Merged from MOODLE_15_STABLE: Fix for Secunia Advisory SA18267 and test file cleanup

AdoDB tests cleanup after Secunia Advisory SA18267 and test file cleanup
Some RSS readers seems to have problems with that wrong p tag.
2006-01-03 21:04:16 +00:00 · 2006-01-03 21:03:28 +00:00 · 2005-09-07 17:09:20 +00:00 · 2005-09-05 16:17:52 +00:00 · 2005-08-30 09:30:44 +00:00 · 2005-08-11 23:53:28 +00:00
2651 changed files with 68135 additions and 58240 deletions
@@ -1,6 +1,7 @@

 <form name="adminform" id="adminform" method="post" action="admin.php">
 <input type="hidden" name="previoussearch" value="<?php echo $previoussearch ?>">
+<input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>">
  <table align="center" border="0" cellpadding="5" cellspacing="0">
    <tr>
      <td valign="top">
@@ -19,6 +19,10 @@
        error("You must be an administrator to use this page.");
    }

+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
    $primaryadmin = get_admin();

 /// If you want any administrator to have the ability to assign admin
@@ -12,10 +12,13 @@
        error("Only the admin can use this page");
    }

+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }

 /// If data submitted, then process and store.

-	if ($config = data_submitted()) {
+    if ($config = data_submitted()) {

        $config = (array)$config;
        validate_form($config, $err);
@@ -27,7 +30,7 @@
                    notify("Problem saving config $name as $value");
                }
            }
-            redirect("auth.php", get_string("changessaved"), 1);
+            redirect("auth.php?sesskey=$USER->sesskey", get_string("changessaved"), 1);
            exit;

        } else {
@@ -35,7 +38,7 @@
                $focus = "form.$key";
            }
        }
-	}
+    }

 /// Otherwise fill and print the form.

@@ -53,6 +56,7 @@
 	} else {
        $auth = $config->auth;
 	} 
+    $auth = clean_filename($auth);
    require_once("$CFG->dirroot/auth/$auth/lib.php"); //just to make sure that current authentication functions are loaded
    if (! isset($config->guestloginbutton)) {
        $config->guestloginbutton = 1;
@@ -93,9 +97,10 @@

    echo "<CENTER><P><B>";
    echo "<form TARGET=\"{$CFG->framename}\" NAME=\"authmenu\" method=\"post\" action=\"auth.php\">";
+    echo "<input type=\"hidden\" name=\"sesskey\" value=\"".$USER->sesskey."\">";
    print_string("chooseauthmethod","auth");

-	choose_from_menu ($options, "auth", $auth, "","document.location='auth.php?auth='+document.authmenu.auth.options[document.authmenu.auth.selectedIndex].value", "");
+	choose_from_menu ($options, "auth", $auth, "","document.location='auth.php?sesskey=$USER->sesskey&auth='+document.authmenu.auth.options[document.authmenu.auth.selectedIndex].value", "");

    echo "</B></P></CENTER>";
        
@@ -15,6 +15,10 @@
        error("Site isn't defined!");
    }

+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
    //Initialise error variables
    $error = false;
    $sche_destination_error = "";
@@ -73,7 +77,7 @@
        }
        if ($status) {
            //get courses
-            if ($courses = get_records("course")) {
+            if ($courses = get_records('course', '', '', '', 'id,shortname')) {
                //For each course, we check (insert, update) the backup_course table
                //with needed data
                foreach ($courses as $course) {
@@ -14,6 +14,10 @@
        error("Site isn't defined!");
    }

+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
    require_variable($_REQUEST['block']);
    $blockid = intval($_REQUEST['block']);

@@ -28,13 +32,13 @@

 /// If data submitted, then process and store.

-	if ($config = data_submitted()) {
-	    unset($config['block']); // This will always be set if we have reached this point
-	    $block->handle_config($config);
+    if ($config = data_submitted()) {
+        unset($config->block); // This will always be set if we have reached this point
+        $block->handle_config($config);
        print_header();
        redirect("$CFG->wwwroot/$CFG->admin/blocks.php", get_string("changessaved"), 1);
        exit;
-	}
+    }

 /// Otherwise print the form.

@@ -44,21 +44,21 @@

 /// If data submitted, then process and store.

-    if (!empty($_GET['hide'])) {
+    if (!empty($_GET['hide']) and confirm_sesskey()) {
        if (!$block = get_record('blocks', 'id', $_GET['hide'])) {
            error("Block doesn't exist!");
        }
        set_field('blocks', 'visible', '0', 'id', $block->id);      // Hide block
    }

-    if (!empty($_GET['show'])) {
+    if (!empty($_GET['show']) and confirm_sesskey() ) {
        if (!$block = get_record('blocks', 'id', $_GET['show'])) {
            error("Block doesn't exist!");
        }
        set_field('blocks', 'visible', '1', 'id', $block->id);      // Show block
    }

-    if (!empty($delete)) {
+    if (!empty($delete) and confirm_sesskey()) {

        if (!$block = get_record('blocks', 'id', $delete)) {
            error("Block doesn't exist!");
@@ -69,7 +69,7 @@

        if (!$_GET['confirm']) {
            notice_yesno(get_string('blockdeleteconfirm', '', $strblockname),
-                         'blocks.php?delete='.$block->id.'&amp;confirm=1',
+                         'blocks.php?delete='.$block->id.'&amp;confirm=1&sesskey='.$USER->sesskey,
                         'blocks.php');
            print_footer();
            exit;
@@ -148,21 +148,21 @@
        //$icon = "<img src=\"$modpixpath/$block->name/icon.gif\" hspace=10 height=16 width=16 border=0>";
        $blockobject = $blockobjects[$blockid];

-        $delete = '<a href="blocks.php?delete='.$blockid.'">'.$strdelete.'</a>';
+        $delete = '<a href="blocks.php?delete='.$blockid.'&sesskey='.$USER->sesskey.'">'.$strdelete.'</a>';

        $settings = ''; // By default, no configuration
        if($blockobject->has_config()) {
-            $settings = '<a href="block.php?block='.$blockid.'">'.$strsettings.'</a>';
+            $settings = '<a href="block.php?block='.$blockid.'&sesskey='.$USER->sesskey.'">'.$strsettings.'</a>';
        }

        $count = blocks_get_courses_using_block_by_id($blockid);
        $class = ''; // Nothing fancy, by default

        if ($blocks[$blockid]->visible) {
-            $visible = '<a href="blocks.php?hide='.$blockid.'" title="'.$strhide.'">'.
+            $visible = '<a href="blocks.php?hide='.$blockid.'&sesskey='.$USER->sesskey.'" title="'.$strhide.'">'.
                       '<img src="'.$pixpath.'/i/hide.gif" style="height: 16px; width: 16px;" /></a>';
        } else {
-            $visible = '<a href="blocks.php?show='.$blockid.'" title="'.$strshow.'">'.
+            $visible = '<a href="blocks.php?show='.$blockid.'&sesskey='.$USER->sesskey.'" title="'.$strshow.'">'.
                       '<img src="'.$pixpath.'/i/show.gif" style="height: 16px; width: 16px;" /></a>';
            $class = ' class="dimmed_text"'; // Leading space required!
        }
@@ -611,6 +611,7 @@

 <tr>
    <td colspan=3 align=center>
+    <input type="hidden" name="sesskey" value="<?php p($sesskey) ?>">
    <input type="submit" value="<?php print_string("savechanges") ?>"></td>
 </tr>
 </table>
@@ -3,7 +3,6 @@

    require_once("../config.php");

-
    if ($site = get_site()) {   // If false then this is a new installation
        require_login();
        if (!isadmin()) {
@@ -22,6 +21,12 @@

 	if ($config = data_submitted($match)) {  

+        if (!empty($USER->id)) {             // Additional identity check
+            if (!confirm_sesskey()) {
+                error(get_string('confirmsesskeybad', 'error'));
+            }
+        }
+
        validate_form($config, $err);

        if (count($err) == 0) {
@@ -82,6 +87,8 @@
        echo "<br />";
    }

+    $sesskey = !empty($USER->id) ? $USER->sesskey : '';
+
    print_simple_box_start("center", "", "$THEME->cellheading");
 	include("config.html");
    print_simple_box_end();
@@ -90,12 +97,14 @@

    $httpsurl = str_replace('http://', 'https://', $CFG->wwwroot);
    if ($httpsurl != $CFG->wwwroot) {
-        if ((($fh = @fopen($httpsurl, 'r')) == false) and ($config->loginhttps == 0)) {
-            echo '<script>'."\n";
-            echo '<!--'."\n";
-            echo "eval('document.form.loginhttps.disabled=true');\n";
-            echo '-->'."\n";
-            echo '</script>'."\n";
+        if (ini_get('allow_url_fopen')) {
+            if ((($fh = @fopen($httpsurl, 'r')) == false) and ($config->loginhttps == 0)) {
+                echo '<script>'."\n";
+                echo '<!--'."\n";
+                echo "eval('document.form.loginhttps.disabled=true');\n";
+                echo '-->'."\n";
+                echo '</script>'."\n";
+            }
        }
    }

@@ -110,10 +119,9 @@

 function validate_form(&$form, &$err) {

-   // if (empty($form->fullname))
-   //     $err["fullname"] = get_string("missingsitename");
+    // Currently no checks are needed ...

-    return;
+    return true;
 }


@@ -34,14 +34,14 @@
                           get_string("adminhelpmanagemodules"));
    $table->data[] = array("<b><a href=\"blocks.php\">".get_string("manageblocks")."</a></b>",
                           get_string("adminhelpmanageblocks"));
-    $table->data[] = array("<b><a href=\"filters.php\">".get_string("managefilters")."</a></b>",
+    $table->data[] = array("<b><a href=\"filters.php?sesskey=$USER->sesskey\">".get_string("managefilters")."</a></b>",
                           get_string("adminhelpmanagefilters"));
    if (!isset($CFG->disablescheduledbackups)) {
-        $table->data[] = array("<b><a href=\"backup.php\">".get_string("backup")."</a></b>",
+        $table->data[] = array("<b><a href=\"backup.php?sesskey=$USER->sesskey\">".get_string("backup")."</a></b>",
                               get_string("adminhelpbackup"));
    }

-    $table->data[]= array("<b><a href=\"editor.php\">". get_string("editorsettings") ."</a></b>",
+    $table->data[]= array("<b><a href=\"editor.php?sesskey=$USER->sesskey\">". get_string("editorsettings") ."</a></b>",
                    get_string("adminhelpeditorsettings"));

    print_table($table);
@@ -1,6 +1,7 @@

 <form name="creatorsform" id="creatorsform" method="post" action="creators.php">
 <input type="hidden" name="previoussearch" value="<?php echo $previoussearch ?>">
+<input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>">
  <table align="center" border="0" cellpadding="5" cellspacing="0">
    <tr>
      <td valign="top">
@@ -19,6 +19,10 @@
        error("You must be an administrator to use this page.");
    }

+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
    $primaryadmin = get_admin();

 /// assign all of the configurable language strings
@@ -11,9 +11,12 @@
 /// eg   wget -q -O /dev/null 'http://moodle.somewhere.edu/admin/cron.php'
 /// or   php /web/moodle/admin/cron.php 

-    $FULLME = "cron";
-
    $starttime = microtime();
+
+/// The following is a hack necessary to allow this script to work well 
+/// from the command line.
+
+    define('FULLME', 'cron');
    
 /// The current directory in PHP version 4.3.0 and above isn't necessarily the
 /// directory of the script when run from the command line. The require_once()
@@ -99,19 +102,6 @@
        }
        flush();
    
-    
-        /// Delete duplicate enrolments (don't know what causes these yet - expired sessions?)
-    
-        if ($users = get_records_select("user_students", "userid > 0 GROUP BY course, userid ".
-                                        "HAVING count(*) > 1", "", "*,count(*)")) {
-            foreach ($users as $user) {
-               delete_records_select("user_students", "userid = '$user->userid' ".
-                                     "AND course = '$user->course' AND id <> '$user->id'");
-            }
-        }
-        flush();
-    
-    
        /// Delete old logs to save space (this might need a timer to slow it down...)
    
        if (!empty($CFG->loglifetime)) {  // value in days
@@ -128,6 +118,11 @@
        }
        flush();

+        if (!empty($CFG->langcache)) {
+            get_list_of_languages();
+        }
+        flush();
+
        if (!empty($CFG->notifyloginfailures)) {
            notify_login_failures();
        }
@@ -144,7 +139,7 @@
        //Execute backup's cron
        //Perhaps a long time and memory could help in large sites
        @set_time_limit(0);
-        @ini_set("memory_limit","128M");
+        @raise_memory_limit("128M");
        if (file_exists("$CFG->dirroot/backup/backup_scheduled.php") and
            file_exists("$CFG->dirroot/backup/backuplib.php") and
            file_exists("$CFG->dirroot/backup/lib.php") and
@@ -3,31 +3,38 @@
 // Deletes the moodledata directory, COMPLETELY!!
 // BE VERY CAREFUL USING THIS!

-    require_once("../config.php");
+    require_once('../config.php');

    require_login();

+    $sure = optional_param('sure', '');
+    $reallysure = optional_param('reallysure', '');
+
    if (!isadmin()) {
-        error("You must be admin to use this script!");
+        error('You must be admin to use this script!');
    }

    $deletedir = $CFG->dataroot;   // The directory to delete!

-    if (!$sure) {
-        notice_yesno ("Are you completely sure you want to delete everything inside the directory $deletedir ?", "delete.php?sure=yes", "index.php");
+    if (empty($sure)) {
+        notice_yesno ('Are you completely sure you want to delete everything inside the directory '. $deletedir .' ?', 'delete.php?sure=yes&amp;sesskey='.set_user_sesskey(), 'index.php');
        exit;
    }

-    if (!$reallysure) {
-        notice_yesno ("Are you REALLY REALLY completely sure you want to delete everything inside the directory $deletedir (this includes all user images, and any other course files that have been created) ?", "delete.php?sure=yes&reallysure=yes", "index.php");
+    if (empty($reallysure)) {
+        notice_yesno ('Are you REALLY REALLY completely sure you want to delete everything inside the directory '. $deletedir .' (this includes all user images, and any other course files that have been created) ?', 'delete.php?sure=yes&amp;reallysure=yes&amp;sesskey='.set_user_sesskey(), 'index.php');
        exit;
    }

+    if (!confirm_sesskey()) {
+        error('This script was called wrongly');
+    }
+
    /// OK, here goes ...

    delete_subdirectories($deletedir);

-    echo "<H1 align=center>Done!</H1>";
+    echo '<h1 align="center">Done!</h1>';
    print_continue($CFG->wwwroot);
    exit;

@@ -37,22 +44,22 @@ function delete_subdirectories($rootdir) {
    $dir = opendir($rootdir);

    while ($file = readdir($dir)) {
-        if ($file != "." and $file != "..") {
-            $fullfile = "$rootdir/$file";
-            if (filetype($fullfile) == "dir") {
+        if ($file != '.' and $file != '..') {
+            $fullfile = $rootdir .'/'. $file;
+            if (filetype($fullfile) == 'dir') {
                delete_subdirectories($fullfile);
-                echo "Deleting $fullfile ... ";
+                echo 'Deleting '. $fullfile .' ... ';
                if (rmdir($fullfile)) {
-                    echo "Done.<BR>";
+                    echo 'Done.<br />';
                } else {
-                    echo "FAILED.<BR>";
+                    echo 'FAILED.<br />';
                }
            } else {
-                echo "Deleting $fullfile ... ";
-                if (unlink("$fullfile")) {
-                    echo "Done.<BR>";
+                echo 'Deleting '. $fullfile .' ... ';
+                if (unlink($fullfile)) {
+                    echo 'Done.<br />';
                } else {
-                    echo "FAILED.<BR>";
+                    echo 'FAILED.<br />';
                }
            }
        }
@@ -1,4 +1,5 @@
-<form method="post" action="<?php print($GLOBALS['ME']);?>">
+<form method="post" action="editor.php">
+<input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>">
 <table border="0" cellpadding="4" cellspacing="2">
 <tr valign=top>
    <td align=right><p>htmleditor:</td>
@@ -76,6 +77,7 @@
 </form>

 <form method="post" action="<?php print($GLOBALS['ME']);?>">
+<input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>">
 <center>
 <input type="submit" name="resettodefaults" value="<?php print_string('editorresettodefaults') ?>" />
 </center>
@@ -8,6 +8,10 @@
        error("Only admins can access this page");
    }

+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
    if ($data = data_submitted()) {

        // do we want default values?
@@ -21,7 +25,7 @@
                error("Editor settings could not be updated!");
            }
        }
-        redirect("$CFG->wwwroot/$CFG->admin/editor.php", get_string("changessaved"), 1);
+        redirect("$CFG->wwwroot/$CFG->admin/editor.php?sesskey=$USER->sesskey", get_string("changessaved"), 1);

    } else {
        // Generate edit form
@@ -3,8 +3,10 @@
       //             Yes, enrol is correct English spelling.

    include("../config.php");
+
+    $enrol = optional_param('enrol', $CFG->enrol);
+
    require_login();
-    optional_variable($enrol, $CFG->enrol);

    if (!$site = get_site()) {
        redirect("index.php");
@@ -14,6 +16,11 @@
        error("Only the admin can use this page");
    }

+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
+    $enrol = clean_filename($enrol);
    require_once("$CFG->dirroot/enrol/$enrol/enrol.php");   /// Open the class

    $enrolment = new enrolment_plugin();
@@ -24,7 +31,7 @@
 	if ($frm = data_submitted()) {
        if ($enrolment->process_config($frm)) {
            set_config('enrol', $frm->enrol);
-            redirect("enrol.php", get_string("changessaved"), 1);
+            redirect("enrol.php?sesskey=$USER->sesskey", get_string("changessaved"), 1);
        }
 	} else {
        $frm = $CFG;
@@ -47,13 +54,14 @@
                   <a href=\"users.php\">$str->users</a> -> $str->enrolments");

    echo "<form target=\"{$CFG->framename}\" name=\"enrolmenu\" method=\"post\" action=\"enrol.php\">";
+    echo "<input type=\"hidden\" name=\"sesskey\" value=\"".$USER->sesskey."\">";
    echo "<div align=\"center\"><p><b>";


 /// Choose an enrolment method
    echo get_string('chooseenrolmethod').': ';
 	choose_from_menu ($options, "enrol", $enrol, "",
-                      "document.location='enrol.php?enrol='+document.enrolmenu.enrol.options[document.enrolmenu.enrol.selectedIndex].value", "");
+                      "document.location='enrol.php?sesskey=$USER->sesskey&enrol='+document.enrolmenu.enrol.options[document.enrolmenu.enrol.selectedIndex].value", "");

    echo "</b></p></div>";
    
@@ -1,6 +1,7 @@
 <?php print_simple_box_start("center", "", "$THEME->cellheading"); ?>

 <form name="filters" id="filters" method="post" action="filters.php">
+<input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>">
  <table align="center" border="0" cellpadding="5" cellspacing="0">
    <tr>
      <td valign="top"><div align="right">
@@ -80,6 +81,7 @@
 <?php print_simple_box_start("center", "", "$THEME->cellheading"); ?>

 <form name="options" id="options" method="post" action="filters.php">
+<input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>">
 <input type="hidden" name="options" value="1">
 <table cellpadding="20">
 <tr valign=top>
@@ -16,6 +16,10 @@
        error("Only administrators can use this page!");
    }

+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
    if (!$site = get_site()) {
        error("Site isn't defined!");
    }
@@ -249,7 +249,6 @@
        error("You need to be an admin user to use this page.", "$CFG->wwwroot/login/index.php");
    }

-
 /// At this point everything is set up and the user is an admin, so print menu

    $stradministration = get_string("administration");
@@ -263,6 +262,12 @@
        print_spacer(10,10);
    }

+/// If no recently cron run
+    $lastcron = get_field_sql('SELECT max(lastcron) FROM ' . $CFG->prefix . 'modules');
+    if (time() - $lastcron > 3600 * 24) {
+        print_simple_box(get_string('cronwarning', 'admin') , 'center');
+    }
+
    $table->tablealign = "right";
    $table->align = array ("right", "left");
    $table->wrap = array ("nowrap", "nowrap");
@@ -282,46 +287,46 @@
                    get_string("adminhelpmanagemodules")."</font><br />";
    $configdata .= "<font size=+1>&nbsp;</font><a href=\"blocks.php\">".get_string("manageblocks")."</a> - <font size=1>".
                    get_string("adminhelpmanageblocks")."</font><br />";
-    $configdata .= "<font size=+1>&nbsp;</font><a href=\"filters.php\">".get_string("managefilters")."</a> - <font size=1>".
+    $configdata .= "<font size=+1>&nbsp;</font><a href=\"filters.php?sesskey=$USER->sesskey\">".get_string("managefilters")."</a> - <font size=1>".
                    get_string("adminhelpmanagefilters")."</font><br />";
    if (!isset($CFG->disablescheduledbackups)) {
-        $configdata .= "<font size=+1>&nbsp;</font><a href=\"backup.php\">".get_string("backup")."</a> - <font size=1>".
+        $configdata .= "<font size=+1>&nbsp;</font><a href=\"backup.php?sesskey=$USER->sesskey\">".get_string("backup")."</a> - <font size=1>".
                        get_string("adminhelpbackup")."</font><br />";
    }
-    $configdata .= "<font size=+1>&nbsp;</font><a href=\"editor.php\">". get_string("editorsettings") ."</a> - <font size=1>".
+    $configdata .= "<font size=+1>&nbsp;</font><a href=\"editor.php?sesskey=$USER->sesskey\">". get_string("editorsettings") ."</a> - <font size=1>".
                    get_string("adminhelpeditorsettings")."</font><br />";

    $table->data[] = array("<font size=+1><b><a href=\"configure.php\">".get_string("configuration")."</a></b>", 
                            $configdata);


-    $userdata = "<font size=+1>&nbsp;</font><a href=\"auth.php\">".get_string("authentication")."</a> - <font size=1>".
+    $userdata = "<font size=+1>&nbsp;</font><a href=\"auth.php?sesskey=$USER->sesskey\">".get_string("authentication")."</a> - <font size=1>".
                 get_string("adminhelpauthentication")."</font><br />";
    $userdata .= "<font size=+1>&nbsp;</font><a href=\"user.php\">".get_string("edituser")."</a> - <font size=1>".
                 get_string("adminhelpedituser")."</font><br />";
-    $userdata .= "<font size=+1>&nbsp;</font><a href=\"$CFG->wwwroot/$CFG->admin/user.php?newuser=true\">".
+    $userdata .= "<font size=+1>&nbsp;</font><a href=\"$CFG->wwwroot/$CFG->admin/user.php?newuser=true&sesskey=$USER->sesskey\">".
                 get_string("addnewuser")."</a> - <font size=1>".
                 get_string("adminhelpaddnewuser")."</font><br />";
-    $userdata .= "<font size=+1>&nbsp;</font><a href=\"$CFG->wwwroot/$CFG->admin/uploaduser.php\">".
+    $userdata .= "<font size=+1>&nbsp;</font><a href=\"$CFG->wwwroot/$CFG->admin/uploaduser.php?sesskey=$USER->sesskey\">".
                 get_string("uploadusers")."</a> - <font size=1>".
                 get_string("adminhelpuploadusers")."</font><br />";

-    $userdata .= "<hr><font size=+1>&nbsp;</font><a href=\"enrol.php\">".get_string("enrolments")."</a> - <font size=1>".
+    $userdata .= "<hr><font size=+1>&nbsp;</font><a href=\"enrol.php?sesskey=$USER->sesskey\">".get_string("enrolments")."</a> - <font size=1>".
                 get_string("adminhelpenrolments")."</font><br />";
-    $userdata .= "<font size=+1>&nbsp;</font><a href=\"../course/index.php?edit=off\">".get_string("assignstudents")."</a> - <font size=1>".
+    $userdata .= "<font size=+1>&nbsp;</font><a href=\"../course/index.php?edit=off&sesskey=$USER->sesskey\">".get_string("assignstudents")."</a> - <font size=1>".
                 get_string("adminhelpassignstudents")."</font><br />";

-    $userdata .= "<font size=+1>&nbsp;</font><a href=\"../course/index.php?edit=on\">".get_string("assignteachers")."</a> - <font size=1>".
+    $userdata .= "<font size=+1>&nbsp;</font><a href=\"../course/index.php?edit=on&sesskey=$USER->sesskey\">".get_string("assignteachers")."</a> - <font size=1>".
                 get_string("adminhelpassignteachers").
                 " <img src=\"../pix/t/user.gif\" height=11 width=11></font><br />";
-    $userdata .= "<font size=+1>&nbsp;</font><a href=\"creators.php\">".get_string("assigncreators")."</a> - <font size=1>".
+    $userdata .= "<font size=+1>&nbsp;</font><a href=\"creators.php?sesskey=$USER->sesskey\">".get_string("assigncreators")."</a> - <font size=1>".
                 get_string("adminhelpassigncreators")."</font><br />";
-    $userdata .= "<font size=+1>&nbsp;</font><a href=\"admin.php\">".get_string("assignadmins")."</a> - <font size=1>".
+    $userdata .= "<font size=+1>&nbsp;</font><a href=\"admin.php?sesskey=$USER->sesskey\">".get_string("assignadmins")."</a> - <font size=1>".
                 get_string("adminhelpassignadmins")."</font><br />";

    $table->data[] = array("<font size=+1><b><a href=\"users.php\">".get_string("users")."</a></b>", $userdata);

-    $table->data[] = array("<font size=+1><b><a href=\"../course/index.php?edit=on\">".get_string("courses")."</a></b>",
+    $table->data[] = array("<font size=+1><b><a href=\"../course/index.php?edit=on&sesskey=$USER->sesskey\">".get_string("courses")."</a></b>",
                           "<font size=+1>&nbsp;</font>".get_string("adminhelpcourses"));
    $table->data[] = array("<font size=+1><b><a href=\"../course/log.php?id=$site->id\">".get_string("logs")."</a></b>",
                           "<font size=+1>&nbsp;</font>".get_string("adminhelplogs"));
@@ -354,7 +359,8 @@
    echo "</td>";

    echo "<td align=center width=33%>";
-    print_single_button("register.php", NULL, get_string("registration"));
+    $options['sesskey'] = $USER->sesskey;
+    print_single_button("register.php", $options, get_string("registration"));
    echo "</td>";
    echo "<tr></table>";

