Releasing 1.8.12

Updated the 18 build version to 20100327
Automatic installer.php lang files by installer_builder (20100327)
2010-03-27 16:46:54 +00:00 · 2010-03-27 00:44:48 +00:00 · 2010-03-27 00:41:21 +00:00 · 2010-03-26 00:44:56 +00:00 · 2010-03-25 00:44:52 +00:00 · 2010-03-24 08:27:25 +00:00
1782 changed files with 95517 additions and 81408 deletions
@@ -0,0 +1,339 @@
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+		    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+			    NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
+
+	    How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.
@@ -7,117 +7,122 @@
 *
 */

-require_once dirname(dirname(__FILE__)) . '/config.php';
-require_once $CFG->libdir . '/tablelib.php';
+require_once('../config.php');
 require_once($CFG->libdir.'/adminlib.php');
+require_once($CFG->libdir.'/tablelib.php');

 $adminroot = admin_get_root();
 admin_externalpage_setup('userauthentication', $adminroot);

+$action = optional_param('action', '', PARAM_ACTION);
+$auth   = optional_param('auth', '', PARAM_SAFEDIR);
+
 // get currently installed and enabled auth plugins
 $authsavailable = get_list_of_plugins('auth');
-if (empty($CFG->auth_plugins_enabled)) {
-    set_config('auth_plugins_enabled', $CFG->auth);
-    $CFG->auth_plugins_enabled = $CFG->auth;
-}
-$authsenabled = explode(',', $CFG->auth_plugins_enabled);

-// save form
-if ($form = data_submitted()) {
-
-    if (!confirm_sesskey()) {
-        error(get_string('confirmsesskeybad', 'error'));
-    }
-
-    if (! isset($form->guestloginbutton)) {
-        $form->guestloginbutton = 1;
-    }
-    if (empty($form->alternateloginurl)) {
-        $form->alternateloginurl = '';
-    }
-    if (empty($form->register)) {
-        $form->register = 'manual';
-    }
-    set_config('guestloginbutton', $form->guestloginbutton);
-    set_config('alternateloginurl', $form->alternateloginurl);
-    set_config('auth', $form->register);
-
-    // add $CFG->auth to auth_plugins_enabled list
-    if (!array_search($form->register, $authsenabled)) {
-        $authsenabled[] = $form->register;
-        $authsenabled = array_unique($authsenabled);
-        set_config('auth_plugins_enabled', implode(',', $authsenabled));
-    }
+//revert auth_plugins_enabled
+if (isset($CFG->auth_plugins_enabled)) {
+    set_config('auth', $CFG->auth_plugins_enabled);
+    delete_records('config', 'name', 'auth_plugins_enabled');
+    unset($CFG->auth_plugins_enabled);
+}
+
+get_enabled_auth_plugins(true); // fix the list of enabled auths
+if (empty($CFG->auth)) {
+    $authsenabled = array();
+} else {
+    $authsenabled = explode(',', $CFG->auth);
+}
+
+if (!isset($CFG->registerauth)) {
+    set_config('registerauth', '');
+}
+
+if (!isset($CFG->auth_instructions)) {
+    set_config('auth_instructions', '');
+}
+
+if (!empty($auth) and !exists_auth_plugin($auth)) {
+    error(get_string('pluginnotinstalled', 'auth', $auth), $url);
 }

-// grab GET/POST parameters
-$params = new object();
-$params->action    = optional_param('action', '', PARAM_ACTION);
-$params->auth      = optional_param('auth', $CFG->auth, PARAM_ALPHANUM);

 ////////////////////////////////////////////////////////////////////////////////
 // process actions

-switch ($params->action) {
+$status = '';
+
+switch ($action) {
+
+    case 'save':
+        if (data_submitted() and confirm_sesskey()) {
+
+            // save settings
+            set_config('guestloginbutton', required_param('guestloginbutton', PARAM_BOOL));
+            set_config('alternateloginurl', stripslashes(trim(required_param('alternateloginurl', PARAM_RAW))));
+            set_config('registerauth', required_param('register', PARAM_SAFEDIR));
+            set_config('auth_instructions', stripslashes(trim(required_param('auth_instructions', PARAM_RAW))));
+
+            // enable registerauth in $CFG->auth if needed
+            if (!empty($CFG->registerauth) and !in_array($CFG->registerauth, $authsenabled)) {
+                $authsenabled[] = $CFG->registerauth;
+                set_config('auth', implode(',', $authsenabled));
+            }
+            $status = get_string('changessaved');
+        }
+        break;

    case 'disable':
-        // remove from enabled list 
-        $key = array_search($params->auth, $authsenabled);
-        if ($key !== false and $params->auth != $CFG->auth) {
+        // remove from enabled list
+        $key = array_search($auth, $authsenabled);
+        if ($key !== false) {
            unset($authsenabled[$key]);
-            set_config('auth_plugins_enabled', implode(',', $authsenabled));
+            set_config('auth', implode(',', $authsenabled));
+        }
+
+        if ($auth == $CFG->registerauth) {
+            set_config('registerauth', '');
        }
        break;
-        
+
    case 'enable':
-        // check auth plugin is valid first
-        if (!exists_auth_plugin($params->auth)) {
-            error(get_string('pluginnotinstalled', 'auth', $params->auth), $url);
-        }
        // add to enabled list
-        if (!array_search($params->auth, $authsenabled)) {
-            $authsenabled[] = $params->auth;
+        if (!in_array($auth, $authsenabled)) {
+            $authsenabled[] = $auth;
            $authsenabled = array_unique($authsenabled);
-            set_config('auth_plugins_enabled', implode(',', $authsenabled));
+            set_config('auth', implode(',', $authsenabled));
        }
        break;
-        
+
    case 'down':
-        $key = array_search($params->auth, $authsenabled);
+        $key = array_search($auth, $authsenabled);
        // check auth plugin is valid
        if ($key === false) {
-            error(get_string('pluginnotenabled', 'auth', $params->auth), $url);
+            error(get_string('pluginnotenabled', 'auth', $auth), $url);
        }
        // move down the list
        if ($key < (count($authsenabled) - 1)) {
            $fsave = $authsenabled[$key];
            $authsenabled[$key] = $authsenabled[$key + 1];
            $authsenabled[$key + 1] = $fsave;
-            set_config('auth_plugins_enabled', implode(',', $authsenabled));
+            set_config('auth', implode(',', $authsenabled));
        }
        break;
-        
+
    case 'up':
-        $key = array_search($params->auth, $authsenabled);
+        $key = array_search($auth, $authsenabled);
        // check auth is valid
        if ($key === false) {
-            error(get_string('pluginnotenabled', 'auth', $params->auth), $url);
+            error(get_string('pluginnotenabled', 'auth', $auth), $url);
        }
        // move up the list
        if ($key >= 1) {
            $fsave = $authsenabled[$key];
            $authsenabled[$key] = $authsenabled[$key - 1];
            $authsenabled[$key - 1] = $fsave;
-            set_config('auth_plugins_enabled', implode(',', $authsenabled));
+            set_config('auth', implode(',', $authsenabled));
        }
        break;
-        
-    case 'save':
-        // save settings
-        set_config('auth_plugins_enabled', implode(',', $authsenabled));
-        set_config('auth', $authsenabled[0]);
-        redirect("auth.php?sesskey=$USER->sesskey", get_string('changessaved'), 1);
-        break;

    default:
        break;
@@ -132,43 +137,64 @@ $txt->updown = "$txt->up/$txt->down";
 // construct the display array, with enabled auth plugins at the top, in order
 $displayauths = array();
 $registrationauths = array();
-$registrationauths['manual'] = $txt->disable;
+$registrationauths[''] = $txt->disable;
 foreach ($authsenabled as $auth) {
-    $displayauths[$auth] = get_string("auth_{$auth}title", 'auth');
    $authplugin = get_auth_plugin($auth);
-    if (method_exists($authplugin, 'user_signup')) {
-        $registrationauths[$auth] = get_string("auth_{$auth}title", 'auth');
-    }    
+/// Get the auth title (from core or own auth lang files)
+    $authtitle = get_string("auth_{$auth}title", "auth");
+    if ($authtitle == "[[auth_{$auth}title]]") {
+        $authtitle = get_string("auth_{$auth}title", "auth_{$auth}");
+    }
+/// Apply titles
+    $displayauths[$auth] = $authtitle;
+    if ($authplugin->can_signup()) {
+        $registrationauths[$auth] = $authtitle;
+    }
 }
+
 foreach ($authsavailable as $auth) {
-    if (!array_key_exists($auth, $displayauths)) {
-        $displayauths[$auth] = get_string("auth_{$auth}title", 'auth');
+    if (array_key_exists($auth, $displayauths)) {
+        continue; //already in the list
    }
    $authplugin = get_auth_plugin($auth);
-    if (method_exists($authplugin, 'user_signup')) {
-        $registrationauths[$auth] = get_string("auth_{$auth}title", 'auth');
-    }    
+/// Get the auth title (from core or own auth lang files)
+    $authtitle = get_string("auth_{$auth}title", "auth");
+    if ($authtitle == "[[auth_{$auth}title]]") {
+        $authtitle = get_string("auth_{$auth}title", "auth_{$auth}");
+    }
+/// Apply titles
+    $displayauths[$auth] = $authtitle;
+    if ($authplugin->can_signup()) {
+        $registrationauths[$auth] = $authtitle;
+    }
 }

 // build the display table
 $table = new flexible_table('auth_admin_table');
 $table->define_columns(array('name', 'enable', 'order', 'settings'));
-$table->column_style('enable', 'text-align', 'center');
-$table->column_style('order', 'text-align', 'center');
-$table->column_style('settings', 'text-align', 'center');
 $table->define_headers(array($txt->name, $txt->enable, $txt->updown, $txt->settings));
 $table->define_baseurl("{$CFG->wwwroot}/{$CFG->admin}/auth.php");
 $table->set_attribute('id', 'blocks');
-$table->set_attribute('class', 'flexible generaltable generalbox');
-$table->set_attribute('style', 'margin:auto;');
-$table->set_attribute('cellpadding', '5');
+$table->set_attribute('class', 'generaltable generalbox boxaligncenter boxwidthwide');
 $table->setup();

+//add always enabled plugins first
+$displayname = "<span>".$displayauths['manual']."</span>";
+$settings = "<a href=\"auth_config.php?sesskey={$USER->sesskey}&amp;auth=manual\">{$txt->settings}</a>";
+$table->add_data(array($displayname, '', '', $settings));
+$displayname = "<span>".$displayauths['nologin']."</span>";
+$settings = "<a href=\"auth_config.php?sesskey={$USER->sesskey}&amp;auth=nologin\">{$txt->settings}</a>";
+$table->add_data(array($displayname, '', '', $settings));
+
+
 // iterate through auth plugins and add to the display table
 $updowncount = 1;
 $authcount = count($authsenabled);
 $url = "auth.php?sesskey=" . sesskey();
 foreach ($displayauths as $auth => $name) {
+    if ($auth == 'manual' or $auth == 'nologin') {
+        continue;
+    }
    // hide/show link
    if (in_array($auth, $authsenabled)) {
        $hideshow = "<a href=\"$url&amp;action=disable&amp;auth=$auth\">";
@@ -204,7 +230,7 @@ foreach ($displayauths as $auth => $name) {
        }
        ++ $updowncount;
    }
-    
+
    // settings link
    $settings = "<a href=\"auth_config.php?sesskey={$USER->sesskey}&amp;auth=$auth\">{$txt->settings}</a>";

@@ -214,65 +240,75 @@ foreach ($displayauths as $auth => $name) {

 // output form
 admin_externalpage_print_header($adminroot);
+
+//print stus messages
+if ($status !== '') {
+    notify($status, 'notifysuccess');
+}
+
 print_simple_box(get_string('configauthenticationplugins', 'admin'), 'center', '700');

-echo "<form $CFG->frametarget id=\"authmenu\" method=\"post\" action=\"auth.php\">";
-echo "<fieldset class=\"invisiblefieldset\"><input type=\"hidden\" name=\"sesskey\" value=\"".$USER->sesskey."\" /></fieldset>";
-print_table($table);
+$table->print_html();

 ////////////////////////////////////////////////////////////////////////////////

+$guestoptions = array();
 $guestoptions[0] = get_string("hide");
 $guestoptions[1] = get_string("show");

 echo '<hr />';
+
+echo '<form '.$CFG->frametarget.' id="adminsettings" method="post" action="auth.php">';
+echo '<div class="settingsform">';
 print_heading(get_string('auth_common_settings', 'auth'));
-echo '<table cellspacing="0" cellpadding="5" border="0" style="margin-left:auto;margin-right:auto">';
+echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
+echo '<input type="hidden" name="action" value="save" />';
+echo '<fieldset>';
+##echo '<table cellspacing="0" cellpadding="5" border="0" style="margin-left:auto;margin-right:auto">';

 // User self registration
-echo "<tr valign=\"top\">\n";
-echo "<td align=\"right\" style=\"white-space:nowrap\">\n";
-print_string("selfregistration", "auth");
-echo ":</td>\n";
-echo "<td>\n";
-choose_from_menu($registrationauths, "register", $CFG->auth, "");
-echo "</td>\n";
-echo "<td>\n";
-print_string("selfregistration_help", "auth");
-echo "</td></tr>\n";
+echo '<div class="form-item" id="admin-register">';
+echo '<label for = "menuregister">' . get_string("selfregistration", "auth");
+echo '<span class="form-shortname">registerauth</span>';
+echo '</label>';
+choose_from_menu($registrationauths, "register", $CFG->registerauth, "");
+echo '<div class="description">' . get_string("selfregistration_help", "auth") . '</div>';
+echo '</div>';

 // Login as guest button enabled
-echo "<tr valign=\"top\">\n";
-echo "<td style=\"white-space:nowrap;text-align:right\">\n";
-print_string("guestloginbutton", "auth");
-echo ":</td>\n";
-echo "<td>\n";
+echo '<div class="form-item" id="admin-guestloginbutton">';
+echo '<label for = "menuguestloginbutton">' . get_string("guestloginbutton", "auth");
+echo '<span class="form-shortname">guestloginbutton</span>';
+echo '</label>';
 choose_from_menu($guestoptions, "guestloginbutton", $CFG->guestloginbutton, "");
-echo "</td>\n";
-echo "<td>\n";
-print_string("showguestlogin","auth");
-echo "</td></tr>\n";
+echo '<div class="description">' . get_string("showguestlogin", "auth") . '</div>';
+echo '</div>';

 /// An alternate url for the login form. It means we can use login forms that are integrated
 /// into non-moodle pages
-echo "<tr valign=\"top\">\n";
-echo "<td align=\"right\" style=\"white-space:nowrap\">\n";
-print_string('alternateloginurl', 'auth');
-echo "</td>\n";
-echo "<td>\n";
-echo '<input type="text" size="40" name="alternateloginurl" alt="'.get_string('alternateloginurl', 'auth').'" value="'.$CFG->alternateloginurl."\" />\n";
-echo "</td>\n";
-echo "<td>\n";
-print_string('alternatelogin', 'auth', htmlspecialchars($CFG->wwwroot.'/login/index.php'));
-echo "</td>\n";
-echo "</tr>\n";
+echo '<div class="form-item" id="admin-alternateloginurl">';
+echo '<label for = "alternateloginurl">' . get_string("alternateloginurl", "auth");
+echo '<span class="form-shortname">alternateloginurl</span>';
+echo '</label>';
+echo '<input type="text" size="60" name="alternateloginurl" id="alternateloginurl" value="'.$CFG->alternateloginurl."\" />\n";
+echo '<div class="description">' . get_string("alternatelogin", "auth", htmlspecialchars($CFG->wwwroot.'/login/index.php')) . '</div>';
+echo '</div>';

-echo "</table>\n";
+/// Instructions about login/password
+/// to be showed to users
+echo '<div class="form-item" id="admin-auth_instructions">';
+echo '<label for = "auth_instructions">' . get_string("instructions", "auth");
+echo '<span class="form-shortname">auth_instructions</span>';
+echo '</label>';
+echo '<textarea cols="30" rows="4" name="auth_instructions" id="auth_instructions">'.s($CFG->auth_instructions)."</textarea>\n";
+echo '<div class="description">' . get_string("authinstructions", "auth") . '</div>';
+echo '</div>';
+
+echo '</fieldset>';

 ////////////////////////////////////////////////////////////////////////////////
-
-
-echo '<div style="text-align:center"><input type="submit" value="'.get_string('savechanges').'" /></div>';
+echo '<div class="form-buttons"><input class="form-submit" type="submit" value="'.get_string('savechanges', 'admin').'" /></div>';
+echo '</div>';
 echo '</form>';
 admin_externalpage_print_footer($adminroot);

@@ -2,13 +2,14 @@
 /**
 * Edit configuration for an individual auth plugin
 */
- 
+
 require_once '../config.php';
 require_once $CFG->libdir.'/adminlib.php';

 $adminroot = admin_get_root();
 admin_externalpage_setup('userauthentication', $adminroot);
-$auth = optional_param('auth', '', PARAM_SAFEDIR);
+$auth = required_param('auth', PARAM_SAFEDIR);
+$CFG->pagepath = 'auth/' . $auth;
 $authplugin = get_auth_plugin($auth);
 $err = array();

@@ -19,9 +20,9 @@ if ($frm = data_submitted()) {
        error(get_string('confirmsesskeybad', 'error'));
    }

-    if (method_exists($authplugin, 'validate_form')) {
-        $authplugin->validate_form($frm, $err);
-    }
+    $frm = stripslashes_recursive($frm);
+
+    $authplugin->validate_form($frm, $err);

    if (count($err) == 0) {

@@ -33,49 +34,56 @@ if ($frm = data_submitted()) {
                if (preg_match('/^lockconfig_(.+?)$/', $name, $matches)) {
                    $plugin = "auth/$auth";
                    $name   = $matches[1];
-                    if (!set_config($name, $value, $plugin)) {                        
-                        notify("Problem saving config $name as $value for plugin $plugin");
+                    if (!set_config($name, $value, $plugin)) {
+                        error("Problem saving config $name as $value for plugin $plugin");
                    }
                }
            }
-            redirect("auth.php?sesskey=$USER->sesskey", get_string("changessaved"), 1);
+            redirect("auth.php");
            exit;
        }
    } else {
        foreach ($err as $key => $value) {
            $focus = "form.$key";
        }
-    }    
+    }
 } else {
    $frm = get_config("auth/$auth");
 }

-$user_fields = array("firstname", "lastname", "email", "phone1", "phone2", "department", "address", "city", "country", "description", "idnumber", "lang");
+$user_fields = array("firstname", "lastname", "email", "phone1", "phone2", "institution", "department", "address", "city", "country", "description", "idnumber", "lang");

-$modules = get_list_of_plugins('auth');
-foreach ($modules as $module) {
-    $options[$module] = get_string("auth_{$module}title", 'auth');
-}
-asort($options);
+/// Get the auth title (from core or own auth lang files)
+    $authtitle = get_string("auth_{$auth}title", "auth");
+    if ($authtitle == "[[auth_{$auth}title]]") {
+        $authtitle = get_string("auth_{$auth}title", "auth_{$auth}");
+    }
+/// Get the auth descriptions (from core or own auth lang files)
+    $authdescription = get_string("auth_{$auth}description", "auth");
+    if ($authdescription == "[[auth_{$auth}description]]") {
+        $authdescription = get_string("auth_{$auth}description", "auth_{$auth}");
+    }

 // output configuration form
 admin_externalpage_print_header($adminroot);

 // choose an authentication method
 echo "<form $CFG->frametarget id=\"authmenu\" method=\"post\" action=\"auth_config.php\">\n";
+echo "<div>\n";
 echo "<input type=\"hidden\" name=\"sesskey\" value=\"".$USER->sesskey."\" />\n";
 echo "<input type=\"hidden\" name=\"auth\" value=\"".$auth."\" />\n";

 // auth plugin description
 print_simple_box_start('center', '80%');
-print_heading($options[$auth]);
-print_simple_box_start('center', '60%', '', 5, 'informationbox');
-print_string("auth_{$auth}description", 'auth');
+print_heading($authtitle);
+print_simple_box_start('center', '80%', '', 5, 'informationbox');
+echo $authdescription;
 print_simple_box_end();
 echo "<hr />\n";
-$authplugin->config_form($frm, $err);
+$authplugin->config_form($frm, $err, $user_fields);
 print_simple_box_end();
-echo '<center><p><input type="submit" value="' . get_string("savechanges") . "\" /></p></center>\n";
+echo '<p style="text-align: center"><input type="submit" value="' . get_string("savechanges") . "\" /></p>\n";
+echo "</div>\n";
 echo "</form>\n";

 admin_externalpage_print_footer($adminroot);
@@ -86,7 +94,7 @@ exit;
 // Good enough for most auth plugins
 // but some may want a custom one if they are offering
 // other options
-// Note: lockconfig_ fields have special handling. 
+// Note: lockconfig_ fields have special handling.
 function print_auth_lock_options ($auth, $user_fields, $helptext, $retrieveopts, $updateopts) {

    echo '<tr><td colspan="3">';
@@ -104,7 +112,7 @@ function print_auth_lock_options ($auth, $user_fields, $helptext, $retrieveopts,
                                'onlogin'   => get_string('update_onlogin', 'auth'));
    $updateextoptions = array('0'  => get_string('update_never', 'auth'),
                              '1'   => get_string('update_onupdate', 'auth'));
-    
+
    $pluginconfig = get_config("auth/$auth");

    // helptext is on a field with rowspan
@@ -138,30 +146,32 @@ function print_auth_lock_options ($auth, $user_fields, $helptext, $retrieveopts,
            $fieldname = get_string($fieldname);
        }

-        echo '<tr valign="top"><td align="right">';
-        echo $fieldname;
-        echo '</td><td>';
-
        if ($retrieveopts) {
            $varname = 'field_map_' . $field;

-            echo "<input name=\"lockconfig_{$varname}\" type=\"text\" size=\"30\" value=\"{$pluginconfig->$varname}\" />";
-            echo '<div align="right">';
-            echo  get_string('auth_updatelocal', 'auth') . '&nbsp;&nbsp;';
+            echo '<tr valign="top"><td align="right">';
+            echo '<label for="lockconfig_'.$varname.'">'.$fieldname.'</label>';
+            echo '</td><td>';
+
+            echo "<input id=\"lockconfig_{$varname}\" name=\"lockconfig_{$varname}\" type=\"text\" size=\"30\" value=\"{$pluginconfig->$varname}\" />";
+            echo '<div style="text-align: right">';
+            echo '<label for="menulockconfig_field_updatelocal_'.$field.'">'.get_string('auth_updatelocal', 'auth') . '</label>&nbsp;';
            choose_from_menu($updatelocaloptions, "lockconfig_field_updatelocal_{$field}", $pluginconfig->{"field_updatelocal_$field"}, "");
            echo '<br />';
            if ($updateopts) {
-                echo  get_string('auth_updateremote', 'auth') . '&nbsp;&nbsp;';
-                 '&nbsp;&nbsp;';
+                echo '<label for="menulockconfig_field_updateremote_'.$field.'">'.get_string('auth_updateremote', 'auth') . '</label>&nbsp;';
                choose_from_menu($updateextoptions, "lockconfig_field_updateremote_{$field}", $pluginconfig->{"field_updateremote_$field"}, "");
                echo '<br />';


            }
-            echo  get_string('auth_fieldlock', 'auth') . '&nbsp;&nbsp;';
+            echo '<label for="menulockconfig_field_lock_'.$field.'">'.get_string('auth_fieldlock', 'auth') . '</label>&nbsp;';
            choose_from_menu($lockoptions, "lockconfig_field_lock_{$field}", $pluginconfig->{"field_lock_$field"}, "");
            echo '</div>';
        } else {
+            echo '<tr valign="top"><td align="right">';
+            echo '<label for="menulockconfig_field_lock_'.$field.'">'.$fieldname.'</label>';
+            echo '</td><td>';
            choose_from_menu($lockoptions, "lockconfig_field_lock_{$field}", $pluginconfig->{"field_lock_$field"}, "");
        }
        echo '</td>';
@@ -59,7 +59,7 @@

    print_heading($strblockname);

-    print_simple_box('<center>'.get_string('configwarning', 'admin').'</center>', 'center', '50%');
+    print_simple_box(get_string('configwarning', 'admin'), 'center', '50%');
    echo '<br />';

    echo '<form method="post" action="block.php">';
@@ -17,7 +17,6 @@
    $delete   = optional_param('delete', 0, PARAM_INT);
    $multiple = optional_param('multiple', 0, PARAM_INT);

-
 /// Print headings

    $strmanageblocks = get_string('manageblocks');
@@ -29,6 +28,7 @@
    $strcourses = get_string('blockinstances', 'admin');
    $strname = get_string('name');
    $strmultiple = get_string('blockmultiple', 'admin');
+    $strshowblockcourse = get_string('showblockcourse');

    admin_externalpage_print_header($adminroot);

@@ -54,7 +54,7 @@
        if (!$block = blocks_get_record($multiple)) {
            error("Block doesn't exist!");
        }
-        $block->multiple = !$block->multiple;
+        $block->multiple = intval(!$block->multiple);
        update_record('block', $block);
    }

@@ -165,11 +165,8 @@
    $table->define_columns(array('name', 'instances', 'version', 'hideshow', 'multiple', 'delete', 'settings'));
    $table->define_headers(array($strname, $strcourses, $strversion, $strhide.'/'.$strshow, $strmultiple, $strdelete, $strsettings));
    $table->define_baseurl($CFG->wwwroot.'/'.$CFG->admin.'/blocks.php');
-
-    $table->set_attribute('cellspacing', '0');
    $table->set_attribute('id', 'blocks');
-    $table->set_attribute('class', 'generaltable generalbox');
-
+    $table->set_attribute('class', 'generaltable generalbox boxaligncenter boxwidthwide');
    $table->setup();

    foreach ($blockbyname as $blockname => $blockid) {
@@ -182,8 +179,20 @@
        if($blockobject->has_config()) {
            $settings = '<a href="block.php?block='.$blockid.'">'.$strsettings.'</a>';
        }
-
-        $count = count_records('block_instance', 'blockid', $blockid);
+       
+        // MDL-11167, blocks can be placed on mymoodle, or the blogs page
+        // and it should not show up on course search page
+        $count = count_records_sql('SELECT COUNT(*) 
+                                        FROM '.$CFG->prefix.'block_instance 
+                                        WHERE blockid = '.$blockid.' AND
+                                        pagetype = \'course-view\'');
+        if ($count>0) {
+            $blocklist = "<a href=\"{$CFG->wwwroot}/course/search.php?blocklist=$blockid&amp;sesskey={$USER->sesskey}\" ";
+            $blocklist .= "title=\"$strshowblockcourse\" >$count</a>";
+        }
+        else {
+            $blocklist = "$count";
+        }
        $class = ''; // Nothing fancy, by default

        if ($blocks[$blockid]->visible) {
@@ -208,8 +217,8 @@

        $table->add_data(array(
            '<span'.$class.'>'.$blockobject->get_title().'</span>',
-            $count,
-            $blockobject->get_version(),
+            $blocklist,
+            '<span'.$class.'>'.$blockobject->get_version().'</span>',
            $visible,
            $multiple,
            $delete,
@@ -228,9 +237,8 @@
        $table->define_headers(array($strname, $strdelete));
        $table->define_baseurl($CFG->wwwroot.'/'.$CFG->admin.'/blocks.php');

-        $table->set_attribute('cellspacing', '0');
        $table->set_attribute('id', 'incompatible');
-        $table->set_attribute('class', 'generaltable generalbox');
+        $table->set_attribute('class', 'generaltable generalbox boxaligncenter boxwidthwide');

        $table->setup();

@@ -98,11 +98,21 @@
                $cron_function = $mod->name."_cron";
                if (function_exists($cron_function)) {
                    mtrace("Processing module function $cron_function ...", '');
+                    if (!empty($PERF->dbqueries)) {
+                        $pre_dbqueries = $PERF->dbqueries;
+                        $pre_time      = microtime(1);
+                    }
                    if ($cron_function()) {
                        if (! set_field("modules", "lastcron", $timenow, "id", $mod->id)) {
                            mtrace("Error: could not update timestamp for $mod->fullname");
                        }
                    }
+                    if (isset($pre_dbqueries)) {
+                        mtrace("... used " . ($PERF->dbqueries - $pre_dbqueries) . " dbqueries");
+                        mtrace("... used " . (microtime(1) - $pre_time) . " seconds");
+                    }
+                /// Reset possible changes by modules to time_limit. MDL-11597
+                    @set_time_limit(0);
                    mtrace("done.");
                }
            }
@@ -127,17 +137,46 @@
                            mtrace('Error: could not update timestamp for '.$block->name);
                        }
                    }
+                /// Reset possible changes by blocks to time_limit. MDL-11597
+                    @set_time_limit(0);
                    mtrace('done.');
                }
            }

        }
    }
-    mtrace("Finished blocks");
+    mtrace('Finished blocks');

    if (!empty($CFG->langcache)) {
        mtrace('Updating languages cache');
-        get_list_of_languages();
+        get_list_of_languages(true);
+    }
+
+    mtrace('Removing expired enrolments ...', '');     // See MDL-8785
+    $timenow = time();
+    $somefound = false;
+    // The preferred way saves memory, dmllib.php
+    // find courses where limited enrolment is enabled
+    global $CFG;
+    $rs_enrol = get_recordset_sql("SELECT ra.roleid, ra.userid, ra.contextid
+        FROM {$CFG->prefix}course c
+        INNER JOIN {$CFG->prefix}context cx ON cx.instanceid = c.id
+        INNER JOIN {$CFG->prefix}role_assignments ra ON ra.contextid = cx.id
+        WHERE cx.contextlevel = '".CONTEXT_COURSE."'
+        AND ra.timeend > 0
+        AND ra.timeend < '$timenow'
+        AND c.enrolperiod > 0
+        ");
+    mtrace($rs_enrol->RecordCount().' to delete');
+    while ($oldenrolment = rs_fetch_next_record($rs_enrol)) {
+        role_unassign($oldenrolment->roleid, $oldenrolment->userid, 0, $oldenrolment->contextid);
+        $somefound = true;
+    }
+    rs_close($rs_enrol);
+    if($somefound) {
+        mtrace('Done');
+    } else {
+        mtrace('none found');
    }


@@ -159,7 +198,7 @@
                foreach ($assigns as $assign) {
                    if ($context = get_context_instance(CONTEXT_COURSE, $assign->courseid)) {
                        if (role_unassign(0, $assign->id, 0, $context->id)) {
-                            mtrace("Deleted assignment for user $assign->id from course $assign->courseid");
+                            mtrace("removing user $assign->id from course $assign->courseid as they have not accessed the course for over $CFG->longtimenosee days");
                        }
                    }
                }
@@ -185,8 +224,8 @@

        /// Delete users who haven't completed profile within required period

-        if (!empty($CFG->deleteunconfirmed)) {
-            $oneweek = $timenow - ($CFG->deleteunconfirmed * 3600);
+        if (!empty($CFG->deleteincompleteusers)) {
+            $cuttime = $timenow - ($CFG->deleteincompleteusers * 3600);
            if ($users = get_users_not_fully_set_up($oneweek)) {
                foreach ($users as $user) {
                    if (delete_records('user', 'id', $user->id)) {
@@ -233,7 +272,7 @@
                                                p.id as prefid 
                                        FROM {$CFG->prefix}user u 
                                             JOIN {$CFG->prefix}user_preferences p ON u.id=p.userid
-                                        WHERE p.name='create_password' AND p.value=1 AND u.email !='' ");
+                                        WHERE p.name='create_password' AND p.value='1' AND u.email !='' ");

            foreach ($newusers as $newuserid => $newuser) {
                $newuser->emailstop = 0; // send email regardless
@@ -254,7 +293,7 @@
        //Execute backup's cron
        //Perhaps a long time and memory could help in large sites
        @set_time_limit(0);
-        @raise_memory_limit("196M");
+        @raise_memory_limit("192M");
        if (function_exists('apache_child_terminate')) {
            // if we are running from Apache, give httpd a hint that 
            // it can recycle the process after it's done. Apache's 
@@ -307,9 +346,8 @@
    }

 /// Run the auth cron, if any
-    if (!($auths = explode(',', $CFG->auth_plugins_enabled))) {
-        $auths = array($user->auth);
-    }
+    $auths = get_enabled_auth_plugins();
+
    mtrace("Running auth crons if required...");
    foreach ($auths as $auth) {
        $authplugin = get_auth_plugin($auth);
@@ -326,7 +364,7 @@
    if (!empty($CFG->enablestats) and empty($CFG->disablestatsprocessing)) {

        // check we're not before our runtime
-        $timetocheck = strtotime("$CFG->statsruntimestarthour:$CFG->statsruntimestartminute today");
+        $timetocheck = strtotime("today $CFG->statsruntimestarthour:$CFG->statsruntimestartminute");

        if (time() > $timetocheck) {
            $time = 60*60*20; // set it to 20 here for first run... (overridden by $CFG)
@@ -54,7 +54,7 @@ function delete_subdirectories($rootdir) {

    $dir = opendir($rootdir);

-    while ($file = readdir($dir)) {
+    while (false !== ($file = readdir($dir))) {
        if ($file != '.' and $file != '..') {
            $fullfile = $rootdir .'/'. $file;
            if (filetype($fullfile) == 'dir') {
@@ -80,7 +80,6 @@
        <FEEDBACK>
          <ON_ERROR message="mysql416required" />
        </FEEDBACK>
-        <BYPASS function="bypass_mysql416_reqs" message="mysql416bypassed" />
      </VENDOR>
      <VENDOR name="postgres" version="7.4" />
      <VENDOR name="mssql" version="9.0" />
@@ -117,6 +116,186 @@
          <ON_CHECK message="tokenizerrecommended" />
        </FEEDBACK>
      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="ctyperecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
    </PHP_EXTENSIONS>
  </MOODLE>
+  <MOODLE version="1.9">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mysql" version="4.1.16">
+        <FEEDBACK>
+          <ON_ERROR message="mysql416required" />
+        </FEEDBACK>
+      </VENDOR>
+      <VENDOR name="postgres" version="8.0" />
+      <VENDOR name="mssql" version="9.0" />
+      <VENDOR name="odbc_mssql" version="9.0" />
+      <VENDOR name="mssql_n" version="9.0" />
+      <VENDOR name="oracle" version="9.0" />
+    </DATABASE>
+    <PHP version="4.3.0" level="required">
+      <RESTRICT function="restrict_php50_version" message="php50restricted" />
+    </PHP>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="iconvrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="curlrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opensslrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="ctyperecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+    </PHP_EXTENSIONS>
+    <CUSTOM_CHECKS>
+      <CUSTOM_CHECK file="question/upgrade.php" function="question_check_no_rqp_questions" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="qtyperqpwillberemovedanyway" />
+          <ON_OK message="qtyperqpwillberemoved" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="question/upgrade.php" function="question_random_check" level="optional">
+        <FEEDBACK>
+          <ON_OK message="questioncwqpfsok" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/customcheckslib.php" function="php_check_register_globals" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="globalswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+    </CUSTOM_CHECKS>
+  </MOODLE>
+  <MOODLE version="2.0" requires="1.9">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mysql" version="5.0.25">
+        <FEEDBACK>
+          <ON_ERROR message="mysql416required" />
+        </FEEDBACK>
+      </VENDOR>
+      <VENDOR name="postgres" version="8.3" />
+      <VENDOR name="mssql" version="9.0" />
+      <VENDOR name="odbc_mssql" version="9.0" />
+      <VENDOR name="mssql_n" version="9.0" />
+      <VENDOR name="oracle" version="10.0" />
+      <VENDOR name="sqlite" version="2.0" />
+    </DATABASE>
+    <PHP version="5.2.8" level="required">
+    </PHP>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="iconvrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opensslrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="gdrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="40M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="safe_mode" value="0" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingsafemode" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+    <CUSTOM_CHECKS>
+    </CUSTOM_CHECKS>
+  </MOODLE>
 </COMPATIBILITY_MATRIX>
@@ -59,10 +59,10 @@
            // run through submitted data
            // reject if does not start with filter_
            foreach ($config as $name => $value) {
-                set_config( $name,$value );
+                set_config($name, stripslashes($value));
            }
        }
-        redirect( "$CFG->wwwroot/$CFG->admin/filters.php", get_string('changessaved'), 1);
+        redirect("$CFG->wwwroot/$CFG->admin/filters.php");
        exit;
    }

@@ -74,21 +74,21 @@
    admin_externalpage_print_header($adminroot);
    print_heading( $filtername );

-    print_simple_box("<center>".get_string("configwarning", "admin")."</center>", "center", "50%");
+    print_simple_box(get_string("configwarning", "admin"), "center", "50%");
    echo "<br />";

    print_simple_box_start("center",'');

    ?>
    <form action="filter.php?filter=<?php echo urlencode($param->filter); ?>" method="post">
+    <div style="text-align: center">
    <input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />

    <?php include "$CFG->dirroot/$param->filter/filterconfig.html"; ?>

-    <center>
        <input type="submit" name="submit" value="<?php print_string('savechanges'); ?>" />
        <input type="submit" name="reset" value="<?php echo print_string('resettodefaults'); ?>" />
-    </center>
+    </div>
    </form>

    <?php
@@ -182,15 +182,10 @@
    // construct the flexible table ready to display
    $table = new flexible_table(FILTER_TABLE);
    $table->define_columns(array('name', 'hideshow', 'order', 'settings'));
-    $table->column_style('hideshow', 'text-align', 'center');
-    $table->column_style('order', 'text-align', 'center');
-    $table->column_style('settings', 'text-align', 'center');
    $table->define_headers(array($txt->name, $txt->hideshow, $txt->updown, $txt->settings));
    $table->define_baseurl("$CFG->wwwroot/$CFG->admin/filters.php");
-    $table->set_attribute('id', 'blocks');
-    $table->set_attribute('class', 'flexible generaltable generalbox');
-    $table->set_attribute('style', 'margin:auto;');
-    $table->set_attribute('cellpadding', '5');
+    $table->set_attribute('id', 'filters');
+    $table->set_attribute('class', 'generaltable generalbox boxaligncenter boxwidthwide');
    $table->setup();

