Drawing a line in the sand at this point.

deleted from Moodle. See:
http://moodle.org/mod/forum/discuss.php?d=13633

admin/admin.html

@@ -1,6 +1,7 @@
 
 <form name="adminform" id="adminform" method="post" action="admin.php">
 <input type="hidden" name="previoussearch" value="<?php echo $previoussearch ?>">
+<input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>">
   <table align="center" border="0" cellpadding="5" cellspacing="0">
     <tr>
       <td valign="top">

admin/admin.php

@@ -19,6 +19,10 @@
         error("You must be an administrator to use this page.");
     }
 
+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
     $primaryadmin = get_admin();
 
 /// If you want any administrator to have the ability to assign admin

admin/auth.php

@@ -12,10 +12,13 @@
         error("Only the admin can use this page");
     }
 
+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
 
 /// If data submitted, then process and store.
 
-	if ($config = data_submitted()) {
+    if ($config = data_submitted()) {
 
         $config = (array)$config;
         validate_form($config, $err);
@@ -27,7 +30,7 @@
                     notify("Problem saving config $name as $value");
                 }
             }
-            redirect("auth.php", get_string("changessaved"), 1);
+            redirect("auth.php?sesskey=$USER->sesskey", get_string("changessaved"), 1);
             exit;
 
         } else {
@@ -35,7 +38,7 @@
                 $focus = "form.$key";
             }
         }
-	}
+    }
 
 /// Otherwise fill and print the form.
 
@@ -53,6 +56,7 @@
 	} else {
         $auth = $config->auth;
 	} 
+    $auth = clean_filename($auth);
     require_once("$CFG->dirroot/auth/$auth/lib.php"); //just to make sure that current authentication functions are loaded
     if (! isset($config->guestloginbutton)) {
         $config->guestloginbutton = 1;
@@ -93,9 +97,10 @@
 
     echo "<CENTER><P><B>";
     echo "<form TARGET=\"{$CFG->framename}\" NAME=\"authmenu\" method=\"post\" action=\"auth.php\">";
+    echo "<input type=\"hidden\" name=\"sesskey\" value=\"".$USER->sesskey."\">";
     print_string("chooseauthmethod","auth");
 
-	choose_from_menu ($options, "auth", $auth, "","document.location='auth.php?auth='+document.authmenu.auth.options[document.authmenu.auth.selectedIndex].value", "");
+	choose_from_menu ($options, "auth", $auth, "","document.location='auth.php?sesskey=$USER->sesskey&auth='+document.authmenu.auth.options[document.authmenu.auth.selectedIndex].value", "");
 
     echo "</B></P></CENTER>";
         

admin/backup.php

@@ -15,6 +15,10 @@
         error("Site isn't defined!");
     }
 
+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
     //Initialise error variables
     $error = false;
     $sche_destination_error = "";

admin/block.php

@@ -14,6 +14,10 @@
         error("Site isn't defined!");
     }
 
+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
     require_variable($_REQUEST['block']);
     $blockid = intval($_REQUEST['block']);
 
@@ -28,13 +32,13 @@
 
 /// If data submitted, then process and store.
 
-	if ($config = data_submitted()) {
-	    unset($config['block']); // This will always be set if we have reached this point
-	    $block->handle_config($config);
+    if ($config = data_submitted()) {
+        unset($config->block); // This will always be set if we have reached this point
+        $block->handle_config($config);
         print_header();
         redirect("$CFG->wwwroot/$CFG->admin/blocks.php", get_string("changessaved"), 1);
         exit;
-	}
+    }
 
 /// Otherwise print the form.
 

admin/blocks.php

@@ -44,21 +44,21 @@
 
 /// If data submitted, then process and store.
 
-    if (!empty($_GET['hide'])) {
+    if (!empty($_GET['hide']) and confirm_sesskey()) {
         if (!$block = get_record('blocks', 'id', $_GET['hide'])) {
             error("Block doesn't exist!");
         }
         set_field('blocks', 'visible', '0', 'id', $block->id);      // Hide block
     }
 
-    if (!empty($_GET['show'])) {
+    if (!empty($_GET['show']) and confirm_sesskey() ) {
         if (!$block = get_record('blocks', 'id', $_GET['show'])) {
             error("Block doesn't exist!");
         }
         set_field('blocks', 'visible', '1', 'id', $block->id);      // Show block
     }
 
-    if (!empty($delete)) {
+    if (!empty($delete) and confirm_sesskey()) {
 
         if (!$block = get_record('blocks', 'id', $delete)) {
             error("Block doesn't exist!");
@@ -69,7 +69,7 @@
 
         if (!$_GET['confirm']) {
             notice_yesno(get_string('blockdeleteconfirm', '', $strblockname),
-                         'blocks.php?delete='.$block->id.'&confirm=1',
+                         'blocks.php?delete='.$block->id.'&confirm=1&sesskey='.$USER->sesskey,
                          'blocks.php');
             print_footer();
             exit;
@@ -148,21 +148,21 @@
         //$icon = "<img src=\"$modpixpath/$block->name/icon.gif\" hspace=10 height=16 width=16 border=0>";
         $blockobject = $blockobjects[$blockid];
 
-        $delete = '<a href="blocks.php?delete='.$blockid.'">'.$strdelete.'</a>';
+        $delete = '<a href="blocks.php?delete='.$blockid.'&sesskey='.$USER->sesskey.'">'.$strdelete.'</a>';
 
         $settings = ''; // By default, no configuration
         if($blockobject->has_config()) {
-            $settings = '<a href="block.php?block='.$blockid.'">'.$strsettings.'</a>';
+            $settings = '<a href="block.php?block='.$blockid.'&sesskey='.$USER->sesskey.'">'.$strsettings.'</a>';
         }
 
         $count = blocks_get_courses_using_block_by_id($blockid);
         $class = ''; // Nothing fancy, by default
 
         if ($blocks[$blockid]->visible) {
-            $visible = '<a href="blocks.php?hide='.$blockid.'" title="'.$strhide.'">'.
+            $visible = '<a href="blocks.php?hide='.$blockid.'&sesskey='.$USER->sesskey.'" title="'.$strhide.'">'.
                        '<img src="'.$pixpath.'/i/hide.gif" style="height: 16px; width: 16px;" /></a>';
         } else {
-            $visible = '<a href="blocks.php?show='.$blockid.'" title="'.$strshow.'">'.
+            $visible = '<a href="blocks.php?show='.$blockid.'&sesskey='.$USER->sesskey.'" title="'.$strshow.'">'.
                        '<img src="'.$pixpath.'/i/show.gif" style="height: 16px; width: 16px;" /></a>';
             $class = ' class="dimmed_text"'; // Leading space required!
         }

admin/config.html

@@ -611,6 +611,7 @@
 
 <tr>
     <td colspan=3 align=center>
+    <input type="hidden" name="sesskey" value="<?php p($sesskey) ?>">
     <input type="submit" value="<?php print_string("savechanges") ?>"></td>
 </tr>
 </table>

admin/config.php

@@ -3,7 +3,6 @@
 
     require_once("../config.php");
 
-
     if ($site = get_site()) {   // If false then this is a new installation
         require_login();
         if (!isadmin()) {
@@ -22,6 +21,12 @@
 
 	if ($config = data_submitted($match)) {  
 
+        if (!empty($USER->id)) {             // Additional identity check
+            if (!confirm_sesskey()) {
+                error(get_string('confirmsesskeybad', 'error'));
+            }
+        }
+
         validate_form($config, $err);
 
         if (count($err) == 0) {
@@ -82,6 +87,8 @@
         echo "<br />";
     }
 
+    $sesskey = !empty($USER->id) ? $USER->sesskey : '';
+
     print_simple_box_start("center", "", "$THEME->cellheading");
 	include("config.html");
     print_simple_box_end();
@@ -110,10 +117,9 @@
 
 function validate_form(&$form, &$err) {
 
-   // if (empty($form->fullname))
-   //     $err["fullname"] = get_string("missingsitename");
+    // Currently no checks are needed ...
 
-    return;
+    return true;
 }
 
 

admin/configure.php

@@ -34,14 +34,14 @@
                            get_string("adminhelpmanagemodules"));
     $table->data[] = array("<b><a href=\"blocks.php\">".get_string("manageblocks")."</a></b>",
                            get_string("adminhelpmanageblocks"));
-    $table->data[] = array("<b><a href=\"filters.php\">".get_string("managefilters")."</a></b>",
+    $table->data[] = array("<b><a href=\"filters.php?sesskey=$USER->sesskey\">".get_string("managefilters")."</a></b>",
                            get_string("adminhelpmanagefilters"));
     if (!isset($CFG->disablescheduledbackups)) {
-        $table->data[] = array("<b><a href=\"backup.php\">".get_string("backup")."</a></b>",
+        $table->data[] = array("<b><a href=\"backup.php?sesskey=$USER->sesskey\">".get_string("backup")."</a></b>",
                                get_string("adminhelpbackup"));
     }
 
-    $table->data[]= array("<b><a href=\"editor.php\">". get_string("editorsettings") ."</a></b>",
+    $table->data[]= array("<b><a href=\"editor.php?sesskey=$USER->sesskey\">". get_string("editorsettings") ."</a></b>",
                     get_string("adminhelpeditorsettings"));
 
     print_table($table);

admin/creators.html

@@ -1,6 +1,7 @@
 
 <form name="creatorsform" id="creatorsform" method="post" action="creators.php">
 <input type="hidden" name="previoussearch" value="<?php echo $previoussearch ?>">
+<input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>">
   <table align="center" border="0" cellpadding="5" cellspacing="0">
     <tr>
       <td valign="top">

admin/creators.php

@@ -19,6 +19,10 @@
         error("You must be an administrator to use this page.");
     }
 
+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
     $primaryadmin = get_admin();
 
 /// assign all of the configurable language strings

admin/editor.html

@@ -1,4 +1,5 @@
 <form method="post" action="<?php print($GLOBALS['ME']);?>">
+<input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>">
 <table border="0" cellpadding="4" cellspacing="2">
 <tr valign=top>
     <td align=right><p>htmleditor:</td>
@@ -76,6 +77,7 @@
 </form>
 
 <form method="post" action="<?php print($GLOBALS['ME']);?>">
+<input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>">
 <center>
 <input type="submit" name="resettodefaults" value="<?php print_string('editorresettodefaults') ?>" />
 </center>

admin/editor.php

@@ -8,6 +8,10 @@
         error("Only admins can access this page");
     }
 
+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
     if ($data = data_submitted()) {
 
         // do we want default values?
@@ -21,7 +25,7 @@
                 error("Editor settings could not be updated!");
             }
         }
-        redirect("$CFG->wwwroot/$CFG->admin/editor.php", get_string("changessaved"), 1);
+        redirect("$CFG->wwwroot/$CFG->admin/editor.php?sesskey=$USER->sesskey", get_string("changessaved"), 1);
 
     } else {
         // Generate edit form

admin/enrol.php

@@ -3,8 +3,10 @@
        //             Yes, enrol is correct English spelling.
 
     include("../config.php");
+
+    $enrol = optional_param('enrol', $CFG->enrol);
+
     require_login();
-    optional_variable($enrol, $CFG->enrol);
 
     if (!$site = get_site()) {
         redirect("index.php");
@@ -14,6 +16,11 @@
         error("Only the admin can use this page");
     }
 
+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
+    $enrol = clean_filename($enrol);
     require_once("$CFG->dirroot/enrol/$enrol/enrol.php");   /// Open the class
 
     $enrolment = new enrolment_plugin();
@@ -24,7 +31,7 @@
 	if ($frm = data_submitted()) {
         if ($enrolment->process_config($frm)) {
             set_config('enrol', $frm->enrol);
-            redirect("enrol.php", get_string("changessaved"), 1);
+            redirect("enrol.php?sesskey=$USER->sesskey", get_string("changessaved"), 1);
         }
 	} else {
         $frm = $CFG;
@@ -47,13 +54,14 @@
                    <a href=\"users.php\">$str->users</a> -> $str->enrolments");
 
     echo "<form target=\"{$CFG->framename}\" name=\"enrolmenu\" method=\"post\" action=\"enrol.php\">";
+    echo "<input type=\"hidden\" name=\"sesskey\" value=\"".$USER->sesskey."\">";
     echo "<div align=\"center\"><p><b>";
 
 
 /// Choose an enrolment method
     echo get_string('chooseenrolmethod').': ';
 	choose_from_menu ($options, "enrol", $enrol, "",
-                      "document.location='enrol.php?enrol='+document.enrolmenu.enrol.options[document.enrolmenu.enrol.selectedIndex].value", "");
+                      "document.location='enrol.php?sesskey=$USER->sesskey&enrol='+document.enrolmenu.enrol.options[document.enrolmenu.enrol.selectedIndex].value", "");
 
     echo "</b></p></div>";
     

admin/filters.html

@@ -1,6 +1,7 @@
 <?php print_simple_box_start("center", "", "$THEME->cellheading"); ?>
 
 <form name="filters" id="filters" method="post" action="filters.php">
+<input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>">
   <table align="center" border="0" cellpadding="5" cellspacing="0">
     <tr>
       <td valign="top"><div align="right">
@@ -80,6 +81,7 @@
 <?php print_simple_box_start("center", "", "$THEME->cellheading"); ?>
 
 <form name="options" id="options" method="post" action="filters.php">
+<input type="hidden" name="sesskey" value="<?php echo $USER->sesskey ?>">
 <input type="hidden" name="options" value="1">
 <table cellpadding="20">
 <tr valign=top>

admin/filters.php

@@ -16,6 +16,10 @@
         error("Only administrators can use this page!");
     }
 
+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
     if (!$site = get_site()) {
         error("Site isn't defined!");
     }

admin/index.php

@@ -282,46 +282,46 @@
                     get_string("adminhelpmanagemodules")."</font><br />";
     $configdata .= "<font size=+1>&nbsp;</font><a href=\"blocks.php\">".get_string("manageblocks")."</a> - <font size=1>".
                     get_string("adminhelpmanageblocks")."</font><br />";
-    $configdata .= "<font size=+1>&nbsp;</font><a href=\"filters.php\">".get_string("managefilters")."</a> - <font size=1>".
+    $configdata .= "<font size=+1>&nbsp;</font><a href=\"filters.php?sesskey=$USER->sesskey\">".get_string("managefilters")."</a> - <font size=1>".
                     get_string("adminhelpmanagefilters")."</font><br />";
     if (!isset($CFG->disablescheduledbackups)) {
-        $configdata .= "<font size=+1>&nbsp;</font><a href=\"backup.php\">".get_string("backup")."</a> - <font size=1>".
+        $configdata .= "<font size=+1>&nbsp;</font><a href=\"backup.php?sesskey=$USER->sesskey\">".get_string("backup")."</a> - <font size=1>".
                         get_string("adminhelpbackup")."</font><br />";
     }
-    $configdata .= "<font size=+1>&nbsp;</font><a href=\"editor.php\">". get_string("editorsettings") ."</a> - <font size=1>".
+    $configdata .= "<font size=+1>&nbsp;</font><a href=\"editor.php?sesskey=$USER->sesskey\">". get_string("editorsettings") ."</a> - <font size=1>".
                     get_string("adminhelpeditorsettings")."</font><br />";
 
     $table->data[] = array("<font size=+1><b><a href=\"configure.php\">".get_string("configuration")."</a></b>", 
                             $configdata);
 
 
-    $userdata = "<font size=+1>&nbsp;</font><a href=\"auth.php\">".get_string("authentication")."</a> - <font size=1>".
+    $userdata = "<font size=+1>&nbsp;</font><a href=\"auth.php?sesskey=$USER->sesskey\">".get_string("authentication")."</a> - <font size=1>".
                  get_string("adminhelpauthentication")."</font><br />";
     $userdata .= "<font size=+1>&nbsp;</font><a href=\"user.php\">".get_string("edituser")."</a> - <font size=1>".
                  get_string("adminhelpedituser")."</font><br />";
-    $userdata .= "<font size=+1>&nbsp;</font><a href=\"$CFG->wwwroot/$CFG->admin/user.php?newuser=true\">".
+    $userdata .= "<font size=+1>&nbsp;</font><a href=\"$CFG->wwwroot/$CFG->admin/user.php?newuser=true&sesskey=$USER->sesskey\">".
                  get_string("addnewuser")."</a> - <font size=1>".
                  get_string("adminhelpaddnewuser")."</font><br />";
-    $userdata .= "<font size=+1>&nbsp;</font><a href=\"$CFG->wwwroot/$CFG->admin/uploaduser.php\">".
+    $userdata .= "<font size=+1>&nbsp;</font><a href=\"$CFG->wwwroot/$CFG->admin/uploaduser.php?sesskey=$USER->sesskey\">".
                  get_string("uploadusers")."</a> - <font size=1>".
                  get_string("adminhelpuploadusers")."</font><br />";
 
-    $userdata .= "<hr><font size=+1>&nbsp;</font><a href=\"enrol.php\">".get_string("enrolments")."</a> - <font size=1>".
+    $userdata .= "<hr><font size=+1>&nbsp;</font><a href=\"enrol.php?sesskey=$USER->sesskey\">".get_string("enrolments")."</a> - <font size=1>".
                  get_string("adminhelpenrolments")."</font><br />";
-    $userdata .= "<font size=+1>&nbsp;</font><a href=\"../course/index.php?edit=off\">".get_string("assignstudents")."</a> - <font size=1>".
+    $userdata .= "<font size=+1>&nbsp;</font><a href=\"../course/index.php?edit=off&sesskey=$USER->sesskey\">".get_string("assignstudents")."</a> - <font size=1>".
                  get_string("adminhelpassignstudents")."</font><br />";
 
-    $userdata .= "<font size=+1>&nbsp;</font><a href=\"../course/index.php?edit=on\">".get_string("assignteachers")."</a> - <font size=1>".
+    $userdata .= "<font size=+1>&nbsp;</font><a href=\"../course/index.php?edit=on&sesskey=$USER->sesskey\">".get_string("assignteachers")."</a> - <font size=1>".
                  get_string("adminhelpassignteachers").
                  " <img src=\"../pix/t/user.gif\" height=11 width=11></font><br />";
-    $userdata .= "<font size=+1>&nbsp;</font><a href=\"creators.php\">".get_string("assigncreators")."</a> - <font size=1>".
+    $userdata .= "<font size=+1>&nbsp;</font><a href=\"creators.php?sesskey=$USER->sesskey\">".get_string("assigncreators")."</a> - <font size=1>".
                  get_string("adminhelpassigncreators")."</font><br />";
-    $userdata .= "<font size=+1>&nbsp;</font><a href=\"admin.php\">".get_string("assignadmins")."</a> - <font size=1>".
+    $userdata .= "<font size=+1>&nbsp;</font><a href=\"admin.php?sesskey=$USER->sesskey\">".get_string("assignadmins")."</a> - <font size=1>".
                  get_string("adminhelpassignadmins")."</font><br />";
 
     $table->data[] = array("<font size=+1><b><a href=\"users.php\">".get_string("users")."</a></b>", $userdata);
 
-    $table->data[] = array("<font size=+1><b><a href=\"../course/index.php?edit=on\">".get_string("courses")."</a></b>",
+    $table->data[] = array("<font size=+1><b><a href=\"../course/index.php?edit=on&sesskey=$USER->sesskey\">".get_string("courses")."</a></b>",
                            "<font size=+1>&nbsp;</font>".get_string("adminhelpcourses"));
     $table->data[] = array("<font size=+1><b><a href=\"../course/log.php?id=$site->id\">".get_string("logs")."</a></b>",
                            "<font size=+1>&nbsp;</font>".get_string("adminhelplogs"));
@@ -354,7 +354,8 @@
     echo "</td>";
 
     echo "<td align=center width=33%>";
-    print_single_button("register.php", NULL, get_string("registration"));
+    $options['sesskey'] = $USER->sesskey;
+    print_single_button("register.php", $options, get_string("registration"));
     echo "</td>";
     echo "<tr></table>";
 

admin/lang.php

@@ -29,6 +29,7 @@
             $title = $strmissingstrings;
             $button = '<form target="'.$CFG->framename.'" method="get" action="'.$CFG->wwwroot.'/admin/lang.php">'.
                       '<input type="hidden" name="mode" value="compare" />'.
+                      '<input type="hidden" name="sesskey" value="'.$USER->sesskey.'" />'.
                       '<input type="submit" value="'.$strcomparelanguage.'" /></form>';
             break;
         case "compare":
@@ -36,6 +37,7 @@
             $title = $strcomparelanguage;
             $button = '<form target="'.$CFG->framename.'" method="get" action="'.$CFG->wwwroot.'/admin/lang.php">'.
                       '<input type="hidden" name="mode" value="missing" />'.
+                      '<input type="hidden" name="sesskey" value="'.$USER->sesskey.'" />'.
                       '<input type="submit" value="'.$strmissingstrings.'" /></form>';
             break;
         default:
@@ -60,8 +62,8 @@
         echo "</td><td>";
         echo popup_form ("$CFG->wwwroot/admin/lang.php?lang=", $langs, "chooselang", $currlang, "", "", "", true);
         echo "</td></tr></table>";
-        print_heading("<a href=\"lang.php?mode=missing\">$strmissingstrings</a>");
-        print_heading("<a href=\"lang.php?mode=compare\">$strcomparelanguage</a>");
+        print_heading("<a href=\"lang.php?mode=missing&sesskey=$USER->sesskey\">$strmissingstrings</a>");
+        print_heading("<a href=\"lang.php?mode=compare&sesskey=$USER->sesskey\">$strcomparelanguage</a>");
         echo "<center><hr noshade size=1>";
         $options["lang"] = $currentlang;
         print_single_button("http://moodle.org/download/lang/", $options, get_string("latestlanguagepack"));
@@ -85,7 +87,7 @@
         }
     }
 
-    if ($mode == "missing") {
+    if ($mode == "missing" and confirm_sesskey()) {
         // For each file, check that a counterpart exists, then check all the strings
     
         foreach ($stringfiles as $file) {
@@ -151,7 +153,7 @@
             notice(get_string("languagegood"), "lang.php");
         }
 
-    } else if ($mode == "compare") {
+    } else if ($mode == "compare" and confirm_sesskey()) {
 
         if (isset($_POST['currentfile'])){   // Save a file
             $newstrings = $_POST;
@@ -159,7 +161,7 @@
             if (lang_save_file($langdir, $currentfile, $newstrings)) {
                 notify(get_string("changessaved")." ($langdir/$currentfile)", "green");
             } else {
-                error("Could not save the file '$currentfile'!", "lang.php?mode=compare&currentfile=$currentfile");
+                error("Could not save the file '$currentfile'!", "lang.php?mode=compare&currentfile=$currentfile&sesskey=$USER->sesskey");
             }
         }
 
@@ -171,7 +173,7 @@
             if ($file == $currentfile) {
                 echo "<b>$file</b> &nbsp; ";
             } else {
-                echo "<a href=\"lang.php?mode=compare&currentfile=$file\">$file</a> &nbsp; ";
+                echo "<a href=\"lang.php?mode=compare&currentfile=$file&sesskey=$USER->sesskey\">$file</a> &nbsp; ";
             }
         }
         echo '</font></center>';
@@ -214,6 +216,7 @@
 
         if ($editable) {
             echo "<form name=\"$currentfile\" action=\"lang.php\" method=\"post\">";
+            echo '<input type="hidden" name="sesskey" value="'.$USER->sesskey.'" />';
         }
         echo "<table width=\"100%\" cellpadding=2 cellspacing=3 border=0>";
         foreach ($enstring as $key => $envalue) {

admin/module.php

@@ -13,6 +13,9 @@
         error("Site isn't defined!");
     }
 
+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
 
 /// If data submitted, then process and store.
 
@@ -29,6 +32,7 @@
 
     require_variable($module);
 
+    $module = clean_filename($module);
 	require_once("$CFG->dirroot/mod/$module/lib.php");
 
 

admin/modules.php

@@ -42,7 +42,7 @@
 
 /// If data submitted, then process and store.
 
-    if (!empty($hide)) {
+    if (!empty($hide) and confirm_sesskey()) {
         if (!$module = get_record("modules", "name", $hide)) {
             error("Module doesn't exist!");
         }
@@ -50,7 +50,7 @@
         set_field("course_modules", "visible", "0", "module", $module->id); // Hide all related activity modules
     }
 
-    if (!empty($show)) {
+    if (!empty($show) and confirm_sesskey()) {
         if (!$module = get_record("modules", "name", $show)) {
             error("Module doesn't exist!");
         }
@@ -58,13 +58,13 @@
         set_field("course_modules", "visible", "1", "module", $module->id); // Show all related activity modules
     }
 
-    if (!empty($delete)) {
+    if (!empty($delete) and confirm_sesskey()) {
       
         $strmodulename = get_string("modulename", "$delete");
 
         if (empty($confirm)) {
             notice_yesno(get_string("moduledeleteconfirm", "", $strmodulename), 
-                         "modules.php?delete=$delete&confirm=$delete", 
+                         "modules.php?delete=$delete&confirm=$delete&sesskey=$USER->sesskey", 
                          "modules.php");
             print_footer();
             exit;
@@ -162,10 +162,10 @@
 
         $icon = "<img src=\"$modpixpath/$module->name/icon.gif\" hspace=10 height=16 width=16 border=0>";
 
-        $delete = "<a href=\"modules.php?delete=$module->name\">$strdelete</a>";
+        $delete = "<a href=\"modules.php?delete=$module->name&sesskey=$USER->sesskey\">$strdelete</a>";
 
         if (file_exists("$CFG->dirroot/mod/$module->name/config.html")) {
-            $settings = "<a href=\"module.php?module=$module->name\">$strsettings</a>";
+            $settings = "<a href=\"module.php?module=$module->name&sesskey=$USER->sesskey\">$strsettings</a>";
         } else {
             $settings = "";
         }
@@ -173,11 +173,11 @@
         $count = count_records("$module->name");
 
         if ($module->visible) {
-            $visible = "<a href=\"modules.php?hide=$module->name\" title=\"$strhide\">".
+            $visible = "<a href=\"modules.php?hide=$module->name&sesskey=$USER->sesskey\" title=\"$strhide\">".
                        "<img src=\"$pixpath/i/hide.gif\" align=\"absmiddle\" height=16 width=16 border=0></a>";
             $class = "";
         } else {
-            $visible = "<a href=\"modules.php?show=$module->name\" title=\"$strshow\">".
+            $visible = "<a href=\"modules.php?show=$module->name&sesskey=$USER->sesskey\" title=\"$strshow\">".
                        "<img src=\"$pixpath/i/show.gif\" align=\"absmiddle\" height=16 width=16 border=0></a>";
             $class = "class=\"dimmed_text\"";
         }

admin/register.php

@@ -13,6 +13,10 @@
         redirect("index.php");
     }
 
+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
     if (!$admin = get_admin()) {
         error("No admins");
     }
@@ -21,12 +25,8 @@
         $admin->country = $CFG->country;
     }
 
-    if (!$admin->secret) {    // secret field hasn't been set yet
-        $admin->secret = random_string(15);
-    
-        if (!set_field("user", "secret", $admin->secret, "id", $admin->id)) {
-            error("Could not set admin's secret string!");
-        }
+    if (empty($CFG->siteidentifier)) {    // Unique site identification code
+        set_config('siteidentifier', random_string(32));
     }
 
 
@@ -39,7 +39,7 @@
 	print_header("$site->shortname: $strregistration", "$site->fullname", 
                  "<a href=\"../$CFG->admin/index.php\">$stradministration</a> -> $strregistration");
 
-    print_heading($strmanagemodules);
+    print_heading($strregistration);
 
     print_simple_box($strregistrationinfo, "center", "70%");
     echo "<br />";
@@ -60,7 +60,7 @@
     echo "<!-- is flagged as a new entry and will be manually checked by the list maintainer -->\n";
    
     echo "<input type=\"hidden\" name=\"url\" value=\"$CFG->wwwroot\">\n";
-    echo "<input type=\"hidden\" name=\"secret\" value=\"$admin->secret\">\n";
+    echo "<input type=\"hidden\" name=\"secret\" value=\"$CFG->siteidentifier\">\n";
     echo "<input type=\"hidden\" name=\"host\" value=\"".$_SERVER["HTTP_HOST"]."\">\n";
     echo "<input type=\"hidden\" name=\"lang\" value=\"".current_language()."\">\n";
     echo "</td></tr>\n";

admin/site.html

@@ -1,4 +1,4 @@
-<form method="post" action="site.php" name="form" <?php echo $onsubmit ?>>
+<form method="post" action="site.php" name="form">
 <table cellpadding=9 cellspacing=0 >
 <tr valign=top>
     <td align=right><P><?php print_string("fullsitename") ?>:</td>
@@ -111,10 +111,5 @@
 <input type="hidden" name="id" value="<?php p($form->id) ?>">
 <input type="hidden" name="category" value="<?php p($form->category) ?>">
 <input type="hidden" name="format" value="<?php p($form->format) ?>">
+<input type="hidden" name="sesskey" value="<?php p($sesskey) ?>">
 </form>
-
-<?php 
-   if ($usehtmleditor) { 
-       print_richedit_javascript("form", "summary", "no");
-   }
-?>

admin/site.php

@@ -14,6 +14,12 @@
 
 	if ($form = data_submitted()) {
 
+        if (!empty($USER->id)) {             // Additional identity check
+            if (!confirm_sesskey()) {
+                error(get_string('confirmsesskeybad', 'error'));
+            }
+        }
+
         validate_form($form, $err);
 
         if (count($err) == 0) {
@@ -108,17 +114,23 @@
         print_heading($strsitesettings);
     }
 