@@ -27,15 +27,17 @@
        case "missing":
            $navigation = "<A HREF=\"lang.php\">$strlanguage</A> -> $strmissingstrings";
            $title = $strmissingstrings;
-            $button = '<form target="'.$CFG->framename.'" method="get" action="'.$CFG->wwwroot.'/admin/lang.php">'.
+            $button = '<form target="'.$CFG->framename.'" method="get" action="'.$CFG->wwwroot.'/'.$CFG->admin.'/lang.php">'.
                      '<input type="hidden" name="mode" value="compare" />'.
+                      '<input type="hidden" name="sesskey" value="'.$USER->sesskey.'" />'.
                      '<input type="submit" value="'.$strcomparelanguage.'" /></form>';
            break;
        case "compare":
            $navigation = "<A HREF=\"lang.php\">$strlanguage</A> -> $strcomparelanguage";
            $title = $strcomparelanguage;
-            $button = '<form target="'.$CFG->framename.'" method="get" action="'.$CFG->wwwroot.'/admin/lang.php">'.
+            $button = '<form target="'.$CFG->framename.'" method="get" action="'.$CFG->wwwroot.'/'.$CFG->admin.'/lang.php">'.
                      '<input type="hidden" name="mode" value="missing" />'.
+                      '<input type="hidden" name="sesskey" value="'.$USER->sesskey.'" />'.
                      '<input type="submit" value="'.$strmissingstrings.'" /></form>';
            break;
        default:
@@ -58,10 +60,10 @@
        echo "<table align=center><tr><td align=\"right\">";
        echo "<b>$strcurrentlanguage:</b>";
        echo "</td><td>";
-        echo popup_form ("$CFG->wwwroot/admin/lang.php?lang=", $langs, "chooselang", $currlang, "", "", "", true);
+        echo popup_form ("$CFG->wwwroot/$CFG->admin/lang.php?lang=", $langs, "chooselang", $currlang, "", "", "", true);
        echo "</td></tr></table>";
-        print_heading("<a href=\"lang.php?mode=missing\">$strmissingstrings</a>");
-        print_heading("<a href=\"lang.php?mode=compare\">$strcomparelanguage</a>");
+        print_heading("<a href=\"lang.php?mode=missing&sesskey=$USER->sesskey\">$strmissingstrings</a>");
+        print_heading("<a href=\"lang.php?mode=compare&sesskey=$USER->sesskey\">$strcomparelanguage</a>");
        echo "<center><hr noshade size=1>";
        $options["lang"] = $currentlang;
        print_single_button("http://moodle.org/download/lang/", $options, get_string("latestlanguagepack"));
@@ -85,7 +87,7 @@
        }
    }

-    if ($mode == "missing") {
+    if ($mode == "missing" and confirm_sesskey()) {
        // For each file, check that a counterpart exists, then check all the strings
    
        foreach ($stringfiles as $file) {
@@ -151,7 +153,7 @@
            notice(get_string("languagegood"), "lang.php");
        }

-    } else if ($mode == "compare") {
+    } else if ($mode == "compare" and confirm_sesskey()) {

        if (isset($_POST['currentfile'])){   // Save a file
            $newstrings = $_POST;
@@ -159,7 +161,7 @@
            if (lang_save_file($langdir, $currentfile, $newstrings)) {
                notify(get_string("changessaved")." ($langdir/$currentfile)", "green");
            } else {
-                error("Could not save the file '$currentfile'!", "lang.php?mode=compare&currentfile=$currentfile");
+                error("Could not save the file '$currentfile'!", "lang.php?mode=compare&currentfile=$currentfile&sesskey=$USER->sesskey");
            }
        }

@@ -171,7 +173,7 @@
            if ($file == $currentfile) {
                echo "<b>$file</b> &nbsp; ";
            } else {
-                echo "<a href=\"lang.php?mode=compare&currentfile=$file\">$file</a> &nbsp; ";
+                echo "<a href=\"lang.php?mode=compare&currentfile=$file&sesskey=$USER->sesskey\">$file</a> &nbsp; ";
            }
        }
        echo '</font></center>';
@@ -201,7 +203,7 @@
        unset($string);
        include("$enlangdir/$currentfile");
        $enstring = $string;  
-        if ($currentlang != 'en') {
+        if ($currentlang != 'en' and $currentfile == 'moodle.php') {
            $enstring['thislanguage'] = "<< TRANSLATORS: Specify the name of your language here.  If possible use Unicode Numeric Character References >>";
            $enstring['thischarset'] = "<< TRANSLATORS: Specify the character set of your language here. Note that all text created while this language is active will be stored using this character set, so don't change it once you have set it. Example: iso-8859-1 >>";
            $enstring['thisdirection'] = "<< TRANSLATORS: This string specifies the direction of your text, either left-to-right or right-to-left.  Insert either 'ltr' or 'rtl' here. >>";
@@ -214,6 +216,7 @@

        if ($editable) {
            echo "<form name=\"$currentfile\" action=\"lang.php\" method=\"post\">";
+            echo '<input type="hidden" name="sesskey" value="'.$USER->sesskey.'" />';
        }
        echo "<table width=\"100%\" cellpadding=2 cellspacing=3 border=0>";
        foreach ($enstring as $key => $envalue) {
@@ -13,6 +13,9 @@
        error("Site isn't defined!");
    }

+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }

 /// If data submitted, then process and store.

@@ -29,6 +32,7 @@

    require_variable($module);

+    $module = clean_filename($module);
 	require_once("$CFG->dirroot/mod/$module/lib.php");


@@ -42,7 +42,7 @@

 /// If data submitted, then process and store.

-    if (!empty($hide)) {
+    if (!empty($hide) and confirm_sesskey()) {
        if (!$module = get_record("modules", "name", $hide)) {
            error("Module doesn't exist!");
        }
@@ -50,7 +50,7 @@
        set_field("course_modules", "visible", "0", "module", $module->id); // Hide all related activity modules
    }

-    if (!empty($show)) {
+    if (!empty($show) and confirm_sesskey()) {
        if (!$module = get_record("modules", "name", $show)) {
            error("Module doesn't exist!");
        }
@@ -58,13 +58,13 @@
        set_field("course_modules", "visible", "1", "module", $module->id); // Show all related activity modules
    }

-    if (!empty($delete)) {
+    if (!empty($delete) and confirm_sesskey()) {
      
        $strmodulename = get_string("modulename", "$delete");

        if (empty($confirm)) {
            notice_yesno(get_string("moduledeleteconfirm", "", $strmodulename), 
-                         "modules.php?delete=$delete&confirm=$delete", 
+                         "modules.php?delete=$delete&confirm=$delete&sesskey=$USER->sesskey", 
                         "modules.php");
            print_footer();
            exit;
@@ -162,10 +162,10 @@

        $icon = "<img src=\"$modpixpath/$module->name/icon.gif\" hspace=10 height=16 width=16 border=0>";

-        $delete = "<a href=\"modules.php?delete=$module->name\">$strdelete</a>";
+        $delete = "<a href=\"modules.php?delete=$module->name&sesskey=$USER->sesskey\">$strdelete</a>";

        if (file_exists("$CFG->dirroot/mod/$module->name/config.html")) {
-            $settings = "<a href=\"module.php?module=$module->name\">$strsettings</a>";
+            $settings = "<a href=\"module.php?module=$module->name&sesskey=$USER->sesskey\">$strsettings</a>";
        } else {
            $settings = "";
        }
@@ -173,11 +173,11 @@
        $count = count_records("$module->name");

        if ($module->visible) {
-            $visible = "<a href=\"modules.php?hide=$module->name\" title=\"$strhide\">".
+            $visible = "<a href=\"modules.php?hide=$module->name&sesskey=$USER->sesskey\" title=\"$strhide\">".
                       "<img src=\"$pixpath/i/hide.gif\" align=\"absmiddle\" height=16 width=16 border=0></a>";
            $class = "";
        } else {
-            $visible = "<a href=\"modules.php?show=$module->name\" title=\"$strshow\">".
+            $visible = "<a href=\"modules.php?show=$module->name&sesskey=$USER->sesskey\" title=\"$strshow\">".
                       "<img src=\"$pixpath/i/show.gif\" align=\"absmiddle\" height=16 width=16 border=0></a>";
            $class = "class=\"dimmed_text\"";
        }
@@ -13,6 +13,10 @@
        redirect("index.php");
    }

+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
    if (!$admin = get_admin()) {
        error("No admins");
    }
@@ -21,12 +25,8 @@
        $admin->country = $CFG->country;
    }

-    if (!$admin->secret) {    // secret field hasn't been set yet
-        $admin->secret = random_string(15);
-    
-        if (!set_field("user", "secret", $admin->secret, "id", $admin->id)) {
-            error("Could not set admin's secret string!");
-        }
+    if (empty($CFG->siteidentifier)) {    // Unique site identification code
+        set_config('siteidentifier', random_string(32));
    }


@@ -39,7 +39,7 @@
 	print_header("$site->shortname: $strregistration", "$site->fullname", 
                 "<a href=\"../$CFG->admin/index.php\">$stradministration</a> -> $strregistration");

-    print_heading($strmanagemodules);
+    print_heading($strregistration);

    print_simple_box($strregistrationinfo, "center", "70%");
    echo "<br />";
@@ -60,7 +60,7 @@
    echo "<!-- is flagged as a new entry and will be manually checked by the list maintainer -->\n";
   
    echo "<input type=\"hidden\" name=\"url\" value=\"$CFG->wwwroot\">\n";
-    echo "<input type=\"hidden\" name=\"secret\" value=\"$admin->secret\">\n";
+    echo "<input type=\"hidden\" name=\"secret\" value=\"$CFG->siteidentifier\">\n";
    echo "<input type=\"hidden\" name=\"host\" value=\"".$_SERVER["HTTP_HOST"]."\">\n";
    echo "<input type=\"hidden\" name=\"lang\" value=\"".current_language()."\">\n";
    echo "</td></tr>\n";
@@ -1,4 +1,4 @@
-<form method="post" action="site.php" name="form" <?php echo $onsubmit ?>>
+<form method="post" action="site.php" name="form">
 <table cellpadding=9 cellspacing=0 >
 <tr valign=top>
    <td align=right><P><?php print_string("fullsitename") ?>:</td>
@@ -111,10 +111,5 @@
 <input type="hidden" name="id" value="<?php p($form->id) ?>">
 <input type="hidden" name="category" value="<?php p($form->category) ?>">
 <input type="hidden" name="format" value="<?php p($form->format) ?>">
+<input type="hidden" name="sesskey" value="<?php p($sesskey) ?>">
 </form>
-
-<?php 
-   if ($usehtmleditor) { 
-       print_richedit_javascript("form", "summary", "no");
-   }
-?>
@@ -14,6 +14,12 @@

 	if ($form = data_submitted()) {

+        if (!empty($USER->id)) {             // Additional identity check
+            if (!confirm_sesskey()) {
+                error(get_string('confirmsesskeybad', 'error'));
+            }
+        }
+
        validate_form($form, $err);

        if (count($err) == 0) {
@@ -108,17 +114,23 @@
        print_heading($strsitesettings);
    }

-    $defaultformat = FORMAT_HTML;
-    if ($usehtmleditor = can_use_richtext_editor()) {
-        $onsubmit = "onsubmit=\"copyrichtext(form.summary);\"";
+    if (empty($USER->id)) {  // New undefined admin user
+        $USER->htmleditor = true;
+        $sesskey = '';
    } else {
-        $onsubmit = "";
+        $sesskey = $USER->sesskey;
    }
+    $usehtmleditor = can_use_html_editor();
+    $defaultformat = FORMAT_HTML;

    print_simple_box_start("center", "", "$THEME->cellheading");
    include("site.html");
    print_simple_box_end();

+    if ($usehtmleditor) { 
+        use_html_editor();
+    }
+
    if (!$firsttime) {
        print_footer();
    }
@@ -17,7 +17,7 @@

    print_heading("");

-    if (isset($zone)) {
+    if (isset($zone) and confirm_sesskey()) {
        $db->debug = true;
        echo "<center>";
        execute_sql("UPDATE {$CFG->prefix}user SET timezone = '$zone'");
@@ -47,11 +47,12 @@
        }
    }

-    echo "<center><form action=timezone.php method=get>";
+    echo '<center><form action="timezone.php" method="get">';
    echo "$strusers ($strall): ";
    choose_from_menu ($timezones, "zone", $user->timezone, get_string("serverlocaltime"), "", "99");
-    echo "<input type=submit value=\"$strsavechanges\">";
-    echo "</form>";
+    echo "<input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\">";
+    echo "<input type=\"submit\" value=\"$strsavechanges\">";
+    echo "</form></center>";

    print_footer();

@@ -33,10 +33,12 @@

    if (empty($_GET['confirm'])) {
        notice_yesno(get_string("upgradelogsinfo", "admin"), 
-                     "upgradelogs.php?confirm=true", 
+                     "upgradelogs.php?confirm=true&sesskey=$USER->sesskey", 
                     "index.php");
        print_footer();
        exit;
+    } else if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
    }


@@ -17,6 +17,10 @@
        error("Could not find site-level course");
    }

+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
    if (!$adminuser = get_admin()) {
        error("Could not find site admin");
    }
@@ -105,7 +109,7 @@
        foreach ($header as $i => $h) {
            $h = trim($h); $header[$i] = $h; // remove whitespace
            if (!($required[$h] or $optionalDefaults[$h] or $optional[$h])) {
-                error(get_string('invalidfieldname', 'error', $h), 'uploaduser.php');
+                error(get_string('invalidfieldname', 'error', $h), 'uploaduser.php?sesskey='.$USER->sesskey);
            }
            if ($required[$h]) {
                $required[$h] = 2;
@@ -114,7 +118,7 @@
        // check for required fields
        foreach ($required as $key => $value) {
            if ($value < 2) {
-                error(get_string('fieldrequired', 'error', $key), 'uploaduser.php');
+                error(get_string('fieldrequired', 'error', $key), 'uploaduser.php?sesskey='.$USER->sesskey);
            }
        }
        $linenum = 2; // since header is line 1
@@ -139,13 +143,17 @@
                    // check for required values
                    if ($required[$name] and !$value) {
                        error(get_string('missingfield', 'error', $name). " ".
-                              get_string('erroronline', 'error', $linenum), 
-                              'uploaduser.php');
+                              get_string('erroronline', 'error', $linenum) .". ".
+                              get_string('processingstops', 'error'), 
+                              'uploaduser.php?sesskey='.$USER->sesskey);
                    }
                    // password needs to be encrypted
                    else if ($name == "password") {
                        $user->password = md5($value);
                    }
+                    else if ($name == "username") {
+                        $user->username = addslashes(moodle_strtolower($value));
+                    }
                    // normal entry
                    else {
                        $user->{$name} = addslashes($value);
@@ -166,7 +174,7 @@
                $addgroup[2] = $user->group3;
                $addgroup[3] = $user->group4;
                $addgroup[4] = $user->group5;
-                $courses = get_courses("all");
+                $courses = get_courses("all",'c.sortorder','c.id,c.shortname,c.fullname,c.sortorder');
                for ($i=0; $i<5; $i++) {
                    $courseid[$i]=0;
                }
@@ -177,7 +185,7 @@
                        }
                    }
                }
-                if (! $user->id = insert_record("user", $user)) {
+                if (get_record("user","username",$username) || !($user->id = insert_record("user", $user))) {
                    if (!$user = get_record("user", "username", "changeme")) {   // half finished user from another time
                        //Record not added - probably because user is already registered
                        //In this case, output userid from previous registration
@@ -258,6 +266,7 @@
    echo '<center>';
    echo '<form method="post" enctype="multipart/form-data" action="uploaduser.php">'.
         $strchoose.':<input type="hidden" name="MAX_FILE_SIZE" value="'.$maxuploadsize.'">'.
+         '<input type="hidden" name="sesskey" value="'.$USER->sesskey.'">'.
         '<input type="file" name="userfile" size=30>'.
         '<input type="submit" value="'.$struploadusers.'">'.
         '</form></br>';
@@ -10,6 +10,9 @@
    optional_variable($dir, "ASC");
    optional_variable($page, 0);
    optional_variable($search, "");
+    if (!empty($search)) {
+        $search=trim($search);
+    }
    optional_variable($lastinitial, "");     // only show students with this last initial
    optional_variable($firstinitial, "");    // only show students with this first initial
    optional_variable($perpage, "30");       // how many per page
@@ -18,6 +21,8 @@
    unset($admin);
    unset($teacher);

+    $search = trim($search);
+
    if (! record_exists("user_admins")) {   // No admin user yet

        $user->firstname = get_string("admin");
@@ -61,6 +66,7 @@
        $USER->admin = true;
        $USER->teacher["$site->id"] = true;
        $USER->newadminuser = true;
+        set_user_sesskey(); // for added security, used to check script parameters

        redirect("$CFG->wwwroot/user/edit.php?id=$user->id&course=$site->id");
        exit;
@@ -77,7 +83,7 @@
        error("You must be an administrator to edit users this way.");
    }

-    if ($newuser) {                 // Create a new user
+    if ($newuser and confirm_sesskey()) {                 // Create a new user
        $user->auth      = "manual";
        $user->firstname = "";
        $user->lastname  = "";
@@ -118,7 +124,7 @@
                         "<a href=\"users.php\">$strusers</a> -> $stredituser");
        }

-        if ($confirmuser) {
+        if ($confirmuser and confirm_sesskey()) {
            if (!$user = get_record("user", "id", "$confirmuser")) {
                error("No such user!");
            }
@@ -134,7 +140,7 @@
                notify(get_string("usernotconfirmed", "", fullname($user, true)));
            }

-        } else if ($delete) {              // Delete a selected user, after confirmation
+        } else if ($delete and confirm_sesskey()) {              // Delete a selected user, after confirmation
            if (!$user = get_record("user", "id", "$delete")) {
                error("No such user!");
            }
@@ -147,7 +153,7 @@
            if ($confirm != md5($delete)) {
                $fullname = fullname($user, true);
                notice_yesno(get_string("deletecheckfull", "", "'$fullname'"),
-                     "user.php?delete=$delete&confirm=".md5($delete), "user.php");
+                     "user.php?delete=$delete&confirm=".md5($delete)."&sesskey=$USER->sesskey", "user.php");

                exit;
            } else if (!$user->deleted) {
@@ -300,7 +306,7 @@
                if ($user->id == $USER->id or $user->username == "changeme") {
                    $deletebutton = "";
                } else {
-                    $deletebutton = "<a href=\"user.php?delete=$user->id\">$strdelete</a>";
+                    $deletebutton = "<a href=\"user.php?delete=$user->id&sesskey=$USER->sesskey\">$strdelete</a>";
                }
                if ($user->lastaccess) {
                    $strlastaccess = format_time(time() - $user->lastaccess);
@@ -308,7 +314,7 @@
                    $strlastaccess = get_string("never");
                }
                if ($user->confirmed == 0) {
-                    $confirmbutton = "<a href=\"user.php?confirmuser=$user->id\">" . get_string("confirm") . "</a>";
+                    $confirmbutton = "<a href=\"user.php?confirmuser=$user->id&sesskey=$USER->sesskey\">" . get_string("confirm") . "</a>";
                } else {
                    $confirmbutton = "";
                }
@@ -333,7 +339,7 @@
            echo "</form>";    
            echo "</td></tr></table>";
            if (is_internal_auth()){
-                print_heading("<a href=\"user.php?newuser=true\">".get_string("addnewuser")."</a>");
+                print_heading("<a href=\"user.php?newuser=true&sesskey=$USER->sesskey\">".get_string("addnewuser")."</a>");
            }

            print_table($table);
@@ -345,7 +351,7 @@
        }

        if (is_internal_auth()){
-            print_heading("<a href=\"user.php?newuser=true\">".get_string("addnewuser")."</a>");
+            print_heading("<a href=\"user.php?newuser=true&sesskey=$USER->sesskey\">".get_string("addnewuser")."</a>");
        }

        print_footer();
@@ -22,27 +22,27 @@

    $table->align = array ("right", "left");

-    $table->data[] = array("<b><a href=\"auth.php\">".get_string("authentication")."</a></b>",
+    $table->data[] = array("<b><a href=\"auth.php?sesskey=$USER->sesskey\">".get_string("authentication")."</a></b>",
                           get_string("adminhelpauthentication"));

    $table->data[] = array("<b><a href=\"user.php\">".get_string("edituser")."</a></b>",
                           get_string("adminhelpedituser"));
    if (is_internal_auth()) {
-        $table->data[] = array("<b><a href=\"$CFG->wwwroot/$CFG->admin/user.php?newuser=true\">".get_string("addnewuser")."</a></b>",
+        $table->data[] = array("<b><a href=\"$CFG->wwwroot/$CFG->admin/user.php?newuser=true&sesskey=$USER->sesskey\">".get_string("addnewuser")."</a></b>",
                               get_string("adminhelpaddnewuser"));
-        $table->data[] = array("<b><a href=\"$CFG->wwwroot/$CFG->admin/uploaduser.php\">".get_string("uploadusers")."</a></b>",
+        $table->data[] = array("<b><a href=\"$CFG->wwwroot/$CFG->admin/uploaduser.php?sesskey=$USER->sesskey\">".get_string("uploadusers")."</a></b>",
                               get_string("adminhelpuploadusers"));
    }
    $table->data[] = array('', '<hr />');
-    $table->data[] = array("<b><a href=\"enrol.php\">".get_string("enrolments")."</a></b>",
+    $table->data[] = array("<b><a href=\"enrol.php?sesskey=$USER->sesskey\">".get_string("enrolments")."</a></b>",
                           get_string("adminhelpenrolments"));
-    $table->data[] = array("<b><a href=\"../course/index.php?edit=off\">".get_string("assignstudents")."</a></b>",
+    $table->data[] = array("<b><a href=\"../course/index.php?edit=off&sesskey=$USER->sesskey\">".get_string("assignstudents")."</a></b>",
                           get_string("adminhelpassignstudents"));
-    $table->data[] = array("<b><a href=\"../course/index.php?edit=on\">".get_string("assignteachers")."</a></b>",
+    $table->data[] = array("<b><a href=\"../course/index.php?edit=on&sesskey=$USER->sesskey\">".get_string("assignteachers")."</a></b>",
                           get_string("adminhelpassignteachers")." <img src=\"../pix/t/user.gif\" height=11 width=11>");
-    $table->data[] = array("<b><a href=\"creators.php\">".get_string("assigncreators")."</a></b>",
+    $table->data[] = array("<b><a href=\"creators.php?sesskey=$USER->sesskey\">".get_string("assigncreators")."</a></b>",
                           get_string("adminhelpassigncreators"));
-    $table->data[] = array("<b><a href=\"admin.php\">".get_string("assignadmins")."</a></b>",
+    $table->data[] = array("<b><a href=\"admin.php?sesskey=$USER->sesskey\">".get_string("assignadmins")."</a></b>",
                           get_string("adminhelpassignadmins"));

    print_table($table);
@@ -12,7 +12,9 @@ function auth_user_login ($username, $password) {
    // two databases of the same kind ... it seems to get confused when trying to access
    // the first database again, after having accessed the second.
    // The following hack will make the database explicit which keeps it happy
-    $CFG->prefix = "$CFG->dbname.$CFG->prefix";
+    if ($CFG->dbtype != 'postgres7') {
+       $CFG->prefix = "$CFG->dbname.$CFG->prefix";
+    }   