    // iterate through filters adding to display table
@@ -0,0 +1,275 @@
+<?php
+
+require_once('../config.php');
+/**
+ * SCRIPT CONFIGURATION
+ */
+$starttimer = time()+microtime();
+
+$settings = array();
+$settings['verbose'] = false;
+$settings['username'] = null;
+$settings['password'] = null;
+$settings['eolchar'] = '<br />'; // Character used to break lines
+
+// Argument arrays: 0=>short name, 1=>long name
+$arguments = array(
+ array('short'=>'u', 'long'=>'username', 'help' => 'Your moodle username', 'type'=>'STRING', 'default' => ''),
+ array('short'=>'pw', 'long'=>'password', 'help' => 'Your moodle password', 'type'=>'STRING', 'default' => ''),
+ array('short'=>'v', 'long' => 'verbose', 'help' => 'Display extra information about the process')
+);
+
+// Building the USAGE output of the command line version
+if (isset($argv) && isset($argc)) {
+    $help = "Moodle User Pix Fix. Restores user profile images that were not properly moved during 1.8.2 upgrade to newer versions.\n\n"
+          . "Usage: {$argv[0]}; [OPTION] ...\n"
+          . "Options:\n"
+          . "  -h,    -?, -help, --help               This output\n";
+
+    foreach ($arguments as $arg_array) {
+        $equal = '';
+        if (!empty($arg_array['type'])) {
+            $equal = "={$arg_array['type']}";
+        }
+
+        $padding1 = 5 - strlen($arg_array['short']);
+        $padding2 = 30 - (strlen($arg_array['long']) + strlen($equal));
+        $paddingstr1 = '';
+        for ($i = 0; $i < $padding1; $i++) {
+            $paddingstr1 .= ' ';
+        }
+        $paddingstr2 = '';
+        for ($i = 0; $i < $padding2; $i++) {
+            $paddingstr2 .= ' ';
+        }
+
+        $help .= "  -{$arg_array['short']},$paddingstr1--{$arg_array['long']}$equal$paddingstr2{$arg_array['help']}\n";
+    }
+
+    $help .= "\nEmail nicolasconnault@gmail.com for any suggestions or bug reports.\n";
+
+    if ($argc == 1 || in_array($argv[1], array('--help', '-help', '-h', '-?'))) {
+        echo $help;
+        die();
+
+    } else {
+
+        $settings['eolchar'] = "\n";
+        $argv = arguments($argv);
+        $argscount = 0;
+
+        foreach ($arguments as $arg_array) {
+            $value = null;
+            if (in_array($arg_array['short'], array_keys($argv))) {
+                $value = $argv[$arg_array['short']];
+                unset($argv[$arg_array['short']]);
+            } elseif (in_array($arg_array['long'], array_keys($argv))) {
+                $value = $argv[$arg_array['long']];
+                unset($argv[$arg_array['long']]);
+            }
+            if (!is_null($value)) {
+                $settings[$arg_array['long']] = $value;
+                $argscount++;
+            }
+        }
+
+        // If some params are left in argv, it means they are not supported
+        if ($argscount == 0 || count($argv) > 0) {
+            echo $help;
+            die();
+        }
+    }
+}
+
+/**
+ * SCRIPT SETUP
+ */
+require_once($CFG->libdir . '/formslib.php');
+require_once($CFG->dirroot .'/course/lib.php');
+verbose("Loading libraries...");
+$systemcontext = get_context_instance(CONTEXT_SYSTEM);
+
+/**
+ * WEB INTERFACE FORM
+ */
+
+class pixfix_form extends moodleform {
+    function definition() {
+        global $arguments;
+        $mform =& $this->_form;
+
+        foreach ($arguments as $arg_array) {
+            $type = 'advcheckbox';
+
+            $label = ucfirst(str_replace('-', ' ', $arg_array['long']));
+            if (!empty($arg_array['type'])) {
+                $type = 'text';
+            }
+
+            if ($arg_array['long'] == 'password' || $arg_array['long'] == 'username') {
+                continue;
+            }
+
+            $mform->addElement($type, $arg_array['long'], $label);
+
+            if (isset($arg_array['default'])) {
+                $mform->setDefault($arg_array['long'], $arg_array['default']);
+            }
+        }
+        $this->add_action_buttons(false, 'Restore Images');
+    }
+
+    function definition_after_data() {
+
+    }
+}
+
+$run_script = true;
+$web_interface = false;
+
+// If eolchar is still <br />, load the web interface
+if ($settings['eolchar'] == '<br />') {
+    print_header("User Pix-Fix");
+    print_heading("User Pix-Fix");
+    $mform = new pixfix_form();
+
+    if ($data = $mform->get_data(false)) {
+        foreach ($arguments as $arg_array) {
+            if (!empty($data->{$arg_array['long']})) {
+                $settings[$arg_array['long']] = $data->{$arg_array['long']};
+            }
+        }
+    } else {
+        $run_script = false;
+    }
+
+    if (!has_capability('moodle/site:doanything', $systemcontext)) {
+        // If not logged in, give link to login page for current site
+        notify("You must be logged in as administrator before using this script.");
+        require_login();
+    } else {
+        $mform->display();
+    }
+
+    $web_interface = true;
+}
+
+if ($run_script) {
+
+    // User authentication
+    if (!$web_interface) {
+        if (empty($settings['username'])) {
+            echo "You must enter a valid username for a moodle administrator account on this site.{$settings['eolchar']}";
+            die();
+        } elseif (empty($settings['password'])) {
+            echo "You must enter a valid password for a moodle administrator account on this site.{$settings['eolchar']}";
+            die();
+        } else {
+            if (!$user = authenticate_user_login($settings['username'], $settings['password'])) {
+                echo "Invalid username or password!{$settings['eolchar']}";
+                die();
+            }
+            $USER = complete_user_login($user);
+            if (!has_capability('moodle/site:doanything', $systemcontext)) {
+                echo "You do not have administration privileges on this Moodle site. These are required for running the restore script.{$settings['eolchar']}";
+                die();
+            }
+        }
+    }
+
+    // Script code here
+
+    // Look for old moodledata/users directory
+    $oldusersdir = $CFG->dataroot . '/users';
+
+    if (!file_exists($oldusersdir)) {
+        notify('The old directory for user profile images ('.$oldusersdir.') does not exist. Pictures cannot be restored!');
+    } else {
+        // Find user profile images that are not yet in the new directory
+        $folders = get_directory_list($oldusersdir, '', false, true, false);
+
+        $restored_count = 0;
+
+        foreach ($folders as $userid) {
+            $olddir = $oldusersdir . '/' . $userid;
+            $files = get_directory_list($olddir);
+
+            if (empty($files)) {
+                continue;
+            }
+
+            // Create new user directory
+            if (!$newdir = make_user_directory($userid)) {
+                // some weird directory - do not stop the upgrade, just ignore it
+                continue;
+            }
+
+            // Move contents of old directory to new one
+            if (file_exists($olddir) && file_exists($newdir)) {
+                $restored = false;
+
+                foreach ($files as $file) {
+                    if (!file_exists($newdir . '/' . $file)) {
+                        copy($olddir . '/' . $file, $newdir . '/' . $file);
+                        verbose("Moved $olddir/$file into $newdir/$file");
+                        $restored = true;
+                    }
+                }
+
+                if ($restored) {
+                    $restored_count++;
+                }
+            } else {
+                notify("Could not move the contents of $olddir into $newdir!");
+                $result = false;
+                break;
+            }
+        }
+
+        if ($settings['eolchar'] == '<br />') {
+            print_box_start('generalbox centerpara');
+        }
+        if ($restored_count > 0) {
+            echo "Successfully restored profile images for $restored_count users!" . $settings['eolchar'];
+        } else {
+            echo "Did not find any user profile images in need of restoring." . $settings['eolchar'];
+        }
+        if ($settings['eolchar'] == '<br />') {
+            print_box_end();
+        }
+    }
+}
+
+if ($settings['eolchar'] == '<br />') {
+    print_footer();
+}
+
+/**
+ * Converts the standard $argv into an associative array taking var=val arguments into account
+ * @param array $argv
+ * @return array $_ARG
+ */
+function arguments($argv) {
+    $_ARG = array();
+    foreach ($argv as $arg) {
+        if (ereg('--?([^=]+)=(.*)',$arg,$reg)) {
+            $_ARG[$reg[1]] = $reg[2];
+        } elseif(ereg('-([a-zA-Z0-9]+)',$arg,$reg)) {
+           $_ARG[$reg[1]] = 'true';
+        }
+    }
+    return $_ARG;
+}
+
+/**
+ * If verbose is switched on, prints a string terminated by the global eolchar string.
+ * @param string $string The string to STDOUT
+ */
+function verbose($string) {
+    global $settings;
+    if ($settings['verbose'] && !$settings['quiet']) {
+        echo $string . $settings['eolchar'];
+    }
+}
+
+?>
@@ -40,7 +40,7 @@ while(!feof($fd)) {
    
    $user = get_record("user","id",$log->userid);
    $course = get_record("course","id",$log->course);
-    $subject = get_string('virusfoundsubject','moodle',$site->fullname);
+    $subject = get_string('virusfoundsubject','moodle',format_string($site->fullname));
    $a->date = userdate($log->time);

    $a->action = $action;
@@ -78,7 +78,7 @@ function notify_admins_unknown($file,$a) {
    global $site;

    $admins = get_admins();
-    $subject = get_string('virusfoundsubject','moodle',$site->fullname);
+    $subject = get_string('virusfoundsubject','moodle',format_string($site->fullname));
    $body = get_string('virusfoundlateradminnolog','moodle',$a);
    foreach ($admins as $admin) {
        email_to_user($admin,$admin,$subject,$body);
@@ -525,11 +525,203 @@ class problem_000011 extends problem_base {
            }
            return 'Error counter was cleared.';
        } else {
-            return '<p>Session errors can be caused by:<ul><li>unresolved problem in server software (aka random switching of users),</li><li>blocked or modified cookies,</li><li>deleting of active session files.</li></ul></p><p><a href="'.me().'&resetsesserrorcounter=1">Reset counter.</a></p>';
+            return '<p>Session errors can be caused by:</p><ul>' .
+            '<li>unresolved problem in server software (aka random switching of users),</li>' .
+            '<li>blocked or modified cookies,</li>' .
+            '<li>deleting of active session files.</li>' .
+            '</ul><p><a href="'.me().'&amp;resetsesserrorcounter=1">Reset counter</a></p>';
        }
    }
 }

+class problem_000012 extends problem_base {
+    function title() {
+        return 'Random questions data consistency';
+    }
+    function exists() {
+        return record_exists_select('question', "qtype = 'random' AND parent <> id");
+    }
+    function severity() {
+        return SEVERITY_ANNOYANCE;
+    }
+    function description() {
+        return '<p>For random questions, question.parent should equal question.id. ' .
+        'There are some questions in your database for which this is not true. ' .
+        'One way that this could have happened is for random questions restored from backup before ' .
+        '<a href="http://tracker.moodle.org/browse/MDL-5482">MDL-5482</a> was fixed.</p>';
+    }
+    function solution() {
+        global $CFG;
+        return '<p>Upgrade to Moodle 1.9.1 or later, or manually execute the SQL</p>' .
+        '<pre>UPDATE ' . $CFG->prefix . 'question SET parent = id WHERE qtype = \'random\' and parent &lt;> id;</pre>';
+    }
+}
+
+class problem_000013 extends problem_base {
+    function title() {
+        return 'Multi-answer questions data consistency';
+    }
+    function exists() {
+        global $CFG;
+        $positionexpr = sql_position(sql_concat("','", "q.id", "','"), 
+                sql_concat("','", "qma.sequence", "','"));
+        return record_exists_sql("
+                SELECT * FROM {$CFG->prefix}question q
+                    JOIN {$CFG->prefix}question_multianswer qma ON $positionexpr > 0
+                WHERE qma.question <> q.parent") ||
+            record_exists_sql("
+                SELECT * FROM {$CFG->prefix}question q
+                    JOIN {$CFG->prefix}question parent_q ON parent_q.id = q.parent
+                WHERE q.category <> parent_q.category");
+    }
+    function severity() {
+        return SEVERITY_ANNOYANCE;
+    }
+    function description() {
+        return '<p>For each sub-question whose id is listed in ' .
+        'question_multianswer.sequence, its question.parent field should equal ' .
+        'question_multianswer.question; and each sub-question should be in the same ' .
+        'category as its parent. There are questions in your database for ' .
+        'which this is not the case. One way that this could have happened is ' .
+        'for multi-answer questions restored from backup before ' .
+        '<a href="http://tracker.moodle.org/browse/MDL-14750">MDL-14750</a> was fixed.</p>';
+    }
+    function solution() {
+        return '<p>Upgrade to Moodle 1.9.1 or later, or manually execute the ' .
+        'code in question_multianswer_fix_subquestion_parents_and_categories in ' .
+        '<a href="http://cvs.moodle.org/moodle/question/type/multianswer/db/upgrade.php?revision=1.1.10.2&amp;view=markup">/question/type/multianswer/db/upgrade.php' .
+        'from the 1.9 stable branch</a>.</p>';
+    }
+}
+
+class problem_000014 extends problem_base {
+    function title() {
+        return 'Only multianswer and random questions should be the parent of another question';
+    }
+    function exists() {
+        global $CFG;
+        return record_exists_sql("
+                SELECT * FROM {$CFG->prefix}question q
+                    JOIN {$CFG->prefix}question parent_q ON parent_q.id = q.parent
+                WHERE parent_q.qtype NOT IN ('random', 'multianswer')");
+    }
+    function severity() {
+        return SEVERITY_ANNOYANCE;
+    }
+    function description() {
+        return '<p>You have questions that violate this in your databse. ' .
+        'You will need to investigate to determine how this happened.</p>';
+    }
+    function solution() {
+        return '<p>It is impossible to give a solution without knowing more about ' .
+        ' how the problem was caused. You may be able to get help from the ' .
+        '<a href="http://moodle.org/mod/forum/view.php?f=121">Quiz forum</a>.</p>';
+    }
+}
+
+class problem_000017 extends problem_base {
+    function title() {
+        return 'Question categories tree structure';
+    }
+    function find_problems() {
+        static $answer = null;
+
+        if (is_null($answer)) {
+            $categories = get_records('question_categories', '', '', 'id');
+
+            // Look for missing parents.
+            $missingparent = array();
+            foreach ($categories as $category) {
+                if ($category->parent != 0 && !array_key_exists($category->parent, $categories)) {
+                    $missingparent[$category->id] = $category;
+                }
+            }
+
+            // Look for loops.
+            $loops = array();
+            while (!empty($categories)) {
+                $current = array_pop($categories);
+                $thisloop = array($current->id => $current);
+                while (true) {
+                    if (isset($thisloop[$current->parent])) {
+                        // Loop detected
+                        $loops[$current->id] = $thisloop;
+                        break;
+                    } else if (!isset($categories[$current->parent])) {
+                        // Got to the top level, or a category we already know is OK.
+                        break;
+                    } else {
+                        // Continue following the path.
+                        $current = $categories[$current->parent];
+                        $thisloop[$current->id] = $current;
+                        unset($categories[$current->id]);
+                    }
+                }
+            }
+
+            $answer = array($missingparent, $loops);
+        }
+
+        return $answer;
+    }
+    function exists() {
+        list($missingparent, $loops) = $this->find_problems();
+        return !empty($missingparent) || !empty($loops);
+    }
+    function severity() {
+        return SEVERITY_ANNOYANCE;
+    }
+    function description() {
+        list($missingparent, $loops) = $this->find_problems();
+
+        $description = '<p>The question categories should be arranged into tree ' .
+                ' structures by the question_categories.parent field. Sometimes ' .
+                ' this tree structure gets messed up.</p>';
+
+        if (!empty($missingparent)) {
+            $description .= '<p>The following categories are missing their parents:</p><ul>';
+            foreach ($missingparent as $cat) {
+                $description .= "<li>Category $cat->id: " . s($cat->name) . "</li>\n";
+            }
+            $description .= "</ul>\n";
+        }
+
+        if (!empty($loops)) {
+            $description .= '<p>The following categories form a loop of parents:</p><ul>';
+            foreach ($loops as $loop) {
+                $description .= "<li><ul>\n";
+                foreach ($loop as $cat) {
+                    $description .= "<li>Category $cat->id: " . s($cat->name) . " has parent $cat->parent</li>\n";
+                }
+                $description .= "</ul></li>\n";
+            }
+            $description .= "</ul>\n";
+        }
+
+        return $description;
+    }
+    function solution() {
+        global $CFG;
+        list($missingparent, $loops) = $this->find_problems();
+
+        $solution = '<p>Consider executing the following SQL queries. These fix ' .
+                'the problem by moving some categories to the top level.</p>';
+
+        if (!empty($missingparent)) {
+            $solution .= "<pre>UPDATE " . $CFG->prefix . "question_categories\n" .
+                    "        SET parent = 0\n" .
+                    "        WHERE id IN (" . implode(',', array_keys($missingparent)) . ");</pre>\n";
+        }
+
+        if (!empty($loops)) {
+            $solution .= "<pre>UPDATE " . $CFG->prefix . "question_categories\n" .
+                    "        SET parent = 0\n" .
+                    "        WHERE id IN (" . implode(',', array_keys($loops)) . ");</pre>\n";
+        }
+
+        return $solution;
+    }
+}

 class problem_00000x extends problem_base {
    function title() {
@@ -136,17 +136,18 @@
            echo "<br />";
            notice_yesno(get_string('doyouagree'), "index.php?agreelicense=1",
                                                   "http://docs.moodle.org/en/License");
+            print_footer('none');
            exit;
        }
        if (empty($confirmrelease)) {
            $strcurrentrelease = get_string("currentrelease");
            print_header($strcurrentrelease, $strcurrentrelease, $strcurrentrelease, "", "", false, "&nbsp;", "&nbsp;");
            print_heading("Moodle $release");
-            print_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/en/Release_Notes'));
-            echo '<form action="index.php"><fieldset class="invisiblefieldset">';
+            print_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/en/Release_Notes'), 'generalbox boxaligncenter boxwidthwide');
+            echo '<form action="index.php"><div>';
            echo '<input type="hidden" name="agreelicense" value="1" />';
            echo '<input type="hidden" name="confirmrelease" value="1" />';
-            echo '</fieldset>';
+            echo '</div>';
            echo '<div class="continuebutton"><input name="autopilot" id="autopilot" type="checkbox" value="1" /><label for="autopilot">'.get_string('unattendedoperation', 'admin').'</label>';
            echo '<br /><br /><input type="submit" value="'.get_string('continue').'" /></div>';
            echo '</form>';
@@ -188,10 +189,16 @@
    /// Continue with the instalation
        $db->debug = false;
        if ($status) {
+            //ugly hack - install new groups: MDL-9217
+            require("$CFG->dirroot/group/version.php");
+            set_config('group_version', $group_version);
+            //install_group_db();
+
            // Install the roles system.
            moodle_install_roles();
            set_config('statsrolesupgraded',time());

+
            // Write default settings unconditionally (i.e. even if a setting is already set, overwrite it)
            // (this should only have any effect during initial install).
            $adminroot = admin_get_root();
@@ -207,6 +214,7 @@
                                                   'enrol' => 'manual',
                                                   'enrol_plugins_enabled' => 'manual',
                                                   'guestloginbutton' => 1,
+                                                   'registerauth' => 'email',
                                                   'style' => 'default',
                                                   'template' => 'default',
                                                   'theme' => 'standardwhite',
@@ -270,13 +278,30 @@
                print_header($strcurrentrelease, $strcurrentrelease, $strcurrentrelease, "", "", false, "&nbsp;", "&nbsp;");
                print_heading("Moodle $release");
                print_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/en/Release_Notes'));
-                echo '<form action="index.php"><fieldset class="invisiblefieldset">';
-                echo '<input type="hidden" name="confirmupgrade" value="1" />';
-                echo '<input type="hidden" name="confirmrelease" value="1" />';
-                echo '</fieldset>';
-                echo '<div class="continuebutton"><input name="autopilot" id="autopilot" type="checkbox" value="0" /><label for="autopilot">'.get_string('unattendedoperation', 'admin').'</label>';
-                echo '<br /><br /><input type="submit" value="'.get_string('continue').'" /></div>';
-                echo '</form>';
+
+                require_once($CFG->libdir.'/environmentlib.php');
+                print_heading(get_string('environment', 'admin'));
+                remove_dir($CFG->dataroot . '/environment'); /// Always delete downloaded env. info to force use of the released one. MDL-9796
+                if (!check_moodle_environment($release, $environment_results, true)) {
+                    print_box_start('generalbox', 'notice'); // MDL-8330
+                    print_string('langpackwillbeupdated', 'admin');
+                    print_box_end();
+                    notice_yesno(get_string('environmenterrorupgrade', 'admin'), 
+                                 'index.php?confirmupgrade=1&confirmrelease=1', 'index.php');
+                } else {
+                    notify(get_string('environmentok', 'admin'), 'notifysuccess');
+                    print_box_start('generalbox', 'notice'); // MDL-8330
+                    print_string('langpackwillbeupdated', 'admin');
+                    print_box_end();  
+                    echo '<form action="index.php"><div>';
+                    echo '<input type="hidden" name="confirmupgrade" value="1" />';
+                    echo '<input type="hidden" name="confirmrelease" value="1" />';
+                    echo '</div>';
+                    echo '<div class="continuebutton"><input name="autopilot" id="autopilot" type="checkbox" value="1" /><label for="autopilot">'.get_string('unattendedoperation', 'admin').'</label>';
+                    echo '<br /><br /><input type="submit" value="'.get_string('continue').'" /></div>';
+                    echo '</form>';
+                }
+
                print_footer('none');
                die;
            } else {
@@ -307,6 +332,10 @@
            /// If successful, continue upgrading roles and setting everything properly
                if ($status) {
                    if (empty($CFG->rolesactive)) {
+                        // ugly hack - upgrade to new groups (from 1.6) : MDL-9217
+                        // require_once("$CFG->dirroot/group/db/upgrade.php");
+                        // MDL-11062, proper group upgrade code is done in lib/db/upgrade.php
+                        // install_group_db();
                        // Upgrade to the roles system.
                        moodle_install_roles();
                        set_config('rolesactive', 1);
@@ -354,6 +383,11 @@
        }
    }

+/// ugly hack - convert to new groups if upgrading from 1.7; must be reworked
+    require_once("$CFG->dirroot/group/db/upgrade.php");
+    upgrade_group_db("$CFG->wwwroot/$CFG->admin/index.php");  // Return here afterwards
+
+
 /// Find and check all main modules and load them up or upgrade them if necessary
 /// first old *.php update and then the new upgrade.php script
    upgrade_activity_modules("$CFG->wwwroot/$CFG->admin/index.php");  // Return here afterwards
@@ -381,6 +415,9 @@
 /// first old *.php update and then the new upgrade.php script
    upgrade_plugins('enrol', 'enrol', "$CFG->wwwroot/$CFG->admin/index.php");  // Return here afterwards

+/// Check all auth plugins and upgrade if necessary
+    upgrade_plugins('auth','auth',"$CFG->wwwroot/$CFG->admin/index.php");
+
 /// Check all course formats and upgrade if necessary
    upgrade_plugins('format','course/format',"$CFG->wwwroot/$CFG->admin/index.php");

@@ -389,12 +426,8 @@
    require_once("$CFG->dirroot/lib/locallib.php");
    upgrade_local_db("$CFG->wwwroot/$CFG->admin/index.php");  // Return here afterwards

-/// Check for new groups and upgrade if necessary. TODO:
-    require_once("$CFG->dirroot/group/db/upgrade.php");
-    upgrade_group_db("$CFG->wwwroot/$CFG->admin/index.php");  // Return here afterwards
-
 /// Check for changes to RPC functions
-    require_once($CFG->dirroot.'/admin/mnet/adminlib.php');
+    require_once("$CFG->dirroot/$CFG->admin/mnet/adminlib.php");
    upgrade_RPC_functions("$CFG->wwwroot/$CFG->admin/index.php");  // Return here afterwards


@@ -466,19 +499,7 @@

 /// Check if the guest user exists.  If not, create one.
    if (! record_exists("user", "username", "guest")) {
-        $guest->auth        = "manual";
-        $guest->username    = "guest";
-        $guest->password    = md5("guest");
-        $guest->firstname   = addslashes(get_string("guestuser"));
-        $guest->lastname    = " ";
-        $guest->email       = "root@localhost";
-        $guest->description = addslashes(get_string("guestuserinfo"));
-        $guest->mnethostid  = $CFG->mnet_localhost_id;
-        $guest->confirmed   = 1;
-        $guest->lang        = $CFG->lang;
-        $guest->timemodified= time();
-
-        if (! $guest->id = insert_record("user", $guest)) {
+        if (! $guest = create_guest_record()) {
            notify("Could not create guest user record !!!");
        }
    }
@@ -519,7 +540,7 @@

 /// Deprecated database! Warning!!
    if (!empty($CFG->migrated_to_new_db)) {
-        print_box(print_string('dbmigrationdeprecateddb','admin'));
+        print_box(print_string('dbmigrationdeprecateddb', 'admin'), 'generalbox adminwarning');
    }

 /// Check for any special upgrades that might need to be run
@@ -527,30 +548,41 @@
        print_box(get_string("upgrade$CFG->upgrade", "admin", "$CFG->wwwroot/$CFG->admin/upgrade$CFG->upgrade.php"));
    }

-    if (ini_get_bool('register_globals') && !ini_get_bool('magic_quotes_gpc')) {
-        print_box(get_string('globalsquoteswarning', 'admin'));
+    if (ini_get_bool('register_globals')) {
+        print_box(get_string('globalswarning', 'admin'), 'generalbox adminwarning');
    }

    if (is_dataroot_insecure()) {
-        print_box(get_string('datarootsecuritywarning', 'admin', $CFG->dataroot));
+        print_box(get_string('datarootsecuritywarning', 'admin', $CFG->dataroot), 'generalbox adminwarning');
    }

-/// If no recently cron run
+    if (defined('WARN_DISPLAY_ERRORS_ENABLED')) {
+        print_box(get_string('displayerrorswarning', 'admin'), 'generalbox adminwarning');
+    }
+
+    if (substr($CFG->wwwroot, -1) == '/') {
+        print_box(get_string('cfgwwwrootslashwarning', 'admin'), 'generalbox adminwarning');
+    }
+    if (strpos($ME, $CFG->httpswwwroot.'/') === false) {
+        print_box(get_string('cfgwwwrootwarning', 'admin'), 'generalbox adminwarning');
+    }
+
+    /// If no recently cron run
    $lastcron = get_field_sql('SELECT max(lastcron) FROM ' . $CFG->prefix . 'modules');
    if (time() - $lastcron > 3600 * 24) {
        $strinstallation = get_string('installation', 'install');
        $helpbutton = helpbutton('install', $strinstallation, 'moodle', true, false, '', true);
-        print_box(get_string('cronwarning', 'admin')."&nbsp;".$helpbutton);
+        print_box(get_string('cronwarning', 'admin')."&nbsp;".$helpbutton, 'generalbox adminwarning');
    }

 /// Print multilang upgrade notice if needed
    if (empty($CFG->filter_multilang_converted)) {
-        print_box(get_string('multilangupgradenotice', 'admin'));
+        print_box(get_string('multilangupgradenotice', 'admin'), 'generalbox adminwarning');
    }

 /// Alert if we are currently in maintenance mode
    if (file_exists($CFG->dataroot.'/1/maintenance.html')) {
-        print_box(get_string('sitemaintenancewarning', 'admin'));
+        print_box(get_string('sitemaintenancewarning', 'admin'), 'generalbox adminwarning');
    }


@@ -560,7 +592,7 @@
    if (!isset($CFG->registered) || $CFG->registered < (time() - 3600*24*30*6)) {
        $options = array();
        $options['sesskey'] = $USER->sesskey;
-        print_box_start();
+        print_box_start('generalbox adminwarning');
        print_string('pleaseregister', 'admin');
        print_single_button('register.php', $options, get_string('registration'));
        print_box_end();
@@ -570,7 +602,7 @@
    //////////////////////////////////////////////////////////////////////////////////////////////////
    ////  IT IS ILLEGAL AND A VIOLATION OF THE GPL TO HIDE, REMOVE OR MODIFY THIS COPYRIGHT NOTICE ///
    $copyrighttext = '<a href="http://moodle.org/">Moodle</a> '.
-                     '<a href="http://docs.moodle.org/en/Release">'.$CFG->release.'</a> ('.$CFG->version.')<br />'.
+                     '<a href="http://docs.moodle.org/en/Release" title="'.$CFG->version.'">'.$CFG->release.'</a><br />'.
                     'Copyright &copy; 1999 onwards, Martin Dougiamas<br />'.
                     'and <a href="http://docs.moodle.org/en/Credits">many other contributors</a>.<br />'.
                     '<a href="http://docs.moodle.org/en/License">GNU Public License</a>';
@@ -57,17 +57,17 @@
            $navigation = "<a href=\"lang.php\">$strlanguage</a> -> $strmissingstrings";
            $title = $strmissingstrings;
            $button = '<form '.$CFG->frametarget.' method="get" action="'.$CFG->wwwroot.'/'.$CFG->admin.'/lang.php">'.
-                      '<fieldset class="invisiblefieldset">'.
+                      '<div>'.
                      '<input type="hidden" name="mode" value="compare" />'.
-                      '<input type="submit" value="'.$streditstrings.'" /></fieldset></form>';
+                      '<input type="submit" value="'.$streditstrings.'" /></div></form>';
            break;
        case "compare":
            $navigation = "<a href=\"lang.php\">$strlanguage</a> -> $streditstrings";
            $title = $streditstrings;
            $button = '<form  '.$CFG->frametarget.' method="get" action="'.$CFG->wwwroot.'/'.$CFG->admin.'/lang.php">'.
-                      '<fieldset class="invisiblefieldset">'.
+                      '<div>'.
                      '<input type="hidden" name="mode" value="missing" />'.
-                      '<input type="submit" value="'.$strmissingstrings.'" /></fieldset></form>';
+                      '<input type="submit" value="'.$strmissingstrings.'" /></div></form>';
            break;
        default:
            $title = $strlanguage;
@@ -82,7 +82,7 @@
    if (!$mode) {
        print_box_start();
        $currlang = current_language();
-        $langs = get_list_of_languages();
+        $langs = get_list_of_languages(false, true);
        popup_form ("$CFG->wwwroot/$CFG->admin/lang.php?lang=", $langs, "chooselang", $currlang, "", "", "", false, 'self', $strcurrentlanguage.':');
        print_heading("<a href=\"lang.php?mode=missing\">$strmissingstrings</a>");
        print_heading("<a href=\"lang.php?mode=compare\">$streditstrings</a>");
@@ -170,7 +170,7 @@
                        $missinglinkend = '';
                    }
                    if (strlen($value) > LANG_MISSING_TEXT_MAX_LEN) {
-                        $value = substr($value, 0, LANG_MISSING_TEXT_MAX_LEN) . ' ...';
+                        $value = lang_xhtml_save_substr($value, 0, LANG_MISSING_TEXT_MAX_LEN) . ' ...'; // MDL-8852
                    }
                    $o .= "$"."string['".$missinglinkstart.$key.$missinglinkend."'] = \"$value\";<br />";
                }
@@ -299,12 +299,12 @@
        helpbutton('langswitchstorage', $strfilestoredinhelp, 'moodle');
        
        echo '<form '.$CFG->frametarget.' method="get" action="'.$CFG->wwwroot.'/'.$CFG->admin.'/lang.php">'.
-             '<fieldset class="invisiblefieldset">'.
+             '<div>'.
             '<input type="hidden" name="mode" value="compare" />'.
             '<input type="hidden" name="currentfile" value="'.$currentfile.'" />'.
             '<input type="hidden" name="uselocal" value="'.(1 - $uselocal % 2).'" />'.
             '<input type="submit" value="'.$strswitchlang.'" />'.
-             '</fieldset></form>';
+             '</div></form>';
        print_box_end();
       
        if ($currentfile <> '') {
@@ -455,7 +455,7 @@
                    echo $missingnext . '</td>';

                } else {
-                    echo '<td bgcolor="'.$cellcolour.'" valign="top">'.$value.'</td>';
+                    echo '<td '.$cellcolour.' valign="top">'.$value.'</td>';
                }
                echo '</tr>'."\n";
            }
@@ -468,8 +468,10 @@
                echo '</td></tr>';
            }
            echo '</table>';
-            echo '</div>'; 
-            echo '</form>'; 
+            if ($editable) {
+                echo '</div>'; 
+                echo '</form>'; 
+            }

        } else {
            // no $currentfile specified
@@ -526,10 +528,12 @@ function lang_save_file($path, $file, $strings, $local, $packstrings) {
        $value = lang_fix_value_before_save($value);
        if ($id == "string" and $value != ""){
            if ((!$local) || (lang_fix_value_from_file($packstrings[$stringname]) <> lang_fix_value_from_file($value))) {
+                // Either we are saving the master language pack
+                // or we are saving local language pack and the strings differ.
                fwrite($f,"\$string['$stringname'] = '$value';\n");
-                if (LANG_KEEP_ORPHANS && isset($orphans[$stringname])) {
-                    unset($orphans[$stringname]);
-                }
+            }
+            if (LANG_KEEP_ORPHANS && isset($orphans[$stringname])) {
+                unset($orphans[$stringname]);
            }
        }
    }
@@ -560,6 +564,7 @@ function lang_fix_value_from_file($value='') {
    $value = trim($value);                             // Delete leading/trailing white space
    $value = str_replace("\\","",$value);              // Delete all slashes
    $value = str_replace("%%","%",$value);
+    $value = str_replace("&","&amp;",$value);          // Fixes MDL-9248
    $value = str_replace("<","&lt;",$value);
    $value = str_replace(">","&gt;",$value);
    $value = str_replace('"',"&quot;",$value);
@@ -578,6 +583,13 @@ function lang_fix_value_before_save($value='') {
    if ($CFG->lang != "zh_hk" and $CFG->lang != "zh_tw") {  // Some MB languages include backslash bytes
        $value = str_replace("\\","",$value);           // Delete all slashes
    }
+    if (ini_get_bool('magic_quotes_sybase')) {          // Unescape escaped sybase quotes
+        $value = str_replace("''", "'", $value);
+    }
+    // escape all embedded variables
+    $value = str_replace('$', '\$', $value);            // Add slashes for $
+    // unescape placeholders: only $a and $a->something are allowed. All other $variables are left escaped
+    $value = preg_replace('/\\\\\$a($|[^_a-zA-Z0-9\-]|\->[a-zA-Z0-9_]+)/', '$a\\1', $value);
    $value = str_replace("'", "\\'", $value);           // Add slashes for '
    $value = str_replace('"', "\\\"", $value);          // Add slashes for "
    $value = str_replace("%","%%",$value);              // Escape % characters
@@ -629,5 +641,75 @@ function lang_file_string_key($keyfromform) {
    return str_replace('##46#', '.', $keyfromform);
 }

+/**
+ * Return the substring of the string and take care of XHTML compliance.
+ *
+ * There was a problem with pure substr() which could possibly produce XHTML parsing error:
+ *  substr('Marks &amp; Spencer', 0, 9) -> 'Marks &am' ... is not XHTML compliance
+ * This function takes care of these cases. Fixes MDL-8852.
+ *
+ * Thanks to kovacsendre, the author of the function at http://php.net/substr
+ *
+ * @param string $str The original string
+ * @param int $start Start position in the $value string
+ * @param int $length Optional length of the returned substring
+ * @return string The substring as returned by substr() with XHTML compliance
+ * @todo Seems the function does not work with negative $start together with $length being set
+ */
+function lang_xhtml_save_substr($str, $start, $length = NULL) {
+    if ($length === 0) { 
+        //stop wasting our time ;)
+        return "";
+    }
+
+    //check if we can simply use the built-in functions
+    if (strpos($str, '&') === false) {
+        // No entities. Use built-in functions
+        if ($length === NULL) {
+            return substr($str, $start);
+        } else {
+            return substr($str, $start, $length);
+        }
+    }
+
+    // create our array of characters and html entities
+    $chars = preg_split('/(&[^;\s]+;)|/', $str, -1, PREG_SPLIT_NO_EMPTY | PREG_SPLIT_DELIM_CAPTURE | PREG_SPLIT_OFFSET_CAPTURE);
+    $html_length = count($chars);
+
+    // check if we can predict the return value and save some processing time, i.e.:
+    // input string was empty OR
+    // $start is longer than the input string OR
+    // all characters would be omitted
+    if (($html_length === 0) or ($start >= $html_length) or (isset($length) and ($length <= -$html_length))) {
+        return '';
+    }
+
+    //calculate start position
+    if ($start >= 0) {
+        $real_start = $chars[$start][1];
+    } else { 
+        //start'th character from the end of string
+        $start = max($start,-$html_length);
+        $real_start = $chars[$html_length+$start][1];
+    }
+
+    if (!isset($length)) {
+        // no $length argument passed, return all remaining characters
+        return substr($str, $real_start);
+    } elseif ($length > 0) { 
+        // copy $length chars
+        if ($start+$length >= $html_length) { 
+            // return all remaining characters
+            return substr($str, $real_start);
+        } else { 
+            //return $length characters
+            return substr($str, $real_start, $chars[max($start,0)+$length][1] - $real_start);
+        }
+    } else { 
+        //negative $length. Omit $length characters from end
+        return substr($str, $real_start, $chars[$html_length+$length][1] - $real_start);
+    }
+}
+

 ?>
@@ -29,6 +29,12 @@

    admin_externalpage_print_header($adminroot);

+    //reset and diagnose lang cache permissions
+    @unlink($CFG->dataroot.'/cache/languages');
+    if (file_exists($CFG->dataroot.'/cache/languages')) {
+        notify('Language cache can not be deleted, please check permissions in dataroot.');
+    }
+    get_list_of_languages(true); //refresh lang cache

    switch ($mode){

@@ -44,10 +50,10 @@
                    $status = $cd->install(); //returns ERROR | UPTODATE | INSTALLED
                    switch ($status) {

-                        case ERROR:
+                        case ERROR: 
                            if ($cd->get_error() == 'remotedownloadnotallowed') {
                                $a = new stdClass();
-                                $a->url = 'http://download.moodle.org/lang16/'.$pack.'zip';
+                                $a->url = 'http://download.moodle.org/lang16/'.$pack.'.zip';
                                $a->dest= $CFG->dataroot.'/lang';
                                error(get_string($cd->get_error(), 'error', $a));
                            } else {
@@ -56,8 +62,8 @@
                        break;

                        case INSTALLED:
-                            @unlink($CFG->dataroot.'/cache/languages');
-                            redirect('langimport.php', get_string('langpackupdated','admin',$pack));
+                            get_list_of_languages(true); //refresh lang cache
+                            redirect('langimport.php', get_string('langpackupdated','admin',$pack), -1, $adminroot);
                        break;

                        case UPTODATE:
@@ -103,14 +109,14 @@
                if (file_exists($dest2)){
                    $rm2 = remove_dir($dest2);
                }
+                get_list_of_languages(true); //refresh lang cache
                //delete the direcotries
                if ($rm1 or $rm2) {
-                    redirect('langimport.php', get_string('langpackremoved','admin'));
+                    redirect('langimport.php', get_string('langpackremoved','admin'), 3, $adminroot);
                } else {    //nothing deleted, possibly due to permission error
                    error('An error has occurred, language pack is not completely uninstalled, please check file permissions');
                }
            }
-            @unlink($CFG->dataroot.'/cache/languages');
        break;

        case UPDATE_ALL_LANG:    //1 click update for all updatable language packs
@@ -120,8 +126,7 @@
            $source = 'http://download.moodle.org/lang16/languages.md5';
            $md5array = array();
            $updated = 0;    //any packs updated?
-            unset($CFG->langlist);   // ignore admin's langlist
-            $alllangs = array_keys(get_list_of_languages());
+            $alllangs = array_keys(get_list_of_languages(false, true)); //get all available langs
            $lang16 = array();   //all the Moodle 1.6 unicode lang packs (updated and not updated)
            $packs = array();    //all the packs that needs updating

@@ -185,7 +190,7 @@
                    case ERROR:
                        if ($cd->get_error() == 'remotedownloadnotallowed') {
                            $a = new stdClass();
-                            $a->url = 'http://download.moodle.org/lang16/'.$pack.'zip';
+                            $a->url = 'http://download.moodle.org/lang16/'.$pack.'.zip';
                            $a->dest= $CFG->dataroot.'/lang';
                            error(get_string($cd->get_error(), 'error', $a));
                        } else {
@@ -208,9 +213,9 @@
            }

            if ($updated) {
-                notice(get_string('langupdatecomplete','admin'), 'langimport.php');
+                notice(get_string('langupdatecomplete','admin'), 'langimport.php', NULL, $adminroot);
            } else {
-                notice(get_string('nolangupdateneeded','admin'), 'langimport.php');
+                notice(get_string('nolangupdateneeded','admin'), 'langimport.php', NULL, $adminroot);
            }

        break;
@@ -247,8 +252,7 @@
            echo '<form id="uninstallform" action="langimport.php?mode=4" method="post">';
            echo '<fieldset class="invisiblefieldset">';
            echo '<input name="sesskey" type="hidden" value="'.sesskey().'" />';
-            unset($CFG->langlist);   // ignore admin's langlist
-            $installedlangs = get_list_of_languages();
+            $installedlangs = get_list_of_languages(false, true);

            /// display installed langs here

@@ -262,9 +266,9 @@
            echo '</fieldset>';
            echo '</form>';
            echo '<form id="updateform" action="langimport.php?mode=5" method="post">';
-            echo '<fieldset class="invisiblefieldset">';
+            echo '<div>';
            echo '<br /><input type="submit" value="'.get_string('updatelangs','admin').'" />';
-            echo '</fieldset>';
+            echo '</div>';
            echo '</form>';

            /// Display option to change site language
@@ -304,7 +308,7 @@
            }
            if ($remote) {
                echo '</select>';
-                echo '<br /><input type="submit" value="&larr; '.get_string('install','admin').'" />';
+                echo '<br /><input type="submit" value="'.$THEME->larrow.' '.get_string('install','admin').'" />';
            }
            echo '</fieldset>';
            echo '</form>';
@@ -368,13 +372,16 @@
                return false;    //failed
            }
            fputs($proxy_fp, "GET $url HTTP/1.0\r\nHost: $CFG->proxyhost\r\n\r\n");
-            $i = 0;
-                while(!feof($proxy_fp)) {
+
+            $headers_done = false;
+            while(!feof($proxy_fp)) {
                $string = fgets($proxy_fp, 1024);
-                if ($i > 11) {    //12 lines of info skipped
+                if(!$headers_done){
+                    // A new line indicates end of HTTP headers
+                    $headers_done = ("\r\n" == $string);
+                } else {
                    $availablelangs[] = split(',', $string);
                }
-                $i++;
            }
            fclose($proxy_fp);

@@ -47,7 +47,7 @@ if (!empty($action) and confirm_sesskey()) {
    // fetch the record in question
    $id = required_param('id', PARAM_INT);
    if (!$idrec = get_record('mnet_sso_access_control', 'id', $id)) {
-        error(get_string('recordnoexists','mnet'), '/admin/mnet/access_control.php');
+        error(get_string('recordnoexists','mnet'), "/$CFG->admin/mnet/access_control.php");
    }

    switch ($action) {
@@ -62,7 +62,7 @@ if (!empty($action) and confirm_sesskey()) {
            // require the access parameter, and it must be 'allow' or 'deny'
            $accessctrl = trim(strtolower(required_param('accessctrl', PARAM_ALPHA)));
            if ($accessctrl != 'allow' and $accessctrl != 'deny') {
-                error(get_string('invalidaccessparam', 'mnet') , '/admin/mnet/access_control.php');
+                error(get_string('invalidaccessparam', 'mnet') , "/$CFG->admin/mnet/access_control.php");
            }

            if (mnet_update_sso_access_control($idrec->username, $idrec->mnet_host_id, $accessctrl)) {
@@ -75,7 +75,7 @@ if (!empty($action) and confirm_sesskey()) {
            break;

        default:
-            print_error('invalidactionparam', 'mnet', '/admin/mnet/access_control.php');
+            print_error('invalidactionparam', 'mnet', "/$CFG->admin/mnet/access_control.php");
    }
 }