-    $defaultformat = FORMAT_HTML;
-    if ($usehtmleditor = can_use_richtext_editor()) {
-        $onsubmit = "onsubmit=\"copyrichtext(form.summary);\"";
+    if (empty($USER->id)) {  // New undefined admin user
+        $USER->htmleditor = true;
+        $sesskey = '';
     } else {
-        $onsubmit = "";
+        $sesskey = $USER->sesskey;
     }
+    $usehtmleditor = can_use_html_editor();
+    $defaultformat = FORMAT_HTML;
 
     print_simple_box_start("center", "", "$THEME->cellheading");
     include("site.html");
     print_simple_box_end();
 
+    if ($usehtmleditor) { 
+        use_html_editor();
+    }
+
     if (!$firsttime) {
         print_footer();
     }

admin/timezone.php

@@ -17,7 +17,7 @@
 
     print_heading("");
 
-    if (isset($zone)) {
+    if (isset($zone) and confirm_sesskey()) {
         $db->debug = true;
         echo "<center>";
         execute_sql("UPDATE {$CFG->prefix}user SET timezone = '$zone'");
@@ -47,11 +47,12 @@
         }
     }
 
-    echo "<center><form action=timezone.php method=get>";
+    echo '<center><form action="timezone.php" method="get">';
     echo "$strusers ($strall): ";
     choose_from_menu ($timezones, "zone", $user->timezone, get_string("serverlocaltime"), "", "99");
-    echo "<input type=submit value=\"$strsavechanges\">";
-    echo "</form>";
+    echo "<input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\">";
+    echo "<input type=\"submit\" value=\"$strsavechanges\">";
+    echo "</form></center>";
 
     print_footer();
 

admin/upgradelogs.php

@@ -33,10 +33,12 @@
 
     if (empty($_GET['confirm'])) {
         notice_yesno(get_string("upgradelogsinfo", "admin"), 
-                     "upgradelogs.php?confirm=true", 
+                     "upgradelogs.php?confirm=true&sesskey=$USER->sesskey", 
                      "index.php");
         print_footer();
         exit;
+    } else if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
     }
 
 

admin/uploaduser.php

@@ -17,6 +17,10 @@
         error("Could not find site-level course");
     }
 
+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
     if (!$adminuser = get_admin()) {
         error("Could not find site admin");
     }
@@ -105,7 +109,7 @@
         foreach ($header as $i => $h) {
             $h = trim($h); $header[$i] = $h; // remove whitespace
             if (!($required[$h] or $optionalDefaults[$h] or $optional[$h])) {
-                error(get_string('invalidfieldname', 'error', $h), 'uploaduser.php');
+                error(get_string('invalidfieldname', 'error', $h), 'uploaduser.php?sesskey='.$USER->sesskey);
             }
             if ($required[$h]) {
                 $required[$h] = 2;
@@ -114,7 +118,7 @@
         // check for required fields
         foreach ($required as $key => $value) {
             if ($value < 2) {
-                error(get_string('fieldrequired', 'error', $key), 'uploaduser.php');
+                error(get_string('fieldrequired', 'error', $key), 'uploaduser.php?sesskey='.$USER->sesskey);
             }
         }
         $linenum = 2; // since header is line 1
@@ -140,7 +144,7 @@
                     if ($required[$name] and !$value) {
                         error(get_string('missingfield', 'error', $name). " ".
                               get_string('erroronline', 'error', $linenum), 
-                              'uploaduser.php');
+                              'uploaduser.php?sesskey='.$USER->sesskey);
                     }
                     // password needs to be encrypted
                     else if ($name == "password") {
@@ -258,6 +262,7 @@
     echo '<center>';
     echo '<form method="post" enctype="multipart/form-data" action="uploaduser.php">'.
          $strchoose.':<input type="hidden" name="MAX_FILE_SIZE" value="'.$maxuploadsize.'">'.
+         '<input type="hidden" name="sesskey" value="'.$USER->sesskey.'">'.
          '<input type="file" name="userfile" size=30>'.
          '<input type="submit" value="'.$struploadusers.'">'.
          '</form></br>';

admin/user.php

@@ -18,6 +18,8 @@
     unset($admin);
     unset($teacher);
 
+    $search = trim($search);
+
     if (! record_exists("user_admins")) {   // No admin user yet
 
         $user->firstname = get_string("admin");
@@ -57,6 +59,7 @@
 
         $USER = $user;
         $USER->loggedin = true;
+        $USER->sesskey  = random_string(10); // for added security, used to check script parameters
         $USER->site = $CFG->wwwroot;
         $USER->admin = true;
         $USER->teacher["$site->id"] = true;
@@ -77,7 +80,7 @@
         error("You must be an administrator to edit users this way.");
     }
 
-    if ($newuser) {                 // Create a new user
+    if ($newuser and confirm_sesskey()) {                 // Create a new user
         $user->auth      = "manual";
         $user->firstname = "";
         $user->lastname  = "";
@@ -118,7 +121,7 @@
                          "<a href=\"users.php\">$strusers</a> -> $stredituser");
         }
 
-        if ($confirmuser) {
+        if ($confirmuser and confirm_sesskey()) {
             if (!$user = get_record("user", "id", "$confirmuser")) {
                 error("No such user!");
             }
@@ -134,7 +137,7 @@
                 notify(get_string("usernotconfirmed", "", fullname($user, true)));
             }
 
-        } else if ($delete) {              // Delete a selected user, after confirmation
+        } else if ($delete and confirm_sesskey()) {              // Delete a selected user, after confirmation
             if (!$user = get_record("user", "id", "$delete")) {
                 error("No such user!");
             }
@@ -147,7 +150,7 @@
             if ($confirm != md5($delete)) {
                 $fullname = fullname($user, true);
                 notice_yesno(get_string("deletecheckfull", "", "'$fullname'"),
-                     "user.php?delete=$delete&confirm=".md5($delete), "user.php");
+                     "user.php?delete=$delete&confirm=".md5($delete)."&sesskey=$USER->sesskey", "user.php");
 
                 exit;
             } else if (!$user->deleted) {
@@ -300,7 +303,7 @@
                 if ($user->id == $USER->id or $user->username == "changeme") {
                     $deletebutton = "";
                 } else {
-                    $deletebutton = "<a href=\"user.php?delete=$user->id\">$strdelete</a>";
+                    $deletebutton = "<a href=\"user.php?delete=$user->id&sesskey=$USER->sesskey\">$strdelete</a>";
                 }
                 if ($user->lastaccess) {
                     $strlastaccess = format_time(time() - $user->lastaccess);
@@ -308,7 +311,7 @@
                     $strlastaccess = get_string("never");
                 }
                 if ($user->confirmed == 0) {
-                    $confirmbutton = "<a href=\"user.php?confirmuser=$user->id\">" . get_string("confirm") . "</a>";
+                    $confirmbutton = "<a href=\"user.php?confirmuser=$user->id&sesskey=$USER->sesskey\">" . get_string("confirm") . "</a>";
                 } else {
                     $confirmbutton = "";
                 }
@@ -333,7 +336,7 @@
             echo "</form>";    
             echo "</td></tr></table>";
             if (is_internal_auth()){
-                print_heading("<a href=\"user.php?newuser=true\">".get_string("addnewuser")."</a>");
+                print_heading("<a href=\"user.php?newuser=true&sesskey=$USER->sesskey\">".get_string("addnewuser")."</a>");
             }
 
             print_table($table);
@@ -345,7 +348,7 @@
         }
 
         if (is_internal_auth()){
-            print_heading("<a href=\"user.php?newuser=true\">".get_string("addnewuser")."</a>");
+            print_heading("<a href=\"user.php?newuser=true&sesskey=$USER->sesskey\">".get_string("addnewuser")."</a>");
         }
 
         print_footer();

admin/users.php

@@ -22,27 +22,27 @@
 
     $table->align = array ("right", "left");
 
-    $table->data[] = array("<b><a href=\"auth.php\">".get_string("authentication")."</a></b>",
+    $table->data[] = array("<b><a href=\"auth.php?sesskey=$USER->sesskey\">".get_string("authentication")."</a></b>",
                            get_string("adminhelpauthentication"));
 
     $table->data[] = array("<b><a href=\"user.php\">".get_string("edituser")."</a></b>",
                            get_string("adminhelpedituser"));
     if (is_internal_auth()) {
-        $table->data[] = array("<b><a href=\"$CFG->wwwroot/$CFG->admin/user.php?newuser=true\">".get_string("addnewuser")."</a></b>",
+        $table->data[] = array("<b><a href=\"$CFG->wwwroot/$CFG->admin/user.php?newuser=true&sesskey=$USER->sesskey\">".get_string("addnewuser")."</a></b>",
                                get_string("adminhelpaddnewuser"));
-        $table->data[] = array("<b><a href=\"$CFG->wwwroot/$CFG->admin/uploaduser.php\">".get_string("uploadusers")."</a></b>",
+        $table->data[] = array("<b><a href=\"$CFG->wwwroot/$CFG->admin/uploaduser.php?sesskey=$USER->sesskey\">".get_string("uploadusers")."</a></b>",
                                get_string("adminhelpuploadusers"));
     }
     $table->data[] = array('', '<hr />');
-    $table->data[] = array("<b><a href=\"enrol.php\">".get_string("enrolments")."</a></b>",
+    $table->data[] = array("<b><a href=\"enrol.php?sesskey=$USER->sesskey\">".get_string("enrolments")."</a></b>",
                            get_string("adminhelpenrolments"));
-    $table->data[] = array("<b><a href=\"../course/index.php?edit=off\">".get_string("assignstudents")."</a></b>",
+    $table->data[] = array("<b><a href=\"../course/index.php?edit=off&sesskey=$USER->sesskey\">".get_string("assignstudents")."</a></b>",
                            get_string("adminhelpassignstudents"));
-    $table->data[] = array("<b><a href=\"../course/index.php?edit=on\">".get_string("assignteachers")."</a></b>",
+    $table->data[] = array("<b><a href=\"../course/index.php?edit=on&sesskey=$USER->sesskey\">".get_string("assignteachers")."</a></b>",
                            get_string("adminhelpassignteachers")." <img src=\"../pix/t/user.gif\" height=11 width=11>");
-    $table->data[] = array("<b><a href=\"creators.php\">".get_string("assigncreators")."</a></b>",
+    $table->data[] = array("<b><a href=\"creators.php?sesskey=$USER->sesskey\">".get_string("assigncreators")."</a></b>",
                            get_string("adminhelpassigncreators"));
-    $table->data[] = array("<b><a href=\"admin.php\">".get_string("assignadmins")."</a></b>",
+    $table->data[] = array("<b><a href=\"admin.php?sesskey=$USER->sesskey\">".get_string("assignadmins")."</a></b>",
                            get_string("adminhelpassignadmins"));
 
     print_table($table);

auth/db/lib.php

@@ -12,7 +12,9 @@ function auth_user_login ($username, $password) {
     // two databases of the same kind ... it seems to get confused when trying to access
     // the first database again, after having accessed the second.
     // The following hack will make the database explicit which keeps it happy
-    $CFG->prefix = "$CFG->dbname.$CFG->prefix";
+    if ($CFG->dbtype != 'postgres7') {
+       $CFG->prefix = "$CFG->dbname.$CFG->prefix";
+    }   
 
     // Connect to the external database
     $authdb = &ADONewConnection($CFG->auth_dbtype);         

auth/ldap/lib.php

@@ -132,7 +132,7 @@ function auth_get_userinfo($username){
         $user_entry = ldap_get_entries($ldap_connection, $user_info_result);
         foreach ($attrmap as $key=>$value){
             if(isset($user_entry[0][strtolower($value)][0])){
-                $result[$key]=$user_entry[0][strtolower($value)][0];
+                $result[$key]=utf8_decode($user_entry[0][strtolower($value)][0]);
             }
         }
         $result['guid']='ldap';
@@ -368,7 +368,7 @@ function auth_iscreator($username=0) {
     }
    
     if ((! $CFG->ldap_creators) OR (! $CFG->ldap_memberattribute)) {
-        return false;
+        return null;
     } 
 
     return auth_ldap_isgroupmember($username, $CFG->ldap_creators);

auth/pam/config.html

@@ -0,0 +1,9 @@
+<tr valign="top"> 
+  <td align="right"><p><?php  print_string("instructions", "auth") ?>:</p></td>
+  <td><textarea name="auth_instructions" cols="30" rows="10" wrap="virtual"><?php  p($config->auth_instructions) ?></textarea> 
+  </td>
+  <td> 
+    <?php  print_string("authinstructions","auth") ?>
+    <?php  helpbutton("text", get_string("helptext")) ?>
+  </td>
+</tr>

auth/pam/lib.php

@@ -0,0 +1,42 @@
+<?PHP  // $Id$
+       //
+       // PAM (Pluggable Authentication Modules) for Moodle 
+       // 
+       // Description:
+       // Authentication by using the PHP4 PAM module:
+       // http://www.math.ohio-state.edu/~ccunning/pam_auth/
+       // 
+       // Version 0.2: 2004/09/01 by Martin Vögeli (stable version)
+       // Version 0.1: 2004/08/30 by Martin Vögeli (first draft)
+       // 
+       // Contact: martinvoegeli@gmx.ch
+       // Website 1: http://elearning.zhwin.ch/
+       // Website 2: http://birdy1976.com/
+       //
+       // License:  GPL License v2
+       // // // // // // // // // // // // // // // // // // //
+
+function auth_user_login ($username, $password) {
+    global $CFG;
+    // returns true if the username and password work
+    // and false if they are wrong or don't exist
+    // variable to store possible errors during authentication
+    $strErrorPAM = " ";
+    // the maximal length of returned messages is 512
+    // let's double the number to give it enough space ;)
+    // (the errror variable is passed by reference)
+    for ($i = 1; $i <= 1024; $i++) {
+        $strErrorPAM += "{$strErrorPAM} ";
+    }
+    // just for testing and debugging
+    // error_reporting(E_ALL);
+    // finally the actual authentication part...
+    if (pam_auth($username, $password, &$strErrorPAM)) {
+        // authentication success
+        return true;
+    } else {
+        // authentication failure
+        return false;
+    }
+}
+?>

backup/backup_scheduled.php

@@ -54,9 +54,31 @@ function schedule_backup_cron() {
         $status = false;
     }
 
+    //Delete old_entries from backup tables
+    if ($status) {
+        mtrace("    Deleting old data");
+        $status = backup_delete_old_data();
+    }
+
     //Now we get a list of courses in the server
     if ($status) {
         mtrace("    Checking courses");
+        //First of all, we delete everything from backup tables related to deleted courses
+        mtrace("        Skipping deleted courses");
+        $skipped = 0;
+        if ($bckcourses = get_records('backup_courses')) {
+            foreach($bckcourses as $bckcourse) {
+                //Search if it exists
+                if (!$exists = get_record('course', 'id', "$bckcourse->courseid")) {
+                    //Doesn't exist, so delete from backup tables
+                    delete_records('backup_courses', 'courseid', "$bckcourse->courseid");
+                    delete_records('backup_log', 'courseid', "$bckcourse->courseid");
+                    $skipped++;
+                }
+            }
+        }
+        mtrace("            $skipped courses");
+        //Now process existing courses
         $courses = get_records("course");
         //For each course, we check (insert, update) the backup_course table
         //with needed data
@@ -79,20 +101,25 @@ function schedule_backup_cron() {
                 }
                 //Now we backup every course with nextstarttime < now
                 if ($backup_course->nextstarttime > 0 && $backup_course->nextstarttime < $now) {
-                    //Set laststarttime
-                    $starttime = time();
-                    set_field("backup_courses","laststarttime",$starttime,"courseid",$backup_course->courseid);
-                    //Launch backup
-                    $course_status = schedule_backup_launch_backup($course,$starttime);
                     //We have to send a email because we have included at least one backup
                     $emailpending = true;
-                    //Set lastendtime
-                    set_field("backup_courses","lastendtime",time(),"courseid",$backup_course->courseid);
-                    //Set laststatus
-                    if ($course_status) {
-                        set_field("backup_courses","laststatus","1","courseid",$backup_course->courseid);
-                    } else {
-                        set_field("backup_courses","laststatus","0","courseid",$backup_course->courseid);
+                    //Only make the backup if laststatus isn't 2-UNFINISHED (uncontrolled error)
+                    if ($backup_course->laststatus != 2) {
+                        //Set laststarttime
+                        $starttime = time();
+                        set_field("backup_courses","laststarttime",$starttime,"courseid",$backup_course->courseid);
+                        //Set course status to unfinished, the process will reset it
+                        set_field("backup_courses","laststatus","2","courseid",$backup_course->courseid);
+                        //Launch backup
+                        $course_status = schedule_backup_launch_backup($course,$starttime);
+                        //Set lastendtime
+                        set_field("backup_courses","lastendtime",time(),"courseid",$backup_course->courseid);
+                        //Set laststatus
+                        if ($course_status) {
+                            set_field("backup_courses","laststatus","1","courseid",$backup_course->courseid);
+                        } else {
+                            set_field("backup_courses","laststatus","0","courseid",$backup_course->courseid);
+                        }
                     }
                 }
 
@@ -117,25 +144,47 @@ function schedule_backup_cron() {
         delete_records_select("backup_log", "laststarttime < '$loglifetime'");
     }
 
-    //Send email to admin
+    //Send email to admin if necessary
     if ($emailpending) {
         mtrace("    Sending email to admin");
         $message = "";
-        //Build the message text (future versions should handle html messages too!!)
-        $logs = get_records_select ("backup_log","laststarttime >= '$now'","id");
-        if ($logs) {
-            $currentcourse = 1;
-            foreach ($logs as $log) {
-                if ($currentcourse != $log->courseid) {
-                    $message .= "\n==================================================\n\n";
-                    $currentcourse = $log->courseid;
-                }
-                $message .= userdate($log->time,"%T",$admin->timezone)." ".$log->info."\n";
-            }
+
+        //Get info about the status of courses
+        $count_all = count_records('backup_courses');
+        $count_ok = count_records('backup_courses','laststatus','1');
+        $count_error = count_records('backup_courses','laststatus','0');
+        $count_unfinished = count_records('backup_courses','laststatus','2');
+
+        //Build the message text
+        //Summary
+        $message .= get_string('summary')."\n";
+        $message .= "==================================================\n";
+        $message .= "  ".get_string('courses').": ".$count_all."\n";
+        $message .= "  ".get_string('ok').": ".$count_ok."\n";
+        $message .= "  ".get_string('error').": ".$count_error."\n";
+        $message .= "  ".get_string('unfinished').": ".$count_unfinished."\n\n";
+
+        //Reference
+        if ($count_error != 0 || $count_unfinished != 0) {
+            $message .= "  ".get_string('backupfailed')."\n\n";
+            $dest_url = $CFG->wwwroot.'/backup/log.php';
+            $message .= "  ".get_string('backuptakealook','',$dest_url)."\n\n";
+            //Reset unfinished to error
+            set_field('backup_courses','laststatus','0','laststatus','2');
+        } else {
+            $message .= "  ".get_string('backupfinished')."\n";
         }
-        //Send the message
+
+        //Build the message subject
         $site = get_site();
-        email_to_user($admin,$admin,"$site->shortname: ".get_string("scheduledbackupstatus"),$message);
+        $prefix = $site->shortname.": ";
+        if ($count_error != 0 || $count_unfinished != 0) {
+            $prefix .= "[".strtoupper(get_string('error'))."] ";
+        } 
+        $subject = $prefix.get_string("scheduledbackupstatus");
+
+        //Send the message
+        email_to_user($admin,$admin,$subject,$message);
     }
     
 
@@ -161,6 +210,7 @@ function schedule_backup_launch_backup($course,$starttime = 0) {
         schedule_backup_log($starttime,$course->id,"  Phase 2: Executing and copying:");
         $status = schedule_backup_course_execute($preferences,$starttime);
     }
+
     if ($status && $preferences) {
         //Only if the backup_sche_keep is set
         if ($preferences->backup_keep) {
@@ -168,6 +218,7 @@ function schedule_backup_launch_backup($course,$starttime = 0) {
             $status = schedule_backup_course_delete_old_files($preferences,$starttime);
         }
     }
+
     if ($status && $preferences) {
         mtrace("            End backup OK");
         schedule_backup_log($starttime,$course->id,"End backup course $course->fullname - OK");
@@ -485,12 +536,6 @@ function schedule_backup_course_execute($preferences,$starttime = 0) {
         $status = clear_backup_dir($preferences->backup_unique_code);
     }
 
-    //Delete old_entries from backup tables
-    if ($status) {
-        schedule_backup_log($starttime,$preferences->backup_course,"    cleaning old data");
-        $status = backup_delete_old_data();
-    }
-
     //Create the moodle.xml file
     if ($status) {
         schedule_backup_log($starttime,$preferences->backup_course,"    creating backup file");

backup/backuplib.php

@@ -261,8 +261,9 @@
         $rootdir = $CFG->dataroot."/users";
         //Check if directory exists
         if (is_dir($rootdir)) {
-            $coursedirs = get_directory_list($rootdir);
-            foreach ($coursedirs as $dir) {
+            //Get directories without descend
+            $userdirs = get_directory_list($rootdir,"",false,true,false);
+            foreach ($userdirs as $dir) {
                 //Extracts user id from file path
                 $tok = strtok($dir,"/");
                 if ($tok) {
@@ -313,7 +314,8 @@
         $rootdir = $CFG->dataroot."/$course";
         //Check if directory exists
         if (is_dir($rootdir)) {
-            $coursedirs = get_directory_list($rootdir,$CFG->moddata);
+            //Get files and directories without descend
+            $coursedirs = get_directory_list($rootdir,$CFG->moddata,false,true,true);
             $backupdata_dir = "backupdata";
             foreach ($coursedirs as $dir) {
                 //Check it isn't backupdata_dir
@@ -464,6 +466,13 @@
         fwrite ($bf,full_tag("DATE",2,false,$preferences->backup_unique_code));
         //The original site wwwroot
         fwrite ($bf,full_tag("ORIGINAL_WWWROOT",2,false,$CFG->wwwroot));
+        //The zip method used
+        if (!empty($CFG->zip)) {
+            $zipmethod = 'external';
+        } else {
+            $zipmethod = 'internal';
+        }
+        fwrite ($bf,full_tag("ZIP_METHOD",2,false,$zipmethod));
         //Te includes tag
         fwrite ($bf,start_tag("DETAILS",2,true));
         //Now, go to mod element of preferences to print its status
@@ -1260,48 +1269,20 @@
         $status = true;
 
         //Base dir where everything happens
-        $basedir = $CFG->dataroot."/temp/backup/".$preferences->backup_unique_code;
+        $basedir = cleardoubleslashes($CFG->dataroot."/temp/backup/".$preferences->backup_unique_code);
         //Backup zip file name
         $name = $preferences->backup_name;
-        //List base_dir files and directories
+        //List of files and directories
         $filelist = list_directories_and_files ($basedir);
 
-        if (empty($CFG->zip)) {    // Use built-in php-based zip function
-            //echo "<br>Using pclzip";                                    //Debug
-            $files = array();
-            foreach ($filelist as $file) {
-                //If directory, append "/"
-                //Commented. Not needed wit version 2.0 of pclzip !!
-                //if (is_dir($basedir."/".$file)) {
-                //    $file = $file."/";
-                //}
-                //Include into array
-                //echo "<br>Adding file/dir ".$file;                       //Debug
-                $files[] = $basedir."/".$file;
-            }
-            include_once("$CFG->dirroot/lib/pclzip/pclzip.lib.php");
-            //include_once("$CFG->dirroot/lib/pclzip/pclerror.lib.php");   //Debug
-            //include_once("$CFG->dirroot/lib/pclzip/pcltrace.lib.php");   //Debug
-            //PclTraceOn(2);                                               //Debug
-            $archive = new PclZip("$basedir/$name");
-            if (($list = $archive->create($files,PCLZIP_OPT_REMOVE_PATH,$basedir)) == 0) {
-                error($archive->errorInfo(true));
-                $status = false;
-            } 
-            //PclTraceDisplay();                                           //Debug
-            //PclTraceOff();                                               //Debug
-        } else {                   // Use external zip program
-            //echo "<br>Using external zip";                               //Debug
-            $files = "";
-            foreach ($filelist as $file) {
-                $files .= basename($file);
-                $files .= " ";
-            }
-            $command = "cd $basedir ; $CFG->zip -r $name $files";
-            //echo "<br>Executing command: ".$command;                     //Debug
-            $status = Exec($command);
+        //Convert them to full paths
+        $files = array();
+        foreach ($filelist as $file) {
+           $files[] = "$basedir/$file";
         }
 
+        $status = zip_files($files, "$basedir/$name");
+
         //echo "<br>Status: ".$status;                                     //Debug
         return $status;
 

backup/config.html

@@ -82,6 +82,7 @@
     $keep_array[500] = "500";
 ?>
 <form method="post" action="backup.php" name="form">
+<?php echo "<input type=\"hidden\" name=\"sesskey\" value=\"".$USER->sesskey."\">"; ?>
 
 <table cellpadding=9 cellspacing=0 >
 <tr valign=top>

backup/lib.php

@@ -56,7 +56,8 @@
         global $CFG;
 
         $status = true;
-        $list = get_directory_list($CFG->dataroot."/temp/backup", "", false);
+        //Get files and directories in the temp backup dir witout descend
+        $list = get_directory_list($CFG->dataroot."/temp/backup", "", false, true, true);
         foreach ($list as $file) {
             $file_path = $CFG->dataroot."/temp/backup/".$file;
             $moddate = filemtime($file_path);

backup/log.php

@@ -28,6 +28,7 @@
     $strftimetime = get_string("strftimetime").":%S";
     $strerror = get_string("error");
     $strok = get_string("ok");
+    $strunfinished = get_string("unfinished");
     $strcourse = get_string("course");
     $strtimetaken = get_string("timetaken","quiz");
     $strstatus = get_string("status");
@@ -39,7 +40,7 @@
         print_header("$site->shortname: $strconfiguration: $strbackup", $site->fullname,
                       "<a href=\"../$CFG->admin/index.php\">$stradmin</a> -> ".
                       "<a href=\"../$CFG->admin/configure.php\">$strconfiguration</a> -> ".
-                      "<a href=\"../$CFG->admin/backup.php\">$strbackup</a> -> ".
+                      "<a href=\"../$CFG->admin/backup.php?sesskey=$USER->sesskey\">$strbackup</a> -> ".
                       $strlogs);
 
         print_heading($backuploglaststatus);
@@ -66,10 +67,12 @@
                     echo "<td nowrap><font size=2>".userdate($course->laststarttime,$strftimedatetime)."</td>";
                     echo "<td nowrap><font size=2> - </td>";
                     echo "<td nowrap><font size=2>".userdate($course->lastendtime,$strftimedatetime)."</td>";
-                    if (!$course->laststatus) {
-                        echo "<td nowrap align=center><font size=2 color=red>".$strerror."</td>";
-                    } else {
+                    if ($course->laststatus == 1) {
                         echo "<td nowrap align=center><font size=2 color=green>".$strok."</td>";
+                    } else if ($course->laststatus == 2) {
+                        echo "<td nowrap align=center><font size=2 color=red>".$strunfinished."</td>";
+                    } else {
+                        echo "<td nowrap align=center><font size=2 color=red>".$strerror."</td>";
                     }
                     echo "<td nowrap><font size=2>".userdate($course->nextstarttime,$strftimedatetime)."</td>";
                     echo "</tr>";
@@ -83,7 +86,7 @@
         print_header("$site->shortname: $strconfiguration: $strbackup", $site->fullname,
                       "<a href=\"../$CFG->admin/index.php\">$stradmin</a> -> ".
                       "<a href=\"../$CFG->admin/configure.php\">$strconfiguration</a> -> ".
-                      "<a href=\"../$CFG->admin/backup.php\">$strbackup</a> -> ".
+                      "<a href=\"../$CFG->admin/backup.php?sesskey=$USER->sesskey\">$strbackup</a> -> ".
                       "<a href=\"log.php\">$strlogs</a> -> ".
                       $strbackupdetails);
 
@@ -115,7 +118,7 @@
                                          FROM {$CFG->prefix}backup_log
                                          WHERE courseid = '$courseid'  AND
                                                laststarttime = '$execution->laststarttime'
-                                         ORDER BY time");
+                                         ORDER BY id");
                 if ($logs) {
                     foreach ($logs as $log) {
                         echo "<tr nowrap>";

backup/restore_check.html

@@ -116,18 +116,18 @@
     }
  
     //Depending the selected restoreto:
-    // If user is a teacher (and nor admin):
+    // If user is a teacher (and not creator):
     //    0-Current course, deleting: Put $restore->course_id and $restore->deleting (true), create the restore object
     //    1-Current course, adding: Put $restore->course_id and $restore->deleting (false), create the restore object
-    // If the uses is an admin:
+    // If the uses is a creator:
     //    0-Existing course, deleting: Select the destination course and launch the check again, then
     //        put $restore->course_id and $restore->deleting (true), create the restore object.
     //    1-Existing course, adding: Select the destination course and launch the check again, then
     //        put $restore->course_id and $restore->deleting (false), create the restore object.
     //    2-New course: Create the restore object and launch the execute.
 