    // Connect to the external database
    $authdb = &ADONewConnection($CFG->auth_dbtype);         
@@ -65,7 +67,7 @@ function auth_get_userinfo($username){
            if ($rs = $authdb->Execute("SELECT ".$config["auth_user_$field"]." FROM $CFG->auth_dbtable
                                        WHERE $CFG->auth_dbfielduser = '$username'")) {
                if ( $rs->RecordCount() == 1 ) {
-                    $result["$field"] = $rs->fields[$config["auth_user_$field"]];
+                    $result["$field"] = $rs->fields[0];
                }
            }
        }
@@ -132,7 +132,7 @@ function auth_get_userinfo($username){
        $user_entry = ldap_get_entries($ldap_connection, $user_info_result);
        foreach ($attrmap as $key=>$value){
            if(isset($user_entry[0][strtolower($value)][0])){
-                $result[$key]=$user_entry[0][strtolower($value)][0];
+                $result[$key]=addslashes(stripslashes(utf8_decode($user_entry[0][strtolower($value)][0])));
            }
        }
        $result['guid']='ldap';
@@ -221,6 +221,11 @@ function auth_get_users($filter='*') {


    foreach ($contexts as $context) {
+        
+        $context = trim($context);
+        if (empty($context)) {
+            continue;
+        }

        if ($CFG->ldap_search_sub) {
            //use ldap_search to find first user from subtree
@@ -368,7 +373,7 @@ function auth_iscreator($username=0) {
    }
   
    if ((! $CFG->ldap_creators) OR (! $CFG->ldap_memberattribute)) {
-        return false;
+        return null;
    } 

    return auth_ldap_isgroupmember($username, $CFG->ldap_creators);
@@ -396,7 +401,10 @@ function auth_ldap_isgroupmember ($username='', $groupdns='') {
    //build filter
    $filter = "(& ($CFG->ldap_user_attribute=$username)(|";
    foreach ($groups as $group){
-        $filter .= "($CFG->ldap_memberattribute=$group)";
+        $group = trim($group);
+        if(!empty($group)) {
+            $filter .= "($CFG->ldap_memberattribute=$group)";
+        }
    }
    $filter .= "))";
    //search
@@ -473,7 +481,10 @@ function auth_ldap_find_userdn ($ldap_connection, $username){
  
    foreach ($ldap_contexts as $context) {

-        $context == trim($context);
+        $context = trim($context);
+        if (empty($context)) {
+            continue;
+        }

        if ($CFG->ldap_search_sub){
            //use ldap_search to find first user from subtree
@@ -539,6 +550,11 @@ function auth_ldap_get_userlist($filter="*") {

    foreach ($contexts as $context) {

+        $context = trim($context);
+        if (empty($context)) {
+            continue;
+        }
+
        if ($CFG->ldap_search_sub) {
            //use ldap_search to find first user from subtree
            $ldap_result = ldap_search($ldap_connection, $context,
@@ -0,0 +1,9 @@
+<tr valign="top"> 
+  <td align="right"><p><?php  print_string("instructions", "auth") ?>:</p></td>
+  <td><textarea name="auth_instructions" cols="30" rows="10" wrap="virtual"><?php  p($config->auth_instructions) ?></textarea> 
+  </td>
+  <td> 
+    <?php  print_string("authinstructions","auth") ?>
+    <?php  helpbutton("text", get_string("helptext")) ?>
+  </td>
+</tr>
@@ -0,0 +1,42 @@
+<?PHP  // $Id$
+       //
+       // PAM (Pluggable Authentication Modules) for Moodle 
+       // 
+       // Description:
+       // Authentication by using the PHP4 PAM module:
+       // http://www.math.ohio-state.edu/~ccunning/pam_auth/
+       // 
+       // Version 0.2: 2004/09/01 by Martin Vögeli (stable version)
+       // Version 0.1: 2004/08/30 by Martin Vögeli (first draft)
+       // 
+       // Contact: martinvoegeli@gmx.ch
+       // Website 1: http://elearning.zhwin.ch/
+       // Website 2: http://birdy1976.com/
+       //
+       // License:  GPL License v2
+       // // // // // // // // // // // // // // // // // // //
+
+function auth_user_login ($username, $password) {
+    global $CFG;
+    // returns true if the username and password work
+    // and false if they are wrong or don't exist
+    // variable to store possible errors during authentication
+    $strErrorPAM = " ";
+    // the maximal length of returned messages is 512
+    // let's double the number to give it enough space ;)
+    // (the errror variable is passed by reference)
+    for ($i = 1; $i <= 1024; $i++) {
+        $strErrorPAM += "{$strErrorPAM} ";
+    }
+    // just for testing and debugging
+    // error_reporting(E_ALL);
+    // finally the actual authentication part...
+    if (pam_auth($username, $password, &$strErrorPAM)) {
+        // authentication success
+        return true;
+    } else {
+        // authentication failure
+        return false;
+    }
+}
+?>
@@ -49,11 +49,11 @@
        print_header("$site->shortname: $strcoursebackup", $site->fullname,
                     "<A HREF=\"$CFG->wwwroot/$CFG->admin/index.php\">$stradministration</A> -> $strcoursebackup");

-        if ($courses = get_courses()) {
+        if ($courses = get_courses('all','c.shortname','c.id,c.shortname,c.fullname')) {
            print_heading(get_string("choosecourse"));
            print_simple_box_start("CENTER");
            foreach ($courses as $course) {
-            echo "<A HREF=\"backup.php?id=$course->id\">$course->fullname ($course->shortname)</A><BR>";
+                echo "<A HREF=\"backup.php?id=$course->id\">$course->fullname ($course->shortname)</A><BR>";
            }
            print_simple_box_end();
        } else {
@@ -88,7 +88,7 @@

    //Adjust some php variables to the execution of this script
    @ini_set("max_execution_time","3000");
-    @ini_set("memory_limit","128M");
+    raise_memory_limit("128M");

    //Call the form, depending the step we are
    if (!$launch) {
@@ -73,7 +73,7 @@
    }
 ?>

-<form name="form" method="post" action="<?php echo $ME ?>">
+<form name="form" method="post" action="backup.php">
 <table cellpadding=5>
 <?php

@@ -115,6 +115,8 @@
    $backup_name .= userdate(time(),$backup_date_format,99,false);
    //The extension
    $backup_name .= ".zip";
+    //And finally, clean everything
+    $backup_name = clean_filename($backup_name);

    //Add as text field
    echo "<input type=\"text\" name=\"backup_name\" size=\"40\" value=\"".$backup_name."\">";
@@ -88,7 +88,8 @@
    if (!isset($backup_name)) {
        error ("Backup name not specified");
    }
-    $preferences->backup_name = $backup_name;
+    //We clean it again (to prevent diacritics entered manually)
+    $preferences->backup_name = clean_filename($backup_name);

    if (!isset($backup_unique_code)) {
        error ("Backup unique code not specified");
@@ -113,7 +114,7 @@
    echo "<td align=\"right\"><P><B>";
    echo get_string("name").":";
    echo "</B></td><td>";
-    echo $backup_name;
+    echo $preferences->backup_name;
    echo "</td></tr>";
    
    //Start the main tr, where all the backup progress is done
@@ -73,7 +73,7 @@

 ?>

-<form name="form" method="post" action="<?php echo $ME ?>">
+<form name="form" method="post" action="backup.php">
 <table cellpadding=5>
 <?php
    if ($allmods = get_records("modules") ) {
@@ -54,9 +54,31 @@ function schedule_backup_cron() {
        $status = false;
    }

+    //Delete old_entries from backup tables
+    if ($status) {
+        mtrace("    Deleting old data");
+        $status = backup_delete_old_data();
+    }
+
    //Now we get a list of courses in the server
    if ($status) {
        mtrace("    Checking courses");
+        //First of all, we delete everything from backup tables related to deleted courses
+        mtrace("        Skipping deleted courses");
+        $skipped = 0;
+        if ($bckcourses = get_records('backup_courses')) {
+            foreach($bckcourses as $bckcourse) {
+                //Search if it exists
+                if (!$exists = get_record('course', 'id', "$bckcourse->courseid")) {
+                    //Doesn't exist, so delete from backup tables
+                    delete_records('backup_courses', 'courseid', "$bckcourse->courseid");
+                    delete_records('backup_log', 'courseid', "$bckcourse->courseid");
+                    $skipped++;
+                }
+            }
+        }
+        mtrace("            $skipped courses");
+        //Now process existing courses
        $courses = get_records("course");
        //For each course, we check (insert, update) the backup_course table
        //with needed data
@@ -79,20 +101,25 @@ function schedule_backup_cron() {
                }
                //Now we backup every course with nextstarttime < now
                if ($backup_course->nextstarttime > 0 && $backup_course->nextstarttime < $now) {
-                    //Set laststarttime
-                    $starttime = time();
-                    set_field("backup_courses","laststarttime",$starttime,"courseid",$backup_course->courseid);
-                    //Launch backup
-                    $course_status = schedule_backup_launch_backup($course,$starttime);
                    //We have to send a email because we have included at least one backup
                    $emailpending = true;
-                    //Set lastendtime
-                    set_field("backup_courses","lastendtime",time(),"courseid",$backup_course->courseid);
-                    //Set laststatus
-                    if ($course_status) {
-                        set_field("backup_courses","laststatus","1","courseid",$backup_course->courseid);
-                    } else {
-                        set_field("backup_courses","laststatus","0","courseid",$backup_course->courseid);
+                    //Only make the backup if laststatus isn't 2-UNFINISHED (uncontrolled error)
+                    if ($backup_course->laststatus != 2) {
+                        //Set laststarttime
+                        $starttime = time();
+                        set_field("backup_courses","laststarttime",$starttime,"courseid",$backup_course->courseid);
+                        //Set course status to unfinished, the process will reset it
+                        set_field("backup_courses","laststatus","2","courseid",$backup_course->courseid);
+                        //Launch backup
+                        $course_status = schedule_backup_launch_backup($course,$starttime);
+                        //Set lastendtime
+                        set_field("backup_courses","lastendtime",time(),"courseid",$backup_course->courseid);
+                        //Set laststatus
+                        if ($course_status) {
+                            set_field("backup_courses","laststatus","1","courseid",$backup_course->courseid);
+                        } else {
+                            set_field("backup_courses","laststatus","0","courseid",$backup_course->courseid);
+                        }
                    }
                }

@@ -117,25 +144,47 @@ function schedule_backup_cron() {
        delete_records_select("backup_log", "laststarttime < '$loglifetime'");
    }

-    //Send email to admin
+    //Send email to admin if necessary
    if ($emailpending) {
        mtrace("    Sending email to admin");
        $message = "";
-        //Build the message text (future versions should handle html messages too!!)
-        $logs = get_records_select ("backup_log","laststarttime >= '$now'","id");
-        if ($logs) {
-            $currentcourse = 1;
-            foreach ($logs as $log) {
-                if ($currentcourse != $log->courseid) {
-                    $message .= "\n==================================================\n\n";
-                    $currentcourse = $log->courseid;
-                }
-                $message .= userdate($log->time,"%T",$admin->timezone)." ".$log->info."\n";
-            }
+
+        //Get info about the status of courses
+        $count_all = count_records('backup_courses');
+        $count_ok = count_records('backup_courses','laststatus','1');
+        $count_error = count_records('backup_courses','laststatus','0');
+        $count_unfinished = count_records('backup_courses','laststatus','2');
+
+        //Build the message text
+        //Summary
+        $message .= get_string('summary')."\n";
+        $message .= "==================================================\n";
+        $message .= "  ".get_string('courses').": ".$count_all."\n";
+        $message .= "  ".get_string('ok').": ".$count_ok."\n";
+        $message .= "  ".get_string('error').": ".$count_error."\n";
+        $message .= "  ".get_string('unfinished').": ".$count_unfinished."\n\n";
+
+        //Reference
+        if ($count_error != 0 || $count_unfinished != 0) {
+            $message .= "  ".get_string('backupfailed')."\n\n";
+            $dest_url = $CFG->wwwroot.'/backup/log.php';
+            $message .= "  ".get_string('backuptakealook','',$dest_url)."\n\n";
+            //Reset unfinished to error
+            set_field('backup_courses','laststatus','0','laststatus','2');
+        } else {
+            $message .= "  ".get_string('backupfinished')."\n";
        }
-        //Send the message
+
+        //Build the message subject
        $site = get_site();
-        email_to_user($admin,$admin,"$site->shortname: ".get_string("scheduledbackupstatus"),$message);
+        $prefix = $site->shortname.": ";
+        if ($count_error != 0 || $count_unfinished != 0) {
+            $prefix .= "[".strtoupper(get_string('error'))."] ";
+        } 
+        $subject = $prefix.get_string("scheduledbackupstatus");
+
+        //Send the message
+        email_to_user($admin,$admin,$subject,$message);
    }
    

@@ -161,6 +210,7 @@ function schedule_backup_launch_backup($course,$starttime = 0) {
        schedule_backup_log($starttime,$course->id,"  Phase 2: Executing and copying:");
        $status = schedule_backup_course_execute($preferences,$starttime);
    }
+
    if ($status && $preferences) {
        //Only if the backup_sche_keep is set
        if ($preferences->backup_keep) {
@@ -168,6 +218,7 @@ function schedule_backup_launch_backup($course,$starttime = 0) {
            $status = schedule_backup_course_delete_old_files($preferences,$starttime);
        }
    }
+
    if ($status && $preferences) {
        mtrace("            End backup OK");
        schedule_backup_log($starttime,$course->id,"End backup course $course->fullname - OK");
@@ -187,7 +238,7 @@ function schedule_backup_log($starttime,$courseid,$message) {
        $log->courseid = $courseid;
        $log->time = time();
        $log->laststarttime = $starttime;
-        $log->info = $message;
+        $log->info = addslashes($message);
    
        insert_record ("backup_log",$log);
    }
@@ -374,11 +425,15 @@ function schedule_backup_course_configure($course,$starttime = 0) {
        $backup_name .= userdate(time(),$backup_date_format,99,false);
        //The extension
        $backup_name .= ".zip";
+        //And finally, clean everything
+        $backup_name = clean_filename($backup_name);

        //Calculate the string to match the keep preference
        $keep_name = $backup_word."-";
        //The shortname
        $keep_name .= strtolower($backup_shortname)."-";
+        //And finally, clean everything
+        $keep_name = clean_filename($keep_name);
 
        $preferences->backup_name = $backup_name;
        $preferences->keep_name = $keep_name;
@@ -485,12 +540,6 @@ function schedule_backup_course_execute($preferences,$starttime = 0) {
        $status = clear_backup_dir($preferences->backup_unique_code);
    }

-    //Delete old_entries from backup tables
-    if ($status) {
-        schedule_backup_log($starttime,$preferences->backup_course,"    cleaning old data");
-        $status = backup_delete_old_data();
-    }
-
    //Create the moodle.xml file
    if ($status) {
        schedule_backup_log($starttime,$preferences->backup_course,"    creating backup file");
@@ -9,7 +9,7 @@
        $status = true;
        $status = execute_sql("INSERT INTO {$CFG->prefix}backup_ids
                                   (backup_code, table_name, old_id)
-                               SELECT DISTINCT '$backup_unique_code','quiz_categories',t.category
+                               SELECT DISTINCT $backup_unique_code,'quiz_categories',t.category
                               FROM {$CFG->prefix}quiz_questions t,
                                    {$CFG->prefix}quiz_question_grades g,
                                    {$CFG->prefix}quiz q
@@ -261,8 +261,9 @@
        $rootdir = $CFG->dataroot."/users";
        //Check if directory exists
        if (is_dir($rootdir)) {
-            $coursedirs = get_directory_list($rootdir);
-            foreach ($coursedirs as $dir) {
+            //Get directories without descend
+            $userdirs = get_directory_list($rootdir,"",false,true,false);
+            foreach ($userdirs as $dir) {
                //Extracts user id from file path
                $tok = strtok($dir,"/");
                if ($tok) {
@@ -313,7 +314,8 @@
        $rootdir = $CFG->dataroot."/$course";
        //Check if directory exists
        if (is_dir($rootdir)) {
-            $coursedirs = get_directory_list($rootdir,$CFG->moddata);
+            //Get files and directories without descend
+            $coursedirs = get_directory_list($rootdir,$CFG->moddata,false,true,true);
            $backupdata_dir = "backupdata";
            foreach ($coursedirs as $dir) {
                //Check it isn't backupdata_dir
@@ -464,6 +466,13 @@
        fwrite ($bf,full_tag("DATE",2,false,$preferences->backup_unique_code));
        //The original site wwwroot
        fwrite ($bf,full_tag("ORIGINAL_WWWROOT",2,false,$CFG->wwwroot));
+        //The zip method used
+        if (!empty($CFG->zip)) {
+            $zipmethod = 'external';
+        } else {
+            $zipmethod = 'internal';
+        }
+        fwrite ($bf,full_tag("ZIP_METHOD",2,false,$zipmethod));
        //Te includes tag
        fwrite ($bf,start_tag("DETAILS",2,true));
        //Now, go to mod element of preferences to print its status
@@ -1057,8 +1066,10 @@
                fwrite ($bf,full_tag("TIMECREATED",4,false,$group->timecreated));
                fwrite ($bf,full_tag("TIMEMODIFIED",4,false,$group->timemodified));
                
-                //Now, backup groups_members
-                $status2 = backup_groups_members_info($bf,$preferences,$group->id);
+                //Now, backup groups_members, only if users are included
+                if ($preferences->backup_users != 2) {
+                    $status2 = backup_groups_members_info($bf,$preferences,$group->id);
+                }

                //End group tag
                fwrite ($bf,end_tag("GROUP",3,true));
@@ -1260,48 +1271,20 @@
        $status = true;

        //Base dir where everything happens
-        $basedir = $CFG->dataroot."/temp/backup/".$preferences->backup_unique_code;
+        $basedir = cleardoubleslashes($CFG->dataroot."/temp/backup/".$preferences->backup_unique_code);
        //Backup zip file name
        $name = $preferences->backup_name;
-        //List base_dir files and directories
+        //List of files and directories
        $filelist = list_directories_and_files ($basedir);

-        if (empty($CFG->zip)) {    // Use built-in php-based zip function
-            //echo "<br>Using pclzip";                                    //Debug
-            $files = array();
-            foreach ($filelist as $file) {
-                //If directory, append "/"
-                //Commented. Not needed wit version 2.0 of pclzip !!
-                //if (is_dir($basedir."/".$file)) {
-                //    $file = $file."/";
-                //}
-                //Include into array
-                //echo "<br>Adding file/dir ".$file;                       //Debug
-                $files[] = $basedir."/".$file;
-            }
-            include_once("$CFG->dirroot/lib/pclzip/pclzip.lib.php");
-            //include_once("$CFG->dirroot/lib/pclzip/pclerror.lib.php");   //Debug
-            //include_once("$CFG->dirroot/lib/pclzip/pcltrace.lib.php");   //Debug
-            //PclTraceOn(2);                                               //Debug
-            $archive = new PclZip("$basedir/$name");
-            if (($list = $archive->create($files,PCLZIP_OPT_REMOVE_PATH,$basedir)) == 0) {
-                error($archive->errorInfo(true));
-                $status = false;
-            } 
-            //PclTraceDisplay();                                           //Debug
-            //PclTraceOff();                                               //Debug
-        } else {                   // Use external zip program
-            //echo "<br>Using external zip";                               //Debug
-            $files = "";
-            foreach ($filelist as $file) {
-                $files .= basename($file);
-                $files .= " ";
-            }
-            $command = "cd $basedir ; $CFG->zip -r $name $files";
-            //echo "<br>Executing command: ".$command;                     //Debug
-            $status = Exec($command);
+        //Convert them to full paths
+        $files = array();
+        foreach ($filelist as $file) {
+           $files[] = "$basedir/$file";
        }

+        $status = zip_files($files, "$basedir/$name");
+
        //echo "<br>Status: ".$status;                                     //Debug
        return $status;

@@ -82,6 +82,7 @@
    $keep_array[500] = "500";
 ?>
 <form method="post" action="backup.php" name="form">
+<?php echo "<input type=\"hidden\" name=\"sesskey\" value=\"".$USER->sesskey."\">"; ?>

 <table cellpadding=9 cellspacing=0 >
 <tr valign=top>
@@ -56,7 +56,8 @@
        global $CFG;

        $status = true;
-        $list = get_directory_list($CFG->dataroot."/temp/backup", "", false);
+        //Get files and directories in the temp backup dir witout descend
+        $list = get_directory_list($CFG->dataroot."/temp/backup", "", false, true, true);
        foreach ($list as $file) {
            $file_path = $CFG->dataroot."/temp/backup/".$file;
            $moddate = filemtime($file_path);
@@ -455,7 +456,7 @@
                                           "old_id", $old_id);

        //If info field = "infile", get file contents
-        if ($status->info == "infile") {
+        if ($status && $status->info == "infile") {
            $filename = $CFG->dataroot."/temp/backup/".$backup_unique_code."/".$backup_unique_code."_".$table."_".$old_id.".info";
            //Read data from file
            $status2 = backup_file2data($filename,$info);
@@ -28,6 +28,7 @@
    $strftimetime = get_string("strftimetime").":%S";
    $strerror = get_string("error");
    $strok = get_string("ok");
+    $strunfinished = get_string("unfinished");
    $strcourse = get_string("course");
    $strtimetaken = get_string("timetaken","quiz");
    $strstatus = get_string("status");
@@ -39,7 +40,7 @@
        print_header("$site->shortname: $strconfiguration: $strbackup", $site->fullname,
                      "<a href=\"../$CFG->admin/index.php\">$stradmin</a> -> ".
                      "<a href=\"../$CFG->admin/configure.php\">$strconfiguration</a> -> ".
-                      "<a href=\"../$CFG->admin/backup.php\">$strbackup</a> -> ".
+                      "<a href=\"../$CFG->admin/backup.php?sesskey=$USER->sesskey\">$strbackup</a> -> ".
                      $strlogs);

        print_heading($backuploglaststatus);
@@ -66,10 +67,12 @@
                    echo "<td nowrap><font size=2>".userdate($course->laststarttime,$strftimedatetime)."</td>";
                    echo "<td nowrap><font size=2> - </td>";
                    echo "<td nowrap><font size=2>".userdate($course->lastendtime,$strftimedatetime)."</td>";
-                    if (!$course->laststatus) {
-                        echo "<td nowrap align=center><font size=2 color=red>".$strerror."</td>";
-                    } else {
+                    if ($course->laststatus == 1) {
                        echo "<td nowrap align=center><font size=2 color=green>".$strok."</td>";
+                    } else if ($course->laststatus == 2) {
+                        echo "<td nowrap align=center><font size=2 color=red>".$strunfinished."</td>";
+                    } else {
+                        echo "<td nowrap align=center><font size=2 color=red>".$strerror."</td>";
                    }
                    echo "<td nowrap><font size=2>".userdate($course->nextstarttime,$strftimedatetime)."</td>";
                    echo "</tr>";
@@ -83,7 +86,7 @@
        print_header("$site->shortname: $strconfiguration: $strbackup", $site->fullname,
                      "<a href=\"../$CFG->admin/index.php\">$stradmin</a> -> ".
                      "<a href=\"../$CFG->admin/configure.php\">$strconfiguration</a> -> ".
-                      "<a href=\"../$CFG->admin/backup.php\">$strbackup</a> -> ".
+                      "<a href=\"../$CFG->admin/backup.php?sesskey=$USER->sesskey\">$strbackup</a> -> ".
                      "<a href=\"log.php\">$strlogs</a> -> ".
                      $strbackupdetails);

@@ -115,7 +118,7 @@
                                         FROM {$CFG->prefix}backup_log
                                         WHERE courseid = '$courseid'  AND
                                               laststarttime = '$execution->laststarttime'
-                                         ORDER BY time");
+                                         ORDER BY id");
                if ($logs) {
                    foreach ($logs as $log) {
                        echo "<tr nowrap>";
@@ -95,7 +95,7 @@
    
    //Adjust some php variables to the execution of this script
    @ini_set("max_execution_time","3000");
-    @ini_set("memory_limit","128M");
+    raise_memory_limit("128M");

    //Call the form, depending the step we are
    if (!$launch) {
@@ -104,7 +104,15 @@
        include_once("restore_form.html");
    } else if ($launch == "check") {
        include_once("restore_check.html");
+        //To avoid multiple restore executions...
+        $SESSION->cancontinue = true;
    } else if ($launch == "execute") {
+        //Prevent multiple restore executions...
+        if (empty($SESSION->cancontinue)) {
+            error("Multiple restore execution not allowed!");
+        }
+        //Unset this for the future
+        unset($SESSION->cancontinue);
        include_once("restore_execute.html");
    }
    print_simple_box_end();
@@ -116,18 +116,18 @@
    }
 
    //Depending the selected restoreto:
-    // If user is a teacher (and nor admin):
+    // If user is a teacher (and not creator):
    //    0-Current course, deleting: Put $restore->course_id and $restore->deleting (true), create the restore object
    //    1-Current course, adding: Put $restore->course_id and $restore->deleting (false), create the restore object
-    // If the uses is an admin:
+    // If the uses is a creator:
    //    0-Existing course, deleting: Select the destination course and launch the check again, then
    //        put $restore->course_id and $restore->deleting (true), create the restore object.
    //    1-Existing course, adding: Select the destination course and launch the check again, then
    //        put $restore->course_id and $restore->deleting (false), create the restore object.
    //    2-New course: Create the restore object and launch the execute.

