Bump 1.8.11

were causing this: wrong get_users_by_capability() call and standard scales.
Improved scales restore to observe the 'moodle/course:managescales' cap.
Backported from 19_STABLE

admin/mnet/delete.php

@@ -31,6 +31,8 @@
         redirect('index.php', get_string('postrequired','mnet') ,7);
     }
 
+    require_sesskey();
+
     if ('verify' == $step) {
         $mnet_peer = new mnet_peer();
         $mnet_peer->set_id($hostid);

admin/mnet/peers.html

@@ -55,6 +55,7 @@ if (empty($CFG->mnet_dispatcher_mode) || $CFG->mnet_dispatcher_mode !== 'strict'
                 <div>
                 <input type="hidden" name="hostid" value="<?php echo $host->id; ?>" />
                 <input type="hidden" name="step" value="verify" />
+                <input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
                 <input type="submit" name="submit" value="<?php print_string('delete'); ?>"/>
                 </div>
             </form>

admin/report/security/lib.php

@@ -42,6 +42,7 @@ function report_security_get_issue_list() {
         'report_security_check_mediafilterswf',
         'report_security_check_openprofiles',
         'report_security_check_google',
+        'report_security_check_passwordsaltmain',
         'report_security_check_configrw',
         'report_security_check_defaultuserrole',
         'report_security_check_guestrole',
@@ -740,3 +741,39 @@ function report_security_check_courserole($detailed=false) {
     return $result;
 }
 
+/**
+ * Checks to see whether a password salt has been defined
+ *
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_passwordsaltmain($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_passwordsaltmain';
+    $result->name    = get_string('check_passwordsaltmain_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+
+    if (empty($CFG->passwordsaltmain)) {
+        $result->status = REPORT_SECURITY_WARNING;
+        $result->info   = get_string('check_passwordsaltmain_warning', 'report_security');
+    } else if ($CFG->passwordsaltmain === 'a_very_long_random_string_of_characters#@6&*1'
+            || trim($CFG->passwordsaltmain) === '' || preg_match('/^([\w]+|[\d]+)$/i', $CFG->passwordsaltmain)) {
+        $result->status = REPORT_SECURITY_WARNING;
+        $result->info   = get_string('check_passwordsaltmain_weak', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_passwordsaltmain_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $docspath = $CFG->docroot.'/'.str_replace('_utf8', '', current_language()).'/report/security/report_security_check_passwordsaltmain';
+        $result->details = get_string('check_passwordsaltmain_details', 'report_security', $docspath);
+    }
+
+    return $result;
+}

admin/roles/allowassign.php

@@ -24,10 +24,10 @@
 
     $roles = get_all_roles();
 
-    if ($grant = data_submitted()) {
+    if ($grant = data_submitted() and confirm_sesskey()) {
 
         foreach ($grant as $grole => $val) {
-            if ($grole == 'dummy') {
+            if ($grole == 'dummy' or !strpos($grole, '_')) {
                 continue;
             }
 
@@ -82,6 +82,7 @@
     print_table($table);
     echo '<div class="buttons"><input type="submit" value="'.get_string('savechanges').'"/>';
     echo '<input type="hidden" name="dummy" value="1" />'; // this is needed otherwise we do not know a form has been submitted
+    echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
     echo '</div></form>';
 
     admin_externalpage_print_footer($adminroot);

admin/roles/allowoverride.php

@@ -22,10 +22,10 @@
 
     $roles = get_all_roles();
 
-    if ($grant = data_submitted()) {
+    if ($grant = data_submitted() and confirm_sesskey()) {
 
         foreach ($grant as $grole => $val) {
-            if ($grole == 'dummy') {
+            if ($grole == 'dummy' or !strpos($grole, '_')) {
                 continue;
             }
 
@@ -80,6 +80,7 @@
     print_table($table);
     echo '<div class="buttons"><input type="submit" value="'.get_string('savechanges').'"/>';
     echo '<input type="hidden" name="dummy" value="1" />'; // this is needed otherwise we do not know a form has been submitted
+    echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
     echo '</div></form>';
 
     admin_externalpage_print_footer($adminroot);

admin/user.php

@@ -114,8 +114,8 @@
             $updateuser->id           = $user->id;
             $updateuser->deleted      = 1;
             $updateuser->username     = addslashes("$user->email.".time());  // Remember it just in case
-            $updateuser->email        = '';               // Clear this field to free it up
-            $updateuser->idnumber     = '';               // Clear this field to free it up
+            $updateuser->email        = md5($user->username); // Store hash of username, useful importing/restoring users
+            $updateuser->idnumber     = '';                   // Clear this field to free it up
             $updateuser->timemodified = time();
             if (update_record('user', $updateuser)) {
                 // Removing a user may have more requirements than just removing their role assignments.
@@ -432,6 +432,8 @@
         }
     }
 