-    //If the user is a teacher and not an admin
-    if (isteacher($id) and !isadmin()) {
+    //If the user is a teacher and not a creator
+    if (isteacheredit($id) and !iscreator()) {
         $restore->course_id = $id;
         if ($restore->restoreto == 0) {
             $restore->deleting = true;
@@ -136,8 +136,8 @@
         }
     }
 
-    //If the user is an admin
-    if (isadmin()) {
+    //If the user is a creator (or admin)
+    if (iscreator()) {
         //Set restore->deleting as needed
         if ($restore->restoreto == 0) {
             $restore->deleting = true;
@@ -147,7 +147,7 @@
     }
 
     //Now, select the course if needed
-    if (($restore->restoreto == 0 or $restore->restoreto == 1) and ($restore->course_id == 0) and (isadmin())) {
+    if (($restore->restoreto == 0 or $restore->restoreto == 1) and ($restore->course_id == 0) and (iscreator())) {
         if ($courses = get_courses("all","c.fullname")) {
             print_heading(get_string("choosecourse"));
             print_simple_box_start("CENTER");

backup/restore_form.html

@@ -123,11 +123,11 @@ function selectItemInMenuByName(formId, menuName, selectIndex ) {
     echo "<td align=\"right\"><P><b>";
     echo get_string("restoreto").":</b>";
     echo "</td><td>";
-    if (isteacheredit($id) and !isadmin()) {
+    if (isteacheredit($id) and !iscreator()) {
         $restore_restoreto_options[0] = get_string("currentcoursedeleting");
         $restore_restoreto_options[1] = get_string("currentcourseadding");
     } 
-    if (isadmin()) {
+    if (iscreator()) {
         $restore_restoreto_options[0] = get_string("existingcoursedeleting");
         $restore_restoreto_options[1] = get_string("existingcourseadding");
         $restore_restoreto_options[2] = get_string("newcourse"); 

backup/restorelib.php

@@ -5,27 +5,8 @@
     //It automatically uses pclzip or command line unzip
     function restore_unzip ($file) {
         
-        global $CFG;
+        return unzip_file($file, '', false);
 
-        $status = true;
-
-        if (empty($CFG->unzip)) {    // Use built-in php-based unzip function
-            include_once("$CFG->dirroot/lib/pclzip/pclzip.lib.php");
-            //include_once("$CFG->dirroot/lib/pclzip/pclerror.lib.php");    //Debug
-            //include_once("$CFG->dirroot/lib/pclzip/pcltrace.lib.php");    //Debug
-            //PclTraceOn(2);                                          //Debug
-            $archive = new PclZip($file);
-            if (!$list = $archive->extract(dirname($file))) {
-                $status = false;
-            }
-            //PclTraceDisplay();                                       //Debug
-            //PclTraceOff();                                           //Debug
-        } else {                     // Use external unzip program
-            $command = "cd ".dirname($file)."; $CFG->unzip -o ".basename($file);
-            Exec($command);
-        }
-
-        return $status;
     }
 
     //This function checks if moodle.xml seems to be a valid xml file
@@ -2961,7 +2942,7 @@
         
         $status = true;
 
-        $xml_parser = xml_parser_create();
+        $xml_parser = xml_parser_create('UTF-8');
         $moodle_parser = new MoodleParser();
         $moodle_parser->todo = $todo;
         $moodle_parser->preferences = $preferences;

backup/version.php

@@ -5,6 +5,8 @@
 // database (backup_version) to determine whether upgrades should
 // be performed (see db/backup_*.php)
 
-$backup_version = 2004083100;   // The current version is a date (YYYYMMDDXX)
+$backup_version = 2004083124;  // YYYYMMDD   = date of first major branch release 1.4
+                               //         X  = point release version 1,2,3 etc
+                               //          Y = increments between point releases
 
-$backup_release = "1.4";  // User-friendly version number
+$backup_release = "1.4.2";  // User-friendly version number

blocks/admin/block_admin.php

@@ -21,7 +21,7 @@ class CourseBlock_admin extends MoodleBlock {
 
         if (empty($this->course)) {
             $this->content = '';
-        } else if ($this->course->category == 0) {
+        } else if ($this->course->id == SITEID) {
             $this->load_content_for_site();
         } else {
             $this->load_content_for_course();
@@ -32,7 +32,7 @@ class CourseBlock_admin extends MoodleBlock {
 
 
     function load_content_for_site() {
-        global $CFG;
+        global $CFG, $USER;
 
         if (isadmin()) {
             $this->content->items[] = '<a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/configure.php">'.get_string('configuration').'</a>...';
@@ -40,18 +40,24 @@ class CourseBlock_admin extends MoodleBlock {
 
             $this->content->items[] = '<a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/users.php">'.get_string('users').'</a>...';
             $this->content->icons[] = '<img src="'.$CFG->pixpath.'/i/users.gif" height="16" width="16" alt="" />';
+
+            $this->content->items[]='<a href="'.$CFG->wwwroot.'/backup/backup.php?id='.SITEID.'">'.get_string('backup').'...</a>';
+            $this->content->icons[]='<img src="'.$CFG->pixpath.'/i/backup.gif" height="16" width="16" alt="">';
+
+            $this->content->items[]='<a href="'.$CFG->wwwroot.'/files/index.php?id='.SITEID.'&amp;wdir=/backupdata">'.get_string('restore').'...</a>';
+            $this->content->icons[]='<img src="'.$CFG->pixpath.'/i/restore.gif" height="16" width="16" alt="">';
         }
 
         if (iscreator()) {
-            $this->content->items[] = '<a href="'.$CFG->wwwroot.'/course/index.php?edit=on">'.get_string('courses').'</a>';
+            $this->content->items[] = '<a href="'.$CFG->wwwroot.'/course/index.php?edit=on&sesskey='.$USER->sesskey.'">'.get_string('courses').'</a>';
             $this->content->icons[] = '<img src="'.$CFG->pixpath.'/i/course.gif" height="16" width="16" alt="" />';
         }
 
         if (isadmin()) {
-            $this->content->items[] = '<a href="'.$CFG->wwwroot.'/course/log.php?id=1">'.get_string('logs').'</a>';
+            $this->content->items[] = '<a href="'.$CFG->wwwroot.'/course/log.php?id='.SITEID.'">'.get_string('logs').'</a>';
             $this->content->icons[] = '<img src="'.$CFG->pixpath.'/i/log.gif" height="16" width="16" alt="" />';
 
-            $this->content->items[] = '<a href="'.$CFG->wwwroot.'/files/index.php?id=1">'.get_string('sitefiles').'</a>';
+            $this->content->items[] = '<a href="'.$CFG->wwwroot.'/files/index.php?id='.SITEID.'">'.get_string('sitefiles').'</a>';
             $this->content->icons[] = '<img src="'.$CFG->pixpath.'/i/files.gif" height="16" width="16" alt="" />';
 
             if (file_exists($CFG->dirroot.'/'.$CFG->admin.'/'.$CFG->dbtype)) {

blocks/calendar_upcoming/block_calendar_upcoming.php

@@ -38,12 +38,11 @@ class CourseBlock_calendar_upcoming extends MoodleBlock {
                                       '/calendar/event.php?action=new&course='.$this->course->id.'">'.
                                        get_string('newevent', 'calendar').'</a>...';
             
-            if($this->course->id == SITEID) {
+            if ($this->course->id == SITEID) {
                 // Being displayed at site level. This will cause the filter to fall back to auto-detecting
                 // the list of courses it will be grabbing events from.
                 $filtercourse = NULL;
-            }
-            else {
+            } else {
                 // Forcibly filter events to include only those from the particular course we are in.
                 $filtercourse = array($courseshown => 1);
             }
@@ -56,12 +55,18 @@ class CourseBlock_calendar_upcoming extends MoodleBlock {
         // Correct formatting is [courseid] => 1 to be concise with moodlelib.php functions.
 
         calendar_set_filters($courses, $group, $user, $filtercourse, $filtercourse, false);
-        $events = calendar_get_upcoming($courses, $group, $user, get_user_preferences('calendar_lookahead', CALENDAR_UPCOMING_DAYS), get_user_preferences('calendar_maxevents', CALENDAR_UPCOMING_MAXEVENTS));
+        $events = calendar_get_upcoming($courses, $group, $user, 
+                                        get_user_preferences('calendar_lookahead', CALENDAR_UPCOMING_DAYS), 
+                                        get_user_preferences('calendar_maxevents', CALENDAR_UPCOMING_MAXEVENTS));
 
-        $this->content->text = calendar_get_sideblock_upcoming($events, 'view.php?view=day&amp;course='.$this->course->id.'&amp;');
+        if (!empty($this->course)) { 
+            $this->content->text = calendar_get_sideblock_upcoming($events, 
+                                   'view.php?view=day&amp;course='.$this->course->id.'&amp;');
+        }
 
-        if(empty($this->content->text)) {
-            $this->content->text = '<div style="font-size: 0.8em; text-align: center;">'.get_string('noupcomingevents', 'calendar').'</div>';
+        if (empty($this->content->text)) {
+            $this->content->text = '<div style="font-size: 0.8em; text-align: center;">'.
+                                   get_string('noupcomingevents', 'calendar').'</div>';
         }
 
         return $this->content;

blocks/course_list/block_course_list.php

@@ -13,7 +13,7 @@ class CourseBlock_course_list extends MoodleBlock {
     }
 
     function print_config() {
-        global $CFG, $THEME;
+        global $CFG, $USER, $THEME;
         print_simple_box_start('center', '', $THEME->cellheading);
         include($CFG->dirroot.'/blocks/'.$this->name().'/config.html');
         print_simple_box_end();

blocks/course_list/config.html

@@ -1,4 +1,5 @@
 <form method="post" action="block.php">
+<?php echo "<input type=\"hidden\" name=\"sesskey\" value=\"".$USER->sesskey."\">"; ?>
 
 <table cellpadding="9" cellspacing="0">
 <tr valign="top">

blocks/course_summary/block_course_summary.php

@@ -2,7 +2,7 @@
 
 class CourseBlock_course_summary extends MoodleBlock {
     function CourseBlock_course_summary ($course) {
-        if (empty($course->category)) {   // Site level
+        if(!empty($course) && $course->id == SITEID) {   // Site level
             $this->title = get_string('frontpagedescription');
         } else {
             $this->title = get_string('blockname','block_course_summary');
@@ -26,13 +26,13 @@ class CourseBlock_course_summary extends MoodleBlock {
         $this->content = New stdClass;
         $options->noclean = true;    // Don't clean Javascripts etc
         $this->content->text = format_text($this->course->summary, FORMAT_HTML, $options);
-        if (isediting($this->course->id)) {
-            if (empty($this->course->category)) {
+        if(isediting($this->course->id)) {
+            if($this->course->id == SITEID) {
                 $editpage = $CFG->wwwroot.'/admin/site.php';
             } else {
                 $editpage = $CFG->wwwroot.'/course/edit.php?id='.$this->course->id;
             }
-            $this->content->text .= "<div align=\"right\"><a href=\"$editpage\"><img src=\"$CFG->pixpath/t/edit.gif\" /></a></div>";
+            $this->content->text .= '<div style="text-align: right;"><a href="'.$editpage.'"><img src="'.$CFG->pixpath.'/t/edit.gif" /></a></div>';
         }
         $this->content->footer = '';
 

blocks/moodleblock.class.php

@@ -119,7 +119,7 @@ class MoodleBlock {
     }
 
     function add_edit_controls($options, $blockid) {
-        global $CFG, $THEME;
+        global $CFG, $THEME, $USER;
 
         // The block may be disabled
         $blockid = intval($blockid);
@@ -143,6 +143,8 @@ class MoodleBlock {
         } else {
             $pixpath = $path.'/../theme/'.$CFG->theme.'/pix';
         }
+ 
+        $sesskeystr = '&sesskey='.$USER->sesskey;
 
         $movebuttons = '<div style="float: right;">';
 
@@ -155,26 +157,26 @@ class MoodleBlock {
             $title = $this->str->show;
         }
 
-        $movebuttons .= '<a style="margin-right: 6px; margin-left: 3px;" title="'.$title.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=toggle&amp;blockid='.$blockid.'">' .
+        $movebuttons .= '<a style="margin-right: 6px; margin-left: 3px;" title="'.$title.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=toggle&amp;blockid='.$blockid.$sesskeystr.'">' .
                         '<img src="'.$pixpath.$icon.'" /></a>';
 
-        $movebuttons .= '<a title="'.$this->str->delete.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=delete&amp;blockid='.$blockid.'">' .
+        $movebuttons .= '<a title="'.$this->str->delete.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=delete&amp;blockid='.$blockid.$sesskeystr.'">' .
                         '<img src="'.$pixpath.'/t/delete.gif" /></a> ';
 
         if ($options & BLOCK_MOVE_LEFT) {
-            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->moveleft.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=moveside&amp;blockid='.$blockid.'">' .
+            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->moveleft.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=moveside&amp;blockid='.$blockid.$sesskeystr.'">' .
                             '<img src="'.$pixpath.'/t/left.gif" /></a>';
         }
         if ($options & BLOCK_MOVE_UP) {
-            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->moveup.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=moveup&amp;blockid='.$blockid.'">' .
+            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->moveup.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=moveup&amp;blockid='.$blockid.$sesskeystr.'">' .
                             '<img src="'.$pixpath.'/t/up.gif" /></a>';
         }
         if ($options & BLOCK_MOVE_DOWN) {
-            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->movedown.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=movedown&amp;blockid='.$blockid.'">' .
+            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->movedown.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=movedown&amp;blockid='.$blockid.$sesskeystr.'">' .
                             '<img src="'.$pixpath.'/t/down.gif" /></a>';
         }
         if ($options & BLOCK_MOVE_RIGHT) {
-            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->moveright.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=moveside&amp;blockid='.$blockid.'">' .
+            $movebuttons .= '<a style="margin-right: 2px; margin-left: 2px;" title="'.$this->str->moveright.'" href="'.$path.'/view.php?id='.$this->course->id.'&amp;blockaction=moveside&amp;blockid='.$blockid.$sesskeystr.'">' .
                             '<img src="'.$pixpath.'/t/right.gif" /></a>';
         }
 

blocks/online_users/block_online_users.php

@@ -11,7 +11,7 @@ class CourseBlock_online_users extends MoodleBlock {
     function has_config() {return true;}
 
     function print_config() {
-        global $CFG, $THEME;
+        global $CFG, $USER, $THEME;
         print_simple_box_start('center', '', $THEME->cellheading);
         include($CFG->dirroot.'/blocks/'.$this->name().'/config.html');
         print_simple_box_end();

blocks/online_users/config.html

@@ -1,4 +1,5 @@
 <form method="post" action="block.php">
+<?php echo "<input type=\"hidden\" name=\"sesskey\" value=\"".$USER->sesskey."\">"; ?>
 
 <table cellpadding="9" cellspacing="0">
 <tr valign="top">

blocks/site_main_menu/block_site_main_menu.php

@@ -54,7 +54,7 @@ class CourseBlock_site_main_menu extends MoodleBlock {
 
         if ($ismoving) {
             $this->content->icons[] = '&nbsp;<img align="bottom" src="'.$CFG->pixpath.'/t/move.gif" height="11" width="11">';
-            $this->content->items[] = $USER->activitycopyname.'&nbsp;(<a href="'.$CFG->wwwroot.'/course/mod.php?cancelcopy=true">'.$strcancel.'</a>)';
+            $this->content->items[] = $USER->activitycopyname.'&nbsp;(<a href="'.$CFG->wwwroot.'/course/mod.php?cancelcopy=true&amp;sesskey='.$USER->sesskey.'">'.$strcancel.'</a>)';
         }
 
         if (!empty($section->sequence)) {
@@ -82,7 +82,7 @@ class CourseBlock_site_main_menu extends MoodleBlock {
                         if ($mod->id == $USER->activitycopy) {
                             continue;
                         }
-                        $this->content->items[] = '<a title="'.$strmovefull.'" href="'.$CFG->wwwroot.'/course/mod.php?moveto='.$mod->id.'">'.
+                        $this->content->items[] = '<a title="'.$strmovefull.'" href="'.$CFG->wwwroot.'/course/mod.php?moveto='.$mod->id.'&amp;sesskey='.$USER->sesskey.'">'.
                             '<img height="16" width="80" src="'.$CFG->pixpath.'/movehere.gif" alt="'.$strmovehere.'" border="0"></a>';
                         $this->content->icons[] = '';
                    }
@@ -115,7 +115,7 @@ class CourseBlock_site_main_menu extends MoodleBlock {
         }
 
         if ($ismoving) {
-            $this->content->items[] = '<a title="'.$strmovefull.'" href="'.$CFG->wwwroot.'/course/mod.php?movetosection='.$section->id.'">'.
+            $this->content->items[] = '<a title="'.$strmovefull.'" href="'.$CFG->wwwroot.'/course/mod.php?movetosection='.$section->id.'&amp;sesskey='.$USER->sesskey.'">'.
                                       '<img height="16" width="80" src="'.$CFG->pixpath.'/movehere.gif" alt="'.$strmovehere.'" border="0"></a>';
             $this->content->icons[] = '';
         }

calendar/lib.php

@@ -112,11 +112,11 @@ function calendar_get_mini($courses, $groups, $users, $cal_month = false, $cal_y
         $events = array();
     }
     else {
-        $events = get_records_select('event', $whereclause);
+        $events = get_records_select('event', $whereclause, 'timestart');
     }
 
     // This is either a genius idea or an idiot idea: in order to not complicate things, we use this rule: if, after
-    // possibly removing courseid 1 from $courses, there is only one course left, then clicking on a day in the month
+    // possibly removing SITEID from $courses, there is only one course left, then clicking on a day in the month
     // will also set the $SESSION->cal_courses_shown variable to that one course. Otherwise, we 'd need to add extra
     // arguments to this function.
 
@@ -190,10 +190,10 @@ function calendar_get_mini($courses, $groups, $users, $cal_month = false, $cal_y
                     $popupicon = $CFG->modpixpath.'/'.$event->modulename.'/icon.gif';
                     $popupalt  = $event->modulename;
 
-                } else if ($event->courseid == 1) {                                // Site event
+                } else if ($event->courseid == SITEID) {                                // Site event
                     $popupicon = $CFG->pixpath.'/c/site.gif';
                     $popupalt  = '';
-                } else if ($event->courseid > 1 and empty($event->groupid)) {      // Course event
+                } else if ($event->courseid != 0 && $event->courseid != SITEID && $event->groupid == 0) {      // Course event
                     $popupicon = $CFG->pixpath.'/c/course.gif';
                     $popupalt  = '';
                 } else if ($event->groupid) {                                      // Group event
@@ -297,12 +297,11 @@ function calendar_get_upcoming($courses, $groups, $users, $daysinfuture, $maxeve
     if ($whereclause === false) {
         $events = false;
     } else {
-        $whereclause .= ' ORDER BY timestart'; // We want them this way
-        $events = get_records_select('event', $whereclause);
+        $events = get_records_select('event', $whereclause, 'timestart');
     }
 
     // This is either a genius idea or an idiot idea: in order to not complicate things, we use this rule: if, after
-    // possibly removing courseid 1 from $courses, there is only one course left, then clicking on a day in the month
+    // possibly removing SITEID from $courses, there is only one course left, then clicking on a day in the month
     // will also set the $SESSION->cal_courses_shown variable to that one course. Otherwise, we 'd need to add extra
     // arguments to this function.
 
@@ -355,14 +354,12 @@ function calendar_get_upcoming($courses, $groups, $users, $daysinfuture, $maxeve
                 $output[$outkey]->cmid = $module->id;
 
 
-
-            } else if($event->courseid == 1) {                              // Site event
+            } else if($event->courseid == SITEID) {                              // Site event
                 $output[$outkey]->icon = '<img height=16 width=16 src="'.$CFG->pixpath.'/c/site.gif" alt="" style="vertical-align: middle;" />';
                 $output[$outkey]->time = $eventtime;
 
 
-
-            } else if($event->courseid > 1 and !$event->groupid) {          // Course event
+            } else if($event->courseid != 0 && $event->courseid != SITEID && $event->groupid == 0) {          // Course event
                 calendar_get_course_cached($coursecache, $event->courseid);
 
                 $output[$outkey]->icon = '<img height=16 width=16 src="'.$CFG->pixpath.'/c/course.gif" alt="" style="vertical-align: middle;" />';
@@ -597,7 +594,7 @@ function calendar_filter_controls($type, $vars = NULL, $course = NULL) {
         $content .= '<td style="width: 8px;"></td><td><a href="'.CALENDAR_URL.'set.php?var=showcourses'.$getvars.'" title="'.get_string('tt_showcourse', 'calendar').'">'.get_string('courseevents', 'calendar').'</a></td>'."\n";
     }
 
-    if(!empty($USER) && !isguest()) {
+    if(!empty($USER->id) && !isguest()) {
         $content .= "</tr>\n<tr>";
 
         if($groupevents) {
@@ -802,10 +799,10 @@ function calendar_events_by_day($events, $month, $year, &$eventsbyday, &$duratio
             $eventsbyday[$eventdaystart][] = $event->id;
 
             // Mark the day as having such an event
-            if($event->courseid == 1 && $event->groupid == 0) {
+            if($event->courseid == SITEID && $event->groupid == 0) {
                 $typesbyday[$eventdaystart]['startglobal'] = true;
             }
-            else if($event->courseid > 1 && $event->groupid == 0) {
+            else if($event->courseid != 0 && $event->courseid != SITEID && $event->groupid == 0) {
                 $typesbyday[$eventdaystart]['startcourse'] = true;
             }
             else if($event->groupid) {
@@ -830,10 +827,10 @@ function calendar_events_by_day($events, $month, $year, &$eventsbyday, &$duratio
         // Mark all days between $lowerbound and $upperbound (inclusive) as duration
         for($i = $lowerbound + 1; $i <= $upperbound; ++$i) {
             $durationbyday[$i][] = $event->id;
-            if($event->courseid == 1 && $event->groupid == 0) {
+            if($event->courseid == SITEID && $event->groupid == 0) {
                 $typesbyday[$i]['durationglobal'] = true;
             }
-            else if($event->courseid > 1 && $event->groupid == 0) {
+            else if($event->courseid != 0 && $event->courseid != SITEID && $event->groupid == 0) {
                 $typesbyday[$i]['durationcourse'] = true;
             }
             else if($event->groupid) {
@@ -868,6 +865,19 @@ function calendar_get_course_cached(&$coursecache, $courseid) {
 function calendar_session_vars() {
     global $SESSION, $USER;
 
+    if(!empty($USER->id) && isset($USER->realuser) && !isset($SESSION->cal_loggedinas)) {
+        // We just logged in as someone else, update the filtering
+        unset($SESSION->cal_users_shown);
+        unset($SESSION->cal_courses_shown);
+        $SESSION->cal_loggedinas = true;
+    }
+    else if(!empty($USER->id) && !isset($USER->realuser) && isset($SESSION->cal_loggedinas)) {
+        // We just logged back to our real self, update again
+        unset($SESSION->cal_users_shown);
+        unset($SESSION->cal_courses_shown);
+        unset($SESSION->cal_loggedinas);
+    }
+
     if(!isset($SESSION->cal_course_referer)) {
         $SESSION->cal_course_referer = 0;
     }
@@ -932,11 +942,11 @@ function calendar_set_filters(&$courses, &$group, &$user, $courseeventsfrom = NU
 
     if(($SESSION->cal_show_course && $SESSION->cal_show_global) || $ignorefilters) {
         if(is_int($courseeventsfrom)) {
-            $courses = array(1, $courseeventsfrom);
+            $courses = array(SITEID, $courseeventsfrom);
         }
         else if(is_array($courseeventsfrom)) {
             $courses = array_keys($courseeventsfrom);
-            $courses[] = 1;
+            $courses[] = SITEID;
         }
     }
     else if($SESSION->cal_show_course) {
@@ -1001,13 +1011,13 @@ function calendar_set_filters(&$courses, &$group, &$user, $courseeventsfrom = NU
 function calendar_edit_event_allowed($event) {
     global $USER;
 
-    if(empty($USER) || isguest($USER->id)) {
+    if(empty($USER->id) || isguest($USER->id)) {
         return false;
     }
 
     if (isadmin($USER->id)) return true; // Admins are allowed anything
 
-    if ($event->courseid > 1) {
+    if ($event->courseid != 0 && $event->courseid != SITEID) {
         // Course event, only editing teachers may... edit :P
         if(isteacheredit($event->courseid)) {
             return true;
@@ -1033,10 +1043,10 @@ function calendar_get_default_courses($ignoreref = false) {
     global $USER, $CFG, $SESSION;
 
     if(!empty($SESSION->cal_course_referer) && !$ignoreref) {
-        return array($SESSION->cal_course_referer => 1);
+        return array($SESSION->cal_course_referer => SITEID);
     }
 
-    if(empty($USER)) {
+    if(empty($USER->id)) {
         return array();
     }
 
@@ -1054,40 +1064,6 @@ function calendar_get_default_courses($ignoreref = false) {
     return $courses;
 }
 
-function calendar_get_tz_offset() {
-    global $USER, $CFG;
-    static $tzfix;
-
-    // Caching
-    if(isset($tzfix)) {
-        return $tzfix;
-    }
-
-    if(empty($USER)) {
-        // Don't forget that there are users which have NOT logged in, even as guests
-        $timezone = $CFG->timezone;
-    }
-    else {
-        // If, on the other hand, we do have a user...
-        $timezone = $USER->timezone;
-        if(abs($timezone > 13)) {
-            // But if the user has specified 'server default' time,
-            // don't get the server's; get the Moodle $CFG setting
-            // (Martin's help text on site cfg implies this)
-            $timezone = $CFG->timezone;
-        }
-    }
-
-    if(abs($timezone) <= 13) {
-        $tzfix = $timezone * 3600;
-    }
-    else {
-        $tzfix = date('Z');
-    }
-
-    return $tzfix;
-}
-
 function calendar_preferences_array() {
     return array(
         'startwday' => get_string('pref_startwday', 'calendar'),

calendar/view.php

@@ -105,7 +105,7 @@
         }
     }
 
-    if (empty($USER) or isguest()) {
+    if (empty($USER->id) or isguest()) {
         $defaultcourses = calendar_get_default_courses();
         calendar_set_filters($courses, $groups, $users, $defaultcourses, $defaultcourses);
 
@@ -198,7 +198,7 @@ function calendar_show_day($d, $m, $y, $courses, $groups, $users) {
     $events = calendar_get_upcoming($courses, $groups, $users, 1, 100, $starttime);
 
     // New event button
-    if (empty($USER) || isguest()) {
+    if (empty($USER->id) || isguest()) {
         $text = get_string('dayview', 'calendar').': '.calendar_course_filter_selector($getvars);
     } else {
         $text = '<div style="float: left;">'.get_string('dayview', 'calendar').': '.
@@ -312,14 +312,14 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users) {
         $events = array();
     }
     else {
-        $events = get_records_select('event', $whereclause);
+        $events = get_records_select('event', $whereclause, 'timestart');
     }
 
     // Extract information: events vs. time
     calendar_events_by_day($events, $m, $y, $eventsbyday, $durationbyday, $typesbyday);
 
     // New event button
-    if(empty($USER) || isguest()) {
+    if(empty($USER->id) || isguest()) {
         $text = get_string('detailedmonthview', 'calendar').': '.calendar_course_filter_selector($getvars);
     }
     else {
@@ -482,7 +482,7 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users) {
 
     echo "</tr>\n";
 
-    if(!empty($USER) && !isguest()) {
+    if(!empty($USER->id) && !isguest()) {
         echo '<tr>';
         // Group events
         if($SESSION->cal_show_groups) {
@@ -515,7 +515,7 @@ function calendar_show_upcoming_events($courses, $groups, $users, $futuredays, $
     $events = calendar_get_upcoming($courses, $groups, $users, $futuredays, $maxevents);
 
     // New event button
-    if(empty($USER) || isguest()) {
+    if(empty($USER->id) || isguest()) {
         $text = get_string('upcomingevents', 'calendar').': '.calendar_course_filter_selector('from=upcoming');
 
     } else {
@@ -601,7 +601,7 @@ function calendar_print_event($event) {
 function calendar_course_filter_selector($getvars = '') {
     global $USER, $SESSION;
 
-    if (empty($USER) or isguest()) {
+    if (empty($USER->id) or isguest()) {
         return '';
     }
 

course/category.php

@@ -23,7 +23,7 @@
     }
 
     if (iscreator()) {
-        if (isset($_GET['edit'])) {
+        if (isset($_GET['edit']) and confirm_sesskey()) {
             if ($edit == "on") {
                 $USER->categoryediting = true;
             } else if ($edit == "off") {
@@ -47,7 +47,7 @@
 
     if (isadmin()) {
         /// Rename the category if requested
-        if (!empty($_POST['rename'])) {
+        if (!empty($_POST['rename']) and confirm_sesskey()) {
             $category->name = $_POST['rename'];
             if (! set_field("course_categories", "name", $category->name, "id", $category->id)) {
                 notify("An error occurred while renaming the category");
@@ -56,7 +56,7 @@
 
         /// Resort the category if requested
 
-        if (!empty($_GET['resort'])) {
+        if (!empty($_GET['resort']) and confirm_sesskey()) {
             if ($courses = get_courses($category->id, "fullname ASC")) {
                 $count = 0;
                 foreach ($courses as $course) {
@@ -114,7 +114,7 @@
 
     /// Move a specified course to a new category 
 
-        if (isset($moveto) and $data = data_submitted()) {   // Some courses are being moved
+        if (isset($moveto) and $data = data_submitted() and confirm_sesskey()) {   // Some courses are being moved
 
             if (! $destcategory = get_record("course_categories", "id", $data->moveto)) {
                 error("Error finding the category");
@@ -122,9 +122,11 @@
 
             unset($data->moveto);
             unset($data->id);
+            unset($data->sesskey);
 
             if ($data) {
                 foreach ($data as $code => $junk) {
+ 
                     $courseid = substr($code, 1);
 
                     if (! $course  = get_record("course", "id", $courseid)) {
@@ -143,7 +145,7 @@
 
     /// Hide or show a course 
     
-        if (isset($hide) or isset($show)) {
+        if ((isset($hide) or isset($show)) and confirm_sesskey()) {
             if (isset($hide)) {
                 $course = get_record("course", "id", $hide);
                 $visible = 0;
@@ -161,7 +163,7 @@
 
     /// Move a course up or down
 
-        if (isset($moveup) or isset($movedown)) {
+        if ((isset($moveup) or isset($movedown)) and confirm_sesskey()) {
 
             $movecourse = NULL;
             $swapcourse = NULL;
@@ -238,7 +240,9 @@
 /// Print out all the courses
     unset($course);    // To avoid unwanted language effects later
 