@@ -86,7 +86,7 @@ if ($form = data_submitted() and confirm_sesskey()) {

    // check permissions and verify form input
    if (!has_capability('moodle/user:delete', $sitecontext)) {
-        error(get_string('nomodifyacl','mnet'), '/admin/mnet/access_control.php');
+        error(get_string('nomodifyacl','mnet'), "/$CFG->admin/mnet/access_control.php");
    }
    if (empty($form->username)) {
        $formerror['username'] = get_string('enterausername','mnet');
@@ -127,15 +127,11 @@ $warn = '';
 if (empty($CFG->mnet_dispatcher_mode) || $CFG->mnet_dispatcher_mode !== 'strict') {
    $warn = '<p>' . get_string('mnetdisabled','mnet') .'</p>';
 }
-if (empty($CFG->auth_plugins_enabled)) {
+
+if (!is_enabled_auth('mnet')) {
    $warn .= '<p>' .  get_string('authmnetdisabled','mnet').'</p>';
-} else {
-    $auths = explode(',', $CFG->auth_plugins_enabled);
-    if (!in_array('mnet', $auths)) {
-        $warn .= '<p>' .  get_string('authmnetdisabled','mnet').'</p>';
-    }
-    unset($auths);
 }
+
 if (get_config('auth/mnet', 'auto_add_remote_users') != true) {
    $warn .= '<p>' .  get_string('authmnetautoadddisabled','mnet').'</p>';
 }
@@ -29,7 +29,7 @@ function mnet_get_functions($type, $parentname) {
        $docname = 'rpclib.php';
        $relname  = '/mod/'.$parentname.'/'.$docname;
        $filename = $CFG->dirroot.$relname;
-        if (file_exists($filename)) include $filename;
+        if (file_exists($filename)) include_once $filename;
        $mnet_publishes = $parentname.'_mnet_publishes';
        if (function_exists($mnet_publishes)) {
            (array)$publishes = $mnet_publishes();
@@ -38,7 +38,7 @@ function mnet_get_functions($type, $parentname) {
        // auth or enrol
        $relname  = '/'.$type.'/'.$parentname.'/'.$docname;
        $filename = $CFG->dirroot.$relname;
-        if (file_exists($filename)) include $filename;
+        if (file_exists($filename)) include_once $filename;
        $class = $type.($type=='enrol'? 'ment':'').'_plugin_'.$parentname;
        if (class_exists($class)) {
            $object = new $class();
@@ -64,7 +64,7 @@ function mnet_get_functions($type, $parentname) {
        foreach($rpcrecords as $rpc) {
            if (!array_key_exists($rpc->function_name, $methodServiceArray)) {
                $rpc->enabled = 0;
-                update_record('mnet_rpc', $rpc);
+                update_record('mnet_rpc', addslashes_recursive($rpc));
            }
        }
    }
@@ -72,7 +72,7 @@ function mnet_get_functions($type, $parentname) {
    if (!file_exists($filename)) return false;

    if (extension_loaded('tokenizer')) {
-        include_once $CFG->dirroot.'/admin/mnet/MethodTable.php';
+        include_once "$CFG->dirroot/$CFG->admin/mnet/MethodTable.php";
        $functions = (array)MethodTable::create($filename,false);
    }

@@ -1,12 +1,12 @@
 <?php
 print_header("$site->shortname: $strmnetsettings", "$site->fullname",
-             '<a href="'.$CFG->wwwroot.'/admin/index.php">'.$stradministration.'</a> -> '.
-             '<a href="'.$CFG->wwwroot.'/admin/mnet/index.php">'.get_string('mnetsettings', 'mnet').'</a> -> Delete host');
+             '<a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/index.php">'.$stradministration.'</a> -> '.
+             '<a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/mnet/index.php">'.get_string('mnetsettings', 'mnet').'</a> -> Delete host');

 print_heading(get_string('mnetsettings', 'mnet'));
 ?>
-<center>
-    <table align="center"   class="generalbox" border="0" cellpadding="5" cellspacing="0">
+<div id="trustedhosts"><!-- See theme/standard/styles_layout.css #trustedhosts .generaltable for rules -->
+    <table class="generalbox standard" border="0" cellpadding="5" cellspacing="0">
        <tr>
            <td  class="generalboxcontent">
            <table cellpadding="9" cellspacing="0" >
@@ -14,7 +14,7 @@ print_heading(get_string('mnetsettings', 'mnet'));
                    <td colspan="2" class="header" cellpadding="0"><span><?php print_string('deleteaserver', 'mnet'); ?>Deleting a Server</span></td>
                </tr>
                <?php
-                if (count($warn) > 0):
+                if (count($warn) > 0){
                ?>
                <tr valign="top">
                    <td align="right" colspan="2"><?php print_string('receivedwarnings','mnet'); ?>:<br />
@@ -22,7 +22,7 @@ print_heading(get_string('mnetsettings', 'mnet'));
                    </td>
                </tr>
                <?php
-                endif;
+                }
                ?>
                <tr valign="top">
                    <td colspan="2"><?php print_string('reallydeleteserver','mnet'); ?>: "<?php echo $mnet_peer->name; ?>"?</td>
@@ -46,7 +46,7 @@ print_heading(get_string('mnetsettings', 'mnet'));
            </td>
        </tr>
    </table>
-</center>
+</div>
 <?php
 print_footer();
 ?>
@@ -31,6 +31,8 @@
        redirect('index.php', get_string('postrequired','mnet') ,7);
    }

+    require_sesskey();
+
    if ('verify' == $step) {
        $mnet_peer = new mnet_peer();
        $mnet_peer->set_id($hostid);
@@ -1,10 +1,11 @@

 <form id="assignform" method="post" action="">
+<div id="trustedhosts"><!-- See theme/standard/styles_layout.css #trustedhosts .generaltable for rules -->
 <input type="hidden" name="previoussearch" value="<?php p($previoussearch) ?>" />
 <input type="hidden" name="courseid" value="<?php p($courseid) ?>" />
 <input type="hidden" name="host" value="<?php p($mnet_peer->id) ?>" />
 <input type="hidden" name="sesskey" value="<?php p(sesskey()) ?>" />
-  <table align="center" border="0" cellpadding="5" cellspacing="0">
+  <table class="generaltable" border="0" cellpadding="5" cellspacing="0">
    <tr>
      <td valign="top">
          <?php print_string('existingusers', 'role', count($mnetenrolledusers)); ?>
@@ -99,4 +100,5 @@
      <td valign="top"></td>
    </tr>
  </table>
+  </div>
 </form>
@@ -86,9 +86,21 @@
    $mnet_request->set_method('enrol/mnet/enrol.php/course_enrolments');
    $mnet_request->add_param($course->remoteid, 'int');
    $mnet_request->send($mnet_peer);
-    $all_enrolled_users = $mnet_request->response;
-
+    $raw_all_enrolled_users = $mnet_request->response;
    unset($mnet_request);
+
+    $all_enrolled_users = array();
+    if (!empty($raw_all_enrolled_users)) {
+        // Try to repair keying of remote users array, numeric usernames get lost in the fracas
+        foreach ($raw_all_enrolled_users as $username => $userdetails) {
+            if (empty($userdetails['username']) || !is_numeric($username)) {
+                //Not able to repair, or no need to repair
+                $all_enrolled_users[$username] = $userdetails;
+            } else {
+                $all_enrolled_users[$userdetails['username']] = $userdetails;
+            }
+        }
+    }
    
    $select = '';
    $all_enrolled_usernames = '';
@@ -258,7 +270,7 @@ $strsearchresults = get_string('searchresults');
 admin_externalpage_print_header($adminroot);

 print_box('<strong>' . s($mnet_peer->name) . ' : ' 
-          . s($course->shortname) .' '. s($course->fullname) 
+          . format_string($course->shortname) .' '. format_string($course->fullname) 
          . '</strong><br />'
          . get_string("enrolcourseenrol_desc", "mnet"));

@@ -29,28 +29,29 @@
    print_box('<strong>' . s($host->name) . ' </strong><br />'
              . get_string("enrolcourses_desc", "mnet"));

-    echo "<hr />";
+    echo '<hr />';

-    print ('<table align="center" >');
+    echo '<div id="trustedhosts"><!-- See theme/standard/styles_layout.css #trustedhosts .generaltable for rules -->'
+           . '<table class="generaltable">';

    $icon  = "<img src=\"$CFG->pixpath/i/course.gif\"".
    " class=\"icon\" alt=\"".get_string("course")."\" />";

    foreach ($courses as $course) {
-        $link = $CFG->wwwroot . '/admin/mnet/enr_course_enrol.php?'
+        $link = "$CFG->wwwroot/$CFG->admin/mnet/enr_course_enrol.php?"
            . "host={$mnethost}&amp;courseid={$course->id}&amp;sesskey={$USER->sesskey}";
-        print ('<tr>'
+        echo '<tr>'
               . "<td>$icon</td>"
-               . "<td><a href=\"$link\">".s($course->fullname). "</a></td>"
+               . "<td><a href=\"$link\">".format_string($course->fullname). "</a></td>"
               . '</tr><tr>'
               . '<td></td>'
-               . '<td>'.s($course->shortname). ' - ' .s($course->cat_name).'</td>'
+               . '<td>'.format_string($course->shortname). ' - ' .format_string($course->cat_name).'</td>'
               . '</tr><tr>'
               . '<td></td>'
               . "<td align=\"left\" >{$course->summary}</td>"
-               . '</tr>');
+               . '</tr>';
    }
-    print ('</table>');
+    echo '</table></div>';

    admin_externalpage_print_footer($adminroot);

@@ -22,38 +22,40 @@

    print_box(get_string("remoteenrolhosts_desc", "mnet"));

-    echo "<hr />";
+    echo '<hr />';

    if (empty($CFG->mnet_dispatcher_mode) || $CFG->mnet_dispatcher_mode !== 'strict') {
        print_box(get_string('mnetdisabled','mnet'));
    }

-    print ('<table align="center" cellspacing="0" cellpadding="5"  width="500" id="hosts" class="generaltable generalbox" >'
+    echo '<div id="trustedhosts"><!-- See theme/standard/styles_layout.css #trustedhosts .generaltable for rules -->'
+           . '<table cellspacing="0" cellpadding="5" id="hosts" class="generaltable generalbox" >'
           . '<tr>'
           . '<th class="header c0"> '.get_string('host', 'mnet').' </th>'
           . '<th class="header c1"> '.get_string('enrolments', 'mnet').' </th>'
           . '<th class="header c2"> '.get_string('courses', 'mnet').' </th>'
           // . '<th class="header c3"> &nbsp; </th>'
-           . '</tr>');
+           . '</tr>';
    $hosts = $enrolment->list_remote_servers();
    foreach ($hosts as $host) {
-        $coursesurl = "{$CFG->wwwroot}/admin/mnet/enr_courses.php?host={$host->id}&amp;sesskey={$USER->sesskey}";
+        $coursesurl = "{$CFG->wwwroot}/$CFG->admin/mnet/enr_courses.php?host={$host->id}&amp;sesskey={$USER->sesskey}";
        $coursecount = get_field_sql("SELECT count(id) FROM {$CFG->prefix}mnet_enrol_course WHERE hostid={$host->id}");
        if (empty($coursecount)) {
            $coursecount = '?';
        }
        $enrolcount = get_field_sql("SELECT count(id) FROM {$CFG->prefix}mnet_enrol_assignments WHERE hostid={$host->id}");

-        print ('<tr>'
+        echo '<tr>'
               . "<td><a href=\"{$coursesurl}\">{$host->name}</a></td>"
               . "<td align=\"center\" >$enrolcount</td>"
               . "<td align=\"center\" >$coursecount - <a href=\"{$coursesurl}\">".get_string('editenrolments', 'mnet')."</a></td>"
               // TODO: teach report/log/index.php to show per-host-logs
               // . '<td align="center" ><a href="{$CFG->wwwroot}/admin/report/log/index.php?course_host={$host->id}">'
               // . get_string('logs', 'mnet').'</a> </td>'
-               . '</tr>');
+               . '</tr>';
    }
-    print ('</table>');
+    echo '</table>'
+       . '</div>';

    admin_externalpage_print_footer($adminroot);

@@ -40,7 +40,7 @@
 /// If data submitted, process and store
    if (($form = data_submitted()) && confirm_sesskey()) {
        if (!empty($form->submit) && $form->submit == get_string('savechanges')) {
-            if (in_array($form->mode, array("off", "strict", "promiscuous"))) {
+            if (in_array($form->mode, array("off", "strict", "dangerous"))) {
                if (set_config('mnet_dispatcher_mode', $form->mode)) {
                    redirect('index.php', get_string('changessaved'));
                } else {
@@ -112,8 +112,8 @@
                <tr valign="top">
                    <td align="right"><?php print_string('net', 'mnet'); ?>:</td>
                    <td><input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>" />
-                        <input type="radio" name="mode" value="off" <?php echo ("off" == $CFG->mnet_dispatcher_mode)? 'checked="true"' : '' ?> /> <?php print_string('off', 'mnet'); ?> <br />
-                        <input type="radio" name="mode" value="strict" <?php echo ("strict" == $CFG->mnet_dispatcher_mode)? 'checked="true"' : '' ?> /> <?php print_string('on', 'mnet'); ?><br />
+                        <input type="radio" name="mode" value="off" <?php echo ("off" == $CFG->mnet_dispatcher_mode)? 'checked="checked"' : '' ?> /> <?php print_string('off', 'mnet'); ?> <br />
+                        <input type="radio" name="mode" value="strict" <?php echo ("strict" == $CFG->mnet_dispatcher_mode)? 'checked="checked"' : '' ?> /> <?php print_string('on', 'mnet'); ?><br />
                        <input type="submit" name="submit" value="<?php print_string('savechanges'); ?>" />
                    </td>
                </tr>
@@ -19,6 +19,7 @@ print_tabs(array($tabs), 'mnetdetails');
 print_simple_box_start("center", "");
 ?>
 <form method="post" action="peers.php">
+<div>
 <input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>" />
 <input type="hidden" name="step" value="commit" />
 <input type="hidden" name="last_connect_time" value="<?php echo $mnet_peer->last_connect_time; ?>" />
@@ -74,7 +75,7 @@ if (isset($mnet_peer->deleted) && $mnet_peer->deleted > 0) {
 </tr>
 <?php

-if(!empty($currentkey)):
+if(!empty($currentkey)) {
 ?>
    <tr>
        <td align="right" valign="top"></td>
@@ -85,30 +86,30 @@ if(!empty($currentkey)):
        <td valign="top"><pre style="font-size: 8px;"><?php echo $currentkey;?></pre></td>
    </tr>
 <?php
-endif;
+}

-if (isset($mnet_peer->id) && $mnet_peer->id > 0):
+if (isset($mnet_peer->id) && $mnet_peer->id > 0) {
 ?>
    <tr>
        <td align="right" valign="top"><?php print_string('last_connect_time', 'mnet'); ?>:</td>
        <td valign="top"><?php echo ($mnet_peer->last_connect_time == 0)? get_string('never','mnet') : date('H:i:s d/m/Y',$mnet_peer->last_connect_time);?></td>
    </tr>
 <?php
-endif;
+}

-if (isset($mnet_peer->deleted) && $mnet_peer->deleted > 0):
+if (isset($mnet_peer->deleted) && $mnet_peer->deleted > 0){
 ?>
    <tr>
        <td align="right" valign="top"><?php print_string('deleted'); ?>:</td>
        <td valign="top">
-            <input type="radio" name="deleted" value="0" checked="true" /> <?php print_string('reenableserver','mnet'); ?><br />
+            <input type="radio" name="deleted" value="0" checked="checked" /> <?php print_string('reenableserver','mnet'); ?><br />
            <input type="radio" name="deleted" value="1"  /> <?php print_string('yes'); ?><br />
        </td>
    </tr>
 <?php
-endif;
+}

-if (isset($mnet_peer->ip_address) && '' != $mnet_peer->ip_address):
+if (isset($mnet_peer->ip_address) && '' != $mnet_peer->ip_address){
 ?>
    <tr>
        <td align="right" valign="top"><?php print_string('ipaddress', 'mnet');
@@ -119,13 +120,14 @@ if (isset($mnet_peer->ip_address) && '' != $mnet_peer->ip_address):
    </tr>

 <?php
-endif;
+}
 ?>
 <tr>
    <td></td>
    <td><input type="submit" value="<?php print_string("savechanges"); ?>" /></td>
 </tr>
 </table>
+</div>
 </form>
 <?php
 print_simple_box_end();
@@ -16,21 +16,22 @@ print_simple_box_start("center", "");
 ?>

 <form method="post" action="mnet_services.php">
+<div>
 <input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>" />
 <input type="hidden" name="step" value="<?php echo $mnet_peer->nextstep; ?>" />
 <input type="hidden" name="hostid" value="<?php echo ($mnet_peer->id)?  $mnet_peer->id : '0' ; ?>" />
 <table cellpadding="9" cellspacing="0" >
 <?php 
-    foreach($myservices as $name => $versions):
+    foreach($myservices as $name => $versions) {
    $version = current($versions);
 ?>
 <tr>
    <td align="left" valign="top" colspan="2">
    <h3><?php echo get_string($name.'_name', $version['parent_type'].'_'.$version['parent'] , $mnet_peer->name); ?></h3>
-    <p><?php echo get_string($name.'_description', $version['parent_type'].'_'.$version['parent'], $mnet_peer->name); ?></p>
+    <?php echo get_string($name.'_description', $version['parent_type'].'_'.$version['parent'], $mnet_peer->name); ?>
 <?php
        $breakstring = '';
-        foreach($versions as $version):
+        foreach($versions as $version){
            if (count($versions) > 1) {
                $versionstring = '('.get_string('version','mnet') .' '.$version['apiversion'].')';
            } else {
@@ -40,16 +41,37 @@ print_simple_box_start("center", "");
            echo $breakstring;
 ?>
    <input type="hidden" name="exists[<?php echo  $version['serviceid']; ?>]" value="1" />
-    <input type="checkbox" name="publish[<?php echo $version['serviceid']; ?>]" <?php echo (!empty($version['I_publish']))? 'checked="checked" ': '' ; ?>/><?php print_string('publish','mnet'); ?><?php echo $versionstring; if (!empty($version['hostsubscribes'])) echo '<a href="#" title="'.get_string('issubscribed','mnet', $mnet_peer->name).'">&radic;</a> '; if (!empty($version['allhosts_publish'])) print_string("enabled_for_all",'mnet',!empty($version['I_publish']));  ?><br />
-    <input type="checkbox" name="subscribe[<?php echo $version['serviceid']; ?>]" <?php echo (!empty($version['I_subscribe']))? 'checked="checked" ': '' ; ?>/><?php print_string('subscribe','mnet'); ?><?php echo $versionstring; if (!empty($version['hostpublishes'])) echo '<a href="#" title="'.get_string('ispublished','mnet', $mnet_peer->name).'">&radic;</a> '; if (!empty($version['allhosts_subscribe'])) print_string("enabled_for_all",'mnet',!empty($version['I_subscribe'])); ?><br />
-<?php
+    <input type="checkbox" name="publish[<?php echo $version['serviceid']; ?>]" <?php echo (!empty($version['I_publish']))? 'checked="checked" ': '' ; ?>/>
+<?php 
+            print_string('publish','mnet');
+            echo $versionstring; 
+            if (!empty($version['hostsubscribes'])) { 
+                echo '<a href="#" title="'.get_string('issubscribed','mnet', $mnet_peer->name).'">&radic;</a> '; 
+            }
+            if (!empty($version['allhosts_publish'])) { 
+                print_string("enabled_for_all",'mnet',!empty($version['I_publish']));
+            } 
+            echo '<br />';
+?>
+    <input type="checkbox" name="subscribe[<?php echo $version['serviceid']; ?>]" <?php echo (!empty($version['I_subscribe']))? 'checked="checked" ': '' ; ?>/>
+<?php 
+            print_string('subscribe','mnet');
+            echo $versionstring; 
+            if (!empty($version['hostpublishes'])) { 
+                echo '<a href="#" title="'.get_string('ispublished','mnet', $mnet_peer->name).'">&radic;</a> ';
+            } 
+            if (!empty($version['allhosts_subscribe'])) {
+                print_string("enabled_for_all",'mnet',!empty($version['I_subscribe']));
+            }
+            
+            echo '<br />';  
            $breakstring = '. . . . . . . . . . . . . . . . . . . . . . . . <br>';
-        endforeach;
+        } // end foreach
 ?>
    </td>
 </tr>
 <?php
-    endforeach;
+    } // end foreach
 ?>
 <tr>
    <td align="left" valign="top" colspan="2">
@@ -70,6 +92,7 @@ print_simple_box_start("center", "");
    </td>
 </tr>
 </table>
+</div>
 </form>
 <?php
 print_simple_box_end();
@@ -48,7 +48,14 @@
            $publish        = (isset($_POST['publish'][$key]) && $_POST['publish'][$key] == 'on')? 1 : 0;
            $subscribe      = (isset($_POST['subscribe'][$key]) && $_POST['subscribe'][$key] == 'on')? 1 : 0;

-            if (false == $host2service && ($publish == 1 || $subscribe == 1)) {
+            if ($publish != 1 && $subscribe != 1) {
+                if (false == $host2service) {
+                    // We don't have or need a record - do nothing!
+                } else {
+                    // We don't need the record - delete it
+                    delete_records('mnet_host2service', 'hostid', $_POST['hostid'], 'serviceid', $key);
+                }
+            } elseif (false == $host2service && ($publish == 1 || $subscribe == 1)) {
                $host2service = new stdClass();
                $host2service->hostid = $_POST['hostid'];
                $host2service->serviceid = $key;
@@ -5,36 +5,38 @@ if (empty($CFG->mnet_dispatcher_mode) || $CFG->mnet_dispatcher_mode !== 'strict'
    print_box(get_string('mnetdisabled','mnet'));
 }
 ?>
-<center>
-<form  method="post" action="peers.php">
-<input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>" />
-<input type="hidden" name="updateregisterall" value="1" />
-<table cellspacing="0" cellpadding="5"  width="500" id="hosts" class="generaltable generalbox" >
-    <tr>
-        <th class="header c0" nowrap="nowrap" colspan="2"><?php print_string('registerallhosts', 'mnet'); ?></th>
-    </tr>
-    <tr>
-        <td class="cell c1" colspan="2"><?php print_string('registerallhostsexplain', 'mnet'); ?></td>
-    </tr>
-    <tr>
-        <td class="cell c1"><input type="checkbox" name="registerallhosts" <?php if (!empty($CFG->mnet_register_allhosts)) echo 'checked="checked" '; ?>/></td>
-        <td class="cell c1"> <?php print_string('registerallhosts', 'mnet'); ?> </td>
-    </tr>
-    <tr>
-        <td align="right" colspan="2"><input type="submit" name="submit" value="<?php print_string('savechanges'); ?>" /></td>
-    </tr>
-</table>
-</form>
-<table cellspacing="0" cellpadding="5" id="hosts" class="generaltable generalbox" >
-    <tr>
-        <th class="header c0" nowrap="nowrap"><?php print_string('site'); ?></th>
-        <th class="header c1" nowrap="nowrap"><?php print_string('system','mnet'); ?></th>
-        <th class="header c2" nowrap="nowrap"><?php print_string('last_connect_time', 'mnet'); ?></th>
-        <th class="header c3" nowrap="nowrap"></th>
-    </tr>
+<div id="trustedhosts"><!-- See theme/standard/styles_layout.css #trustedhosts .generaltable for rules -->
+    <form  method="post" action="peers.php">
+        <div>
+            <input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>" />
+            <input type="hidden" name="updateregisterall" value="1" />
+            <table cellspacing="0" cellpadding="5" class="generaltable generalbox" >
+                <tr>
+                    <th class="header c0" colspan="2"><?php print_string('registerallhosts', 'mnet'); ?></th>
+                </tr>
+                <tr>
+                    <td class="cell c1" colspan="2"><?php print_string('registerallhostsexplain', 'mnet'); ?></td>
+                </tr>
+                <tr>
+                    <td class="cell c1"><input type="checkbox" name="registerallhosts" <?php if (!empty($CFG->mnet_register_allhosts)) echo 'checked="checked" '; ?>/></td>
+                    <td class="cell c1"> <?php print_string('registerallhosts', 'mnet'); ?> </td>
+                </tr>
+                <tr>
+                    <td align="right" colspan="2"><input type="submit" name="submit" value="<?php print_string('savechanges'); ?>" /></td>
+                </tr>
+            </table>
+        </div>
+    </form>
+    <table cellspacing="0" cellpadding="5" class="generaltable generalbox standard" >
+        <tr>
+            <th class="header c0"><?php print_string('site'); ?></th>
+            <th class="header c1"><?php print_string('system','mnet'); ?></th>
+            <th class="header c2"><?php print_string('last_connect_time', 'mnet'); ?></th>
+            <th class="header c3"></th>
+        </tr>
 <?php

-    foreach($hosts as $host):
+    foreach($hosts as $host) {

        if ($host->last_connect_time == 0) {
            $last_connect = get_string('never');
@@ -46,43 +48,47 @@ if (empty($CFG->mnet_dispatcher_mode) || $CFG->mnet_dispatcher_mode !== 'strict'
    <tr>
        <td class="cell c0"><a href="peers.php?step=update&amp;hostid=<?php echo $host->id; ?>"><?php echo $host->name; ?></a></td>
        <td class="cell c1"><a href="peers.php?step=update&amp;hostid=<?php echo $host->id; ?>"><?php echo $host->wwwroot; ?></a></td>
-        <td class="cell c2" nowrap="nowrap"><?php if ($host->id != $CFG->mnet_all_hosts_id) echo $last_connect; ?></td>
+        <td class="cell c2"><?php if ($host->id != $CFG->mnet_all_hosts_id) echo $last_connect; ?></td>
        <td class="cell c3">
-<?php   if ($host->id != $CFG->mnet_all_hosts_id): ?>
+<?php   if ($host->id != $CFG->mnet_all_hosts_id){ ?>
            <form method="post" action="delete.php">
+                <div>
                <input type="hidden" name="hostid" value="<?php echo $host->id; ?>" />
                <input type="hidden" name="step" value="verify" />
+                <input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
                <input type="submit" name="submit" value="<?php print_string('delete'); ?>"/>
+                </div>
            </form>
-<?php   endif; ?>
+<?php   } ?>
        </td>
    </tr>
 <?php
-    endforeach;
+    }
 ?>
-    <tr>
-        <td class="cell c4" colspan="4">&nbsp;</td>
-    </tr>
+    </table>
    <form method="post" action="peers.php">
-    <tr>
-        <th class="header c4" nowrap="nowrap" colspan="4">
-            <?php print_string('addnewhost', 'mnet'); ?>
-            <input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>" />
-            <input type="hidden" name="step" value="input" />
-        </th>
-    </tr>
-    <tr>
-        <td class="cell c0"></td>
-        <td class="cell c1"><input type="text" name="wwwroot" value="" /></td>
-        <td class="cell c2"></td>
-        <td class="cell c3"></td>
-    </tr>
-    <tr>
-        <td class="cell c4" align="right" colspan="4"><input type="submit" value="<?php print_string('addhost','mnet'); ?>" /></td>
-    </tr>
+        <table cellspacing="0" cellpadding="5" class="generaltable generalbox standard" >
+            
+            <tr>
+                <th class="header c4" colspan="4">
+                    <?php print_string('addnewhost', 'mnet'); ?>
+                    <input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>" />
+                    <input type="hidden" name="step" value="input" />
+                </th>
+            </tr>
+            <tr>
+                <td class="cell c0">wwwroot:</td>
+                <td class="cell c1"><input type="text" name="wwwroot" value="" /></td>
+                <td class="cell c2"></td>
+                <td class="cell c3"></td>
+            </tr>
+            <tr>
+                <td class="cell c4" align="right" colspan="4"><input type="submit" value="<?php print_string('addhost','mnet'); ?>" /></td>
+            </tr>
+        
+        </table>
    </form>
-</table>
-</center>
+</div>
 <?php
 admin_externalpage_print_footer($adminroot);
-?>
+?>
@@ -50,7 +50,19 @@ if (($form = data_submitted()) && confirm_sesskey()) {
    if (!empty($form->wwwroot)) {
        // ensure we remove trailing slashes
        $form->wwwroot = preg_replace(':/$:', '', $form->wwwroot);
+        
+        // ensure the wwwroot starts with a http or https prefix
+        if (strtolower(substr($form->wwwroot, 0, 4)) != 'http') {
+            $form->wwwroot = 'http://'.$form->wwwroot;
+        }
    }
+
+    if(!function_exists('xmlrpc_encode_request')) {
+        trigger_error("You must have xml-rpc enabled in your PHP build to use this feature.");
+        error(get_string('xmlrpc-missing', 'mnet'),'peers.php');
+        exit;
+    }
+
    if (!empty($form->updateregisterall)) {
        if (!empty($form->registerallhosts)) {
            set_config('mnet_register_allhosts',1);
@@ -84,6 +96,7 @@ if (($form = data_submitted()) && confirm_sesskey()) {
    
        if (isset($form->deleted) && ($form->deleted == '0' || $form->deleted == '1')) {
            $mnet_peer->deleted = $form->deleted;
+            $mnet_peer->updateparams->deleted = $form->deleted;
        }
    
        if (isset($form->public_key)) {
@@ -94,9 +107,10 @@ if (($form = data_submitted()) && confirm_sesskey()) {
            } else {
                $oldkey = $mnet_peer->public_key;
                $mnet_peer->public_key = $form->public_key;
-                $mnet_peer->public_key_expires   = $mnet_peer->check_common_name($form->public_key);
+                $mnet_peer->updateparams->public_key = $form->public_key;
+                $mnet_peer->public_key_expires = $mnet_peer->check_common_name($form->public_key);
+                $mnet_peer->updateparams->public_key_expires = $mnet_peer->check_common_name($form->public_key);
                if ($mnet_peer->public_key_expires == false) {
-                    $mnet_peer->public_key == $oldkey;
                    $errmsg = '<br />';
                    foreach ($mnet_peer->error as $err) {
                        $errmsg .= $err['code'] . ': ' . $err['text'].'<br />';
@@ -1,36 +1,39 @@
 <?php
 admin_externalpage_print_header($adminroot);
 ?>
-<center>
-<table cellspacing="0" cellpadding="5"  width="500" id="hosts" class="generaltable generalbox" >
+<div id="trustedhosts"><!-- See theme/standard/styles_layout.css #trustedhosts .generaltable for rules -->
+<table cellspacing="0" cellpadding="5"  class="generaltable generalbox" >
    <tr>
-        <th class="header c0" nowrap="nowrap" colspan="2"><?php print_string('trustedhosts', 'mnet'); ?></th>
+        <th class="header c0" colspan="2"><?php print_string('trustedhosts', 'mnet'); ?></th>
    </tr>
    <tr>
        <td class="cell c1" colspan="2"><?php print_string('trustedhostsexplain', 'mnet'); ?></td>
    </tr>
    <tr>
-        <td class="cell c1" colspan="2"><form  method="post" action="trustedhosts.php">
-            <input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>" />
-            <textarea name="hostlist" cols="40" rows="20"><?php echo $trusted_hosts; ?></textarea><br />
-            <input type="submit" value="<?php print_string('savechanges'); ?>" />
+        <td class="cell c1" colspan="2">
+            <form  method="post" action="trustedhosts.php">
+            <div>
+                <input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>" />
+                <textarea name="hostlist" cols="40" rows="20"><?php echo $trusted_hosts; ?></textarea><br />
+                <input type="submit" value="<?php print_string('savechanges'); ?>" />
+            </div>
            </form>
        </td>
    </tr>
 </table>
-<table cellspacing="0" cellpadding="5"  width="500" id="hosts" class="generaltable generalbox" >
+<table cellspacing="0" cellpadding="5" class="generaltable generalbox" >
    <tr>
-        <th class="header c0" nowrap="nowrap" colspan="2"><?php print_string('testtrustedhosts', 'mnet'); ?></th>
+        <th class="header c0" colspan="2"><?php print_string('testtrustedhosts', 'mnet'); ?></th>
    </tr>
 <?php 
-    if (!empty($test_ip_address)):
+    if (!empty($test_ip_address)){
 ?>
    <tr>
        <td class="cell c1" colspan="2">
            <?php
                if ($in_range) {
                    print_string('is_in_range',  'mnet', $test_ip_address);
-                    echo '<br>';
+                    echo '<br />';
                    print_string('validated_by', 'mnet', $validated_by);
                } else {
                    print_string('not_in_range',  'mnet', $test_ip_address);
@@ -39,24 +42,27 @@ admin_externalpage_print_header($adminroot);
        </td>
    </tr>
 <?php
-    else:
+   } else {
 ?>
    <tr>
        <td class="cell c1" colspan="2"><?php print_string('testtrustedhostsexplain', 'mnet'); ?></td>
    </tr>
 <?php
-    endif;
+   } 
 ?>
    <tr>
-        <td class="cell c1" colspan="2"><form  method="get" action="trustedhosts.php">
-            <input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>" />
-            <input type="text" name="testipaddress" value="<?php echo $test_ip_address; ?>" />
-            <input type="submit" value="<?php print_string('go'); ?>" />
+        <td class="cell c1" colspan="2">
+            <form  method="get" action="trustedhosts.php">
+            <div>
+                <input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>" />
+                <input type="text" name="testipaddress" value="<?php echo $test_ip_address; ?>" />
+                <input type="submit" value="<?php print_string('go'); ?>" />
+            </div>
            </form>
        </td>
    </tr>
 </table>
-</center>
+</div>
 <?php
 admin_externalpage_print_footer($adminroot);
-?>
+?>
@@ -49,7 +49,6 @@

    /// If data submitted, process and store
    if (($form = data_submitted()) && confirm_sesskey()) {
-        echo 'a';
        $hostlist = preg_split("/[\s,]+/", $form->hostlist);
        foreach($hostlist as $host) {
            list($address, $mask) = explode('/', $host.'/');
@@ -16,7 +16,7 @@
        }

        if ($module != '') {
-            require_once("$CFG->dirroot/mod/$module/lib.php");
+            include_once("$CFG->dirroot/mod/$module/lib.php");
            // if the config.html contains a hidden form field giving
            // the module name then the form does not have to prefix all
            // its variable names, we will do it here.
@@ -43,7 +43,7 @@

 /// Otherwise print the form.
    $module = required_param('module', PARAM_SAFEDIR);
-    require_once("$CFG->dirroot/mod/$module/lib.php");
+    include_once("$CFG->dirroot/mod/$module/lib.php");

    $strmodulename = get_string("modulename", $module);

@@ -55,7 +55,7 @@

    print_heading($strmodulename);

-    print_simple_box("<center>".get_string("configwarning", 'admin')."</center>", "center", "60%");
+    print_simple_box(get_string("configwarning", 'admin'), "center", "60%");
    echo "<br />";

    print_simple_box_start("center", "");
@@ -2,10 +2,15 @@
      // Allows the admin to manage activity modules

    require_once('../config.php');
+    require_once('../course/lib.php');
    require_once($CFG->libdir.'/adminlib.php');
+    require_once($CFG->libdir.'/tablelib.php');
+
+    // defines
+    define('MODULE_TABLE','module_administration_table');
+
    $adminroot = admin_get_root();
    admin_externalpage_setup('managemodules', $adminroot);
-    require_once('../course/lib.php');

    $show    = optional_param('show', '', PARAM_SAFEDIR);
    $hide    = optional_param('hide', '', PARAM_SAFEDIR);
@@ -23,34 +28,51 @@
    $strsettings = get_string("settings");
    $stractivities = get_string("activities");
    $stractivitymodule = get_string("activitymodule");
+    $strshowmodulecourse = get_string('showmodulecourse');

    admin_externalpage_print_header($adminroot);

    print_heading($stractivities);

-    $coursesaffected = false;
-
-
 /// If data submitted, then process and store.

    if (!empty($hide) and confirm_sesskey()) {
        if (!$module = get_record("modules", "name", $hide)) {
            error("Module doesn't exist!");
        }
-        set_field("modules", "visible", "0", "id", $module->id);                               // Hide main module
-        set_field('course_modules', 'visibleold', '1', 'visible' ,'1', 'module', $module->id); // Remember the previous visible state so we can toggle this back if the module is unhidden.
-        set_field('course_modules', 'visibleold', '0', 'visible' ,'0', 'module', $module->id);
-        set_field("course_modules", "visible", "0", "module", $module->id);                    // Hide all related activity modules
-        $coursesaffected = true;
+        set_field("modules", "visible", "0", "id", $module->id); // Hide main module
+        // Remember the visibility status in visibleold
+        // and hide...
+        $sql = "UPDATE {$CFG->prefix}course_modules
+                SET visibleold=visible,
+                    visible=0
+                WHERE  module={$module->id}";
+        execute_sql($sql, false);
+        // clear the course modinfo cache for courses
+        // where we just deleted something
+        $sql = "UPDATE {$CFG->prefix}course
+                SET modinfo=''
+                WHERE id IN (SELECT DISTINCT course 
+                             FROM {$CFG->prefix}course_modules 
+                             WHERE visibleold=1 AND module={$module->id})";
+        execute_sql($sql, false);
    }

    if (!empty($show) and confirm_sesskey()) {
        if (!$module = get_record("modules", "name", $show)) {
            error("Module doesn't exist!");
        }
-        set_field("modules", "visible", "1", "id", $module->id);                               // Show main module
-        set_field('course_modules', 'visible', '1', 'visibleold', '1', 'module', $module->id); // Get the previous saved visible state for the course module.
-        $coursesaffected = true;
+        set_field("modules", "visible", "1", "id", $module->id); // Show main module
+        set_field('course_modules', 'visible', '1', 'visibleold', 
+                  '1', 'module', $module->id); // Get the previous saved visible state for the course module.
+        // clear the course modinfo cache for courses
+        // where we just made something visible
+        $sql = "UPDATE {$CFG->prefix}course
+                SET modinfo=''
+                WHERE id IN (SELECT DISTINCT course 
+                             FROM {$CFG->prefix}course_modules 
+                             WHERE visible=1 AND module={$module->id})";
+        execute_sql($sql, false);
    }

    if (!empty($delete) and confirm_sesskey()) {
@@ -83,6 +105,15 @@
                }
            }

+            // clear course.modinfo for courses
+            // that used this module...
+            $sql = "UPDATE {$CFG->prefix}course
+                    SET modinfo=''
+                    WHERE id IN (SELECT DISTINCT course 
+                                 FROM {$CFG->prefix}course_modules 
+                                 WHERE module={$module->id})";
+            execute_sql($sql, false);
+
            // Now delete all the course module records
            if (!delete_records("course_modules", "module", $module->id)) {
                notify("Error occurred while deleting all $strmodulename records in course_modules table");
@@ -118,20 +149,12 @@
            // Delete the capabilities that were defined by this module
            capabilities_cleanup('mod/'.$module->name);

-            // rebuild_course_cache();  // Because things have changed
-            $coursesaffected = true;
-
            $a->module = $strmodulename;
            $a->directory = "$CFG->dirroot/mod/$delete";
            notice(get_string("moduledeletefiles", "", $a), "modules.php");
        }
    }

-    if ($coursesaffected) {
-        rebuild_course_cache();  // Because things have changed
-    }
-
-
 /// Get and sort the existing modules

    if (!$modules = get_records("modules")) {
@@ -149,12 +172,14 @@
    ksort($modulebyname);

 /// Print the table of all modules
-
-    $table->head  = array ($stractivitymodule, $stractivities, $strversion, "$strhide/$strshow", $strdelete, $strsettings);
-    $table->align = array ("left", "right", "left", "center", "center", "center");
-    $table->wrap  = array ("nowrap", "", "", "", "","");
-    $table->size  = array ("100%", "10", "10", "10", "10","12");
-    $table->width = "100";
+    // construct the flexible table ready to display
+    $table = new flexible_table(MODULE_TABLE);
+    $table->define_columns(array('name', 'instances', 'version', 'hideshow', 'delete', 'settings'));
+    $table->define_headers(array($stractivitymodule, $stractivities, $strversion, "$strhide/$strshow", $strdelete, $strsettings));
+    $table->define_baseurl($CFG->wwwroot.'/'.$CFG->admin.'/modules.php');
+    $table->set_attribute('id', 'modules');
+    $table->set_attribute('class', 'generaltable generalbox boxaligncenter boxwidthwide');
+    $table->setup();

    foreach ($modulebyname as $modulename => $module) {

@@ -169,7 +194,14 @@
            $settings = "";
        }

-        $count = count_records("$module->name");
+        $count = count_records_select("$module->name",'course<>0');
+        if ($count>0) {
+            $countlink = "<a href=\"{$CFG->wwwroot}/course/search.php?modulelist=$module->name" .
+                "&amp;sesskey={$USER->sesskey}\" title=\"$strshowmodulecourse\">$count</a>";
+        }
+        else {
+            $countlink = "$count";
+        }

        if ($module->visible) {
            $visible = "<a href=\"modules.php?hide=$module->name&amp;sesskey=$USER->sesskey\" title=\"$strhide\">".
@@ -178,18 +210,25 @@
        } else {
            $visible = "<a href=\"modules.php?show=$module->name&amp;sesskey=$USER->sesskey\" title=\"$strshow\">".
                       "<img src=\"$CFG->pixpath/i/show.gif\" class=\"icon\" alt=\"$strshow\" /></a>";
-            $class = "class=\"dimmed_text\"";
+            $class = " class=\"dimmed_text\"";
        }
        if ($module->name == "forum") {
            $delete = "";
            $visible = "";
            $class = "";
        }
-        $table->data[] = array ("<span $class>$icon $modulename</span>", $count, $module->version, $visible, $delete, $settings);
-    }
-    print_table($table);

-    echo "<br /><br />";
+        $table->add_data(array(
+            '<span'.$class.'>'.$icon.' '.$modulename.'</span>', 
+            $countlink, 
+            '<span'.$class.'>'.$module->version.'</span>', 
+            $visible, 
+            $delete, 
+            $settings
+        ));
+    }
+
+    $table->print_html();

    admin_externalpage_print_footer($adminroot);