+    require_once($CFG->dirroot . '/blocks/extrafields/admin_user.php');
+
 
     admin_externalpage_print_footer($adminroot);
 

admin/xmldb/actions/XMLDBAction.class.php

@@ -47,6 +47,8 @@ class XMLDBAction {
 
     var $postaction;     //Action to execute at the end of the invoke script
 
+    var $sesskey_protected; // Actions must be protected by sesskey mechanishm
+
     /**
      * Constructor
      */
@@ -72,6 +74,7 @@ class XMLDBAction {
         $this->output    = NULL;
         $this->errormsg  = NULL;
         $this->subaction = NULL;
+        $this->sesskey_protected = true;
     }
 
     /**
@@ -130,13 +133,18 @@ class XMLDBAction {
     }
 
     /**
-     * main invoke method, it simply sets the postaction attribute
-     * if possible
+     * main invoke method, it sets the postaction attribute
+     * if possible and checks sesskey_protected if needed
      */
     function invoke() {
 
         global $SESSION;
 
+    /// Sesskey protection
+        if ($this->sesskey_protected) {
+            require_sesskey();
+        }
+
     /// If we are used any dir, save it in the lastused session object
     /// Some actions can use it to perform positioning
         if ($lastused = optional_param ('dir', NULL, PARAM_PATH)) {

admin/xmldb/actions/check_indexes/check_indexes.class.php

@@ -94,7 +94,7 @@ class check_indexes extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmcheckindexes'] . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=check_indexes&amp;confirmed=yes" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=check_indexes&amp;sesskey=' . sesskey() . '&amp;confirmed=yes" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_field/delete_field.class.php

@@ -77,7 +77,7 @@ class delete_field extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletefield'] . '<br /><br />' . $fieldparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_field&amp;confirmed=yes&amp;postaction=edit_table&amp;field=' . $fieldparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_field&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_table&amp;field=' . $fieldparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_index/delete_index.class.php

@@ -77,7 +77,7 @@ class delete_index extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeleteindex'] . '<br /><br />' . $indexparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_index&amp;confirmed=yes&amp;postaction=edit_table&amp;index=' . $indexparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_index&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_table&amp;index=' . $indexparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_key/delete_key.class.php

@@ -77,7 +77,7 @@ class delete_key extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletekey'] . '<br /><br />' . $keyparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_key&amp;confirmed=yes&amp;postaction=edit_table&amp;key=' . $keyparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_key&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_table&amp;key=' . $keyparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_sentence/delete_sentence.class.php

@@ -77,7 +77,7 @@ class delete_sentence extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletesentence'] . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_sentence&amp;confirmed=yes&amp;postaction=edit_statement&amp;sentence=' . $sentenceparam . '&amp;statement=' . urlencode($statementparam) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_sentence&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_statement&amp;sentence=' . $sentenceparam . '&amp;statement=' . urlencode($statementparam) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_statement/delete_statement.class.php

@@ -76,7 +76,7 @@ class delete_statement extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletestatement'] . '<br /><br />' . $statementparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_statement&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_statement&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_table/delete_table.class.php

@@ -76,7 +76,7 @@ class delete_table extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletetable'] . '<br /><br />' . $tableparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_table&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_table&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_xml_file/delete_xml_file.class.php

@@ -75,7 +75,7 @@ class delete_xml_file extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletexmlfile'] . '<br /><br />' . $dirpath . '/install.php</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_xml_file&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_xml_file&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/edit_field/edit_field.class.php

@@ -35,6 +35,7 @@ class edit_field extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -103,6 +104,7 @@ class edit_field extends XMLDBAction {
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
         $o.= '    <input type="hidden" name ="field" value="' . $fieldparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_field_save" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';

admin/xmldb/actions/edit_index/edit_index.class.php

@@ -35,6 +35,7 @@ class edit_index extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -103,6 +104,7 @@ class edit_index extends XMLDBAction {
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
         $o.= '    <input type="hidden" name ="index" value="' . $indexparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_index_save" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';

admin/xmldb/actions/edit_key/edit_key.class.php

@@ -35,6 +35,7 @@ class edit_key extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -103,6 +104,7 @@ class edit_key extends XMLDBAction {
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
         $o.= '    <input type="hidden" name ="key" value="' . $keyparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_key_save" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';

admin/xmldb/actions/edit_sentence/edit_sentence.class.php

@@ -35,6 +35,7 @@ class edit_sentence extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -119,6 +120,7 @@ class edit_sentence extends XMLDBAction {
             $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
             $o.= '    <input type="hidden" name ="statement" value="' . $statementparam .'" />';
             $o.= '    <input type="hidden" name ="sentence" value="' . $sentenceparam .'" />';
+            $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
             $o.= '    <input type="hidden" name ="action" value="edit_sentence_save" />';
             $o.= '    <input type="hidden" name ="postaction" value="edit_statement" />';
             $o.= '    <table id="formelements" class="boxaligncenter">';