-    $courses = get_courses_page($category->id, "c.sortorder ASC", "c.*", $totalcount, $page*$perpage, $perpage);
+    $courses = get_courses_page($category->id, 'c.sortorder ASC', 
+                                'c.id,c.sortorder,c.shortname,c.fullname,c.summary,c.visible', 
+                                $totalcount, $page*$perpage, $perpage);
     $numcourses = count($courses);
 
     if (!$courses) {
@@ -274,6 +278,7 @@
         }
 
         echo "<form name=\"movecourses\" action=\"category.php\" method=\"post\">";
+        echo "<input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\">";
         echo "<table align=\"center\" border=0 cellspacing=2 cellpadding=4 class=\"generalbox\"><tr>";
         echo "<th>$strcourses</th>";
         if ($creatorediting) {
@@ -308,10 +313,10 @@
                     echo "<a title=\"$strdelete\" href=\"delete.php?id=$acourse->id\"><img".
                          " src=\"$pixpath/t/delete.gif\" height=11 width=11 border=0></a> ";
                     if (!empty($acourse->visible)) {
-                        echo "<a title=\"$strhide\" href=\"category.php?id=$category->id&hide=$acourse->id\"><img".
+                        echo "<a title=\"$strhide\" href=\"category.php?id=$category->id&hide=$acourse->id&sesskey=$USER->sesskey\"><img".
                              " src=\"$pixpath/t/hide.gif\" height=11 width=11 border=0></a> ";
                     } else {
-                        echo "<a title=\"$strshow\" href=\"category.php?id=$category->id&show=$acourse->id\"><img".
+                        echo "<a title=\"$strshow\" href=\"category.php?id=$category->id&show=$acourse->id&sesskey=$USER->sesskey\"><img".
                              " src=\"$pixpath/t/show.gif\" height=11 width=11 border=0></a> ";
                     }
     
@@ -322,14 +327,14 @@
                              " src=\"$pixpath/t/restore.gif\" height=11 width=11 border=0></a> ";
             
                     if ($up) {
-                        echo "<a title=\"$strmoveup\" href=\"category.php?id=$category->id&moveup=$acourse->id\"><img".
+                        echo "<a title=\"$strmoveup\" href=\"category.php?id=$category->id&moveup=$acourse->id&sesskey=$USER->sesskey\"><img".
                              " src=\"$pixpath/t/up.gif\" height=11 width=11 border=0></a> ";
                     } else {
                         echo "<img src=\"$CFG->wwwroot/pix/spacer.gif\" height=11 width=11 border=0></a> ";
                     }
         
                     if ($down) {
-                        echo "<a title=\"$strmovedown\" href=\"category.php?id=$category->id&movedown=$acourse->id\"><img".
+                        echo "<a title=\"$strmovedown\" href=\"category.php?id=$category->id&movedown=$acourse->id&sesskey=$USER->sesskey\"><img".
                              " src=\"$pixpath/t/down.gif\" height=11 width=11 border=0></a> ";
                     } else {
                         echo "<img src=\"$CFG->wwwroot/pix/spacer.gif\" height=11 width=11 border=0></a> ";
@@ -386,6 +391,7 @@
         unset($options);
         $options["id"] = $category->id;
         $options["resort"] = "name";
+        $options["sesskey"] = $USER->sesskey;
         print_single_button("category.php", $options, get_string("resortcoursesbyname"), "get");
     }
 
@@ -400,6 +406,7 @@
         $strrename= get_string("rename");
         echo "<form name=\"renameform\" action=\"category.php\" method=\"post\">";
         echo "<input type=\"hidden\" name=\"id\" value=\"$category->id\">";
+        echo "<input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\">";
         echo "<input type=\"text\" size=30 name=\"rename\" value=\"".s($category->name)."\">";
         echo "<input type=\"submit\" value=\"$strrename\">";
         echo "</form>";

course/delete.php

@@ -38,7 +38,7 @@
                      "$strdeletecheck");
 
         notice_yesno("$strdeletecoursecheck<BR><BR>$course->fullname ($course->shortname)", 
-                     "delete.php?id=$course->id&delete=".md5($course->timemodified), 
+                     "delete.php?id=$course->id&delete=".md5($course->timemodified)."&sesskey=$USER->sesskey", 
                      "category.php?id=$course->category");
         exit;
     }
@@ -47,6 +47,10 @@
         error("The check variable was wrong - try again");
     }
 
+    if (!confirm_sesskey()) {
+        error(get_string('confirmsesskeybad', 'error'));
+    }
+
     // OK checks done, delete the course now.
     $strdeletingcourse = get_string("deletingcourse", "", $course->shortname);
 

course/edit.html

@@ -260,4 +260,5 @@
     <td><input type="submit" value="<?php  print_string("savechanges") ?>"></td>
 </table>
 <input type="hidden" name="id" value="<?php echo $form->id ?>">
+<input type="hidden" name="sesskey" value="<?php echo $form->sesskey ?>">
 </form>

course/edit.php

@@ -5,8 +5,8 @@
     require_once("lib.php");
     require_once("$CFG->libdir/blocklib.php");
 
-    optional_variable($id, 0);   // course id
-    optional_variable($category, 0);   // category id
+    $id       = (int)optional_param('id', 0);         // course id
+    $category = (int)optional_param('category', 0);   // possible default category
 
     require_login();
 
@@ -36,7 +36,7 @@
 
 /// If data submitted, then process and store.
 
-    if ($form = data_submitted()) {
+    if ($form = data_submitted() and confirm_sesskey()) {
 
         if (empty($course)) {
             check_for_restricted_user($USER->username, "$CFG->wwwroot");
@@ -187,6 +187,8 @@
                      "<a href=\"index.php\">$strcategories</a> -> $straddnewcourse", $focus);
     }
 
+    $form->sesskey = !empty($USER->id) ? $USER->sesskey : '';
+
     print_heading($streditcoursesettings);
     print_simple_box_start("center", "", "$THEME->cellheading");
     include("edit.html");

course/editsection.html

@@ -22,6 +22,7 @@
 </tr>
 </table>
 <input type="hidden" name=id value="<?php echo $form->id ?>">
+<input type="hidden" name=sesskey value="<?php echo $form->sesskey ?>">
 <input type="submit" value="<?php print_string("savechanges") ?>">
 </form>
 </center>

course/editsection.php

@@ -23,7 +23,7 @@
 
 /// If data submitted, then process and store.
 
-    if ($form = data_submitted()) {
+    if ($form = data_submitted() and confirm_sesskey()) {
 
         $timenow = time();
 
@@ -43,6 +43,8 @@
         $form = $section;
     }
 
+    $form->sesskey = !empty($USER->id) ? $USER->sesskey : '';
+
     $usehtmleditor = can_use_html_editor();
 
     $sectionname = get_string("name$course->format");

course/format/topics/format.php

@@ -31,7 +31,7 @@
         }
     }
 
-    if (isteacher($course->id) and isset($marker)) {
+    if (isteacher($course->id) and isset($marker) and confirm_sesskey()) {
         $course->marker = $marker;
         if (! set_field("course", "marker", $marker, "id", $course->id)) {
             error("Could not mark that topic for this course");
@@ -84,7 +84,7 @@
         echo "<tr>";
         echo "<td colspan=3 valign=top bgcolor=\"$THEME->cellcontent\" class=\"topicoutlineclip\" width=\"100%\">";
         echo "<p><font size=2>";
-        echo "$stractivityclipboard&nbsp;&nbsp;(<a href=\"mod.php?cancelcopy=true\">$strcancel</a>)";
+        echo "$stractivityclipboard&nbsp;&nbsp;(<a href=\"mod.php?cancelcopy=true&amp;sesskey=$USER->sesskey\">$strcancel</a>)";
         echo "</font></p>";
         echo "</td>";
         echo "</tr>";
@@ -226,28 +226,28 @@
 
             if (isediting($course->id)) {
                 if ($course->marker == $section) {  // Show the "light globe" on/off
-                    echo "<a href=\"view.php?id=$course->id&marker=0\" title=\"$strmarkedthistopic\">".
+                    echo "<a href=\"view.php?id=$course->id&marker=0&sesskey=$USER->sesskey\" title=\"$strmarkedthistopic\">".
                          "<img src=\"$CFG->pixpath/i/marked.gif\" vspace=3 height=16 width=16 border=0></a><br />";
                 } else {
-                    echo "<a href=\"view.php?id=$course->id&marker=$section\" title=\"$strmarkthistopic\">".
+                    echo "<a href=\"view.php?id=$course->id&marker=$section&sesskey=$USER->sesskey\" title=\"$strmarkthistopic\">".
                          "<img src=\"$CFG->pixpath/i/marker.gif\" vspace=3 height=16 width=16 border=0></a><br />";
                 }
 
                 if ($thissection->visible) {        // Show the hide/show eye
-                    echo "<a href=\"view.php?id=$course->id&hide=$section\" title=\"$strtopichide\">".
+                    echo "<a href=\"view.php?id=$course->id&hide=$section&sesskey=$USER->sesskey\" title=\"$strtopichide\">".
                          "<img src=\"$CFG->pixpath/i/hide.gif\" vspace=3 height=16 width=16 border=0></a><br />";
                 } else {
-                    echo "<a href=\"view.php?id=$course->id&show=$section\" title=\"$strtopicshow\">".
+                    echo "<a href=\"view.php?id=$course->id&show=$section&sesskey=$USER->sesskey\" title=\"$strtopicshow\">".
                          "<img src=\"$CFG->pixpath/i/show.gif\" vspace=3 height=16 width=16 border=0></a><br />";
                 }
 
                 if ($section > 1) {                       // Add a arrow to move section up
-                    echo "<a href=\"view.php?id=$course->id&section=$section&move=-1\" title=\"$strmoveup\">".
+                    echo "<a href=\"view.php?id=$course->id&section=$section&move=-1&sesskey=$USER->sesskey\" title=\"$strmoveup\">".
                          "<img src=\"$CFG->pixpath/t/up.gif\" vspace=3 height=11 width=11 border=0></a><br />";
                 }
 
                 if ($section < $course->numsections) {    // Add a arrow to move section down
-                    echo "<a href=\"view.php?id=$course->id&section=$section&move=1\" title=\"$strmovedown\">".
+                    echo "<a href=\"view.php?id=$course->id&section=$section&move=1&sesskey=$USER->sesskey\" title=\"$strmovedown\">".
                          "<img src=\"$CFG->pixpath/t/down.gif\" vspace=3 height=11 width=11 border=0></a><br />";
                 }
 

course/format/weeks/format.php

@@ -74,7 +74,7 @@
         echo "<tr>";
         echo "<td colspan=3 valign=top bgcolor=\"$THEME->cellcontent\" class=\"weeklyoutlineclip\" width=\"100%\">";
         echo "<p><font size=2>";
-        echo "$stractivityclipboard&nbsp;&nbsp;(<a href=\"mod.php?cancelcopy=true\">$strcancel</a>)";
+        echo "$stractivityclipboard&nbsp;&nbsp;(<a href=\"mod.php?cancelcopy=true&amp;sesskey=$USER->sesskey\">$strcancel</a>)";
         echo "</font></p>";
         echo "</td>";
         echo "</tr>";
@@ -219,20 +219,20 @@
     
             if (isediting($course->id)) {
                 if ($thissection->visible) {        // Show the hide/show eye
-                    echo "<a href=\"view.php?id=$course->id&hide=$section\" title=\"$strweekhide\">".
+                    echo "<a href=\"view.php?id=$course->id&hide=$section&sesskey=$USER->sesskey\" title=\"$strweekhide\">".
                          "<img src=\"$CFG->pixpath/i/hide.gif\" vspace=3 height=16 width=16 border=0></a><br />";
                 } else {
-                    echo "<a href=\"view.php?id=$course->id&show=$section\" title=\"$strweekshow\">".
+                    echo "<a href=\"view.php?id=$course->id&show=$section&sesskey=$USER->sesskey\" title=\"$strweekshow\">".
                          "<img src=\"$CFG->pixpath/i/show.gif\" vspace=3 height=16 width=16 border=0></a><br />";
                 }
     
                 if ($section > 1) {                       // Add a arrow to move section up
-                    echo "<a href=\"view.php?id=$course->id&section=$section&move=-1\" title=\"$strmoveup\">".
+                    echo "<a href=\"view.php?id=$course->id&section=$section&move=-1&sesskey=$USER->sesskey\" title=\"$strmoveup\">".
                          "<img src=\"$CFG->pixpath/t/up.gif\" vspace=3 height=11 width=11 border=0></a><br />";
                 }
     
                 if ($section < $course->numsections) {    // Add a arrow to move section down
-                    echo "<a href=\"view.php?id=$course->id&section=$section&move=1\" title=\"$strmovedown\">".
+                    echo "<a href=\"view.php?id=$course->id&section=$section&move=1&sesskey=$USER->sesskey\" title=\"$strmovedown\">".
                          "<img src=\"$CFG->pixpath/t/down.gif\" vspace=3 height=11 width=11 border=0></a><br />";
                 }
     

course/grades.php

@@ -141,7 +141,7 @@
 
 
 /// OK, we have all the data, now present it to the user
-    if ($download == "xls") {
+    if ($download == "xls" and confirm_sesskey()) {
         require_once("../lib/excel/Worksheet.php");
         require_once("../lib/excel/Workbook.php");
 
@@ -199,7 +199,7 @@
     
         exit;
 
-    } else if ($download == "txt") {
+    } else if ($download == "txt" and confirm_sesskey()) {
 
 /// Print header to force download
 
@@ -254,9 +254,11 @@
         echo "<TD>";
         $options["id"] = "$course->id";
         $options["download"] = "xls";
+        $options["sesskey"] = $USER->sesskey;
         print_single_button("grades.php", $options, get_string("downloadexcel"));
         echo "<TD>";
         $options["download"] = "txt";
+        $options["sesskey"] = $USER->sesskey;
         print_single_button("grades.php", $options, get_string("downloadtext"));
         echo "</TABLE>";
     

course/group-edit.html

@@ -50,4 +50,5 @@
 
 <input type="hidden" name="group" value="<?php p($group->id) ?>"> 
 <input type="hidden" name="id" value="<?php p($course->id) ?>"> 
+<input type="hidden" name="sesskey" value="<?php p($sesskey) ?>"> 
 </form>

course/group.php

@@ -58,7 +58,7 @@
 
 /// If data submitted, then process and store.
 
-    if ($form = data_submitted()) { 
+    if ($form = data_submitted() and confirm_sesskey()) { 
 
         if (empty($form->name)) {
             $edit = true;
@@ -92,6 +92,8 @@
             $defaultformat = FORMAT_MOODLE;
         }
 
+        $sesskey = !empty($USER->id) ? $USER->sesskey : '';
+
         include('group-edit.html');
 
         if ($usehtmleditor) {

course/groups-edit.html

@@ -87,6 +87,7 @@ function groupWindow(selectgroup) {
         <form name="form1" id="form1" method="post" action="groups.php">
           <input type="hidden" name="id" value="<?php p($course->id) ?>" />
           <input type="hidden" name="groupid" value="<?php p($selectedgroup) ?>" />
+          <input type="hidden" name="sesskey" value="<?php p($sesskey) ?>">
           <select name="nonmembers[]" size="15" multiple="multiple">
             <?php 
                 if (!empty($nonmembers)) {
@@ -113,6 +114,7 @@ function groupWindow(selectgroup) {
       <td class="generalboxcontent"><p>
         <form name="form2" id="form2" method="post" action="groups.php">
           <input type="hidden" name="id" value="<?php p($course->id) ?>" />
+          <input type="hidden" name="sesskey" value="<?php p($sesskey) ?>">
           <select name="groups" size="15" onChange="updateMembers(this)">
             <?php 
                 if (!empty($listgroups)) {
@@ -146,6 +148,7 @@ function groupWindow(selectgroup) {
         <form name="form3" id="form3" method="post" action="groups.php">
           <input type="hidden" name="id" value="<?php p($course->id) ?>" />
           <input type="hidden" name="groupid" value="<?php p($selectedgroup) ?>" />
+          <input type="hidden" name="sesskey" value="<?php p($sesskey) ?>">
           <select name="members[]" size="15" multiple="multiple">
             <?php 
                 if (!empty($members)) {

course/groups.php

@@ -82,7 +82,7 @@
 
 /// We are in editing mode.  First, process any inputs there may be.
 
-    if ($data = data_submitted()) {
+    if ($data = data_submitted() and confirm_sesskey()) {
 
         if (!empty($data->nonmembersadd)) {            /// Add people to a group
             if (!empty($data->nonmembers) and !empty($data->groupid)) {
@@ -219,6 +219,8 @@
         $members = $listmembers[$selectedgroup];
     }
 
+    $sesskey = !empty($USER->id) ? $USER->sesskey : '';
+
 /// Print out the complete form
 
     include('groups-edit.html');

course/index.php

@@ -14,7 +14,7 @@
     }
 
     if (isadmin()) {
-        if (isset($_GET['edit'])) {
+        if (isset($_GET['edit']) and confirm_sesskey()) {
             if ($edit == "on") {
                 $USER->categoriesediting = true;
             } else if ($edit == "off") {
@@ -84,7 +84,7 @@
 
 
 /// If data for a new category was submitted, then add it
-    if ($form = data_submitted()) {
+    if ($form = data_submitted() and confirm_sesskey()) {
         if (!empty($form->addcategory)) {
             unset($newcategory);
             $newcategory->name = $form->addcategory;
@@ -100,7 +100,7 @@
 
 /// Delete a category if necessary
 
-    if (isset($delete)) {
+    if (isset($delete) and confirm_sesskey()) {
         if ($deletecat = get_record("course_categories", "id", $delete)) {
 
             /// Send the children categories to live with their grandparent
@@ -145,7 +145,7 @@
 
 /// Move a category to a new parent if required
 
-    if (isset($move) and isset($moveto)) {
+    if (isset($move) and isset($moveto) and confirm_sesskey()) {
         if ($tempcat = get_record("course_categories", "id", $move)) {
             if ($tempcat->parent != $moveto) {
                 if (! set_field("course_categories", "parent", $moveto, "id", $tempcat->id)) {
@@ -157,7 +157,7 @@
 
 
 /// Hide or show a category 
-    if (isset($hide) or isset($show)) {
+    if ((isset($hide) or isset($show)) and confirm_sesskey()) {
         if (isset($hide)) {
             $tempcat = get_record("course_categories", "id", $hide);
             $visible = 0;
@@ -178,7 +178,7 @@
 
 /// Move a category up or down
 
-    if (isset($moveup) or isset($movedown)) {
+    if ((isset($moveup) or isset($movedown)) and confirm_sesskey()) {
         
         $swapcategory = NULL;
         $movecategory = NULL;
@@ -253,6 +253,7 @@
     echo "<form name=\"addform\" action=\"index.php\" method=\"post\">";
     echo "<input type=\"text\" size=30 name=\"addcategory\">";
     echo "<input type=\"submit\" value=\"$straddnewcategory\">";
+    echo "<input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\">";
     echo "</form>";
     echo "</center>";
 
@@ -298,7 +299,7 @@
 function print_category_edit($category, $displaylist, $parentslist, $depth=-1, $up=false, $down=false) {
 /// Recursive function to print all the categories ready for editing
 
-    global $THEME, $CFG;
+    global $THEME, $CFG, $USER;
 
     static $str = '';
     static $pixpath = '';
@@ -327,7 +328,7 @@ function print_category_edit($category, $displaylist, $parentslist, $depth=-1, $
             echo "&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;";
         }
         $linkcss = $category->visible ? "" : " class=\"dimmed\" ";
-        echo "<a $linkcss title=\"$str->edit\" href=\"category.php?id=$category->id&edit=on\">$category->name</a>";
+        echo "<a $linkcss title=\"$str->edit\" href=\"category.php?id=$category->id&edit=on&sesskey=$USER->sesskey\">$category->name</a>";
         echo "</p>";
         echo "</td>";
 
@@ -335,23 +336,23 @@ function print_category_edit($category, $displaylist, $parentslist, $depth=-1, $
 
         echo "<td nowrap=\"nowrap\">";    /// Print little icons
 
-        echo "<a title=\"$str->delete\" href=\"index.php?delete=$category->id\"><img".
+        echo "<a title=\"$str->delete\" href=\"index.php?delete=$category->id&sesskey=$USER->sesskey\"><img".
              " src=\"$pixpath/t/delete.gif\" height=11 width=11 border=0></a> ";
 
         if (!empty($category->visible)) {
-            echo "<a title=\"$str->hide\" href=\"index.php?hide=$category->id\"><img".
+            echo "<a title=\"$str->hide\" href=\"index.php?hide=$category->id&sesskey=$USER->sesskey\"><img".
                  " src=\"$pixpath/t/hide.gif\" height=11 width=11 border=0></a> ";
         } else {
-            echo "<a title=\"$str->show\" href=\"index.php?show=$category->id\"><img".
+            echo "<a title=\"$str->show\" href=\"index.php?show=$category->id&sesskey=$USER->sesskey\"><img".
                  " src=\"$pixpath/t/show.gif\" height=11 width=11 border=0></a> ";
         }
 
         if ($up) {
-            echo "<a title=\"$str->moveup\" href=\"index.php?moveup=$category->id\"><img".
+            echo "<a title=\"$str->moveup\" href=\"index.php?moveup=$category->id&sesskey=$USER->sesskey\"><img".
                  " src=\"$pixpath/t/up.gif\" height=11 width=11 border=0></a> ";
         }
         if ($down) {
-            echo "<a title=\"$str->movedown\" href=\"index.php?movedown=$category->id\"><img".
+            echo "<a title=\"$str->movedown\" href=\"index.php?movedown=$category->id&sesskey=$USER->sesskey\"><img".
                  " src=\"$pixpath/t/down.gif\" height=11 width=11 border=0></a> ";
         }
         echo "</td>";
@@ -364,7 +365,7 @@ function print_category_edit($category, $displaylist, $parentslist, $depth=-1, $
                 unset($tempdisplaylist[$key]);
             }
         }
-        popup_form ("index.php?move=$category->id&moveto=", $tempdisplaylist, "moveform$category->id", "$category->parent", "", "", "", false);
+        popup_form ("index.php?move=$category->id&sesskey=$USER->sesskey&moveto=", $tempdisplaylist, "moveform$category->id", "$category->parent", "", "", "", false);
         echo "</td>";
         echo "</tr>";
     } else {

course/lib.php

@@ -809,7 +809,7 @@ function get_all_sections($courseid) {
 function course_set_display($courseid, $display=0) {
     global $USER;
 
-    if (empty($USER)) {
+    if (empty($USER->id)) {
         return false;
     }
 
@@ -876,8 +876,8 @@ function print_section($course, $section, $mods, $modnamesused, $absolute=false,
             $strmovehere = get_string("movehere");
             $strmovefull = strip_tags(get_string("movefull", "", "'$USER->activitycopyname'"));
         }
-        $labelformatoptions->noclean = true;
     }
+    $labelformatoptions->noclean = true;
 
     $modinfo = unserialize($course->modinfo);
 
@@ -899,7 +899,7 @@ function print_section($course, $section, $mods, $modnamesused, $absolute=false,
                         continue;
                     }
                     echo "<a title=\"$strmovefull\"".
-                         " href=\"$CFG->wwwroot/course/mod.php?moveto=$mod->id\">".
+                         " href=\"$CFG->wwwroot/course/mod.php?moveto=$mod->id&amp;sesskey=$USER->sesskey\">".
                          "<img height=\"16\" width=\"80\" src=\"$CFG->pixpath/movehere.gif\" ".
                          " alt=\"$strmovehere\" border=\"0\"></a><br />\n";
                 }
@@ -959,7 +959,7 @@ function print_section($course, $section, $mods, $modnamesused, $absolute=false,
     }
     if ($ismoving) {
         echo "<tr><td><a title=\"$strmovefull\"".
-             " href=\"$CFG->wwwroot/course/mod.php?movetosection=$section->id\">".
+             " href=\"$CFG->wwwroot/course/mod.php?movetosection=$section->id&amp;sesskey=$USER->sesskey\">".
              "<img height=\"16\" width=\"80\" src=\"$CFG->pixpath/movehere.gif\" ".
              " alt=\"$strmovehere\" border=\"0\"></a></td></tr>\n";
     }
@@ -970,7 +970,7 @@ function print_section($course, $section, $mods, $modnamesused, $absolute=false,
 function print_section_add_menus($course, $section, $modnames, $vertical=false, $return=false) {
 // Prints the menus to add activities and resources
 
-    global $CFG;
+    global $CFG, $USER;
     static $straddactivity, $stractivities, $straddresource, $resources;
 
     if (!isset($straddactivity)) {
@@ -990,7 +990,7 @@ function print_section_add_menus($course, $section, $modnames, $vertical=false,
     $output = '';
 
     $output .= '<div align="right"><table align="right"><tr><td>';
-    $output .= popup_form("$CFG->wwwroot/course/mod.php?id=$course->id&amp;section=$section&add=",
+    $output .= popup_form("$CFG->wwwroot/course/mod.php?id=$course->id&amp;section=$section&amp;sesskey=$USER->sesskey&add=",
                 $resources, "ressection$section", "", $straddresource, 'resource/types', $straddresource, true);
     $output .= '</td>';
 
@@ -999,7 +999,7 @@ function print_section_add_menus($course, $section, $modnames, $vertical=false,
     }
 
     $output .= '<td>';
-    $output .= popup_form("$CFG->wwwroot/course/mod.php?id=$course->id&amp;section=$section&add=",
+    $output .= popup_form("$CFG->wwwroot/course/mod.php?id=$course->id&amp;section=$section&amp;sesskey=$USER->sesskey&add=",
                 $modnames, "section$section", "", $straddactivity, 'mods', $straddactivity, true);
     $output .= '</td></tr></table>';
     $output .= '</div>';
@@ -1653,7 +1653,7 @@ function move_module($cm, $move) {
 }
 
 function make_editing_buttons($mod, $absolute=false, $moveselect=true, $indent=-1) {
-    global $CFG, $THEME;
+    global $CFG, $THEME, $USER;
 
     static $str;
 
@@ -1688,10 +1688,10 @@ function make_editing_buttons($mod, $absolute=false, $moveselect=true, $indent=-
     }
 
     if ($mod->visible) {
-        $hideshow = "<a title=\"$str->hide\" href=\"$path/mod.php?hide=$mod->id\"><img".
+        $hideshow = "<a title=\"$str->hide\" href=\"$path/mod.php?hide=$mod->id&amp;sesskey=$USER->sesskey\"><img".
                     " src=\"$pixpath/t/hide.gif\" hspace=\"2\" height=\"11\" width=\"11\" border=\"0\" alt=\"$str->hide\"></a> ";
     } else {
-        $hideshow = "<a title=\"$str->show\" href=\"$path/mod.php?show=$mod->id\"><img".
+        $hideshow = "<a title=\"$str->show\" href=\"$path/mod.php?show=$mod->id&amp;sesskey=$USER->sesskey\"><img".
                     " src=\"$pixpath/t/show.gif\" hspace=\"2\" height=\"11\" width=\"11\" ".
                     "border=\"0\" alt=\"$str->show\"></a> ";
     }
@@ -1699,15 +1699,15 @@ function make_editing_buttons($mod, $absolute=false, $moveselect=true, $indent=-
         if ($mod->groupmode == SEPARATEGROUPS) {
             $grouptitle = $str->groupsseparate;
             $groupimage = "$pixpath/t/groups.gif";
-            $grouplink  = "$path/mod.php?id=$mod->id&groupmode=0";
+            $grouplink  = "$path/mod.php?id=$mod->id&groupmode=0&amp;sesskey=$USER->sesskey";
         } else if ($mod->groupmode == VISIBLEGROUPS) {
             $grouptitle = $str->groupsvisible;
             $groupimage = "$pixpath/t/groupv.gif";
-            $grouplink  = "$path/mod.php?id=$mod->id&groupmode=1";
+            $grouplink  = "$path/mod.php?id=$mod->id&groupmode=1&amp;sesskey=$USER->sesskey";
         } else {
             $grouptitle = $str->groupsnone;
             $groupimage = "$pixpath/t/groupn.gif";
-            $grouplink  = "$path/mod.php?id=$mod->id&groupmode=2";
+            $grouplink  = "$path/mod.php?id=$mod->id&groupmode=2&amp;sesskey=$USER->sesskey";
         }
         if ($mod->groupmodelink) {
             $groupmode = "<a title=\"$grouptitle ($str->clicktochange)\" href=\"$grouplink\">".
@@ -1723,37 +1723,37 @@ function make_editing_buttons($mod, $absolute=false, $moveselect=true, $indent=-
     }
 
     if ($moveselect) {
-        $move =     "<a title=\"$str->move\" href=\"$path/mod.php?copy=$mod->id\"><img".
+        $move =     "<a title=\"$str->move\" href=\"$path/mod.php?copy=$mod->id&amp;sesskey=$USER->sesskey\"><img".
                     " src=\"$pixpath/t/move.gif\" hspace=\"2\" height=\"11\" width=\"11\" ".
                     " border=\"0\" alt=\"$str->move\"></a>";
     } else {
-        $move =     "<a title=\"$str->moveup\" href=\"$path/mod.php?id=$mod->id&move=-1\"><img".
+        $move =     "<a title=\"$str->moveup\" href=\"$path/mod.php?id=$mod->id&move=-1&amp;sesskey=$USER->sesskey\"><img".
                     " src=\"$pixpath/t/up.gif\" hspace=\"2\" height=\"11\" width=\"11\" ".
                     " border=\"0\" alt=\"$str->moveup\"></a>".
-                    "<a title=\"$str->movedown\" href=\"$path/mod.php?id=$mod->id&move=1\"><img".
+                    "<a title=\"$str->movedown\" href=\"$path/mod.php?id=$mod->id&move=1&amp;sesskey=$USER->sesskey\"><img".
                     " src=\"$pixpath/t/down.gif\" hspace=\"2\" height=\"11\" width=\"11\" ".
                     " border=\"0\" alt=\"$str->movedown\"></a>";
     }
 