@@ -42,7 +42,7 @@ while(@ob_end_flush());

 echo '<strong>Progress:</strong>';
 $i = 0;
-$skiptables = array($CFG->prefix.'config');//, $CFG->prefix.'sessions2');
+$skiptables = array($CFG->prefix.'config', $CFG->prefix.'user_students', $CFG->prefix.'user_teachers');//, $CFG->prefix.'sessions2');

 foreach ($tables as $table) {
    if (($CFG->prefix && strpos($table, $CFG->prefix) !== 0)
@@ -63,12 +63,8 @@ foreach ($tables as $table) {
                if ($rs and $rs->RecordCount() > 0) {
                    while (!$rs->EOF) {
                        $text = $rs->fields[$column];
-                        $search = '/(<(?:lang|span) lang="[a-zA-Z0-9_-]*".*?>.+?<\/(?:lang|span)>)(\s*<(?:lang|span) lang="[a-zA-Z0-9_-]*".*?>.+?<\/(?:lang|span)>)+/is';
-                        $newtext = preg_replace_callback($search, 'multilangupgrade_impl', $text);
-                        if ($newtext != $text) {
-                            $newtext = addslashes($newtext);
-                            execute_sql("UPDATE $table SET $column='$newtext' WHERE id=".$rs->fields['id'], false);
-                        }
+                        $id   = $rs->fields['id'];
+
                        if ($i % 600 == 0) {
                            echo '<br />';
                        }
@@ -77,6 +73,22 @@ foreach ($tables as $table) {
                        }
                        $i++;
                        $rs->MoveNext();
+
+                        if (empty($text) or is_numeric($text)) {
+                            continue; // nothing to do
+                        }
+
+                        $search = '/(<(?:lang|span) lang="[a-zA-Z0-9_-]*".*?>.+?<\/(?:lang|span)>)(\s*<(?:lang|span) lang="[a-zA-Z0-9_-]*".*?>.+?<\/(?:lang|span)>)+/is';
+                        $newtext = preg_replace_callback($search, 'multilangupgrade_impl', $text);
+
+                        if (is_null($newtext)) {
+                            continue; // regex error
+                        }
+
+                        if ($newtext != $text) {
+                            $newtext = addslashes($newtext);
+                            execute_sql("UPDATE $table SET $column='$newtext' WHERE id=$id", false);
+                        }
                    }
                }
            }
@@ -46,7 +46,7 @@ function online_assignment_cleanup($output=false) {


    /// get a list of all courses on this site
-    $courses = get_courses();
+    $courses = get_records('course');

    /// cycle through each course
    foreach ($courses as $course) {
@@ -99,7 +99,7 @@ function online_assignment_cleanup($output=false) {

                        /// grab the section record
                        if (!($section = get_record('course_sections', 'id', $newsection))) {
-                            if ($output) echo 'Serious error: Cannot retrieve section: '.$newsection.' for course: '.$course->fullname.'<br />';
+                            if ($output) echo 'Serious error: Cannot retrieve section: '.$newsection.' for course: '. format_string($course->fullname) .'<br />';
                            continue;
                        }

@@ -116,11 +116,12 @@ class page_admin extends page_base {
        $this->init_full($section); // we're trusting that init_full() has already been called by now; it should have.
                                    // if not, print_header() has to be called with a $section parameter

-        if ($this->user_allowed_editing()) {
+	// The search page currently doesn't handle block editing 
+        if ($this->section != 'search' and $this->user_allowed_editing()) {
            $buttons = '<div><form '.$CFG->frametarget.' method="get" action="' . $this->url_get_path() . '">'.
-                       '<fieldset class="invisiblefieldset"><input type="hidden" name="adminedit" value="'.($this->user_is_editing()?'off':'on').'" />'.
+                       '<div><input type="hidden" name="adminedit" value="'.($this->user_is_editing()?'off':'on').'" />'.
                       '<input type="hidden" name="section" value="'.$this->section.'" />'.
-                       '<input type="submit" value="'.get_string($this->user_is_editing()?'blockseditoff':'blocksediton').'" /></fieldset></form></div>';
+                       '<input type="submit" value="'.get_string($this->user_is_editing()?'blockseditoff':'blocksediton').'" /></div></form></div>';
        } else {
            $buttons = '&nbsp;';
        }
@@ -16,8 +16,8 @@ if ($_ENV['RECIPIENT'] == $CFG->noreplyaddress) {
    }
    
    $site = get_site();
-    $subject = get_string('noreplybouncesubject','moodle',$site->fullname);
-    $body = get_string('noreplybouncemessage','moodle',$site->fullname)."\n\n";
+    $subject = get_string('noreplybouncesubject','moodle',format_string($site->fullname));
+    $body = get_string('noreplybouncemessage','moodle',format_string($site->fullname))."\n\n";
    
    $fd = fopen('php://stdin','r');
    if ($fd) {
@@ -54,7 +54,7 @@ if ($modid == '0') { // special
 }
 else {
    $modname = get_field("modules","name","id",$modid);
-    require_once('mod/'.$modname.'/lib.php');
+    include_once('mod/'.$modname.'/lib.php');
 }
 $function = $modname.'_process_email';

@@ -34,7 +34,7 @@
    $strregistration = get_string("registration");
    $strregistrationinfo = get_string("registrationinfo");

-    print_header("$site->shortname: $strregistration", "$site->fullname", 
+    print_header("$site->shortname: $strregistration", $site->fullname, 
                 "<a href=\"../$CFG->admin/index.php\">$stradministration</a> -> $strregistration");

    print_heading($strregistration);
@@ -72,7 +72,7 @@
    echo '<div class="fitem">';
    echo '<div class="fitemtitle"><label for="sitename">'.get_string("fullsitename").'</label></div>';
    echo '<div class="felement ftext">';
-    echo '<input size="50" id="sitename" type="text" name="sitename" value="'.$site->fullname.'" />';
+    echo '<input size="50" id="sitename" type="text" name="sitename" value="'.format_string($site->fullname).'" />';
    echo '</div>';
    echo '</div>';

@@ -0,0 +1,140 @@
+<?php // $Id$
+      // index.php - scheduled backup logs
+
+    require_once('../../../config.php');
+    require_once($CFG->libdir.'/adminlib.php');
+    require_once($CFG->dirroot.'/backup/lib.php');
+
+    $adminroot = admin_get_root();
+
+    admin_externalpage_setup('reportbackups', $adminroot);
+
+    admin_externalpage_print_header($adminroot);
+
+    $courseid = optional_param('courseid', 0, PARAM_INT);
+
+    require_capability('moodle/site:backup', get_context_instance(CONTEXT_SYSTEM, SITEID));
+
+/// Scheduled backups are disabled by the server admin
+    if (!empty($CFG->disablescheduledbackups)) {
+        print_error('scheduledbackupsdisabled', '', '', NULL, true);
+    }
+
+/// Scheduled backups aren't active by the site admin
+    $backup_config = backup_get_config();
+    if (empty($backup_config->backup_sche_active)) {
+        notify(get_string('scheduledbackupsinactive'));
+    }
+
+/// Get needed strings
+    $backuploglaststatus = get_string("backuploglaststatus");
+    $backuplogdetailed = get_string("backuplogdetailed");
+    $stradmin = get_string("administration");
+    $strconfiguration = get_string("configuration");
+    $strbackup = get_string("backup");
+    $strbackupdetails = get_string("backupdetails");
+    $strlogs = get_string("logs");
+    $strftimedatetime = get_string("strftimerecent");
+    $strftimetime = get_string("strftimetime").":%S";
+    $strerror = get_string("error");
+    $strok = get_string("ok");
+    $strunfinished = get_string("unfinished");
+    $strskipped = get_string("skipped");
+    $strcourse = get_string("course");
+    $strtimetaken = get_string("timetaken","quiz");
+    $strstatus = get_string("status");
+    $strnext = get_string("next");
+
+/// Decide when to show last execution logs or detailed logs
+/// Lastlog view
+    if (!$courseid) {
+        print_heading($backuploglaststatus);
+        print_simple_box_start('center');
+    /// Now, get every record from backup_courses
+        $courses = get_records("backup_courses");
+
+        if (!$courses) {
+            notify(get_string('nologsfound'));
+        } else {
+            echo "<table border=\"0\" align=\"center\" cellpadding=\"3\" cellspacing=\"3\">";
+            //Print table header
+            echo "<tr>";
+            echo "<td nowrap=\"nowrap\" align=\"center\"><font size=\"3\">$strcourse</font></td>";
+            echo "<td nowrap=\"nowrap\" align=\"center\" colspan=\"3\"><font size=\"3\">$strtimetaken</font></td>";
+            echo "<td nowrap=\"nowrap\" align=\"center\"><font size=\"3\">$strstatus</font></td>";
+            echo "<td nowrap=\"nowrap\" align=\"center\"><font size=\"3\">$strnext</font></td></tr>";
+            foreach ($courses as $course) {
+            /// Get the course shortname
+                $coursename = get_field ("course","fullname","id",$course->courseid);
+                if ($coursename) {
+                    echo "<tr>";
+                    echo "<td nowrap=\"nowrap\"><font size=\"2\"><a href=\"index.php?courseid=$course->courseid\">".$coursename."</a></font></td>";
+                    echo "<td nowrap=\"nowrap\"><font size=\"2\">".userdate($course->laststarttime,$strftimedatetime)."</font></td>";
+                    echo "<td nowrap=\"nowrap\"><font size=\"2\"> - </font></td>";
+                    echo "<td nowrap=\"nowrap\"><font size=\"2\">".userdate($course->lastendtime,$strftimedatetime)."</font></td>";
+                    if ($course->laststatus == 1) {
+                        echo "<td nowrap=\"nowrap\" align=\"center\"><font size=\"2\" color=\"green\">".$strok."</font></td>";
+                    } else if ($course->laststatus == 2) {
+                        echo "<td nowrap=\"nowrap\" align=\"center\"><font size=\"2\" color=\"red\">".$strunfinished."</font></td>";
+                    } else if ($course->laststatus == 3) {
+                        echo "<td nowrap=\"nowrap\" align=\"center\"><font size=\"2\" color=\"green\">".$strskipped."</font></td>";
+                    } else {
+                        echo "<td nowrap=\"nowrap\" align=\"center\"><font size=\"2\" color=\"red\">".$strerror."</font></td>";
+                    }
+                    echo "<td nowrap=\"nowrap\"><font size=\"2\">".userdate($course->nextstarttime,$strftimedatetime)."</font></td>";
+                    echo "</tr>";
+                }
+            }
+            echo "</table>";
+        }
+        print_simple_box_end();
+/// Detailed View !!
+    } else {
+        print_heading($backuplogdetailed);
+
+        $coursename = get_field("course","fullname","id","$courseid");
+        print_heading("$strcourse: $coursename");
+
+        print_simple_box_start('center');
+
+    /// First, me get all the distinct backups for that course in backup_log
+        $executions = get_records_sql("SELECT DISTINCT laststarttime,laststarttime
+                                       FROM {$CFG->prefix}backup_log
+                                       WHERE courseid = '$courseid'
+                                       ORDER BY laststarttime DESC");
+
+    /// Iterate over backup executions
+        if (!$executions) {
+            notify(get_string('nologsfound'));
+        } else {
+            echo "<table border=\"0\" align=\"center\" cellpadding=\"3\" cellspacing=\"3\">";
+            foreach($executions as $execution) {
+                echo "<tr>";
+                echo "<td nowrap=\"nowrap\" align=\"center\" colspan=\"3\">";
+                print_simple_box("<center>".userdate($execution->laststarttime)."</center>", "center");
+                echo "</td>";
+                echo "</tr>";
+                $logs = get_records_sql("SELECT *
+                                         FROM {$CFG->prefix}backup_log
+                                         WHERE courseid = '$courseid'  AND
+                                               laststarttime = '$execution->laststarttime'
+                                         ORDER BY id");
+                if ($logs) {
+                    foreach ($logs as $log) {
+                        echo "<tr>";
+                        echo "<td nowrap=\"nowrap\"><font size=\"2\">".userdate($log->time,$strftimetime)."</font></td>";
+                        $log->info = str_replace("- ERROR!!","- <font color=\"red\">ERROR!!</font>",$log->info);
+                        $log->info = str_replace("- OK","- <font color=\"green\">OK</font>",$log->info);
+                        echo "<td nowrap=\"nowrap\"><font size=\"2\">".str_replace("  ","&nbsp;&nbsp;&nbsp;&nbsp;",$log->info)."</font></td>";
+                        echo "</tr>";
+                    }
+                }
+            }
+            echo "</table>";
+        }
+        print_simple_box_end();
+    }
+
+    admin_externalpage_print_footer($adminroot);
+
+?>
@@ -17,7 +17,7 @@
    require_capability('moodle/site:viewreports', get_context_instance(CONTEXT_SYSTEM, SITEID));  // needed?

    if (empty($CFG->enablestats)) {
-        redirect("$CFG->wwwroot/$CFG->admin/settings.php?section=stats", get_string('mustenablestats', 'admin'));
+        redirect("$CFG->wwwroot/$CFG->admin/settings.php?section=stats", get_string('mustenablestats', 'admin'), 3, $adminroot);
    }


@@ -117,4 +117,4 @@
    }
    admin_externalpage_print_footer($adminroot);

-?>
+?>
@@ -10,9 +10,9 @@

    require_login();

-    require_capability('moodle/site:viewreports', get_context_instance(CONTEXT_SYSTEM, SITEID));
+    require_capability('moodle/site:viewreports', get_context_instance(CONTEXT_SYSTEM));

-    stats_check_uptodate($course->id);
+    stats_check_uptodate();

    $param = stats_get_parameters($time,$report,SITEID,STATS_MODE_RANKED);

@@ -0,0 +1,74 @@
+<?php // $Id$
+
+    require_once('../../../config.php');
+    require_once($CFG->dirroot.'/question/upgrade.php');
+    require_once($CFG->libdir.'/adminlib.php');
+
+    $adminroot = admin_get_root();
+    admin_externalpage_setup('reportquestion', $adminroot);
+
+    admin_externalpage_print_header($adminroot);
+    print_heading(page_doc_link(get_string('adminreport', 'question')));
+
+    $probstr = '';
+    $contextupgradeversion = 2007081000;
+    if ($CFG->version < $contextupgradeversion){
+        ///cwrqpfs issue
+        $probstr = print_heading(get_string('cwrqpfs', 'question'), '', 3, 'main', true);
+
+        if ($updates = question_cwqpfs_to_update()){
+
+            $probstr .=get_string('cwrqpfsinfo', 'question');
+            $probstr .= '<ul>';
+            $catlist = join(array_keys($updates), ',');
+            //get info about cateogries and no of questions used outside category's course
+            $categories = get_records_sql('SELECT qc.*, c.fullname as coursename FROM '.$CFG->prefix.'question_categories as qc, '
+                        .$CFG->prefix.'course as c WHERE qc.course = c.id AND qc.id IN ('.$catlist.')');
+            foreach ($updates as $id => $publish){
+                $categories[$id]->caturl = "$CFG->wwwroot/question/category.php?sesskey=".sesskey().
+                            "&amp;edit=$id&amp;id=".$categories[$id]->course;
+                if ($categories[$id]->publish){
+                    $categories[$id]->changefrom = get_string('published', 'question');
+                    $categories[$id]->changeto = get_string('unpublished', 'question');
+                } else {
+                    $categories[$id]->changefrom = get_string('unpublished', 'question');
+                    $categories[$id]->changeto = get_string('published', 'question');
+                }
+                $probstr .= '<li>'.get_string('changepublishstatuscat', 'question', $categories[$id]);
+                if ($questions = get_records_sql('SELECT q.*, qui.id as quizid, qui.name as quizname, cm.id as cmid, '
+                               .'qui.course, c.fullname as coursename FROM '.$CFG->prefix.'question q, '
+                               .$CFG->prefix.'quiz_question_instances qqi, '
+                               .$CFG->prefix.'quiz qui, '
+                               .$CFG->prefix.'course_modules cm, '
+                               .$CFG->prefix.'modules m, '
+                               .$CFG->prefix.'course c '
+                            .'WHERE (q.category = '.$id.' AND qqi.question = q.id '
+                            .'AND qqi.quiz = qui.id '
+                            .'AND qui.course = c.id '
+                            .'AND cm.instance = qui.id '
+                            .'AND cm.module = m.id '
+                            .'AND m.name = \'quiz\''
+                            .'AND ('.$categories[$id]->course.' <> qui.course)) ORDER BY qui.id ASC')){
+
+                    $probstr .= '<ul>';
+                    foreach ($questions as $question){
+                        $question->quizurl = "$CFG->wwwroot/mod/quiz/edit.php?cmid=".$question->cmid;
+                        $question->qurl = "$CFG->wwwroot/question/question.php?cmid={$question->cmid}&amp;id={$question->id}&amp;returnurl=".urlencode($FULLME);
+                        $probstr .= '<li>'.get_string('questionaffected', 'question', $question).'</li>';
+                    }
+                    $probstr .= '</ul>';
+                }
+                $probstr .= '</li>';
+            }
+            $probstr .= '</ul>';
+        } else {
+            $probstr .=('<p>'.get_string('cwrqpfsnoprob', 'question').'</p>');
+        }
+    }
+    if ($probstr) {
+        print_box($probstr);
+    } else {
+        print_box(get_string('noprobs', 'question'), 'boxwidthnarrow boxaligncenter generalbox');
+    }
+    admin_externalpage_print_footer($adminroot);
+?>
@@ -0,0 +1,123 @@
+<?php  //$Id$
+
+///////////////////////////////////////////////////////////////////////////
+//                                                                       //
+// NOTICE OF COPYRIGHT                                                   //
+//                                                                       //
+// Moodle - Modular Object-Oriented Dynamic Learning Environment         //
+//          http://moodle.org                                            //
+//                                                                       //
+// Copyright (C) 1999 onwards Martin Dougiamas  http://dougiamas.com     //
+//                                                                       //
+// This program is free software; you can redistribute it and/or modify  //
+// it under the terms of the GNU General Public License as published by  //
+// the Free Software Foundation; either version 2 of the License, or     //
+// (at your option) any later version.                                   //
+//                                                                       //
+// This program is distributed in the hope that it will be useful,       //
+// but WITHOUT ANY WARRANTY; without even the implied warranty of        //
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         //
+// GNU General Public License for more details:                          //
+//                                                                       //
+//          http://www.gnu.org/copyleft/gpl.html                         //
+//                                                                       //
+///////////////////////////////////////////////////////////////////////////
+
+require_once('../../../config.php');
+require_once($CFG->dirroot.'/'.$CFG->admin.'/report/security/lib.php');
+require_once($CFG->libdir.'/adminlib.php');
+
+require_login();
+
+$issue = optional_param('issue', '', PARAM_FILE); // show detailed info about one issue only
+
+$issues = report_security_get_issue_list();
+
+// test if issue valid string
+if (array_search($issue, $issues, true) === false) {
+    $issue = '';
+}
+
+// we may need a bit more memory and this may take a long time to process
+@raise_memory_limit('128M');
+@set_time_limit(0);
+
+// Print the header.
+$adminroot = admin_get_root();
+admin_externalpage_setup('reportsecurity', $adminroot);
+admin_externalpage_print_header($adminroot);
+
+print_heading(get_string('reportsecurity', 'report_security'));
+
+while(@ob_end_flush());
+@flush();
+
+$strok       = '<span class="statusok">'.get_string('statusok', 'report_security').'</span>';
+$strinfo     = '<span class="statusinfo">'.get_string('statusinfo', 'report_security').'</span>';
+$strwarning  = '<span class="statuswarning">'.get_string('statuswarning', 'report_security').'</span>';
+$strserious  = '<span class="statusserious">'.get_string('statusserious', 'report_security').'</span>';
+$strcritical = '<span class="statuscritical">'.get_string('statuscritical', 'report_security').'</span>';
+
+$strissue    = get_string('issue', 'report_security');
+$strstatus   = get_string('status', 'report_security');
+$strdesc     = get_string('description', 'report_security');
+$strconfig   = get_string('configuration', 'report_security');
+
+$statusarr = array(REPORT_SECURITY_OK       => $strok,
+                   REPORT_SECURITY_INFO     => $strinfo,
+                   REPORT_SECURITY_WARNING  => $strwarning,
+                   REPORT_SECURITY_SERIOUS  => $strserious,
+                   REPORT_SECURITY_CRITICAL => $strcritical);
+
+$url = "$CFG->wwwroot/$CFG->admin/report/security/index.php";
+
+if ($issue and ($result = $issue(true))) {
+    $table = new object();
+    $table->head  = array($strissue, $strstatus, $strdesc, $strconfig);
+    $table->size  = array('30%', '10%', '50%', '10%' );
+    $table->align = array('left', 'left', 'left', 'left');
+    $table->width = '90%';
+    $table->data  = array();
+
+    // print detail of one issue only
+    $row = array();
+    $row[0] = report_security_doc_link($issue, $result->name);
+    $row[1] = $statusarr[$result->status];
+    $row[2] = $result->info;
+    $row[3] = is_null($result->link) ? '&nbsp;' : $result->link;
+
+    $CFG->pagepath = "report/security/$issue"; // help link in footer
+
+    $table->data[] = $row;
+
+    print_table($table);
+
+    print_box($result->details, 'generalbox boxwidthnormal boxaligncenter'); // TODO: add proper css
+
+    print_continue($url);
+
+} else {
+    $table = new object();
+    $table->head  = array($strissue, $strstatus, $strdesc);
+    $table->size  = array('30%', '10%', '60%' );
+    $table->align = array('left', 'left', 'left');
+    $table->width = '90%';
+    $table->data  = array();
+
+    foreach ($issues as $issue) {
+        $result = $issue(false);
+        if (!$result) {
+            // ignore this test
+            continue;
+        }
+        $row = array();
+        $row[0] = "<a href='$url?issue=$result->issue'>$result->name</a>";
+        $row[1] = $statusarr[$result->status];
+        $row[2] = $result->info;
+
+        $table->data[] = $row;
+    }
+    print_table($table);
+}
+
+admin_externalpage_print_footer($adminroot);
@@ -0,0 +1,779 @@
+<?php  //$Id$
+
+///////////////////////////////////////////////////////////////////////////
+//                                                                       //
+// NOTICE OF COPYRIGHT                                                   //
+//                                                                       //
+// Moodle - Modular Object-Oriented Dynamic Learning Environment         //
+//          http://moodle.org                                            //
+//                                                                       //
+// Copyright (C) 1999 onwards Martin Dougiamas  http://dougiamas.com     //
+//                                                                       //
+// This program is free software; you can redistribute it and/or modify  //
+// it under the terms of the GNU General Public License as published by  //
+// the Free Software Foundation; either version 2 of the License, or     //
+// (at your option) any later version.                                   //
+//                                                                       //
+// This program is distributed in the hope that it will be useful,       //
+// but WITHOUT ANY WARRANTY; without even the implied warranty of        //
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         //
+// GNU General Public License for more details:                          //
+//                                                                       //
+//          http://www.gnu.org/copyleft/gpl.html                         //
+//                                                                       //
+///////////////////////////////////////////////////////////////////////////
+
+require_once("$CFG->libdir/adminlib.php");
+
+
+define('REPORT_SECURITY_OK', 'ok');
+define('REPORT_SECURITY_INFO', 'info');
+define('REPORT_SECURITY_WARNING', 'warning');
+define('REPORT_SECURITY_SERIOUS', 'serious');
+define('REPORT_SECURITY_CRITICAL', 'critical');
+
+function report_security_get_issue_list() {
+    return array(
+        'report_security_check_globals',
+        'report_security_check_unsecuredataroot',
+        'report_security_check_displayerrors',
+        'report_security_check_noauth',
+        'report_security_check_embed',
+        'report_security_check_mediafilterswf',
+        'report_security_check_openprofiles',
+        'report_security_check_google',
+        'report_security_check_passwordsaltmain',
+        'report_security_check_configrw',
+        'report_security_check_defaultuserrole',
+        'report_security_check_guestrole',
+        'report_security_check_defaultcourserole',
+        'report_security_check_courserole',
+
+    );
+}
+
+function report_security_doc_link($issue, $name) {
+    global $CFG;
+
+    if (empty($CFG->docroot)) {
+        return $name;
+    }
+
+    $lang = str_replace('_utf8', '', current_language());
+
+    $str = "<a onclick=\"this.target='docspopup'\" href=\"$CFG->docroot/$lang/report/security/$issue\">";
+    $str .= "<img class=\"iconhelp\" src=\"$CFG->httpswwwroot/pix/docs.gif\" alt=\"\" />$name</a>";
+
+    return $str;
+}
+
+///=============================================
+///               Issue checks
+///=============================================
+
+
+/**
+ * Verifies register globals PHP setting.
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_globals($detailed=false) {
+    $result = new object();
+    $result->issue   = 'report_security_check_globals';
+    $result->name    = get_string('check_globals_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+
+    if (ini_get_bool('register_globals')) {
+        $result->status = REPORT_SECURITY_CRITICAL;
+        $result->info   = get_string('check_globals_error', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_globals_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_globals_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies unsupported noauth setting
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_noauth($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_noauth';
+    $result->name    = get_string('check_noauth_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/auth.php\">".get_string('authentication').'</a>';
+
+    if (is_enabled_auth('none')) {
+        $result->status = REPORT_SECURITY_CRITICAL;
+        $result->info   = get_string('check_noauth_error', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_noauth_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_noauth_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies sloppy embedding - this should have been removed long ago!!
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_embed($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_embed';
+    $result->name    = get_string('check_embed_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/settings.php?section=sitepolicies\">".get_string('sitepolicies', 'admin').'</a>';
+
+    if (!empty($CFG->allowobjectembed)) {
+        $result->status = REPORT_SECURITY_CRITICAL;
+        $result->info   = get_string('check_embed_error', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_embed_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_embed_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies sloppy swf embedding - this should have been removed long ago!!
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_mediafilterswf($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_mediafilterswf';
+    $result->name    = get_string('check_mediafilterswf_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/filters.php\">".get_string('filtersettings', 'admin').'</a>';
+
+    if (!empty($CFG->textfilters)) {
+        $activefilters = explode(',', $CFG->textfilters);
+    } else {
+        $activefilters = array();
+    }
+
+    if (array_search('filter/mediaplugin', $activefilters) !== false and !empty($CFG->filter_mediaplugin_enable_swf)) {
+        $result->status = REPORT_SECURITY_CRITICAL;
+        $result->info   = get_string('check_mediafilterswf_error', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_mediafilterswf_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_mediafilterswf_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies fatal misconfiguration of dataroot
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_unsecuredataroot($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_unsecuredataroot';
+    $result->name    = get_string('check_unsecuredataroot_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+
+    $insecuredataroot = is_dataroot_insecure();
+
+    if ($insecuredataroot) {
+        $result->status = REPORT_SECURITY_SERIOUS;
+        $result->info   = get_string('check_unsecuredataroot_warning', 'report_security', $CFG->dataroot);
+
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_unsecuredataroot_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_unsecuredataroot_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies disaplying of errors - problem for lib files and 3rd party code
+ * because we can not disable debugging in these scripts (they do not include config.php)
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_displayerrors($detailed=false) {
+    $result = new object();
+    $result->issue   = 'report_security_check_displayerrors';
+    $result->name    = get_string('check_displayerrors_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+
+    if (defined('WARN_DISPLAY_ERRORS_ENABLED')) {
+        $result->status = REPORT_SECURITY_WARNING;
+        $result->info   = get_string('check_displayerrors_error', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_displayerrors_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_displayerrors_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies open profiles - originaly open by default, not anymore because spammer abused it a lot
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_openprofiles($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_openprofiles';
+    $result->name    = get_string('check_openprofiles_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/settings.php?section=sitepolicies\">".get_string('sitepolicies', 'admin').'</a>';
+
+    if (empty($CFG->forcelogin) and empty($CFG->forceloginforprofiles)) {
+        $result->status = REPORT_SECURITY_WARNING;
+        $result->info   = get_string('check_openprofiles_error', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_openprofiles_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_openprofiles_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies google access not combined with disabled guest access
+ * because attackers might gain guest access by modifying browser signature.
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_google($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_google';
+    $result->name    = get_string('check_google_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/settings.php?section=sitepolicies\">".get_string('sitepolicies', 'admin').'</a>';
+
+    if (empty($CFG->opentogoogle)) {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_google_ok', 'report_security');
+    } else if (!empty($CFG->guestloginbutton)) {
+        $result->status = REPORT_SECURITY_INFO;
+        $result->info   = get_string('check_google_info', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_SERIOUS;
+        $result->info   = get_string('check_google_error', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_google_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies config.php is not writable anymore after installation,
+ * config files were changed on several outdated server.
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_configrw($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_configrw';
+    $result->name    = get_string('check_configrw_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+
+    if (is_writable($CFG->dirroot.'/config.php')) {
+        $result->status = REPORT_SECURITY_WARNING;
+        $result->info   = get_string('check_configrw_warning', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_configrw_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_configrw_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies sanity of default user role.
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_defaultuserrole($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_defaultuserrole';
+    $result->name    = get_string('check_defaultuserrole_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/settings.php?section=userpolicies\">".get_string('userpolicies', 'admin').'</a>';;
+
+    if (!$default_role = get_record('role', 'id', $CFG->defaultuserroleid)) {
+        $result->status  = REPORT_SECURITY_WARNING;
+        $result->info    = get_string('check_defaultuserrole_notset', 'report_security');
+        $result->details = $result->info;
+
+        return $result;
+    }
+
+    // first test if do anything enabled - that would be really crazy!
+    $sql = "SELECT COUNT(DISTINCT rc.contextid)
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE rc.capability = 'moodle/site:doanything'
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $default_role->id";
+
+    $anythingcount = count_records_sql($sql);
+
+    // risky caps - usually very dangerous
+    $sql = "SELECT COUNT(DISTINCT rc.contextid)
+              FROM {$CFG->prefix}role_capabilities rc
+              JOIN {$CFG->prefix}capabilities cap ON cap.name = rc.capability
+             WHERE ".sql_bitand('cap.riskbitmask', (RISK_XSS | RISK_CONFIG))." <> 0
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $default_role->id";
+
+    $riskycount = count_records_sql($sql);
+
+    // default role can not have view cap in all courses - this would break moodle badly
+    $viewcap = record_exists('role_capabilities', 'roleid', $default_role->id, 'permission', CAP_ALLOW, 'capability', 'moodle/course:view');
+
+    // it may have either no or 'user' legacy type - nothing else, or else it would break during upgrades badly
+    $legacyok = false;
+    $sql = "SELECT rc.capability, 1
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE rc.capability LIKE 'moodle/legacy:%'
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $default_role->id";
+    $legacycaps = get_records_sql($sql);
+    if (!$legacycaps) {
+        $legacyok = true;
+    } else if (count($legacycaps) == 1 and isset($legacycaps['moodle/legacy:user'])) {
+        $legacyok = true;
+    }
+
+    if ($anythingcount or $riskycount or $viewcap or !$legacyok) {
+        $result->status  = REPORT_SECURITY_CRITICAL;
+        $result->info    = get_string('check_defaultuserrole_error', 'report_security', format_string($default_role->name));
+
+    } else {
+        $result->status  = REPORT_SECURITY_OK;
+        $result->info    = get_string('check_defaultuserrole_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_defaultuserrole_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies sanity of guest role
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_guestrole($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_guestrole';
+    $result->name    = get_string('check_guestrole_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/settings.php?section=userpolicies\">".get_string('userpolicies', 'admin').'</a>';;
+
+    if (!$guest_role = get_record('role', 'id', $CFG->guestroleid)) {
+        $result->status  = REPORT_SECURITY_WARNING;
+        $result->info    = get_string('check_guestrole_notset', 'report_security');
+        $result->details = $result->info;
+
+        return $result;
+    }
+
+    // first test if do anything enabled - that would be really crazy!
+    $sql = "SELECT COUNT(DISTINCT rc.contextid)
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE rc.capability = 'moodle/site:doanything'
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $guest_role->id";
+
+    $anythingcount = count_records_sql($sql);
+
+    // risky caps - usually very dangerous
+    $sql = "SELECT COUNT(DISTINCT rc.contextid)
+              FROM {$CFG->prefix}role_capabilities rc
+              JOIN {$CFG->prefix}capabilities cap ON cap.name = rc.capability
+             WHERE ".sql_bitand('cap.riskbitmask', (RISK_XSS | RISK_CONFIG))." <> 0
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $guest_role->id";
+
+    $riskycount = count_records_sql($sql);
+
+    // it may have either no or 'guest' legacy type - nothing else, or else it would break during upgrades badly
+    $legacyok = false;
+    $sql = "SELECT rc.capability, 1
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE rc.capability LIKE 'moodle/legacy:%'
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $guest_role->id";
+    $legacycaps = get_records_sql($sql);
+    if (!$legacycaps) {
+        $legacyok = true;
+    } else if (count($legacycaps) == 1 and isset($legacycaps['moodle/legacy:guest'])) {
+        $legacyok = true;
+    }
+
+    if ($anythingcount or $riskycount or !$legacyok) {
+        $result->status  = REPORT_SECURITY_CRITICAL;
+        $result->info    = get_string('check_guestrole_error', 'report_security', format_string($guest_role->name));
+
+    } else {
+        $result->status  = REPORT_SECURITY_OK;
+        $result->info    = get_string('check_guestrole_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_guestrole_details', 'report_security');
+    }
+
+    return $result;
+}
+
+
+/**
+ * Verifies sanity of site default course role.
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_defaultcourserole($detailed=false) {
+    global $CFG;
+
+    $problems = array();
+
+    $result = new object();
+    $result->issue   = 'report_security_check_defaultcourserole';
+    $result->name    = get_string('check_defaultcourserole_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/settings.php?section=userpolicies\">".get_string('userpolicies', 'admin').'</a>';;
+
+    if ($detailed) {
+        $result->details = get_string('check_defaultcourserole_details', 'report_security');
+    }
+
+    if (!$student_role = get_record('role', 'id', $CFG->defaultcourseroleid)) {
+        $result->status  = REPORT_SECURITY_WARNING;
+        $result->info    = get_string('check_defaultcourserole_notset', 'report_security');
+        $result->details = get_string('check_defaultcourserole_details', 'report_security');
+
+        return $result;
+    }
+
+    // first test if do anything enabled - that would be really crazy!
+    $sql = "SELECT DISTINCT rc.contextid
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE rc.capability = 'moodle/site:doanything'
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $student_role->id";
+
+    if ($anything_contexts = get_records_sql($sql)) {
+        foreach($anything_contexts as $contextid) {
+            if ($contextid == SYSCONTEXTID) {
+                $a = "$CFG->wwwroot/$CFG->admin/roles/manage.php?action=view&amp;roleid=$CFG->defaultcourseroleid";
+            } else {
+                $a = "$CFG->wwwroot/$CFG->admin/roles/override.php?contextid=$contextid&amp;roleid=$CFG->defaultcourseroleid";
+            }
+            $problems[] = get_string('check_defaultcourserole_anything', 'report_security', $a);
+        }
+    }
+
+    // risky caps - usually very dangerous
+    $sql = "SELECT DISTINCT rc.contextid
+              FROM {$CFG->prefix}role_capabilities rc
+              JOIN {$CFG->prefix}capabilities cap ON cap.name = rc.capability
+             WHERE ".sql_bitand('cap.riskbitmask', (RISK_XSS | RISK_CONFIG))." <> 0
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $student_role->id";
+
+    if ($riskycontexts = get_records_sql($sql)) {
+        foreach($riskycontexts as $contextid=>$unused) {
+            if ($contextid == SYSCONTEXTID) {
+                $a = "$CFG->wwwroot/$CFG->admin/roles/manage.php?action=view&amp;roleid=$CFG->defaultcourseroleid";
+            } else {
+                $a = "$CFG->wwwroot/$CFG->admin/roles/override.php?contextid=$contextid&amp;roleid=$CFG->defaultcourseroleid";
+            }
+            $problems[] = get_string('check_defaultcourserole_risky', 'report_security', $a);
+        }
+    }
+
+    // course creator or administrator does not make any sense here
+    $sql = "SELECT rc.capability, 1
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE rc.capability LIKE 'moodle/legacy:%'
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $student_role->id";
+    $legacycaps = get_records_sql($sql);
+    if (isset($legacycaps['moodle/legacy:coursecreator']) or isset($legacycaps['moodle/legacy:admin'])) {
+        $problems[] = get_string('check_defaultcourserole_legacy', 'report_security');
+    }
+
+    if ($problems) {
+        $result->status  = REPORT_SECURITY_CRITICAL;
+        $result->info    = get_string('check_defaultcourserole_error', 'report_security', format_string($student_role->name));
+        if ($detailed) {
+            $result->details .= "<ul>";
+            foreach ($problems as $problem) {
+                $result->details .= "<li>$problem</li>";
+            }
+            $result->details .= "</ul>";
+        }
+
+    } else {
+        $result->status  = REPORT_SECURITY_OK;
+        $result->info    = get_string('check_defaultcourserole_ok', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies sanity of default roles in courses.
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_courserole($detailed=false) {
+    global $CFG, $SITE;
+
+    $problems = array();
+
+    $result = new object();
+    $result->issue   = 'report_security_check_courserole';
+    $result->name    = get_string('check_courserole_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+
+    if ($detailed) {
+        $result->details = get_string('check_courserole_details', 'report_security');
+    }
+
+    // get list of all student roles selected in courses excluding the default course role
+    $sql = "SELECT r.*
+              FROM {$CFG->prefix}role r
+              JOIN {$CFG->prefix}course c ON c.defaultrole = r.id
+             WHERE c.id <> $SITE->id AND r.id <> $CFG->defaultcourseroleid";
+
+    if (!$student_roles = get_records_sql($sql)) {
+        $result->status  = REPORT_SECURITY_OK;
+        $result->info    = get_string('check_courserole_notyet', 'report_security');
+        $result->details = get_string('check_courserole_details', 'report_security');
+
+        return $result;
+    }
+
+    $roleids = array_keys($student_roles);
+
+    $sql = "SELECT DISTINCT rc.roleid
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE (rc.capability = 'moodle/legacy:coursecreator' OR rc.capability = 'moodle/legacy:admin'
+                    OR rc.capability = 'moodle/legacy:teacher' OR rc.capability = 'moodle/legacy:editingteacher')
+                   AND rc.permission = ".CAP_ALLOW."";
+
+    $riskyroleids = get_records_sql($sql);
+    $riskyroleids = array_keys($riskyroleids);
+
+
+    // first test if do anything enabled - that would be really crazy!!!!!!
+    $inroles = implode(',', $roleids);
+    $sql = "SELECT rc.roleid, rc.contextid
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE rc.capability = 'moodle/site:doanything'
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid IN ($inroles)
+          GROUP BY rc.roleid, rc.contextid
+          ORDER BY rc.roleid, rc.contextid";
+
+    $rs = get_recordset_sql($sql);
+    while ($res = rs_fetch_next_record($rs)) {
+        $roleid    = $res->roleid;
+        $contextid = $res->contextid;
+        if ($contextid == SYSCONTEXTID) {
+            $a = "$CFG->wwwroot/$CFG->admin/roles/manage.php?action=view&amp;roleid=$roleid";
+        } else {
+            $a = "$CFG->wwwroot/$CFG->admin/roles/override.php?contextid=$contextid&amp;roleid=$roleid";
+        }
+        $problems[] = get_string('check_courserole_anything', 'report_security', $a);
+    }
+    rs_close($rs);
+
+    // any XSS legacy cap does not make any sense here!
+    $inroles = implode(',', $riskyroleids);
+    $sql = "SELECT DISTINCT c.id, c.shortname
+              FROM {$CFG->prefix}course c
+             WHERE c.defaultrole IN ($inroles)
+          ORDER BY c.sortorder";
+    if ($courses = get_records_sql($sql)) {
+        foreach ($courses as $course) {
+            $a = (object)array('url'=>"$CFG->wwwroot/course/edit.php?id=$course->id", 'shortname'=>$course->shortname);
+            $problems[] = get_string('check_courserole_riskylegacy', 'report_security', $a);
+        }
+    } else {
+        $course = array();
+    }
+
+    // risky caps in any level for roles not marked as risky yet - usually very dangerous!!
+    if ($checkroles = array_diff($roleids, $riskyroleids)) {
+        $inroles = implode(',', $checkroles);
+        $sql = "SELECT rc.roleid, rc.contextid
+                  FROM {$CFG->prefix}role_capabilities rc
+                  JOIN {$CFG->prefix}capabilities cap ON cap.name = rc.capability
+                 WHERE ".sql_bitand('cap.riskbitmask', (RISK_XSS | RISK_CONFIG))." <> 0
+                       AND rc.permission = ".CAP_ALLOW."
+                       AND rc.roleid IN ($inroles)
+              GROUP BY rc.roleid, rc.contextid
+              ORDER BY rc.roleid, rc.contextid";
+        $rs = get_recordset_sql($sql);
+        while ($res = rs_fetch_next_record($rs)) {
+            $roleid    = $res->roleid;
+            $contextid = $res->contextid;
+            if ($contextid == SYSCONTEXTID) {
+                $a = "$CFG->wwwroot/$CFG->admin/roles/manage.php?action=view&amp;roleid=$roleid";
+            } else {
+                $a = "$CFG->wwwroot/$CFG->admin/roles/override.php?contextid=$contextid&amp;roleid=$roleid";
+            }
+            $problems[] = get_string('check_courserole_risky', 'report_security', $a);
+        }
+        rs_close($rs);
+    }
+
+
+    if ($problems) {
+        $result->status  = REPORT_SECURITY_CRITICAL;
+        $result->info    = get_string('check_courserole_error', 'report_security');
+        if ($detailed) {
+            $result->details .= "<ul>";
+            foreach ($problems as $problem) {
+                $result->details .= "<li>$problem</li>";
+            }
+            $result->details .= "</ul>";
+        }
+
+    } else {
+        $result->status  = REPORT_SECURITY_OK;
+        $result->info    = get_string('check_courserole_ok', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Checks to see whether a password salt has been defined
+ *
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_passwordsaltmain($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_passwordsaltmain';
+    $result->name    = get_string('check_passwordsaltmain_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+
+    if (empty($CFG->passwordsaltmain)) {
+        $result->status = REPORT_SECURITY_WARNING;
+        $result->info   = get_string('check_passwordsaltmain_warning', 'report_security');
+    } else if ($CFG->passwordsaltmain === 'a_very_long_random_string_of_characters#@6&*1'
+            || trim($CFG->passwordsaltmain) === '' || preg_match('/^([a-z0-9]{0,10})$/i', $CFG->passwordsaltmain)) {
+        $result->status = REPORT_SECURITY_WARNING;
+        $result->info   = get_string('check_passwordsaltmain_weak', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_passwordsaltmain_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $docspath = $CFG->docroot.'/'.str_replace('_utf8', '', current_language()).'/report/security/report_security_check_passwordsaltmain';
+        $result->details = get_string('check_passwordsaltmain_details', 'report_security', $docspath);
+    }
+
+    return $result;
+}
@@ -45,8 +45,7 @@ class ExHtmlReporter extends HtmlReporter {