admin/xmldb/actions/edit_statement/edit_statement.class.php

@@ -35,6 +35,7 @@ class edit_statement extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -106,6 +107,7 @@ class edit_statement extends XMLDBAction {
         $o.= '<div>';        
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="statement" value="' . $statementparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_statement_save" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_statement" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';
@@ -129,7 +131,7 @@ class edit_statement extends XMLDBAction {
             $b .= '&nbsp;[' . $this->str['viewedited'] . ']';
         }
     /// The new sentence button
-        $b .= '&nbsp;<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newsentence'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;sesskey=' . sesskey() . '&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newsentence'] . ']</a>';
     /// The back to edit xml file button
         $b .= '&nbsp;<a href="index.php?action=edit_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['back'] . ']</a>';
         $b .= '</p>';
@@ -157,10 +159,10 @@ class edit_statement extends XMLDBAction {
                 $b .= '<a href="index.php?action=edit_sentence&amp;sentence=' .$key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['edit'] . ']</a>';
                 $b .= '</td><td class="button cell">';
             /// The duplicate button
-                $b .= '<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;basesentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['duplicate'] . ']</a>';
+                $b .= '<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;sesskey=' . sesskey() . '&amp;basesentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['duplicate'] . ']</a>';
                 $b .= '</td><td class="button cell">';
             /// The delete button
-                $b .= '<a href="index.php?action=delete_sentence&amp;sentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                $b .= '<a href="index.php?action=delete_sentence&amp;sesskey=' . sesskey() . '&amp;sentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                 $b .= '</td>';
             /// Print table row
             $o .= '<tr class="r' . $row . '"><td class="table cell">' . $p . $sentence . $b . '</tr>';

admin/xmldb/actions/edit_table/edit_table.class.php

@@ -35,6 +35,7 @@ class edit_table extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -107,6 +108,7 @@ class edit_table extends XMLDBAction {
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_table_save" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';
     /// If the table is being used, we cannot rename it
@@ -134,11 +136,11 @@ class edit_table extends XMLDBAction {
             $b .= '&nbsp;[' . $this->str['viewedited'] . ']';
         }
     /// The new field button
-        $b .= '&nbsp;<a href="index.php?action=new_field&amp;postaction=edit_field&amp;table=' . $tableparam . '&amp;field=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newfield'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_field&amp;sesskey=' . sesskey() . '&amp;postaction=edit_field&amp;table=' . $tableparam . '&amp;field=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newfield'] . ']</a>';
     /// The new key button
-        $b .= '&nbsp;<a href="index.php?action=new_key&amp;postaction=edit_key&amp;table=' . $tableparam . '&amp;key=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newkey'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_key&amp;sesskey=' . sesskey() . '&amp;postaction=edit_key&amp;table=' . $tableparam . '&amp;key=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newkey'] . ']</a>';
     /// The new index button
-        $b .= '&nbsp;<a href="index.php?action=new_index&amp;postaction=edit_index&amp;table=' . $tableparam . '&amp;index=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newindex'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_index&amp;sesskey=' . sesskey() . '&amp;postaction=edit_index&amp;table=' . $tableparam . '&amp;index=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newindex'] . ']</a>';
     /// The back to edit xml file button
         $b .= '&nbsp;<a href="index.php?action=edit_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['back'] . ']</a>';
         $b .= '</p>';
@@ -185,14 +187,14 @@ class edit_table extends XMLDBAction {
                 $b .= '</td><td class="button cell">';
             /// The up button
                 if ($field->getPrevious()) {
-                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=up&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['up'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The down button
                 if ($field->getNext()) {
-                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=down&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['down'] . ']';
                 }
@@ -200,7 +202,7 @@ class edit_table extends XMLDBAction {
             /// The delete button (if we have more than one and it isn't used
                 if (count($fields) > 1 &&
                 !$structure->getFieldUses($table->getName(), $field->getName())) {
-                    $b .= '<a href="index.php?action=delete_field&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_field&amp;sesskey=' . sesskey() . '&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['delete'] . ']';
                 }
@@ -234,21 +236,21 @@ class edit_table extends XMLDBAction {
                 $b .= '</td><td class="button cell">';
             /// The up button
                 if ($key->getPrevious()) {
-                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=up&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['up'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The down button
                 if ($key->getNext()) {
-                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=down&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['down'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The delete button (if the key hasn't uses)
                 if (!$structure->getKeyUses($table->getName(), $key->getName())) {
-                    $b .= '<a href="index.php?action=delete_key&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_key&amp;sesskey=' . sesskey() . '&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['delete'] . ']';
                 }
@@ -274,20 +276,20 @@ class edit_table extends XMLDBAction {
                 $b .= '</td><td class="button cell">';
             /// The up button
                 if ($index->getPrevious()) {
-                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=up&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['up'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The down button
                 if ($index->getNext()) {
-                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=down&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['down'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The delete button
-                    $b .= '<a href="index.php?action=delete_index&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_index&amp;sesskey=' . sesskey() . '&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
             /// The readable info
                 $r = '</td><td class="readableinfo cell">' . $index->readableInfo() . '</td>';
             /// Print table row