     $leftright = "";
     if ($indent > 0) {
-        $leftright .= "<a title=\"$str->moveleft\" href=\"$path/mod.php?id=$mod->id&indent=-1\"><img".
+        $leftright .= "<a title=\"$str->moveleft\" href=\"$path/mod.php?id=$mod->id&indent=-1&amp;sesskey=$USER->sesskey\"><img".
                       " src=\"$pixpath/t/left.gif\" hspace=\"2\" height=\"11\" width=\"11\" ".
                       " border=\"0\" alt=\"$str->moveleft\"></a>";
     }
     if ($indent >= 0) {
-        $leftright .= "<a title=\"$str->moveright\" href=\"$path/mod.php?id=$mod->id&indent=1\"><img".
+        $leftright .= "<a title=\"$str->moveright\" href=\"$path/mod.php?id=$mod->id&indent=1&amp;sesskey=$USER->sesskey\"><img".
                       " src=\"$pixpath/t/right.gif\" hspace=\"2\" height=\"11\" width=\"11\" ".
                       " border=\"0\" alt=\"$str->moveright\"></a>";
     }
 
     return "$leftright$move".
-           "<a title=\"$str->update\" href=\"$path/mod.php?update=$mod->id\"><img".
+           "<a title=\"$str->update\" href=\"$path/mod.php?update=$mod->id&amp;sesskey=$USER->sesskey\"><img".
            " src=\"$pixpath/t/edit.gif\" hspace=\"2\" height=\"11\" width=\"11\" border=\"0\" ".
            " alt=\"$str->update\"></a>".
       //   Following line is commented out until this feature is more definite -- martin
-      //     "<a title=\"$str->duplicate\" href=\"$path/mod.php?duplicate=$mod->id\"> 2 </a>".
-           "<a title=\"$str->delete\" href=\"$path/mod.php?delete=$mod->id\"><img".
+      //     "<a title=\"$str->duplicate\" href=\"$path/mod.php?duplicate=$mod->id&amp;sesskey=$USER->sesskey\"> 2 </a>".
+           "<a title=\"$str->delete\" href=\"$path/mod.php?delete=$mod->id&amp;sesskey=$USER->sesskey\"><img".
            " src=\"$pixpath/t/delete.gif\" hspace=\"2\" height=\"11\" width=\"11\" border=\"0\" ".
            " alt=\"$str->delete\"></a>$hideshow$groupmode";
 }

course/loginas.php

@@ -4,9 +4,10 @@
     require_once("../config.php");
     require_once("lib.php");
 
-    require_variable($id);     // course id
+    require_variable($id);      // course id
     optional_variable($user);   // login as this user
-    optional_variable($return); // return to being the real user again
+    optional_variable($return); // return to the page we came from
+
 
     if (! $course = get_record("course", "id", $id)) {
         error("Course ID was incorrect");
@@ -16,7 +17,7 @@
         require_login($course->id);
     }
 
-    if ($return and $USER->realuser) {
+    if ($USER->realuser) {   /// Reset user back to their real self
         $USER = get_user_info_from_db("id", $USER->realuser);
         $USER->loggedin = true;
         $USER->site = $CFG->wwwroot;
@@ -30,8 +31,10 @@
             unset($SESSION->oldtimeaccess);
         }
 
-        redirect($_SERVER["HTTP_REFERER"]);
-        exit;
+        if ($return) {       /// That's all we wanted to do, so let's go back
+            redirect($_SERVER["HTTP_REFERER"]);
+            exit;
+        }
     }
 
     // $user must be defined to go on

course/mod.php

@@ -27,6 +27,14 @@
 
     if (isset($_POST["course"])) {    // add or update form submitted
 
+        //It caller is correct, $SESSION->sesskey must exist and coincide
+        if (empty($SESSION->sesskey) or !confirm_sesskey($SESSION->sesskey)) {
+            error(get_string('confirmsesskeybad', 'error'));
+        }
+
+        //Unset this, check done
+        unset($SESSION->sesskey);
+
         if (!$course = get_record("course", "id", $mod->course)) {
             error("This course doesn't exist");
         }
@@ -35,7 +43,9 @@
             error("You can't modify this course!");
         }
 
+        $mod->modulename = clean_filename($mod->modulename);  // For safety
         $modlib = "$CFG->dirroot/mod/$mod->modulename/lib.php";
+
         if (file_exists($modlib)) {
             include_once($modlib);
         } else {
@@ -163,7 +173,7 @@
     }
 
 
-    if (isset($_GET['move'])) {  
+    if (isset($_GET['move']) and confirm_sesskey()) {  
 
         require_variable($id);   
 
@@ -187,7 +197,7 @@
         }
         exit;
 
-    } else if (isset($_GET['movetosection']) or isset($_GET['moveto'])) {  
+    } else if ((isset($_GET['movetosection']) or isset($_GET['moveto'])) and confirm_sesskey()) {  
         
         if (! $cm = get_record("course_modules", "id", $USER->activitycopy)) {
             error("The copied course module doesn't exist!");
@@ -231,7 +241,7 @@
             redirect("view.php?id=$section->course");
         }
 
-    } else if (isset($_GET['indent'])) {  
+    } else if (isset($_GET['indent']) and confirm_sesskey()) {  
 
         require_variable($id);   
 
@@ -257,7 +267,7 @@
         }
         exit;
 
-    } else if (isset($_GET['hide'])) {
+    } else if (isset($_GET['hide']) and confirm_sesskey()) {
 
         if (! $cm = get_record("course_modules", "id", $_GET['hide'])) {
             error("This course module doesn't exist");
@@ -279,7 +289,7 @@
         }
         exit;
 
-    } else if (isset($_GET['show'])) {
+    } else if (isset($_GET['show']) and confirm_sesskey()) {
 
         if (! $cm = get_record("course_modules", "id", $_GET['show'])) {
             error("This course module doesn't exist");
@@ -311,7 +321,7 @@
         }
         exit;
 
-    } else if (isset($_GET['groupmode'])) {
+    } else if (isset($_GET['groupmode']) and confirm_sesskey()) {
 
         if (! $cm = get_record("course_modules", "id", $_GET['id'])) {
             error("This course module doesn't exist");
@@ -333,7 +343,7 @@
         }
         exit;
 
-    } else if (isset($_GET['copy'])) { // value = course module
+    } else if (isset($_GET['copy']) and confirm_sesskey()) { // value = course module
 
         if (! $cm = get_record("course_modules", "id", $_GET['copy'])) {
             error("This course module doesn't exist");
@@ -361,7 +371,7 @@
 
         redirect("view.php?id=$cm->course");
 
-    } else if (isset($_GET['cancelcopy'])) { // value = course module
+    } else if (isset($_GET['cancelcopy']) and confirm_sesskey()) { // value = course module
 
         $courseid = $USER->activitycopycourse;
 
@@ -371,7 +381,7 @@
 
         redirect("view.php?id=$courseid");
 
-    } else if (isset($_GET['delete'])) {   // value = course module
+    } else if (isset($_GET['delete']) and confirm_sesskey()) {   // value = course module
 
         if (! $cm = get_record("course_modules", "id", $_GET['delete'])) {
             error("This course module doesn't exist");
@@ -410,6 +420,7 @@
         $form->modulename   = $module->name;
         $form->fullmodulename  = $fullmodulename;
         $form->instancename = $instance->name;
+        $SESSION->sesskey = !empty($USER->id) ? $USER->sesskey : '';
 
         $strdeletecheck = get_string("deletecheck", "", "$form->fullmodulename");
         $strdeletecheckfull = get_string("deletecheckfull", "", "$form->fullmodulename '$form->instancename'");
@@ -426,7 +437,7 @@
         exit;
 
 
-    } else if (isset($_GET['update'])) {   // value = course module
+    } else if (isset($_GET['update']) and confirm_sesskey()) {   // value = course module
 
         if (! $cm = get_record("course_modules", "id", $_GET['update'])) {
             error("This course module doesn't exist");
@@ -463,6 +474,7 @@
         $form->modulename   = $module->name;
         $form->instance     = $cm->instance;
         $form->mode         = "update";
+        $SESSION->sesskey = !empty($USER->id) ? $USER->sesskey : '';
 
         $sectionname    = get_string("name$course->format");
         $fullmodulename = strtolower(get_string("modulename", $module->name));
@@ -475,7 +487,7 @@
             $pageheading = get_string("updatinga", "moodle", $fullmodulename);
         }
 
-    } else if (isset($_GET['duplicate'])) {   // value = course module
+    } else if (isset($_GET['duplicate']) and confirm_sesskey()) {   // value = course module
 
         if (! $cm = get_record("course_modules", "id", $_GET['duplicate'])) {
             error("This course module doesn't exist");
@@ -514,6 +526,7 @@
         $form->modulename   = $module->name;
         $form->instance     = $cm->instance;
         $form->mode         = "add";
+        $SESSION->sesskey = !empty($USER->id) ? $USER->sesskey : '';
 
         $sectionname    = get_string("name$course->format");
         $fullmodulename = strtolower(get_string("modulename", $module->name));
@@ -527,7 +540,7 @@
         }
 
         
-    } else if (isset($_GET['add'])) {
+    } else if (isset($_GET['add']) and confirm_sesskey()) {
 
         if (empty($_GET['add'])) {
             redirect($_SERVER["HTTP_REFERER"]);
@@ -552,6 +565,7 @@
         $form->instance   = "";
         $form->coursemodule = "";
         $form->mode       = "add";
+        $SESSION->sesskey = !empty($USER->id) ? $USER->sesskey : '';
         if (isset($_GET['type'])) {
             $form->type = $_GET['type'];
         }

course/recent.php

@@ -144,6 +144,7 @@
         foreach ($sections as $section) {
 
             if ($i <= $course->numsections) {
+                $activity = new Object;
                 $activity->type = "section";
                 if ($i) {
                     $activity->name = $sectiontitle . " $i";
@@ -194,6 +195,7 @@
                     $get_recent_mod_activity = $coursemod->name."_get_recent_mod_activity";
 
                     if (function_exists($get_recent_mod_activity)) {
+                        $activity = new Object;
                         $activity->type = "activity";
                         $activity->name = $instance->name;
                         $activity->visible = $coursemod->visible;

course/scales.php

@@ -43,7 +43,7 @@
 
     $errors = NULL;
 
-    if ($action == 'sendform') {
+    if ($action == 'sendform' and confirm_sesskey()) {
         if ($form = data_submitted()) {
             if (empty($form->name)) {
                 $errors[$scaleid]->name = true;
@@ -124,6 +124,9 @@
 
     //If action is edit or new, show the form
     if ($action == "edit" || $action == "new") {
+
+        $sesskey = !empty($USER->id) ? $USER->sesskey : '';
+
         //Check for teacher edit
         if (! isteacheredit($course->id)) {
             error("Only editing teachers can modify scales !");
@@ -216,6 +219,7 @@
         echo "<tr>";
         echo "<td colspan=2 align=\"center\">";
         echo "<input type=\"hidden\" name=\"id\" value=\"$course->id\">";
+        echo "<input type=\"hidden\" name=\"sesskey\" value=\"$sesskey\">";
         echo "<input type=\"hidden\" name=\"courseid\" value=\"$scale->courseid\">";
         echo "<input type=\"hidden\" name=\"scaleid\" value=\"$scale->id\">";
         echo "<input type=\"hidden\" name=\"action\" value=\"sendform\">";
@@ -230,7 +234,7 @@
     }
 
     //If action is delete, do it
-    if ($action == "delete") {
+    if ($action == "delete" and confirm_sesskey()) {
         //Check for teacher edit
         if (! isteacheredit($course->id)) {
             error("Only editing teachers can delete scales !");
@@ -263,7 +267,7 @@
     }
 
     //If action is down or up, do it
-    if ($action == "down" || $action == "up" ) {
+    if (($action == "down" || $action == "up") and confirm_sesskey()) {
         //Check for teacher edit
         if (! isadmin()) {
             error("Only administrators can move scales",$CFG->wwwroot.'/course/scales.php?id='.$course->id);
@@ -449,14 +453,14 @@
                 $buttons .= "<a title=\"$stredit\" href=\"$path/scales.php?id=$course->id&scaleid=$scale->id&action=edit\"><img".
                             " src=\"$pixpath/t/edit.gif\" hspace=2 height=11 width=11 border=0></a> ";
                 if ($incustom && isadmin()) {
-                    $buttons .= "<a title=\"$strdown\" href=\"$path/scales.php?id=$course->id&scaleid=$scale->id&action=down\"><img".
+                    $buttons .= "<a title=\"$strdown\" href=\"$path/scales.php?id=$course->id&scaleid=$scale->id&action=down&amp;sesskey=$USER->sesskey\"><img".
                                 " src=\"$pixpath/t/down.gif\" hspace=2 height=11 width=11 border=0></a> ";
                 }
                 if (!$incustom && isadmin()) {
-                    $buttons .= "<a title=\"$strup\" href=\"$path/scales.php?id=$course->id&scaleid=$scale->id&action=up\"><img".
+                    $buttons .= "<a title=\"$strup\" href=\"$path/scales.php?id=$course->id&scaleid=$scale->id&action=up&amp;sesskey=$USER->sesskey\"><img".
                                 " src=\"$pixpath/t/up.gif\" hspace=2 height=11 width=11 border=0></a> ";
                 }
-                $buttons .= "<a title=\"$strdelete\" href=\"$path/scales.php?id=$course->id&scaleid=$scale->id&action=delete\"><img".
+                $buttons .= "<a title=\"$strdelete\" href=\"$path/scales.php?id=$course->id&scaleid=$scale->id&action=delete&amp;sesskey=$USER->sesskey\"><img".
                             " src=\"$pixpath/t/delete.gif\" hspace=2 height=11 width=11 border=0></a> ";
             }
             $line[] = $buttons;

course/student.html

@@ -1,6 +1,7 @@
 
 <form name="studentform" id="studentform" method="post" action="student.php">
 <input type="hidden" name="previoussearch" value="<?php echo $previoussearch ?>">
+<input type="hidden" name="sesskey" value="<?php echo $sesskey ?>">
 <input type="hidden" name="id" value="<?php echo $id?>">
   <table align="center" border="0" cellpadding="5" cellspacing="0">
     <tr>

course/student.php

@@ -67,7 +67,7 @@
 /// A form was submitted so process the input
 
     } else {
-        if (!empty($frm->add) and !empty($frm->addselect)) {
+        if (!empty($frm->add) and !empty($frm->addselect) and confirm_sesskey()) {
             if ($course->enrolperiod) {
                 $timestart = time();
                 $timeend   = $timestart + $course->enrolperiod;
@@ -79,7 +79,7 @@
                     error("Could not add student with id $addstudent to this course!");
                 }
             }
-        } else if (!empty($frm->remove) and !empty($frm->removeselect)) {
+        } else if (!empty($frm->remove) and !empty($frm->removeselect) and confirm_sesskey()) {
             foreach ($frm->removeselect as $removestudent) {
                 if (! unenrol_student($removestudent, $course->id)) {
                     error("Could not remove student with id $removestudent from this course!");
@@ -135,6 +135,8 @@
 
     print_simple_box_start("center", "", "$THEME->cellheading");
 
+    $sesskey = !empty($USER->id) ? $USER->sesskey : '';
+
     include('student.html');
 
     print_simple_box_end();

course/teacher.php

@@ -67,7 +67,8 @@
 
 /// If data submitted, then process and store.
 
-    if ($form = data_submitted()) {
+    if ($form = data_submitted() and confirm_sesskey()) {
+        unset ($form->sesskey);
         $rank = array();
 
         // Peel out all the data from variable names.
@@ -95,7 +96,7 @@
 
 /// Add a teacher if one is specified
 
-    if (!empty($_GET['add'])) {
+    if (!empty($_GET['add']) and confirm_sesskey()) {
         if (! add_teacher($add, $course->id)) {
             error("Could not add that teacher to this course!");
         }
@@ -103,9 +104,9 @@
 
 /// Remove a teacher if one is specified.
 
-    if (!empty($_GET['remove'])) {
+    if (!empty($_GET['remove']) and confirm_sesskey()) {
         if (! remove_teacher($remove, $course->id)) {
-            error("Could not add that teacher to this course!");
+            error("Could not remove that teacher from this course!");
         }
     }
 
@@ -150,7 +151,7 @@
                 $editall = choose_from_menu ($editmenu, "e$teacher->id", $teacher->editall, "", "", "", true);
             }
     
-            $removelink = "<a href=\"teacher.php?id=$course->id&remove=$teacher->id\">$strremoveteacher</a>";
+            $removelink = "<a href=\"teacher.php?id=$course->id&remove=$teacher->id&sesskey=$USER->sesskey\">$strremoveteacher</a>";
 
             if (!$teacher->role) {
                 $teacher->role = $course->teacher;
@@ -165,6 +166,7 @@
 
         print_table($table);
         echo "<input type=hidden name=id value=\"$course->id\">";
+        echo "<input type=hidden name=sesskey value=\"$USER->sesskey\">";
         echo "<center><input type=submit value=\"".get_string("savechanges")."\"> ";
         echo "</center>";
         echo "</form>";
@@ -201,7 +203,7 @@
 
 
         foreach ($users as $user) {
-            $addlink = "<a href=\"teacher.php?id=$course->id&add=$user->id\">$straddteacher</a>";
+            $addlink = "<a href=\"teacher.php?id=$course->id&add=$user->id&sesskey=$USER->sesskey\">$straddteacher</a>";
             $picture = print_user_picture($user->id, $course->id, $user->picture, false, true);
             $table->data[] = array ($picture, fullname($user, true), $user->email, $addlink);
         }

course/unenrol.php

@@ -28,7 +28,7 @@
         error("You are not allowed to unenroll");
     }
 
-    if (isset($confirm)) {
+    if (isset($confirm) and confirm_sesskey()) {
 
         if (! unenrol_student($user->id, $course->id)) {
             error("An error occurred while trying to unenrol you.");
@@ -56,7 +56,7 @@
         $strunenrolsure = get_string("unenrolsure", "", fullname($user, true));
     }
 
-    notice_yesno ($strunenrolsure, "unenrol.php?id=$id&user=$user->id&confirm=yes", "$HTTP_REFERER");
+    notice_yesno ($strunenrolsure, "unenrol.php?id=$id&user=$user->id&confirm=yes&sesskey=$USER->sesskey", "$HTTP_REFERER");
 
     print_footer();
 

course/user.php

@@ -116,6 +116,11 @@
                                 continue;
                             }
                             $mod = $mods[$sectionmod];
+
+                            if (empty($mod->visible)) {
+                                continue;
+                            }
+
                             $instance = get_record("$mod->modname", "id", "$mod->instance");
                             $libfile = "$CFG->dirroot/mod/$mod->modname/lib.php";
 

course/view.php

@@ -75,15 +75,15 @@
 
         $editing = $USER->editing;
 
-        if (isset($hide)) {
+        if (isset($hide) and confirm_sesskey()) {
             set_section_visible($course->id, $hide, '0');
         }
 
-        if (isset($show)) {
+        if (isset($show) and confirm_sesskey()) {
             set_section_visible($course->id, $show, '1');
         }
 
-        if (isset($_GET['blockaction'])) {
+        if (isset($_GET['blockaction']) and confirm_sesskey()) {
             if (isset($_GET['blockid'])) {
                 block_action($course, $leftblocks, $rightblocks, strtolower($_GET['blockaction']), intval($_GET['blockid']));
             }
@@ -118,7 +118,7 @@
         }
 
         if (!empty($section)) {
-            if (!empty($move)) {
+            if (!empty($move) and confirm_sesskey()) {
                 if (!move_section($course, $section, $move)) {
                     notify("An error occurred while moving a section");
                 }
@@ -135,7 +135,7 @@
 
     $SESSION->fromdiscussion = "$CFG->wwwroot/course/view.php?id=$course->id";
 
-    if (! $course->category) {      // This course is not a real course.
+    if ($course->id == SITEID) {      // This course is not a real course.
         redirect("$CFG->wwwroot/");
     }
 

doc/index.php

@@ -5,16 +5,11 @@
     optional_variable($file, "");     // docs file to view
     optional_variable($frame, "");    // docs file to view
     optional_variable($sub, "");      // sub-section (named anchor)
-    optional_variable($lang, "");     // override current language
 
     if ($CFG->forcelogin) {
         require_login();
     }
 
-    if (!empty($lang)) {
-        $SESSION->lang = $lang;
-    }
-
     if (!empty($sub)) {
         $sub = "#$sub";
     } else {

enrol/database/enrol.php

@@ -17,45 +17,71 @@ class enrolment_plugin extends enrolment_base {
 function get_student_courses(&$user) {
     global $CFG;
 
-    parent::get_student_courses($user);
-
+    parent::get_student_courses($user);  /// Start with the list of known enrolments
+                                         /// If the database fails we can at least use this
 
     // This is a hack to workaround what seems to be a bug in ADOdb with accessing 
     // two databases of the same kind ... it seems to get confused when trying to access
     // the first database again, after having accessed the second.
     // The following hack will make the database explicit which keeps it happy
+
     if (strpos($CFG->prefix, $CFG->dbname) === false) {
+        $oldprefix = $CFG->prefix;
         $CFG->prefix = "$CFG->dbname.$CFG->prefix";
     }
-        
 
-    // Connect to the external database
+    // Try to connect to the external database
+
     $enroldb = &ADONewConnection($CFG->enrol_dbtype);
+
     if ($enroldb->PConnect($CFG->enrol_dbhost,$CFG->enrol_dbuser,$CFG->enrol_dbpass,$CFG->enrol_dbname)) {
 
-        foreach ($user->student as $courseid=>$value) {
-        
-            /// Get the value of the local course field
-            $localcoursevalue = get_field("course", $CFG->enrol_localcoursefield, "id", $courseid);
-            
-            /// Find a record in the external database that matches the local course field and local user field
-            /// to the respective remote fields
-            $rs = $enroldb->Execute("SELECT * FROM $CFG->enrol_dbtable 
-                                     WHERE $CFG->enrol_remotecoursefield = '$localcoursevalue' 
-                                     AND $CFG->enrol_remoteuserfield = '{$user->$CFG->enrol_localuserfield}' ");
+        $courselist = array();      /// Initialise new array
+        $newstudent = array();
 
-            /// If no records existed then student has been unenrolled externally.
-            /// Unenrol locally and remove entry from the $user->student array
-            if (! ($rs->RecordCount()) ) {
-                unenrol_student($user->id, $courseid);
-                unset ($user->student[$courseid]);
+        /// Get the authoritative list of enrolments from the database
+
+        $useridnumber = $user->{$CFG->enrol_localuserfield};   
+
+
+        if ($rs = $enroldb->Execute("SELECT $CFG->enrol_remotecoursefield 
+                                       FROM $CFG->enrol_dbtable 
+                                      WHERE $CFG->enrol_remoteuserfield = '$useridnumber' ")) {
+
+            if ($rs->RecordCount() > 0) {
+                while (!$rs->EOF) {
+                    $courselist[] = $rs->fields[0];
+                    $rs->MoveNext();
+                }
+
+                foreach ($courselist as $coursefield) {
+                    if ($course = get_record('course', $CFG->enrol_localcoursefield, $coursefield)) {
+                        $newstudent[$course->id] = true;             /// Add it to new list
+                        if (isset($user->student[$course->id])) {   /// We have it already
+                            unset($user->student[$course->id]);       /// Remove from old list
+                        } else {
+                            enrol_student($user->id, $course->id);   /// Enrol the student
+                        }
+                    }
+                }
             }
+
+            if (!empty($user->student)) {    /// We have some courses left that we need to unenrol from
+                foreach ($user->student as $courseid => $value) {
+                    unenrol_student($user->id, $courseid);       /// Unenrol the student
+                    unset($user->student[$course->id]);           /// Remove from old list
+                }
+            }
+
+            $user->student = $newstudent;    /// Overwrite the array with the new one
         }
-
+        
         $enroldb->Close();
-
     }
 
+    if (!empty($oldprefix)) {
+        $CFG->prefix = $oldprefix;           // Restore it just in case
+    }
 }
 
 
@@ -87,7 +113,7 @@ function get_access_icons($course) {
 }
 
 
-/// Overrise the base config_form() function
+/// Overide the base config_form() function
 function config_form($frm) {
     global $CFG;
     include("$CFG->dirroot/enrol/database/config.html");

enrol/enrol.class.php

@@ -148,6 +148,16 @@ function print_entry($course) {
             if (! enrol_student($USER->id, $course->id, $timestart, $timeend)) {
                 error("An error occurred while trying to enrol you.");
             }
+
+            $subject = get_string("welcometocourse", "", $course->fullname);
+            $a->coursename = $course->fullname;
+            $a->profileurl = "$CFG->wwwroot/user/view.php?id=$USER->id&course=$course->id";
+            $message = get_string("welcometocoursetext", "", $a);
+            if (! $teacher = get_teacher($course->id)) {
+                $teacher = get_admin();
+            }
+            email_to_user($USER, $teacher, $subject, $message);
+
             add_to_log($course->id, "course", "enrol", "view.php?id=$course->id", "$USER->id");
 
             $USER->student[$course->id] = true;

files/index.php

@@ -1,4 +1,4 @@
-<?PHP // $Id$
+<?php // $Id$
 
 //  Manage all uploaded files in a course file area
 
@@ -8,11 +8,23 @@
 //  USER is a persistent variable using sessions
 
     require("../config.php");
+    require("mimetypes.php");
+
+    $id      = required_param('id', PARAM_INT);
+    $file    = optional_param('file', '', PARAM_PATH);
+    $wdir    = optional_param('wdir', '', PARAM_PATH);
+    $action  = optional_param('action', '', PARAM_ACTION);
+    $name    = optional_param('name', '', PARAM_FILE);
+    $oldname = optional_param('oldname', '', PARAM_FILE);
+    $choose  = optional_param('choose', '', PARAM_CLEAN);
+
+
+    if ($choose) {
+        if (count(explode('.', $choose)) != 2) {
+            error('Incorrect format for choose parameter');
+        }
+    }
 
-    require_variable($id);
-    optional_variable($file, "");
-    optional_variable($wdir, "");
-    optional_variable($action, "");
 
     if (! $course = get_record("course", "id", $id) ) {
         error("That's an invalid course id");
@@ -25,14 +37,19 @@
     }
 
     function html_footer() {
-        global $course;
-        echo "</td></tr></table></body></html>";
-        print_footer($course);
+
+        global $course, $choose;
+
+        if ($choose) {
+            echo "</td></tr></table></body></html>";
+        } else {
+            echo "</td></tr></table></body></html>";
+            print_footer($course);
+        }
     }
     
     function html_header($course, $wdir, $formfield=""){
-
-        global $CFG;
+        global $CFG, $THEME, $ME, $choose;
 
         if (! $site = get_site()) {
             error("Invalid site!");
@@ -43,7 +60,7 @@
         } else {
             $strfiles = get_string("files");
         }
-    
+
         if ($wdir == "/") {
             $fullnav = "$strfiles";
         } else {
@@ -54,29 +71,65 @@
             for ($i=1; $i<$numdirs-1; $i++) {
                $navigation .= " -> ";
                $link .= "/".urlencode($dirs[$i]);
-               $navigation .= "<a href=\"index.php?id=$course->id&wdir=$link\">".$dirs[$i]."</a>";
+               $navigation .= "<a href=\"".$ME."?id=$course->id&amp;wdir=$link&amp;choose=$choose\">".$dirs[$i]."</a>";
             }
-            $fullnav = "<a href=\"index.php?id=$course->id&wdir=/\">$strfiles</a> $navigation -> ".$dirs[$numdirs-1];
+            $fullnav = "<a href=\"".$ME."?id=$course->id&amp;wdir=/&amp;choose=$choose\">$strfiles</a> $navigation -> ".$dirs[$numdirs-1];
         }
 
-        if ($course->id == $site->id) {
-            print_header("$course->shortname: $strfiles", "$course->fullname", 
-                         "<a href=\"../$CFG->admin/index.php\">".get_string("administration").
-                         "</a> -> $fullnav", $formfield);
 
-            print_heading(get_string("publicsitefileswarning"), "center", 2);
+        if ($choose) {
+            print_header();
+
+            $chooseparts = explode('.', $choose);
+
+            ?>
+            <script language="javascript" type="text/javascript">
+            <!--
+            function set_value(txt) {
+                opener.document.forms['<?php echo $chooseparts[0]."'].".$chooseparts[1] ?>.value = txt;
+                window.close();
+            }
+            -->
+            </script>
+
+            <?php
+            $fullnav = str_replace('->', '&raquo;', "$course->shortname -> $fullnav");
+            echo '<table border="0" cellpadding="3" cellspacing="0" width="100%">';
+            echo '<tr>';
+            echo '<td bgcolor="'.$THEME->cellheading.'" class="navbar">';
+            echo '<font size="2"><b>'.$fullnav.'</b></font>';
+            echo '</td>';
+            echo '</tr>';
+            echo '</table>';
+
+            if ($course->id == $site->id) {
+                print_heading(get_string("publicsitefileswarning"), "center", 2);
+            }
 
         } else {
-            print_header("$course->shortname: $strfiles", "$course->fullname", 
-                         "<a href=\"../course/view.php?id=$course->id\">$course->shortname".
-                         "</a> -> $fullnav", $formfield);
+
+            if ($course->id == $site->id) {
+                print_header("$course->shortname: $strfiles", "$course->fullname",
+                             "<a href=\"../$CFG->admin/index.php\">".get_string("administration").
+                             "</a> -> $fullnav", $formfield);
+
+                print_heading(get_string("publicsitefileswarning"), "center", 2);
+
+            } else {
+                print_header("$course->shortname: $strfiles", "$course->fullname",
+                             "<a href=\"../course/view.php?id=$course->id\">$course->shortname".
+                             "</a> -> $fullnav", $formfield);
+            }
         }
 