        $this->strrunonlyfolder = $this->get_string('runonlyfolder');
        $this->strrunonlyfile = $this->get_string('runonlyfile');
-        check_theme_arrows();
-        $this->strseparator = ' <span class="sep">'.$THEME->rarrow.'</span> ';
+        $this->strseparator = get_separator();
    }

    /**
@@ -0,0 +1,372 @@
+<?php
+
+/**
+ * Spam Cleaner
+ *
+ * Helps an admin to clean up spam in Moodle
+ *
+ * @version $Id$
+ * @authors Dongsheng Cai, Martin Dougiamas, Amr Hourani
+ * @license http://www.gnu.org/copyleft/gpl.html GNU Public License
+ */
+
+// Configuration
+
+// List of known spammy keywords, please add more here
+
+$autokeywords = array(
+                    "<img",
+                    "fuck",
+                    "casino",
+                    "porn",
+                    "xxx",
+                    "cialis",
+                    "viagra",
+                    "poker",
+                    "warcraft"
+                );
+
+/////////////////////////////////////////////////////////////////////////////////
+
+require_once('../../../config.php');
+require_once($CFG->libdir.'/adminlib.php');
+function delete_user($user) {
+    $updateuser = new object();
+    $updateuser->id           = $user->id;
+    $updateuser->deleted      = 1;
+    $updateuser->username     = addslashes("$user->email.".time());
+    $updateuser->email        = '';
+    $updateuser->idnumber     = '';
+    $updateuser->timemodified = time();
+    if (update_record('user', $updateuser)) {
+        role_unassign(0, $user->id);
+        return true;
+    } else {
+        return false;
+    }
+}
+
+$keyword = optional_param('keyword', '', PARAM_RAW);
+$autodetect = optional_param('autodetect', '', PARAM_RAW);
+$del = optional_param('del', '', PARAM_RAW);
+$delall = optional_param('delall', '', PARAM_RAW);
+$ignore = optional_param('ignore', '', PARAM_RAW);
+$reset = optional_param('reset', '', PARAM_RAW);
+$id = optional_param('id', '', PARAM_INT);
+
+require_login();
+$adminroot = admin_get_root();
+admin_externalpage_setup('reportspamcleaner', $adminroot);
+
+// Implement some AJAX calls 
+
+// Delete one user
+if (!empty($del) && confirm_sesskey() && ($id != $USER->id)) {
+    if (isset($SESSION->users_result[$id])) {
+        $user = $SESSION->users_result[$id];
+        if (delete_user($user)) {
+            unset($SESSION->users_result[$id]);
+            echo 1;
+        } else {
+            echo 0;
+        }
+    } else {
+        echo 0;
+    }
+    exit;
+}
+
+// Delete lots of users
+if (!empty($delall) && confirm_sesskey()) {
+    if (!empty($SESSION->users_result)) {
+        foreach ($SESSION->users_result as $userid => $user) {
+            if ($userid != $USER->id) {
+                if (delete_user($user)) {
+                    unset($SESSION->users_result[$userid]);
+                }
+            }
+        }
+    }
+    echo 1;
+    exit;
+}
+
+if (!empty($ignore)) {
+    unset($SESSION->users_result[$id]);
+    echo 1;
+    exit;
+}
+
+admin_externalpage_print_header($adminroot);
+
+// Print headers and things
+
+print_spamcleaner_javascript();
+
+print_box(get_string('spamcleanerintro', 'report_spamcleaner'));
+
+print_box_start();     // The forms section at the top
+
+?>
+
+<div class="mdl-align">
+
+<form method="post" action="index.php">
+  <div>
+    <input type="text" name="keyword" id="keyword_el" value="<?php p($keyword) ?>" /> 
+    <input type="hidden" name="sesskey" value="<?php echo sesskey();?>" />
+    <input type="submit" value="<?php echo get_string('spamsearch', 'report_spamcleaner')?>" />
+  </div>
+</form>
+<p><?php echo get_string('spameg', 'report_spamcleaner');?></p>
+
+<hr />
+
+<form method="post"  action="index.php">
+  <div>
+    <input type="submit" name="autodetect" value="<?php echo get_string('spamauto', 'report_spamcleaner');?>" />
+  </div>
+</form>
+
+
+</div>
+
+<?php
+print_box_end(); 
+
+echo '<div id="result" class="mdl-align">';
+
+// Print list of resulting profiles
+
+if (!empty($keyword)) {               // Use the keyword(s) supplied by the user
+    $keywords = explode(',', $keyword);
+    foreach ($keywords as $key => $keyword) {
+        $keywords[$key] = trim($keyword);
+    }
+    search_spammers($keywords);
+
+} else if (!empty($autodetect)) {     // Use the inbuilt keyword list to detect users
+    search_spammers($autokeywords);
+}
+
+echo '</div>';
+
+/////////////////////////////////////////////////////////////////////////////////
+
+
+///  Functions 
+
+
+function search_spammers($keywords) {
+
+    global $CFG, $USER, $DB; 
+
+    if (!is_array($keywords)) {
+        $keywords = array($keywords);    // Make it into an array
+    }
+
+    $like = sql_ilike();
+
+    $keywordfull = array();
+    foreach ($keywords as $keyword) {
+        $keyword = addslashes($keyword);   // Just to be safe
+        $keywordfull[] = " description $like '%$keyword%' ";
+        $keywordfull2[] = " p.summary $like '%$keyword%' ";
+    }
+    $conditions = '( '.implode(' OR ', $keywordfull).' )';
+    $conditions2 = '( '.implode(' OR ', $keywordfull2).' )';
+
+    $sql = "SELECT * FROM {$CFG->prefix}user WHERE deleted = 0 AND id <> {$USER->id} AND $conditions";  // Exclude oneself
+    $sql2= "SELECT u.*, p.summary FROM {$CFG->prefix}user AS u, {$CFG->prefix}post AS p WHERE $conditions2 AND u.deleted = 0 AND u.id=p.userid AND u.id <> {$USER->id}";
+    $spamusers_desc = get_recordset_sql($sql);
+    $spamusers_blog = get_recordset_sql($sql2);
+
+    $keywordlist = implode(', ', $keywords);
+    print_box(get_string('spamresult', 'report_spamcleaner').s($keywordlist)).' ...';
+
+    print_user_list(array($spamusers_desc, $spamusers_blog), $keywords);
+
+}
+
+function print_user_list($users_rs, $keywords) {
+    global $CFG, $SESSION;
+
+    // reset session everytime this function is called
+    $SESSION->users_result = array();
+    $count = 0;
+
+    foreach ($users_rs as $rs) {
+        while ($user = rs_fetch_next_record($rs)) {
+            if (!$count) {
+                echo '<table border="1" width="100%" id="data-grid"><tr><th>&nbsp;</th><th>'.get_string('user','admin').'</th><th>'.get_string('spamdesc', 'report_spamcleaner').'</th><th>'.get_string('spamoperation', 'report_spamcleaner').'</th></tr>';
+            }
+            $count++;
+            filter_user($user, $keywords, $count);
+        }
+    }
+
+    if (!$count) {
+        echo get_string('spamcannotfinduser', 'report_spamcleaner');
+
+    } else {
+        echo '</table>';
+        echo '<div class="mld-align">
+              <button id="removeall_btn">'.get_string('spamdeleteall', 'report_spamcleaner').'</button>
+              </div>';
+    }
+}
+function filter_user($user, $keywords, $count) {
+    global $CFG;
+    $image_search = false;
+    if (in_array('<img', $keywords)) {
+        $image_search = true;
+    }
+    if (isset($user->summary)) {
+        $user->description = '<h3>'.get_string('spamfromblog', 'report_spamcleaner').'</h3>'.$user->summary;
+        unset($user->summary);
+    }
+    if (preg_match('#<img.*src=[\"\']('.$CFG->pixpath.')#', $user->description, $matches)
+        && $image_search) {
+        $result = false;
+        foreach ($keywords as $keyword) {
+            if (preg_match('#'.$keyword.'#', $user->description)
+                && ($keyword != '<img')) {
+                $result = true;
+            }
+        }
+        if ($result) {
+            echo print_user_entry($user, $keywords, $count);
+        } else {
+            unset($user);
+        }
+    } else {
+        echo print_user_entry($user, $keywords, $count);
+    }
+}
+
+
+function print_user_entry($user, $keywords, $count) {
+
+    global $SESSION, $CFG;
+
+    $smalluserobject = new object;      // All we need to delete them later
+    $smalluserobject->id = $user->id;
+    $smalluserobject->email = $user->email;
+    $smalluserobject->auth = $user->auth;
+    $smalluserobject->firstname = $user->firstname;
+    $smalluserobject->lastname = $user->lastname;
+
+    if (empty($SESSION->users_result[$user->id])) {
+        $SESSION->users_result[$user->id] = $smalluserobject;
+        $html = '<tr valign="top" id="row-'.$user->id.'" class="result-row">';
+        $html .= '<td width="10">'.$count.'</td>';
+        $html .= '<td width="30%" align="left"><a href="'.$CFG->wwwroot."/user/view.php?course=1&amp;id=".$user->id.'" title="'.s($user->username).'">'.fullname($user).'</a>';
+
+        $html .= "<ul>";
+        $profile_set = array('city'=>true, 'country'=>true, 'email'=>true);
+        foreach ($profile_set as $key=>$value) {
+            if (isset($user->$key)){
+                $html .= '<li>'.$user->$key.'</li>';
+            }
+        }
+        $html .= "</ul>";
+        $html .= '</td>';
+
+        foreach ($keywords as $keyword) {
+            $user->description = highlight($keyword, $user->description);
+        }
+
+        $html .= '<td align="left">'.format_text($user->description, FORMAT_MOODLE).'</td>';
+        $html .= '<td width="100px" align="center">';
+        $html .= '<button onclick="del_user(this,'.$user->id.')">'.get_string('deleteuser', 'admin').'</button><br />';
+        $html .= '<button onclick="ignore_user(this,'.$user->id.')">'.get_string('ignore', 'admin').'</button>';
+        $html .= '</td>';
+        $html .= '</tr>';
+        return $html;
+    } else {
+        return null;
+    }
+
+
+}
+
+function print_spamcleaner_javascript()  {
+    global $CFG;
+
+$sesskey = sesskey();
+
+?>
+<script type="text/javascript" src="<?php echo $CFG->wwwroot;?>/lib/yui/yahoo-dom-event/yahoo-dom-event.js"></script>
+<script type="text/javascript" src="<?php echo $CFG->wwwroot;?>/lib/yui/connection/connection-min.js"></script>
+<script type="text/javascript">
+//<![CDATA[
+var row = null;
+var delall_cb = {
+    success: function(o){
+        var resp = o.responseText;
+        if(resp){
+            window.location.href=window.location.href;
+        }
+    }
+}
+function init() {
+    YAHOO.util.Event.addListener("removeall_btn", "click", function(){
+        var yes = confirm('<?php echo get_string('spamdeleteallconfirm', 'report_spamcleaner');?>');
+        if(yes){
+            var cObj = YAHOO.util.Connect.asyncRequest('POST', '<?php echo me();?>?delall=yes&sesskey=<?php echo $sesskey;?>', delall_cb); 
+        }
+    });
+}
+var del_cb = {
+    success: function(o) {
+        var resp = o.responseText;
+        if(row) {
+            if(resp){
+                while(row.tagName != 'TR') {
+                    row = row.parentNode;
+                }
+                row.parentNode.removeChild(row);
+                row = null;
+            } else {
+                alert('<?php echo get_string('spamcannotdelete', 'report_spamcleaner');?>');
+            }
+        }
+    }
+}
+var ignore_cb = {
+    success: function(o){
+        var resp = o.responseText;
+        if(row) {
+            if(resp){
+                while(row.tagName != 'TR') {
+                    row = row.parentNode;
+                }
+                row.parentNode.removeChild(row);
+                row = null;
+            }
+        }
+    }
+}
+function del_user(obj, id) {
+    var yes = confirm('<?php echo get_string('spamdeleteconfirm', 'report_spamcleaner');?>');
+    if(yes){
+        row = obj;
+        var cObj = YAHOO.util.Connect.asyncRequest('POST', '<?php echo me();?>?del=yes&sesskey=<?php echo $sesskey;?>&id='+id, del_cb); 
+    }
+}
+function ignore_user(obj, id) {
+    row = obj;
+    var cObj = YAHOO.util.Connect.asyncRequest('POST', '<?php echo me();?>?ignore=yes&sesskey=<?php echo $sesskey;?>&id='+id, ignore_cb); 
+}
+window.onload = function(){
+    init();
+}
+//]]>
+</script>
+
+<?php 
+}
+
+admin_externalpage_print_footer($adminroot);
+
+?>
@@ -0,0 +1,5 @@
+<?php
+
+// spam cleaner
+$ADMIN->add('reports', new admin_externalpage('reportspamcleaner', get_string('spamcleaner','report_spamcleaner'), "$CFG->wwwroot/$CFG->admin/report/spamcleaner/index.php", 'moodle/site:config'));
+
@@ -30,7 +30,7 @@
    }

    if ($mode == STATS_MODE_RANKED) {
-        redirect($CFG->wwwroot.'/'.$CFG->admin.'/report/stats/index.php?time='.$time);
+        redirect($CFG->wwwroot.'/'.$CFG->admin.'/report/stats/index.php?time='.$time, '', 3, $adminroot);
    }

    if (!$course = get_record("course","id",$courseid)) {
@@ -46,7 +46,7 @@
    require_login();

    if (empty($CFG->enablestats)) {
-        redirect("$CFG->wwwroot/$CFG->admin/settings.php?section=stats", get_string('mustenablestats', 'admin'));
+        redirect("$CFG->wwwroot/$CFG->admin/settings.php?section=stats", get_string('mustenablestats', 'admin'), 3, $adminroot);
    }

    require_capability('moodle/site:viewreports', get_context_instance(CONTEXT_COURSE, $course->id));
@@ -24,10 +24,10 @@

    $roles = get_all_roles();

-    if ($grant = data_submitted()) {
+    if ($grant = data_submitted() and confirm_sesskey()) {

        foreach ($grant as $grole => $val) {
-            if ($grole == 'dummy') {
+            if ($grole == 'dummy' or !strpos($grole, '_')) {
                continue;
            }

@@ -80,9 +80,10 @@

    echo '<form action="allowassign.php" method="post">';
    print_table($table);
-    echo '<div class="singlebutton"><input type="submit" value="'.get_string('savechanges').'"/></div>';
+    echo '<div class="buttons"><input type="submit" value="'.get_string('savechanges').'"/>';
    echo '<input type="hidden" name="dummy" value="1" />'; // this is needed otherwise we do not know a form has been submitted
-    echo '</form>';
+    echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
+    echo '</div></form>';

    admin_externalpage_print_footer($adminroot);

@@ -22,10 +22,10 @@

    $roles = get_all_roles();

-    if ($grant = data_submitted()) {
+    if ($grant = data_submitted() and confirm_sesskey()) {

        foreach ($grant as $grole => $val) {
-            if ($grole == 'dummy') {
+            if ($grole == 'dummy' or !strpos($grole, '_')) {
                continue;
            }

@@ -78,9 +78,10 @@

    echo '<form action="allowoverride.php" method="post">';
    print_table($table);
-    echo '<div class="singlebutton"><input type="submit" value="'.get_string('savechanges').'"/></div>';
+    echo '<div class="buttons"><input type="submit" value="'.get_string('savechanges').'"/>';
    echo '<input type="hidden" name="dummy" value="1" />'; // this is needed otherwise we do not know a form has been submitted
-    echo '</form>';
+    echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
+    echo '</div></form>';

    admin_externalpage_print_footer($adminroot);

@@ -15,31 +15,36 @@
                  onfocus="getElementById('assignform').add.disabled=true;
                           getElementById('assignform').remove.disabled=false;
                           getElementById('assignform').addselect.selectedIndex=-1;">
-          
+
          <?php
-              foreach ($contextusers as $contextuser) {
-                  $fullname = fullname($contextuser, true);
-                  if ($contextuser->hidden) {
-                      $hidden=' ('.get_string('hiddenassign').') ';
-                  } else {
-                      $hidden="";
-                  }
-                  echo "<option value=\"$contextuser->id\">".$fullname.", ".$contextuser->email.$hidden."</option>\n";
-              }
+            $i = 0;
+            foreach ($contextusers as $contextuser) {
+                $fullname = fullname($contextuser, true);
+                if ($contextuser->hidden) {
+                    $hidden=' ('.get_string('hiddenassign').') ';
+                } else {
+                    $hidden="";
+                }
+                echo "<option value=\"$contextuser->id\">".$fullname.", ".$contextuser->email.$hidden."</option>\n";
+                $i++;    
+            }
+            if ($i==0) {
+                echo '<option/>'; // empty select breaks xhtml strict
+            }
          ?>
-          <option/>
+          
          </select></td>
      <td valign="top">
        <br />
        <label title="<?php print_string('hiddenassign') ?>">
            <input type="checkbox" name="hidden" value="1" />
            <img src="<?php echo $CFG->pixpath; ?>/t/hide.gif" alt="<?php print_string('hiddenassign') ?>" class="hide-show-image" />
+            <?php helpbutton('hiddenassign', get_string('hiddenassign')); ?>
        </label>
        <?php check_theme_arrows(); ?>
        <p class="arrow_button">
-            <input name="add" id="add" type="submit" value="<?php echo '&nbsp;'.$THEME->larrow.' &nbsp; &nbsp; '.get_string('add'); ?>" title="<?php print_string('add'); ?>" />
-            <br />
-            <input name="remove" id="remove" type="submit" value="<?php echo '&nbsp; '.$THEME->rarrow.' &nbsp; &nbsp; '.get_string('remove'); ?>" title="<?php print_string('remove'); ?>" />
+            <input name="add" id="add" type="submit" value="<?php echo $THEME->larrow.'&nbsp;'.get_string('add'); ?>" title="<?php print_string('add'); ?>" /><br />
+            <input name="remove" id="remove" type="submit" value="<?php echo get_string('remove').'&nbsp;'.$THEME->rarrow; ?>" title="<?php print_string('remove'); ?>" />
        </p>
      </td>
      <td valign="top">
@@ -50,32 +55,32 @@
                           getElementById('assignform').remove.disabled=true;
                           getElementById('assignform').removeselect.selectedIndex=-1;">
          <?php
+            $i=0;
+            if (!empty($searchtext)) {
+                echo "<optgroup label=\"$strsearchresults (" . $usercount . ")\">\n";
+                while ($user = rs_fetch_next_record($availableusers)) {
+                    $fullname = fullname($user, true);
+                    echo "<option value=\"$user->id\">".$fullname.", ".$user->email."</option>\n";
+                    $i++;
+                }
+                echo "</optgroup>\n";

-              if (!empty($searchtext)) {
-                  echo "<optgroup label=\"$strsearchresults (" . $availableusers->_numOfRows . ")\">\n";
-                  while ($user = rs_fetch_next_record($availableusers)) {
-                      if (!isset($contextusers[$user->id])) {
-                          $fullname = fullname($user, true);
-                          echo "<option value=\"$user->id\">".$fullname.", ".$user->email."</option>\n";
-                      }
-                  }
-                  echo "</optgroup>\n";
-
-              } else {
-                  if ($usercount > MAX_USERS_PER_PAGE) {
-                      echo '<optgroup label="'.get_string('toomanytoshow').'"><option></option></optgroup>'."\n"
+            } else {
+                if ($usercount > MAX_USERS_PER_PAGE) {
+                    echo '<optgroup label="'.get_string('toomanytoshow').'"><option></option></optgroup>'."\n"
                          .'<optgroup label="'.get_string('trysearching').'"><option></option></optgroup>'."\n";
-                  } else {
-                      while ($user = rs_fetch_next_record($availableusers)) {
-                          if (!isset($contextusers[$user->id])) {
-                              $fullname = fullname($user, true);
-                              echo "<option value=\"$user->id\">".$fullname.", ".$user->email."</option>\n";
-                          }
-                      }
-                  }
-              }
+                } else {
+                    while ($user = rs_fetch_next_record($availableusers)) {
+                        $fullname = fullname($user, true);
+                        echo "<option value=\"$user->id\">".$fullname.", ".$user->email."</option>\n";
+                        $i++;
+                    }
+                }
+            }
+            if ($i==0) {
+                echo '<option/>'; // empty select breaks xhtml strict
+            }
          ?>
-         <option/>
         </select>
         <br />
         <label for="searchtext" class="accesshide"><?php p($strsearch) ?></label>
@@ -19,7 +19,7 @@
    $timeend        = optional_param('timened', 0, PARAM_INT);
    $userid         = optional_param('userid', 0, PARAM_INT); // needed for user tabs
    $courseid       = optional_param('courseid', 0, PARAM_INT); // needed for user tabs
-    
+
    $errors = array();

    $previoussearch = ($searchtext != '') or ($previoussearch) ? 1:0;
@@ -50,9 +50,11 @@
        }
    } else {
        $courseid = SITEID;
-        $course = get_site();
+        $course = clone($SITE);
    }

+    require_login($course);
+
    if ($context->contextlevel == CONTEXT_COURSE) {
        require_login($context->instanceid);
    } else {
@@ -61,7 +63,10 @@

    require_capability('moodle/role:assign', $context);

-    $assignableroles = get_assignable_roles($context);
+/// needed for tabs.php
+    $overridableroles = get_overridable_roles($context);
+    $assignableroles  = get_assignable_roles($context);
+
 /// Get some language strings

    $strassignusers = get_string('assignusers', 'role');
@@ -103,7 +108,7 @@

        /// site header
        } else {
-            print_header("$course->fullname: $fullname", "$course->fullname",
+            print_header("$course->fullname: $fullname", $course->fullname,
                        "<a href=\"$CFG->wwwroot/user/view.php?id=$userid&amp;course=$courseid\">$fullname</a> -> $straction", "", "", true, "&nbsp;", navmenu($course));
        }

@@ -158,12 +163,14 @@
                    }
                }
            }
-
+            
+            $rolename = get_field('role', 'name', 'id', $roleid);
+            add_to_log($course->id, 'role', 'assign', 'admin/roles/assign.php?contextid='.$context->id.'&roleid='.$roleid, $rolename, '', $USER->id);
        } else if ($remove and !empty($frm->removeselect) and confirm_sesskey()) {

            $sitecontext = get_context_instance(CONTEXT_SYSTEM);
            $topleveladmin = false;
-   
+
            // we only worry about this if the role has doanything capability at site level
            if ($context->id == $sitecontext->id && $adminroles = get_roles_with_capability('moodle/site:doanything', CAP_ALLOW, $sitecontext)) {
                foreach ($adminroles as $adminrole) {
@@ -172,7 +179,7 @@
                    }
                }
            }
-            
+
            foreach ($frm->removeselect as $removeuser) {
                $removeuser = clean_param($removeuser, PARAM_INT);

@@ -192,11 +199,16 @@
                    }
                }
            }
-
+            
+            $rolename = get_field('role', 'name', 'id', $roleid);
+            add_to_log($course->id, 'role', 'unassign', 'admin/roles/assign.php?contextid='.$context->id.'&roleid='.$roleid, $rolename, '', $USER->id);
        } else if ($showall) {
            $searchtext = '';
            $previoussearch = 0;
        }
+        
+        
+    
    }

    if ($context->contextlevel==CONTEXT_COURSE and $context->instanceid == SITEID) {
@@ -205,6 +217,10 @@
        print_heading_with_help(get_string('assignroles', 'role'), 'assignroles');
    }

+    if ($context->contextlevel==CONTEXT_SYSTEM) {
+        print_box(get_string('globalroleswarning', 'role'));
+    }
+    
    if ($roleid) {        /// prints a form to swap roles

    /// Get all existing participants in this context.
@@ -215,7 +231,7 @@
        }

        $select  = "username <> 'guest' AND deleted = 0 AND confirmed = 1";
-    
+
        $usercount = count_records_select('user', $select) - count($contextusers);

        $searchtext = trim($searchtext);
@@ -224,21 +240,103 @@
            $LIKE      = sql_ilike();
            $FULLNAME  = sql_fullname();

-            $select  .= " AND ($FULLNAME $LIKE '%$searchtext%' OR email $LIKE '%$searchtext%') ";
+            $selectsql = " AND ($FULLNAME $LIKE '%$searchtext%' OR email $LIKE '%$searchtext%') ";
+            $select  .= $selectsql;
+        } else { 
+            $selectsql = ""; 
        }

-        $availableusers = get_recordset_sql('SELECT id, firstname, lastname, email 
-                                               FROM '.$CFG->prefix.'user 
-                                              WHERE '.$select.'
-                                            ORDER BY lastname ASC, firstname ASC');
+        if ($context->contextlevel > CONTEXT_COURSE) { // mod or block (or group?)

-        /// In the .html file below we loop through these results and exclude any in $contextusers
+            /************************************************************************
+             *                                                                      *
+             * context level is above or equal course context level                 *
+             * in this case we pull out all users matching search criteria (if any) *
+             *                                                                      *
+             * MDL-11324                                                            *
+             * a mini get_users_by_capability() call here, this is done instead of  *
+             * get_users_by_capability() because                                    *
+             * 1) get_users_by_capability() does not deal with searching by name    *
+             * 2) exceptions array can be potentially large for large courses       *
+             * 3) get_recordset_sql() is more efficient                             *
+             *                                                                      *
+             ************************************************************************/
+        
+            if ($possibleroles = get_roles_with_capability('moodle/course:view', CAP_ALLOW, $context)) {
+  
+                $doanythingroles = get_roles_with_capability('moodle/site:doanything', CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM));

+                $validroleids = array();
+                foreach ($possibleroles as $possiblerole) {
+                    if (isset($doanythingroles[$possiblerole->id])) {  // We don't want these included
+                            continue;
+                    }
+                    if ($caps = role_context_capabilities($possiblerole->id, $context, 'moodle/course:view')) { // resolved list
+                        if (isset($caps['moodle/course:view']) && $caps['moodle/course:view'] > 0) { // resolved capability > 0
+                            $validroleids[] = $possiblerole->id;
+                        }
+                    }
+                }
+
+                if ($validroleids) {
+                    $roleids =  '('.implode(',', $validroleids).')';
+            
+                    $select = " SELECT u.id, u.firstname, u.lastname, u.email";
+                    $countselect = "SELECT COUNT(u.id)";
+                    $from   = " FROM {$CFG->prefix}user u
+                                INNER JOIN {$CFG->prefix}role_assignments ra ON ra.userid = u.id
+                                INNER JOIN {$CFG->prefix}role r ON r.id = ra.roleid";
+                    $where  = " WHERE ra.contextid ".get_related_contexts_string($context)."
+                                AND u.deleted = 0
+                                AND ra.roleid in $roleids";
+                    $excsql = " AND u.id NOT IN (
+                                    SELECT u.id
+                                    FROM {$CFG->prefix}role_assignments r,
+                                    {$CFG->prefix}user u
+                                    WHERE r.contextid = $contextid
+                                    AND u.id = r.userid 
+                                    AND r.roleid = $roleid
+                                    $selectsql)";
+            
+                    $availableusers = get_recordset_sql($select . $from . $where . $selectsql . $excsql);         
+                }
+
+                $usercount =  $availableusers->_numOfRows;
+
+            }
+
+        } else { 
+         
+            /************************************************************************
+             *                                                                      *
+             * context level is above or equal course context level                 *
+             * in this case we pull out all users matching search criteria (if any) *
+             *                                                                      *
+             ************************************************************************/
+            
+            /// MDL-11111 do not include user already assigned this role in this context as available users
+            /// so that the number of available users is right and we save time looping later
+            $availableusers = get_recordset_sql('SELECT id, firstname, lastname, email
+                                                FROM '.$CFG->prefix.'user
+                                                WHERE '.$select.'
+                                                AND id NOT IN (
+                                                    SELECT u.id
+                                                    FROM '.$CFG->prefix.'role_assignments r,
+                                                    '.$CFG->prefix.'user u
+                                                    WHERE r.contextid = '.$contextid.'
+                                                    AND u.id = r.userid 
+                                                    AND r.roleid = '.$roleid.'
+                                                    '.$selectsql.')
+                                                ORDER BY lastname ASC, firstname ASC');
+
+            $usercount = $availableusers->_numOfRows;         
+
+        }
+    
        echo '<div style="text-align:center">'.$strcurrentcontext.': '.print_context_name($context).'<br/>';
-        echo '<label>'.$strroletoassign.'</label>: ';
-        $assignableroles = array('0'=>get_string('listallroles', 'role').'...') + $assignableroles; 
+        $assignableroles = array('0'=>get_string('listallroles', 'role').'...') + $assignableroles;
        popup_form("$CFG->wwwroot/$CFG->admin/roles/assign.php?userid=$userid&amp;courseid=$courseid&amp;contextid=$contextid&amp;roleid=",
-            $assignableroles, 'switchrole', $roleid, '');
+            $assignableroles, 'switchrole', $roleid, '', '', '', false, 'self', $strroletoassign);
        echo '</div>';

        print_simple_box_start('center');
@@ -4,67 +4,98 @@
        case 'add':
            $submitlabel = get_string('addrole', 'role');
            break;
-        case 'view':
-            $submitlabel = get_string('listallroles', 'role');
-            break;
        case 'edit':
        default:
            $submitlabel = get_string('savechanges');
    }

+    if ($action == 'view') {
+?>
+<?php
+    }
 ?>
-
-<div align="right">
-<a href="manage.php?roleid=<?php p($roleid); ?>&amp;action=duplicate"><?php print_string('duplicaterole'); ?></a>
-</div>
 <form id="rolesform" action="manage.php" method="post">
+<fieldset class="invisiblefieldset">
 <input type="hidden" name="roleid" value="<?php p($roleid) ?>" />
 <input type="hidden" name="sesskey" value="<?php p(sesskey()) ?>" />
 <input type="hidden" name="action" value="<?php if ($action != 'view') { echo p($action); } ?>" />
-
-<table cellpadding="9" cellspacing="0" align="center">
-<tr valign="top">
-    <td align="right"><?php print_string('name') ?>:</td>
-    <td><?php
-    if ($action == 'view') {
-        p($role->name);
-    } else {
-        echo '<input type="text" name="name" maxlength="254" size="50" value="'.s($role->name).'" />';
-        if (isset($errors["name"])) formerr($errors["name"]);
-    } ?></td>
-</tr>
-<tr valign="top">
-    <td align="right"><?php print_string('shortname') ?>:</td>
-    <td><?php
-    if ($action == 'view') {
-        p($role->shortname);
-    } else {
-        echo '<input type="text" name="shortname" maxlength="20" size="15" value="'.s($role->shortname).'" />';
-        if (isset($errors["shortname"])) formerr($errors["shortname"]);
-    } ?></td>
-</tr>
-<tr valign="top">
-    <td align="right"><?php print_string('description') ?>:</td>
-    <td><?php
-    if ($action == 'view') {
-        p($role->description);
-        $usehtmleditor = false;
-    } else {
-        print_textarea($usehtmleditor, 10, 50, 50, 10, 'description', $role->description);
-    } ?></td>
-</tr>
+</fieldset>
+<table class="roledesc" cellpadding="9" cellspacing="0">
+<?php if ($action == 'view') { ?>
+    <tr valign="top">
+        <td align="right"><?php print_string('name') ?>:</td>
+        <td><?php p($role->name); ?></td>
+    </tr>
+    <tr valign="top">
+        <td align="right"><?php print_string('shortname') ?>:</td>
+        <td><?php p($role->shortname); ?></td>
+    </tr>
+    <tr valign="top">
+        <td align="right"><?php print_string('description') ?>:</td>
+        <td><?php p($role->description); $usehtmleditor = false; ?></td>
+    </tr>
+    <tr valign="top">
+        <td align="right"><?php print_string('legacytype', 'role') ?>:</td>
+        <td><?php 
+                $usehtmleditor = false;
+                if (empty($role->legacytype)) {
+                    print_string('none');
+                } else {
+                    print_string('legacy:'.$role->legacytype, 'role');
+                }
+            ?>
+        </td>
+    </tr>
+<?php } else { ?>
+    <tr valign="top">
+        <td align="right"><label for="name"><?php print_string('name') ?></label></td>
+        <td><?php
+            echo '<input type="text" id="name" name="name" maxlength="254" size="50" value="'.s($role->name).'" />';
+            if (isset($errors["name"])) formerr($errors["name"]);
+            ?>
+        </td>
+    </tr>
+    <tr valign="top">
+        <td align="right"><label for="shortname"><?php print_string('shortname') ?></label></td>
+        <td><?php
+            echo '<input type="text" id="shortname" name="shortname" maxlength="20" size="15" value="'.s($role->shortname).'" />';
+            if (isset($errors["shortname"])) formerr($errors["shortname"]);
+            ?>
+        </td>
+    </tr>
+    <tr valign="top">
+        <td align="right"><label for="edit-description"><?php print_string('description') ?></label></td>
+        <td><?php
+            print_textarea($usehtmleditor, 10, 50, 50, 10, 'description', $role->description);
+            ?>
+        </td>
+    </tr>
+    <tr valign="top">
+        <td align="right"><label for="menulegacytype"><?php print_string('legacytype', 'role') ?></label></td>
+        <td><?php
+            $options = array();
+            $options[''] = get_string('none');
+            $legacyroles = get_legacy_roles();
+            foreach($legacyroles as $ltype=>$lcap) {
+                $options[$ltype] = get_string('legacy:'.$ltype, 'role');
+            }
+            choose_from_menu($options, 'legacytype', $role->legacytype, '');
+            ?>
+        </td>
+    </tr>
+<?php } ?>
 </table>

-<?php 
+<?php
    print_heading_with_help(get_string('permissions','role'), 'permissions');

-    $strinherit = get_string('inherit','role');
+    $strinherit = get_string('notset','role');
    $strallow = get_string('allow','role');
    $strprevent = get_string('prevent','role');
    $strprohibit = get_string('prohibit','role');
 ?>

-<table class="rolecap" align="center">
+<table class="rolecap">

 <tr>
 <th class="name" align="left" scope="col"><?php print_string('capability','role') ?></th>
@@ -82,9 +113,23 @@ $contextlevel = 0;
 $component = '';

 $strrisks = s(get_string('risks', 'role'));
-$strcapabilities = s(get_string('capabilities', 'role'));
+// MDL-11687
+$strcapabilities = 'Capabilities';//s(get_string('capabilities', 'role'));
+
+// prepare legacy defaults
+if (!empty($role->legacytype)) {
+    $defaultcaps = get_default_capabilities($role->legacytype);
+} else {
+    $defaultcaps = false;
+}

 foreach ($capabilities as $capability) {
+
+    //legacy caps have their own selector
+    if (islegacy($capability->name)) {
+        continue;
+    }
+
    // prints a breaker if component or name or context level
    if ($capability->component != $component or $capability->contextlevel != $contextlevel) {
        echo ('<tr class="rolecapheading header"><td colspan="10" class="header"><strong>'.
@@ -97,7 +142,6 @@ foreach ($capabilities as $capability) {

    if (empty($errors)) {
       // check the capability override for this cap, this role in this context
-        $sitecontext = get_context_instance(CONTEXT_SYSTEM, SITEID);
        $localoverride = get_local_override($roleid, $sitecontext->id, $capability->name);
    } else {
        $localoverride = new object();
@@ -109,44 +153,53 @@ foreach ($capabilities as $capability) {
    $riskinfo = '<td class="risk managetrust">';
    $rowclasses = '';
    if (RISK_MANAGETRUST & (int)$capability->riskbitmask) {
-        $riskinfo .= '<a target="docspopup" title="'.get_string('riskmanagetrust', 'admin').'" href="'.$CFG->docroot.'/'.$lang.'/'.$strrisks.'">';
+        $riskinfo .= '<a onclick="this.target=\'docspopup\'" title="'.get_string('riskmanagetrust', 'admin').'" href="'.$CFG->docroot.'/'.$lang.'/'.$strrisks.'">';
        $riskinfo .= '<img src="'.$CFG->pixpath.'/i/risk_managetrust.gif" alt="'.get_string('riskmanagetrustshort', 'admin').'" /></a>';
        $rowclasses .= ' riskmanagetrust';
    }
    $riskinfo .= '</td><td class="risk config">';
    if (RISK_CONFIG & (int)$capability->riskbitmask) {
-        $riskinfo .= '<a target="docspopup" title="'.get_string('riskconfig', 'admin').'" href="'.$CFG->docroot.'/'.$lang.'/'.$strrisks.'">';
+        $riskinfo .= '<a onclick="this.target=\'docspopup\'" title="'.get_string('riskconfig', 'admin').'" href="'.$CFG->docroot.'/'.$lang.'/'.$strrisks.'">';
        $riskinfo .= '<img src="'.$CFG->pixpath.'/i/risk_config.gif" alt="'.get_string('riskconfigshort', 'admin').'" /></a>';
        $rowclasses .= ' riskconfig';
    }
    $riskinfo .= '</td><td class="risk xss">';
    if (RISK_XSS & (int)$capability->riskbitmask) {
-        $riskinfo .= '<a target="docspopup" title="'.get_string('riskxss', 'admin').'" href="'.$CFG->docroot.'/'.$lang.'/'.$strrisks.'">';
+        $riskinfo .= '<a onclick="this.target=\'docspopup\'" title="'.get_string('riskxss', 'admin').'" href="'.$CFG->docroot.'/'.$lang.'/'.$strrisks.'">';
        $riskinfo .= '<img src="'.$CFG->pixpath.'/i/risk_xss.gif" alt="'.get_string('riskxssshort', 'admin').'" /></a>';
        $rowclasses .= ' riskxss';
    }
    $riskinfo .= '</td><td class="risk personal">';
    if (RISK_PERSONAL & (int)$capability->riskbitmask) {
-        $riskinfo .= '<a target="docspopup" title="'.get_string('riskpersonal', 'admin').'" href="'.$CFG->docroot.'/'.$lang.'/'.$strrisks.'">';
+        $riskinfo .= '<a onclick="this.target=\'docspopup\'" title="'.get_string('riskpersonal', 'admin').'" href="'.$CFG->docroot.'/'.$lang.'/'.$strrisks.'">';
        $riskinfo .= '<img src="'.$CFG->pixpath.'/i/risk_personal.gif" alt="'.get_string('riskpersonalshort', 'admin').'" /></a>';
        $rowclasses .= ' riskpersonal';
    }
    $riskinfo .= '</td><td class="risk spam">';
    if (RISK_SPAM & (int)$capability->riskbitmask) {
-        $riskinfo .= '<a target="docspopup" title="'.get_string('riskspam', 'admin').'" href="'.$CFG->docroot.'/'.$lang.'/'.$strrisks.'">';
+        $riskinfo .= '<a onclick="this.target=\'docspopup\'" title="'.get_string('riskspam', 'admin').'" href="'.$CFG->docroot.'/'.$lang.'/'.$strrisks.'">';
        $riskinfo .= '<img src="'.$CFG->pixpath.'/i/risk_spam.gif" alt="'.get_string('riskspamshort', 'admin').'" /></a>';
        $rowclasses .= ' riskspam';
    }
    $riskinfo .= '</td>';

+    $isinherit  = (!isset($defaultcaps[$capability->name]) or $defaultcaps[$capability->name] == CAP_INHERIT) ? 'capdefault' : '';
+    $isallow    = (isset($defaultcaps[$capability->name]) and $defaultcaps[$capability->name] == CAP_ALLOW) ? 'capdefault' : '';
+    $isprevent  = (isset($defaultcaps[$capability->name]) and $defaultcaps[$capability->name] == CAP_PREVENT) ? 'capdefault' : '';
+    $isprohibit = (isset($defaultcaps[$capability->name]) and $defaultcaps[$capability->name] == CAP_PROHIBIT) ? 'capdefault' : '';
+
    ?>