admin/xmldb/actions/edit_xml_file/edit_xml_file.class.php

@@ -35,6 +35,7 @@ class edit_xml_file extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -107,6 +108,7 @@ class edit_xml_file extends XMLDBAction {
                 $o.= '    <input type="hidden" name ="postaction" value="edit_xml_file" />';
                 $o.= '    <input type="hidden" name ="path" value="' . s($structure->getPath()) .'" />';
                 $o.= '    <input type="hidden" name ="version" value="' . s($structure->getVersion()) .'" />';
+                $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
                 $o.= '    <table id="formelements" class="boxaligncenter">';
                 $o.= '      <tr valign="top"><td>Path:</td><td>' . s($structure->getPath()) . '</td></tr>';
                 $o.= '      <tr valign="top"><td>Version:</td><td>' . s($structure->getVersion()) . '</td></tr>';
@@ -125,15 +127,15 @@ class edit_xml_file extends XMLDBAction {
                     $b .= '&nbsp;[' . $this->str['viewedited'] . ']';
                 }
             /// The new table button
-                $b .= '&nbsp;<a href="index.php?action=new_table&amp;postaction=edit_table&amp;table=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtable'] . ']</a>';
+                $b .= '&nbsp;<a href="index.php?action=new_table&amp;sesskey=' . sesskey() . '&amp;postaction=edit_table&amp;table=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtable'] . ']</a>';
             /// The new from MySQL button
                 if ($CFG->dbfamily == 'mysql') {
-                    $b .= '&nbsp;<a href="index.php?action=new_table_from_mysql&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtablefrommysql'] . ']</a>';
+                    $b .= '&nbsp;<a href="index.php?action=new_table_from_mysql&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtablefrommysql'] . ']</a>';
                 } else {
                     $b .= '&nbsp;[' . $this->str['newtablefrommysql'] . ']';
                 }
             /// The new statement button
-                $b .= '&nbsp;<a href="index.php?action=new_statement&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newstatement'] . ']</a>';
+                $b .= '&nbsp;<a href="index.php?action=new_statement&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newstatement'] . ']</a>';
             /// The back to main menu button
                 $b .= '&nbsp;<a href="index.php?action=main_view#lastused">[' . $this->str['backtomainview'] . ']</a>';
                 $b .= '</p>';
@@ -169,14 +171,14 @@ class edit_xml_file extends XMLDBAction {
                         $b .= '</td><td class="button cell">';
                     /// The up button
                         if ($table->getPrevious()) {
-                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=up&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['up'] . ']';
                         }
                         $b .= '</td><td class="button cell">';
                     /// The down button
                         if ($table->getNext()) {
-                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=down&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['down'] . ']';
                         }
@@ -185,7 +187,7 @@ class edit_xml_file extends XMLDBAction {
                         if (count($tables) > 1 &&
                             !$structure->getTableUses($table->getName())) {
                             ///!$structure->getTableUses($table->getName())) {
-                            $b .= '<a href="index.php?action=delete_table&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                            $b .= '<a href="index.php?action=delete_table&amp;sesskey=' . sesskey() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['delete'] . ']';
                         }
@@ -214,20 +216,20 @@ class edit_xml_file extends XMLDBAction {
                         $b .= '</td><td class="button cell">';
                     /// The up button
                         if ($statement->getPrevious()) {
-                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=up&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['up'] . ']';
                         }
                         $b .= '</td><td class="button cell">';
                     /// The down button
                         if ($statement->getNext()) {
-                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=down&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['down'] . ']';
                         }
                         $b .= '</td><td class="button cell">';
                     /// The delete button
-                        $b .= '<a href="index.php?action=delete_statement&amp;statement=' . $statement->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                        $b .= '<a href="index.php?action=delete_statement&amp;sesskey=' . sesskey() . '&amp;statement=' . $statement->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                         $b .= '</td>';
                     /// Print statement row
                         $o .= '<tr class="r' . $row . '"><td class="statement cell"><a href="index.php?action=view_statement_xml&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;statement=' . $statement->getName() . '&amp;select=edited">' . $statement->getName() . '</a>' . $b . '</tr>';

admin/xmldb/actions/get_db_directories/get_db_directories.class.php

@@ -39,6 +39,7 @@ class get_db_directories extends XMLDBAction {
         //$this->can_subaction = ACTION_HAVE_SUBACTIONS;
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/load_xml_file/load_xml_file.class.php

@@ -38,6 +38,7 @@ class load_xml_file extends XMLDBAction {
         //$this->can_subaction = ACTION_HAVE_SUBACTIONS;
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/main_view/main_view.class.php