+
         echo "<table border=0 align=center cellspacing=3 cellpadding=3 width=640>";
         echo "<tr>";
         echo "<td colspan=\"2\">";
+
     }
 
+
     if (! $basedir = make_upload_directory("$course->id")) {
         error("The site administrator needs to fix the file permissions");
     }
@@ -85,19 +138,18 @@
 
 //  End of configuration and access control
 
-    require("mimetypes.php");
-
-    $regexp="\\.\\.";
-    if (ereg( $regexp, $file, $regs )| ereg( $regexp, $wdir,$regs )) {           
-        $message = "Error: Directories can not contain \"..\"";
-        $wdir = "/";
-        $action = "";
-    }    
 
     if (!$wdir) {
         $wdir="/";
     }
 
+    if (($wdir != '/' and detect_munged_arguments($wdir, 0))
+      or ($file != '' and detect_munged_arguments($file, 0))) {
+        $message = "Error: Directories can not contain \"..\"";
+        $wdir = "/";
+        $action = "";
+    }
+
     if ($wdir == "/backupdata") {
         if (! make_upload_directory("$course->id/backupdata")) {   // Backup folder
             error("Could not create backupdata folder.  The site administrator needs to fix the file permissions");
@@ -109,31 +161,16 @@
 
         case "upload":
             html_header($course, $wdir);
-            if (!empty($_FILES['userfile'])) {
-                $userfile = $_FILES['userfile'];
-            } else {
-                $save = false;
-            }
-            if (!empty($save)) {
-                if (!is_uploaded_file($userfile['tmp_name']) or $userfile['size'] == 0) {
-                    notify(get_string("uploadnofilefound"));
-                } else {
-                    $userfile_name = clean_filename($userfile['name']);
-                    if ($userfile_name) {
-                        $newfile = "$basedir$wdir/$userfile_name";
-                        if (move_uploaded_file($userfile['tmp_name'], $newfile)) {
-                            chmod($newfile, 0666);
-                            $a = NULL;
-                            $a->file = "$userfile_name (".$userfile['type'].")";
-                            $a->directory = $wdir;
-                            print_string("uploadedfileto", "", $a);
-                        } else {
-                            notify(get_string("uploadproblem", "", $userfile_name));
-                        }
-                    }
+            require_once($CFG->dirroot.'/lib/uploadlib.php');
+                
+            if (!empty($save) and confirm_sesskey()) {
+                $um = new upload_manager('userfile',false,false,$course,false,0);
+                $dir = "$basedir$wdir";
+                if ($um->process_file_uploads($dir)) {
+                    notify(get_string('uploadedfile'));
                 }
+                // um will take care of error reporting.
                 displaydir($wdir);
-                    
             } else {
                 $upload_max_filesize = get_max_upload_file_size($CFG->maxbytes);  // Restricted by site setting
                 $filesize = display_size($upload_max_filesize);
@@ -143,36 +180,38 @@
                 $strmaxsize = get_string("maxsize", "", $filesize);
                 $strcancel = get_string("cancel");
 
-                echo "<P>$struploadafile ($strmaxsize) --> <B>$wdir</B>";
-                echo "<TABLE><TR><TD COLSPAN=2>";
-                echo "<FORM ENCTYPE=\"multipart/form-data\" METHOD=\"post\" ACTION=index.php>";
-                echo " <INPUT TYPE=hidden NAME=MAX_FILE_SIZE value=\"$upload_max_filesize\">";
-                echo " <INPUT TYPE=hidden NAME=id VALUE=$id>";
-                echo " <INPUT TYPE=hidden NAME=wdir VALUE=$wdir>";
-                echo " <INPUT TYPE=hidden NAME=action VALUE=upload>";
-                echo " <INPUT NAME=\"userfile\" TYPE=\"file\" size=\"60\">";
-                echo " </TD><TR><TD WIDTH=10>";
-                echo " <INPUT TYPE=submit NAME=save VALUE=\"$struploadthisfile\">";
-                echo "</FORM>";
-                echo "</TD><TD WIDTH=100%>";
-                echo "<FORM ACTION=index.php METHOD=get>";
-                echo " <INPUT TYPE=hidden NAME=id VALUE=$id>";
-                echo " <INPUT TYPE=hidden NAME=wdir VALUE=$wdir>";
-                echo " <INPUT TYPE=hidden NAME=action VALUE=cancel>";
-                echo " <INPUT TYPE=submit VALUE=\"$strcancel\">";
-                echo "</FORM>";
-                echo "</TD></TR></TABLE>";
+                echo "<p>$struploadafile ($strmaxsize) --> <b>$wdir</b>";
+                echo "<table><tr><td colspan=\"2\">";
+                echo "<form enctype=\"multipart/form-data\" method=\"post\" action=\"index.php\">";
+                echo ' <input type="hidden" name="choose" value="'.$choose.'">';
+                echo " <input type=\"hidden\" name=\"id\" value=\"$id\" />";
+                echo " <input type=\"hidden\" name=\"wdir\" value=\"$wdir\" />";
+                echo " <input type=\"hidden\" name=\"action\" value=\"upload\" />";
+                echo " <input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\" />";
+                upload_print_form_fragment(1,array('userfile'),null,false,null,$course->maxbytes,0,false);
+                echo " </td><tr><td width=\"10\">";
+                echo " <input type=\"submit\" name=\"save\" value=\"$struploadthisfile\" />";
+                echo "</form>";
+                echo "</td><td width=\"100%\">";
+                echo "<form action=\"index.php\" method=\"get\">";
+                echo ' <input type="hidden" name="choose" value="'.$choose.'">';
+                echo " <input type=\"hidden\" name=\"id\" value=\"$id\" />";
+                echo " <input type=\"hidden\" name=\"wdir\" value=\"$wdir\" />";
+                echo " <input type=\"hidden\" name=\"action\" value=\"cancel\" />";
+                echo " <input type=\"submit\" value=\"$strcancel\" />";
+                echo "</form>";
+                echo "</td></tr></table>";
             }
             html_footer();
             break;
 
         case "delete":
-            if (!empty($confirm)) {
+            if (!empty($confirm) and confirm_sesskey()) {
                 html_header($course, $wdir);
                 foreach ($USER->filelist as $file) {
                     $fullfile = $basedir.$file;
                     if (! fulldelete($fullfile)) {
-                        echo "<BR>Error: Could not delete: $fullfile";
+                        echo "<br />Error: Could not delete: $fullfile";
                     }
                 }
                 clearfilelist();
@@ -182,14 +221,14 @@
             } else {
                 html_header($course, $wdir);
                 if (setfilelist($_POST)) {
-                    echo "<p align=center>".get_string("deletecheckwarning").":</p>";
+                    echo "<p align=\"center\">".get_string("deletecheckwarning").":</p>";
                     print_simple_box_start("center");
                     printfilelist($USER->filelist);
                     print_simple_box_end();
                     echo "<br />";
                     notice_yesno (get_string("deletecheckfiles"), 
-                                "index.php?id=$id&wdir=$wdir&action=delete&confirm=1",
-                                "index.php?id=$id&wdir=$wdir&action=cancel");
+                                "index.php?id=$id&amp;wdir=$wdir&amp;action=delete&amp;confirm=1&amp;sesskey=$USER->sesskey",
+                                "index.php?id=$id&amp;wdir=$wdir&amp;action=cancel");
                 } else {
                     displaydir($wdir);
                 }
@@ -199,10 +238,10 @@
 
         case "move":
             html_header($course, $wdir);
-            if ($count = setfilelist($_POST)) {
+            if (($count = setfilelist($_POST)) and confirm_sesskey()) {
                 $USER->fileop     = $action;
                 $USER->filesource = $wdir;
-                echo "<p align=center>";
+                echo "<p align=\"center\">";
                 print_string("selectednowmove", "moodle", $count);
                 echo "</p>";
             }
@@ -212,13 +251,13 @@
 
         case "paste":
             html_header($course, $wdir);
-            if (isset($USER->fileop) and $USER->fileop == "move") {
+            if (isset($USER->fileop) and ($USER->fileop == "move") and confirm_sesskey()) {
                 foreach ($USER->filelist as $file) {
                     $shortfile = basename($file);
                     $oldfile = $basedir.$file;
                     $newfile = $basedir.$wdir."/".$shortfile;
                     if (!rename($oldfile, $newfile)) {
-                        echo "<P>Error: $shortfile not moved";
+                        echo "<p>Error: $shortfile not moved";
                     }
                 }
             }
@@ -228,7 +267,7 @@
             break;
 
         case "rename":
-            if (!empty($name)) {
+            if (!empty($name) and confirm_sesskey()) {
                 html_header($course, $wdir);
                 $name = clean_filename($name);
                 if (file_exists($basedir.$wdir."/".$name)) {
@@ -243,30 +282,33 @@
                 $strcancel = get_string("cancel");
                 $strrenamefileto = get_string("renamefileto", "moodle", $file);
                 html_header($course, $wdir, "form.name");
-                echo "<P>$strrenamefileto:";
-                echo "<TABLE><TR><TD>";
-                echo "<FORM ACTION=index.php METHOD=post NAME=form>";
-                echo " <INPUT TYPE=hidden NAME=id VALUE=$id>";
-                echo " <INPUT TYPE=hidden NAME=wdir VALUE=$wdir>";
-                echo " <INPUT TYPE=hidden NAME=action VALUE=rename>";
-                echo " <INPUT TYPE=hidden NAME=oldname VALUE=\"$file\">";
-                echo " <INPUT TYPE=text NAME=name SIZE=35 VALUE=\"$file\">";
-                echo " <INPUT TYPE=submit VALUE=\"$strrename\">";
-                echo "</FORM>";
-                echo "</TD><TD>";
-                echo "<FORM ACTION=index.php METHOD=get>";
-                echo " <INPUT TYPE=hidden NAME=id VALUE=$id>";
-                echo " <INPUT TYPE=hidden NAME=wdir VALUE=$wdir>";
-                echo " <INPUT TYPE=hidden NAME=action VALUE=cancel>";
-                echo " <INPUT TYPE=submit VALUE=\"$strcancel\">";
-                echo "</FORM>";
-                echo "</TD></TR></TABLE>";
+                echo "<p>$strrenamefileto:";
+                echo "<table><tr><td>";
+                echo "<form action=\"index.php\" method=\"post\" name=\"form\">";
+                echo ' <input type="hidden" name="choose" value="'.$choose.'">';
+                echo " <input type=\"hidden\" name=\"id\" value=\"$id\" />";
+                echo " <input type=\"hidden\" name=\"wdir\" value=\"$wdir\" />";
+                echo " <input type=\"hidden\" name=\"action\" value=\"rename\" />";
+                echo " <input type=\"hidden\" name=\"oldname\" value=\"$file\" />";
+                echo " <input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\" />";
+                echo " <input type=\"text\" name=\"name\" size=\"35\" value=\"$file\" />";
+                echo " <input type=\"submit\" value=\"$strrename\" />";
+                echo "</form>";
+                echo "</td><td>";
+                echo "<form action=\"index.php\" method=\"get\">";
+                echo ' <input type="hidden" name="choose" value="'.$choose.'">';
+                echo " <input type=\"hidden\" name=\"id\" value=\"$id\" />";
+                echo " <input type=\"hidden\" name=\"wdir\" value=\"$wdir\" />";
+                echo " <input type=\"hidden\" name=\"action\" value=\"cancel\" />";
+                echo " <input type=\"submit\" value=\"$strcancel\" />";
+                echo "</form>";
+                echo "</td></tr></table>";
             }
             html_footer();
             break;
 
         case "mkdir":
-            if (!empty($name)) {
+            if (!empty($name) and confirm_sesskey()) {
                 html_header($course, $wdir);
                 $name = clean_filename($name);
                 if (file_exists("$basedir$wdir/$name")) {
@@ -281,37 +323,40 @@
                 $strcancel = get_string("cancel");
                 $strcreatefolder = get_string("createfolder", "moodle", $wdir);
                 html_header($course, $wdir, "form.name");
-                echo "<P>$strcreatefolder:";
-                echo "<TABLE><TR><TD>";
-                echo "<FORM ACTION=index.php METHOD=post NAME=form>";
-                echo " <INPUT TYPE=hidden NAME=id VALUE=$id>";
-                echo " <INPUT TYPE=hidden NAME=wdir VALUE=$wdir>";
-                echo " <INPUT TYPE=hidden NAME=action VALUE=mkdir>";
-                echo " <INPUT TYPE=text NAME=name SIZE=35>";
-                echo " <INPUT TYPE=submit VALUE=\"$strcreate\">";
-                echo "</FORM>";
-                echo "</TD><TD>";
-                echo "<FORM ACTION=index.php METHOD=get>";
-                echo " <INPUT TYPE=hidden NAME=id VALUE=$id>";
-                echo " <INPUT TYPE=hidden NAME=wdir VALUE=$wdir>";
-                echo " <INPUT TYPE=hidden NAME=action VALUE=cancel>";
-                echo " <INPUT TYPE=submit VALUE=\"$strcancel\">";
-                echo "</FORM>";
-                echo "</TD></TR></TABLE>";
+                echo "<p>$strcreatefolder:";
+                echo "<table><tr><td>";
+                echo "<form action=\"index.php\" method=\"post\" name=\"form\">";
+                echo ' <input type="hidden" name="choose" value="'.$choose.'">';
+                echo " <input type=\"hidden\" name=\"id\" value=\"$id\" />";
+                echo " <input type=\"hidden\" name=\"wdir\" value=\"$wdir\" />";
+                echo " <input type=\"hidden\" name=\"action\" value=\"mkdir\" />";
+                echo " <input type=\"text\" name=\"name\" size=\"35\" />";
+                echo " <input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\" />";
+                echo " <input type=\"submit\" value=\"$strcreate\" />";
+                echo "</form>";
+                echo "</td><td>";
+                echo "<form action=\"index.php\" method=\"get\">";
+                echo ' <input type="hidden" name="choose" value="'.$choose.'">';
+                echo " <input type=\"hidden\" name=\"id\" value=\"$id\" />";
+                echo " <input type=\"hidden\" name=\"wdir\" value=\"$wdir\" />";
+                echo " <input type=\"hidden\" name=\"action\" value=\"cancel\" />";
+                echo " <input type=\"submit\" value=\"$strcancel\" />";
+                echo "</form>";
+                echo "</td></tr></table>";
             }
             html_footer();
             break;
 
         case "edit":
             html_header($course, $wdir);
-            if (isset($text)) {
+            if (isset($text) and confirm_sesskey()) {
                 $fileptr = fopen($basedir.$file,"w");
                 fputs($fileptr, stripslashes($text));
                 fclose($fileptr);
                 displaydir($wdir);
                     
             } else {
-                $streditfile = get_string("edit", "", "<B>$file</B>");
+                $streditfile = get_string("edit", "", "<b>$file</b>");
                 $fileptr  = fopen($basedir.$file, "r");
                 $contents = fread($fileptr, filesize($basedir.$file));
                 fclose($fileptr);
@@ -325,24 +370,27 @@
 
                 print_heading("$streditfile");
 
-                echo "<TABLE><TR><TD COLSPAN=2>";
-                echo "<FORM ACTION=\"index.php\" METHOD=\"post\" NAME=\"form\">";
-                echo " <INPUT TYPE=hidden NAME=id VALUE=$id>";
-                echo " <INPUT TYPE=hidden NAME=wdir VALUE=\"$wdir\">";
-                echo " <INPUT TYPE=hidden NAME=file VALUE=\"$file\">";
-                echo " <INPUT TYPE=hidden NAME=action VALUE=edit>";
+                echo "<table><tr><td colspan=\"2\">";
+                echo "<form action=\"index.php\" method=\"post\" name=\"form\">";
+                echo ' <input type="hidden" name="choose" value="'.$choose.'">';
+                echo " <input type=\"hidden\" name=\"id\" value=\"$id\" />";
+                echo " <input type=\"hidden\" name=\"wdir\" value=\"$wdir\" />";
+                echo " <input type=\"hidden\" name=\"file\" value=\"$file\" />";
+                echo " <input type=\"hidden\" name=\"action\" value=\"edit\" />";
+                echo " <input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\" />";
                 print_textarea($usehtmleditor, 25, 80, 680, 400, "text", $contents);
-                echo "</TD></TR><TR><TD>";
-                echo " <INPUT TYPE=submit VALUE=\"".get_string("savechanges")."\">";
-                echo "</FORM>";
-                echo "</TD><TD>";
-                echo "<FORM ACTION=index.php METHOD=get>";
-                echo " <INPUT TYPE=hidden NAME=id VALUE=$id>";
-                echo " <INPUT TYPE=hidden NAME=wdir VALUE=$wdir>";
-                echo " <INPUT TYPE=hidden NAME=action VALUE=cancel>";
-                echo " <INPUT TYPE=submit VALUE=\"".get_string("cancel")."\">";
-                echo "</FORM>";
-                echo "</TD></TR></TABLE>";
+                echo "</td></tr><tr><td>";
+                echo " <input type=\"submit\" value=\"".get_string("savechanges")."\" />";
+                echo "</form>";
+                echo "</td><td>";
+                echo "<form action=\"index.php\" method=\"get\">";
+                echo ' <input type="hidden" name="choose" value="'.$choose.'">';
+                echo " <input type=\"hidden\" name=\"id\" value=\"$id\" />";
+                echo " <input type=\"hidden\" name=\"wdir\" value=\"$wdir\" />";
+                echo " <input type=\"hidden\" name=\"action\" value=\"cancel\" />";
+                echo " <input type=\"submit\" value=\"".get_string("cancel")."\" />";
+                echo "</form>";
+                echo "</td></tr></table>";
 
                 if ($usehtmleditor) { 
                     use_html_editor();
@@ -354,28 +402,19 @@
             break;
 
         case "zip":
-            if (!empty($name)) {
+            if (!empty($name) and confirm_sesskey()) {
                 html_header($course, $wdir);
                 $name = clean_filename($name);
-                if (empty($CFG->zip)) {    // Use built-in php-based zip function
-                    $files = array();
-                    foreach ($USER->filelist as $file) {
-                        $files[] = "$basedir/$file";
-                    }
-                    include_once("$CFG->libdir/pclzip/pclzip.lib.php");
-                    $archive = new PclZip("$basedir/$wdir/$name");
-                    if (($list = $archive->create($files,'',"$basedir/$wdir/")) == 0) {
-                        error($archive->errorInfo(true));
-                    }
-                } else {                   // Use external zip program
-                    $files = "";
-                    foreach ($USER->filelist as $file) {
-                        $files .= basename($file);
-                        $files .= " ";
-                    }
-                    $command = "cd $basedir/$wdir ; $CFG->zip -r $name $files";
-                    Exec($command);
+
+                $files = array();
+                foreach ($USER->filelist as $file) {
+                   $files[] = "$basedir/$file";
                 }
+
+                if (!zip_files($files,"$basedir/$wdir/$name")) {
+                    error(get_string("zipfileserror","error"));
+                }
+
                 clearfilelist();
                 displaydir($wdir);
                     
@@ -383,28 +422,31 @@
                 html_header($course, $wdir, "form.name");
 
                 if (setfilelist($_POST)) {
-                    echo "<P ALIGN=CENTER>".get_string("youareabouttocreatezip").":</P>";
+                    echo "<p align=\"center\">".get_string("youareabouttocreatezip").":</p>";
                     print_simple_box_start("center");
                     printfilelist($USER->filelist);
                     print_simple_box_end();
-                    echo "<BR>";
-                    echo "<P ALIGN=CENTER>".get_string("whattocallzip");
-                    echo "<TABLE><TR><TD>";
-                    echo "<FORM ACTION=index.php METHOD=post NAME=form>";
-                    echo " <INPUT TYPE=hidden NAME=id VALUE=$id>";
-                    echo " <INPUT TYPE=hidden NAME=wdir VALUE=\"$wdir\">";
-                    echo " <INPUT TYPE=hidden NAME=action VALUE=zip>";
-                    echo " <INPUT TYPE=text NAME=name SIZE=35 VALUE=\"new.zip\">";
-                    echo " <INPUT TYPE=submit VALUE=\"".get_string("createziparchive")."\">";
-                    echo "</FORM>";
-                    echo "</TD><TD>";
-                    echo "<FORM ACTION=index.php METHOD=get>";
-                    echo " <INPUT TYPE=hidden NAME=id VALUE=$id>";
-                    echo " <INPUT TYPE=hidden NAME=wdir VALUE=$wdir>";
-                    echo " <INPUT TYPE=hidden NAME=action VALUE=cancel>";
-                    echo " <INPUT TYPE=submit VALUE=\"".get_string("cancel")."\">";
-                    echo "</FORM>";
-                    echo "</TD></TR></TABLE>";
+                    echo "<br />";
+                    echo "<p align=\"center\">".get_string("whattocallzip");
+                    echo "<table><tr><td>";
+                    echo "<form action=\"index.php\" method=\"post\" name=\"form\">";
+                    echo ' <input type="hidden" name="choose" value="'.$choose.'">';
+                    echo " <input type=\"hidden\" name=\"id\" value=\"$id\" />";
+                    echo " <input type=\"hidden\" name=\"wdir\" value=\"$wdir\" />";
+                    echo " <input type=\"hidden\" name=\"action\" value=\"zip\" />";
+                    echo " <input type=\"text\" name=\"name\" size=\"35\" value=\"new.zip\" />";
+                    echo " <input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\" />";
+                    echo " <input type=\"submit\" value=\"".get_string("createziparchive")."\" />";
+                    echo "</form>";
+                    echo "</td><td>";
+                    echo "<form action=\"index.php\" method=\"get\">";
+                    echo ' <input type="hidden" name="choose" value="'.$choose.'">';
+                    echo " <input type=\"hidden\" name=\"id\" value=\"$id\" />";
+                    echo " <input type=\"hidden\" name=\"wdir\" value=\"$wdir\" />";
+                    echo " <input type=\"hidden\" name=\"action\" value=\"cancel\" />";
+                    echo " <input type=\"submit\" value=\"".get_string("cancel")."\" />";
+                    echo "</form>";
+                    echo "</td></tr></table>";
                 } else {
                     displaydir($wdir);
                     clearfilelist();
@@ -415,62 +457,26 @@
 
         case "unzip":
             html_header($course, $wdir);
-            if (!empty($file)) {
-                $strname = get_string("name");
-                $strsize = get_string("size");
-                $strmodified = get_string("modified");
-                $strstatus = get_string("status");
+            if (!empty($file) and confirm_sesskey()) {
                 $strok = get_string("ok");
                 $strunpacking = get_string("unpacking", "", $file);
 
-                echo "<P ALIGN=CENTER>$strunpacking:</P>";
+                echo "<p align=\"center\">$strunpacking:</p>";
 
                 $file = basename($file);
 
-                if (empty($CFG->unzip)) {    // Use built-in php-based unzip function
-                    include_once("$CFG->libdir/pclzip/pclzip.lib.php");
-                    $archive = new PclZip("$basedir/$wdir/$file");
-                    if (!$list = $archive->extract("$basedir/$wdir")) {
-                        error($archive->errorInfo(true));
-                    } else {  // print some output
-                        echo "<table cellpadding=\"4\" cellspacing=\"2\" border=\"0\" width=640>";
-                        echo "<tr><th align=left>$strname</th>";
-                        echo "<th align=right>$strsize</th>";
-                        echo "<th align=right>$strmodified</th>";
-                        echo "<th align=right>$strstatus</th></tr>";
-                        foreach ($list as $item) {
-                            echo "<tr>";
-                            $item['filename'] = str_replace("$basedir/$wdir/", "", $item['filename']);
-                            print_cell("left", $item['filename']);
-                            if (! $item['folder']) {
-                                print_cell("right", display_size($item['size']));
-                            } else {
-                                echo "<td>&nbsp;</td>";
-                            }
-                            $filedate  = userdate($item['mtime'], get_string("strftimedatetime"));
-                            print_cell("right", $filedate);
-                            print_cell("right", $item['status']);
-                            echo "</tr>";
-                        }
-                        echo "</table>";
-                    }
-                    
-                } else {                     // Use external unzip program
-                    print_simple_box_start("center");
-                    echo "<PRE>";
-                    $command = "cd $basedir/$wdir ; $CFG->unzip -o $file 2>&1";
-                    passthru($command);
-                    echo "</PRE>";
-                    print_simple_box_end();
+                if (!unzip_file("$basedir/$wdir/$file")) {
+                    error(get_string("unzipfileserror","error"));
                 }
 
-                echo "<CENTER><FORM ACTION=index.php METHOD=get>";
-                echo " <INPUT TYPE=hidden NAME=id VALUE=$id>";
-                echo " <INPUT TYPE=hidden NAME=wdir VALUE=$wdir>";
-                echo " <INPUT TYPE=hidden NAME=action VALUE=cancel>";
-                echo " <INPUT TYPE=submit VALUE=\"$strok\">";
-                echo "</FORM>";
-                echo "</CENTER>";
+                echo "<center><form action=\"index.php\" method=\"get\">";
+                echo ' <input type="hidden" name="choose" value="'.$choose.'">';
+                echo " <input type=\"hidden\" name=\"id\" value=\"$id\" />";
+                echo " <input type=\"hidden\" name=\"wdir\" value=\"$wdir\" />";
+                echo " <input type=\"hidden\" name=\"action\" value=\"cancel\" />";
+                echo " <input type=\"submit\" value=\"$strok\" />";
+                echo "</form>";
+                echo "</center>";
             } else {
                 displaydir($wdir);
             }
@@ -479,24 +485,24 @@
 
         case "listzip":
             html_header($course, $wdir);
-            if (!empty($file)) {
+            if (!empty($file) and confirm_sesskey()) {
                 $strname = get_string("name");
                 $strsize = get_string("size");
                 $strmodified = get_string("modified");
                 $strok = get_string("ok");
                 $strlistfiles = get_string("listfiles", "", $file);
 
-                echo "<P ALIGN=CENTER>$strlistfiles:</P>";
+                echo "<p align=\"center\">$strlistfiles:</p>";
                 $file = basename($file);
 
                 include_once("$CFG->libdir/pclzip/pclzip.lib.php");
-                $archive = new PclZip("$basedir/$wdir/$file");
-                if (!$list = $archive->listContent("$basedir/$wdir")) {
+                $archive = new PclZip(cleardoubleslashes("$basedir/$wdir/$file"));
+                if (!$list = $archive->listContent(cleardoubleslashes("$basedir/$wdir"))) {
                     notify($archive->errorInfo(true));
 
                 } else {
-                    echo "<table cellpadding=\"4\" cellspacing=\"2\" border=\"0\" width=640>";
-                    echo "<tr><th align=left>$strname</th><th align=right>$strsize</th><th align=right>$strmodified</th></tr>";
+                    echo "<table cellpadding=\"4\" cellspacing=\"2\" border=\"0\" width=\"640\">";
+                    echo "<tr><th align=\"left\">$strname</th><th align=\"right\">$strsize</th><th align=\"right\">$strmodified</th></tr>";
                     foreach ($list as $item) {
                         echo "<tr>";
                         print_cell("left", $item['filename']);
@@ -511,13 +517,14 @@
                     }
                     echo "</table>";
                 }
-                echo "<br><center><form action=index.php method=get>";
-                echo " <INPUT TYPE=hidden NAME=id VALUE=$id>";
-                echo " <INPUT TYPE=hidden NAME=wdir VALUE=$wdir>";
-                echo " <INPUT TYPE=hidden NAME=action VALUE=cancel>";
-                echo " <INPUT TYPE=submit VALUE=\"$strok\">";
-                echo "</FORM>";
-                echo "</CENTER>";
+                echo "<br /><center><form action=\"index.php\" method=\"get\">";
+                echo ' <input type="hidden" name="choose" value="'.$choose.'">';
+                echo " <input type=\"hidden\" name=\"id\" value=\"$id\" />";
+                echo " <input type=\"hidden\" name=\"wdir\" value=\"$wdir\" />";
+                echo " <input type=\"hidden\" name=\"action\" value=\"cancel\" />";
+                echo " <input type=\"submit\" value=\"$strok\" />";
+                echo "</form>";
+                echo "</center>";
             } else {
                 displaydir($wdir);
             }
@@ -526,16 +533,16 @@
 
         case "restore":
             html_header($course, $wdir);
-            if (!empty($file)) {
-                echo "<p align=center>".get_string("youaregoingtorestorefrom").":</p>";
+            if (!empty($file) and confirm_sesskey()) {
+                echo "<p align=\"center\">".get_string("youaregoingtorestorefrom").":</p>";
                 print_simple_box_start("center");
                 echo $file;
                 print_simple_box_end();
                 echo "<br />";
                 echo "<p align=center>".get_string("areyousuretorestorethisinfo")."</p>";
-                $restore_path = "../backup/restore.php";
+                $restore_path = "$CFG->wwwroot/backup/restore.php";
                 notice_yesno (get_string("areyousuretorestorethis"),
-                                $restore_path."?id=".$id."&file=".$id.$wdir."/".$file,
+                                $restore_path."?id=".$id."&file=".cleardoubleslashes($id.$wdir."/".$file),
                                 "index.php?id=$id&wdir=$wdir&action=cancel");
             } else {
                 displaydir($wdir);
@@ -556,7 +563,6 @@
 
 /// FILE FUNCTIONS ///////////////////////////////////////////////////////////
 
-
 function fulldelete($location) { 
     if (is_dir($location)) {
         $currdir = opendir($location);
@@ -599,7 +605,10 @@ function setfilelist($VARS) {
     foreach ($VARS as $key => $val) {
         if (substr($key,0,4) == "file") {
             $count++;
-            $USER->filelist[] = rawurldecode($val);
+            $val = rawurldecode($val);
+            if (!detect_munged_arguments($val, 0)) {
+                $USER->filelist[] = $val;
+            }
         }
     }
     return $count;
@@ -618,7 +627,7 @@ function printfilelist($filelist) {
 
     foreach ($filelist as $file) {
         if (is_dir($basedir.$file)) {
-            echo "<img src=\"$CFG->pixpath/f/folder.gif\" height=16 width=16> $file<br>";
+            echo "<img src=\"$CFG->pixpath/f/folder.gif\" height=\"16\" width=\"16\" alt=\"\" /> $file<br />";
             $subfilelist = array();
             $currdir = opendir($basedir.$file);
             while ($subfile = readdir($currdir)) { 
@@ -630,18 +639,18 @@ function printfilelist($filelist) {
 