-    //If the user is a teacher and not an admin
-    if (isteacher($id) and !isadmin()) {
+    //If the user is a teacher and not a creator
+    if (isteacheredit($id) and !iscreator()) {
        $restore->course_id = $id;
        if ($restore->restoreto == 0) {
            $restore->deleting = true;
@@ -136,8 +136,8 @@
        }
    }

-    //If the user is an admin
-    if (isadmin()) {
+    //If the user is a creator (or admin)
+    if (iscreator()) {
        //Set restore->deleting as needed
        if ($restore->restoreto == 0) {
            $restore->deleting = true;
@@ -147,8 +147,8 @@
    }

    //Now, select the course if needed
-    if (($restore->restoreto == 0 or $restore->restoreto == 1) and ($restore->course_id == 0) and (isadmin())) {
-        if ($courses = get_courses("all","c.fullname")) {
+    if (($restore->restoreto == 0 or $restore->restoreto == 1) and ($restore->course_id == 0) and (iscreator())) {
+        if ($courses = get_courses("all","c.fullname","c.id,c.fullname,c.shortname")) {
            print_heading(get_string("choosecourse"));
            print_simple_box_start("CENTER");
            foreach ($courses as $course) {
@@ -64,6 +64,7 @@
    //Saving conversion id variables into backup_tables
    if ($restore->restoreto == 2) {
        echo "<li>".get_string("creatingnewcourse");
+        $oldidnumber = $course_header->course_idnumber;
        if (!$status = restore_create_new_course($restore,$course_header)) {
            notify("Error while creating the new empty course.");
        }
@@ -72,6 +73,9 @@
            echo "<ul>";
            echo "<li>".$course_header->course_fullname." (".$course_header->course_shortname.")";
            echo "<li>".get_string("category").": ".$course_header->category->name;
+            if (!empty($oldidnumber)) {
+                echo "<li>".get_string("nomoreidnumber","moodle",$oldidnumber)."</li>";
+            }
            echo "</ul>";
            //Put the destination course_id
            $restore->course_id = $course_header->course_id;
@@ -290,6 +294,7 @@
    //Now if all is OK, update:
    //   - course modinfo field 
    //   - categories table
+    //   - add user as teacher
    if ($status) {
        echo "<li>".get_string("checkingcourse");
        //modinfo field
@@ -297,6 +302,13 @@
        //categories table
        $course = get_record("course","id",$restore->course_id); 
        fix_course_sortorder();
+        //Make the user a teacher if the course hasn't teachers (bug 2381)
+        if (!isadmin()) {
+            if (!$checktea = get_records('user_teachers','course', $restore->course_id)) {
+                //Add the teacher to the course
+                $status = add_teacher($USER->id, $restore->course_id);
+            }
+        }
    }

    //Cleanup temps (files and db)
@@ -113,7 +113,7 @@ function selectItemInMenuByName(formId, menuName, selectIndex ) {
 -->
 </script>

-<form name="form1" id="form1" method="post" action="<?php echo $ME ?>">
+<form name="form1" id="form1" method="post" action="restore.php">
 <table cellpadding=5>
 <?php

@@ -123,11 +123,11 @@ function selectItemInMenuByName(formId, menuName, selectIndex ) {
    echo "<td align=\"right\"><P><b>";
    echo get_string("restoreto").":</b>";
    echo "</td><td>";
-    if (isteacheredit($id) and !isadmin()) {
+    if (isteacheredit($id) and !iscreator()) {
        $restore_restoreto_options[0] = get_string("currentcoursedeleting");
        $restore_restoreto_options[1] = get_string("currentcourseadding");
    } 
-    if (isadmin()) {
+    if (iscreator()) {
        $restore_restoreto_options[0] = get_string("existingcoursedeleting");
        $restore_restoreto_options[1] = get_string("existingcourseadding");
        $restore_restoreto_options[2] = get_string("newcourse"); 
@@ -5,27 +5,8 @@
    //It automatically uses pclzip or command line unzip
    function restore_unzip ($file) {
        
-        global $CFG;
+        return unzip_file($file, '', false);

-        $status = true;
-
-        if (empty($CFG->unzip)) {    // Use built-in php-based unzip function
-            include_once("$CFG->dirroot/lib/pclzip/pclzip.lib.php");
-            //include_once("$CFG->dirroot/lib/pclzip/pclerror.lib.php");    //Debug
-            //include_once("$CFG->dirroot/lib/pclzip/pcltrace.lib.php");    //Debug
-            //PclTraceOn(2);                                          //Debug
-            $archive = new PclZip($file);
-            if (!$list = $archive->extract(dirname($file))) {
-                $status = false;
-            }
-            //PclTraceDisplay();                                       //Debug
-            //PclTraceOff();                                           //Debug
-        } else {                     // Use external unzip program
-            $command = "cd ".dirname($file)."; $CFG->unzip -o ".basename($file);
-            Exec($command);
-        }
-
-        return $status;
    }

    //This function checks if moodle.xml seems to be a valid xml file
@@ -537,6 +518,7 @@
            $course->fullname = addslashes($course_header->course_fullname);
            $course->shortname = addslashes($course_header->course_shortname);
            $course->idnumber = addslashes($course_header->course_idnumber);
+            $course->idnumber = ''; //addslashes($course_header->course_idnumber); // we don't want this at all.
            $course->summary = restore_decode_absolute_links(addslashes($course_header->course_summary));
            $course->format = addslashes($course_header->course_format);
            $course->showgrades = addslashes($course_header->course_showgrades);
@@ -562,6 +544,16 @@
            $course->hiddensections = addslashes($course_header->course_hiddensections);
            $course->timecreated = addslashes($course_header->course_timecreated);
            $course->timemodified = addslashes($course_header->course_timemodified);
+            //Calculate sortorder field
+            $sortmax = get_record_sql('SELECT MAX(sortorder) AS max
+                                       FROM ' . $CFG->prefix . 'course
+                                       WHERE category=' . $course->category);
+            if (!empty($sortmax->max)) {
+                $course->sortorder = $sortmax->max + 1;
+                unset($sortmax);
+            } else {
+                $course->sortorder = 100;
+            }
            //Adjust blockinfo field.
            //If the info doesn't exist in backup, we create defaults, else we recode it 
            //to current site blocks.
@@ -946,13 +938,16 @@
            if ($info !== true) {
                //Iterate over each category
                foreach ($info as $category) {
-                    $catrestore = "quiz_restore_question_categories";
-                    if (function_exists($catrestore)) {
-                        //print_object ($category);                                                //Debug
-                        $status = $catrestore($category,$restore);
-                    } else {
-                        //Something was wrong. Function should exist.
-                        $status = false;
+                    //Skip empty categories (some backups can contain them)
+                    if (!empty($category->id)) {
+                        $catrestore = "quiz_restore_question_categories";
+                        if (function_exists($catrestore)) {
+                            //print_object ($category);                                                //Debug
+                            $status = $catrestore($category,$restore);
+                        } else {
+                            //Something was wrong. Function should exist.
+                            $status = false;
+                        }
                    }
                }
            }
@@ -1116,8 +1111,11 @@
                            backup_putid($restore->backup_unique_code,"group",
                                         $group->id, $newid);
                        }
-                        //Now restore members in the groups_members
-                        $status2 = restore_create_groups_members($newid,$info,$restore);
+                        //Now restore members in the groups_members, only if
+                        //users are included
+                        if ($restore->users != 2) {
+                            $status2 = restore_create_groups_members($newid,$info,$restore);
+                        }
                    }   
                }
            }
@@ -2961,7 +2959,7 @@
        
        $status = true;

-        $xml_parser = xml_parser_create();
+        $xml_parser = xml_parser_create('UTF-8');
        $moodle_parser = new MoodleParser();
        $moodle_parser->todo = $todo;
        $moodle_parser->preferences = $preferences;
@@ -21,7 +21,7 @@

    //Adjust some php variables to the execution of this script
    @ini_set("max_execution_time","3000");
-    @ini_set("memory_limit","128M");
+    raise_memory_limit("128M");

    echo "<pre>\n";

@@ -5,6 +5,8 @@
 // database (backup_version) to determine whether upgrades should
 // be performed (see db/backup_*.php)

-$backup_version = 2004083100;   // The current version is a date (YYYYMMDDXX)
+$backup_version = 2004083124;  // YYYYMMDD   = date of first major branch release 1.4
+                               //         X  = point release version 1,2,3 etc
+                               //          Y = increments between point releases

-$backup_release = "1.4";  // User-friendly version number
+$backup_release = "1.4.2";  // User-friendly version number
@@ -21,7 +21,7 @@ class CourseBlock_admin extends MoodleBlock {

        if (empty($this->course)) {
            $this->content = '';
-        } else if ($this->course->category == 0) {
+        } else if ($this->course->id == SITEID) {
            $this->load_content_for_site();
        } else {
            $this->load_content_for_course();
@@ -32,7 +32,7 @@ class CourseBlock_admin extends MoodleBlock {


    function load_content_for_site() {
-        global $CFG;
+        global $CFG, $USER;

        if (isadmin()) {
            $this->content->items[] = '<a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/configure.php">'.get_string('configuration').'</a>...';
@@ -40,18 +40,24 @@ class CourseBlock_admin extends MoodleBlock {

            $this->content->items[] = '<a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/users.php">'.get_string('users').'</a>...';
            $this->content->icons[] = '<img src="'.$CFG->pixpath.'/i/users.gif" height="16" width="16" alt="" />';
+
+            $this->content->items[]='<a href="'.$CFG->wwwroot.'/backup/backup.php?id='.SITEID.'">'.get_string('backup').'...</a>';
+            $this->content->icons[]='<img src="'.$CFG->pixpath.'/i/backup.gif" height="16" width="16" alt="">';
+
+            $this->content->items[]='<a href="'.$CFG->wwwroot.'/files/index.php?id='.SITEID.'&amp;wdir=/backupdata">'.get_string('restore').'...</a>';
+            $this->content->icons[]='<img src="'.$CFG->pixpath.'/i/restore.gif" height="16" width="16" alt="">';
        }

        if (iscreator()) {
-            $this->content->items[] = '<a href="'.$CFG->wwwroot.'/course/index.php?edit=on">'.get_string('courses').'</a>';
+            $this->content->items[] = '<a href="'.$CFG->wwwroot.'/course/index.php?edit=on&sesskey='.set_user_sesskey().'">'.get_string('courses').'</a>';
            $this->content->icons[] = '<img src="'.$CFG->pixpath.'/i/course.gif" height="16" width="16" alt="" />';
        }

        if (isadmin()) {
-            $this->content->items[] = '<a href="'.$CFG->wwwroot.'/course/log.php?id=1">'.get_string('logs').'</a>';
+            $this->content->items[] = '<a href="'.$CFG->wwwroot.'/course/log.php?id='.SITEID.'">'.get_string('logs').'</a>';
            $this->content->icons[] = '<img src="'.$CFG->pixpath.'/i/log.gif" height="16" width="16" alt="" />';

-            $this->content->items[] = '<a href="'.$CFG->wwwroot.'/files/index.php?id=1">'.get_string('sitefiles').'</a>';
+            $this->content->items[] = '<a href="'.$CFG->wwwroot.'/files/index.php?id='.SITEID.'">'.get_string('sitefiles').'</a>';
            $this->content->icons[] = '<img src="'.$CFG->pixpath.'/i/files.gif" height="16" width="16" alt="" />';

            if (file_exists($CFG->dirroot.'/'.$CFG->admin.'/'.$CFG->dbtype)) {
@@ -38,12 +38,11 @@ class CourseBlock_calendar_upcoming extends MoodleBlock {
                                      '/calendar/event.php?action=new&amp;course='.$this->course->id.'">'.
                                       get_string('newevent', 'calendar').'</a>...';
            
-            if($this->course->id == SITEID) {
+            if ($this->course->id == SITEID) {
                // Being displayed at site level. This will cause the filter to fall back to auto-detecting
                // the list of courses it will be grabbing events from.
                $filtercourse = NULL;
-            }
-            else {
+            } else {
                // Forcibly filter events to include only those from the particular course we are in.
                $filtercourse = array($courseshown => 1);
            }
@@ -56,12 +55,18 @@ class CourseBlock_calendar_upcoming extends MoodleBlock {
        // Correct formatting is [courseid] => 1 to be concise with moodlelib.php functions.

        calendar_set_filters($courses, $group, $user, $filtercourse, $filtercourse, false);
-        $events = calendar_get_upcoming($courses, $group, $user, get_user_preferences('calendar_lookahead', CALENDAR_UPCOMING_DAYS), get_user_preferences('calendar_maxevents', CALENDAR_UPCOMING_MAXEVENTS));
+        $events = calendar_get_upcoming($courses, $group, $user, 
+                                        get_user_preferences('calendar_lookahead', CALENDAR_UPCOMING_DAYS), 
+                                        get_user_preferences('calendar_maxevents', CALENDAR_UPCOMING_MAXEVENTS));

-        $this->content->text = calendar_get_sideblock_upcoming($events, 'view.php?view=day&amp;course='.$this->course->id.'&amp;');
+        if (!empty($this->course)) { 
+            $this->content->text = calendar_get_sideblock_upcoming($events, 
+                                   'view.php?view=day&amp;course='.$this->course->id.'&amp;');
+        }

-        if(empty($this->content->text)) {
-            $this->content->text = '<div style="font-size: 0.8em; text-align: center;">'.get_string('noupcomingevents', 'calendar').'</div>';
+        if (empty($this->content->text)) {
+            $this->content->text = '<div style="font-size: 0.8em; text-align: center;">'.
+                                   get_string('noupcomingevents', 'calendar').'</div>';
        }

        return $this->content;
@@ -13,7 +13,7 @@ class CourseBlock_course_list extends MoodleBlock {
    }

    function print_config() {
-        global $CFG, $THEME;
+        global $CFG, $USER, $THEME;
        print_simple_box_start('center', '', $THEME->cellheading);
        include($CFG->dirroot.'/blocks/'.$this->name().'/config.html');
        print_simple_box_end();
@@ -1,4 +1,5 @@
 <form method="post" action="block.php">
+<?php echo "<input type=\"hidden\" name=\"sesskey\" value=\"".$USER->sesskey."\">"; ?>

 <table cellpadding="9" cellspacing="0">
 <tr valign="top">
@@ -2,7 +2,7 @@

 class CourseBlock_course_summary extends MoodleBlock {
    function CourseBlock_course_summary ($course) {
-        if (empty($course->category)) {   // Site level
+        if(!empty($course) && $course->id == SITEID) {   // Site level
            $this->title = get_string('frontpagedescription');
        } else {
            $this->title = get_string('blockname','block_course_summary');
@@ -26,13 +26,13 @@ class CourseBlock_course_summary extends MoodleBlock {
        $this->content = New stdClass;
        $options->noclean = true;    // Don't clean Javascripts etc
        $this->content->text = format_text($this->course->summary, FORMAT_HTML, $options);
-        if (isediting($this->course->id)) {
-            if (empty($this->course->category)) {
-                $editpage = $CFG->wwwroot.'/admin/site.php';
+        if(isediting($this->course->id)) {
+            if($this->course->id == SITEID) {
+                $editpage = $CFG->wwwroot.'/'.$CFG->admin.'/site.php';
            } else {
                $editpage = $CFG->wwwroot.'/course/edit.php?id='.$this->course->id;
            }
-            $this->content->text .= "<div align=\"right\"><a href=\"$editpage\"><img src=\"$CFG->pixpath/t/edit.gif\" /></a></div>";
+            $this->content->text .= '<div style="text-align: right;"><a href="'.$editpage.'"><img src="'.$CFG->pixpath.'/t/edit.gif" /></a></div>';
        }
        $this->content->footer = '';

@@ -119,7 +119,7 @@ class MoodleBlock {
    }

    function add_edit_controls($options, $blockid) {
-        global $CFG, $THEME;
+        global $CFG, $THEME, $USER;

        // The block may be disabled
        $blockid = intval($blockid);
@@ -143,6 +143,8 @@ class MoodleBlock {
        } else {
            $pixpath = $path.'/../theme/'.$CFG->theme.'/pix';
        }
+ 
+        $sesskeystr = '&amp;sesskey='.$USER->sesskey;

        $movebuttons = '<div style="float: right;">';

@@ -155,26 +157,26 @@ class MoodleBlock {
            $title = $this->str->show;
        }

-        $movebuttons .= '<a style="margin-right: 6px; margin-left: 3px;" title="'.$title.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=toggle&amp;blockid='.$blockid.'">' .
+        $movebuttons .= '<a style="margin-right: 6px; margin-left: 3px;" title="'.$title.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=toggle&amp;blockid='.$blockid.$sesskeystr.'">' .
                        '<img src="'.$pixpath.$icon.'" /></a>';

-        $movebuttons .= '<a title="'.$this->str->delete.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=delete&amp;blockid='.$blockid.'">' .
+        $movebuttons .= '<a title="'.$this->str->delete.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=delete&amp;blockid='.$blockid.$sesskeystr.'">' .
                        '<img src="'.$pixpath.'/t/delete.gif" /></a> ';

        if ($options & BLOCK_MOVE_LEFT) {
-            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->moveleft.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=moveside&amp;blockid='.$blockid.'">' .
+            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->moveleft.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=moveside&amp;blockid='.$blockid.$sesskeystr.'">' .
                            '<img src="'.$pixpath.'/t/left.gif" /></a>';
        }
        if ($options & BLOCK_MOVE_UP) {
-            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->moveup.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=moveup&amp;blockid='.$blockid.'">' .
+            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->moveup.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=moveup&amp;blockid='.$blockid.$sesskeystr.'">' .
                            '<img src="'.$pixpath.'/t/up.gif" /></a>';
        }
        if ($options & BLOCK_MOVE_DOWN) {
-            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->movedown.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=movedown&amp;blockid='.$blockid.'">' .
+            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->movedown.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=movedown&amp;blockid='.$blockid.$sesskeystr.'">' .
                            '<img src="'.$pixpath.'/t/down.gif" /></a>';
        }
        if ($options & BLOCK_MOVE_RIGHT) {
-            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->moveright.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=moveside&amp;blockid='.$blockid.'">' .
+            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->moveright.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=moveside&amp;blockid='.$blockid.$sesskeystr.'">' .
                            '<img src="'.$pixpath.'/t/right.gif" /></a>';
        }

@@ -11,7 +11,7 @@ class CourseBlock_online_users extends MoodleBlock {
    function has_config() {return true;}

    function print_config() {
-        global $CFG, $THEME;
+        global $CFG, $USER, $THEME;
        print_simple_box_start('center', '', $THEME->cellheading);
        include($CFG->dirroot.'/blocks/'.$this->name().'/config.html');
        print_simple_box_end();
@@ -1,4 +1,5 @@
 <form method="post" action="block.php">
+<?php echo "<input type=\"hidden\" name=\"sesskey\" value=\"".$USER->sesskey."\">"; ?>

 <table cellpadding="9" cellspacing="0">
 <tr valign="top">
@@ -27,7 +27,7 @@ class CourseBlock_participants extends MoodleBlock {
        $strgroups   = get_string('groups');
        $strgroupmy  = get_string('groupmy');

-        if ($this->course->category or $CFG->showsiteparticipantslist > 1 or ($CFG->showsiteparticipantslist == 1 and isteacher()) or isteacher(SITEID)) {
+        if ($this->course->category or $CFG->showsiteparticipantslist > 1 or ($CFG->showsiteparticipantslist == 1 and isteacherinanycourse()) or isteacher(SITEID)) {
            $this->content->items[]='<a title="'.get_string('listofallpeople').'" href="'.$CFG->wwwroot.'/user/index.php?id='.$this->course->id.'">'.get_string('participants').'</a>';
            $this->content->icons[]='<img src="'.$CFG->pixpath.'/i/users.gif" height="16" width="16" alt="">';
        }
@@ -54,7 +54,7 @@ class CourseBlock_site_main_menu extends MoodleBlock {

        if ($ismoving) {
            $this->content->icons[] = '&nbsp;<img align="bottom" src="'.$CFG->pixpath.'/t/move.gif" height="11" width="11">';
-            $this->content->items[] = $USER->activitycopyname.'&nbsp;(<a href="'.$CFG->wwwroot.'/course/mod.php?cancelcopy=true">'.$strcancel.'</a>)';
+            $this->content->items[] = $USER->activitycopyname.'&nbsp;(<a href="'.$CFG->wwwroot.'/course/mod.php?cancelcopy=true&amp;sesskey='.$USER->sesskey.'">'.$strcancel.'</a>)';
        }

        if (!empty($section->sequence)) {
@@ -82,7 +82,7 @@ class CourseBlock_site_main_menu extends MoodleBlock {
                        if ($mod->id == $USER->activitycopy) {
                            continue;
                        }
-                        $this->content->items[] = '<a title="'.$strmovefull.'" href="'.$CFG->wwwroot.'/course/mod.php?moveto='.$mod->id.'">'.
+                        $this->content->items[] = '<a title="'.$strmovefull.'" href="'.$CFG->wwwroot.'/course/mod.php?moveto='.$mod->id.'&amp;sesskey='.$USER->sesskey.'">'.
                            '<img height="16" width="80" src="'.$CFG->pixpath.'/movehere.gif" alt="'.$strmovehere.'" border="0"></a>';
                        $this->content->icons[] = '';
                   }
@@ -115,7 +115,7 @@ class CourseBlock_site_main_menu extends MoodleBlock {
        }

        if ($ismoving) {
-            $this->content->items[] = '<a title="'.$strmovefull.'" href="'.$CFG->wwwroot.'/course/mod.php?movetosection='.$section->id.'">'.
+            $this->content->items[] = '<a title="'.$strmovefull.'" href="'.$CFG->wwwroot.'/course/mod.php?movetosection='.$section->id.'&amp;sesskey='.$USER->sesskey.'">'.
                                      '<img height="16" width="80" src="'.$CFG->pixpath.'/movehere.gif" alt="'.$strmovehere.'" border="0"></a>';
            $this->content->icons[] = '';
        }
@@ -78,7 +78,7 @@ class CourseBlock_social_activities extends MoodleBlock {
                        if ($mod->id == $USER->activitycopy) {
                            continue;
                        }
-                        $this->content->items[] = '<a title="'.$strmovefull.'" href="'.$CFG->wwwroot.'/course/mod.php?moveto='.$mod->id.'">'.
+                        $this->content->items[] = '<a title="'.$strmovefull.'" href="'.$CFG->wwwroot.'/course/mod.php?moveto='.$mod->id.'&amp;sesskey='.$USER->sesskey.'">'.
                            '<img height="16" width="80" src="'.$CFG->pixpath.'/movehere.gif" alt="'.$strmovehere.'" border="0"></a>';
                        $this->content->icons[] = '';
                    }
@@ -111,7 +111,7 @@ class CourseBlock_social_activities extends MoodleBlock {
        }

        if ($ismoving) {
-            $this->content->items[] = '<a title="'.$strmovefull.'" href="'.$CFG->wwwroot.'/course/mod.php?movetosection='.$section->id.'">'.
+            $this->content->items[] = '<a title="'.$strmovefull.'" href="'.$CFG->wwwroot.'/course/mod.php?movetosection='.$section->id.'&amp;sesskey='.$USER->sesskey.'">'.
                                      '<img height="16" width="80" src="'.$CFG->pixpath.'/movehere.gif" alt="'.$strmovehere.'" border="0"></a>';
            $this->content->icons[] = '';
        }
@@ -112,11 +112,11 @@ function calendar_get_mini($courses, $groups, $users, $cal_month = false, $cal_y
        $events = array();
    }
    else {
-        $events = get_records_select('event', $whereclause);
+        $events = get_records_select('event', $whereclause, 'timestart');
    }

    // This is either a genius idea or an idiot idea: in order to not complicate things, we use this rule: if, after
-    // possibly removing courseid 1 from $courses, there is only one course left, then clicking on a day in the month
+    // possibly removing SITEID from $courses, there is only one course left, then clicking on a day in the month
    // will also set the $SESSION->cal_courses_shown variable to that one course. Otherwise, we 'd need to add extra
    // arguments to this function.

@@ -190,10 +190,10 @@ function calendar_get_mini($courses, $groups, $users, $cal_month = false, $cal_y
                    $popupicon = $CFG->modpixpath.'/'.$event->modulename.'/icon.gif';
                    $popupalt  = $event->modulename;

-                } else if ($event->courseid == 1) {                                // Site event
+                } else if ($event->courseid == SITEID) {                                // Site event
                    $popupicon = $CFG->pixpath.'/c/site.gif';
                    $popupalt  = '';
-                } else if ($event->courseid > 1 and empty($event->groupid)) {      // Course event
+                } else if ($event->courseid != 0 && $event->courseid != SITEID && $event->groupid == 0) {      // Course event
                    $popupicon = $CFG->pixpath.'/c/course.gif';
                    $popupalt  = '';
                } else if ($event->groupid) {                                      // Group event
@@ -290,6 +290,9 @@ function calendar_get_upcoming($courses, $groups, $users, $daysinfuture, $maxeve
    // This effectively adds as many days as needed, and the final SECS_IN_DAY - 1
    // serves to cover the duration until the end of the final day. We could
    // just do another gmmktime() and an addition, but this is "faster" :)
+
+    // WARNING: IT IS ALSO BUGGY WITH REGARDS TO DST CHANGES! THIS HAS TO BE FIXED SOMEDAY!
+    // IF YOU DO SECS ARITHMETIC, THE CODE WILL ALWAYS BE BUGGY WITH REGARD TO DST!
    $display->tend = $display->tstart + (SECS_IN_DAY * $display->range) - 1;

    // Get the events matching our criteria
@@ -297,12 +300,11 @@ function calendar_get_upcoming($courses, $groups, $users, $daysinfuture, $maxeve
    if ($whereclause === false) {
        $events = false;
    } else {
-        $whereclause .= ' ORDER BY timestart'; // We want them this way
-        $events = get_records_select('event', $whereclause);
+        $events = get_records_select('event', $whereclause, 'timestart');
    }

    // This is either a genius idea or an idiot idea: in order to not complicate things, we use this rule: if, after
-    // possibly removing courseid 1 from $courses, there is only one course left, then clicking on a day in the month
+    // possibly removing SITEID from $courses, there is only one course left, then clicking on a day in the month
    // will also set the $SESSION->cal_courses_shown variable to that one course. Otherwise, we 'd need to add extra
    // arguments to this function.