@@ -35,6 +35,7 @@ class main_view extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -84,9 +85,9 @@ class main_view extends XMLDBAction {
     /// The reserved_words button
         $b .= '&nbsp;<a href="index.php?action=view_reserved_words">[' . $this->str['reservedwords'] . ']</a>';
     /// The test button
-        $b .= '&nbsp;<a href="index.php?action=test">[' . $this->str['test'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=test&amp;sesskey=' . sesskey() . '">[' . $this->str['test'] . ']</a>';
     /// The check indexes button
-        $b .= '&nbsp;<a href="index.php?action=check_indexes">[' . $this->str['checkindexes'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=check_indexes&amp;sesskey=' . sesskey() . '">[' . $this->str['checkindexes'] . ']</a>';
         $b .= '</p>';
     /// Send buttons to output
         $o .= $b;
@@ -126,7 +127,7 @@ class main_view extends XMLDBAction {
                 if ($dbdir->path_exists &&
                     !file_exists($key . '/install.xml') &&
                     is_writeable($key)) {
-                    $b .= '<a href="index.php?action=create_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['create'] . ']</a>';
+                    $b .= '<a href="index.php?action=create_xml_file&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['create'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['create'] . ']';
                 }
@@ -159,7 +160,7 @@ class main_view extends XMLDBAction {
                     is_writeable($key) &&
                     !empty($dbdir->xml_loaded) &&
                     !empty($dbdir->xml_changed)) {
-                    $b .= '<a href="index.php?action=save_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['save'] . ']</a>';
+                    $b .= '<a href="index.php?action=save_xml_file&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['save'] . ']</a>';
                 /// Check if the file has been manually edited while being modified in the editor
                     if ($dbdir->filemtime != filemtime($key . '/install.xml')) {
                     /// File manually modified. Add to errors.
@@ -178,7 +179,7 @@ class main_view extends XMLDBAction {
                     is_writeable($key) &&
                     !empty($dbdir->xml_loaded) &&
                     !empty($dbdir->xml_changed)) {
-                    $b .= '<a href="index.php?action=revert_changes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['revert'] . ']</a>';
+                    $b .= '<a href="index.php?action=revert_changes&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['revert'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['revert'] . ']';
                 }
@@ -200,7 +201,7 @@ class main_view extends XMLDBAction {
                     is_readable($key . '/install.xml') &&
                     is_writeable($key) &&
                     empty($dbdir->xml_loaded)) {
-                    $b .= '<a href="index.php?action=delete_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_xml_file&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['delete'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['delete'] . ']';
                 }

admin/xmldb/actions/new_statement/new_statement.class.php

@@ -107,6 +107,7 @@ class new_statement extends XMLDBAction {
             $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
             $o.= '    <input type="hidden" name ="action" value="new_statement" />';
             $o.= '    <input type="hidden" name ="postaction" value="edit_statement" />';
+            $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() . '" />';
             $o.= '    <table id="formelements" class="boxaligncenter" cellpadding="5">';
             $o.= '      <tr><td><label for="type" accesskey="t">' . $this->str['statementtype'] .' </label>' . choose_from_menu($typeoptions, 'type', '', 'choose', '', 0, true) . '<label for="table" accesskey="a">' . $this->str['statementtable'] . ' </label>' .choose_from_menu($selecttables, 'table', '', 'choose', '', 0, true) . '</td></tr>';
             $o.= '      <tr><td colspan="2" align="center"><input type="submit" value="' .$this->str['create'] . '" /></td></tr>';

admin/xmldb/actions/new_table_from_mysql/new_table_from_mysql.class.php

@@ -111,6 +111,7 @@ class new_table_from_mysql extends XMLDBAction {
             $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
             $o.= '    <input type="hidden" name ="action" value="new_table_from_mysql" />';
             $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
+            $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() . '" />';
             $o.= '    <table id="formelements" class="boxaligncenter" cellpadding="5">';
             $o.= '      <tr><td><label for="table" accesskey="t">' . $this->str['createtable'] .' </label>' . choose_from_menu($selecttables, 'table', '', 'choose', '', 0, true) . '<label for="after" accesskey="a">' . $this->str['aftertable'] . ' </label>' .choose_from_menu($aftertables, 'after', '', 'choose', '', 0, true) . '</td></tr>';
             $o.= '      <tr><td colspan="2" align="center"><input type="submit" value="' .$this->str['create'] . '" /></td></tr>';

admin/xmldb/actions/revert_changes/revert_changes.class.php

@@ -75,7 +75,7 @@ class revert_changes extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmrevertchanges'] . '<br /><br />' . $dirpath . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=revert_changes&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=revert_changes&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/test/test.class.php

@@ -955,6 +955,20 @@ class test extends XMLDBAction {
 
         $this->output = $o;
 
+    /// Finally drop all the potentially existing test tables
+        $table = new XMLDBTable('testtable');
+        if (table_exists($table)) {
+            $status = drop_table($table, true, false);
+        }
+        $table = new XMLDBTable ('anothertest');
+        if (table_exists($table)) {
+            $status = drop_table($table, true, false);
+        }
+        $table = new XMLDBTable ('newnameforthetable');
+        if (table_exists($table)) {
+            $status = drop_table($table, true, false);
+        }
+
     /// Launch postaction if exists (leave this here!)
         if ($this->getPostAction() && $result) {
             return $this->launch($this->getPostAction());

admin/xmldb/actions/unload_xml_file/unload_xml_file.class.php

@@ -35,6 +35,7 @@ class unload_xml_file extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_field_xml/view_field_xml.class.php

@@ -35,6 +35,7 @@ class view_field_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_index_xml/view_index_xml.class.php

@@ -35,6 +35,7 @@ class view_index_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_key_xml/view_key_xml.class.php

@@ -35,6 +35,7 @@ class view_key_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_reserved_words/view_reserved_words.class.php

@@ -38,6 +38,7 @@ class view_reserved_words extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+    $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_statement_xml/view_statement_xml.class.php