        <tr class="rolecap <?php echo $rowclasses; ?>">
-        <td class="name"><span class="cap-desc"><a target="docspopup" href="<?php echo $CFG->docroot.'/'.$lang.'/'.$strcapabilities.'/'.$capability->name ?>"><?php echo get_capability_string($capability->name); ?></a><span class="cap-name"><?php echo $capability->name ?></span></span></td>
-        <td class="inherit"><input type="radio" title="<?php p($strinherit); ?>" name="<?php echo $capability->name; ?>" value="<?php echo CAP_INHERIT ?>" <?php if (!isset($localoverride->permission) || $localoverride->permission==CAP_INHERIT){ echo 'checked="checked"'; }?> <?php echo $disabled; ?>/></td>
-        <td class="allow"><input type="radio" title="<?php p($strallow); ?>" name="<?php echo $capability->name; ?>" value="<?php echo CAP_ALLOW ?>" <?php if (isset($localoverride->permission) && $localoverride->permission==CAP_ALLOW){ echo 'checked="checked"'; }?> <?php echo $disabled; ?>/></td>
-        <td class="prevent" ><input type="radio" title="<?php p($strprevent); ?>" name="<?php echo $capability->name; ?>" value="<?php echo CAP_PREVENT ?>" <?php if (isset($localoverride->permission) && $localoverride->permission==CAP_PREVENT){ echo 'checked="checked"'; }?> <?php echo $disabled; ?>/></td>
-        <td class="prohibit" ><input type="radio" title="<?php p($strprohibit); ?>" name="<?php echo $capability->name; ?>" value="<?php echo CAP_PROHIBIT ?>" <?php if (isset($localoverride->permission) && $localoverride->permission==CAP_PROHIBIT){ echo 'checked="checked"'; }?> <?php echo $disabled; ?>/></td>
+        <td class="name"><span class="cap-desc"><a onclick="this.target='docspopup'" href="<?php echo $CFG->docroot.'/'.$lang.'/'.$strcapabilities.'/'.$capability->name ?>"><?php echo get_capability_string($capability->name); ?></a><span class="cap-name"><?php echo $capability->name ?></span></span></td>
+        <td class="inherit <?php echo $isinherit ?>">
+          <input type="radio" title="<?php p($strinherit); ?>" name="<?php echo $capability->name; ?>" value="<?php echo CAP_INHERIT ?>" <?php if (!isset($localoverride->permission) || $localoverride->permission==CAP_INHERIT){ echo 'checked="checked"'; }?> <?php echo $disabled; ?>/></td>
+        <td class="allow <?php echo $isallow ?>">
+          <input type="radio" title="<?php p($strallow); ?>" name="<?php echo $capability->name; ?>" value="<?php echo CAP_ALLOW ?>" <?php if (isset($localoverride->permission) && $localoverride->permission==CAP_ALLOW){ echo 'checked="checked"'; }?> <?php echo $disabled; ?>/></td>
+        <td class="prevent <?php echo $isprevent ?>" >
+          <input type="radio" title="<?php p($strprevent); ?>" name="<?php echo $capability->name; ?>" value="<?php echo CAP_PREVENT ?>" <?php if (isset($localoverride->permission) && $localoverride->permission==CAP_PREVENT){ echo 'checked="checked"'; }?> <?php echo $disabled; ?>/></td>
+        <td class="prohibit <?php echo $isprohibit ?>" >
+          <input type="radio" title="<?php p($strprohibit); ?>" name="<?php echo $capability->name; ?>" value="<?php echo CAP_PROHIBIT ?>" <?php if (isset($localoverride->permission) && $localoverride->permission==CAP_PROHIBIT){ echo 'checked="checked"'; }?> <?php echo $disabled; ?>/></td>

        <?php echo $riskinfo; ?>

@@ -155,11 +208,11 @@ foreach ($capabilities as $capability) {
 <?php } ?>
 </table>

-<div class="submit" align="center">
-<input type="submit" value="<?php p($submitlabel) ?>" />
 <?php if ($action != 'view') { ?>
+<div class="submit buttons">
+<input type="submit" value="<?php p($submitlabel) ?>" />
 <input type="submit" name="cancel" value="<?php print_string('cancel') ?>" />
-<?php } ?>
 </div>
+<?php } ?>

 </form>
@@ -15,7 +15,9 @@
    $confirm     = optional_param('confirm', 0, PARAM_BOOL);
    $cancel      = optional_param('cancel', 0, PARAM_BOOL);

-    $sitecontext = get_context_instance(CONTEXT_SYSTEM, SITEID);
+    $sitecontext = get_context_instance(CONTEXT_SYSTEM);
+
+    require_capability('moodle/role:manage', $sitecontext);

    if ($cancel) {
        redirect('manage.php');
@@ -55,6 +57,12 @@
            if ($data = data_submitted() and confirm_sesskey()) {

                $shortname = moodle_strtolower(clean_param(clean_filename($shortname), PARAM_SAFEDIR)); // only lowercase safe ASCII characters
+                $legacytype = required_param('legacytype', PARAM_RAW);
+
+                $legacyroles = get_legacy_roles();
+                if (!array_key_exists($legacytype, $legacyroles)) {
+                    $legacytype = '';
+                }

                if (empty($name)) {
                    $errors['name'] = get_string('errorbadrolename', 'role');
@@ -69,12 +77,19 @@
                }

                if (empty($errors)) {
-                    $newrole = create_role($name, $shortname, $description);
+                    $newroleid = create_role($name, $shortname, $description);
+
+                    // set proper legacy type
+                    if (!empty($legacytype)) {
+                        assign_capability($legacyroles[$legacytype], CAP_ALLOW, $newroleid, $sitecontext->id);
+                    }
+
                } else {
                    $newrole = new object();
-                    $newrole->name = $name;
-                    $newrole->shortname = $shortname;
+                    $newrole->name        = $name;
+                    $newrole->shortname   = $shortname;
                    $newrole->description = $description;
+                    $newrole->legacytype  = $legacytype;
                }

                $allowed_values = array(CAP_INHERIT, CAP_ALLOW, CAP_PREVENT, CAP_PROHIBIT);
@@ -84,6 +99,12 @@
                    if (!isset($data->{$cap->name})) {
                        continue;
                    }
+
+                    // legacy caps have their own selector
+                    if (islegacy($data->{$cap->name})) {
+                        continue;
+                    }
+
                    $capname = $cap->name;
                    $value = clean_param($data->{$cap->name}, PARAM_INT);
                    if (!in_array($value, $allowed_values)) {
@@ -91,21 +112,31 @@
                    }

                    if (empty($errors)) {
-                        assign_capability($capname, $value, $newrole, $sitecontext->id);
+                        assign_capability($capname, $value, $newroleid, $sitecontext->id);
                    } else {
                        $newrole->$capname = $value;
                    }
                }
+
                if (empty($errors)) {
+                    $rolename = get_field('role', 'name', 'id', $newroleid);
+                    add_to_log(SITEID, 'role', 'add', 'admin/roles/manage.php?action=add', $rolename, '', $USER->id);
                    redirect('manage.php');
                }
            }
+            
            break;

        case 'edit':
            if ($data = data_submitted() and confirm_sesskey()) {

                $shortname = moodle_strtolower(clean_param(clean_filename($shortname), PARAM_SAFEDIR)); // only lowercase safe ASCII characters
+                $legacytype = required_param('legacytype', PARAM_RAW);
+
+                $legacyroles = get_legacy_roles();
+                if (!array_key_exists($legacytype, $legacyroles)) {
+                    $legacytype = '';
+                }

                if (empty($name)) {
                    $errors['name'] = get_string('errorbadrolename', 'role');
@@ -126,9 +157,10 @@
                }
                if (!empty($errors)) {
                    $newrole = new object();
-                    $newrole->name = $name;
-                    $newrole->shortname = $shortname;
+                    $newrole->name        = $name;
+                    $newrole->shortname   = $shortname;
                    $newrole->description = $description;
+                    $newrole->legacytype  = $legacytype;
                }

                $allowed_values = array(CAP_INHERIT, CAP_ALLOW, CAP_PREVENT, CAP_PROHIBIT);
@@ -138,6 +170,12 @@
                    if (!isset($data->{$cap->name})) {
                        continue;
                    }
+
+                    // legacy caps have their own selector
+                    if (islegacy($data->{$cap->name}) === 0 ) {
+                        continue;
+                    }
+
                    $capname = $cap->name;
                    $value = clean_param($data->{$cap->name}, PARAM_INT);
                    if (!in_array($value, $allowed_values)) {
@@ -171,6 +209,7 @@
                            assign_capability($capname, $value, $roleid, $sitecontext->id);
                        }
                    }
+
                }

                if (empty($errors)) {
@@ -183,14 +222,25 @@
                    if (!update_record('role', $role)) {
                        error('Could not update role!');
                    }
+
+                    // set proper legacy type
+                    foreach($legacyroles as $ltype=>$lcap) {
+                        if ($ltype == $legacytype) {
+                            assign_capability($lcap, CAP_ALLOW, $roleid, $sitecontext->id);
+                        } else {
+                            unassign_capability($lcap, $roleid);
+                        } 
+                    }                    
+                    add_to_log(SITEID, 'role', 'edit', 'admin/roles/manage.php?action=edit&roleid='.$role->id, $role->name, '', $USER->id);
                    redirect('manage.php');
                }
            }
+
            break;

        case 'delete':
            if (in_array($roleid, $defaultroles)) {
-                error('This role is used as one of the default system roles, it can not be deleted'); 
+                error('This role is used as one of the default system roles, it can not be deleted');
            }
            if ($confirm and data_submitted() and confirm_sesskey()) {
                if (!delete_role($roleid)) {
@@ -243,17 +293,38 @@

            redirect('manage.php');
            break;
+
        case 'duplicate':
+            if (!array_key_exists($roleid, $roles)) {
+                redirect('manage.php');
+            }
+
+            if ($confirm and data_submitted() and confirm_sesskey()) {
+                //ok - lets duplicate!
+            } else {
+                // show confirmation
+                admin_externalpage_print_header($adminroot);
+                $optionsyes = array('action'=>'duplicate', 'roleid'=>$roleid, 'sesskey'=>sesskey(), 'confirm'=>1);
+                $optionsno  = array('action'=>'view', 'roleid'=>$roleid);
+                $a = new object();
+                $a->id = $roleid;
+                $a->name = $roles[$roleid]->name;
+                $a->shortname = $roles[$roleid]->shortname;
+                notice_yesno(get_string('duplicaterolesure', 'role', $a), 'manage.php', 'manage.php', $optionsyes, $optionsno, 'post', 'get');
+                admin_externalpage_print_footer($adminroot);
+                die;
+            }
+
            // duplicate current role
            $sourcerole = get_record('role','id',$roleid);
-            
+
            $fullname = $sourcerole->name;
            $shortname = $sourcerole->shortname;
            $currentfullname = "";
            $currentshortname = "";
            $counter = 0;
-            
-            // find a name for the duplicated role  
+
+            // find a name for the duplicated role
            do {
                if ($counter) {
                    $suffixfull = " ".get_string("copyasnoun")." ".$counter;
@@ -269,14 +340,50 @@
                $courseshort = get_record("role","shortname",addslashes($currentshortname));
                $counter++;
            } while ($coursefull || $courseshort);
-                
-            $description = 'duplicate of '.$fullname;    
+
+            $description = 'duplicate of '.$fullname;
            if ($newrole = create_role($currentfullname, $currentshortname, $description)) {
                // dupilcate all the capabilities
                role_cap_duplicate($sourcerole, $newrole);
-            }         
+            }
+            $rolename = get_field('role', 'name', 'id', $newrole);
+            add_to_log(SITEID, 'role', 'duplicate', 'admin/roles/manage.php?roleid='.$newrole.'&action=duplicate', $rolename, '', $USER->id);
            redirect('manage.php');
            break;
+
+        case 'reset':
+            if (!array_key_exists($roleid, $roles)) {
+                redirect('manage.php');
+            }
+
+            if ($confirm and data_submitted() and confirm_sesskey()) {
+                reset_role_capabilities($roleid);
+                $rolename = get_field('role', 'name', 'id', $roleid);
+                add_to_log(SITEID, 'role', 'reset', 'admin/roles/manage.php?roleid='.$roleid.'&action=reset', $rolename, '', $USER->id);
+                redirect('manage.php?action=view&amp;roleid='.$roleid);
+
+            } else {
+                // show confirmation
+                admin_externalpage_print_header($adminroot);
+                $optionsyes = array('action'=>'reset', 'roleid'=>$roleid, 'sesskey'=>sesskey(), 'confirm'=>1);
+                $optionsno  = array('action'=>'view', 'roleid'=>$roleid);
+                $a = new object();
+                $a->id = $roleid;
+                $a->name = $roles[$roleid]->name;
+                $a->shortname = $roles[$roleid]->shortname;
+                $a->legacytype = get_legacy_type($roleid);
+                if (empty($a->legacytype)) {
+                    $warning = get_string('resetrolesurenolegacy', 'role', $a);
+                } else {
+                    $warning = get_string('resetrolesure', 'role', $a);
+                }
+                notice_yesno($warning, 'manage.php', 'manage.php', $optionsyes, $optionsno, 'post', 'get');
+                admin_externalpage_print_footer($adminroot);
+                die;
+            }
+
+            break;
+
        default:
            break;
    }
@@ -294,9 +401,10 @@
            $roleid = 0;
            if (empty($errors) or empty($newrole)) {
                $role = new object();
-                $role->name='';
-                $role->shortname='';
-                $role->description='';
+                $role->name        = '';
+                $role->shortname   = '';
+                $role->description = '';
+                $role->legacytype  = '';
            } else {
                $role = stripslashes_safe($newrole);
            }
@@ -306,6 +414,7 @@
            if(!$role = get_record('role', 'id', $roleid)) {
                error('Incorrect role ID!');
            }
+            $role->legacytype = get_legacy_type($role->id);
        }

        foreach ($roles as $rolex) {
@@ -332,18 +441,28 @@
                break;
        }

-        echo '<div align="center" class="selector">';
+        echo '<div class="selector">';
        if ($action == 'view') {
-            echo get_string('selectrole', 'role').': ';
-            echo '<form style="display:inline;" id="switchrole" action="manage.php" method="get">';
-            echo '<input type="hidden" name="action" value="view" />';
-            choose_from_menu ($roleoptions, 'roleid', $roleid, get_string('listallroles', 'role').'...', $script='switchrole.submit()');
-            echo '</form>';
-            echo '<form style="display:inline;" id="editrole" action="manage.php" method="get">';
-            echo '<input type="hidden" name="roleid" value="'.$roleid.'" />';
-            echo '<input type="hidden" name="action" value="edit" />';
-            echo '<input type="submit" value="'.get_string('edit').'" />';
-            echo '</form>';
+            popup_form('manage.php?action=view&amp;roleid=', $roleoptions, 'switchrole', $roleid, '', '', '',
+                       false, 'self', get_string('selectrole', 'role'));
+
+            echo '<div class="buttons">';
+
+            $legacytype = get_legacy_type($roleid); 
+            $options = array();
+            $options['roleid'] = $roleid;
+            $options['action'] = 'edit';
+            print_single_button('manage.php', $options, get_string('edit'));
+            $options['action'] = 'reset';
+            if (empty($legacytype)) {
+                print_single_button('manage.php', $options, get_string('resetrolenolegacy', 'role'));
+            } else {
+                print_single_button('manage.php', $options, get_string('resetrole', 'role'));
+            }
+            $options['action'] = 'duplicate';
+            print_single_button('manage.php', $options, get_string('duplicaterole', 'role'));
+            print_single_button('manage.php', null, get_string('listallroles', 'role'));
+            echo '</div>';
        }
        echo '</div>';

@@ -419,7 +538,9 @@

        $options = new object();
        $options->action = 'add';
+        echo '<div class="buttons">';
        print_single_button('manage.php', $options, get_string('addrole', 'role'), 'get');
+        echo '</div>';
    }

    admin_externalpage_print_footer($adminroot);
@@ -468,12 +589,12 @@ function role_cap_duplicate($sourcerole, $targetrole) {
    $systemcontext = get_context_instance(CONTEXT_SYSTEM);
    $caps = get_records_sql("SELECT * FROM {$CFG->prefix}role_capabilities
                             WHERE roleid = $sourcerole->id
-                             AND contextid = $systemcontext->id");                                           
+                             AND contextid = $systemcontext->id");
    // adding capabilities
    foreach ($caps as $cap) {
        unset($cap->id);
        $cap->roleid = $targetrole;
        insert_record('role_capabilities', $cap);
-    }  
+    }
 }
 ?>
@@ -1,6 +1,12 @@
 <?php
 // this page deals with the 2 tabs for manage.php and grant.php

+    if (!defined('MOODLE_INTERNAL')) {
+        die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+    }
+
+    $toprow = array();
+
    $toprow[] = new tabobject('manage', $CFG->wwwroot.'/'.$CFG->admin.'/roles/manage.php', get_string('manageroles', 'role'),'', true);

    $toprow[] = new tabobject('allowassign', $CFG->wwwroot.'/'.$CFG->admin.'/roles/allowassign.php', get_string('allowassign', 'role'));
@@ -6,11 +6,13 @@
 ?>

 <form id="overrideform" action="override.php" method="post">
+    <fieldset class="invisiblefieldset">
    <input type="hidden" name="contextid" value="<?php p($contextid) ?>" />
    <input type="hidden" name="roleid" value="<?php p($roleid) ?>" />
    <input type="hidden" name="sesskey" value="<?php p(sesskey()) ?>" />
    <input type="hidden" name="userid" value="<?php p($userid) ?>" />
    <input type="hidden" name="courseid" value="<?php p($courseid) ?>" />
+    </fieldset>

    <table class="rolecap">
        <tr>
@@ -28,9 +30,16 @@
        $component = '';

        $strrisks = s(get_string('risks', 'role'));
-        $strcapabilities = s(get_string('capabilities', 'role'));
+        // MDL-11687
+        $strcapabilities = 'Capabilities';//s(get_string('capabilities', 'role'));

        foreach ($capabilities as $capability) {
+
+            // legacy caps should not be overriden - we must use proper capabilities if needed
+            if (islegacy($capability->name)) {
+                continue;
+            }
+
        // prints a breaker if component or name or context level
            if ($capability->component != $component or $capability->contextlevel != $contextlevel) {
                echo ('<tr class="rolecapheading header"><td colspan="10" class="header"><strong>'.get_component_string($capability->component, $capability->contextlevel).'</strong></td></tr>');
@@ -57,36 +66,36 @@
                $isprohibit = 0;
            }

-            $isdisabled = $isprohibit || islegacy($capability->name);
+            $isdisabled = $isprohibit;

            $riskinfo = '<td class="risk managetrust">';
            $rowclasses = '';
            if (RISK_MANAGETRUST & (int)$capability->riskbitmask) {
-                $riskinfo .= '<a target="docspopup" title="'.get_string('riskmanagetrust', 'admin').'" href="'.$CFG->docroot.'/'.$lang.'/'.$strrisks.'">';
+                $riskinfo .= '<a onclick="this.target=\'docspopup\'" title="'.get_string('riskmanagetrust', 'admin').'" href="'.$CFG->docroot.'/'.$lang.'/'.$strrisks.'">';
                $riskinfo .= '<img src="'.$CFG->pixpath.'/i/risk_managetrust.gif" alt="'.get_string('riskmanagetrustshort', 'admin').'" /></a>';
                $rowclasses .= ' riskmanagetrust';
            }
            $riskinfo .= '</td><td class="risk config">';
            if (RISK_CONFIG & (int)$capability->riskbitmask) {
-                $riskinfo .= '<a target="docspopup" title="'.get_string('riskconfig', 'admin').'" href="'.$CFG->docroot.'/'.$lang.'/'.$strrisks.'">';
+                $riskinfo .= '<a onclick="this.target=\'docspopup\'" title="'.get_string('riskconfig', 'admin').'" href="'.$CFG->docroot.'/'.$lang.'/'.$strrisks.'">';
                $riskinfo .= '<img src="'.$CFG->pixpath.'/i/risk_config.gif" alt="'.get_string('riskconfigshort', 'admin').'" /></a>';
                $rowclasses .= ' riskconfig';
            }
            $riskinfo .= '</td><td class="risk xss">';
            if (RISK_XSS & (int)$capability->riskbitmask) {
-                $riskinfo .= '<a target="docspopup" title="'.get_string('riskxss', 'admin').'" href="'.$CFG->docroot.'/'.$lang.'/'.$strrisks.'">';
+                $riskinfo .= '<a onclick="this.target=\'docspopup\'" title="'.get_string('riskxss', 'admin').'" href="'.$CFG->docroot.'/'.$lang.'/'.$strrisks.'">';
                $riskinfo .= '<img src="'.$CFG->pixpath.'/i/risk_xss.gif" alt="'.get_string('riskxssshort', 'admin').'" /></a>';
                $rowclasses .= ' riskxss';
            }
            $riskinfo .= '</td><td class="risk personal">';
            if (RISK_PERSONAL & (int)$capability->riskbitmask) {
-                $riskinfo .= '<a target="docspopup" title="'.get_string('riskpersonal', 'admin').'" href="'.$CFG->docroot.'/'.$lang.'/'.$strrisks.'">';
+                $riskinfo .= '<a onclick="this.target=\'docspopup\'" title="'.get_string('riskpersonal', 'admin').'" href="'.$CFG->docroot.'/'.$lang.'/'.$strrisks.'">';
                $riskinfo .= '<img src="'.$CFG->pixpath.'/i/risk_personal.gif" alt="'.get_string('riskpersonalshort', 'admin').'" /></a>';
                $rowclasses .= ' riskpersonal';
            }
            $riskinfo .= '</td><td class="risk spam">';
            if (RISK_SPAM & (int)$capability->riskbitmask) {
-                $riskinfo .= '<a target="docspopup" title="'.get_string('riskspam', 'admin').'" href="'.$CFG->docroot.'/'.$lang.'/'.$strrisks.'">';
+                $riskinfo .= '<a onclick="this.target=\'docspopup\'" title="'.get_string('riskspam', 'admin').'" href="'.$CFG->docroot.'/'.$lang.'/'.$strrisks.'">';
                $riskinfo .= '<img src="'.$CFG->pixpath.'/i/risk_spam.gif" alt="'.get_string('riskspamshort', 'admin').'" /></a>';
                $rowclasses .= ' riskspam';
            }
@@ -96,13 +105,7 @@
        ?>

        <tr class="rolecap <?php echo $rowclasses; ?>">
-             <td class="name">
-                 <span class="cap-desc">
-                    <a target="docspopup" href="<?php echo $CFG->docroot.'/'.$lang.'/'.$strcapabilities.'/'.$capability->name ?>">
-                    <?php echo get_capability_string($capability->name); ?></a>
-                 </span>
-                 <span class="cap-name"><?php echo $capability->name ?></span>
-             </td>
+             <td class="name"><span class="cap-desc"><a onclick="this.target='docspopup'" href="<?php echo $CFG->docroot.'/'.$lang.'/'.$strcapabilities.'/'.$capability->name ?>"><?php echo get_capability_string($capability->name); ?></a><span class="cap-name"><?php echo $capability->name ?></span></span></td>

             <td class="inherit">
             <input type="radio" title="<?php p($strinherit); ?>" name="<?php echo $capability->name; ?>" value="0"
@@ -136,8 +139,7 @@

        <?php } ?>
    </table>
-    <br />
-    <div align="center">
+    <div class="submit buttons">
        <input type="submit" value="<?php print_string('savechanges') ?>" />
        <input type="submit" name="cancel" value="<?php print_string('cancel') ?>" />
    </div>
@@ -2,7 +2,7 @@

    require_once('../../config.php');

-    $contextid = required_param('contextid',PARAM_INT);    // context id
+    $contextid = required_param('contextid', PARAM_INT);   // context id
    $roleid    = optional_param('roleid', 0, PARAM_INT);   // requested role id
    $userid    = optional_param('userid', 0, PARAM_INT);   // needed for user tabs
    $courseid  = optional_param('courseid', 0, PARAM_INT); // needed for user tabs
@@ -12,29 +12,34 @@
        error('Bad context ID');
    }

-    if (!$sitecontext = get_context_instance(CONTEXT_SYSTEM, SITEID)) {
+    if (!$sitecontext = get_context_instance(CONTEXT_SYSTEM)) {
        error('No site ID');
    }

    if ($context->id == $sitecontext->id) {
-        error ('Can not override base role capabilities');
+        error('Can not override base role capabilities');
    }

-    require_capability('moodle/role:override', $context);   // Just to make sure
+    if (!has_capability('moodle/role:override', $context)) {
+        error('You do not have permission to change overrides in this context!');
+    }

    if ($courseid) {
        if (!$course = get_record('course', 'id', $courseid)) {
            error('Bad course ID');
        }
    } else {
-        $course = $SITE;
+        $course = clone($SITE);
+        $courseid = SITEID;
    }

+    require_login($course);
+
    $baseurl = 'override.php?contextid='.$context->id;
    if (!empty($userid)) {
        $baseurl .= '&amp;userid='.$userid;
    }
-    if (!empty($courseid)) {
+    if ($courseid != SITEID) {
        $baseurl .= '&amp;courseid='.$courseid;
    }

@@ -42,6 +47,9 @@
        redirect($baseurl);
    }

+/// needed for tabs.php
+    $overridableroles = get_overridable_roles($context);
+    $assignableroles  = get_assignable_roles($context);

 /// Get some language strings

@@ -53,6 +61,7 @@
    $strparticipants   = get_string('participants');

 /// Make sure this user can override that role
+
    if ($roleid) {
        if (!user_can_override($context, $roleid)) {
            error ('you can not override this role in this context');
@@ -64,18 +73,27 @@
        $fullname = fullname($user, has_capability('moodle/site:viewfullnames', $context));
    }

+/// get all cababilities
+    $capabilities = fetch_context_capabilities($context);
+
 /// Process incoming role override
    if ($data = data_submitted() and $roleid and confirm_sesskey()) {
        $allowed_values = array(CAP_INHERIT, CAP_ALLOW, CAP_PREVENT, CAP_PROHIBIT);
-        $capabilities = fetch_context_capabilities($context); // capabilities applicable in this context

        $localoverrides = get_records_select('role_capabilities', "roleid = $roleid AND contextid = $context->id",
                                             '', 'capability, permission, id');

        foreach ($capabilities as $cap) {
+
            if (!isset($data->{$cap->name})) {
+                //cap not specified in form
                continue;
            }
+
+            if (islegacy($data->{$cap->name})) {
+                continue;
+            }
+
            $capname = $cap->name;
            $value = clean_param($data->{$cap->name}, PARAM_INT);
            if (!in_array($value, $allowed_values)) {
@@ -112,6 +130,8 @@
                }
            }
        }
+        $rolename = get_field('role', 'name', 'id', $roleid);
+        add_to_log($course->id, 'role', 'override', 'admin/roles/override.php?contextid='.$context->id.'&roleid='.$roleid, $rolename, '', $USER->id);
        redirect($baseurl);
    }

@@ -129,7 +149,7 @@

        /// site header
        } else {
-            print_header("$course->fullname: $fullname", "$course->fullname",
+            print_header("$course->fullname: $fullname", $course->fullname,
                        "<a href=\"$CFG->wwwroot/user/view.php?id=$userid&amp;course=$course->id\">$fullname</a> -> $straction", "", "", true, "&nbsp;", navmenu($course));
        }
        $showroles = 1;
@@ -151,15 +171,13 @@

    print_heading_with_help(get_string('overrides', 'role'), 'overrides');

-    $overridableroles = get_overridable_roles($context);
-
    if ($roleid) {
    /// prints a form to swap roles
-        echo '<div align="center">'.$strcurrentcontext.': '.print_context_name($context).'<br/>';
-        echo $strroletooverride.': ';
-        $overridableroles = array('0'=>get_string('listallroles', 'role').'...') + $overridableroles; 
+        echo '<div class="selector">';
+        echo $strcurrentcontext.': '.print_context_name($context).'<br/>';
+        $overridableroles = array('0'=>get_string('listallroles', 'role').'...') + $overridableroles;
        popup_form("$CFG->wwwroot/$CFG->admin/roles/override.php?userid=$userid&amp;courseid=$courseid&amp;contextid=$contextid&amp;roleid=",
-            $overridableroles, 'switchrole', $roleid, '');
+            $overridableroles, 'switchrole', $roleid, '', '', '', false, 'self', $strroletooverride);
        echo '</div>';

        $parentcontexts = get_parent_contexts($context);
@@ -177,11 +195,12 @@

        $lang = str_replace('_utf8', '', current_language());

-        // Get the capabilities overrideable in this context
-        if ($capabilities = fetch_context_capabilities($context)) {
+        if (!empty($capabilities)) {
+            // Print the capabilities overrideable in this context
            print_simple_box_start('center');
            include_once('override.html');
            print_simple_box_end();
+
        } else {
            notice(get_string('nocapabilitiesincontext', 'role'),
                    $CFG->wwwroot.'/'.$CFG->admin.'/roles/'.$baseurl);
@@ -1,6 +1,11 @@
 <?php // $Id$

 // Handles headers and tabs for the roles control at any level apart from SYSTEM level
+// We also assume that $currenttab, $assignableroles and $overridableroles are defined
+
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}

 if ($currenttab != 'update') {
    switch ($context->contextlevel) {
@@ -29,11 +34,14 @@ if ($currenttab != 'update') {
        case CONTEXT_COURSE:
            if ($context->instanceid != SITEID) {
                $streditcoursesettings = get_string("editcoursesettings");
-    
+
                $course = get_record('course', 'id', $context->instanceid);
-                print_header($streditcoursesettings, "$course->fullname",
+
+                require_login($course);
+
+                print_header($streditcoursesettings, $course->fullname,
                        "<a href=\"$CFG->wwwroot/course/view.php?id=$course->id\">$course->shortname</a> -> $straction");
-            }                        
+            }
            break;

        case CONTEXT_GROUP:
@@ -54,6 +62,8 @@ if ($currenttab != 'update') {
                error("The required instance of this module doesn't exist");
            }

+            require_login($course);
+
            $strnav = "<a href=\"$CFG->wwwroot/mod/$module->name/view.php?id=$cm->id\">$instance->name</a> ->";
            $fullmodulename = get_string("modulename", $module->name);
            $streditinga = get_string("editinga", "moodle", $fullmodulename);
@@ -65,7 +75,6 @@ if ($currenttab != 'update') {
                $focuscursor = "form.name";
            }

-            $COURSE = $course;
            print_header_simple($streditinga, '',
                    "<a href=\"$CFG->wwwroot/mod/$module->name/index.php?id=$course->id\">$strmodulenameplural</a> ->
                    $strnav <a href=\"$CFG->wwwroot/course/mod.php?update=$cm->id&amp;sesskey=".sesskey()."\">$streditinga</a> -> $straction", $focuscursor, "", false);
@@ -81,6 +90,9 @@ if ($currenttab != 'update') {
                    switch ($blockinstance->pagetype) {
                        case 'course-view':
                            if ($course = get_record('course', 'id', $blockinstance->pageid)) {
+
+                                require_login($course);
+
                                if ($course->id != SITEID) {
                                    $navigation = "<a href=\"$CFG->wwwroot/course/view.php?id=$course->id\">$course->shortname</a> -> $navigation";
                                }
@@ -104,7 +116,7 @@ if ($currenttab != 'update') {
            break;

        default:
-            error ('This is an unknown context!');
+            error ('This is an unknown context (' . $context->contextlevel . ') in admin/roles/tabs.php!');
            return false;

    }
@@ -123,14 +135,7 @@ if ($context->contextlevel != CONTEXT_SYSTEM) {    // Print tabs for anything ex
    $toprow[] = new tabobject('roles', $CFG->wwwroot.'/'.$CFG->admin.'/roles/assign.php?contextid='.
                               $context->id, get_string('roles'));

-    if (isset($tabsmode)) {
-
-        if (!isset($assignableroles)) {
-            $assignableroles = get_assignable_roles($context);
-        }
-        if (!isset($overridableroles)) {
-            $overridableroles = get_overridable_roles($context);
-        }
+    if (!empty($tabsmode)) {

        if (!empty($assignableroles)) {
            $secondrow[] = new tabobject('assign',
@@ -157,6 +162,25 @@ if ($context->contextlevel != CONTEXT_SYSTEM) {    // Print tabs for anything ex
        $activetwo = array();
    }

+/// Here other core tabs should go (always calling tabs.php files)
+/// All the logic to decide what to show must be self-cointained in the tabs file
+/// ej.:
+/// include_once($CFG->dirroot . '/grades/tabs.php');
+
+/// Finally, we support adding some 'on-the-fly' tabs here
+/// All the logic to decide what to show must be self-cointained in the tabs file
+    if (isset($CFG->extratabs) && !empty($CFG->extratabs)) {
+        if ($extratabs = explode(',', $CFG->extratabs)) {
+            asort($extratabs);
+            foreach($extratabs as $extratab) {
+            /// Each extra tab mus be one $CFG->dirroot relative file
+                if (file_exists($CFG->dirroot . '/' . $extratab)) {
+                    include_once($CFG->dirroot . '/' . $extratab);
+                }
+            }
+        }
+    }
+
    if (!empty($secondrow)) {
        $tabs = array($toprow, $secondrow);
    } else {
@@ -59,8 +59,10 @@ if ($statusmsg != '') {
 $resultshtml = search_settings_html(admin_get_root(), $query);

 echo '<form action="search.php" method="post" id="adminsettings">';
+echo '<div>';
 echo '<input type="hidden" name="sesskey" value="' . sesskey() . '" />';
 echo '<input type="hidden" name="query" value="' . s($query) . '" />';
+echo '</div>';
 echo '<fieldset>';
 echo '<div class="clearer"><!-- --></div>';
 if ($resultshtml != '') {
@@ -112,6 +114,11 @@ function search_settings(&$node, $query) {
 function search_settings_html(&$node, $query) {

    global $CFG;
+
+    if ($query == ''){
+        return '';
+    }
+
    if (is_a($node, 'admin_category')) {
        $entries = array_keys($node->children);
        $return = '';
@@ -10,14 +10,20 @@ $temp->add(new admin_setting_configcheckbox('allowuserthemes', get_string('allow
 $temp->add(new admin_setting_configcheckbox('allowcoursethemes', get_string('allowcoursethemes', 'admin'), get_string('configallowcoursethemes', 'admin'), 0));
 $temp->add(new admin_setting_configcheckbox('allowuserblockhiding', get_string('allowuserblockhiding', 'admin'), get_string('configallowuserblockhiding', 'admin'), 1));
 $temp->add(new admin_setting_configcheckbox('showblocksonmodpages', get_string('showblocksonmodpages', 'admin'), get_string('configshowblocksonmodpages', 'admin'), 0));
-$temp->add(new admin_setting_configcheckbox('tabselectedtofront', get_string('tabselectedtofronttext', 'admin'), get_string('tabselectedtofront', 'admin'), 0));
 $ADMIN->add('themes', $temp);
 $ADMIN->add('themes', new admin_externalpage('themeselector', get_string('themeselector','admin'), $CFG->wwwroot . '/theme/index.php'));

+# for CALENDAR_TF_12 and CALENDAR_TF_24 ...
+require_once($CFG->dirroot . '/calendar/lib.php');

 // calendar
 $temp = new admin_settingpage('calendar', get_string('calendarsettings','admin'));
 $temp->add(new admin_setting_special_adminseesall());
+$temp->add(new admin_setting_configselect('calendar_site_timeformat', get_string('pref_timeformat', 'calendar'), get_string('explain_site_timeformat', 'calendar'), '0',
+array(  0              => get_string('default', 'calendar'),
+        CALENDAR_TF_12 => get_string('timeformat_12', 'calendar'),
+        CALENDAR_TF_24 => get_string('timeformat_24', 'calendar')
+    )));
 $temp->add(new admin_setting_configselect('calendar_startwday', get_string('configstartwday', 'admin'), get_string('helpstartofweek', 'admin'), 0, 
 array(
        0 => get_string('sunday', 'calendar'),
@@ -3,7 +3,7 @@
 // This file defines settingpages and externalpages under the "courses" category


-$ADMIN->add('courses', new admin_externalpage('coursemgmt', get_string('coursemgmt', 'admin'), $CFG->wwwroot . '/course/index.php?categoryedit=on'));
+$ADMIN->add('courses', new admin_externalpage('coursemgmt', get_string('coursemgmt', 'admin'), $CFG->wwwroot . '/course/index.php?categoryedit=on','moodle/category:update'));

 $ADMIN->add('courses', new admin_externalpage('enrolment', get_string('enrolments'), $CFG->wwwroot . '/'.$CFG->admin.'/enrol.php'));

@@ -17,7 +17,7 @@ $ADMIN->add('courses', $temp);


 // "backups" settingpage
-$temp = new admin_settingpage('backups', get_string('backups','admin'));
+$temp = new admin_settingpage('backups', get_string('backups','admin'),'moodle/site:backup');
 $temp->add(new admin_setting_backupcheckbox('backup_sche_modules', get_string('includemodules'), get_string('backupincludemoduleshelp'), 0));
 $temp->add(new admin_setting_backupcheckbox('backup_sche_withuserdata', get_string('includemoduleuserdata'), get_string('backupincludemoduleuserdatahelp'), 0));
 $temp->add(new admin_setting_backupcheckbox('backup_sche_metacourse', get_string('metacourse'), get_string('backupmetacoursehelp'), 0));
@@ -6,13 +6,16 @@
 $temp = new admin_settingpage('langsettings', get_string('languagesettings', 'admin'));
 $temp->add(new admin_setting_configselect('lang', get_string('lang', 'admin'), get_string('configlang', 'admin'), current_language(), get_list_of_languages())); // $CFG->lang might be set in installer already, default en or en_utf8 is in setup.php
 $temp->add(new admin_setting_configcheckbox('langmenu', get_string('langmenu', 'admin'), get_string('configlangmenu', 'admin'), 1));
-$temp->add(new admin_setting_configtext('langlist', get_string('langlist', 'admin'), get_string('configlanglist', 'admin'), '', PARAM_NOTAGS));
+$temp->add(new admin_setting_langlist());
 $temp->add(new admin_setting_configcheckbox('langcache', get_string('langcache', 'admin'), get_string('configlangcache', 'admin'), 1));
 $temp->add(new admin_setting_configtext('locale', get_string('localetext', 'admin'), get_string('configlocale', 'admin'), '', PARAM_FILE));
+
+// new CFG variable for excel encoding
+$temp->add(new admin_setting_configselect('latinexcelexport', get_string('latinexcelexport', 'admin'), get_string('configlatinexcelexport', 'admin'), '0', array('0'=>'Unicode','1'=>'Latin')));
+
+
 $ADMIN->add('language', $temp);

-
-
 $ADMIN->add('language', new admin_externalpage('langedit', get_string('langedit', 'admin'), "$CFG->wwwroot/$CFG->admin/lang.php"));
 $ADMIN->add('language', new admin_externalpage('langimport', get_string('langpacks', 'admin'), "$CFG->wwwroot/$CFG->admin/langimport.php"));

@@ -5,7 +5,6 @@ $temp = new admin_settingpage('locationsettings', get_string('locationsettings',
 $options = get_list_of_timezones();
 $options[99] = get_string('serverlocaltime');
 $temp->add(new admin_setting_configselect('timezone', get_string('timezone','admin'), get_string('configtimezone', 'admin'), 99, $options));
-$options = get_list_of_timezones();
 $options[99] = get_string('timezonenotforced', 'admin');
 $temp->add(new admin_setting_configselect('forcetimezone', get_string('forcetimezone', 'admin'), get_string('helpforcetimezone', 'admin'), 99, $options));
 $options = get_list_of_countries();
@@ -3,19 +3,19 @@
 // This file defines settingpages and externalpages under the "mnet" category

 $ADMIN->add('mnet', new admin_externalpage('net', get_string('settings', 'mnet'), 
-                                           $CFG->wwwroot . '/admin/mnet/index.php', 
+                                           "$CFG->wwwroot/$CFG->admin/mnet/index.php",
                                           'moodle/site:config'));

 $ADMIN->add('mnet', new admin_externalpage('mnetpeers', get_string('mnetpeers', 'mnet'), 
-                                           $CFG->wwwroot . '/admin/mnet/peers.php', 
+                                           "$CFG->wwwroot/$CFG->admin/mnet/peers.php",
                                           'moodle/site:config'));
 $ADMIN->add('mnet', new admin_externalpage('ssoaccesscontrol', get_string('ssoaccesscontrol', 'mnet'),
-                                           $CFG->wwwroot . '/admin/mnet/access_control.php', 
+                                           "$CFG->wwwroot/$CFG->admin/mnet/access_control.php",
                                           'moodle/site:config'));
 $ADMIN->add('mnet', new admin_externalpage('mnetenrol', get_string('mnetenrol', 'mnet'), 
-                                           $CFG->wwwroot . '/admin/mnet/enr_hosts.php', 
+                                           "$CFG->wwwroot/$CFG->admin/mnet/enr_hosts.php",
                                           'moodle/site:config'));
 $ADMIN->add('mnet', new admin_externalpage('trustedhosts', get_string('trustedhosts', 'mnet'), 
-                                           $CFG->wwwroot . '/admin/mnet/trustedhosts.php', 
+                                           "$CFG->wwwroot/$CFG->admin/mnet/trustedhosts.php",
                                           'moodle/site:config'));
 ?>
@@ -25,7 +25,7 @@ $temp->add(new admin_setting_configselect('fullnamedisplay', get_string('fullnam
              'lastname firstname' => get_string('lastname') . ' + ' . get_string('firstname'),
              'firstname' => get_string('firstname'))));
 $temp->add(new admin_setting_configcheckbox('extendedusernamechars', get_string('extendedusernamechars', 'admin'), get_string('configextendedusernamechars', 'admin'), 0));
-$temp->add(new admin_setting_configtext('sitepolicy', get_string('sitepolicy', 'admin'), get_string('configsitepolicy', 'admin'), '', PARAM_URL));
+$temp->add(new admin_setting_configtext('sitepolicy', get_string('sitepolicy', 'admin'), get_string('configsitepolicy', 'admin'), '', PARAM_RAW));
 $temp->add(new admin_setting_configselect('bloglevel', get_string('bloglevel', 'admin'), get_string('configbloglevel', 'admin'), 4, array(5 => get_string('worldblogs','blog'),
                                                                                                                                          4 => get_string('siteblogs','blog'),
                                                                                                                                          3 => get_string('courseblogs','blog'),
@@ -33,8 +33,11 @@ $temp->add(new admin_setting_configselect('bloglevel', get_string('bloglevel', '
                                                                                                                                          1 => get_string('personalblogs','blog'),
                                                                                                                                          0 => get_string('disableblogs','blog'))));