@@ -355,14 +357,12 @@ function calendar_get_upcoming($courses, $groups, $users, $daysinfuture, $maxeve
                $output[$outkey]->cmid = $module->id;


-
-            } else if($event->courseid == 1) {                              // Site event
+            } else if($event->courseid == SITEID) {                              // Site event
                $output[$outkey]->icon = '<img height=16 width=16 src="'.$CFG->pixpath.'/c/site.gif" alt="" style="vertical-align: middle;" />';
                $output[$outkey]->time = $eventtime;


-
-            } else if($event->courseid > 1 and !$event->groupid) {          // Course event
+            } else if($event->courseid != 0 && $event->courseid != SITEID && $event->groupid == 0) {          // Course event
                calendar_get_course_cached($coursecache, $event->courseid);

                $output[$outkey]->icon = '<img height=16 width=16 src="'.$CFG->pixpath.'/c/course.gif" alt="" style="vertical-align: middle;" />';
@@ -393,6 +393,7 @@ function calendar_sql_where($tstart, $tend, $users, $groups, $courses, $withdura
    if(is_bool($users) && is_bool($groups) && is_bool($courses)) {
        return false;
    }
+
    if(is_array($users) && !empty($users)) {
        // Events from a number of users
        if(!empty($whereclause)) $whereclause .= ' OR';
@@ -412,6 +413,7 @@ function calendar_sql_where($tstart, $tend, $users, $groups, $courses, $withdura
        // No user at all
        // No need to do anything
    }
+
    if(is_array($groups) && !empty($groups)) {
        // Events from a number of groups
        if(!empty($whereclause)) $whereclause .= ' OR';
@@ -427,6 +429,8 @@ function calendar_sql_where($tstart, $tend, $users, $groups, $courses, $withdura
        if(!empty($whereclause)) $whereclause .= ' OR ';
        $whereclause .= ' groupid != 0';
    }
+    // boolean false (no groups at all): we don't need to do anything
+
    if(is_array($courses)) {
        // A number of courses (maybe none at all!)
        if(!empty($courses)) {
@@ -451,6 +455,14 @@ function calendar_sql_where($tstart, $tend, $users, $groups, $courses, $withdura
        $whereclause .= ' groupid = 0 AND courseid != 0';
    }

+    // Security check: if, by now, we have NOTHING in $whereclause, then it means
+    // that NO event-selecting clauses were defined. Thus, we won't be returning ANY
+    // events no matter what. Allowing the code to proceed might return a completely
+    // valid query with only time constraints, thus selecting ALL events in that time frame!
+    if(empty($whereclause)) {
+        return false;
+    }
+
    if ($ignorehidden) {
        if (!empty($whereclause)) $whereclause .= ' AND';
        $whereclause .= ' visible = 1';
@@ -528,8 +540,8 @@ function calendar_top_controls($type, $data) {
        case 'day':
            $data['d'] = $date['mday']; // Just for convenience
            $dayname = calendar_wday_name($date['weekday']);
-            $prevdate = getdate($time - SECS_IN_DAY);
-            $nextdate = getdate($time + SECS_IN_DAY);
+            $prevdate = usergetdate(make_timestamp($data['y'], $data['m'], $data['d'] - 1));
+            $nextdate = usergetdate(make_timestamp($data['y'], $data['m'], $data['d'] + 1));
            $prevname = calendar_wday_name($prevdate['weekday']);
            $nextname = calendar_wday_name($nextdate['weekday']);
            $content .= "<table style='width: 100%;'><tr>\n";
@@ -597,7 +609,7 @@ function calendar_filter_controls($type, $vars = NULL, $course = NULL) {
        $content .= '<td style="width: 8px;"></td><td><a href="'.CALENDAR_URL.'set.php?var=showcourses'.$getvars.'" title="'.get_string('tt_showcourse', 'calendar').'">'.get_string('courseevents', 'calendar').'</a></td>'."\n";
    }

-    if(!empty($USER) && !isguest()) {
+    if(!empty($USER->id) && !isguest()) {
        $content .= "</tr>\n<tr>";

        if($groupevents) {
@@ -735,6 +747,9 @@ function calendar_get_sideblock_upcoming($events, $linkhref = NULL) {
    }

    for ($i = 0; $i < $lines; ++$i) {
+        if (!isset($events[$i]->time)) {   // Just for robustness
+            continue;
+        }
        $content .= '<div class="cal_event">'.$events[$i]->icon.' ';
        if (!empty($events[$i]->referer)) {
            // That's an activity event, so let's provide the hyperlink
@@ -802,10 +817,10 @@ function calendar_events_by_day($events, $month, $year, &$eventsbyday, &$duratio
            $eventsbyday[$eventdaystart][] = $event->id;

            // Mark the day as having such an event
-            if($event->courseid == 1 && $event->groupid == 0) {
+            if($event->courseid == SITEID && $event->groupid == 0) {
                $typesbyday[$eventdaystart]['startglobal'] = true;
            }
-            else if($event->courseid > 1 && $event->groupid == 0) {
+            else if($event->courseid != 0 && $event->courseid != SITEID && $event->groupid == 0) {
                $typesbyday[$eventdaystart]['startcourse'] = true;
            }
            else if($event->groupid) {
@@ -830,10 +845,10 @@ function calendar_events_by_day($events, $month, $year, &$eventsbyday, &$duratio
        // Mark all days between $lowerbound and $upperbound (inclusive) as duration
        for($i = $lowerbound + 1; $i <= $upperbound; ++$i) {
            $durationbyday[$i][] = $event->id;
-            if($event->courseid == 1 && $event->groupid == 0) {
+            if($event->courseid == SITEID && $event->groupid == 0) {
                $typesbyday[$i]['durationglobal'] = true;
            }
-            else if($event->courseid > 1 && $event->groupid == 0) {
+            else if($event->courseid != 0 && $event->courseid != SITEID && $event->groupid == 0) {
                $typesbyday[$i]['durationcourse'] = true;
            }
            else if($event->groupid) {
@@ -868,6 +883,19 @@ function calendar_get_course_cached(&$coursecache, $courseid) {
 function calendar_session_vars() {
    global $SESSION, $USER;

+    if(!empty($USER->id) && isset($USER->realuser) && !isset($SESSION->cal_loggedinas)) {
+        // We just logged in as someone else, update the filtering
+        unset($SESSION->cal_users_shown);
+        unset($SESSION->cal_courses_shown);
+        $SESSION->cal_loggedinas = true;
+    }
+    else if(!empty($USER->id) && !isset($USER->realuser) && isset($SESSION->cal_loggedinas)) {
+        // We just logged back to our real self, update again
+        unset($SESSION->cal_users_shown);
+        unset($SESSION->cal_courses_shown);
+        unset($SESSION->cal_loggedinas);
+    }
+
    if(!isset($SESSION->cal_course_referer)) {
        $SESSION->cal_course_referer = 0;
    }
@@ -932,11 +960,11 @@ function calendar_set_filters(&$courses, &$group, &$user, $courseeventsfrom = NU

    if(($SESSION->cal_show_course && $SESSION->cal_show_global) || $ignorefilters) {
        if(is_int($courseeventsfrom)) {
-            $courses = array(1, $courseeventsfrom);
+            $courses = array(SITEID, $courseeventsfrom);
        }
        else if(is_array($courseeventsfrom)) {
            $courses = array_keys($courseeventsfrom);
-            $courses[] = 1;
+            $courses[] = SITEID;
        }
    }
    else if($SESSION->cal_show_course) {
@@ -1001,13 +1029,13 @@ function calendar_set_filters(&$courses, &$group, &$user, $courseeventsfrom = NU
 function calendar_edit_event_allowed($event) {
    global $USER;

-    if(empty($USER) || isguest($USER->id)) {
+    if(empty($USER->id) || isguest($USER->id)) {
        return false;
    }

    if (isadmin($USER->id)) return true; // Admins are allowed anything

-    if ($event->courseid > 1) {
+    if ($event->courseid != 0 && $event->courseid != SITEID) {
        // Course event, only editing teachers may... edit :P
        if(isteacheredit($event->courseid)) {
            return true;
@@ -1033,10 +1061,10 @@ function calendar_get_default_courses($ignoreref = false) {
    global $USER, $CFG, $SESSION;

    if(!empty($SESSION->cal_course_referer) && !$ignoreref) {
-        return array($SESSION->cal_course_referer => 1);
+        return array($SESSION->cal_course_referer => SITEID);
    }

-    if(empty($USER)) {
+    if(empty($USER->id)) {
        return array();
    }

@@ -1054,40 +1082,6 @@ function calendar_get_default_courses($ignoreref = false) {
    return $courses;
 }

-function calendar_get_tz_offset() {
-    global $USER, $CFG;
-    static $tzfix;
-
-    // Caching
-    if(isset($tzfix)) {
-        return $tzfix;
-    }
-
-    if(empty($USER)) {
-        // Don't forget that there are users which have NOT logged in, even as guests
-        $timezone = $CFG->timezone;
-    }
-    else {
-        // If, on the other hand, we do have a user...
-        $timezone = $USER->timezone;
-        if(abs($timezone > 13)) {
-            // But if the user has specified 'server default' time,
-            // don't get the server's; get the Moodle $CFG setting
-            // (Martin's help text on site cfg implies this)
-            $timezone = $CFG->timezone;
-        }
-    }
-
-    if(abs($timezone) <= 13) {
-        $tzfix = $timezone * 3600;
-    }
-    else {
-        $tzfix = date('Z');
-    }
-
-    return $tzfix;
-}
-
 function calendar_preferences_array() {
    return array(
        'startwday' => get_string('pref_startwday', 'calendar'),
@@ -44,11 +44,7 @@
    require_once($CFG->dirroot.'/course/lib.php');
    require_once($CFG->dirroot.'/calendar/lib.php');

-    optional_variable($_GET['view'], 'upcoming');
    optional_variable($_GET['course'], 0);
-    optional_variable($_GET['cal_d']);
-    optional_variable($_GET['cal_m']);
-    optional_variable($_GET['cal_y']);

    if(!$site = get_site()) {
        redirect($CFG->wwwroot.'/'.$CFG->admin.'/index.php');
@@ -60,10 +56,11 @@

    $nav = calendar_get_link_tag(get_string('calendar', 'calendar'), CALENDAR_URL.'view.php?view=upcoming&amp;', $now['mday'], $now['mon'], $now['year']);

-    // Make sure that the GET variables are correct
-    $day = intval($_GET['cal_d']);
-    $mon = intval($_GET['cal_m']);
-    $yr = intval($_GET['cal_y']);
+    $view = optional_param('view', 'upcoming');
+    $day = optional_param('cal_d', 0, PARAM_INT);
+    $mon = optional_param('cal_m', 0, PARAM_INT);
+    $yr  = optional_param('cal_y', 0, PARAM_INT);
+    
    if(!checkdate($mon, $day, $yr)) {
        $day = intval($now['mday']);
        $mon = intval($now['mon']);
@@ -71,7 +68,7 @@
    }
    $time = mktime(0, 0, 0, $mon, $day, $yr);

-    switch($_GET['view']) {
+    switch($view) {
        case 'day':
            $text = strftime(get_string('strftimedate'), $time);
            if($text[0] == '0') {
@@ -105,7 +102,7 @@
        }
    }

-    if (empty($USER) or isguest()) {
+    if (empty($USER->id) or isguest()) {
        $defaultcourses = calendar_get_default_courses();
        calendar_set_filters($courses, $groups, $users, $defaultcourses, $defaultcourses);

@@ -139,7 +136,7 @@

    echo '<td style="vertical-align: top; width: 100%;">';

-    switch($_GET['view']) {
+    switch($view) {
        case 'day':
            calendar_show_day($day, $mon, $yr, $courses, $groups, $users);
        break;
@@ -161,7 +158,7 @@
    list($prevmon, $prevyr) = calendar_sub_month($mon, $yr);
    list($nextmon, $nextyr) = calendar_add_month($mon, $yr);
    $getvars = 'cal_d='.$day.'&amp;cal_m='.$mon.'&amp;cal_y='.$yr; // For filtering
-    echo calendar_filter_controls($_GET['view'], $getvars);
+    echo calendar_filter_controls($view, $getvars);
    echo '<p>';
    echo calendar_top_controls('display', array('m' => $prevmon, 'y' => $prevyr));
    echo calendar_get_mini($courses, $groups, $users, $prevmon, $prevyr);
@@ -193,12 +190,12 @@ function calendar_show_day($d, $m, $y, $courses, $groups, $users) {
    $getvars = 'from=day&amp;cal_d='.$d.'&amp;cal_m='.$m.'&amp;cal_y='.$y; // For filtering

    $starttime = make_timestamp($y, $m, $d);
-    $endtime   = $starttime + SECS_IN_DAY - 1;
+    $endtime   = make_timestamp($y, $m, $d + 1) - 1;

    $events = calendar_get_upcoming($courses, $groups, $users, 1, 100, $starttime);

    // New event button
-    if (empty($USER) || isguest()) {
+    if (empty($USER->id) || isguest()) {
        $text = get_string('dayview', 'calendar').': '.calendar_course_filter_selector($getvars);
    } else {
        $text = '<div style="float: left;">'.get_string('dayview', 'calendar').': '.
@@ -312,14 +309,14 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users) {
        $events = array();
    }
    else {
-        $events = get_records_select('event', $whereclause);
+        $events = get_records_select('event', $whereclause, 'timestart');
    }

    // Extract information: events vs. time
    calendar_events_by_day($events, $m, $y, $eventsbyday, $durationbyday, $typesbyday);

    // New event button
-    if(empty($USER) || isguest()) {
+    if(empty($USER->id) || isguest()) {
        $text = get_string('detailedmonthview', 'calendar').': '.calendar_course_filter_selector($getvars);
    }
    else {
@@ -482,7 +479,7 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users) {

    echo "</tr>\n";

-    if(!empty($USER) && !isguest()) {
+    if(!empty($USER->id) && !isguest()) {
        echo '<tr>';
        // Group events
        if($SESSION->cal_show_groups) {
@@ -515,7 +512,7 @@ function calendar_show_upcoming_events($courses, $groups, $users, $futuredays, $
    $events = calendar_get_upcoming($courses, $groups, $users, $futuredays, $maxevents);

    // New event button
-    if(empty($USER) || isguest()) {
+    if(empty($USER->id) || isguest()) {
        $text = get_string('upcomingevents', 'calendar').': '.calendar_course_filter_selector('from=upcoming');

    } else {
@@ -544,7 +541,7 @@ function calendar_show_upcoming_events($courses, $groups, $users, $futuredays, $


 function calendar_print_event($event) {
-    global $CFG, $THEME;
+    global $CFG, $THEME, $USER;

    static $strftimetime;

@@ -582,8 +579,8 @@ function calendar_print_event($event) {
            $editlink   = CALENDAR_URL.'event.php?action=edit&amp;id='.$event->id;
            $deletelink = CALENDAR_URL.'event.php?action=delete&amp;id='.$event->id;
        } else {
-            $editlink   = $CFG->wwwroot.'/course/mod.php?update='.$event->cmid.'&amp;return=true';
-            $deletelink = $CFG->wwwroot.'/course/mod.php?delete='.$event->cmid;
+            $editlink   = $CFG->wwwroot.'/course/mod.php?update='.$event->cmid.'&amp;return=true&amp;sesskey='.$USER->sesskey;
+            $deletelink = $CFG->wwwroot.'/course/mod.php?delete='.$event->cmid.'&amp;sesskey='.$USER->sesskey;;
        }
        echo ' <a href="'.$editlink.'"><img
                  src="'.$CFG->pixpath.'/t/edit.gif" alt="'.get_string('tt_editevent', 'calendar').'"
@@ -601,12 +598,12 @@ function calendar_print_event($event) {
 function calendar_course_filter_selector($getvars = '') {
    global $USER, $SESSION;

-    if (empty($USER) or isguest()) {
+    if (empty($USER->id) or isguest()) {
        return '';
    }

    if (isadmin()) {
-        $courses = get_courses('all', 'c.shortname');
+        $courses = get_courses('all', 'c.shortname','c.id,c.shortname');
    } else {
        $courses = get_my_courses($USER->id, 'shortname');
    }
@@ -177,6 +177,24 @@ $CFG->admin = 'admin';
 // then all addresses are ALLOWED EXCEPT those listed.
 //      $CFG->allowemailaddresses = "myschool.edu.au hotmail.com";
 //      $CFG->denyemailaddresses = "hotmail.com yahoo.com";
+//
+// The following setting will tell Moodle to respect your PHP session 
+// settings. Use this if you want to control session configuration
+// from php.ini, httpd.conf or .htaccess files. 
+//     $CFG->respectsessionsettings = true;
+//
+// Generating the language menu consumes a *lot* of memory and queries a 
+// lot of files. if you are looking for performance, and not adding/removing
+// languages often, enable the language menu cache. With the cache enabled, 
+// Moodle only refreshes the list of languages every few invocations of the 
+// cron script. For maximum efficiency, make sure your cron is called from the 
+// commandline, not via HTTP.  
+//     $CFG->langcache = true;
+//
+// The following setting will turn SQL Error logging on. This will output an
+// entry in apache error log indicating the position of the error and the statement
+// called. This option will action disregarding error_reporting setting.
+//     $CFG->dblogerror = true;

 //=========================================================================
 // ALL DONE!  To continue installation, visit your main page with a browser
@@ -23,7 +23,7 @@
    }

    if (iscreator()) {
-        if (isset($_GET['edit'])) {
+        if (isset($_GET['edit']) and confirm_sesskey()) {
            if ($edit == "on") {
                $USER->categoryediting = true;
            } else if ($edit == "off") {
@@ -47,7 +47,7 @@

    if (isadmin()) {
        /// Rename the category if requested
-        if (!empty($_POST['rename'])) {
+        if (!empty($_POST['rename']) and confirm_sesskey()) {
            $category->name = $_POST['rename'];
            if (! set_field("course_categories", "name", $category->name, "id", $category->id)) {
                notify("An error occurred while renaming the category");
@@ -56,14 +56,19 @@

        /// Resort the category if requested

-        if (!empty($_GET['resort'])) {
-            if ($courses = get_courses($category->id, "fullname ASC")) {
-                $count = 0;
+        if (!empty($_GET['resort']) and confirm_sesskey()) {
+            if ($courses = get_courses($category->id, "fullname ASC", 'c.id,c.fullname,c.sortorder')) {
+                // move it off the range
+                $count = get_record_sql('SELECT MAX(sortorder) AS max, 1
+                                         FROM ' . $CFG->prefix . 'course WHERE category=' . $category->id);
+                $count = $count->max + 100;
+                begin_sql();
                foreach ($courses as $course) {
                    set_field('course', 'sortorder', $count, 'id', $course->id);
                    $count++;
                }
-                fix_course_sortorder();
+                commit_sql();
+                fix_course_sortorder($category->id);
            }
        }
    }
@@ -114,7 +119,7 @@

    /// Move a specified course to a new category 

-        if (isset($moveto) and $data = data_submitted()) {   // Some courses are being moved
+        if (isset($moveto) and $data = data_submitted() and confirm_sesskey()) {   // Some courses are being moved

            if (! $destcategory = get_record("course_categories", "id", $data->moveto)) {
                error("Error finding the category");
@@ -122,15 +127,37 @@

            unset($data->moveto);
            unset($data->id);
+            unset($data->sesskey);

            if ($data) {
                foreach ($data as $code => $junk) {
+ 
                    $courseid = substr($code, 1);

                    if (! $course  = get_record("course", "id", $courseid)) {
                        notify("Error finding course $courseid");
                    } else {
-                        if (!set_field("course", "category", $destcategory->id, "id", $course->id)) {
+                        // figure out a sortorder that we can use in the destination category
+                        $sortorder = get_field_sql('SELECT MIN(sortorder)-1 AS min
+                                                    FROM ' . $CFG->prefix . 'course WHERE category=' . $destcategory->id);
+                        if ($sortorder < 1) { 
+                            // rather than let the db default to 0
+                            // set it to > 100 and avoid extra work in fix_coursesortorder()
+                            $sortorder = 200;
+                        }
+
+                        $course->category  = $destcategory->id;
+                        $course->sortorder = $sortorder;
+                        $course->fullname = addslashes($course->fullname);
+                        $course->shortname = addslashes($course->shortname);
+                        $course->summary = addslashes($course->summary);
+                        $course->password = addslashes($course->password);
+                        $course->teacher = addslashes($course->teacher);
+                        $course->teachers = addslashes($course->teachers);
+                        $course->student = addslashes($course->student);
+                        $course->students = addslashes($course->students);
+ 
+                        if (!update_record('course', $course)) {
                            notify("An error occurred - course not moved!");
                        }
                        fix_course_sortorder();
@@ -143,7 +170,7 @@

    /// Hide or show a course 
    
-        if (isset($hide) or isset($show)) {
+        if ((isset($hide) or isset($show)) and confirm_sesskey()) {
            if (isset($hide)) {
                $course = get_record("course", "id", $hide);
                $visible = 0;
@@ -161,54 +188,44 @@

    /// Move a course up or down

-        if (isset($moveup) or isset($movedown)) {
+        if ((isset($moveup) or isset($movedown)) and confirm_sesskey()) {

            $movecourse = NULL;
            $swapcourse = NULL;

-            $courses = get_courses($category->id);
-
+            // ensure the course order has no gaps
+            // and isn't at 0
+            fix_course_sortorder($category->id);
+            
+            // we are going to need to know the range
+            $max = get_record_sql('SELECT MAX(sortorder) AS max, 1
+                                         FROM ' . $CFG->prefix . 'course WHERE category=' . $category->id);
+            $max = $max->max + 100;
+            
            if (isset($moveup)) {
-                if ($movecourse = get_record("course", "id", $moveup)) {
-                    foreach ($courses as $course) {
-                        if ($course->id == $movecourse->id) {
-                            break;
-                        }
-                        $swapcourse = $course;
-                    }
-                }
-            }
-            if (isset($movedown)) {
-                if ($movecourse = get_record("course", "id", $movedown)) {
-                    $choosenext = false;
-                    foreach ($courses as $course) {
-                        if ($choosenext) {
-                            $swapcourse = $course;
-                            break;
-                        }
-                        if ($course->id == $movecourse->id) {
-                            $choosenext = true;
-                        }
-                    }
-                }
+                $movecourse = get_record('course', 'id', $moveup);
+                $swapcourse = get_record('course', 
+                                         'category',  $category->id, 
+                                         'sortorder', $movecourse->sortorder - 1);
+            } else {
+                $movecourse = get_record('course', 'id', $movedown);
+                $swapcourse = get_record('course', 
+                                         'category',  $category->id, 
+                                         'sortorder', $movecourse->sortorder + 1);
            }
+            
            if ($swapcourse and $movecourse) {        // Renumber everything for robustness
-                $count=0;
-                foreach ($courses as $course) {
-                    $count++;
-                    if ($course->id == $swapcourse->id) {
-                        $course = $movecourse;
-                    } else if ($course->id == $movecourse->id) {
-                        $course = $swapcourse;
-                    }
-                    if (! set_field("course", "sortorder", $count, "id", $course->id)) {
-                        notify("Could not update that course!");
-                    }
+                begin_sql();
+                if (!(    set_field("course", "sortorder", $max, "id", $swapcourse->id)
+                       && set_field("course", "sortorder", $swapcourse->sortorder, "id", $movecourse->id)
+                       && set_field("course", "sortorder", $movecourse->sortorder, "id", $swapcourse->id)
+                    )) {
+                    notify("Could not update that course!");
                }
+                commit_sql();
            }
-        }

-        fix_course_sortorder();
+        }

    } // End of editing stuff

@@ -238,7 +255,9 @@
 /// Print out all the courses
    unset($course);    // To avoid unwanted language effects later

-    $courses = get_courses_page($category->id, "c.sortorder ASC", "c.*", $totalcount, $page*$perpage, $perpage);
+    $courses = get_courses_page($category->id, 'c.sortorder ASC', 
+                                'c.id,c.sortorder,c.shortname,c.fullname,c.summary,c.visible,c.teacher,c.guest,c.password', 
+                                $totalcount, $page*$perpage, $perpage);
    $numcourses = count($courses);

    if (!$courses) {
@@ -274,6 +293,7 @@
        }

        echo "<form name=\"movecourses\" action=\"category.php\" method=\"post\">";
+        echo "<input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\">";
        echo "<table align=\"center\" border=0 cellspacing=2 cellpadding=4 class=\"generalbox\"><tr>";
        echo "<th>$strcourses</th>";
        if ($creatorediting) {
@@ -308,10 +328,10 @@
                    echo "<a title=\"$strdelete\" href=\"delete.php?id=$acourse->id\"><img".
                         " src=\"$pixpath/t/delete.gif\" height=11 width=11 border=0></a> ";
                    if (!empty($acourse->visible)) {
-                        echo "<a title=\"$strhide\" href=\"category.php?id=$category->id&hide=$acourse->id\"><img".
+                        echo "<a title=\"$strhide\" href=\"category.php?id=$category->id&page=$page&hide=$acourse->id&amp;sesskey=$USER->sesskey\"><img".
                             " src=\"$pixpath/t/hide.gif\" height=11 width=11 border=0></a> ";
                    } else {
-                        echo "<a title=\"$strshow\" href=\"category.php?id=$category->id&show=$acourse->id\"><img".
+                        echo "<a title=\"$strshow\" href=\"category.php?id=$category->id&page=$page&show=$acourse->id&amp;sesskey=$USER->sesskey\"><img".
                             " src=\"$pixpath/t/show.gif\" height=11 width=11 border=0></a> ";
                    }
    
@@ -322,14 +342,14 @@
                             " src=\"$pixpath/t/restore.gif\" height=11 width=11 border=0></a> ";
            
                    if ($up) {
-                        echo "<a title=\"$strmoveup\" href=\"category.php?id=$category->id&moveup=$acourse->id\"><img".
+                        echo "<a title=\"$strmoveup\" href=\"category.php?id=$category->id&page=$page&moveup=$acourse->id&amp;sesskey=$USER->sesskey\"><img".
                             " src=\"$pixpath/t/up.gif\" height=11 width=11 border=0></a> ";
                    } else {
                        echo "<img src=\"$CFG->wwwroot/pix/spacer.gif\" height=11 width=11 border=0></a> ";
                    }
        
                    if ($down) {
-                        echo "<a title=\"$strmovedown\" href=\"category.php?id=$category->id&movedown=$acourse->id\"><img".
+                        echo "<a title=\"$strmovedown\" href=\"category.php?id=$category->id&page=$page&movedown=$acourse->id&amp;sesskey=$USER->sesskey\"><img".
                             " src=\"$pixpath/t/down.gif\" height=11 width=11 border=0></a> ";
                    } else {
                        echo "<img src=\"$CFG->wwwroot/pix/spacer.gif\" height=11 width=11 border=0></a> ";
@@ -350,13 +370,13 @@
                echo "</td>";
            } else {
                echo "<td align=\"right\">";
-                if ($acourse->guest ) {
+                if (!empty($acourse->guest)) {
                    echo "<a href=\"view.php?id=$acourse->id\"><img hspace=2 title=\"$strallowguests\" alt=\"\" height=16 width=16 border=0 src=\"$pixpath/i/user.gif\"></a>";
                }
-                if ($acourse->password) {
+                if (!empty($acourse->password)) {
                    echo "<a href=\"view.php?id=$acourse->id\"><img hspace=2 title=\"$strrequireskey\" alt=\"\" height=16 width=16 border=0 src=\"$pixpath/i/key.gif\"></a>";
                }
-                if ($acourse->summary) {
+                if (!empty($acourse->summary)) {
                    link_to_popup_window ("/course/info.php?id=$acourse->id", "courseinfo", 
                                          "<img hspace=2 alt=\"info\" height=16 width=16 border=0 src=\"$pixpath/i/info.gif\">", 
                                           400, 500, $strsummary);
@@ -386,6 +406,7 @@
        unset($options);
        $options["id"] = $category->id;
        $options["resort"] = "name";
+        $options["sesskey"] = $USER->sesskey;
        print_single_button("category.php", $options, get_string("resortcoursesbyname"), "get");
    }

@@ -400,6 +421,7 @@
        $strrename= get_string("rename");
        echo "<form name=\"renameform\" action=\"category.php\" method=\"post\">";
        echo "<input type=\"hidden\" name=\"id\" value=\"$category->id\">";
+        echo "<input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\">";
        echo "<input type=\"text\" size=30 name=\"rename\" value=\"".s($category->name)."\">";
        echo "<input type=\"submit\" value=\"$strrename\">";
        echo "</form>";
@@ -38,7 +38,7 @@
                     "$strdeletecheck");

        notice_yesno("$strdeletecoursecheck<BR><BR>$course->fullname ($course->shortname)", 
-                     "delete.php?id=$course->id&delete=".md5($course->timemodified), 
+                     "delete.php?id=$course->id&delete=".md5($course->timemodified)."&sesskey=$USER->sesskey", 
                     "category.php?id=$course->category");
        exit;
    }
@@ -47,6 +47,10 @@
        error("The check variable was wrong - try again");
    }

+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
    // OK checks done, delete the course now.
    $strdeletingcourse = get_string("deletingcourse", "", $course->shortname);

@@ -260,4 +260,5 @@
    <td><input type="submit" value="<?php  print_string("savechanges") ?>"></td>
 </table>
 <input type="hidden" name="id" value="<?php echo $form->id ?>">
+<input type="hidden" name="sesskey" value="<?php echo $form->sesskey ?>">
 </form>
@@ -5,8 +5,8 @@
    require_once("lib.php");
    require_once("$CFG->libdir/blocklib.php");

-    optional_variable($id, 0);   // course id
-    optional_variable($category, 0);   // category id
+    $id       = (int)optional_param('id', 0);         // course id
+    $category = (int)optional_param('category', 0);   // possible default category

    require_login();

@@ -36,7 +36,7 @@

 /// If data submitted, then process and store.