@@ -35,6 +35,7 @@ class view_statement_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_structure_php/view_structure_php.class.php

@@ -36,6 +36,7 @@ class view_structure_php extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_structure_sql/view_structure_sql.class.php

@@ -36,6 +36,7 @@ class view_structure_sql extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_structure_xml/view_structure_xml.class.php

@@ -35,6 +35,7 @@ class view_structure_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_table_php/view_table_php.class.php

@@ -36,6 +36,7 @@ class view_table_php extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_table_sql/view_table_sql.class.php

@@ -36,6 +36,7 @@ class view_table_sql extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_table_xml/view_table_xml.class.php

@@ -35,6 +35,7 @@ class view_table_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_xml/view_xml.class.php

@@ -38,6 +38,7 @@ class view_xml extends XMLDBAction {
         //$this->can_subaction = ACTION_HAVE_SUBACTIONS;
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

auth/cas/auth.php

@@ -60,6 +60,11 @@ class auth_plugin_cas extends auth_plugin_base {
 		$this->connectCAS();
         return phpCAS::isAuthenticated() && (trim(moodle_strtolower(phpCAS::getUser())) == $username);
     }
+
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/db/auth.php

@@ -572,6 +572,13 @@ class auth_plugin_db extends auth_plugin_base {
         }
     }
 
+    function prevent_local_passwords() {
+        if (!isset($this->config->passtype)) {
+            return false;
+        }
+        return ($this->config->passtype != 'internal');
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/email/auth.php

@@ -132,6 +132,10 @@ class auth_plugin_email extends auth_plugin_base {
         }
     }
 
+    function prevent_local_passwords() {
+        return false;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/fc/auth.php

@@ -144,6 +144,10 @@ class auth_plugin_fc extends auth_plugin_base {
         return false;
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/imap/auth.php

@@ -81,6 +81,10 @@ class auth_plugin_imap extends auth_plugin_base {
         return false;  // No match
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/ldap/auth.php

@@ -1607,6 +1607,10 @@ class auth_plugin_ldap extends auth_plugin_base {
         return ($fresult);
     }
 
+    function prevent_local_passwords() {
+        return !empty($this->config->preventpassindb);
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/ldap/config.html

@@ -16,7 +16,7 @@
     if (!isset($config->opt_deref))
         { $config->opt_deref = LDAP_DEREF_NEVER; }
     if (!isset($config->preventpassindb))
-        { $config->preventpassindb = 0; }
+        { $config->preventpassindb = 1; }
     if (!isset($config->bind_dn))
         {$config->bind_dn = ''; }
     if (!isset($config->bind_pw))

auth/manual/auth.php

@@ -62,6 +62,10 @@ class auth_plugin_manual extends auth_plugin_base {
         return update_internal_user_password($user, $newpassword);
     }
 
+    function prevent_local_passwords() {
+        return false;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/mnet/auth.php

@@ -590,6 +590,10 @@ class auth_plugin_mnet extends auth_plugin_base {
         delete_records_select('mnet_enrol_assignments', $whereclause);
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/nntp/auth.php

@@ -64,6 +64,10 @@ class auth_plugin_nntp extends auth_plugin_base {
         return false;
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/nologin/auth.php

@@ -46,6 +46,11 @@ class auth_plugin_nologin extends auth_plugin_base {
         return false;
     }
 
+    function prevent_local_passwords() {
+        // just in case, we do not want to loose the passwords
+        return false;
+    }
+
     /**
      * No external data sync.
      *

auth/none/auth.php

@@ -62,6 +62,10 @@ class auth_plugin_none extends auth_plugin_base {
         return update_internal_user_password($user, $newpassword);
     }
 
+    function prevent_local_passwords() {
+        return false;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/pam/auth.php

@@ -77,6 +77,10 @@ class auth_plugin_pam extends auth_plugin_base {
         }
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/pop3/auth.php

@@ -81,6 +81,10 @@ class auth_plugin_pop3 extends auth_plugin_base {
         return false;  // No matches found
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/radius/auth.php

@@ -80,6 +80,10 @@ class auth_plugin_radius extends auth_plugin_base {
         $rauth->close();
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/shibboleth/auth.php

@@ -134,6 +134,10 @@ class auth_plugin_shibboleth extends auth_plugin_base {
         return $moodleattributes;
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

backup/backup.php

@@ -115,7 +115,7 @@
     raise_memory_limit("192M");
 
     //Call the form, depending the step we are
-    if (!$launch) {
+    if (!$launch or !data_submitted() or !confirm_sesskey()) {
         // if we're at the start, clear the cache of prefs
         if (isset($SESSION->backupprefs[$course->id])) {
             unset($SESSION->backupprefs[$course->id]);

backup/backup_check.html

@@ -4,6 +4,9 @@
     //Check login   
     require_login();
 