+$temp->add(new admin_setting_configcheckbox('profilesforenrolledusersonly', get_string('profilesforenrolledusersonly','admin'),get_string('configprofilesforenrolledusersonly', 'admin'),'1'));
+
 $temp->add(new admin_setting_configcheckbox('cronclionly', get_string('cronclionly', 'admin'), get_string('configcronclionly', 'admin'), 0));
 $temp->add(new admin_setting_configtext('cronremotepassword', get_string('cronremotepassword', 'admin'), get_string('configcronremotepassword', 'admin'), '', PARAM_RAW));
+$temp->add(new admin_setting_configcheckbox('emailchangeconfirmation', get_string('emailchangeconfirmation', 'admin'), get_string('configemailchangeconfirmation', 'admin'), 1));

 $ADMIN->add('security', $temp);

@@ -44,6 +47,7 @@ $ADMIN->add('security', $temp);
 // "httpsecurity" settingpage
 $temp = new admin_settingpage('httpsecurity', get_string('httpsecurity', 'admin'));
 $temp->add(new admin_setting_configcheckbox('loginhttps', get_string('loginhttps', 'admin'), get_string('configloginhttps', 'admin'), 0));
+$temp->add(new admin_setting_configtext('excludeoldflashclients', get_string('excludeoldflashclients', 'admin'), get_string('configexcludeoldflashclients', 'admin'), '10.0.12', PARAM_TEXT));
 $ADMIN->add('security', $temp);


@@ -17,7 +17,7 @@ $ADMIN->add('server', $temp, 0);

 // "email" settingpage
 $temp = new admin_settingpage('mail', get_string('mail','admin'));
-$temp->add(new admin_setting_configtext('smtphosts', get_string('smtphosts', 'admin'), get_string('configsmtphosts', 'admin'), '', PARAM_HOST));
+$temp->add(new admin_setting_configtext('smtphosts', get_string('smtphosts', 'admin'), get_string('configsmtphosts', 'admin'), '', PARAM_RAW));
 $temp->add(new admin_setting_configtext('smtpuser', get_string('smtpuser', 'admin'), get_string('configsmtpuser', 'admin'), '', PARAM_NOTAGS));
 $temp->add(new admin_setting_configtext('smtppass', get_string('smtppass', 'admin'), get_string('configsmtpuser', 'admin'), '', PARAM_RAW));
 $temp->add(new admin_setting_configtext('noreplyaddress', get_string('noreplyaddress', 'admin'), get_string('confignoreplyaddress', 'admin'), 'noreply@' . $_SERVER['HTTP_HOST'], PARAM_NOTAGS));
@@ -48,6 +48,7 @@ $temp->add(new admin_setting_configselect('digestmailtime', get_string('digestma
                                                                                                                                                          '22' => '22',
                                                                                                                                                          '23' => '23')));
 $charsets = get_list_of_charsets();
+unset($charsets['UTF-8']); // not needed here
 $options = array();
 $options['0'] = get_string('none');
 $options = array_merge($options, $charsets);
@@ -85,6 +86,7 @@ $ADMIN->add('server', $temp);
 $temp = new admin_settingpage('debugging', get_string('debugging', 'admin'));
 $temp->add(new admin_setting_special_debug());
 $temp->add(new admin_setting_special_debugdisplay());
+$temp->add(new admin_setting_configcheckbox('debugsmtp', get_string('debugsmtp', 'admin'), get_string('configdebugsmtp', 'admin'), 0));
 $temp->add(new admin_setting_special_perfdebug());
 $ADMIN->add('server', $temp);

@@ -153,6 +155,15 @@ $temp->add(new admin_setting_configselect('deleteunconfirmed', get_string('delet
                                                                                                                                                                    6 => get_string('numhours', '', 6),
                                                                                                                                                                    1 => get_string('numhours', '', 1))));

+$temp->add(new admin_setting_configselect('deleteincompleteusers', get_string('deleteincompleteusers', 'admin'), get_string('configdeleteincompleteusers', 'admin'), 0, array(0 => get_string('never'),
+                                                                                                                                                                    168 => get_string('numdays', '', 7),
+                                                                                                                                                                    144 => get_string('numdays', '', 6),
+                                                                                                                                                                    120 => get_string('numdays', '', 5),
+                                                                                                                                                                    96 => get_string('numdays', '', 4),
+                                                                                                                                                                    72 => get_string('numdays', '', 3),
+                                                                                                                                                                    48 => get_string('numdays', '', 2),
+                                                                                                                                                                    24 => get_string('numdays', '', 1))));
+
 $temp->add(new admin_setting_configselect('loglifetime', get_string('loglifetime', 'admin'), get_string('configloglifetime', 'admin'), 0, array(0 => get_string('neverdeletelogs'),
                                                                                                                                                1000 => get_string('numdays', '', 1000),
                                                                                                                                                365 => get_string('numdays', '', 365),
@@ -23,7 +23,7 @@ $ADMIN->add('accounts', new admin_externalpage('profilefields', get_string('prof
 $ADMIN->add('users', new admin_category('roles', get_string('permissions', 'role')));
 $ADMIN->add('roles', new admin_externalpage('defineroles', get_string('defineroles', 'role'), "$CFG->wwwroot/$CFG->admin/roles/manage.php"));
 $sitecontext = get_context_instance(CONTEXT_SYSTEM);
-$ADMIN->add('roles', new admin_externalpage('assignroles', get_string('assignroles', 'role'), "$CFG->wwwroot/$CFG->admin/roles/assign.php?contextid=" . $sitecontext->id));
+$ADMIN->add('roles', new admin_externalpage('assignroles', get_string('assignglobalroles', 'role'), "$CFG->wwwroot/$CFG->admin/roles/assign.php?contextid=" . $sitecontext->id));


 // "userpolicies" settingpage
@@ -43,6 +43,14 @@ if ($userroles = get_roles_with_capability('moodle/legacy:user', CAP_ALLOW)) {
 } else {
    $userrole->id = 0;
 }
+if (empty($CFG->creatornewroleid)) {
+    if ($teacherroles = get_roles_with_capability('moodle/legacy:editingteacher', CAP_ALLOW, $context)) {
+        $teachereditrole = array_shift($teacherroles);
+        set_config('creatornewroleid', $teachereditrole->id);
+    } else {
+        set_config('creatornewroleid', 0);
+    }
+}
 // we must not use assignable roles here:
 //   1/ unsetting roles as assignable for admin might bork the settings!
 //   2/ default user role should not be assignable anyway
@@ -61,6 +69,8 @@ $temp->add(new admin_setting_configselect('defaultuserroleid', get_string('defau
              get_string('configdefaultuserroleid', 'admin'), $userrole->id, $allroles));
 $temp->add(new admin_setting_configselect('defaultcourseroleid', get_string('defaultcourseroleid', 'admin'),
              get_string('configdefaultcourseroleid', 'admin'), $studentrole->id, $allroles));
+$temp->add(new admin_setting_configselect('creatornewroleid', get_string('creatornewroleid', 'admin'),
+              get_string('configcreatornewroleid', 'admin'), $CFG->creatornewroleid, $allroles));

 $temp->add(new admin_setting_configcheckbox('autologinguests', get_string('autologinguests', 'admin'), get_string('configautologinguests', 'admin'), 0));

@@ -72,7 +72,7 @@

    if (!empty($pt)) {
        echo '</td>';
-        echo '<td valign="top" style="width: '.$blocks_preferred_width.'px;" id="left-column">';
+        echo '<td valign="top" style="width: '.$blocks_preferred_width.'px;" id="right-column">';
        blocks_print_group($PAGE, $blocks, BLOCK_POS_RIGHT);
        echo '</td>';
        echo '</tr></table>';
@@ -24,9 +24,9 @@
    if (!$ok or !confirm_sesskey()) {
        $message = '<br /><br />';
        $message .= $CFG->dataroot.'/temp/olson.txt<br />';
-        $message .= $CFG->dataroot.'/temp/timezones.txt<br />';
-        $message .= '<a href="http://download.moodle.org/timezones/">http://download.moodle.org/timezones/</a><br />';
-        $message .= '<a href="'.$CFG->wwwroot.'/lib/timezones.txt">'.$CFG->dirroot.'/lib/timezones.txt</a><br />';
+        $message .= $CFG->dataroot.'/temp/timezone.txt<br />';
+        $message .= '<a href="http://download.moodle.org/timezone/">http://download.moodle.org/timezone/</a><br />';
+        $message .= '<a href="'.$CFG->wwwroot.'/lib/timezone.txt">'.$CFG->dirroot.'/lib/timezone.txt</a><br />';
        $message .= '<br />';

        $message = get_string("configintrotimezones", 'admin', $message);
@@ -54,7 +54,7 @@

 /// Next, look for a CSV file locally

-    $source = $CFG->dataroot.'/temp/timezones.txt';
+    $source = $CFG->dataroot.'/temp/timezone.txt';
    if (!$importdone and is_readable($source)) {
        if ($timezones = get_records_csv($source, 'timezone')) {
            update_timezone_records($timezones);
@@ -64,17 +64,17 @@

 /// Otherwise, let's try moodle.org's copy

-    $source = 'http://download.moodle.org/timezones/';
+    $source = 'http://download.moodle.org/timezone/';
    if (!$importdone and ini_get('allow_url_fopen')) {
        if (is_readable($source) && $contents = file_get_contents($source)) {  // Grab whole page
-            if ($file = fopen($CFG->dataroot.'/temp/timezones.txt', 'w')) {            // Make local copy
+            if ($file = fopen($CFG->dataroot.'/temp/timezone.txt', 'w')) {            // Make local copy
                fwrite($file, $contents);
                fclose($file);
-                if ($timezones = get_records_csv($CFG->dataroot.'/temp/timezones.txt', 'timezone')) {  // Parse it
+                if ($timezones = get_records_csv($CFG->dataroot.'/temp/timezone.txt', 'timezone')) {  // Parse it
                    update_timezone_records($timezones);
                    $importdone = $source;
                }
-                unlink($CFG->dataroot.'/temp/timezones.txt');
+                unlink($CFG->dataroot.'/temp/timezone.txt');
            }
        }
    }
@@ -82,7 +82,7 @@

 /// Final resort, use the copy included in Moodle

-    $source = $CFG->dirroot.'/lib/timezones.txt';
+    $source = $CFG->dirroot.'/lib/timezone.txt';
    if (!$importdone and is_readable($source)) {  // Distribution file
        if ($timezones = get_records_csv($source, 'timezone')) {
            update_timezone_records($timezones);
@@ -6,6 +6,9 @@
 require_once('../config.php');
 require_once($CFG->libdir.'/adminlib.php');

+/// no guest autologin
+require_login(0, false);
+
 $adminroot = admin_get_root();
 admin_externalpage_setup('upgradesettings', $adminroot); // now hidden page

@@ -62,13 +62,16 @@ if ($um->preprocess_files() && confirm_sesskey()) {
    // that we'll take longer, and that the process should be recycled soon
    // to free up memory.
    @set_time_limit(0);
-    @raise_memory_limit("196M");
+    @raise_memory_limit("192M");
    if (function_exists('apache_child_terminate')) {
        @apache_child_terminate();
    }

-    //Fix mac/dos newlines
    $text = my_file_get_contents($filename);
+    //trim utf-8 bom
+    $textlib = new textlib();
+    $text = $textlib->trim_utf8_bom($text);
+    //Fix mac/dos newlines
    $text = preg_replace('!\r\n?!',"\n",$text);
    $fp = fopen($filename, "w");
    fwrite($fp,$text);
@@ -101,8 +104,6 @@ if ($um->preprocess_files() && confirm_sesskey()) {
            "maildisplay" => 1,
            "htmleditor" => 1,
            "autosubscribe" => 1,
-            "idnumber" => 1,
-            "icq" => 1,
            "course1" => 1,
            "course2" => 1,
            "course3" => 1,
@@ -131,10 +132,10 @@ if ($um->preprocess_files() && confirm_sesskey()) {
            // check for valid field names
            foreach ($header as $i => $h) {
                $h = trim($h); $header[$i] = $h; // remove whitespace
-                if (!($required[$h] or $optionalDefaults[$h] or $optional[$h])) {
+                if (!(isset($required[$h]) or isset($optionalDefaults[$h]) or isset($optional[$h]))) {
                    error(get_string('invalidfieldname', 'error', $h), 'uploaduser.php?sesskey='.$USER->sesskey);
                }
-                if ($required[$h]) {
+                if (isset($required[$h])) {
                    $required[$h] = 0;
                }
            }
@@ -173,7 +174,7 @@ if ($um->preprocess_files() && confirm_sesskey()) {
                    // add fields to object $user
                    foreach ($record as $name => $value) {
                        // check for required values
-                        if ($required[$name] and !$value) {
+                        if (isset($required[$name]) and !$value) {
                            error(get_string('missingfield', 'error', $name). " ".
                                    get_string('erroronline', 'error', $linenum) .". ".
                                    get_string('processingstops', 'error'),
@@ -265,7 +266,6 @@ if ($um->preprocess_files() && confirm_sesskey()) {
                            //This can be used to obtain a list of userids for existing users
                            notify("$olduser->id ".get_string('usernotaddedregistered', 'error', $username));
                            $userserrors++;
-                            continue;
                        }

                    } else { // new user
@@ -299,8 +299,8 @@ if ($um->preprocess_files() && confirm_sesskey()) {
                            if (!$course[$i]) {
                                notify(get_string('coursegroupunknown','error',$addgroup[$i]));
                            } else {
-                                if ($groupid = groups_get_group_by_name($course[$i]->id, $addgroup[$i])) { //TODO:check.
-                                    $groupid[$i] = $groupid;
+                                if ($gid = groups_get_group_by_name($course[$i]->id, $addgroup[$i])) {
+                                    $groupid[$i] = $gid;
                                } else {
                                    notify(get_string('groupunknown','error',$addgroup[$i]));
                                }
@@ -419,4 +419,3 @@ function my_file_get_contents($filename, $use_include_path = 0) {
 }

 ?>
-
@@ -63,19 +63,24 @@
    $strsearch = get_string('search');
    $strshowallusers = get_string('showallusers');

+    if (empty($CFG->loginhttps)) {
+        $securewwwroot = $CFG->wwwroot;
+    } else {
+        $securewwwroot = str_replace('http:','https:',$CFG->wwwroot);
+    }
+
    admin_externalpage_print_header($adminroot);

    if ($confirmuser and confirm_sesskey()) {
        if (!$user = get_record('user', 'id', $confirmuser)) {
-            error("No such user!");
+            error("No such user!", '', true);
        }

-        $confirmeduser = new object();
-        $confirmeduser->id = $confirmuser;
-        $confirmeduser->confirmed = 1;
-        $confirmeduser->timemodified = time();
+        $auth = get_auth_plugin($user->auth);

-        if (update_record('user', $confirmeduser)) {
+        $result = $auth->user_confirm(addslashes($user->username), addslashes($user->secret));
+
+        if ($result == AUTH_CONFIRM_OK or $result == AUTH_CONFIRM_ALREADY) {
            notify(get_string('userconfirmed', '', fullname($user, true)) );
        } else {
            notify(get_string('usernotconfirmed', '', fullname($user, true)));
@@ -88,12 +93,12 @@
        }

        if (!$user = get_record('user', 'id', $delete)) {
-            error("No such user!");
+            error("No such user!", '', true);
        }

        $primaryadmin = get_admin();
        if ($user->id == $primaryadmin->id) {
-            error("You are not allowed to delete the primary admin user!");
+            error("You are not allowed to delete the primary admin user!", '', true);
        }

        if ($confirm != md5($delete)) {
@@ -104,16 +109,18 @@
            admin_externalpage_print_footer($adminroot);
            die;
        } else if (data_submitted() and !$user->deleted) {
+            //following code is also used in auth sync scripts
            $updateuser = new object();
-            $updateuser->id = $user->id;
-            $updateuser->deleted = 1;
-            $updateuser->username = addslashes("$user->email.".time());  // Remember it just in case
-            $updateuser->email = '';               // Clear this field to free it up
-            $updateuser->idnumber = '';               // Clear this field to free it up
+            $updateuser->id           = $user->id;
+            $updateuser->deleted      = 1;
+            $updateuser->username     = addslashes("$user->email.".time());  // Remember it just in case
+            $updateuser->email        = md5($user->username); // Store hash of username, useful importing/restoring users
+            $updateuser->idnumber     = '';                   // Clear this field to free it up
            $updateuser->timemodified = time();
            if (update_record('user', $updateuser)) {
-                // not sure if this is needed. unenrol_student($user->id);  // From all courses
-                delete_records('role_assignments', 'userid', $user->id); // unassign all roles
+                // Removing a user may have more requirements than just removing their role assignments.
+                // Use 'role_unassign' to make sure that all necessary actions occur.
+                role_unassign(0, $user->id);
                // remove all context assigned on this user?
                notify(get_string('deletedactivity', '', fullname($user, true)) );
            } else {
@@ -126,7 +133,7 @@
            error('You are not permitted to modify the MNET access control list.');
        }
        if (!$user = get_record('user', 'id', $acl)) {
-            error("No such user.");
+            error("No such user.", '', true);
        }
        if (!is_mnet_remote_user($user)) {
            error('Users in the MNET access control list must be remote MNET users.');
@@ -142,12 +149,12 @@
            $aclrecord->username = $user->username;
            $aclrecord->accessctrl = $accessctrl;
            if (!insert_record('mnet_sso_access_control', $aclrecord)) {
-                error("Database error - Couldn't modify the MNET access control list.");
+                error("Database error - Couldn't modify the MNET access control list.", '', true);
            }
        } else {
            $aclrecord->accessctrl = $accessctrl;
            if (!update_record('mnet_sso_access_control', $aclrecord)) {
-                error("Database error - Couldn't modify the MNET access control list.");
+                error("Database error - Couldn't modify the MNET access control list.", '', true);
            }
        }
        $mnethosts = get_records('mnet_host', '', '', 'id', 'id,wwwroot,name');
@@ -196,7 +203,7 @@
        }
    }
    
-    $users = get_users_listing($sort, $dir, $page*$perpage, $perpage, $search, $firstinitial, $lastinitial, $remotewhere);
+    $users = get_users_listing($sort, $dir, $page*$perpage, $perpage, $search, $firstinitial, $lastinitial, $remotewhere, false);
    $usercount = get_users(false);
    $usersearchcount = get_users(false, $search, true, "", "", $firstinitial, $lastinitial);

@@ -296,13 +303,19 @@
        }

        $mainadmin = get_admin();
-        if(empty($CFG->loginhttps)) {
-            $securewwwroot = $CFG->wwwroot;
-        } else {
-            $securewwwroot = str_replace('http:','https:',$CFG->wwwroot);
-        }

-        $table->head = array ("$firstname / $lastname", $email, $city, $country, $lastaccess, "", "", "");
+        $override = new object();
+        $override->firstname = 'firstname';
+        $override->lastname = 'lastname';
+        $fullnamelanguage = get_string('fullnamedisplay', '', $override);
+        if (($CFG->fullnamedisplay == 'firstname lastname') or
+            ($CFG->fullnamedisplay == 'firstname') or
+            ($CFG->fullnamedisplay == 'language' and $fullnamelanguage == 'firstname lastname' )) {
+            $fullnamedisplay = "$firstname / $lastname";
+        } else { // ($CFG->fullnamedisplay == 'language' and $fullnamelanguage == 'lastname firstname') 
+            $fullnamedisplay = "$lastname / $firstname";
+        }
+        $table->head = array ($fullnamedisplay, $email, $city, $country, $lastaccess, "", "", "");
        $table->align = array ("left", "left", "left", "left", "left", "center", "center", "center");
        $table->width = "95%";
        foreach ($users as $user) {
@@ -354,7 +367,9 @@
                            . get_string($changeaccessto, 'mnet') . " access</a>)";
                }
                // mnet info in edit column
-                $editbutton = $mnethosts[$user->mnethostid]->name;
+                if (isset($mnethosts[$user->mnethostid])) {
+                    $editbutton = $mnethosts[$user->mnethostid]->name;
+                }
            }

            if ($user->lastaccess) {
@@ -405,7 +420,7 @@
    echo "</td></tr></table>";

    if (has_capability('moodle/user:create', $sitecontext)) {
-        print_heading('<a href="../user/editadvanced.php?id=-1">'.get_string('addnewuser').'</a>');
+        print_heading('<a href="'.$securewwwroot.'/user/editadvanced.php?id=-1">'.get_string('addnewuser').'</a>');
    }
    if (!empty($table)) {
        print_table($table);
@@ -413,7 +428,7 @@
                         "user.php?sort=$sort&amp;dir=$dir&amp;perpage=$perpage".
                         "&amp;firstinitial=$firstinitial&amp;lastinitial=$lastinitial&amp;search=".urlencode(stripslashes($search))."&amp;");
        if (has_capability('moodle/user:create', $sitecontext)) {
-            print_heading('<a href="../user/editadvanced.php?id=-1">'.get_string('addnewuser').'</a>');
+            print_heading('<a href="'.$securewwwroot.'/user/editadvanced.php?id=-1">'.get_string('addnewuser').'</a>');
        }
    }

@@ -47,6 +47,8 @@ class XMLDBAction {

    var $postaction;     //Action to execute at the end of the invoke script

+    var $sesskey_protected; // Actions must be protected by sesskey mechanishm
+
    /**
     * Constructor
     */
@@ -72,6 +74,7 @@ class XMLDBAction {
        $this->output    = NULL;
        $this->errormsg  = NULL;
        $this->subaction = NULL;
+        $this->sesskey_protected = true;
    }

    /**
@@ -130,13 +133,18 @@ class XMLDBAction {
    }

    /**
-     * main invoke method, it simply sets the postaction attribute
-     * if possible
+     * main invoke method, it sets the postaction attribute
+     * if possible and checks sesskey_protected if needed
     */
    function invoke() {

        global $SESSION;

+    /// Sesskey protection
+        if ($this->sesskey_protected) {
+            require_sesskey();
+        }
+
    /// If we are used any dir, save it in the lastused session object
    /// Some actions can use it to perform positioning
        if ($lastused = optional_param ('dir', NULL, PARAM_PATH)) {
@@ -0,0 +1,275 @@
+<?php // $Id$
+
+///////////////////////////////////////////////////////////////////////////
+//                                                                       //
+// NOTICE OF COPYRIGHT                                                   //
+//                                                                       //
+// Moodle - Modular Object-Oriented Dynamic Learning Environment         //
+//          http://moodle.com                                            //
+//                                                                       //
+// Copyright (C) 2001-3001 Martin Dougiamas        http://dougiamas.com  //
+//           (C) 2001-3001 Eloy Lafuente (stronk7) http://contiento.com  //
+//                                                                       //
+// This program is free software; you can redistribute it and/or modify  //
+// it under the terms of the GNU General Public License as published by  //
+// the Free Software Foundation; either version 2 of the License, or     //
+// (at your option) any later version.                                   //
+//                                                                       //
+// This program is distributed in the hope that it will be useful,       //
+// but WITHOUT ANY WARRANTY; without even the implied warranty of        //
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         //
+// GNU General Public License for more details:                          //
+//                                                                       //
+//          http://www.gnu.org/copyleft/gpl.html                         //
+//                                                                       //
+///////////////////////////////////////////////////////////////////////////
+
+/// This class will compare all the indexes found in the XMLDB definitions
+/// with the phisical DB implementation, reporting about all the missing
+/// indexes to be created to be 100% ok.
+
+class check_indexes extends XMLDBAction {
+
+    /**
+     * Init method, every subclass will have its own
+     */
+    function init() {
+        parent::init();
+
+    /// Set own core attributes
+
+    /// Set own custom attributes
+
+    /// Get needed strings
+        $this->loadStrings(array(
+            'confirmcheckindexes' => 'xmldb',
+            'ok' => '',
+            'missing' => 'xmldb',
+            'table' => 'xmldb',
+            'key' => 'xmldb',
+            'index' => 'xmldb',
+            'searchresults' => 'xmldb',
+            'missingindexes' => 'xmldb',
+            'completelogbelow' => 'xmldb',
+            'nomissingindexesfound' => 'xmldb',
+            'yesmissingindexesfound' => 'xmldb',
+            'yes' => '',
+            'no' => '',
+            'back' => 'xmldb'
+
+        ));
+    }
+
+    /**
+     * Invoke method, every class will have its own
+     * returns true/false on completion, setting both
+     * errormsg and output as necessary
+     */
+    function invoke() {
+        parent::invoke();
+
+        $result = true;
+
+    /// Set own core attributes
+        $this->does_generate = ACTION_GENERATE_HTML;
+
+    /// These are always here
+        global $CFG, $XMLDB;
+
+    /// And we nedd some ddl suff
+        require_once ($CFG->libdir . '/ddllib.php');
+
+    /// Here we'll acummulate all the missing indexes found
+        $missing_indexes = array();
+
+    /// Do the job, setting $result as needed
+
+    /// Get the confirmed to decide what to do
+        $confirmed = optional_param('confirmed', false, PARAM_BOOL);
+
+    /// If  not confirmed, show confirmation box
+        if (!$confirmed) {
+            $o = '<table class="generalbox" border="0" cellpadding="5" cellspacing="0" id="notice">';
+            $o.= '  <tr><td class="generalboxcontent">';
+            $o.= '    <p class="centerpara">' . $this->str['confirmcheckindexes'] . '</p>';
+            $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
+            $o.= '      <div class="singlebutton">';
+            $o.= '        <form action="index.php?action=check_indexes&amp;sesskey=' . sesskey() . '&amp;confirmed=yes" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
+            $o.= '      </td><td>';
+            $o.= '      <div class="singlebutton">';
+            $o.= '        <form action="index.php?action=main_view" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '          <input type="submit" value="'. $this->str['no'] .'" /></fieldset></form></div>';
+            $o.= '      </td></tr>';
+            $o.= '    </table>';
+            $o.= '  </td></tr>';
+            $o.= '</table>';
+
+            $this->output = $o;
+        } else {
+        /// The back to edit table button
+            $b = ' <p class="centerpara buttons">';
+            $b .= '<a href="index.php">[' . $this->str['back'] . ']</a>';
+            $b .= '</p>';
+
+        /// Iterate over $XMLDB->dbdirs, loading their XML data to memory
+            if ($XMLDB->dbdirs) {
+                $dbdirs =& $XMLDB->dbdirs;
+                $o='<ul>';
+                foreach ($dbdirs as $dbdir) {
+                /// Only if the directory exists
+                    if (!$dbdir->path_exists) {
+                        continue;
+                    }
+                /// Load the XML file
+                    $xmldb_file = new XMLDBFile($dbdir->path . '/install.xml');
+                /// Load the needed XMLDB generator
+                    $classname = 'XMLDB' . $CFG->dbtype;
+                    $generator = new $classname();
+                    $generator->setPrefix($CFG->prefix);
+
+                /// Only if the file exists
+                    if (!$xmldb_file->fileExists()) {
+                        continue;
+                    }
+                /// Load the XML contents to structure
+                    $loaded = $xmldb_file->loadXMLStructure();
+                    if (!$loaded || !$xmldb_file->isLoaded()) {
+                        notify('Errors found in XMLDB file: '. $dbdir->path . '/install.xml');
+                        continue;
+                    }
+                /// Arriving here, everything is ok, get the XMLDB structure
+                    $structure = $xmldb_file->getStructure();
+                    $o.='    <li>' . str_replace($CFG->dirroot . '/', '', $dbdir->path . '/install.xml');
+                /// Getting tables
+                    if ($xmldb_tables = $structure->getTables()) {
+                        $o.='        <ul>';
+                    /// Foreach table, process its indexes and keys
+                        foreach ($xmldb_tables as $xmldb_table) {
+                        /// Skip table if not exists
+                            if (!table_exists($xmldb_table)) {
+                                continue;
+                            }
+                            $o.='            <li>' . $xmldb_table->getName();
+                        /// Keys
+                            if ($xmldb_keys = $xmldb_table->getKeys()) {
+                                $o.='        <ul>';
+                                foreach ($xmldb_keys as $xmldb_key) {
+                                    $o.='            <li>' . $this->str['key'] . ': ' . $xmldb_key->readableInfo() . ' ';
+                                /// Primaries are skipped
+                                    if ($xmldb_key->getType() == XMLDB_KEY_PRIMARY) {
+                                        $o.='<font color="green">' . $this->str['ok'] . '</font></li>';
+                                        continue;
+                                    }
+                                /// If we aren't creating the keys or the key is a XMLDB_KEY_FOREIGN (not underlying index generated
+                                /// automatically by the RDBMS) create the underlying (created by us) index (if doesn't exists)
+                                    if (!$generator->getKeySQL($xmldb_table, $xmldb_key) || $xmldb_key->getType() == XMLDB_KEY_FOREIGN) {
+                                    /// Create the interim index
+                                        $xmldb_index = new XMLDBIndex('anyname');
+                                        $xmldb_index->setFields($xmldb_key->getFields());
+                                        switch ($xmldb_key->getType()) {
+                                            case XMLDB_KEY_UNIQUE:
+                                            case XMLDB_KEY_FOREIGN_UNIQUE:
+                                                $xmldb_index->setUnique(true);
+                                                break;
+                                            case XMLDB_KEY_FOREIGN:
+                                                $xmldb_index->setUnique(false);
+                                                break;
+                                        }
+                                    /// Check if the index exists in DB
+                                        if (index_exists($xmldb_table, $xmldb_index)) {
+                                            $o.='<font color="green">' . $this->str['ok'] . '</font>';
+                                        } else {
+                                            $o.='<font color="red">' . $this->str['missing'] . '</font>';
+                                        /// Add the missing index to the list
+                                            $obj = new object;
+                                            $obj->table = $xmldb_table;
+                                            $obj->index = $xmldb_index;
+                                            $missing_indexes[] = $obj;
+                                        }
+                                    }
+                                    $o.='</li>';
+                                }
+                                $o.='        </ul>';
+                            }
+                        /// Indexes
+                            if ($xmldb_indexes = $xmldb_table->getIndexes()) {
+                                $o.='        <ul>';
+                                foreach ($xmldb_indexes as $xmldb_index) {
+                                    $o.='            <li>' . $this->str['index'] . ': ' . $xmldb_index->readableInfo() . ' ';
+                                /// Check if the index exists in DB
+                                    if (index_exists($xmldb_table, $xmldb_index)) {
+                                        $o.='<font color="green">' . $this->str['ok'] . '</font>';
+                                    } else {
+                                        $o.='<font color="red">' . $this->str['missing'] . '</font>';
+                                    /// Add the missing index to the list
+                                        $obj = new object;
+                                        $obj->table = $xmldb_table;
+                                        $obj->index = $xmldb_index;
+                                        $missing_indexes[] = $obj;
+                                    }
+                                    $o.='</li>';
+                                }
+                                $o.='        </ul>';
+                            }
+                            $o.='    </li>';
+                        /// Give the script some more time (resetting to current if exists)
+                            if ($currenttl = @ini_get('max_execution_time')) {
+                                @ini_set('max_execution_time',$currenttl);
+                            }
+                        }
+                        $o.='        </ul>';
+                    }
+                    $o.='    </li>';
+                }
+                $o.='</ul>';
+            }
+
+        /// We have finished, let's show the results of the search
+            $s = '';
+            $r = '<table class="generalbox boxaligncenter boxwidthwide" border="0" cellpadding="5" cellspacing="0" id="results">';
+            $r.= '  <tr><td class="generalboxcontent">';
+            $r.= '    <h2 class="main">' . $this->str['searchresults'] . '</h2>';
+            $r.= '    <p class="centerpara">' . $this->str['missingindexes'] . ': ' . count($missing_indexes) . '</p>';
+            $r.= '  </td></tr>';
+            $r.= '  <tr><td class="generalboxcontent">';
+
+        /// If we have found missing indexes inform about them
+            if (count($missing_indexes)) {
+                $r.= '    <p class="centerpara">' . $this->str['yesmissingindexesfound'] . '</p>';
+                $r.= '        <ul>';
+                foreach ($missing_indexes as $obj) {
+                    $xmldb_table = $obj->table;
+                    $xmldb_index = $obj->index;
+                    $sqlarr = $xmldb_table->getAddIndexSQL($CFG->dbtype, $CFG->prefix, $xmldb_index, true);
+                    $r.= '            <li>' . $this->str['table'] . ': ' . $xmldb_table->getName() . '. ' .
+                                              $this->str['index'] . ': ' . $xmldb_index->readableInfo() . '</li>';
+                    $s.= '<code>' . str_replace("\n", '<br />', implode('<br />', $sqlarr)) . '</code><br />';
+                    
+                }
+                $r.= '        </ul>';
+            /// Add the SQL statements (all together)
+                $r.= '<hr />' . $s;
+            } else {
+                $r.= '    <p class="centerpara">' . $this->str['nomissingindexesfound'] . '</p>';
+            }
+            $r.= '  </td></tr>';
+            $r.= '  <tr><td class="generalboxcontent">';
+        /// Add the complete log message
+            $r.= '    <p class="centerpara">' . $this->str['completelogbelow'] . '</p>';
+            $r.= '  </td></tr>';
+            $r.= '</table>';
+
+            $this->output = $b . $r . $o;
+        }
+
+    /// Launch postaction if exists (leave this here!)
+        if ($this->getPostAction() && $result) {
+            return $this->launch($this->getPostAction());
+        }
+
+    /// Return ok if arrived here
+        return $result;
+    }
+}
+?>
@@ -77,7 +77,7 @@ class delete_field extends XMLDBAction {
            $o.= '    <p class="centerpara">' . $this->str['confirmdeletefield'] . '<br /><br />' . $fieldparam . '</p>';
            $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
            $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_field&amp;confirmed=yes&amp;postaction=edit_table&amp;field=' . $fieldparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_field&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_table&amp;field=' . $fieldparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
            $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
            $o.= '      </td><td>';
            $o.= '      <div class="singlebutton">';
@@ -77,7 +77,7 @@ class delete_index extends XMLDBAction {
            $o.= '    <p class="centerpara">' . $this->str['confirmdeleteindex'] . '<br /><br />' . $indexparam . '</p>';
            $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
            $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_index&amp;confirmed=yes&amp;postaction=edit_table&amp;index=' . $indexparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_index&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_table&amp;index=' . $indexparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
            $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
            $o.= '      </td><td>';
            $o.= '      <div class="singlebutton">';
@@ -77,7 +77,7 @@ class delete_key extends XMLDBAction {
            $o.= '    <p class="centerpara">' . $this->str['confirmdeletekey'] . '<br /><br />' . $keyparam . '</p>';
            $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
            $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_key&amp;confirmed=yes&amp;postaction=edit_table&amp;key=' . $keyparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_key&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_table&amp;key=' . $keyparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
            $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
            $o.= '      </td><td>';
            $o.= '      <div class="singlebutton">';
@@ -77,7 +77,7 @@ class delete_sentence extends XMLDBAction {
            $o.= '    <p class="centerpara">' . $this->str['confirmdeletesentence'] . '</p>';
            $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
            $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_sentence&amp;confirmed=yes&amp;postaction=edit_statement&amp;sentence=' . $sentenceparam . '&amp;statement=' . urlencode($statementparam) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_sentence&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_statement&amp;sentence=' . $sentenceparam . '&amp;statement=' . urlencode($statementparam) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
            $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
            $o.= '      </td><td>';
            $o.= '      <div class="singlebutton">';
@@ -76,7 +76,7 @@ class delete_statement extends XMLDBAction {
            $o.= '    <p class="centerpara">' . $this->str['confirmdeletestatement'] . '<br /><br />' . $statementparam . '</p>';
            $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
            $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_statement&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_statement&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
            $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
            $o.= '      </td><td>';
            $o.= '      <div class="singlebutton">';
@@ -76,7 +76,7 @@ class delete_table extends XMLDBAction {
            $o.= '    <p class="centerpara">' . $this->str['confirmdeletetable'] . '<br /><br />' . $tableparam . '</p>';
            $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
            $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_table&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_table&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
            $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
            $o.= '      </td><td>';
            $o.= '      <div class="singlebutton">';
@@ -75,7 +75,7 @@ class delete_xml_file extends XMLDBAction {
            $o.= '    <p class="centerpara">' . $this->str['confirmdeletexmlfile'] . '<br /><br />' . $dirpath . '/install.php</p>';
            $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
            $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_xml_file&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_xml_file&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
            $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
            $o.= '      </td><td>';
            $o.= '      <div class="singlebutton">';
@@ -35,6 +35,7 @@ class edit_field extends XMLDBAction {
        parent::init();

    /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection

    /// Get needed strings
        $this->loadStrings(array(
@@ -84,7 +85,7 @@ class edit_field extends XMLDBAction {
    /// Fetch request data
        $tableparam = required_param('table', PARAM_CLEAN);
        if (!$table =& $structure->getTable($tableparam)) {
-            $this->errormsg = 'Wrong table specified: ' . $tableparm;
+            $this->errormsg = 'Wrong table specified: ' . $tableparam;
            return false;
        }
        $fieldparam = required_param('field', PARAM_CLEAN);
@@ -103,6 +104,7 @@ class edit_field extends XMLDBAction {
        $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
        $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
        $o.= '    <input type="hidden" name ="field" value="' . $fieldparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
        $o.= '    <input type="hidden" name ="action" value="edit_field_save" />';
        $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
        $o.= '    <table id="formelements" class="boxaligncenter">';
@@ -173,7 +175,7 @@ class edit_field extends XMLDBAction {
        $o.= '    </table>';
        $o.= '</div></form>';
    /// Calculate the buttons
-        $b = ' <p class="buttons">';
+        $b = ' <p class="centerpara buttons">';
    /// The view original XML button
        if ($table->getField($fieldparam)) {
            $b .= '&nbsp;<a href="index.php?action=view_field_xml&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;select=original&amp;table=' . $tableparam . '&amp;field=' . $fieldparam . '">[' . $this->str['vieworiginal'] . ']</a>';
@@ -35,6 +35,7 @@ class edit_index extends XMLDBAction {
        parent::init();

    /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection

    /// Get needed strings
        $this->loadStrings(array(
@@ -84,7 +85,7 @@ class edit_index extends XMLDBAction {
    /// Fetch request data
        $tableparam = required_param('table', PARAM_CLEAN);
        if (!$table =& $structure->getTable($tableparam)) {
-            $this->errormsg = 'Wrong table specified: ' . $tableparm;
+            $this->errormsg = 'Wrong table specified: ' . $tableparam;
            return false;
        }
        $indexparam = required_param('index', PARAM_CLEAN);
@@ -103,6 +104,7 @@ class edit_index extends XMLDBAction {
        $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
        $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
        $o.= '    <input type="hidden" name ="index" value="' . $indexparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
        $o.= '    <input type="hidden" name ="action" value="edit_index_save" />';
        $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
        $o.= '    <table id="formelements" class="boxaligncenter">';
@@ -112,7 +114,7 @@ class edit_index extends XMLDBAction {
        if ($structure->getIndexUses($table->getName(), $index->getName())) {
            $disabled = ' disabled="disabled " ';
        }
-        $o.= '      <tr valign="top"><td><label for="name" accesskey="n">Name:</label></td><td colspan="2"><input name="name" type="text" size="30" id="name"' . $disabled . 'value="' . s($index->getName()) . '" /></td></tr>';
+        $o.= '      <tr valign="top"><td><label for="name" accesskey="n">Name:</label></td><td colspan="2"><input name="name" type="text" size="30" id="name"' . $disabled . ' value="' . s($index->getName()) . '" /></td></tr>';
    /// XMLDB key comment
        $o.= '      <tr valign="top"><td><label for="comment" accesskey="c">Comment:</label></td><td colspan="2"><textarea name="comment" rows="3" cols="80" id="comment">' . s($index->getComment()) . '</textarea></td></tr>';
    /// XMLDBIndex Type
@@ -128,7 +130,7 @@ class edit_index extends XMLDBAction {
        $o.= '    </table>';
        $o.= '</div></form>';
    /// Calculate the buttons
-        $b = ' <p class="buttons">';
+        $b = ' <p class="centerpara buttons">';
    /// The view original XML button
        if ($table->getIndex($indexparam)) {
            $b .= '&nbsp;<a href="index.php?action=view_index_xml&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;select=original&amp;table=' . $tableparam . '&amp;index=' . $indexparam . '">[' . $this->str['vieworiginal'] . ']</a>';
@@ -35,6 +35,7 @@ class edit_key extends XMLDBAction {
        parent::init();