-    if ($form = data_submitted()) {
+    if ($form = data_submitted() and confirm_sesskey()) {

        if (empty($course)) {
            check_for_restricted_user($USER->username, "$CFG->wwwroot");
@@ -46,6 +46,8 @@

        $form->startdate = make_timestamp($form->startyear, $form->startmonth, $form->startday);

+        $form->format = optional_param('format', 'social', PARAM_ALPHA);
+
        validate_form($course, $form, $err);

        if (count($err) == 0) {
@@ -75,6 +77,13 @@
                    //For topics and weeks formats (default built in the function)
                    $form->blockinfo = blocks_get_default_blocks();
                }
+                
+                // place at beginning of category
+                fix_course_sortorder();
+                $form->sortorder = get_field_sql("SELECT min(sortorder)-1 FROM {$CFG->prefix}course WHERE category=$form->category");
+                if (empty($form->sortorder)) {
+                    $form->sortorder = 100;
+                }

                if ($newcourseid = insert_record("course", $form)) {  // Set up new course
                    $section = NULL;
@@ -103,6 +112,8 @@
                        $USER->teacher[$newcourseid] = true;
                        $USER->teacheredit[$newcourseid] = true;

+                        fix_course_sortorder();
+
                        redirect("view.php?id=$newcourseid", get_string("changessaved"));
                    }

@@ -187,6 +198,8 @@
                     "<a href=\"index.php\">$strcategories</a> -> $straddnewcourse", $focus);
    }

+    $form->sesskey = !empty($USER->id) ? $USER->sesskey : '';
+
    print_heading($streditcoursesettings);
    print_simple_box_start("center", "", "$THEME->cellheading");
    include("edit.html");
@@ -22,6 +22,7 @@
 </tr>
 </table>
 <input type="hidden" name=id value="<?php echo $form->id ?>">
+<input type="hidden" name=sesskey value="<?php echo $form->sesskey ?>">
 <input type="submit" value="<?php print_string("savechanges") ?>">
 </form>
 </center>
@@ -23,7 +23,7 @@

 /// If data submitted, then process and store.

-    if ($form = data_submitted()) {
+    if ($form = data_submitted() and confirm_sesskey()) {

        $timenow = time();

@@ -43,6 +43,8 @@
        $form = $section;
    }

+    $form->sesskey = !empty($USER->id) ? $USER->sesskey : '';
+
    $usehtmleditor = can_use_html_editor();

    $sectionname = get_string("name$course->format");
@@ -33,16 +33,16 @@

    echo "<td width=\"*\" valign=\"top\">";
    if ($social = forum_get_course_forum($course->id, "social")) {
-        if (forum_is_subscribed($USER->id, $social->id)) {
-            $subtext = get_string("unsubscribe", "forum");
+        if (forum_is_forcesubscribed($social->id)) {
+            $subtext = get_string('everyoneissubscribed', 'forum');
+        } else if (forum_is_subscribed($USER->id, $social->id)) {
+            $subtext = '<a href="../mod/forum/subscribe.php?id='.$social->id.'">'.get_string('unsubscribe', 'forum').'</a>';
        } else {
-            $subtext = get_string("subscribe", "forum");
+            $subtext = '<a href="../mod/forum/subscribe.php?id='.$social->id.'">'.get_string('subscribe', 'forum').'</a>';
        }
        $headertext = "<table border=0 width=100% cellpadding=0 cellspacing=0 class=headingblockcontent><tr><td>".
                       get_string("socialheadline").
-                       "</td><td align=right><font size=1>".
-                       "<a href=\"../mod/forum/subscribe.php?id=$social->id\">$subtext</a></td>".
-                       "</tr></table>";
+                       "</td><td align=right><font size='1'>$subtext</font></td></tr></table>";
        print_heading_block($headertext);
        echo "<img alt=\"\" height=7 src=\"../pix/spacer.gif\"><br>";

@@ -31,7 +31,7 @@
        }
    }

-    if (isteacher($course->id) and isset($marker)) {
+    if (isteacher($course->id) and isset($marker) and confirm_sesskey()) {
        $course->marker = $marker;
        if (! set_field("course", "marker", $marker, "id", $course->id)) {
            error("Could not mark that topic for this course");
@@ -84,7 +84,7 @@
        echo "<tr>";
        echo "<td colspan=3 valign=top bgcolor=\"$THEME->cellcontent\" class=\"topicoutlineclip\" width=\"100%\">";
        echo "<p><font size=2>";
-        echo "$stractivityclipboard&nbsp;&nbsp;(<a href=\"mod.php?cancelcopy=true\">$strcancel</a>)";
+        echo "$stractivityclipboard&nbsp;&nbsp;(<a href=\"mod.php?cancelcopy=true&amp;sesskey=$USER->sesskey\">$strcancel</a>)";
        echo "</font></p>";
        echo "</td>";
        echo "</tr>";
@@ -226,28 +226,28 @@

            if (isediting($course->id)) {
                if ($course->marker == $section) {  // Show the "light globe" on/off
-                    echo "<a href=\"view.php?id=$course->id&marker=0\" title=\"$strmarkedthistopic\">".
+                    echo "<a href=\"view.php?id=$course->id&marker=0&sesskey=$USER->sesskey\" title=\"$strmarkedthistopic\">".
                         "<img src=\"$CFG->pixpath/i/marked.gif\" vspace=3 height=16 width=16 border=0></a><br />";
                } else {
-                    echo "<a href=\"view.php?id=$course->id&marker=$section\" title=\"$strmarkthistopic\">".
+                    echo "<a href=\"view.php?id=$course->id&marker=$section&sesskey=$USER->sesskey\" title=\"$strmarkthistopic\">".
                         "<img src=\"$CFG->pixpath/i/marker.gif\" vspace=3 height=16 width=16 border=0></a><br />";
                }

                if ($thissection->visible) {        // Show the hide/show eye
-                    echo "<a href=\"view.php?id=$course->id&hide=$section\" title=\"$strtopichide\">".
+                    echo "<a href=\"view.php?id=$course->id&hide=$section&sesskey=$USER->sesskey\" title=\"$strtopichide\">".
                         "<img src=\"$CFG->pixpath/i/hide.gif\" vspace=3 height=16 width=16 border=0></a><br />";
                } else {
-                    echo "<a href=\"view.php?id=$course->id&show=$section\" title=\"$strtopicshow\">".
+                    echo "<a href=\"view.php?id=$course->id&show=$section&sesskey=$USER->sesskey\" title=\"$strtopicshow\">".
                         "<img src=\"$CFG->pixpath/i/show.gif\" vspace=3 height=16 width=16 border=0></a><br />";
                }

                if ($section > 1) {                       // Add a arrow to move section up
-                    echo "<a href=\"view.php?id=$course->id&section=$section&move=-1\" title=\"$strmoveup\">".
+                    echo "<a href=\"view.php?id=$course->id&section=$section&move=-1&sesskey=$USER->sesskey\" title=\"$strmoveup\">".
                         "<img src=\"$CFG->pixpath/t/up.gif\" vspace=3 height=11 width=11 border=0></a><br />";
                }

                if ($section < $course->numsections) {    // Add a arrow to move section down
-                    echo "<a href=\"view.php?id=$course->id&section=$section&move=1\" title=\"$strmovedown\">".
+                    echo "<a href=\"view.php?id=$course->id&section=$section&move=1&sesskey=$USER->sesskey\" title=\"$strmovedown\">".
                         "<img src=\"$CFG->pixpath/t/down.gif\" vspace=3 height=11 width=11 border=0></a><br />";
                }

@@ -61,7 +61,7 @@
    }

 /// Start main column
-    echo "</td><td width=\"*\">";
+    echo "<td width=\"*\">";
    print_heading_block(get_string("weeklyoutline"), "100%", "outlineheadingblock");
    print_spacer(8, 1, true);

@@ -74,7 +74,7 @@
        echo "<tr>";
        echo "<td colspan=3 valign=top bgcolor=\"$THEME->cellcontent\" class=\"weeklyoutlineclip\" width=\"100%\">";
        echo "<p><font size=2>";
-        echo "$stractivityclipboard&nbsp;&nbsp;(<a href=\"mod.php?cancelcopy=true\">$strcancel</a>)";
+        echo "$stractivityclipboard&nbsp;&nbsp;(<a href=\"mod.php?cancelcopy=true&amp;sesskey=$USER->sesskey\">$strcancel</a>)";
        echo "</font></p>";
        echo "</td>";
        echo "</tr>";
@@ -219,20 +219,20 @@
    
            if (isediting($course->id)) {
                if ($thissection->visible) {        // Show the hide/show eye
-                    echo "<a href=\"view.php?id=$course->id&hide=$section\" title=\"$strweekhide\">".
+                    echo "<a href=\"view.php?id=$course->id&hide=$section&sesskey=$USER->sesskey\" title=\"$strweekhide\">".
                         "<img src=\"$CFG->pixpath/i/hide.gif\" vspace=3 height=16 width=16 border=0></a><br />";
                } else {
-                    echo "<a href=\"view.php?id=$course->id&show=$section\" title=\"$strweekshow\">".
+                    echo "<a href=\"view.php?id=$course->id&show=$section&sesskey=$USER->sesskey\" title=\"$strweekshow\">".
                         "<img src=\"$CFG->pixpath/i/show.gif\" vspace=3 height=16 width=16 border=0></a><br />";
                }
    
                if ($section > 1) {                       // Add a arrow to move section up
-                    echo "<a href=\"view.php?id=$course->id&section=$section&move=-1\" title=\"$strmoveup\">".
+                    echo "<a href=\"view.php?id=$course->id&section=$section&move=-1&sesskey=$USER->sesskey\" title=\"$strmoveup\">".
                         "<img src=\"$CFG->pixpath/t/up.gif\" vspace=3 height=11 width=11 border=0></a><br />";
                }
    
                if ($section < $course->numsections) {    // Add a arrow to move section down
-                    echo "<a href=\"view.php?id=$course->id&section=$section&move=1\" title=\"$strmovedown\">".
+                    echo "<a href=\"view.php?id=$course->id&section=$section&move=1&sesskey=$USER->sesskey\" title=\"$strmovedown\">".
                         "<img src=\"$CFG->pixpath/t/down.gif\" vspace=3 height=11 width=11 border=0></a><br />";
                }
    
@@ -141,7 +141,7 @@


 /// OK, we have all the data, now present it to the user
-    if ($download == "xls") {
+    if ($download == "xls" and confirm_sesskey()) {
        require_once("../lib/excel/Worksheet.php");
        require_once("../lib/excel/Workbook.php");

@@ -199,7 +199,7 @@
    
        exit;

-    } else if ($download == "txt") {
+    } else if ($download == "txt" and confirm_sesskey()) {

 /// Print header to force download

@@ -254,9 +254,11 @@
        echo "<TD>";
        $options["id"] = "$course->id";
        $options["download"] = "xls";
+        $options["sesskey"] = $USER->sesskey;
        print_single_button("grades.php", $options, get_string("downloadexcel"));
        echo "<TD>";
        $options["download"] = "txt";
+        $options["sesskey"] = $USER->sesskey;
        print_single_button("grades.php", $options, get_string("downloadtext"));
        echo "</TABLE>";
    
@@ -50,4 +50,5 @@

 <input type="hidden" name="group" value="<?php p($group->id) ?>"> 
 <input type="hidden" name="id" value="<?php p($course->id) ?>"> 
+<input type="hidden" name="sesskey" value="<?php p($sesskey) ?>"> 
 </form>
@@ -58,7 +58,7 @@

 /// If data submitted, then process and store.

-    if ($form = data_submitted()) { 
+    if ($form = data_submitted() and confirm_sesskey()) { 

        if (empty($form->name)) {
            $edit = true;
@@ -92,6 +92,8 @@
            $defaultformat = FORMAT_MOODLE;
        }

+        $sesskey = !empty($USER->id) ? $USER->sesskey : '';
+
        include('group-edit.html');

        if ($usehtmleditor) {
@@ -87,6 +87,7 @@ function groupWindow(selectgroup) {
        <form name="form1" id="form1" method="post" action="groups.php">
          <input type="hidden" name="id" value="<?php p($course->id) ?>" />
          <input type="hidden" name="groupid" value="<?php p($selectedgroup) ?>" />
+          <input type="hidden" name="sesskey" value="<?php p($sesskey) ?>">
          <select name="nonmembers[]" size="15" multiple="multiple">
            <?php 
                if (!empty($nonmembers)) {
@@ -113,6 +114,7 @@ function groupWindow(selectgroup) {
      <td class="generalboxcontent"><p>
        <form name="form2" id="form2" method="post" action="groups.php">
          <input type="hidden" name="id" value="<?php p($course->id) ?>" />
+          <input type="hidden" name="sesskey" value="<?php p($sesskey) ?>">
          <select name="groups" size="15" onChange="updateMembers(this)">
            <?php 
                if (!empty($listgroups)) {
@@ -146,6 +148,7 @@ function groupWindow(selectgroup) {
        <form name="form3" id="form3" method="post" action="groups.php">
          <input type="hidden" name="id" value="<?php p($course->id) ?>" />
          <input type="hidden" name="groupid" value="<?php p($selectedgroup) ?>" />
+          <input type="hidden" name="sesskey" value="<?php p($sesskey) ?>">
          <select name="members[]" size="15" multiple="multiple">
            <?php 
                if (!empty($members)) {
@@ -82,7 +82,7 @@

 /// We are in editing mode.  First, process any inputs there may be.

-    if ($data = data_submitted()) {
+    if ($data = data_submitted() and confirm_sesskey()) {

        if (!empty($data->nonmembersadd)) {            /// Add people to a group
            if (!empty($data->nonmembers) and !empty($data->groupid)) {
@@ -219,6 +219,8 @@
        $members = $listmembers[$selectedgroup];
    }

+    $sesskey = !empty($USER->id) ? $USER->sesskey : '';
+
 /// Print out the complete form

    include('groups-edit.html');
@@ -14,7 +14,7 @@
    }

    if (isadmin()) {
-        if (isset($_GET['edit'])) {
+        if (isset($_GET['edit']) and confirm_sesskey()) {
            if ($edit == "on") {
                $USER->categoriesediting = true;
            } else if ($edit == "off") {
@@ -84,7 +84,7 @@


 /// If data for a new category was submitted, then add it
-    if ($form = data_submitted()) {
+    if ($form = data_submitted() and confirm_sesskey()) {
        if (!empty($form->addcategory)) {
            unset($newcategory);
            $newcategory->name = $form->addcategory;
@@ -100,7 +100,7 @@

 /// Delete a category if necessary

-    if (isset($delete)) {
+    if (isset($delete) and confirm_sesskey()) {
        if ($deletecat = get_record("course_categories", "id", $delete)) {

            /// Send the children categories to live with their grandparent
@@ -145,7 +145,7 @@

 /// Move a category to a new parent if required

-    if (isset($move) and isset($moveto)) {
+    if (isset($move) and isset($moveto) and confirm_sesskey()) {
        if ($tempcat = get_record("course_categories", "id", $move)) {
            if ($tempcat->parent != $moveto) {
                if (! set_field("course_categories", "parent", $moveto, "id", $tempcat->id)) {
@@ -157,7 +157,7 @@


 /// Hide or show a category 
-    if (isset($hide) or isset($show)) {
+    if ((isset($hide) or isset($show)) and confirm_sesskey()) {
        if (isset($hide)) {
            $tempcat = get_record("course_categories", "id", $hide);
            $visible = 0;
@@ -178,7 +178,7 @@

 /// Move a category up or down

-    if (isset($moveup) or isset($movedown)) {
+    if ((isset($moveup) or isset($movedown)) and confirm_sesskey()) {
        
        $swapcategory = NULL;
        $movecategory = NULL;
@@ -237,7 +237,7 @@
    }

 /// Find any orphan courses that don't yet have a valid category and set to default
-    if ($courses = get_courses()) {
+    if ($courses = get_courses(NULL,NULL,'c.category,c.id,c.sortorder')) {
        foreach ($courses as $course) {
            if ($course->category and !isset($categories[$course->category])) {
                set_field("course", "category", $default, "id", $course->id);
@@ -253,6 +253,7 @@
    echo "<form name=\"addform\" action=\"index.php\" method=\"post\">";
    echo "<input type=\"text\" size=30 name=\"addcategory\">";
    echo "<input type=\"submit\" value=\"$straddnewcategory\">";
+    echo "<input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\">";
    echo "</form>";
    echo "</center>";

@@ -298,7 +299,7 @@
 function print_category_edit($category, $displaylist, $parentslist, $depth=-1, $up=false, $down=false) {
 /// Recursive function to print all the categories ready for editing

-    global $THEME, $CFG;
+    global $THEME, $CFG, $USER;

    static $str = '';
    static $pixpath = '';
@@ -327,7 +328,7 @@ function print_category_edit($category, $displaylist, $parentslist, $depth=-1, $
            echo "&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;";
        }
        $linkcss = $category->visible ? "" : " class=\"dimmed\" ";
-        echo "<a $linkcss title=\"$str->edit\" href=\"category.php?id=$category->id&edit=on\">$category->name</a>";
+        echo "<a $linkcss title=\"$str->edit\" href=\"category.php?id=$category->id&edit=on&sesskey=$USER->sesskey\">$category->name</a>";
        echo "</p>";
        echo "</td>";

@@ -335,23 +336,23 @@ function print_category_edit($category, $displaylist, $parentslist, $depth=-1, $

        echo "<td nowrap=\"nowrap\">";    /// Print little icons

-        echo "<a title=\"$str->delete\" href=\"index.php?delete=$category->id\"><img".
+        echo "<a title=\"$str->delete\" href=\"index.php?delete=$category->id&sesskey=$USER->sesskey\"><img".
             " src=\"$pixpath/t/delete.gif\" height=11 width=11 border=0></a> ";

        if (!empty($category->visible)) {
-            echo "<a title=\"$str->hide\" href=\"index.php?hide=$category->id\"><img".
+            echo "<a title=\"$str->hide\" href=\"index.php?hide=$category->id&sesskey=$USER->sesskey\"><img".
                 " src=\"$pixpath/t/hide.gif\" height=11 width=11 border=0></a> ";
        } else {
-            echo "<a title=\"$str->show\" href=\"index.php?show=$category->id\"><img".
+            echo "<a title=\"$str->show\" href=\"index.php?show=$category->id&sesskey=$USER->sesskey\"><img".
                 " src=\"$pixpath/t/show.gif\" height=11 width=11 border=0></a> ";
        }

        if ($up) {
-            echo "<a title=\"$str->moveup\" href=\"index.php?moveup=$category->id\"><img".
+            echo "<a title=\"$str->moveup\" href=\"index.php?moveup=$category->id&sesskey=$USER->sesskey\"><img".
                 " src=\"$pixpath/t/up.gif\" height=11 width=11 border=0></a> ";
        }
        if ($down) {
-            echo "<a title=\"$str->movedown\" href=\"index.php?movedown=$category->id\"><img".
+            echo "<a title=\"$str->movedown\" href=\"index.php?movedown=$category->id&sesskey=$USER->sesskey\"><img".
                 " src=\"$pixpath/t/down.gif\" height=11 width=11 border=0></a> ";
        }
        echo "</td>";
@@ -364,7 +365,7 @@ function print_category_edit($category, $displaylist, $parentslist, $depth=-1, $
                unset($tempdisplaylist[$key]);
            }
        }
-        popup_form ("index.php?move=$category->id&moveto=", $tempdisplaylist, "moveform$category->id", "$category->parent", "", "", "", false);
+        popup_form ("index.php?move=$category->id&sesskey=$USER->sesskey&moveto=", $tempdisplaylist, "moveform$category->id", "$category->parent", "", "", "", false);
        echo "</td>";
        echo "</tr>";
    } else {
@@ -255,11 +255,18 @@ function print_log_selector_form($course, $selecteduser=0, $selecteddate="today"
        /// If using a group, only get users in that group.
        if ($selectedgroup) {
            $sql = 'SELECT u.id as id, u.firstname, u.lastname, u.lastaccess '.
-                   'FROM '.$CFG->prefix.'user u,'.$CFG->prefix.'user_students us,'.$CFG->prefix.'groups_members gm, '.
-                        $CFG->prefix.'user_teachers ut '.
-                   'WHERE us.course='.$course->id.' AND gm.groupid='.$selectedgroup.
-                   ' AND (gm.userid=us.userid OR gm.userid=ut.userid) AND gm.userid=u.id';
-            $courseusers = get_records_sql($sql); 
+                       'FROM '.$CFG->prefix.'user u '.
+                       ' JOIN '.$CFG->prefix.'groups_members gm ON gm.userid=u.id '.
+                       ' JOIN '.$CFG->prefix.'user_teachers  ut ON gm.userid=ut.userid '.
+                       'WHERE ut.course='.$course->id.' AND gm.groupid='.$selectedgroup;
+                 $courseusers = get_records_sql($sql); 
+                // students
+                $sql = 'SELECT u.id as id, u.firstname, u.lastname, u.lastaccess '.
+                       'FROM '.$CFG->prefix.'user u '.
+                       ' JOIN '.$CFG->prefix.'groups_members gm ON gm.userid=u.id '.
+                       ' JOIN '.$CFG->prefix.'user_students  us ON gm.userid=us.userid '.
+                       'WHERE us.course='.$course->id.' AND gm.groupid='.$selectedgroup;
+                $courseusers = array_merge($couseusers, get_records_sql($sql)); 
        } else {
            $courseusers = get_course_users($course->id, '', '', 'u.id, u.firstname, u.lastname');
        }
@@ -277,9 +284,9 @@ function print_log_selector_form($course, $selecteduser=0, $selecteddate="today"
    }

    if (isadmin()) {
-        if ($ccc = get_records("course", "", "", "fullname")) {
+        if ($ccc = get_records("course", "", "", "fullname","id,fullname,category")) {
            foreach ($ccc as $cc) {
-                if ($cc->category) {
+                if (!empty($cc->category)) {
                    $courses["$cc->id"] = "$cc->fullname";
                } else {
                    $courses["$cc->id"] = " $cc->fullname (Site)";
@@ -373,9 +380,13 @@ function print_log_selector_form($course, $selecteduser=0, $selecteddate="today"
    }

    if ($showgroups) {
-        $cgroups = get_groups($course->id);
-        foreach ($cgroups as $cgroup) {
-            $groups[$cgroup->id] = $cgroup->name;
+        if ($cgroups = get_groups($course->id)) {
+            foreach ($cgroups as $cgroup) {
+                $groups[$cgroup->id] = $cgroup->name;
+            }
+        }
+        else {
+            $groups = array();
        }
        choose_from_menu ($groups, "group", $selectedgroup, get_string("allgroups") );
    }
@@ -521,7 +532,7 @@ function print_log($course, $user=0, $date=0, $order="l.time ASC", $page=0, $per
            $ld = get_record('log_display', 'module', $log->module, "action", $log->action);
            $ldcache[$log->module][$log->action] = $ld;
        }
-        if ($ld) {
+        if ($ld && !empty($log->info)) {
            $log->info = get_field($ld->mtable, $ld->field, 'id', $log->info);
        }

@@ -809,7 +820,7 @@ function get_all_sections($courseid) {
 function course_set_display($courseid, $display=0) {
    global $USER;

-    if (empty($USER)) {
+    if (empty($USER->id)) {
        return false;
    }

@@ -876,8 +887,8 @@ function print_section($course, $section, $mods, $modnamesused, $absolute=false,
            $strmovehere = get_string("movehere");
            $strmovefull = strip_tags(get_string("movefull", "", "'$USER->activitycopyname'"));
        }
-        $labelformatoptions->noclean = true;
    }
+    $labelformatoptions->noclean = true;

    $modinfo = unserialize($course->modinfo);

@@ -899,7 +910,7 @@ function print_section($course, $section, $mods, $modnamesused, $absolute=false,
                        continue;
                    }
                    echo "<a title=\"$strmovefull\"".
-                         " href=\"$CFG->wwwroot/course/mod.php?moveto=$mod->id\">".
+                         " href=\"$CFG->wwwroot/course/mod.php?moveto=$mod->id&amp;sesskey=$USER->sesskey\">".
                         "<img height=\"16\" width=\"80\" src=\"$CFG->pixpath/movehere.gif\" ".
                         " alt=\"$strmovehere\" border=\"0\"></a><br />\n";
                }
@@ -959,7 +970,7 @@ function print_section($course, $section, $mods, $modnamesused, $absolute=false,
    }
    if ($ismoving) {
        echo "<tr><td><a title=\"$strmovefull\"".
-             " href=\"$CFG->wwwroot/course/mod.php?movetosection=$section->id\">".
+             " href=\"$CFG->wwwroot/course/mod.php?movetosection=$section->id&amp;sesskey=$USER->sesskey\">".
             "<img height=\"16\" width=\"80\" src=\"$CFG->pixpath/movehere.gif\" ".
             " alt=\"$strmovehere\" border=\"0\"></a></td></tr>\n";
    }
@@ -970,7 +981,7 @@ function print_section($course, $section, $mods, $modnamesused, $absolute=false,
 function print_section_add_menus($course, $section, $modnames, $vertical=false, $return=false) {
 // Prints the menus to add activities and resources