+    // Init backupuserinfo
+    $backupuserinfo = false;
+
     if (!empty($course->id)) {
         if (!has_capability('moodle/site:backup', get_context_instance(CONTEXT_COURSE, $course->id))) {
             if (empty($to)) {
@@ -14,10 +17,12 @@
                 }
             }
         }
+        $backupuserinfo = has_capability('moodle/backup:userinfo', get_context_instance(CONTEXT_COURSE, $course->id));
     } else {
         if (!has_capability('moodle/site:backup', get_context_instance(CONTEXT_SYSTEM, SITEID))) {
             error("You need to be an admin user to use this page.", "$CFG->wwwroot/login/index.php");
         }
+        $backupuserinfo = has_capability('moodle/backup:userinfo', get_context_instance(CONTEXT_SYSTEM));
     }
 
     
@@ -38,6 +43,7 @@
 <form id="form" method="post" action="backup.php">
 <table cellpadding="5" style="text-align:center;margin-left:auto;margin-right:auto">
 <?php
+    echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
 
     if (empty($to)) {
         //Now print the Backup Name tr
@@ -58,6 +64,16 @@
 
     }
 
+    // Re-enforce 'moodle/site:backup' at system context to be able to backup all users
+    if ($backupprefs->backup_users == 0 and !has_capability('moodle/site:backup', get_context_instance(CONTEXT_SYSTEM))) {
+        $backupprefs->backup_users = 1; // users => course
+    }
+
+    // Re-enforce moodle/backup:userinfo capability
+    if (!$backupuserinfo) {
+        $backupprefs->backup_users = 2; // users => none
+    }
+
     //Here we check if backup_users = None. Then, we switch off every module
     //user info, user_files, logs and exercises, workshop and messages backups. A Warning is showed to
     //inform the user.

backup/backup_form.html

@@ -4,6 +4,9 @@
     //Check login   
     require_login();
 
+    //Init backupuserinfo
+    $backupuserinfo = false;
+
     if (!empty($course->id)) {
         if (!has_capability('moodle/site:backup', get_context_instance(CONTEXT_COURSE, $course->id))) {
             if (empty($to)) {
@@ -14,10 +17,12 @@
                 }
             }
         }
+        $backupuserinfo = has_capability('moodle/backup:userinfo', get_context_instance(CONTEXT_COURSE, $course->id));
     } else {
         if (!has_capability('moodle/site:backup', get_context_instance(CONTEXT_SYSTEM, SITEID))) {
             error("You need to be an admin user to use this page.", "$CFG->wwwroot/login/index.php");
         }
+        $backupuserinfo = has_capability('moodle/backup:userinfo', get_context_instance(CONTEXT_SYSTEM));
     }
 
     //Check site
@@ -115,6 +120,8 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
 <form id="form1" method="post" action="backup.php">
 <table cellpadding="5" style="margin-left:auto;margin-right:auto;">
 <?php
+    echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
+
 /// Acummulator for hidden options and proper XHTML output
     $hidden_options = '';
     //Now, check modules and info and show posibilities
@@ -127,12 +134,16 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_', true);\">". get_string("all")."</a>/";
         echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_', false);\">".  get_string("none")."</a>";
         echo "</td>";
-        echo "<td align=\"right\">";
-        echo '<b>&nbsp;</b>';
-        echo "</td><td>";
-        echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_user_info_', true);\">". get_string("all")."</a>/";
-        echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_user_info_', false);\">". get_string("none")."</a>";
-        echo "</td>";
+        if (empty($to) and $backupuserinfo) {
+            echo "<td align=\"right\">";
+            echo '<b>&nbsp;</b>';
+            echo "</td><td>";
+            echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_user_info_', true);\">". get_string("all")."</a>/";
+            echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_user_info_', false);\">". get_string("none")."</a>";
+            echo "</td>";
+        } else {
+            echo "<td colspan=\"2\">&nbsp;</td>";
+        }
         echo "</tr>";
         echo "<tr><td colspan=\"4\"><hr /></td></tr>";
         $currentrow = 0;
@@ -155,8 +166,8 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
                 echo "</td><td align=\"right\">&nbsp;";
                 echo "</td><td>";
                 $var = "backup_user_info_".$modname;
-                if (empty($to)) {
-                    $backup_user_options[0] = get_string("withoutuserdata"); 
+                if (empty($to) and $backupuserinfo) {
+                    $backup_user_options[0] = get_string("withoutuserdata");
                     $backup_user_options[1] = get_string("withuserdata");
                     //choose_from_menu($backup_user_options, $var, $$var, "");
                     print_checkbox($var, $$var, $$var, get_string("userdata"),'','selectItemInCheckboxByName(\'form1\',\'backup_user_info_'.$modname.'\',this.checked)');
@@ -177,7 +188,7 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
                         echo '</td><td align="right">&nbsp;';
                         $var = 'backup_user_info_'.$modname.'_instance_'.$instance->id;
                         $$var = optional_param($var,1);
-                        if (empty($to)) {
+                        if (empty($to) and $backupuserinfo) {
                             print_checkbox($var,$$var,$$var,get_string('userdata'),'','this.form.elements[\'backup_user_info_'.$modname.'\'].checked=1;');
                         } else {
                             echo '<input type="hidden" name="'.$var.'" value="0" />';
@@ -207,23 +218,25 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
             $hidden_options .= '<input type="hidden" name="backup_metacourse" value="0" />';
         }
 