    /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection

    /// Get needed strings
        $this->loadStrings(array(
@@ -84,7 +85,7 @@ class edit_key extends XMLDBAction {
    /// Fetch request data
        $tableparam = required_param('table', PARAM_CLEAN);
        if (!$table =& $structure->getTable($tableparam)) {
-            $this->errormsg = 'Wrong table specified: ' . $tableparm;
+            $this->errormsg = 'Wrong table specified: ' . $tableparam;
            return false;
        }
        $keyparam = required_param('key', PARAM_CLEAN);
@@ -103,6 +104,7 @@ class edit_key extends XMLDBAction {
        $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
        $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
        $o.= '    <input type="hidden" name ="key" value="' . $keyparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
        $o.= '    <input type="hidden" name ="action" value="edit_key_save" />';
        $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
        $o.= '    <table id="formelements" class="boxaligncenter">';
@@ -112,7 +114,7 @@ class edit_key extends XMLDBAction {
        if ($structure->getKeyUses($table->getName(), $key->getName())) {
            $disabled = ' disabled="disabled " ';
        }
-        $o.= '      <tr valign="top"><td><label for="name" accesskey="n">Name:</label></td><td colspan="2"><input name="name" type="text" size="30" id="name"' . $disabled . 'value="' . s($key->getName()) . '" /></td></tr>';
+        $o.= '      <tr valign="top"><td><label for="name" accesskey="n">Name:</label></td><td colspan="2"><input name="name" type="text" size="30" id="name"' . $disabled . ' value="' . s($key->getName()) . '" /></td></tr>';
    /// XMLDB key comment
        $o.= '      <tr valign="top"><td><label for="comment" accesskey="c">Comment:</label></td><td colspan="2"><textarea name="comment" rows="3" cols="80" id="comment">' . s($key->getComment()) . '</textarea></td></tr>';
    /// XMLDBKey Type
@@ -140,7 +142,7 @@ class edit_key extends XMLDBAction {
        $o.= '    </table>';
        $o.= '</div></form>';
    /// Calculate the buttons
-        $b = ' <p class="buttons">';
+        $b = ' <p class="centerpara buttons">';
    /// The view original XML button
        if ($table->getKey($keyparam)) {
            $b .= '&nbsp;<a href="index.php?action=view_key_xml&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;select=original&amp;table=' . $tableparam . '&amp;key=' . $keyparam . '">[' . $this->str['vieworiginal'] . ']</a>';
@@ -35,6 +35,7 @@ class edit_sentence extends XMLDBAction {
        parent::init();

    /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection

    /// Get needed strings
        $this->loadStrings(array(
@@ -119,6 +120,7 @@ class edit_sentence extends XMLDBAction {
            $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
            $o.= '    <input type="hidden" name ="statement" value="' . $statementparam .'" />';
            $o.= '    <input type="hidden" name ="sentence" value="' . $sentenceparam .'" />';
+            $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
            $o.= '    <input type="hidden" name ="action" value="edit_sentence_save" />';
            $o.= '    <input type="hidden" name ="postaction" value="edit_statement" />';
            $o.= '    <table id="formelements" class="boxaligncenter">';
@@ -133,7 +135,7 @@ class edit_sentence extends XMLDBAction {
            $o.= '    </table>';
            $o.= '</div></form>';
        /// Calculate the buttons
-            $b = ' <p class="buttons">';
+            $b = ' <p class="centerpara buttons">';
        /// The back to edit statement button
            $b .= '&nbsp;<a href="index.php?action=edit_statement&amp;statement=' . urlencode($statementparam) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['back'] . ']</a>';
            $b .= '</p>';
@@ -35,6 +35,7 @@ class edit_statement extends XMLDBAction {
        parent::init();

    /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection

    /// Get needed strings
        $this->loadStrings(array(
@@ -106,6 +107,7 @@ class edit_statement extends XMLDBAction {
        $o.= '<div>';        
        $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
        $o.= '    <input type="hidden" name ="statement" value="' . $statementparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
        $o.= '    <input type="hidden" name ="action" value="edit_statement_save" />';
        $o.= '    <input type="hidden" name ="postaction" value="edit_statement" />';
        $o.= '    <table id="formelements" class="boxaligncenter">';
@@ -115,7 +117,7 @@ class edit_statement extends XMLDBAction {
        $o.= '    </table>';
        $o.= '</div></form>';
    /// Calculate the buttons
-        $b = ' <p class="buttons">';
+        $b = ' <p class="centerpara buttons">';
    /// The view original XML button
        if ($origstructure->getStatement($statementparam)) {
            $b .= '&nbsp;<a href="index.php?action=view_statement_xml&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;select=original&amp;statement=' . $statementparam . '">[' . $this->str['vieworiginal'] . ']</a>';
@@ -129,7 +131,7 @@ class edit_statement extends XMLDBAction {
            $b .= '&nbsp;[' . $this->str['viewedited'] . ']';
        }
    /// The new sentence button
-        $b .= '&nbsp;<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newsentence'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;sesskey=' . sesskey() . '&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newsentence'] . ']</a>';
    /// The back to edit xml file button
        $b .= '&nbsp;<a href="index.php?action=edit_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['back'] . ']</a>';
        $b .= '</p>';
@@ -157,10 +159,10 @@ class edit_statement extends XMLDBAction {
                $b .= '<a href="index.php?action=edit_sentence&amp;sentence=' .$key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['edit'] . ']</a>';
                $b .= '</td><td class="button cell">';
            /// The duplicate button
-                $b .= '<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;basesentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['duplicate'] . ']</a>';
+                $b .= '<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;sesskey=' . sesskey() . '&amp;basesentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['duplicate'] . ']</a>';
                $b .= '</td><td class="button cell">';
            /// The delete button
-                $b .= '<a href="index.php?action=delete_sentence&amp;sentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                $b .= '<a href="index.php?action=delete_sentence&amp;sesskey=' . sesskey() . '&amp;sentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                $b .= '</td>';
            /// Print table row
            $o .= '<tr class="r' . $row . '"><td class="table cell">' . $p . $sentence . $b . '</tr>';
@@ -35,6 +35,7 @@ class edit_table extends XMLDBAction {
        parent::init();

    /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection

    /// Get needed strings
        $this->loadStrings(array(
@@ -107,6 +108,7 @@ class edit_table extends XMLDBAction {
        $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
        $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
        $o.= '    <input type="hidden" name ="action" value="edit_table_save" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
        $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
        $o.= '    <table id="formelements" class="boxaligncenter">';
    /// If the table is being used, we cannot rename it
@@ -134,11 +136,11 @@ class edit_table extends XMLDBAction {
            $b .= '&nbsp;[' . $this->str['viewedited'] . ']';
        }
    /// The new field button
-        $b .= '&nbsp;<a href="index.php?action=new_field&amp;postaction=edit_field&amp;table=' . $tableparam . '&amp;field=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newfield'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_field&amp;sesskey=' . sesskey() . '&amp;postaction=edit_field&amp;table=' . $tableparam . '&amp;field=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newfield'] . ']</a>';
    /// The new key button
-        $b .= '&nbsp;<a href="index.php?action=new_key&amp;postaction=edit_key&amp;table=' . $tableparam . '&amp;key=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newkey'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_key&amp;sesskey=' . sesskey() . '&amp;postaction=edit_key&amp;table=' . $tableparam . '&amp;key=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newkey'] . ']</a>';
    /// The new index button
-        $b .= '&nbsp;<a href="index.php?action=new_index&amp;postaction=edit_index&amp;table=' . $tableparam . '&amp;index=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newindex'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_index&amp;sesskey=' . sesskey() . '&amp;postaction=edit_index&amp;table=' . $tableparam . '&amp;index=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newindex'] . ']</a>';
    /// The back to edit xml file button
        $b .= '&nbsp;<a href="index.php?action=edit_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['back'] . ']</a>';
        $b .= '</p>';
@@ -185,14 +187,14 @@ class edit_table extends XMLDBAction {
                $b .= '</td><td class="button cell">';
            /// The up button
                if ($field->getPrevious()) {
-                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=up&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                } else {
                    $b .= '[' . $this->str['up'] . ']';
                }
                $b .= '</td><td class="button cell">';
            /// The down button
                if ($field->getNext()) {
-                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=down&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                } else {
                    $b .= '[' . $this->str['down'] . ']';
                }
@@ -200,7 +202,7 @@ class edit_table extends XMLDBAction {
            /// The delete button (if we have more than one and it isn't used
                if (count($fields) > 1 &&
                !$structure->getFieldUses($table->getName(), $field->getName())) {
-                    $b .= '<a href="index.php?action=delete_field&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_field&amp;sesskey=' . sesskey() . '&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                } else {
                    $b .= '[' . $this->str['delete'] . ']';
                }
@@ -234,21 +236,21 @@ class edit_table extends XMLDBAction {
                $b .= '</td><td class="button cell">';
            /// The up button
                if ($key->getPrevious()) {
-                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=up&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                } else {
                    $b .= '[' . $this->str['up'] . ']';
                }
                $b .= '</td><td class="button cell">';
            /// The down button
                if ($key->getNext()) {
-                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=down&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                } else {
                    $b .= '[' . $this->str['down'] . ']';
                }
                $b .= '</td><td class="button cell">';
            /// The delete button (if the key hasn't uses)
                if (!$structure->getKeyUses($table->getName(), $key->getName())) {
-                    $b .= '<a href="index.php?action=delete_key&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_key&amp;sesskey=' . sesskey() . '&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                } else {
                    $b .= '[' . $this->str['delete'] . ']';
                }
@@ -274,20 +276,20 @@ class edit_table extends XMLDBAction {
                $b .= '</td><td class="button cell">';
            /// The up button
                if ($index->getPrevious()) {
-                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=up&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                } else {
                    $b .= '[' . $this->str['up'] . ']';
                }
                $b .= '</td><td class="button cell">';
            /// The down button
                if ($index->getNext()) {
-                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=down&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                } else {
                    $b .= '[' . $this->str['down'] . ']';
                }
                $b .= '</td><td class="button cell">';
            /// The delete button
-                    $b .= '<a href="index.php?action=delete_index&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_index&amp;sesskey=' . sesskey() . '&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
            /// The readable info
                $r = '</td><td class="readableinfo cell">' . $index->readableInfo() . '</td>';
            /// Print table row
@@ -107,7 +107,7 @@ class edit_table_save extends XMLDBAction {
                         "<a href=\"../index.php\">" . $this->str['administration'] . "</a> -> <a href=\"index.php\">XMLDB</a>");
            notice ('<p>' .implode(', ', $errors) . '</p>
                     <p>' . $temptable->readableInfo(),
-                     'index.php?action=edit_table&amp;table=' . $tableparam . '&amp;dir=' . str_replace($CFG->dirroot, '', urlencode($dirpath)));
+                     'index.php?action=edit_table&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)));
            die; /// re-die :-P
        }

@@ -35,6 +35,7 @@ class edit_xml_file extends XMLDBAction {
        parent::init();

    /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection

    /// Get needed strings
        $this->loadStrings(array(
@@ -107,6 +108,7 @@ class edit_xml_file extends XMLDBAction {
                $o.= '    <input type="hidden" name ="postaction" value="edit_xml_file" />';
                $o.= '    <input type="hidden" name ="path" value="' . s($structure->getPath()) .'" />';
                $o.= '    <input type="hidden" name ="version" value="' . s($structure->getVersion()) .'" />';
+                $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
                $o.= '    <table id="formelements" class="boxaligncenter">';
                $o.= '      <tr valign="top"><td>Path:</td><td>' . s($structure->getPath()) . '</td></tr>';
                $o.= '      <tr valign="top"><td>Version:</td><td>' . s($structure->getVersion()) . '</td></tr>';
@@ -125,15 +127,15 @@ class edit_xml_file extends XMLDBAction {
                    $b .= '&nbsp;[' . $this->str['viewedited'] . ']';
                }
            /// The new table button
-                $b .= '&nbsp;<a href="index.php?action=new_table&amp;postaction=edit_table&amp;table=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtable'] . ']</a>';
+                $b .= '&nbsp;<a href="index.php?action=new_table&amp;sesskey=' . sesskey() . '&amp;postaction=edit_table&amp;table=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtable'] . ']</a>';
            /// The new from MySQL button
                if ($CFG->dbfamily == 'mysql') {
-                    $b .= '&nbsp;<a href="index.php?action=new_table_from_mysql&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtablefrommysql'] . ']</a>';
+                    $b .= '&nbsp;<a href="index.php?action=new_table_from_mysql&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtablefrommysql'] . ']</a>';
                } else {
                    $b .= '&nbsp;[' . $this->str['newtablefrommysql'] . ']';
                }
            /// The new statement button
-                $b .= '&nbsp;<a href="index.php?action=new_statement&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newstatement'] . ']</a>';
+                $b .= '&nbsp;<a href="index.php?action=new_statement&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newstatement'] . ']</a>';
            /// The back to main menu button
                $b .= '&nbsp;<a href="index.php?action=main_view#lastused">[' . $this->str['backtomainview'] . ']</a>';
                $b .= '</p>';
@@ -169,14 +171,14 @@ class edit_xml_file extends XMLDBAction {
                        $b .= '</td><td class="button cell">';
                    /// The up button
                        if ($table->getPrevious()) {
-                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=up&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                        } else {
                            $b .= '[' . $this->str['up'] . ']';
                        }
                        $b .= '</td><td class="button cell">';
                    /// The down button
                        if ($table->getNext()) {
-                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=down&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                        } else {
                            $b .= '[' . $this->str['down'] . ']';
                        }
@@ -185,7 +187,7 @@ class edit_xml_file extends XMLDBAction {
                        if (count($tables) > 1 &&
                            !$structure->getTableUses($table->getName())) {
                            ///!$structure->getTableUses($table->getName())) {
-                            $b .= '<a href="index.php?action=delete_table&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                            $b .= '<a href="index.php?action=delete_table&amp;sesskey=' . sesskey() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                        } else {
                            $b .= '[' . $this->str['delete'] . ']';
                        }
@@ -214,20 +216,20 @@ class edit_xml_file extends XMLDBAction {
                        $b .= '</td><td class="button cell">';
                    /// The up button
                        if ($statement->getPrevious()) {
-                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=up&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                        } else {
                            $b .= '[' . $this->str['up'] . ']';
                        }
                        $b .= '</td><td class="button cell">';
                    /// The down button
                        if ($statement->getNext()) {
-                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=down&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                        } else {
                            $b .= '[' . $this->str['down'] . ']';
                        }
                        $b .= '</td><td class="button cell">';
                    /// The delete button
-                        $b .= '<a href="index.php?action=delete_statement&amp;statement=' . $statement->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                        $b .= '<a href="index.php?action=delete_statement&amp;sesskey=' . sesskey() . '&amp;statement=' . $statement->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                        $b .= '</td>';
                    /// Print statement row
                        $o .= '<tr class="r' . $row . '"><td class="statement cell"><a href="index.php?action=view_statement_xml&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;statement=' . $statement->getName() . '&amp;select=edited">' . $statement->getName() . '</a>' . $b . '</tr>';
@@ -39,6 +39,7 @@ class get_db_directories extends XMLDBAction {
        //$this->can_subaction = ACTION_HAVE_SUBACTIONS;

    /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection

    /// Get needed strings
        $this->loadStrings(array(
@@ -130,6 +131,18 @@ class get_db_directories extends XMLDBAction {
            }
        }

+    /// Now, course formats (course/format/xxx/db)
+        if ($plugins = get_list_of_plugins('course/format', 'db')) {
+            foreach ($plugins as $plugin) {
+                $dbdir = new stdClass;
+                $dbdir->path = $CFG->dirroot . '/course/format/' . $plugin . '/db';
+                if (!isset($XMLDB->dbdirs[$dbdir->path])) {
+                    $XMLDB->dbdirs[$dbdir->path] = $dbdir;
+                }
+                $XMLDB->dbdirs[$dbdir->path]->path_exists = file_exists($dbdir->path);  //Update status
+            }
+        }
+
    /// Now, enrolment plugins (enrol/xxx/db)
        if ($plugins = get_list_of_plugins('enrol', 'db')) {
            foreach ($plugins as $plugin) {
@@ -141,7 +154,7 @@ class get_db_directories extends XMLDBAction {
                $XMLDB->dbdirs[$dbdir->path]->path_exists = file_exists($dbdir->path);  //Update status
            }
        }
-        
+
    /// Now, groups
        $dbdir = new stdClass;
        $dbdir->path = $CFG->dirroot . '/group/db';
@@ -38,6 +38,7 @@ class load_xml_file extends XMLDBAction {
        //$this->can_subaction = ACTION_HAVE_SUBACTIONS;

    /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection

    /// Get needed strings
        $this->loadStrings(array(
@@ -81,6 +82,9 @@ class load_xml_file extends XMLDBAction {
                    return false;
                }
                $xmldb_file = new XMLDBFile($dbdir->path . '/install.xml');
+            ///Set the XML DTD and schema
+                $xmldb_file->setDTD($CFG->dirroot . '/lib/xmldb/xmldb.dtd');
+                $xmldb_file->setSchema($CFG->dirroot . '/lib/xmldb/xmldb.xsd');
            /// Set dbdir as necessary
                if ($xmldb_file->fileExists()) {
                    $dbdir->xml_exists = true;
@@ -92,6 +96,7 @@ class load_xml_file extends XMLDBAction {
                $loaded = $xmldb_file->loadXMLStructure();
                if ($loaded && $xmldb_file->isLoaded()) {
                    $dbdir->xml_loaded = true;
+                    $dbdir->filemtime = filemtime($dbdir->path . '/install.xml'); 
                }
                $dbdir->xml_file = $xmldb_file;
            } else {
@@ -35,6 +35,7 @@ class main_view extends XMLDBAction {
        parent::init();

    /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection

    /// Get needed strings
        $this->loadStrings(array(
@@ -47,7 +48,8 @@ class main_view extends XMLDBAction {
            'delete' => 'xmldb',
            'reservedwords' => 'xmldb',
            'test' => 'xmldb',
-            'gotolastused' => 'xmldb'
+            'gotolastused' => 'xmldb',
+            'checkindexes' => 'xmldb'
        ));
    }

@@ -83,7 +85,9 @@ class main_view extends XMLDBAction {
    /// The reserved_words button
        $b .= '&nbsp;<a href="index.php?action=view_reserved_words">[' . $this->str['reservedwords'] . ']</a>';
    /// The test button
-        $b .= '&nbsp;<a href="index.php?action=test">[' . $this->str['test'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=test&amp;sesskey=' . sesskey() . '">[' . $this->str['test'] . ']</a>';
+    /// The check indexes button
+        $b .= '&nbsp;<a href="index.php?action=check_indexes&amp;sesskey=' . sesskey() . '">[' . $this->str['checkindexes'] . ']</a>';
        $b .= '</p>';
    /// Send buttons to output
        $o .= $b;
@@ -123,7 +127,7 @@ class main_view extends XMLDBAction {
                if ($dbdir->path_exists &&
                    !file_exists($key . '/install.xml') &&
                    is_writeable($key)) {
-                    $b .= '<a href="index.php?action=create_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['create'] . ']</a>';
+                    $b .= '<a href="index.php?action=create_xml_file&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['create'] . ']</a>';
                } else {
                    $b .= '[' . $this->str['create'] . ']';
                }
@@ -152,11 +156,18 @@ class main_view extends XMLDBAction {
            /// The save button
                if ($dbdir->path_exists &&
                    file_exists($key . '/install.xml') &&
-                    is_readable($key . '/install.xml') &&
+                    is_writeable($key . '/install.xml') &&
                    is_writeable($key) &&
                    !empty($dbdir->xml_loaded) &&
                    !empty($dbdir->xml_changed)) {
-                    $b .= '<a href="index.php?action=save_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['save'] . ']</a>';
+                    $b .= '<a href="index.php?action=save_xml_file&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['save'] . ']</a>';
+                /// Check if the file has been manually edited while being modified in the editor
+                    if ($dbdir->filemtime != filemtime($key . '/install.xml')) {
+                    /// File manually modified. Add to errors.
+                        if ($structure =& $dbdir->xml_file->getStructure()) {
+                            $structure->errormsg = 'Warning: File locally modified while using the XMLDB Editor. Saving will overwrite local changes';
+                        }
+                    }
                } else {
                    $b .= '[' . $this->str['save'] . ']';
                }
@@ -168,7 +179,7 @@ class main_view extends XMLDBAction {
                    is_writeable($key) &&
                    !empty($dbdir->xml_loaded) &&
                    !empty($dbdir->xml_changed)) {
-                    $b .= '<a href="index.php?action=revert_changes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['revert'] . ']</a>';
+                    $b .= '<a href="index.php?action=revert_changes&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['revert'] . ']</a>';
                } else {
                    $b .= '[' . $this->str['revert'] . ']';
                }
@@ -190,7 +201,7 @@ class main_view extends XMLDBAction {
                    is_readable($key . '/install.xml') &&
                    is_writeable($key) &&
                    empty($dbdir->xml_loaded)) {
-                    $b .= '<a href="index.php?action=delete_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_xml_file&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['delete'] . ']</a>';
                } else {
                    $b .= '[' . $this->str['delete'] . ']';
                }
@@ -107,6 +107,7 @@ class new_statement extends XMLDBAction {
            $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
            $o.= '    <input type="hidden" name ="action" value="new_statement" />';
            $o.= '    <input type="hidden" name ="postaction" value="edit_statement" />';
+            $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() . '" />';
            $o.= '    <table id="formelements" class="boxaligncenter" cellpadding="5">';
            $o.= '      <tr><td><label for="type" accesskey="t">' . $this->str['statementtype'] .' </label>' . choose_from_menu($typeoptions, 'type', '', 'choose', '', 0, true) . '<label for="table" accesskey="a">' . $this->str['statementtable'] . ' </label>' .choose_from_menu($selecttables, 'table', '', 'choose', '', 0, true) . '</td></tr>';
            $o.= '      <tr><td colspan="2" align="center"><input type="submit" value="' .$this->str['create'] . '" /></td></tr>';
@@ -88,6 +88,7 @@ class new_table extends XMLDBAction {
            $field->setType(XMLDB_TYPE_INTEGER);
            $field->setLength(10);
            $field->setNotNull(true);
+            $field->setUnsigned(true);
            $field->setSequence(true);
            $field->setComment('id of the table, please edit me');
            $field->setLoaded(true);
@@ -88,7 +88,7 @@ class new_table_from_mysql extends XMLDBAction {
            $dbtables = $db->MetaTables('TABLES');
            $selecttables = array();
            foreach ($dbtables as $dbtable) {
-                $dbtable = str_replace($CFG->prefix, '', $dbtable);
+                $dbtable = strtolower(str_replace($CFG->prefix, '', $dbtable));
                $i = $structure->findTableInArray($dbtable);
                if ($i === NULL) {
                    $selecttables[$dbtable] = $dbtable;
@@ -111,6 +111,7 @@ class new_table_from_mysql extends XMLDBAction {
            $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
            $o.= '    <input type="hidden" name ="action" value="new_table_from_mysql" />';
            $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
+            $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() . '" />';
            $o.= '    <table id="formelements" class="boxaligncenter" cellpadding="5">';
            $o.= '      <tr><td><label for="table" accesskey="t">' . $this->str['createtable'] .' </label>' . choose_from_menu($selecttables, 'table', '', 'choose', '', 0, true) . '<label for="after" accesskey="a">' . $this->str['aftertable'] . ' </label>' .choose_from_menu($aftertables, 'after', '', 'choose', '', 0, true) . '</td></tr>';
            $o.= '      <tr><td colspan="2" align="center"><input type="submit" value="' .$this->str['create'] . '" /></td></tr>';
@@ -75,7 +75,7 @@ class revert_changes extends XMLDBAction {
            $o.= '    <p class="centerpara">' . $this->str['confirmrevertchanges'] . '<br /><br />' . $dirpath . '</p>';
            $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
            $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=revert_changes&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=revert_changes&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
            $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
            $o.= '      </td><td>';
            $o.= '      <div class="singlebutton">';
@@ -92,7 +92,7 @@ class test extends XMLDBAction {
        $table->addFieldInfo('course', XMLDB_TYPE_INTEGER, '10', XMLDB_UNSIGNED, XMLDB_NOTNULL, null, null, null, '0');
        $table->addFieldInfo('type', XMLDB_TYPE_CHAR, '20', null, XMLDB_NOTNULL, null, XMLDB_ENUM, array('single', 'news', 'general', 'social', 'eachuser', 'teacher', 'qanda'), 'general');
        $table->addFieldInfo('name', XMLDB_TYPE_CHAR, '255', null, XMLDB_NOTNULL, null, null, null, '');
-        $table->addFieldInfo('intro', XMLDB_TYPE_TEXT, 'small', null, XMLDB_NOTNULL, null, null, null, '');
+        $table->addFieldInfo('intro', XMLDB_TYPE_TEXT, 'small', null, XMLDB_NOTNULL, null, null, null, null);
        $table->addFieldInfo('logo', XMLDB_TYPE_BINARY, 'big', null, XMLDB_NOTNULL, null, null, null);
        $table->addFieldInfo('assessed', XMLDB_TYPE_INTEGER, '10', XMLDB_UNSIGNED, XMLDB_NOTNULL, null, null, null, '0');
        $table->addFieldInfo('assesstimestart', XMLDB_TYPE_INTEGER, '10', XMLDB_UNSIGNED, XMLDB_NOTNULL, null, null, null, '0');
@@ -114,6 +114,8 @@ class test extends XMLDBAction {
        $table->addIndexInfo('course', XMLDB_INDEX_NOTUNIQUE, array('course'));
        $table->addIndexInfo('rsstype', XMLDB_INDEX_UNIQUE, array('rsstype'));

+        $table->setComment("This is a test'n drop table. You can drop it safely");
+
    /// Get SQL code and execute it
        $test = new stdClass;
        $test->sql = $table->getCreateTableSQL($CFG->dbtype, $CFG->prefix, true);
@@ -275,7 +277,7 @@ class test extends XMLDBAction {
        /// Get SQL code and execute it
            $test = new stdClass;
            $field = new XMLDBField('grade');
-            $field->setAttributes(XMLDB_TYPE_CHAR, '20', null, XMLDB_NOTNULL, null, null, null, 'test');
+            $field->setAttributes(XMLDB_TYPE_CHAR, '20', null, XMLDB_NOTNULL, null, null, null, "test'n drop");

            $test->sql = $table->getAlterFieldSQL($CFG->dbtype, $CFG->prefix, $field, true);
            $test->status = change_field_type($table, $field, false, false);
@@ -376,7 +378,22 @@ class test extends XMLDBAction {
            $tests['change field precision (number)'] = $test;
        }

-    /// 18th test. Change the sign of one numeric field to unsigned
+    /// 18th test. Change the precision of one integer field to a smaller one
+        if ($test->status) {
+        /// Get SQL code and execute it
+            $test = new stdClass;
+            $field = new XMLDBField('course');
+            $field->setAttributes(XMLDB_TYPE_INTEGER, '5', XMLDB_UNSIGNED, XMLDB_NOTNULL, null, null, null, '0');
+
+            $test->sql = $table->getAlterFieldSQL($CFG->dbtype, $CFG->prefix, $field, true);
+            $test->status = change_field_precision($table, $field, false, false);
+            if (!$test->status) {
+                $test->error = $db->ErrorMsg();
+            }
+            $tests['change field precision (integer) to smaller one'] = $test;
+        }
+
+    /// 19th test. Change the sign of one numeric field to unsigned
        if ($test->status) {
        /// Get SQL code and execute it
            $test = new stdClass;
@@ -391,7 +408,7 @@ class test extends XMLDBAction {
            $tests['change field sign (unsigned)'] = $test;
        }

-    /// 19th test. Change the sign of one numeric field to signed
+    /// 20th test. Change the sign of one numeric field to signed
        if ($test->status) {
        /// Get SQL code and execute it
            $test = new stdClass;
@@ -406,7 +423,7 @@ class test extends XMLDBAction {
            $tests['change field sign (signed)'] = $test;
        }

-    /// 20th test. Change the nullability of one char field to not null
+    /// 21th test. Change the nullability of one char field to not null
        if ($test->status) {
        /// Get SQL code and execute it
            $test = new stdClass;
@@ -421,7 +438,7 @@ class test extends XMLDBAction {
            $tests['change field nullability (not null)'] = $test;
        }

-    /// 21th test. Change the nullability of one char field to null
+    /// 22th test. Change the nullability of one char field to null
        if ($test->status) {
        /// Get SQL code and execute it
            $test = new stdClass;
@@ -436,7 +453,7 @@ class test extends XMLDBAction {
            $tests['change field nullability (null)'] = $test;
        }

-    /// 22th test. Dropping the default of one field
+    /// 23th test. Dropping the default of one field
        if ($test->status) {
        /// Get SQL code and execute it
            $test = new stdClass;
@@ -451,7 +468,7 @@ class test extends XMLDBAction {
            $tests['drop field default of NULL field'] = $test;
        }

-    /// 23th test. Creating the default for one field
+    /// 24th test. Creating the default for one field
        if ($test->status) {
        /// Get SQL code and execute it
            $test = new stdClass;
@@ -466,7 +483,7 @@ class test extends XMLDBAction {
            $tests['add field default of NULL field'] = $test;
        }

-    /// 24th test. Creating the default for one field
+    /// 25th test. Creating the default for one field
        if ($test->status) {
        /// Get SQL code and execute it
            $test = new stdClass;
@@ -482,7 +499,7 @@ class test extends XMLDBAction {
        }


-    /// 25th test. Dropping the default of one NOT NULL field
+    /// 26th test. Dropping the default of one NOT NULL field
        if ($test->status) {
        /// Get SQL code and execute it
            $test = new stdClass;
@@ -497,7 +514,7 @@ class test extends XMLDBAction {
            $tests['drop field default of NOT NULL field'] = $test;
        }

-    /// 26th test. Adding one unique index to the table
+    /// 27th test. Adding one unique index to the table
        if ($test->status) {
        /// Get SQL code and execute it
            $test = new stdClass;
@@ -512,7 +529,7 @@ class test extends XMLDBAction {
            $tests['add unique index'] = $test;
        }

-    /// 27th test. Adding one not unique index to the table
+    /// 28th test. Adding one not unique index to the table
        if ($test->status) {
        /// Get SQL code and execute it
            $test = new stdClass;
@@ -527,7 +544,7 @@ class test extends XMLDBAction {
            $tests['add not unique index'] = $test;
        }

-    /// 28th test. Re-add the same index than previous test. Check find_index_name() works.
+    /// 29th test. Re-add the same index than previous test. Check find_index_name() works.
        if ($test->status) {
        /// Get SQL code and execute it
            $test = new stdClass;
@@ -546,7 +563,7 @@ class test extends XMLDBAction {
            $tests['check find_index_name()'] = $test;
        }

-    /// 29th test. Dropping one index from the table
+    /// 30th test. Dropping one index from the table
        if ($test->status) {
        /// Get SQL code and execute it
            $test = new stdClass;
@@ -561,7 +578,7 @@ class test extends XMLDBAction {
            $tests['drop index'] = $test;
        }

-    /// 30th test. Adding one unique key to the table
+    /// 31th test. Adding one unique key to the table
        if ($test->status) {
        /// Get SQL code and execute it
            $test = new stdClass;
@@ -576,7 +593,7 @@ class test extends XMLDBAction {
            $tests['add unique key'] = $test;
        }

-    /// 31th test. Adding one foreign+unique key to the table
+    /// 32th test. Adding one foreign+unique key to the table
        if ($test->status) {
        /// Get SQL code and execute it
            $test = new stdClass;
@@ -591,7 +608,7 @@ class test extends XMLDBAction {
            $tests['add foreign+unique key'] = $test;
        }

-    /// 32th test. Drop one key
+    /// 33th test. Drop one key
        if ($test->status) {
        /// Get SQL code and execute it
            $test = new stdClass;
@@ -606,7 +623,7 @@ class test extends XMLDBAction {
            $tests['drop foreign+unique key'] = $test;
        }

-    /// 33th test. Adding one foreign key to the table
+    /// 34th test. Adding one foreign key to the table
        if ($test->status) {
        /// Get SQL code and execute it
            $test = new stdClass;
@@ -621,7 +638,7 @@ class test extends XMLDBAction {
            $tests['add foreign key'] = $test;
        }

-    /// 34th test. Drop one foreign key
+    /// 35th test. Drop one foreign key
        if ($test->status) {
        /// Get SQL code and execute it
            $test = new stdClass;
@@ -636,7 +653,7 @@ class test extends XMLDBAction {
            $tests['drop foreign key'] = $test;
        }

-    /// 35th test. Adding one complex enum field
+    /// 36th test. Adding one complex enum field
        if ($test->status) {
        /// Create a new field with complex specs (enums are good candidates)
            $field = new XMLDBField('type');
@@ -651,7 +668,7 @@ class test extends XMLDBAction {
            $tests['add field with enum'] = $test;
        }

-    /// 36th test. Dropping the enum of one field
+    /// 37th test. Dropping the enum of one field
        if ($test->status) {
        /// Get SQL code and execute it
            $test = new stdClass;
@@ -666,7 +683,7 @@ class test extends XMLDBAction {
            $tests['delete enumlist from one field'] = $test;
        }

-    /// 37th test. Creating the enum for one field
+    /// 38th test. Creating the enum for one field
        if ($test->status) {
        /// Get SQL code and execute it
            $test = new stdClass;
@@ -680,7 +697,7 @@ class test extends XMLDBAction {
            $tests['add enumlist to one field'] = $test;
        }

-    /// 38th test. Renaming one index
+    /// 39th test. Renaming one index
        if ($test->status) {
        /// Get SQL code and execute it
            $test = new stdClass;
@@ -695,7 +712,7 @@ class test extends XMLDBAction {
            $tests['rename index (experimental. DO NOT USE IT)'] = $test;
        }

-    /// 39th test. Renaming one key
+    /// 40th test. Renaming one key
        if ($test->status) {
        /// Get SQL code and execute it
            $test = new stdClass;
@@ -710,13 +727,13 @@ class test extends XMLDBAction {
            $tests['rename key (experimental. DO NOT USE IT)'] = $test;
        }

-    /// 40th test. Renaming one field
+    /// 41th test. Renaming one field
        if ($test->status) {
        /// Get SQL code and execute it
            $test = new stdClass;
            $field = new XMLDBField('type');
            $field->setAttributes(XMLDB_TYPE_CHAR, '20', null, XMLDB_NOTNULL, null, XMLDB_ENUM, array('single', 'news', 'general', 'social', 'eachuser', 'teacher', 'qanda'), 'general', 'course');
-            
+
            $test->sql = $table->getRenameFieldSQL($CFG->dbtype, $CFG->prefix, $field, 'newnameforthefield', true);
            $test->status = rename_field($table, $field, 'newnameforthefield', false, false);
            if (!$test->status) {
@@ -725,11 +742,11 @@ class test extends XMLDBAction {
            $tests['rename field'] = $test;
        }

-    /// 41th test. Renaming one table
+    /// 42th test. Renaming one table
        if ($test->status) {
        /// Get SQL code and execute it
            $test = new stdClass;
-            
+
            $test->sql = $table->getRenameTableSQL($CFG->dbtype, $CFG->prefix, 'newnameforthetable', true);
            $test->status = rename_table($table, 'newnameforthetable', false, false);
            if (!$test->status) {
@@ -738,7 +755,7 @@ class test extends XMLDBAction {
            $tests['rename table'] = $test;
        }

-    /// 42th test. Getting the PK sequence name for one table
+    /// 43th test. Getting the PK sequence name for one table
        if ($test->status) {
            $test = new stdClass;
            $table->setName('newnameforthetable');
@@ -753,13 +770,13 @@ class test extends XMLDBAction {
            $tests['find sequence name'] = $test;
        }

-    /// 43th test. Inserting TEXT contents
+    /// 44th test. Inserting TEXT contents
        $textlib = textlib_get_instance();
        if ($test->status) {
            $test = new stdClass;
            $test->status = false;
            $test->sql = array();
-            $basetext = '日本語 • Русский • Deutsch • English • Español • Français • Italiano • Nederlands • Polski • Português • Svenska • العربية • فارسی 한국어 • עברית • ไทย中文  Ελληνικά • Български • Српски • Українська • Bosanski • Català • Česky • Dansk • Eesti • Simple English • Esperanto • Euskara • Galego • Hrvatski • Ido • Bahasa Indonesia • Íslenska • Lëtzebuergesch • Lietuvių • Magyar • Bahasa Melayu اردو • ئۇيغۇرچه • हिन्दी • नेपाल भाषा मराठी • தமிழ் Հայերեն • Беларуская • Чăваш • Ирон æвзаг • Македонски • Сибирской говор • Afrikaans • Aragonés • Arpitan • Asturianu • Kreyòl Ayisyen • Azərbaycan • Bân-lâm-gú • Basa Banyumasan • Brezhoneg • Corsu • Cymraeg • Deitsch • Føroyskt • Frysk • Furlan • Gaeilge • Gàidhlig • Ilokano • Interlingua • Basa Jawa • Kapampangan • Kernewek • Kurdî  كوردی • Ladino  לאדינו • Latina • Latviešu • Limburgs • Lumbaart • Nedersaksisch • Nouormand • Occitan • O‘zbek • Piemontèis • Plattdüütsch • Ripoarisch • Sámegiella • Scots • Shqip • Sicilianu • Sinugboanon • Srpskohrvatski / Српскохрватски • Basa Sunda • Kiswahili • Tagalog • Tatarça • Walon • Winaray  Авар • Башҡорт • Кыргызча  Монгол • Қазақша • Тоҷикӣ • Удмурт • Armãneashce • Bamanankan • Eald Englisc • Gaelg • Interlingue • Kaszëbsczi • Kongo • Ligure • Lingála • lojban • Malagasy • Malti • Māori • Nāhuatl • Ekakairũ Naoero • Novial • Pangasinán • Tok Pisin • Romani / रोमानी • Rumantsch • Runa Simi • Sardu • Tetun • Türkmen / تركمن / Туркмен • Vèneto • Volapük • Võro • West-Vlaoms • Wollof • Zazaki • Žemaitėška';
+            $basetext = "\\ ''語 • Русский • Deutsch • English • Español • Français • Italiano • Nederlands • Polski • Português • Svenska • العربية • فارسی 한국어 • עברית • ไทย中文  Ελληνικά • Български • Српски • Українська • Bosanski • Català • Česky • Dansk • Eesti • Simple English • Esperanto • Euskara • Galego • Hrvatski • Ido • Bahasa Indonesia • Íslenska • Lëtzebuergesch • Lietuvių • Magyar • Bahasa Melayu اردو • ئۇيغۇرچه • हिन्दी • नेपाल भाषा मराठी • தமிழ் Հայերեն • Беларуская • Чăваш • Ирон æвзаг • Македонски • Сибирской говор • Afrikaans • Aragonés • Arpitan • Asturianu • Kreyòl Ayisyen • Azərbaycan • Bân-lâm-gú • Basa Banyumasan • Brezhoneg • Corsu • Cymraeg • Deitsch • Føroyskt • Frysk • Furlan • Gaeilge • Gàidhlig • Ilokano • Interlingua • Basa Jawa • Kapampangan • Kernewek • Kurdî  كوردی • Ladino  לאדינו • Latina • Latviešu • Limburgs • Lumbaart • Nedersaksisch • Nouormand • Occitan • O‘zbek • Piemontèis • Plattdüütsch • Ripoarisch • Sámegiella • Scots • Shqip • Sicilianu • Sinugboanon • Srpskohrvatski / Српскохрватски • Basa Sunda • Kiswahili • Tagalog • Tatarça • Walon • Winaray  Авар • Башҡорт • Кыргызча  Монгол • Қазақша • Тоҷикӣ • Удмурт • Armãneashce • Bamanankan • Eald Englisc • Gaelg • Interlingue • Kaszëbsczi • Kongo • Ligure • Lingála • lojban • Malagasy • Malti • Māori • Nāhuatl • Ekakairũ Naoero • Novial • Pangasinán • Tok Pisin • Romani / रोमानी • Rumantsch • Runa Simi • Sardu • Tetun • Türkmen / تركمن / Туркмен • Vèneto • Volapük • Võro • West-Vlaoms • Wollof • Zazaki • Žemaitėška";
        /// Create one big text (1.500.000 chars)
            $fulltext = '';
            for ($i=0; $i<1000; $i++) { //1500 * 1000 chars
@@ -792,7 +809,7 @@ class test extends XMLDBAction {
            $tests['insert record '. $textlen . ' cc. (text)'] = $test;
        }

-    /// 44th test. Inserting BINARY contents
+    /// 45th test. Inserting BINARY contents
        if ($test->status) {
            $test = new stdClass;
            $test->status = false;
@@ -821,7 +838,7 @@ class test extends XMLDBAction {
            $tests['insert record '. $textlen . ' bytes (binary)'] = $test;
        }

-    /// 45th test. update_record with TEXT and BINARY contents
+    /// 46th test. update_record with TEXT and BINARY contents
        if ($test->status) {
            $test = new stdClass;
            $test->status = false;
@@ -861,7 +878,7 @@ class test extends XMLDBAction {
            $tests['update record '. $textlen . ' cc. (text) and ' . $imglen . ' bytes (binary)'] = $test;
        }

-    /// 46th test. set_field with TEXT contents
+    /// 47th test. set_field with TEXT contents
        if ($test->status) {
            $test = new stdClass;
            $test->status = false;
@@ -891,7 +908,7 @@ class test extends XMLDBAction {
            $tests['set field '. $textlen . ' cc. (text)'] = $test;
        }

-    /// 47th test. set_field with BINARY contents
+    /// 48th test. set_field with BINARY contents
        if ($test->status) {
            $test = new stdClass;
            $test->status = false;
@@ -938,6 +955,20 @@ class test extends XMLDBAction {

        $this->output = $o;

+    /// Finally drop all the potentially existing test tables
+        $table = new XMLDBTable('testtable');
+        if (table_exists($table)) {
+            $status = drop_table($table, true, false);
+        }
+        $table = new XMLDBTable ('anothertest');
+        if (table_exists($table)) {
+            $status = drop_table($table, true, false);
+        }
+        $table = new XMLDBTable ('newnameforthetable');
+        if (table_exists($table)) {
+            $status = drop_table($table, true, false);
+        }
+
    /// Launch postaction if exists (leave this here!)
        if ($this->getPostAction() && $result) {
            return $this->launch($this->getPostAction());
@@ -35,6 +35,7 @@ class unload_xml_file extends XMLDBAction {
        parent::init();

    /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection

    /// Get needed strings
        $this->loadStrings(array(
--- a/Show More
+++ b/Show More