-    global $CFG;
+    global $CFG, $USER;
    static $straddactivity, $stractivities, $straddresource, $resources;

    if (!isset($straddactivity)) {
@@ -990,7 +1001,7 @@ function print_section_add_menus($course, $section, $modnames, $vertical=false,
    $output = '';

    $output .= '<div align="right"><table align="right"><tr><td>';
-    $output .= popup_form("$CFG->wwwroot/course/mod.php?id=$course->id&amp;section=$section&add=",
+    $output .= popup_form("$CFG->wwwroot/course/mod.php?id=$course->id&amp;section=$section&amp;sesskey=$USER->sesskey&add=",
                $resources, "ressection$section", "", $straddresource, 'resource/types', $straddresource, true);
    $output .= '</td>';

@@ -999,7 +1010,7 @@ function print_section_add_menus($course, $section, $modnames, $vertical=false,
    }

    $output .= '<td>';
-    $output .= popup_form("$CFG->wwwroot/course/mod.php?id=$course->id&amp;section=$section&add=",
+    $output .= popup_form("$CFG->wwwroot/course/mod.php?id=$course->id&amp;section=$section&amp;sesskey=$USER->sesskey&add=",
                $modnames, "section$section", "", $straddactivity, 'mods', $straddactivity, true);
    $output .= '</td></tr></table>';
    $output .= '</div>';
@@ -1021,7 +1032,7 @@ function rebuild_course_cache($courseid=0) {
        $select = "";
    }

-    if ($courses = get_records_select("course", $select)) {
+    if ($courses = get_records_select("course", $select,'','id,fullname')) {
        foreach ($courses as $course) {
            $modinfo = serialize(get_array_of_activities($course->id));
            if (!set_field("course", "modinfo", $modinfo, "id", $course->id)) {
@@ -1139,7 +1150,7 @@ function print_category_info($category, $depth) {
    echo "\n\n<table border=0 cellpadding=3 cellspacing=0 width=\"100%\"><tr>";

    if ($CFG->frontpage == FRONTPAGECOURSELIST) {
-        $courses = get_courses($category->id);
+        $courses = get_courses($category->id, 'c.sortorder ASC', 'c.id,c.sortorder,c.visible,c.fullname,c.shortname,c.password,c.summary,c.guest');

        echo "<tr>";

@@ -1214,14 +1225,14 @@ function print_courses($category, $width="100%") {
        $categories = get_categories(0);  // Parent = 0   ie top-level categories only
        if (count($categories) == 1) {
            $category   = array_shift($categories);
-            $courses    = get_courses($category->id);
+            $courses    = get_courses($category->id, 'c.sortorder ASC', 'c.id,c.sortorder,c.visible,c.fullname,c.shortname,c.password,c.summary,c.teacher');
        } else {
-            $courses    = get_courses("all");
+            $courses    = get_courses("all", 'c.sortorder ASC', 'c.id,c.sortorder,c.visible,c.fullname,c.shortname,c.password,c.summary,c.teacher');
        }
        unset($categories);
    } else {
        $categories = get_categories($category->id);  // sub categories
-        $courses    = get_courses($category->id);
+        $courses    = get_courses($category->id, 'c.sortorder ASC', 'c.id,c.sortorder,c.visible,c.fullname,c.shortname,c.password,c.summary,c.teacher');
    }

    if ($courses) {
@@ -1653,7 +1664,7 @@ function move_module($cm, $move) {
 }

 function make_editing_buttons($mod, $absolute=false, $moveselect=true, $indent=-1) {
-    global $CFG, $THEME;
+    global $CFG, $THEME, $USER;

    static $str;

@@ -1688,10 +1699,10 @@ function make_editing_buttons($mod, $absolute=false, $moveselect=true, $indent=-
    }

    if ($mod->visible) {
-        $hideshow = "<a title=\"$str->hide\" href=\"$path/mod.php?hide=$mod->id\"><img".
+        $hideshow = "<a title=\"$str->hide\" href=\"$path/mod.php?hide=$mod->id&amp;sesskey=$USER->sesskey\"><img".
                    " src=\"$pixpath/t/hide.gif\" hspace=\"2\" height=\"11\" width=\"11\" border=\"0\" alt=\"$str->hide\"></a> ";
    } else {
-        $hideshow = "<a title=\"$str->show\" href=\"$path/mod.php?show=$mod->id\"><img".
+        $hideshow = "<a title=\"$str->show\" href=\"$path/mod.php?show=$mod->id&amp;sesskey=$USER->sesskey\"><img".
                    " src=\"$pixpath/t/show.gif\" hspace=\"2\" height=\"11\" width=\"11\" ".
                    "border=\"0\" alt=\"$str->show\"></a> ";
    }
@@ -1699,15 +1710,15 @@ function make_editing_buttons($mod, $absolute=false, $moveselect=true, $indent=-
        if ($mod->groupmode == SEPARATEGROUPS) {
            $grouptitle = $str->groupsseparate;
            $groupimage = "$pixpath/t/groups.gif";
-            $grouplink  = "$path/mod.php?id=$mod->id&groupmode=0";
+            $grouplink  = "$path/mod.php?id=$mod->id&groupmode=0&amp;sesskey=$USER->sesskey";
        } else if ($mod->groupmode == VISIBLEGROUPS) {
            $grouptitle = $str->groupsvisible;
            $groupimage = "$pixpath/t/groupv.gif";
-            $grouplink  = "$path/mod.php?id=$mod->id&groupmode=1";
+            $grouplink  = "$path/mod.php?id=$mod->id&groupmode=1&amp;sesskey=$USER->sesskey";
        } else {
            $grouptitle = $str->groupsnone;
            $groupimage = "$pixpath/t/groupn.gif";
-            $grouplink  = "$path/mod.php?id=$mod->id&groupmode=2";
+            $grouplink  = "$path/mod.php?id=$mod->id&groupmode=2&amp;sesskey=$USER->sesskey";
        }
        if ($mod->groupmodelink) {
            $groupmode = "<a title=\"$grouptitle ($str->clicktochange)\" href=\"$grouplink\">".
@@ -1723,37 +1734,37 @@ function make_editing_buttons($mod, $absolute=false, $moveselect=true, $indent=-
    }

    if ($moveselect) {
-        $move =     "<a title=\"$str->move\" href=\"$path/mod.php?copy=$mod->id\"><img".
+        $move =     "<a title=\"$str->move\" href=\"$path/mod.php?copy=$mod->id&amp;sesskey=$USER->sesskey\"><img".
                    " src=\"$pixpath/t/move.gif\" hspace=\"2\" height=\"11\" width=\"11\" ".
                    " border=\"0\" alt=\"$str->move\"></a>";
    } else {
-        $move =     "<a title=\"$str->moveup\" href=\"$path/mod.php?id=$mod->id&move=-1\"><img".
+        $move =     "<a title=\"$str->moveup\" href=\"$path/mod.php?id=$mod->id&move=-1&amp;sesskey=$USER->sesskey\"><img".
                    " src=\"$pixpath/t/up.gif\" hspace=\"2\" height=\"11\" width=\"11\" ".
                    " border=\"0\" alt=\"$str->moveup\"></a>".
-                    "<a title=\"$str->movedown\" href=\"$path/mod.php?id=$mod->id&move=1\"><img".
+                    "<a title=\"$str->movedown\" href=\"$path/mod.php?id=$mod->id&move=1&amp;sesskey=$USER->sesskey\"><img".
                    " src=\"$pixpath/t/down.gif\" hspace=\"2\" height=\"11\" width=\"11\" ".
                    " border=\"0\" alt=\"$str->movedown\"></a>";
    }

    $leftright = "";
    if ($indent > 0) {
-        $leftright .= "<a title=\"$str->moveleft\" href=\"$path/mod.php?id=$mod->id&indent=-1\"><img".
+        $leftright .= "<a title=\"$str->moveleft\" href=\"$path/mod.php?id=$mod->id&indent=-1&amp;sesskey=$USER->sesskey\"><img".
                      " src=\"$pixpath/t/left.gif\" hspace=\"2\" height=\"11\" width=\"11\" ".
                      " border=\"0\" alt=\"$str->moveleft\"></a>";
    }
    if ($indent >= 0) {
-        $leftright .= "<a title=\"$str->moveright\" href=\"$path/mod.php?id=$mod->id&indent=1\"><img".
+        $leftright .= "<a title=\"$str->moveright\" href=\"$path/mod.php?id=$mod->id&indent=1&amp;sesskey=$USER->sesskey\"><img".
                      " src=\"$pixpath/t/right.gif\" hspace=\"2\" height=\"11\" width=\"11\" ".
                      " border=\"0\" alt=\"$str->moveright\"></a>";
    }

    return "$leftright$move".
-           "<a title=\"$str->update\" href=\"$path/mod.php?update=$mod->id\"><img".
+           "<a title=\"$str->update\" href=\"$path/mod.php?update=$mod->id&amp;sesskey=$USER->sesskey\"><img".
           " src=\"$pixpath/t/edit.gif\" hspace=\"2\" height=\"11\" width=\"11\" border=\"0\" ".
           " alt=\"$str->update\"></a>".
      //   Following line is commented out until this feature is more definite -- martin
-      //     "<a title=\"$str->duplicate\" href=\"$path/mod.php?duplicate=$mod->id\"> 2 </a>".
-           "<a title=\"$str->delete\" href=\"$path/mod.php?delete=$mod->id\"><img".
+      //     "<a title=\"$str->duplicate\" href=\"$path/mod.php?duplicate=$mod->id&amp;sesskey=$USER->sesskey\"> 2 </a>".
+           "<a title=\"$str->delete\" href=\"$path/mod.php?delete=$mod->id&amp;sesskey=$USER->sesskey\"><img".
           " src=\"$pixpath/t/delete.gif\" hspace=\"2\" height=\"11\" width=\"11\" border=\"0\" ".
           " alt=\"$str->delete\"></a>$hideshow$groupmode";
 }
@@ -33,6 +33,7 @@
    $strlogs = get_string("logs");
    $stradministration = get_string("administration");

+    session_write_close();

    if (!empty($_GET['chooselog'])) {
        $userinfo = get_string("allparticipants");
@@ -4,9 +4,9 @@
    require_once("../config.php");
    require_once("lib.php");

-    require_variable($id);     // course id
+    require_variable($id);      // course id
    optional_variable($user);   // login as this user
-    optional_variable($return); // return to being the real user again
+    optional_variable($return); // return to the page we came from

    if (! $course = get_record("course", "id", $id)) {
        error("Course ID was incorrect");
@@ -16,13 +16,13 @@
        require_login($course->id);
    }

-    if ($return and $USER->realuser) {
+    if (isset($USER->realuser)) {   /// Reset user back to their real self
        $USER = get_user_info_from_db("id", $USER->realuser);
        $USER->loggedin = true;
        $USER->site = $CFG->wwwroot;

-        if (isset($SESSION->oldcurrentgroup)) {      // Restore previous "current group"
-            $SESSION->currentgroup[$course->id] = $SESSION->oldcurrentgroup;
+        if (isset($SESSION->oldcurrentgroup)) {      // Restore previous "current group" cache.
+            $SESSION->currentgroup = $SESSION->oldcurrentgroup;
            unset($SESSION->oldcurrentgroup);
        }
        if (isset($SESSION->oldtimeaccess)) {        // Restore previous timeaccess settings
@@ -30,8 +30,10 @@
            unset($SESSION->oldtimeaccess);
        }

-        redirect($_SERVER["HTTP_REFERER"]);
-        exit;
+        if ($return) {       /// That's all we wanted to do, so let's go back
+            redirect($_SERVER["HTTP_REFERER"]);
+            exit;
+        }
    }

    // $user must be defined to go on
@@ -66,9 +68,9 @@
    $USER->site = $CFG->wwwroot;
    $USER->realuser = $teacher_id;

-    if (isset($SESSION->currentgroup[$course->id])) {    // Remember current setting for later
-        $SESSION->oldcurrentgroup = $SESSION->currentgroup[$course->id];
-        unset($SESSION->currentgroup[$course->id]);
+    if (isset($SESSION->currentgroup)) {    // Remember current cache setting for later
+        $SESSION->oldcurrentgroup = $SESSION->currentgroup;
+        unset($SESSION->currentgroup);
    }

    set_moodle_cookie($USER->username);
@@ -86,4 +88,4 @@
    notice($strloggedinas, "$CFG->wwwroot/course/view.php?id=$course->id");


-?>
+?>
@@ -16,6 +16,14 @@
        error("Only teachers can view logs");
    }

+    session_write_close();
+
+    // we override the default framename so header/footer
+    // links open in a new window 
+    if (empty($CFG->framename) || $CFG->framename==='_top') {
+        $CFG->framename = '_blank';
+    }
+
    $strlivelogs = get_string("livelogs");
    $strupdatesevery = get_string("updatesevery", "moodle", COURSE_LIVELOG_REFRESH);

@@ -28,6 +36,8 @@
    print_log($course, $user, $date, "l.time DESC", 0, 500, 
              "loglive.php?id=$course->id&user=$user&date=$date");

+    print_footer();
+
    exit;

 ?>
@@ -27,6 +27,14 @@

    if (isset($_POST["course"])) {    // add or update form submitted

+        //It caller is correct, $SESSION->sesskey must exist and coincide
+        if (empty($SESSION->sesskey) or !confirm_sesskey($SESSION->sesskey)) {
+            error(get_string('confirmsesskeybad', 'error'));
+        }
+
+        //Unset this, check done
+        unset($SESSION->sesskey);
+
        if (!$course = get_record("course", "id", $mod->course)) {
            error("This course doesn't exist");
        }
@@ -35,7 +43,9 @@
            error("You can't modify this course!");
        }

+        $mod->modulename = clean_filename($mod->modulename);  // For safety
        $modlib = "$CFG->dirroot/mod/$mod->modulename/lib.php";
+
        if (file_exists($modlib)) {
            include_once($modlib);
        } else {
@@ -163,7 +173,7 @@
    }


-    if (isset($_GET['move'])) {  
+    if (isset($_GET['move']) and confirm_sesskey()) {  

        require_variable($id);   

@@ -187,7 +197,7 @@
        }
        exit;

-    } else if (isset($_GET['movetosection']) or isset($_GET['moveto'])) {  
+    } else if ((isset($_GET['movetosection']) or isset($_GET['moveto'])) and confirm_sesskey()) {  
        
        if (! $cm = get_record("course_modules", "id", $USER->activitycopy)) {
            error("The copied course module doesn't exist!");
@@ -231,7 +241,7 @@
            redirect("view.php?id=$section->course");
        }

-    } else if (isset($_GET['indent'])) {  
+    } else if (isset($_GET['indent']) and confirm_sesskey()) {  

        require_variable($id);   

@@ -257,7 +267,7 @@
        }
        exit;

-    } else if (isset($_GET['hide'])) {
+    } else if (isset($_GET['hide']) and confirm_sesskey()) {

        if (! $cm = get_record("course_modules", "id", $_GET['hide'])) {
            error("This course module doesn't exist");
@@ -279,7 +289,7 @@
        }
        exit;

-    } else if (isset($_GET['show'])) {
+    } else if (isset($_GET['show']) and confirm_sesskey()) {

        if (! $cm = get_record("course_modules", "id", $_GET['show'])) {
            error("This course module doesn't exist");
@@ -311,7 +321,7 @@
        }
        exit;

-    } else if (isset($_GET['groupmode'])) {
+    } else if (isset($_GET['groupmode']) and confirm_sesskey()) {

        if (! $cm = get_record("course_modules", "id", $_GET['id'])) {
            error("This course module doesn't exist");
@@ -333,7 +343,7 @@
        }
        exit;

-    } else if (isset($_GET['copy'])) { // value = course module
+    } else if (isset($_GET['copy']) and confirm_sesskey()) { // value = course module

        if (! $cm = get_record("course_modules", "id", $_GET['copy'])) {
            error("This course module doesn't exist");
@@ -361,7 +371,7 @@

        redirect("view.php?id=$cm->course");

-    } else if (isset($_GET['cancelcopy'])) { // value = course module
+    } else if (isset($_GET['cancelcopy']) and confirm_sesskey()) { // value = course module

        $courseid = $USER->activitycopycourse;

@@ -371,7 +381,7 @@

        redirect("view.php?id=$courseid");

-    } else if (isset($_GET['delete'])) {   // value = course module
+    } else if (isset($_GET['delete']) and confirm_sesskey()) {   // value = course module

        if (! $cm = get_record("course_modules", "id", $_GET['delete'])) {
            error("This course module doesn't exist");
@@ -410,11 +420,12 @@
        $form->modulename   = $module->name;
        $form->fullmodulename  = $fullmodulename;
        $form->instancename = $instance->name;
+        $SESSION->sesskey = !empty($USER->id) ? $USER->sesskey : '';

        $strdeletecheck = get_string("deletecheck", "", "$form->fullmodulename");
        $strdeletecheckfull = get_string("deletecheckfull", "", "$form->fullmodulename '$form->instancename'");

-        print_header_simple("$strdeletecheck", "$",
+        print_header_simple("$strdeletecheck", "",
                     "$strdeletecheck");

        print_simple_box_start("center", "60%", "#FFAAAA", 20, "noticebox");
@@ -426,7 +437,7 @@
        exit;


-    } else if (isset($_GET['update'])) {   // value = course module
+    } else if (isset($_GET['update']) and confirm_sesskey()) {   // value = course module

        if (! $cm = get_record("course_modules", "id", $_GET['update'])) {
            error("This course module doesn't exist");
@@ -463,6 +474,7 @@
        $form->modulename   = $module->name;
        $form->instance     = $cm->instance;
        $form->mode         = "update";
+        $SESSION->sesskey = !empty($USER->id) ? $USER->sesskey : '';

        $sectionname    = get_string("name$course->format");
        $fullmodulename = strtolower(get_string("modulename", $module->name));
@@ -475,7 +487,7 @@
            $pageheading = get_string("updatinga", "moodle", $fullmodulename);
        }

-    } else if (isset($_GET['duplicate'])) {   // value = course module
+    } else if (isset($_GET['duplicate']) and confirm_sesskey()) {   // value = course module

        if (! $cm = get_record("course_modules", "id", $_GET['duplicate'])) {
            error("This course module doesn't exist");
@@ -514,6 +526,7 @@
        $form->modulename   = $module->name;
        $form->instance     = $cm->instance;
        $form->mode         = "add";
+        $SESSION->sesskey = !empty($USER->id) ? $USER->sesskey : '';

        $sectionname    = get_string("name$course->format");
        $fullmodulename = strtolower(get_string("modulename", $module->name));
@@ -527,7 +540,7 @@
        }

        
-    } else if (isset($_GET['add'])) {
+    } else if (isset($_GET['add']) and confirm_sesskey()) {

        if (empty($_GET['add'])) {
            redirect($_SERVER["HTTP_REFERER"]);
@@ -552,6 +565,7 @@
        $form->instance   = "";
        $form->coursemodule = "";
        $form->mode       = "add";
+        $SESSION->sesskey = !empty($USER->id) ? $USER->sesskey : '';
        if (isset($_GET['type'])) {
            $form->type = $_GET['type'];
        }
@@ -110,7 +110,7 @@

    } else { // you chose a group of activities

-        if (isteacher($user)) {
+        if (isteacher($course->id)) {
            $hiddenfilter = "";
        } else {
            $hiddenfilter = " AND cs.visible = '1' ";
@@ -135,7 +135,7 @@
            $activityfilter = "";
        }

-        if (isteacher($user)) {
+        if (isteacher($course->id)) {
            $hiddenfilter = "";
        } else {
            $hiddenfilter = " AND cm.visible = '1' ";
@@ -144,6 +144,7 @@
        foreach ($sections as $section) {

            if ($i <= $course->numsections) {
+                $activity = new Object;
                $activity->type = "section";
                if ($i) {
                    $activity->name = $sectiontitle . " $i";
@@ -194,6 +195,7 @@
                    $get_recent_mod_activity = $coursemod->name."_get_recent_mod_activity";

                    if (function_exists($get_recent_mod_activity)) {
+                        $activity = new Object;
                        $activity->type = "activity";
                        $activity->name = $instance->name;
                        $activity->visible = $coursemod->visible;
@@ -229,7 +231,7 @@

        $section = 0;

-        if (isteacher($user)) {
+        if (isteacher($course->id)) {
            $teacher = true;
        } else {
            $teacher = false;
@@ -39,11 +39,14 @@
    $stroptions = get_string("action");
    $strtype = get_string("group");

+    /// init this here so we can pass it by reference to every call to site_scale_used to avoid getting the courses out of the db over and over again
+    $courses = array();
+
    /// If scale data is being submitted, then save it and continue

    $errors = NULL;

-    if ($action == 'sendform') {
+    if ($action == 'sendform' and confirm_sesskey()) {
        if ($form = data_submitted()) {
            if (empty($form->name)) {
                $errors[$scaleid]->name = true;
@@ -98,8 +101,8 @@
            error("Scale ID was incorrect");
        }

-        $scales_course_uses = course_scale_used($course->id,$scale->id);
-        $scales_site_uses = site_scale_used($scale->id);
+        //        $scales_course_uses = course_scale_used($course->id,$scale->id);
+        //        $scales_site_uses = site_scale_used($scale->id,$courses);
        $scalemenu = make_menu_from_list($scale->scale);

        print_header("$course->shortname: $strscales", "$course->fullname",
@@ -124,6 +127,9 @@

    //If action is edit or new, show the form
    if ($action == "edit" || $action == "new") {
+
+        $sesskey = !empty($USER->id) ? $USER->sesskey : '';
+
        //Check for teacher edit
        if (! isteacheredit($course->id)) {
            error("Only editing teachers can modify scales !");
@@ -143,7 +149,7 @@
            
        //Calculate the uses
        if ($scale->courseid == 0) {
-            $scale_uses = site_scale_used($scale->id);
+            $scale_uses = site_scale_used($scale->id,$courses);
        } else {
            $scale_uses = course_scale_used($course->id,$scale->id);
        }
@@ -216,6 +222,7 @@
        echo "<tr>";
        echo "<td colspan=2 align=\"center\">";
        echo "<input type=\"hidden\" name=\"id\" value=\"$course->id\">";
+        echo "<input type=\"hidden\" name=\"sesskey\" value=\"$sesskey\">";
        echo "<input type=\"hidden\" name=\"courseid\" value=\"$scale->courseid\">";
        echo "<input type=\"hidden\" name=\"scaleid\" value=\"$scale->id\">";
        echo "<input type=\"hidden\" name=\"action\" value=\"sendform\">";
@@ -230,7 +237,7 @@
    }

    //If action is delete, do it
-    if ($action == "delete") {
+    if ($action == "delete" and confirm_sesskey()) {
        //Check for teacher edit
        if (! isteacheredit($course->id)) {
            error("Only editing teachers can delete scales !");
@@ -242,7 +249,7 @@

        //Calculate the uses
        if ($scale->courseid == 0) {
-            $scale_uses = site_scale_used($scale->id);
+            $scale_uses = site_scale_used($scale->id,$courses);
        } else {
            $scale_uses = course_scale_used($course->id,$scale->id);
        }
@@ -263,7 +270,7 @@
    }

    //If action is down or up, do it
-    if ($action == "down" || $action == "up" ) {
+    if (($action == "down" || $action == "up") and confirm_sesskey()) {
        //Check for teacher edit
        if (! isadmin()) {
            error("Only administrators can move scales",$CFG->wwwroot.'/course/scales.php?id='.$course->id);
@@ -275,7 +282,7 @@

        //Calculate the uses
        if ($scale->courseid == 0) {
-            $scale_uses = site_scale_used($scale->id);
+            $scale_uses = site_scale_used($scale->id,$courses);
        } else {
            $scale_uses = course_scale_used($course->id,$scale->id);
        }
@@ -436,7 +443,7 @@
            if (!empty($scale->courseid)) {
                $scales_uses = course_scale_used($course->id,$scale->id);
            } else {
-                $scales_uses = site_scale_used($scale->id);
+                $scales_uses = site_scale_used($scale->id,$courses);
            }
            $line[] = $scales_uses;
            if ($incustom) {
@@ -449,14 +456,14 @@
                $buttons .= "<a title=\"$stredit\" href=\"$path/scales.php?id=$course->id&scaleid=$scale->id&action=edit\"><img".
                            " src=\"$pixpath/t/edit.gif\" hspace=2 height=11 width=11 border=0></a> ";
                if ($incustom && isadmin()) {
-                    $buttons .= "<a title=\"$strdown\" href=\"$path/scales.php?id=$course->id&scaleid=$scale->id&action=down\"><img".
+                    $buttons .= "<a title=\"$strdown\" href=\"$path/scales.php?id=$course->id&scaleid=$scale->id&action=down&amp;sesskey=$USER->sesskey\"><img".
                                " src=\"$pixpath/t/down.gif\" hspace=2 height=11 width=11 border=0></a> ";
                }
                if (!$incustom && isadmin()) {
-                    $buttons .= "<a title=\"$strup\" href=\"$path/scales.php?id=$course->id&scaleid=$scale->id&action=up\"><img".
+                    $buttons .= "<a title=\"$strup\" href=\"$path/scales.php?id=$course->id&scaleid=$scale->id&action=up&amp;sesskey=$USER->sesskey\"><img".
                                " src=\"$pixpath/t/up.gif\" hspace=2 height=11 width=11 border=0></a> ";
                }
-                $buttons .= "<a title=\"$strdelete\" href=\"$path/scales.php?id=$course->id&scaleid=$scale->id&action=delete\"><img".
+                $buttons .= "<a title=\"$strdelete\" href=\"$path/scales.php?id=$course->id&scaleid=$scale->id&action=delete&amp;sesskey=$USER->sesskey\"><img".
                            " src=\"$pixpath/t/delete.gif\" hspace=2 height=11 width=11 border=0></a> ";
            }
            $line[] = $buttons;
@@ -465,7 +472,7 @@
        }
        $head = $strscale.",".$stractivities.",".$strtype.",".$stroptions;
        $table->head = explode(",",$head);
-        $size = "50%,20$,20%,10%";
+        $size = "50%,20%,20%,10%";
        $table->size = explode(",",$size);
        $align = "left,center,center,center";
        $table->align = explode(",",$align);
@@ -1,6 +1,7 @@

 <form name="studentform" id="studentform" method="post" action="student.php">
 <input type="hidden" name="previoussearch" value="<?php echo $previoussearch ?>">
+<input type="hidden" name="sesskey" value="<?php echo $sesskey ?>">
 <input type="hidden" name="id" value="<?php echo $id?>">
  <table align="center" border="0" cellpadding="5" cellspacing="0">
    <tr>
@@ -67,7 +67,7 @@
 /// A form was submitted so process the input

    } else {
-        if (!empty($frm->add) and !empty($frm->addselect)) {
+        if (!empty($frm->add) and !empty($frm->addselect) and confirm_sesskey()) {
            if ($course->enrolperiod) {
                $timestart = time();
                $timeend   = $timestart + $course->enrolperiod;
@@ -79,7 +79,7 @@
                    error("Could not add student with id $addstudent to this course!");
                }
            }
-        } else if (!empty($frm->remove) and !empty($frm->removeselect)) {
+        } else if (!empty($frm->remove) and !empty($frm->removeselect) and confirm_sesskey()) {
            foreach ($frm->removeselect as $removestudent) {
                if (! unenrol_student($removestudent, $course->id)) {
                    error("Could not remove student with id $removestudent from this course!");
@@ -135,6 +135,8 @@

    print_simple_box_start("center", "", "$THEME->cellheading");

+    $sesskey = !empty($USER->id) ? $USER->sesskey : '';
+
    include('student.html');

    print_simple_box_end();
@@ -67,7 +67,8 @@

 /// If data submitted, then process and store.