         } else { 
             $icon = mimeinfo("icon", $file);
-            echo "<img src=\"$CFG->pixpath/f/$icon\"  height=16 width=16> $file<br>";
+            echo "<img src=\"$CFG->pixpath/f/$icon\"  height=\"16\" width=\"16\" alt=\"\" /> $file<br />";
         }
     }
 }
 
 
 function print_cell($alignment="center", $text="&nbsp;") {
-    echo "<TD ALIGN=\"$alignment\" NOWRAP>";
-    echo "<FONT SIZE=\"-1\" FACE=\"Arial, Helvetica\">";
+    echo "<td align=\"$alignment\" nowrap=\"nowrap\">";
+    echo "<font size=\"-1\" face=\"Arial, Helvetica\">";
     echo "$text";
-    echo "</FONT>";
-    echo "</TD>\n";
+    echo "</font>";
+    echo "</td>\n";
 }
 
 function displaydir ($wdir) {
@@ -650,6 +659,7 @@ function displaydir ($wdir) {
     global $basedir;
     global $id;
     global $USER, $CFG;
+    global $choose;
 
     $fullpath = $basedir.$wdir;
 
@@ -683,18 +693,20 @@ function displaydir ($wdir) {
     $strunzip  = get_string("unzip");
     $strlist   = get_string("list");
     $strrestore= get_string("restore");
+    $strchoose   = get_string("choose");
 
 
-    echo "<FORM ACTION=\"index.php\" METHOD=post NAME=dirform>";
-    echo "<HR WIDTH=640 ALIGN=CENTER NOSHADE SIZE=1>";
-    echo "<TABLE BORDER=0 cellspacing=2 cellpadding=2 width=640>";    
-    echo "<TR>";
-    echo "<TH WIDTH=5></TH>";
-    echo "<TH ALIGN=left>$strname</TH>";
-    echo "<TH ALIGN=right>$strsize</TH>";
-    echo "<TH ALIGN=right>$strmodified</TH>";
-    echo "<TH ALIGN=right>$straction</TH>";
-    echo "</TR>\n";
+    echo "<form action=\"index.php\" method=\"post\" name=\"dirform\">";
+    echo '<input type="hidden" name="choose" value="'.$choose.'">';
+    echo "<hr width=\"640\" align=\"center\" noshade=\"noshade\" size=\"1\" />";
+    echo "<table border=\"0\" cellspacing=\"2\" cellpadding=\"2\" width=\"640\">";    
+    echo "<tr>";
+    echo "<th width=\"5\"></th>";
+    echo "<th align=\"left\">$strname</th>";
+    echo "<th align=\"right\">$strsize</th>";
+    echo "<th align=\"right\">$strmodified</th>";
+    echo "<th align=\"right\">$straction</th>";
+    echo "</tr>\n";
 
     if ($wdir == "/") {
         $wdir = "";
@@ -714,15 +726,15 @@ function displaydir ($wdir) {
             $filesize = display_size(get_directory_size("$fullpath/$dir"));
             $filedate = userdate(filemtime($filename), "%d %b %Y, %I:%M %p");
     
-            echo "<TR>";
+            echo "<tr>";
 
-            print_cell("center", "<INPUT TYPE=checkbox NAME=\"file$count\" VALUE=\"$fileurl\">");
-            print_cell("left", "<A HREF=\"index.php?id=$id&wdir=$fileurl\"><IMG SRC=\"$CFG->pixpath/f/folder.gif\" HEIGHT=16 WIDTH=16 BORDER=0 ALT=\"Folder\"></A> <A HREF=\"index.php?id=$id&wdir=$fileurl\">".htmlspecialchars($dir)."</A>");
+            print_cell("center", "<input type=\"checkbox\" name=\"file$count\" value=\"$fileurl\" />");
+            print_cell("left", "<a href=\"index.php?id=$id&amp;wdir=$fileurl&amp;choose=$choose\"><img src=\"$CFG->pixpath/f/folder.gif\" height=\"16\" width=\"16\" border=\"0\" alt=\"Folder\" /></a> <a href=\"index.php?id=$id&amp;wdir=$fileurl&amp;choose=$choose\">".htmlspecialchars($dir)."</a>");
             print_cell("right", "<b>$filesize</b>");
             print_cell("right", $filedate);
-            print_cell("right", "<A HREF=\"index.php?id=$id&wdir=$wdir&file=$filesafe&action=rename\">$strrename</A>");
+            print_cell("right", "<a href=\"index.php?id=$id&amp;wdir=$wdir&amp;file=$filesafe&amp;action=rename&amp;choose=$choose\">$strrename</a>");
     
-            echo "</TR>";
+            echo "</tr>";
         }
     }
 
@@ -740,17 +752,23 @@ function displaydir ($wdir) {
             $fileurlsafe = rawurlencode($fileurl);
             $filedate    = userdate(filemtime($filename), "%d %b %Y, %I:%M %p");
 
+            if (substr($fileurl,0,1) == '/') {
+                $selectfile = substr($fileurl,1);
+            } else {
+                $selectfile = $fileurl;
+            }
+
             echo "<tr>";
 
-            print_cell("center", "<INPUT TYPE=checkbox NAME=\"file$count\" VALUE=\"$fileurl\">");
-            echo "<td align=left nowrap>";
+            print_cell("center", "<input type=\"checkbox\" name=\"file$count\" value=\"$fileurl\" />");
+            echo "<td align=\"left\" nowrap=\"nowrap\">";
             if ($CFG->slasharguments) {
                 $ffurl = "/file.php/$id$fileurl";
             } else {
                 $ffurl = "/file.php?file=/$id$fileurl";
             }
             link_to_popup_window ($ffurl, "display", 
-                                  "<IMG SRC=\"$CFG->pixpath/f/$icon\" HEIGHT=16 WIDTH=16 BORDER=0 ALT=\"File\">", 
+                                  "<img src=\"$CFG->pixpath/f/$icon\" height=\"16\" width=\"16\" border=\"0\" alt=\"File\" />", 
                                   480, 640);
             echo "<font size=\"-1\" face=\"Arial, Helvetica\">";
             link_to_popup_window ($ffurl, "display", 
@@ -761,33 +779,41 @@ function displaydir ($wdir) {
             $file_size = filesize($filename);
             print_cell("right", display_size($file_size));
             print_cell("right", $filedate);
-            if ($icon == "text.gif" || $icon == "html.gif") {
-                $edittext = "<a href=\"index.php?id=$id&wdir=$wdir&file=$fileurl&action=edit\">$stredit</a>";
-            } else if ($icon == "zip.gif") {
-                $edittext = "<a href=\"index.php?id=$id&wdir=$wdir&file=$fileurl&action=unzip\">$strunzip</a>&nbsp;";
-                $edittext .= "<a href=\"index.php?id=$id&wdir=$wdir&file=$fileurl&action=listzip\">$strlist</a> ";
-                if (!empty($CFG->backup_version) and isteacheredit($id)) {
-                    $edittext .= "<a href=\"index.php?id=$id&wdir=$wdir&file=$filesafe&action=restore\">$strrestore</a> ";
-                }
+
+            if ($choose) {
+                $edittext = "<b><a onMouseDown=\"return set_value('$selectfile')\" href=\"\">$strchoose</a></b>&nbsp;";
             } else {
-                $edittext = "";
+                $edittext = '';
             }
-            print_cell("right", "$edittext <A HREF=\"index.php?id=$id&wdir=$wdir&file=$filesafe&action=rename\">$strrename</A>");
+
+
+            if ($icon == "text.gif" || $icon == "html.gif") {
+                $edittext .= "<a href=\"index.php?id=$id&amp;wdir=$wdir&amp;file=$fileurl&amp;action=edit&amp;choose=$choose\">$stredit</a>";
+            } else if ($icon == "zip.gif") {
+                $edittext .= "<a href=\"index.php?id=$id&amp;wdir=$wdir&amp;file=$fileurl&amp;action=unzip&amp;sesskey=$USER->sesskey&amp;choose=$choose\">$strunzip</a>&nbsp;";
+                $edittext .= "<a href=\"index.php?id=$id&amp;wdir=$wdir&amp;file=$fileurl&amp;action=listzip&amp;sesskey=$USER->sesskey&amp;choose=$choose\">$strlist</a> ";
+                if (!empty($CFG->backup_version) and isteacheredit($id)) {
+                    $edittext .= "<a href=\"index.php?id=$id&amp;wdir=$wdir&amp;file=$filesafe&amp;action=restore&amp;sesskey=$USER->sesskey&amp;choose=$choose\">$strrestore</a> ";
+                }
+            }
+
+            print_cell("right", "$edittext <a href=\"index.php?id=$id&amp;wdir=$wdir&amp;file=$filesafe&amp;action=rename&amp;choose=$choose\">$strrename</a>");
     
-            echo "</TR>";
+            echo "</tr>";
         }
     }
-    echo "</TABLE>";
-    echo "<hr width=640 align=center noshade size=1>";
+    echo "</table>";
+    echo "<hr width=\"640\" align=\"center\" noshade=\"noshade\" size=\"1\" />";
 
     if (empty($wdir)) {
         $wdir = "/";
     }
 
-    echo "<TABLE BORDER=0 cellspacing=2 cellpadding=2 width=640>";    
-    echo "<TR><TD>";
-    echo "<INPUT TYPE=hidden NAME=id VALUE=\"$id\">";
-    echo "<INPUT TYPE=hidden NAME=wdir VALUE=\"$wdir\"> ";
+    echo "<table border=\"0\" cellspacing=\"2\" cellpadding=\"2\" width=\"640\">";    
+    echo "<tr><td>";
+    echo "<input type=\"hidden\" name=\"id\" value=\"$id\" />";
+    echo "<input type=\"hidden\" name=\"wdir\" value=\"$wdir\" /> ";
+    echo "<input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\" />";
     $options = array (
                    "move" => "$strmovetoanotherfolder",
                    "delete" => "$strdeletecompletely",
@@ -797,34 +823,37 @@ function displaydir ($wdir) {
         choose_from_menu ($options, "action", "", "$strwithchosenfiles...", "javascript:document.dirform.submit()");
     }
 
-    echo "</FORM>";
-    echo "<TD ALIGN=center>";
+    echo "</form>";
+    echo "<td align=\"center\">";
     if (!empty($USER->fileop) and ($USER->fileop == "move") and ($USER->filesource <> $wdir)) {
-        echo "<FORM ACTION=index.php METHOD=get>";
-        echo " <INPUT TYPE=hidden NAME=id VALUE=$id>";
-        echo " <INPUT TYPE=hidden NAME=wdir VALUE=\"$wdir\">";
-        echo " <INPUT TYPE=hidden NAME=action VALUE=paste>";
-        echo " <INPUT TYPE=submit VALUE=\"$strmovefilestohere\">";
-        echo "</FORM>";
+        echo "<form action=\"index.php\" method=\"get\">";
+        echo ' <input type="hidden" name="choose" value="'.$choose.'">';
+        echo " <input type=\"hidden\" name=\"id\" value=\"$id\" />";
+        echo " <input type=\"hidden\" name=\"wdir\" value=\"$wdir\" />";
+        echo " <input type=\"hidden\" name=\"action\" value=\"paste\" />";
+        echo " <input type=\"hidden\" name=\"sesskey\" value=\"$USER->sesskey\" />";
+        echo " <input type=\"submit\" value=\"$strmovefilestohere\" />";
+        echo "</form>";
     }
-    echo "<TD ALIGN=right>";
-        echo "<FORM ACTION=index.php METHOD=get>";
-        echo " <INPUT TYPE=hidden NAME=id VALUE=$id>";
-        echo " <INPUT TYPE=hidden NAME=wdir VALUE=\"$wdir\">";
-        echo " <INPUT TYPE=hidden NAME=action VALUE=mkdir>";
-        echo " <INPUT TYPE=submit VALUE=\"$strmakeafolder\">";
-        echo "</FORM>";
-    echo "</TD>";
-    echo "<TD ALIGN=right>";
-        echo "<FORM ACTION=index.php METHOD=get>";
-        echo " <INPUT TYPE=hidden NAME=id VALUE=$id>";
-        echo " <INPUT TYPE=hidden NAME=wdir VALUE=\"$wdir\">";
-        echo " <INPUT TYPE=hidden NAME=action VALUE=upload>";
-        echo " <INPUT TYPE=submit VALUE=\"$struploadafile\">";
-        echo "</FORM>";
-    echo "</TD></TR>";
-    echo "</TABLE>";
-    echo "<HR WIDTH=640 ALIGN=CENTER NOSHADE SIZE=1>";
+    echo "<td align=\"right\">";
+        echo "<form action=\"index.php\" method=\"get\">";
+        echo ' <input type="hidden" name="choose" value="'.$choose.'">';
+        echo " <input type=\"hidden\" name=\"id\" value=\"$id\" />";
+        echo " <input type=\"hidden\" name=\"wdir\" value=\"$wdir\" />";
+        echo " <input type=\"hidden\" name=\"action\" value=\"mkdir\" />";
+        echo " <input type=\"submit\" value=\"$strmakeafolder\" />";
+        echo "</form>";
+    echo "</td>";
+    echo "<td align=\"right\">";
+        echo "<form action=\"index.php\" method=\"get\">";
+        echo " <input type=\"hidden\" name=\"id\" value=\"$id\" />";
+        echo " <input type=\"hidden\" name=\"wdir\" value=\"$wdir\" />";
+        echo " <input type=\"hidden\" name=\"action\" value=\"upload\" />";
+        echo " <input type=\"submit\" value=\"$struploadafile\" />";
+        echo "</form>";
+    echo "</td></tr>";
+    echo "</table>";
+    echo "<hr width=\"640\" align=\"center\" noshade=\"noshade\" size=\"1\" />";
 
 }
 

filter/algebra/pix.php

@@ -11,6 +11,9 @@
     $CFG->texfilterdir     = "filter/tex";
     $CFG->algebraimagedir  = "filter/algebra";
 
+    $cmd = '';      // Initialise these variables
+    $status = '';
+
     error_reporting(E_ALL);
 
     $lifetime = 86400;

filter/multilang/filter.php

@@ -103,7 +103,7 @@ class XMLParser {
     $this->texts['en'] = $data;
 
     /// Create parser
-    $xml_parser = xml_parser_create(); 
+    $xml_parser = xml_parser_create(''); 
     xml_set_object($xml_parser, &$this); 
     xml_set_element_handler($xml_parser, 'startElement', 'endElement'); 
     xml_set_character_data_handler($xml_parser, 'characterData'); 

filter/tex/pix.php

@@ -10,6 +10,9 @@
     $CFG->texfilterdir = "filter/tex";
     $CFG->teximagedir = "filter/tex";
 
+    $cmd = '';      // Initialise these variables
+    $status = '';
+
     error_reporting(E_ALL);
 
     $lifetime = 86400;

lang/af/help/mods.html

@@ -1,66 +1 @@
-<P ALIGN=CENTER><B>Aktiwiteit Modules</B></P>
-
-<P>Moodle bevat 'n wye verskeidenheid aktiwiteits modules wat gebruik kan word
-om enige tipe kursus te bou.</P>
-
-<P><IMG VALIGN=absmiddle SRC="<?php echo $CFG->wwwroot?>/mod/forum/icon.gif">&nbsp;<B>Forums</B></P>
-<UL>
-<P>Dit kan die belangrikste aktiwiteit wees - dit is hier wat die besprekings
-plaasvind. 
-   Forums kan op verskillende maniere gestruktureer word. Mede gebruikers van
-die forum kan elke posstuk evalueer. Posstukke kan op verskillende maniere
-gesien word, en kan aangehegte dokumente bevat. Deur op 'n forum in te skryf,
-sal deelnemers alle posstukke op die forum ontvang in hulle email. 'n
-Onderwyser kan alle studente forseer om ingeskryf te wees op 'n forum.
-</UL>
-
-<P><IMG VALIGN=absmiddle SRC="<?php echo $CFG->wwwroot?>/mod/journal/icon.gif">&nbsp;<B>Joernale</B></P>
-<UL>
-<P>Die module kan 'n belangrike reflektiewe aktiwiteit wees. Die onderwyser kan
-studente vra om oor 'n spesifieke onderwerp te skryf. Studente kan aan hulle
-antwoord werk of redigeer oor 'n sekere tydperk. Die antwoord is privaat en kan
-slegs deur die onderwyser gesien word, wat kan terugvoer lewer en 'n punt gee
-vir die joernaal inskrywing. Een joernaal aktiwiteit per week is gewoonlik&nbsp;
-'n goeie idee.</P>
-</UL>
-
-<P><IMG VALIGN=absmiddle SRC="<?php echo $CFG->wwwroot?>/mod/resource/icon.gif">&nbsp;<B>Hulpbronne</B></P>
-<UL>
-<P>Hulpbronne is inhoud: inligting wat die onderwyser by die kursus wil voeg. Dit kan lêers wees op die bediener; bladsye wat in Moodle geredigeer is;
-of eksterne web bladsye wat deel gemaak is van die kursus.</P>
-</UL>
-
-<P><IMG VALIGN=absmiddle SRC="<?php echo $CFG->wwwroot?>/mod/assignment/icon.gif">&nbsp;<B>Opdragte</B></P>
-<UL>
-<P>Onderwysers kan opdragte gee wat deur die studente voorberei moet word (enige
-formaat) en inlewer deur dit op die bediener te laai. Tipiese opdragte is opstelle, projekte, verslae ens. Die module het fasiliteite om die opdragte te
-merk.</P>
-</UL>
-
-<P><IMG VALIGN=absmiddle SRC="<?php echo $CFG->wwwroot?>/mod/quiz/icon.gif">&nbsp;<B>Toetse</B></P>
-<UL>
-<P>Die module laat die onderwyser toe om toetse op te stel, dit kan meervoudige
-keuse vrae, waar/vals, en kort antwoord vrae wees. Die vrae word in kategorieë
-in 'n databasis gehou,die vrae kan weer gebruik word in die kursus of ander
-kursusse. Toetse kan verskeie pogings toelaat. Elke poging word outomaties
-gemerk, die onderwyser kan terugvoer lewer of die korrekte antwoord wys. Die
-module het fasiliteite om die toetse te merk.</P>
-</UL>
-
-<P><IMG VALIGN=absmiddle SRC="<?php echo $CFG->wwwroot?>/mod/choice/icon.gif">&nbsp;<B>Keuses</B></P>
-<UL>
-<P>Die keuse aktiwiteit is eenvoudig - die onderwyser vra 'n vraag en
-spesifiseer 'n paar antwoorde as terugvoer. Dit laat die klas toe om te kies om
-in 'n sekere rigting in te gaan; of om toestemming te gee vir iets.
-</UL>
-
-<P><IMG VALIGN=absmiddle SRC="<?php echo $CFG->wwwroot?>/mod/survey/icon.gif">&nbsp;<B>Menings
-Opnames</B></P>
-<UL>
-<P>Die Opname module bevat 'n paar opname instrumente wat handig is om dink werk
-te stimuleer of om 'n opname in 'n gekoppelde omgewing te maak . Onderwysers kan
-dit gebruik om data van hul studente bymekaar te maak wat hulle sal help om meer
-te leer van hulle klas en onderwys metodes.</P>
-</UL>
-
-
+<P ALIGN=CENTER><B>Aktiwiteit Modules</B></P>



<P>Moodle bevat 'n wye verskeidenheid aktiwiteits modules wat gebruik kan word

om enige tipe kursus te bou.</P>



<P><IMG VALIGN=absmiddle SRC="<?php echo $CFG->wwwroot?>/mod/forum/icon.gif" alt="" />&nbsp;<B>Forums</B></P>

<UL>

<P>Dit kan die belangrikste aktiwiteit wees - dit is hier wat die besprekings

plaasvind. 

   Forums kan op verskillende maniere gestruktureer word. Mede gebruikers van

die forum kan elke posstuk evalueer. Posstukke kan op verskillende maniere

gesien word, en kan aangehegte dokumente bevat. Deur op 'n forum in te skryf,

sal deelnemers alle posstukke op die forum ontvang in hulle email. 'n

Onderwyser kan alle studente forseer om ingeskryf te wees op 'n forum.

</UL>



<P><IMG VALIGN=absmiddle SRC="<?php echo $CFG->wwwroot?>/mod/journal/icon.gif" alt="" />&nbsp;<B>Joernale</B></P>

<UL>

<P>Die module kan 'n belangrike reflektiewe aktiwiteit wees. Die onderwyser kan

studente vra om oor 'n spesifieke onderwerp te skryf. Studente kan aan hulle

antwoord werk of redigeer oor 'n sekere tydperk. Die antwoord is privaat en kan

slegs deur die onderwyser gesien word, wat kan terugvoer lewer en 'n punt gee

vir die joernaal inskrywing. Een joernaal aktiwiteit per week is gewoonlik&nbsp;

'n goeie idee.</P>

</UL>



<P><IMG VALIGN=absmiddle SRC="<?php echo $CFG->wwwroot?>/mod/resource/icon.gif" alt="" />&nbsp;<B>Hulpbronne</B></P>

<UL>

<P>Hulpbronne is inhoud: inligting wat die onderwyser by die kursus wil voeg. Dit kan lêers wees op die bediener; bladsye wat in Moodle geredigeer is;

of eksterne web bladsye wat deel gemaak is van die kursus.</P>

</UL>



<P><IMG VALIGN=absmiddle SRC="<?php echo $CFG->wwwroot?>/mod/assignment/icon.gif" alt="" />&nbsp;<B>Opdragte</B></P>

<UL>

<P>Onderwysers kan opdragte gee wat deur die studente voorberei moet word (enige

formaat) en inlewer deur dit op die bediener te laai. Tipiese opdragte is opstelle, projekte, verslae ens. Die module het fasiliteite om die opdragte te

merk.</P>

</UL>



<P><IMG VALIGN=absmiddle SRC="<?php echo $CFG->wwwroot?>/mod/quiz/icon.gif" alt="" />&nbsp;<B>Toetse</B></P>

<UL>

<P>Die module laat die onderwyser toe om toetse op te stel, dit kan meervoudige

keuse vrae, waar/vals, en kort antwoord vrae wees. Die vrae word in kategorieë

in 'n databasis gehou,die vrae kan weer gebruik word in die kursus of ander

kursusse. Toetse kan verskeie pogings toelaat. Elke poging word outomaties

gemerk, die onderwyser kan terugvoer lewer of die korrekte antwoord wys. Die

module het fasiliteite om die toetse te merk.</P>

</UL>



<P><IMG VALIGN=absmiddle SRC="<?php echo $CFG->wwwroot?>/mod/choice/icon.gif" alt="" />&nbsp;<B>Keuses</B></P>

<UL>

<P>Die keuse aktiwiteit is eenvoudig - die onderwyser vra 'n vraag en

spesifiseer 'n paar antwoorde as terugvoer. Dit laat die klas toe om te kies om

in 'n sekere rigting in te gaan; of om toestemming te gee vir iets.

</UL>



<P><IMG VALIGN=absmiddle SRC="<?php echo $CFG->wwwroot?>/mod/survey/icon.gif" alt="" />&nbsp;<B>Menings

Opnames</B></P>

<UL>

<P>Die Opname module bevat 'n paar opname instrumente wat handig is om dink werk

te stimuleer of om 'n opname in 'n gekoppelde omgewing te maak . Onderwysers kan

dit gebruik om data van hul studente bymekaar te maak wat hulle sal help om meer

te leer van hulle klas en onderwys metodes.</P>

</UL>

lang/af/moodle.php

@@ -245,8 +245,8 @@ $string['emailpasswordconfirmsent'] = "'n Email is veronderstel om gestuur te we
 $string['emailpasswordsent'] = "Dankie dat jy die verandering van jou wagwoord bevestig het. <p>'n Email wat jou nuwe wagwoord bevat is gestuur na <b>\$a->email</b>. <p>Die nuwe wagwoord was outomaties gegenereer - jy kan jou wagwoord verander na iets wat makliker is om te onthou. <a href=\$a->link> Verander jou wagwoord hier</a>";
 $string['enrolmentconfirmation'] = "Jy gaan jou self inskryf as 'n lid van die kursus. <br/> Is jy seker jy wil dit doen?";
 $string['enrolmentkey'] = "Registrasie sleutel";
-$string['enrolmentkeyfrom'] = "Die kursus benodig 'n 'registrasie sleutel' - 'n eenmalige<BR> wagwoord wat voorsien moet word deur \$a";
-$string['enrolmentkeyhint'] = "Die registrasie sleutel is nie korrek nie, probeer aseblief weer<BR> (Leidraad: dit begin met '\$a')";
+$string['enrolmentkeyfrom'] = "Die kursus benodig 'n 'registrasie sleutel' - 'n eenmalige<br /> wagwoord wat voorsien moet word deur \$a";
+$string['enrolmentkeyhint'] = "Die registrasie sleutel is nie korrek nie, probeer aseblief weer<br /> (Leidraad: dit begin met '\$a')";
 $string['entercourse'] = "Klik om by die kursus in te gaan";
 $string['enteremailaddress'] = "Sleutel jou email adres in om jou wagwoord te verander,jou nuwe wagwoord sal na jou gestuur word via email.";
 $string['error'] = "Fout";
@@ -553,8 +553,8 @@ $string['searchagain'] = "Soek weer";
 $string['searchcourses'] = "Soek deur kursusse";
 $string['searchhelp'] = "Jy kan vir meer as een woord op 'n slag soek.<p>
 woord: soek vir enige bypassende woord in die teks. 
-<br>+woord: soek slegs vir woorde wat presies die selfde is.
-<br>-woord: moenie resultate insluit waarin die woord is nie.";
+<br />+woord: soek slegs vir woorde wat presies die selfde is.
+<br />-woord: moenie resultate insluit waarin die woord is nie.";
 $string['searchresults'] = "Soektog resultate";
 $string['sec'] = "sekonde";
 $string['secs'] = "sekondes";

lang/af/quiz.php

@@ -69,11 +69,11 @@ $string['filloutoneanswer'] = "Jy moet een moontlike antwoord kies.  Antwoorde w
 $string['filloutthreequestions'] = "Jy moet ten minste drie keuses maak.  Antwoorde wat oop gelos word,word nie gemerk nie.";
 $string['fillouttwochoices'] = "Jy moet ten minste twee keuses maak.  Antwoorde wat oop gelos word,word nie gemerk nie.";
 $string['fractionsaddwrong'] = "Die positiewe punte wat jy gekies het tel nie op tot 100%% nie
-<BR>Dit tel op tot \$a%%
-<BR>Wil jy terug gaan en die vraag reg maak?";
+<br />Dit tel op tot \$a%%
+<br />Wil jy terug gaan en die vraag reg maak?";
 $string['fractionsnomax'] = "Een van die antwoorde moet 100%% wees, sodat dit
-<BR>moontlik is om vol punte te kry vir die vraag.
-<BR>Wil jy terug gaan en die vraag reg maak?";
+<br />moontlik is om vol punte te kry vir die vraag.
+<br />Wil jy terug gaan en die vraag reg maak?";
 $string['gradeaverage'] = "Gemiddelde punt";
 $string['gradehighest'] = "Hoogste punt";
 $string['grademethod'] = "Graderings metode";
@@ -99,7 +99,7 @@ $string['nomoreattempts'] = "Nog pogings word nie toegelaat nie";
 $string['noquestions'] = "Geen vrae is al by gesit nie";
 $string['noreview'] = "Jy word nie toegelaat om die toets te hersien nie";
 $string['noreviewuntil'] = "Jy mag eers die toets hersien na \$a";
-$string['notenoughsubquestions'] = "Nie genoeg sub-vrae gedefinieer nie!<br>
+$string['notenoughsubquestions'] = "Nie genoeg sub-vrae gedefinieer nie!<br />
 Wil jy terug gaan en die vraag reg maak?";
 $string['numerical'] = "Numeries";
 $string['publish'] = "Publiseer";

lang/af/workshop.php

@@ -93,11 +93,11 @@ $string['newsubmissions'] = "Nuwe ingehandige werk";
 $string['noassessmentsdone'] = "Geen Evaluering gedoen";
 $string['nosubmissionsavailableforassessment'] = "Geen ingehandigde werk beskikbaar vir evaluering";
 $string['notavailable'] = "Nie beskikbaar";
-$string['noteonassessmentelements'] = "Evaluering word ingedeel in 'n paar 'Evaluerings Elemente'.<BR>
-	Dit maak evaluering makliker en meer konstant. As onderwyser moet jy die Elemente<BR>
-	byvoeg voordat jy die opdrag beskikbaar stel aan die studente. Dit word gedoen deur<BR>
-	op die opdrag in die kursus te klik, as daar geen elemente is nie sal jy gevra word<BR>
-	om hulle by te sit. Jy kan die aantal elemente redigeer deur die 'Redigeer Evaluasie' skerm,<BR>
+$string['noteonassessmentelements'] = "Evaluering word ingedeel in 'n paar 'Evaluerings Elemente'.<br />
+	Dit maak evaluering makliker en meer konstant. As onderwyser moet jy die Elemente<br />
+	byvoeg voordat jy die opdrag beskikbaar stel aan die studente. Dit word gedoen deur<br />
+	op die opdrag in die kursus te klik, as daar geen elemente is nie sal jy gevra word<br />
+	om hulle by te sit. Jy kan die aantal elemente redigeer deur die 'Redigeer Evaluasie' skerm,<br />
 	die elemente kan bygesit word deur die  'Bestuur Evaluasie skerm. ";
 $string['notgraded'] = "Nie gemerk nie";
 $string['notitlegiven'] = "Geen title gegee";
@@ -172,7 +172,7 @@ $string['verypoor'] = "Baie Sleg";
 $string['view'] = "Vertoon";
 $string['viewassessmentofteacher'] = "Vertoon evaluasie van \$a";
 $string['viewotherassessments'] = "Vertoon ander evaluasies";
-$string['warningonamendingelements'] = "WAARSKUWING:Daar is ingehandigde evaluasies. <BR>Moenie die aantal Evaluasie Elemente, Skaal Tipes of Element Gewig verander nie.";
+$string['warningonamendingelements'] = "WAARSKUWING:Daar is ingehandigde evaluasies. <br />Moenie die aantal Evaluasie Elemente, Skaal Tipes of Element Gewig verander nie.";
 $string['weightederrorcount'] = "Geweegde Fouttelling : \$a";
 $string['weightforbias'] = "Gewig van afronding";
 $string['weightforgradingofassessments'] = "Gewig vir evaluasies";