-    if ($form = data_submitted()) {
+    if ($form = data_submitted() and confirm_sesskey()) {
+        unset ($form->sesskey);
        $rank = array();

        // Peel out all the data from variable names.
@@ -95,7 +96,7 @@

 /// Add a teacher if one is specified

-    if (!empty($_GET['add'])) {
+    if (!empty($_GET['add']) and confirm_sesskey()) {
        if (! add_teacher($add, $course->id)) {
            error("Could not add that teacher to this course!");
        }
@@ -103,9 +104,9 @@

 /// Remove a teacher if one is specified.

-    if (!empty($_GET['remove'])) {
+    if (!empty($_GET['remove']) and confirm_sesskey()) {
        if (! remove_teacher($remove, $course->id)) {
-            error("Could not add that teacher to this course!");
+            error("Could not remove that teacher from this course!");
        }
    }

@@ -150,7 +151,7 @@
                $editall = choose_from_menu ($editmenu, "e$teacher->id", $teacher->editall, "", "", "", true);
            }
    
-            $removelink = "<a href=\"teacher.php?id=$course->id&remove=$teacher->id\">$strremoveteacher</a>";
+            $removelink = "<a href=\"teacher.php?id=$course->id&remove=$teacher->id&sesskey=$USER->sesskey\">$strremoveteacher</a>";

            if (!$teacher->role) {
                $teacher->role = $course->teacher;
@@ -165,6 +166,7 @@

        print_table($table);
        echo "<input type=hidden name=id value=\"$course->id\">";
+        echo "<input type=hidden name=sesskey value=\"$USER->sesskey\">";
        echo "<center><input type=submit value=\"".get_string("savechanges")."\"> ";
        echo "</center>";
        echo "</form>";
@@ -201,7 +203,7 @@


        foreach ($users as $user) {
-            $addlink = "<a href=\"teacher.php?id=$course->id&add=$user->id\">$straddteacher</a>";
+            $addlink = "<a href=\"teacher.php?id=$course->id&add=$user->id&sesskey=$USER->sesskey\">$straddteacher</a>";
            $picture = print_user_picture($user->id, $course->id, $user->picture, false, true);
            $table->data[] = array ($picture, fullname($user, true), $user->email, $addlink);
        }
@@ -28,7 +28,7 @@
        error("You are not allowed to unenroll");
    }

-    if (isset($confirm)) {
+    if (isset($confirm) and confirm_sesskey()) {

        if (! unenrol_student($user->id, $course->id)) {
            error("An error occurred while trying to unenrol you.");
@@ -56,7 +56,7 @@
        $strunenrolsure = get_string("unenrolsure", "", fullname($user, true));
    }

-    notice_yesno ($strunenrolsure, "unenrol.php?id=$id&user=$user->id&confirm=yes", "$HTTP_REFERER");
+    notice_yesno ($strunenrolsure, "unenrol.php?id=$id&user=$user->id&confirm=yes&sesskey=$USER->sesskey", "$HTTP_REFERER");

    print_footer();

@@ -93,67 +93,74 @@
                if (isset($sections[$i])) {   // should always be true

                    $section = $sections[$i];
-        
-                    if ($section->sequence) {
-                        echo "<HR>";
-                        echo "<H2>";
-                        switch ($course->format) {
-                            case "weeks": print_string("week"); break;
-                            case "topics": print_string("topic"); break;
-                            default: print_string("section"); break;
-                        }
-                        echo " $i</H2>";
+                    $showsection = (isteacher($course->id) or $section->visible or !$course->hiddensections);

-                        echo "<UL>";
+                    if ($showsection) { // prevent hidden sections in user activity. Thanks to Geoff Wilbert!

-                        if ($mode == "outline") {
-                            echo "<TABLE CELLPADDING=4 CELLSPACING=0>";
-                        }
-
-                        $sectionmods = explode(",", $section->sequence);
-                        foreach ($sectionmods as $sectionmod) {
-                            if (empty($mods[$sectionmod])) {
-                                continue;
+                        if ($section->sequence) {
+                            echo "<HR>";
+                            echo "<H2>";
+                            switch ($course->format) {
+                                case "weeks": print_string("week"); break;
+                                case "topics": print_string("topic"); break;
+                                default: print_string("section"); break;
                            }
-                            $mod = $mods[$sectionmod];
-                            $instance = get_record("$mod->modname", "id", "$mod->instance");
-                            $libfile = "$CFG->dirroot/mod/$mod->modname/lib.php";
+                            echo " $i</H2>";
+    
+                            echo "<UL>";

-                            if (file_exists($libfile)) {
-                                require_once($libfile);
+                            if ($mode == "outline") {
+                                echo "<TABLE CELLPADDING=4 CELLSPACING=0>";
+                            }

-                                switch ($mode) {
-                                    case "outline":
-                                        $user_outline = $mod->modname."_user_outline";
-                                        if (function_exists($user_outline)) {
-                                            $output = $user_outline($course, $user, $mod, $instance);
-                                            print_outline_row($mod, $instance, $output);
-                                        }
-                                        break;
-                                    case "complete":
-                                        $user_complete = $mod->modname."_user_complete";
-                                        if (function_exists($user_complete)) {
-                                            $image = "<IMG SRC=\"../mod/$mod->modname/icon.gif\" ".
-                                                     "HEIGHT=16 WIDTH=16 ALT=\"$mod->modfullname\">";
-                                            echo "<H4>$image $mod->modfullname: ".
-                                                 "<A HREF=\"$CFG->wwwroot/mod/$mod->modname/view.php?id=$mod->id\">".
-                                                 "$instance->name</A></H4>";
-                                            echo "<UL>";
-                                            $user_complete($course, $user, $mod, $instance);
-                                            echo "</UL>";
-                                        }
-                                        break;
+                            $sectionmods = explode(",", $section->sequence);
+                            foreach ($sectionmods as $sectionmod) {
+                                if (empty($mods[$sectionmod])) {
+                                    continue;
                                }
+                                $mod = $mods[$sectionmod];
+    
+                                if (empty($mod->visible)) {
+                                    continue;
+                                }
+
+                                $instance = get_record("$mod->modname", "id", "$mod->instance");
+                                $libfile = "$CFG->dirroot/mod/$mod->modname/lib.php";
+
+                                if (file_exists($libfile)) {
+                                    require_once($libfile);
+
+                                    switch ($mode) {
+                                        case "outline":
+                                            $user_outline = $mod->modname."_user_outline";
+                                            if (function_exists($user_outline)) {
+                                                $output = $user_outline($course, $user, $mod, $instance);
+                                                print_outline_row($mod, $instance, $output);
+                                            }
+                                            break;
+                                        case "complete":
+                                            $user_complete = $mod->modname."_user_complete";
+                                            if (function_exists($user_complete)) {
+                                                $image = "<IMG SRC=\"../mod/$mod->modname/icon.gif\" ".
+                                                         "HEIGHT=16 WIDTH=16 ALT=\"$mod->modfullname\">";
+                                                echo "<H4>$image $mod->modfullname: ".
+                                                     "<A HREF=\"$CFG->wwwroot/mod/$mod->modname/view.php?id=$mod->id\">".
+                                                     "$instance->name</A></H4>";
+                                                echo "<UL>";
+                                                $user_complete($course, $user, $mod, $instance);
+                                                echo "</UL>";
+                                            }
+                                            break;
+                                        }
+                                    }
+                                }
+    
+                            if ($mode == "outline") {
+                                echo "</TABLE>";
+                                print_simple_box_end();
                            }
+                            echo "</UL>";
                        }
-
-                        if ($mode == "outline") {
-                            echo "</TABLE>";
-                            print_simple_box_end();
-                        }
-                        echo "</UL>";
-
-                    
                    }
                }
            }
@@ -29,6 +29,7 @@

    add_to_log($course->id, "course", "view", "view.php?id=$course->id", "$course->id");

+    $course->format = clean_param($course->format, PARAM_ALPHA);
    if (!file_exists($CFG->dirroot.'/course/format/'.$course->format.'/format.php')) {
        $course->format = 'weeks';  // Default format is weeks
    }
@@ -75,15 +76,15 @@

        $editing = $USER->editing;

-        if (isset($hide)) {
+        if (isset($hide) and confirm_sesskey()) {
            set_section_visible($course->id, $hide, '0');
        }

-        if (isset($show)) {
+        if (isset($show) and confirm_sesskey()) {
            set_section_visible($course->id, $show, '1');
        }

-        if (isset($_GET['blockaction'])) {
+        if (isset($_GET['blockaction']) and confirm_sesskey()) {
            if (isset($_GET['blockid'])) {
                block_action($course, $leftblocks, $rightblocks, strtolower($_GET['blockaction']), intval($_GET['blockid']));
            }
@@ -118,7 +119,7 @@
        }

        if (!empty($section)) {
-            if (!empty($move)) {
+            if (!empty($move) and confirm_sesskey()) {
                if (!move_section($course, $section, $move)) {
                    notify("An error occurred while moving a section");
                }
@@ -135,7 +136,7 @@

    $SESSION->fromdiscussion = "$CFG->wwwroot/course/view.php?id=$course->id";

-    if (! $course->category) {      // This course is not a real course.
+    if ($course->id == SITEID) {      // This course is not a real course.
        redirect("$CFG->wwwroot/");
    }

@@ -5,7 +5,8 @@
    if (! $info = document_file("files.php", false)) {
        error("404 - File Not Found");
    }
-
+
+    $string = array();
    if ($CFG->forcelogin) {
        require_login();
    }
@@ -2,19 +2,14 @@

    require("../config.php");

-    optional_variable($file, "");     // docs file to view
-    optional_variable($frame, "");    // docs file to view
-    optional_variable($sub, "");      // sub-section (named anchor)
-    optional_variable($lang, "");     // override current language
+    $file  = optional_param('file', "", PARAM_FILE);  // docs file to view straight
+    $frame = optional_param('frame', "", PARAM_FILE); // docs file to view in frame
+    $sub   = optional_param('sub', "", PARAM_CLEAN);  // sub-section (named anchor)

    if ($CFG->forcelogin) {
        require_login();
    }

-    if (!empty($lang)) {
-        $SESSION->lang = $lang;
-    }
-
    if (!empty($sub)) {
        $sub = "#$sub";
    } else {
@@ -17,45 +17,71 @@ class enrolment_plugin extends enrolment_base {
 function get_student_courses(&$user) {
    global $CFG;

-    parent::get_student_courses($user);
-
+    parent::get_student_courses($user);  /// Start with the list of known enrolments
+                                         /// If the database fails we can at least use this

    // This is a hack to workaround what seems to be a bug in ADOdb with accessing 
    // two databases of the same kind ... it seems to get confused when trying to access
    // the first database again, after having accessed the second.
    // The following hack will make the database explicit which keeps it happy
+
    if (strpos($CFG->prefix, $CFG->dbname) === false) {
+        $oldprefix = $CFG->prefix;
        $CFG->prefix = "$CFG->dbname.$CFG->prefix";
    }
-        

-    // Connect to the external database
+    // Try to connect to the external database
+
    $enroldb = &ADONewConnection($CFG->enrol_dbtype);
+
    if ($enroldb->PConnect($CFG->enrol_dbhost,$CFG->enrol_dbuser,$CFG->enrol_dbpass,$CFG->enrol_dbname)) {

-        foreach ($user->student as $courseid=>$value) {
-        
-            /// Get the value of the local course field
-            $localcoursevalue = get_field("course", $CFG->enrol_localcoursefield, "id", $courseid);
-            
-            /// Find a record in the external database that matches the local course field and local user field
-            /// to the respective remote fields
-            $rs = $enroldb->Execute("SELECT * FROM $CFG->enrol_dbtable 
-                                     WHERE $CFG->enrol_remotecoursefield = '$localcoursevalue' 
-                                     AND $CFG->enrol_remoteuserfield = '{$user->$CFG->enrol_localuserfield}' ");
+        $courselist = array();      /// Initialise new array
+        $newstudent = array();

-            /// If no records existed then student has been unenrolled externally.
-            /// Unenrol locally and remove entry from the $user->student array
-            if (! ($rs->RecordCount()) ) {
-                unenrol_student($user->id, $courseid);
-                unset ($user->student[$courseid]);
+        /// Get the authoritative list of enrolments from the database
+
+        $useridnumber = $user->{$CFG->enrol_localuserfield};   
+
+
+        if ($rs = $enroldb->Execute("SELECT $CFG->enrol_remotecoursefield 
+                                       FROM $CFG->enrol_dbtable 
+                                      WHERE $CFG->enrol_remoteuserfield = '$useridnumber' ")) {
+
+            if ($rs->RecordCount() > 0) {
+                while (!$rs->EOF) {
+                    $courselist[] = $rs->fields[0];
+                    $rs->MoveNext();
+                }
+
+                foreach ($courselist as $coursefield) {
+                    if ($course = get_record('course', $CFG->enrol_localcoursefield, $coursefield)) {
+                        $newstudent[$course->id] = true;             /// Add it to new list
+                        if (isset($user->student[$course->id])) {   /// We have it already
+                            unset($user->student[$course->id]);       /// Remove from old list
+                        } else {
+                            enrol_student($user->id, $course->id);   /// Enrol the student
+                        }
+                    }
+                }
            }
+
+            if (!empty($user->student)) {    /// We have some courses left that we need to unenrol from
+                foreach ($user->student as $courseid => $value) {
+                    unenrol_student($user->id, $courseid);       /// Unenrol the student
+                    unset($user->student[$course->id]);           /// Remove from old list
+                }
+            }
+
+            $user->student = $newstudent;    /// Overwrite the array with the new one
        }
-
+        
        $enroldb->Close();
-
    }

+    if (!empty($oldprefix)) {
+        $CFG->prefix = $oldprefix;           // Restore it just in case
+    }
 }


@@ -87,7 +113,7 @@ function get_access_icons($course) {
 }


-/// Overrise the base config_form() function
+/// Overide the base config_form() function
 function config_form($frm) {
    global $CFG;
    include("$CFG->dirroot/enrol/database/config.html");
@@ -129,15 +129,15 @@ function print_entry($course) {
        if (isguest()) {
            add_to_log($course->id, "course", "guest", "view.php?id=$course->id", "$USER->id");

-        } else if (empty($_GET['confirm'])) {
+        } else if (empty($_GET['confirm']) && empty($_GET['cancel'])) {

            print_header($strloginto, $course->fullname, "<a href=\".\">$strcourses</a> -> $strloginto");
            echo "<br />";
-            notice_yesno(get_string("enrolmentconfirmation"), "enrol.php?id=$course->id&confirm=1", $CFG->wwwroot);
+            notice_yesno(get_string("enrolmentconfirmation"), "enrol.php?id=$course->id&confirm=1", "enrol.php?id=$course->id&cancel=1");
            print_footer();
            exit;

-        } else {
+        } elseif (!empty($_GET['confirm'])) {
            if ($course->enrolperiod) {
                $timestart = time();
                $timeend = time() + $course->enrolperiod;
@@ -148,6 +148,16 @@ function print_entry($course) {
            if (! enrol_student($USER->id, $course->id, $timestart, $timeend)) {
                error("An error occurred while trying to enrol you.");
            }
+
+            $subject = get_string("welcometocourse", "", $course->fullname);
+            $a->coursename = $course->fullname;
+            $a->profileurl = "$CFG->wwwroot/user/view.php?id=$USER->id&course=$course->id";
+            $message = get_string("welcometocoursetext", "", $a);
+            if (! $teacher = get_teacher($course->id)) {
+                $teacher = get_admin();
+            }
+            email_to_user($USER, $teacher, $subject, $message);
+
            add_to_log($course->id, "course", "enrol", "view.php?id=$course->id", "$USER->id");

            $USER->student[$course->id] = true;
@@ -160,6 +170,9 @@ function print_entry($course) {
            }

            redirect($destination);
+        } elseif (!empty($_GET['cancel'])) {
+            unset($SESSION->wantsurl);
+            redirect($CFG->wwwroot);
        }
    }

@@ -292,6 +305,11 @@ function cron() {
    
    if ($students = get_records_select('user_students', $select)) {
        foreach ($students as $student) {
+            if ($course = get_record('course', 'id', $student->course)) {
+                if (empty($course->enrolperiod)) {   // This overrides student timeend
+                    continue;
+                }
+            }
            unenrol_student($student->userid, $student->course);
        }
    }
@@ -315,12 +333,12 @@ function get_access_icons($course) {

    $str = '';

-    if ($course->guest) {
+    if (!empty($course->guest)) {
        $strallowguests = get_string("allowguests");
        $str .= "<a title=\"$strallowguests\" href=\"$CFG->wwwroot/course/view.php?id=$course->id\">";
        $str .= "<img vspace=4 alt=\"$strallowguests\" height=16 width=16 border=0 src=\"$CFG->pixpath/i/guest.gif\"></a>&nbsp;&nbsp;";
    }
-    if ($course->password) {
+    if (!empty($course->password)) {
        $strrequireskey = get_string("requireskey");
        $str .= "<a title=\"$strrequireskey\" href=\"$CFG->wwwroot/course/view.php?id=$course->id\">";
        $str .= "<img vspace=4 alt=\"$strrequireskey\" height=16 width=16 border=0 src=\"$CFG->pixpath/i/key.gif\"></a>";
@@ -1 +1,46 @@
-<table cellpadding="20" align="center">
+<table cellpadding="20" align="center">
+
+  <tr valign="top">
+    <td>
+      <p align="center">
+      <?php
+          if ($teacher) {
+              $site = get_site();
+              $teachername = "<a href=\"../user/view.php?id=$teacher->id&course=$site->id\">".
+                             "$teacher->firstname $teacher->lastname</a>.";
+          } else {
+              $teachername = get_string("yourteacher", "", strtolower($course->teacher));
+          }
+          print_string("enrolmentkeyfrom", "", $teachername);
+       ?>
+       </p>
+    </td>
+  </tr>
+
+  <tr valign=top>
+    <td class="generalbox" bgcolor="<?php p($THEME->cellcontent) ?>">
+      <center><?php if (! empty($this->errormsg)) {formerr($this->errormsg);} ?></center>
+      <form name="form" method="post" action="enrol.php">
+        <table>
+          <tr>
+            <td width="50%" align="right"><p><?php print_string("enrolmentkey") ?>:</p></td>
+            <td width="50%">
+              <input type="password" name="password" size="20" value="<?php p($password) ?>" >
+              <input type="hidden" name="id" value="<?php p($course->id) ?>" >
+            </td>
+          <tr>
+            <td width="50%">&nbsp;</td>
+            <td width="50%">
+              <table cellpadding="1" cellspacing="0" align="center">
+                <tr>
+                    <td><input type="submit" value="<?php print_string("login") ?>">&nbsp;&nbsp;</form></td>
+                    <td><form action="<?php p($CFG->wwwroot)?>/index.php" method=post>
+                        <input type="submit" value="<?php print_string("cancel") ?>"></form></td>
+                </tr>
+              </table>
+            </td>
+        </table>
+    </td>
+  </tr>
+
+</table> 
@@ -8,11 +8,11 @@

 <input type="hidden" name="cmd" value="_xclick">
 <input type="hidden" name="business" value="<?php p($CFG->enrol_paypalbusiness)?>">
-<input type="hidden" name="item_name" value="<?php p($course->fullname) ?>">
-<input type="hidden" name="item_number" value="<?php p($course->shortname) ?>">
+<input type="hidden" name="item_name" value="<?php p($coursefullname) ?>">
+<input type="hidden" name="item_number" value="<?php p($courseshortname) ?>">
 <input type="hidden" name="quantity" value="1">
 <input type="hidden" name="on0" value="<?php print_string("user") ?>">
-<input type="hidden" name="os0" value="<?php echo fullname($USER) ?>">
+<input type="hidden" name="os0" value="<?php p($userfullname) ?>">
 <input type="hidden" name="custom" value="<?php echo "$USER->id-$course->id" ?>">

 <input type="hidden" name="currency_code" value="<?php p($CFG->enrol_currency) ?>">
@@ -26,10 +26,10 @@
 <input type="hidden" name="rm" value="2">
 <input type="hidden" name="cbt" value="<?php print_string("continuetocourse") ?>">

-<input type="hidden" name="first_name" value="<?php p($USER->firstname) ?>">
-<input type="hidden" name="last_name" value="<?php p($USER->lastname) ?>">
-<input type="hidden" name="address" value="<?php p($USER->address) ?>">
-<input type="hidden" name="city" value="<?php p($USER->city) ?>">
+<input type="hidden" name="first_name" value="<?php p($userfirstname) ?>">
+<input type="hidden" name="last_name" value="<?php p($userlastname) ?>">
+<input type="hidden" name="address" value="<?php p($useraddress) ?>">
+<input type="hidden" name="city" value="<?php p($usercity) ?>">
 <input type="hidden" name="email" value="<?php p($USER->email) ?>">
 <input type="hidden" name="country" value="<?php p($USER->country) ?>">

@@ -35,10 +35,18 @@ function print_entry($course) {
    } else {

        print_header($strloginto, $course->fullname, 
-                     "<a href=\"$CFG->wwwroot/courses/\">$strcourses</a> -> $strloginto");
+                     "<a href=\"$CFG->wwwroot/course/\">$strcourses</a> -> $strloginto");
        print_course($course, "80%");
        print_simple_box_start("center");

+        //Sanitise some fields before building the PayPal form
+        $coursefullname  = $this->sanitise_for_paypal($course->fullname);
+        $courseshortname = $this->sanitise_for_paypal($course->shortname);
+        $userfullname    = $this->sanitise_for_paypal(fullname($USER));
+        $userfirstname   = $this->sanitise_for_paypal($USER->firstname);
+        $userlastname    = $this->sanitise_for_paypal($USER->lastname);
+        $useraddress     = $this->sanitise_for_paypal($USER->address);
+        $usercity        = $this->sanitise_for_paypal($USER->city);

        include("$CFG->dirroot/enrol/paypal/enrol.html");

@@ -51,13 +59,6 @@ function print_entry($course) {



-/// Override the base check_entry() function
-/// This should never be called for this type of enrolment anyway
-function check_entry($form, $course) {
-}       
-
-
-
 /// Override the get_access_icons() function
 function get_access_icons($course) {
    global $CFG;
@@ -150,5 +151,38 @@ function process_config($config) {

 }

+//To avoid wrong (for PayPal) characters in sent data
+function sanitise_for_paypal($text) {
+    global $CFG;
+
+    if (!empty($CFG->sanitise_for_paypal)) {
+        //Array of characters to replace (not allowed by PayPal)
+        //Can be expanded as necessary to add other diacritics
+        $replace = array('á' => 'a',        //Spanish characters
+                         'é' => 'e',
+                         'í' => 'i',
+                         'ó' => 'o',
+                         'ú' => 'u',
+                         'Á' => 'A',
+                         'É' => 'E',
+                         'Í' => 'I',
+                         'Ó' => 'O',
+                         'Ú' => 'U',
+                         'ñ' => 'n',
+                         'Ñ' => 'N',
+                         'ü' => 'u',
+                         'Ü' => 'U');
+        $text = strtr($text, $replace);
+    
+        //Make here other sanities if necessary
+
+    }
+
+    return $text;
+
+}
+

 } // end of class definition
+
+?>
@@ -34,7 +34,7 @@
    $custom = explode('-', $data->custom);
    $data->userid           = $custom[0];
    $data->courseid         = $custom[1];
-    $data->payment_amount   = $data->mc_gross;
+    $data->payment_gross    = $data->mc_gross;
    $data->payment_currency = $data->mc_currency;


@@ -184,7 +184,7 @@


        } else if (strcmp ($result, "INVALID") == 0) { // ERROR
-            insert_record("enrol_paypal", $data);
+            insert_record("enrol_paypal", $data, false);
            email_paypal_error_to_admin("Received an invalid payment notification!! (Fake payment?)", $data);
        }
    }
--- a/Show More
+++ b/Show More