lang/ar/dialogue.php

@@ -9,7 +9,7 @@ $string['allowmultiple'] = '
 $string['allowstudentdialogues'] = 'ÇáÓãÇÍ ÈÍæÇÑÇÊ ØÇáÈ -  áØÇáÈ';
 $string['close'] = 'ÇÛáÇÞ';
 $string['closed'] = 'ãÛáÞ';
-$string['confirmclosure'] = 'أنت على وشك أن تغلق حوارًا مع  $a. الحوارات المغلقة لا يمكن إعادت فتحها ثانياً . إذا أغلقت هذا الحوار يمكنك أن تشاهده لكنّ لن تستطيع الاضافة علية, و سيجب عليك أن تبدأ حوار آخر للإستمرار& quot، والتحدث&quot، هذا الشّخص . .</ br /><br>هل أنت متأكّد أنّك تريد إغلاق هذا الحوار ؟';
+$string['confirmclosure'] = 'أنت على وشك أن تغلق حوارًا مع  $a. الحوارات المغلقة لا يمكن إعادت فتحها ثانياً . إذا أغلقت هذا الحوار يمكنك أن تشاهده لكنّ لن تستطيع الاضافة علية, و سيجب عليك أن تبدأ حوار آخر للإستمرار& quot، والتحدث&quot، هذا الشّخص . .</ br /><br />هل أنت متأكّد أنّك تريد إغلاق هذا الحوار ؟';
 $string['deleteafter'] = 'ÇÍÐÝ ÇáÍæÇÑÇÊ ÇáãÛáÞÉ ÈÚÏ (ÇíÇã)';
 $string['dialogueclosed'] = 'ÍæÇÑ ãÛáÞ';
 $string['dialogueintro'] = 'ãÞÏãÉ ÍæÇÑ';

lang/ar/editor.php

@@ -4,7 +4,7 @@
 
 $string['about'] = 'Íæá åÐÇ ÇáãÍÑÑ';
 $string['absbottom'] = 'ÃÓÝá ÇáäÕ';
-$string['absmiddle'] = 'æÓØ ÇáÓØÑ';
+$string['middle'] = 'æÓØ ÇáÓØÑ';
 $string['address'] = 'ÚäæÇä';
 $string['alignment'] = 'ãÍÇÐÇÉ';
 $string['alternatetext'] = 'ÇáäÕ ÇáÈÏíá';

lang/ar/glossary.php

@@ -84,10 +84,10 @@ $string['entryexported'] = '
 $string['entryishidden'] = '(هذا المصطلح مخفية حالياً)';
 $string['entryleveldefaultsettings'] = 'اإعداد الإفتراضي للمصطلح';
 $string['entryusedynalink'] = 'يجب ربط هذا المصطلح آليا';
-$string['explainaddentry'] = 'أضف مصطلح جديدة إلى المسرد الحالي.<br> تعبئة حقلي المفهوم و التعريف إجباري';
+$string['explainaddentry'] = 'أضف مصطلح جديدة إلى المسرد الحالي.<br /> تعبئة حقلي المفهوم و التعريف إجباري';
 $string['explainall'] = 'أعرض جميع المصطلاحات في صفحة واحدة';
 $string['explainalphabet'] = 'استعرض المسرد باستخدام الفهرست';
-$string['explainexport'] = 'لقد تم إنشاء ملف.<br> قم بتنزيلة واحتفظ به في مكان أمن. تسطيع استيراده إلى هذا المنهج الدراسي أو غيره متى شئت ';
+$string['explainexport'] = 'لقد تم إنشاء ملف.<br /> قم بتنزيلة واحتفظ به في مكان أمن. تسطيع استيراده إلى هذا المنهج الدراسي أو غيره متى شئت ';
 $string['explainimport'] = 'يجب عليك تحديدالملف المستورد وتعريف معايير عملية الإستيراد.<p> سلم طلبك وقم بمراجعة النتائج.';
 $string['explainspecial'] = 'اعرض المصطلاحات التى لا تنتم إلى حرف';
 $string['exportedentry'] = 'تم تصدير المصطلح';

lang/ar/moodle.php

@@ -97,7 +97,7 @@ $string['backupkeephelp'] = '
 $string['backuplogshelp'] = 'لو مكن، سيتم إضافة جميع سِجلات أداء المنهج الدراسي ضمن النسخ الاحتياطي الآلي.';
 $string['backupnameformat'] = 'نوع تنسيق ملف  النسخة الإحتياطية';
 $string['backuporiginalname'] = 'اسم الاصلي لملف  النسخة الإحتياطية';
-$string['backupsavetohelp'] = 'المسار الكامل للمجلد الذي تريد أن تحفظ في ملفات النسخ الاحتياطي <br> (أترك فارغاً للحفظ في المجلد الافتراطي للمنهج الدراسي)';
+$string['backupsavetohelp'] = 'المسار الكامل للمجلد الذي تريد أن تحفظ في ملفات النسخ الاحتياطي <br /> (أترك فارغاً للحفظ في المجلد الافتراطي للمنهج الدراسي)';
 $string['backupuserfileshelp'] = 'اختر لو كنت ترغب في إضافة ملفات المستخدم(مثل: صور اللمحه الشخصية) ضمن النسخ الاحتياطي الآلي';
 $string['backupusershelp'] = 'اختر لو كنت ترغب في إضافة جميع المستخدمين في الخادم أو المستخدمين المطلوبين لكل منهج دراسي فقط';
 $string['backupversion'] = 'إصدار النسخة الإحتياطية';
@@ -324,9 +324,9 @@ $string['enrolledincoursenot'] = '
 $string['enrolmentconfirmation'] = 'انت على وشك التسجيل كعضو في هذ المنهج الدراسي
 <br />هل أنت متأكد من ذلك؟';
 $string['enrolmentkey'] = 'مفتاح التسجيل';
-$string['enrolmentkeyfrom'] = 'هذا المنهج الدراسي يتطلب \'مفتاح تسجيل\' -  في المرة الأولى فقط<BR>
+$string['enrolmentkeyfrom'] = 'هذا المنهج الدراسي يتطلب \'مفتاح تسجيل\' -  في المرة الأولى فقط<br />
 كلمة المرور التي يفترض حصولك عليها من $a';
-$string['enrolmentkeyhint'] = 'مفتاح التسجيل غير صحيح. يرجى إعادة المحاولة<BR>
+$string['enrolmentkeyhint'] = 'مفتاح التسجيل غير صحيح. يرجى إعادة المحاولة<br />
 (هذا تلميح - إنه يبدأ بـ \'$a\'';
 $string['entercourse'] = 'الدخول إلى هذا المنهج الدراسي';
 $string['enteremailaddress'] = 'أدخل عنوان بريدك الإلكتروني لتصلك عليه رسالة باسم المستخدم وكلمة المرور.';
@@ -719,7 +719,7 @@ $string['scheduledbackupstatus'] = '
 $string['search'] = 'بحث';
 $string['searchagain'] = 'بحث مرة أخرى';
 $string['searchcourses'] = 'بحث مناهج دراسية';
-$string['searchhelp'] = 'تستطيع البحت عن كلمات متعددة في آن واحد <p>word: أبحث عن هذه الكلم ضمن النص. <br>+word: الكلمات المتشابه تماما سيبحث عنها. <br>word:لا تضيف نتائج تحتوى على هذه الكلمة';
+$string['searchhelp'] = 'تستطيع البحت عن كلمات متعددة في آن واحد <p>word: أبحث عن هذه الكلم ضمن النص. <br />+word: الكلمات المتشابه تماما سيبحث عنها. <br />word:لا تضيف نتائج تحتوى على هذه الكلمة';
 $string['searchresults'] = 'نتائج البحث';
 $string['sec'] = 'ثانية';
 $string['secs'] = 'ثواني';

lang/ar/quiz.php

@@ -80,11 +80,11 @@ $string['filloutoneanswer'] = '
 $string['filloutthreequestions'] = 'يجب تعبيئة ثلاثة أسئلة على الاقل. الاسئلةالفارغة لن تستخدم.';
 $string['fillouttwochoices'] = 'يجب تعبيئة اختيارين على الأقل. الخيارات التي تترك فارغة لن تستخدم.';
 $string['fractionsaddwrong'] = 'الدرجات الموجبة التي حصلت عليها لا تبلغ 100%%
-<BR>بل إنها تبلغ $a %%
-<BR>هل تريد الرجوع لتصويب هذا السؤال؟';
+<br />بل إنها تبلغ $a %%
+<br />هل تريد الرجوع لتصويب هذا السؤال؟';
 $string['fractionsnomax'] = 'لا بد أن يكون أحد الأسئلة 100%%, حتى يكون
-<BR>الحصول على الدرجة النهائية لهذا السؤال ممكنا.
-<BR>هل تريد الرجوع لتصويب هذا السؤال؟';
+<br />الحصول على الدرجة النهائية لهذا السؤال ممكنا.
+<br />هل تريد الرجوع لتصويب هذا السؤال؟';
 $string['gift'] = 'تنسيق GIFT';
 $string['gradeaverage'] = 'متوسط الدرجة';
 $string['gradehighest'] = 'أعلى درجة';
@@ -118,7 +118,7 @@ $string['noquestions'] = '
 $string['noresponse'] = 'لا توجد إجابة';
 $string['noreview'] = 'لا تستطيع مراجعة هذا الامتحان';
 $string['noreviewuntil'] = 'لا تستطيع مراجعة هذا الامتحان حتى $a ';
-$string['notenoughsubquestions'] = 'عدد الاسئلة الفرعية غير كافي!<br> هل ترغب في العودة لتعديل هذا السؤال.';
+$string['notenoughsubquestions'] = 'عدد الاسئلة الفرعية غير كافي!<br /> هل ترغب في العودة لتعديل هذا السؤال.';
 $string['numerical'] = 'رقمي';
 $string['paragraphquestion'] = 'سؤال الفقرة غير مدعم في سطر $a . سيتم تجاهل السؤال.';
 $string['percentcorrect'] = 'نسبة الصح';

lang/ca/admin.php

@@ -1,11 +1,18 @@
 <?PHP // $Id$ 
-      // admin.php - created with Moodle 1.3 development (2004032800)
+      // admin.php - created with Moodle 1.5 UNSTABLE DEVELOPMENT (2004101900)
 
 
+$string['blockinstances'] = 'Instàncies';
+$string['blockmultiple'] = 'Múltiple';
 $string['cachetext'] = 'Durada de la memòria cau de text';
+$string['change'] = 'Canvia';
 $string['filteruploadedfiles'] = 'Filtrar fitxers penjats';
 $string['upgradelogs'] = 'Per a disposar de totes les funcionalitats, els vostres registres s\'han d\'actualitzar. <a href=\"$a\">Més informació</a>';
 $string['upgradelogsinfo'] = 'S\'han introduït alguns canvis en la manera d\'emmagatzemar els registres. Per tal de poder veure tots els vostres registres vells per activitat, els vostres registres vells s\'han d\'actualitzar. Depenent del vostre servidor això pot trigar una bona estona (unes quantes hores) i en una instal·lació gran pot carregar una mica la base de dades. Una vegada hàgeu engegat aquest procés haureu de deixar que acabi (mantenint la finestra del navegador oberta). No us amoïneu: el vostre lloc seguirà actiu per als usuaris mentre els registres s\'actualitzen. <br /><br />Voleu actualitzar els registres ara?';
+$string['upgradesure'] = 'Els vostres fitxers de Moodle han canviat i esteu a punt d\'actualitzar automàticament el servidor a aquesta versió:
+<p><b>$a</b></p>
+<p>Després de fer això no podreu tornar enrere.</p> 
+<p>Esteu segur que voleu actualitzar aquest servidor a aquesta versió?</p>';
 $string['upgradinglogs'] = 'S\'estan actualitzant els registres';
 
 ?>

lang/ca/auth.php

@@ -1,7 +1,9 @@
 <?PHP // $Id$ 
-      // auth.php - created with Moodle 1.5 unstable development (2004083000)
+      // auth.php - created with Moodle 1.5 UNSTABLE DEVELOPMENT (2004093001)
 
 
+$string['auth_common_settings'] = 'Paràmetres comuns';
+$string['auth_data_mapping'] = 'Mapatge de dades';
 $string['auth_dbdescription'] = 'Aquest mètode utilitza una taula d\'una base de dades externa per comprovar si un nom d\'usuari i una contrasenya són vàlids. Si el compte és nou, aleshores també es pot copiar en Moodle informació d\'altres camps.';
 $string['auth_dbextrafields'] = 'Aquests camps són opcionals. Podeu triar d\'omplir alguns camps d\'usuari del Moodle amb informació dels <B>camps de la base de dades externa</B> especificats aquí. <P>Si els deixeu en blanc s\'utilitzaran valors per defecte.<P>En tot cas, l\'usuari podrà editar tots aquests camps quan es connecti.';
 $string['auth_dbfieldpass'] = 'Nom del camp que conté la contrasenya';
@@ -14,6 +16,8 @@ $string['auth_dbtable'] = 'Nom de la taula';
 $string['auth_dbtitle'] = 'Utilitza una base de dades externa';
 $string['auth_dbtype'] = 'Tipus de base de dades (vg. la <A HREF=../lib/adodb/readme.htm#drivers>documentació sobre ADOdb</A>)';
 $string['auth_dbuser'] = 'Nom d\'usuari amb accés de lectura a la base de dades';
+$string['auth_editlock'] = 'Bloqueja valor';
+$string['auth_editlock_expl'] = '<p><b>Bloqueja valor:</b> si habiliteu aquesta opció, impedireu que els usuaris i administradors de Moodle editen aquest fitxer directament. Utilitzeu aquesta opció si manteniu aquestes dades en un sistema d\'autenticació extern.</p>';
 $string['auth_emaildescription'] = 'La confirmació per correu electrònic és el mètode d\'autenticació per defecte. Quan l\'usuari es registra i tria el seu nom d\'usuari i contrasenya, se li envia un missatge per confirmar les dades. Aquest missatge conté un enllaç segur a una pàgina en la qual l\'usuari pot confirmar el seu compte. En les connexions següents simplement es compara el nom d\'usuari i la contrasenya amb els valors guardats a la base de dades de Moodle.';
 $string['auth_emailtitle'] = 'Autenticació basada en el correu electrònic';
 $string['auth_fccreators'] = 'Llista de grups als membres dels quals els és permès de crear nous cursos. Separeu els diferents grups amb \';\'. Els noms han de ser exactament iguals als del servidor FirstClass. El sistema distingeix majúscules i minúscules.';
@@ -28,15 +32,18 @@ $string['auth_imaphost'] = 'L\'adre
 $string['auth_imapport'] = 'El número de port del servidor IMAP. Generalment és el 143 o el 993.';
 $string['auth_imaptitle'] = 'Utilitza un servidor IMAP';
 $string['auth_imaptype'] = 'Tipus de servidor IMAP. Els servidors IMAP poden tenir diferents tipus d\'autenticació i negociació.';
-$string['auth_ldap_bind_dn'] = 'Si voleu utilitzar el bind-user per cercar usuaris, especifiqueu-ho aquí. Una cosa semblant a \'cn=ldapuser,ou=public,o=org\'';
-$string['auth_ldap_bind_pw'] = 'Contrasenya del bind-user.';
+$string['auth_ldap_bind_dn'] = 'Si voleu utilitzar l\'usuari de vinculació (<i>bind-user</i>) per cercar usuaris, especifiqueu-ho aquí. Una cosa semblant a \'cn=ldapuser,ou=public,o=org\'';
+$string['auth_ldap_bind_pw'] = 'Contrasenya del <i>bind-user</i>.';
+$string['auth_ldap_bind_settings'] = 'Paràmetres de vinculació';
 $string['auth_ldap_contexts'] = 'Llista de contextos en què estan ubicats els usuaris. Separeu els contextos amb \';\'. Per exemple: \'ou=users,o=org; ou=others,o=org\'';
 $string['auth_ldap_create_context'] = 'Si activeu la creació d\'usuaris mitjançant confirmació per correu electrònic, especifiqueu en quin context s\'han de crear els usuaris. Aquest context ha de ser diferent del d\'altres usuaris per tal de prevenir problemes de seguretat. No cal afegir aquest context a ldap_context-variable. Moodle cercarà els usuaris en aquest context automàticament.';
 $string['auth_ldap_creators'] = 'Llista de grups als membres dels quals els és permès  crear nous cursos. Separeu els grups amb \';\'. Generalment una cosa semblant a \'cn=teachers,ou=staff,o=myorg\'';
 $string['auth_ldap_host_url'] = 'Especifiqueu l\'hoste LDAP en format URL, per exemple \'ldap://ldap.myorg.com/\' o \'ldaps://ldap.myorg.com/\' ';
+$string['auth_ldap_login_settings'] = 'Paràmetres d\'entrada';
 $string['auth_ldap_memberattribute'] = 'Especifiqueu l\'atribut de membre de l\'usuari, quan els usuaris pertanyen a un grup. Generalment \'member\'';
 $string['auth_ldap_objectclass'] = 'Filtre utilitzat per nomenar/cercar usuaris. Generalment es defineix quelcom semblant a objectClass=posixAccount. Per defecte objectClass=*, que retorna tots els objectes de LDAP.';
 $string['auth_ldap_search_sub'] = 'Poseu el valor <> 0 si voleu cercar els usuaris en subcontextos.';
+$string['auth_ldap_server_settings'] = 'Paràmetres del servidor LDAP';
 $string['auth_ldap_update_userinfo'] = 'Passar les dades de l\'usuari (nom, cognoms, adreça...) de LDAP a Moodle. Informació sobre mapatge en /auth/ldap/attr_mappings.php';
 $string['auth_ldap_user_attribute'] = 'L\'atribut utilitzat per anomenar/cercar usuaris. Generalment \'cn\'.';
 $string['auth_ldap_version'] = 'La versió del protocol LDAP que està utilitzant el servidor.';
@@ -60,24 +67,39 @@ $string['auth_nntpport'] = 'N
 $string['auth_nntptitle'] = 'Utilitza un servidor NNTP';
 $string['auth_nonedescription'] = 'Els usuaris es poden registrar i crear comptes immediatament vàlids, sense cap mena d\'autenticació contra un servidor extern ni confirmar la identitat per correu electrònic. Teniu compte amb aquesta  opció - penseu en els problemes de seguretat i d\'administració que pot causar.';
 $string['auth_nonetitle'] = 'Sense autenticació';
+$string['auth_pamdescription'] = 'Aquest mètode utilitza PAM per accedir els noms d\'usuari natius d\'aquest servidor. Per utilitzar aquest mòdul heu d\'instal·lar <a href=\"http://www.math.ohio-state.edu/~ccunning/pam_auth/\" target=\"_blank\">PHP4 PAM Authentication</a>.';
+$string['auth_pamtitle'] = 'PAM (Pluggable Authentication Modules)';
+$string['auth_passwordisexpired'] = 'La vostra contrasenya ha caducat. Voleu canviar-la ara?';
+$string['auth_passwordwillexpire'] = 'La vostra contrasenya caducarà aviat ($a dies). Voleu canviar-la ara?';
 $string['auth_pop3description'] = 'Aquest mètode utilitza un servidor POP3 per comprovar si un nom d\'usuari i una contrasenya són vàlids.';
 $string['auth_pop3host'] = 'L\'adreça del servidor POP3. Ha de ser el número IP, no el nom del DNS.';
 $string['auth_pop3mailbox'] = 'Nom de la bústia amb la qual es fa la connexió (generalment INBOX)';
 $string['auth_pop3port'] = 'Número de port del servidor (el 110 és el més habitual)';
 $string['auth_pop3title'] = 'Utilitza un servidor POP3';
 $string['auth_pop3type'] = 'Tipus de servidor. Si el vostre servidor utilitza seguretat per certificat, trieu pop3cert.';
-$string['auth_user_create'] = 'Activa la creació d\'usuaris';
-$string['auth_user_creation'] = 'Els nous usuaris (anònims) poden crear comptes d\'usuari en la font d\'autenticació externa i confirmar-los via correu electrònic. Si activeu aquesta opció, recordeu de configurar també opcions específiques del mòdul per a la creació d\'usuaris.';
+$string['auth_updatelocal'] = 'Actualitza dades locals';
+$string['auth_updatelocal_expl'] = '<p><b>Actualitza dades locals:</b> si habiliteu aquesta opció, el camp s\'actualitzarà (amb les dades externes d\'autenticació) cada vegada que l\'usuari entri o quan es faci una sincronització d\'usuaris. Els camps definits per actualitzar-se localment haurien d\'estar bloquejats.</p>';
+$string['auth_updateremote'] = 'Actualitza dades externes';
+$string['auth_updateremote_expl'] = '<p>Actualitza dades externes:</b> si habiliteu aquesta opció, les dades externes d\'autenticació s\'actualitzaran quan s\'actualitzi el registre de l\'usuari. Els camps s\'haurien de desbloquejar per permetre l\'edició.</p>';
+$string['auth_updateremote_ldap'] = '<p><b>Nota:</b> actualitzar dades LDAP externes requreix definir binddn i dindpw amb un bind-user que tingui privilegis d\'edició en tots els registres d\'usuari. Actualment no preserva valors múltiples en els atributs i suprimeix els valors extra quan es fa l\'actualització.</p>';
+$string['auth_user_create'] = 'Habilita la creació d\'usuaris';
+$string['auth_user_creation'] = 'Els nous usuaris (anònims) poden crear comptes d\'usuari en la font d\'autenticació externa i confirmar-los via correu electrònic. Si habiliteu aquesta opció, recordeu de configurar també opcions específiques del mòdul per a la creació d\'usuaris.';
 $string['auth_usernameexists'] = 'El nom d\'usuari elegit ja existeix. Sisplau trieu-ne un altre.';
 $string['authenticationoptions'] = 'Opcions d\'autenticació';
 $string['authinstructions'] = 'Aquí podeu posar instruccions per als vostres usuaris, per tal que sàpiguen quin nom d\'usuari i quina contrasenya han d\'utilitzar. El text apareixerà a la pàgina d\'entrada. Si el deixeu en blanc no hi haurà instruccions.';
-$string['changepassword'] = 'URL de canvi de contrasenya';
+$string['changepassword'] = 'URL per a canvi de contrasenya';
 $string['changepasswordhelp'] = 'Aquí podeu especificar una adreça en la qual els usuaris puguin recuperar o canviar la seua contrasenya si se n\'han oblidat. Aquesta opció apareixerà en forma de botó a la pàgina d\'entrada. Si la deixeu en blanc no apareixerà el botó.';
 $string['chooseauthmethod'] = 'Trieu un mètode d\'autenticació: ';
-$string['guestloginbutton'] = 'Botó d\'entrada d\'invitats';
+$string['forcechangepassword'] = 'Imposa canvi de contrasenya';
+$string['forcechangepassword_help'] = 'Obliga els usuaris a canviar la contrasenya la pròxima vegada que entrien en Moodle.';
+$string['forcechangepasswordfirst_help'] = 'Obliga els usuaris a canviar la contrasenya la pròxima vegada que entrien en Moodle.';
+$string['guestloginbutton'] = 'Botó d\'entrada de visitants';
 $string['instructions'] = 'Instruccions';
 $string['md5'] = 'Xifratge MD5';
 $string['plaintext'] = 'Text net';
-$string['showguestlogin'] = 'Podeu ocultar o mostrar el botó d\'entrada com a invitat a la pàgina d\'entrada.';
+$string['showguestlogin'] = 'Podeu ocultar o mostrar el botó d\'entrada com a visitant a la pàgina d\'entrada.';
+$string['stdchangepassword'] = 'Utilitza la pàgina estàndard de canvi de contrasenya';
+$string['stdchangepassword_expl'] = 'Si el sistema extern d\'autenticació permet canvis de contrasenya per mitjà de Moodle, commuteu aquest paràmetre a Sí. Aquest paràmetre substitueix l\'\"URL per a canvi de contrasenya\".';
+$string['stdchangepassword_explldap'] = 'NOTA: s\'aconsella que utilitzeu LDAP sobre un túnel xifrat SSL (ldaps://) si el servidor LDAP és remot.';
 
 ?>

lang/ca/block_course_summary.php

@@ -1,8 +1,8 @@
 <?PHP // $Id$ 
-      // block_course_summary.php - created with Moodle 1.4 development (2004070800)
+      // block_course_summary.php - created with Moodle 1.5 UNSTABLE DEVELOPMENT (2004101900)
 
 
-$string['blockname'] = 'Resum del curs';
-$string['siteinfo'] = 'Informació del lloc';
+$string['coursesummary'] = 'Resum del curs';
+$string['pagedescription'] = 'Descripció del curs/lloc';
 
 ?>

lang/ca/choice.php

@@ -1,5 +1,5 @@
 <?PHP // $Id$ 
-      // choice.php - created with Moodle 1.4 development (2004062600)
+      // choice.php - created with Moodle 1.5 unstable development (2004090600)
 
 
 $string['allowupdate'] = 'Permet actualitzar la consulta';
@@ -9,6 +9,7 @@ $string['choiceclose'] = 'Fins';
 $string['choicename'] = 'Títol de la consulta';
 $string['choiceopen'] = 'Oberta';
 $string['choicetext'] = 'Text de la consulta';
+$string['havetologin'] = 'Abans de trametre una resposta heu d\'entrar amb el vostre nom d\'usuari i contrasenya.';
 $string['modulename'] = 'Consulta';
 $string['modulenameplural'] = 'Consultes';
 $string['mustchooseone'] = 'Heu de triar una resposta abans de desar. No s\'ha desat res.';

lang/ca/dialogue.php

@@ -1,5 +1,5 @@
 <?PHP // $Id$ 
-      // dialogue.php - created with Moodle 1.2 Beta (2004022400)
+      // dialogue.php - created with Moodle 1.5 unstable development (2004091100)
 
 
 $string['addmynewentries'] = 'Afegeix les meves entrades noves';
@@ -9,7 +9,7 @@ $string['allowmultiple'] = 'Permet m
 $string['allowstudentdialogues'] = 'Permet diàlegs d\'estudiant a estudiant';
 $string['close'] = 'Tanca';
 $string['closed'] = 'Tancat';
-$string['confirmclosure'] = 'Aneu a tancar un diàleg amb $a. Els diàlegs tancats no es poden tornar a obrir. Si tanqueu aquest diàleg el podreu veure, però no el podreu reprendre i haureu d\'obrir un diàleg nou per continuar &quot;xerrant&quot; amb aquesta persona.<br /><br />Esteu segur que voleu tancar aquest diàleg?';
+$string['confirmclosure'] = 'Aneu a tancar un diàleg amb $a. Els diàlegs tancats no es poden tornar a obrir. Si tanqueu aquest diàleg el podreu veure, però no el podreu reprendre i haureu d\'obrir un diàleg nou per continuar \"xerrant\" amb aquesta persona.<br /><br />Esteu segur que voleu tancar aquest diàleg?';
 $string['deleteafter'] = 'Suprimeix els diàlegs tancats després d\'aquests dies';
 $string['dialogueclosed'] = 'Diàleg tancat';
 $string['dialogueintro'] = 'Introducció al diàleg';
@@ -27,6 +27,7 @@ $string['everybody'] = 'Tothom';
 $string['furtherinformation'] = 'Més informació';
 $string['lastentry'] = 'Darrera entrada';
 $string['maildefault'] = 'Envia correu per defecte';
+$string['mailnotification'] = 'Notificació per correu';
 $string['modulename'] = 'Diàleg';
 $string['modulenameplural'] = 'Diàlegs';
 $string['namehascloseddialogue'] = '$a ha tancat el diàleg';

lang/ca/docs/intro.html

@@ -20,7 +20,7 @@
   <p>El mot Moodle era originalment un acr&ograve;nim de Modular Object-Oriented Dynamic Learning Environment (Entorn d'Aprenentatge Din&agrave;mic i Modular Orientat a l'Objecte), cosa que &eacute;s &uacute;til principalment a programadors i te&ograve;rics de l'educaci&oacute;. Tamb&eacute; &eacute;s un verb que descriu el proc&eacute;s de vagarejar ociosament, fent les coses a mesura que se us acudeixen: una manera de divertir-se joguinejant que tot sovint porta noves percepcions i creativitat. S'aplica, aix&iacute;, tant a l'estil de desenvolupament de Moodle com a una possible manera d'apropar-se l'estudiant a l'aprenentatge, o el professor a l'ensenyament, en un curs en l&iacute;nia. Aquell qui fa servir Moodle &eacute;s un Moodler.</p>
   <p><a href="http://moodle.org/community/" target="_top">Moodlegeu amb nosaltres</a>!</p>
 </blockquote>
-<p><br>
+<p><br />
 </p>
 <p align="CENTER"><font size="1"><a href="." target="_top">Documentaci&oacute; de Moodle</a></font></p>
 <p align="CENTER"><font size="1">Version: $Id$</font></p>