-        if (empty($to)) {
+        if (empty($to) and $backupuserinfo) {
             //Now print the Users tr
             echo "<tr>";
             echo "<td align=\"right\" colspan=\"2\"><b>";
             echo get_string("users").":";
             echo "</b></td><td colspan=\"2\">";
-            $user_options[0] = get_string("all");
+            if (has_capability('moodle/site:backup', get_context_instance(CONTEXT_SYSTEM))) {
+                $user_options[0] = get_string("all");
+            }
             $user_options[1] = get_string("course");
             $user_options[2] = get_string("none");
             choose_from_menu($user_options, "backup_users", $backup_users, "");
             echo "</td></tr>";
         }
         else {
-            $hidden_options .= '<input type="hidden" name="backup_users" value="0" />';
+            $hidden_options .= '<input type="hidden" name="backup_users" value="2" />';
         }
-        
-        if (empty($to)) {
+
+        if (empty($to) and $backupuserinfo) {
             //Now print the Logs tr
             echo "<tr>";
             echo "<td align=\"right\" colspan=\"2\"><b>";
@@ -237,8 +250,8 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         else {
             $hidden_options .= '<input type="hidden" name="backup_logs" value="0" />';
         }
- 
-        if (empty($to)) {
+
+        if (empty($to) and $backupuserinfo) {
             //Now print the User Files tr
             echo "<tr>";
             echo "<td align=\"right\" colspan=\"2\"><b>";
@@ -262,7 +275,7 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         choose_from_menu($course_file_options, "backup_course_files", $backup_course_files, "");
         echo "</td></tr>";
 
-        if (empty($to) && $course->id == SITEID) {
+        if (empty($to) and $backupuserinfo and $course->id == SITEID) {
             //If we are in a SITEID backup print the Messages tr
             echo "<tr>";
             echo "<td align=\"right\" colspan=\"2\"><b>";

backup/backuplib.php

@@ -82,8 +82,8 @@
 
     //Returns every needed user (participant) in a course
     //It uses the xxxx_get_participants() function
-    //plus users needed to backup scales.
-    //WARNING: It returns only NEEDED users, not every 
+    //plus users needed to backup messages
+    //WARNING: It returns only NEEDED users, not every
     //   every student and teacher in the course, so it
     //must be merged with backup_get_enrrolled_users !!
 
@@ -119,21 +119,6 @@
             }
         }
 
-        //Now, add scale users (from site and course scales)
-        //Get users
-        $scaleusers = get_records_sql("SELECT DISTINCT userid,userid
-                                       FROM {$CFG->prefix}scale
-                                       WHERE courseid = '0' or courseid = '$courseid'");
-        //Add scale users to results
-        if ($scaleusers) {
-            foreach ($scaleusers as $scaleuser) {
-                //If userid != 0
-                if ($scaleuser->userid != 0) {
-                    $result[$scaleuser->userid]->id = $scaleuser->userid;
-                }
-            }
-        }
-
         //Now, add message users if necessary
         if ($includemessages) {
             include_once("$CFG->dirroot/message/lib.php");
@@ -163,7 +148,7 @@
         // get all users with moodle/course:view capability, this will include people
         // assigned at cat level, or site level
         // but it should be ok if they have no direct assignment at course, mod, block level
-        return get_users_by_capability(get_context_instance(CONTEXT_COURSE, $courseid), 'moodle/course:view');
+        return get_users_by_capability(get_context_instance(CONTEXT_COURSE, $courseid), 'moodle/course:view', '', '', '', '', '', '', false);
     }
 
     //Returns all users ids (every record in users table)
@@ -1102,7 +1087,11 @@
                 fwrite ($bf,full_tag("POLICYAGREED",4,false,$user->policyagreed));
                 fwrite ($bf,full_tag("DELETED",4,false,$user->deleted));
                 fwrite ($bf,full_tag("USERNAME",4,false,$user->username));
-                fwrite ($bf,full_tag("PASSWORD",4,false,$user->password));
+                // Prevent user passwords in backup files unless
+                // $CFG->includeuserpasswordsinbackup is defined. MDL-20838
+                if (!empty($CFG->includeuserpasswordsinbackup)) {
+                    fwrite ($bf,full_tag("PASSWORD",4,false,$user->password));
+                }
                 fwrite ($bf,full_tag("IDNUMBER",4,false,$user->idnumber));
                 fwrite ($bf,full_tag("FIRSTNAME",4,false,$user->firstname));
                 fwrite ($bf,full_tag("LASTNAME",4,false,$user->lastname));
@@ -1128,7 +1117,6 @@
                 fwrite ($bf,full_tag("LASTLOGIN",4,false,$user->lastlogin));
                 fwrite ($bf,full_tag("CURRENTLOGIN",4,false,$user->currentlogin));
                 fwrite ($bf,full_tag("LASTIP",4,false,$user->lastip));
-                fwrite ($bf,full_tag("SECRET",4,false,$user->secret));
                 fwrite ($bf,full_tag("PICTURE",4,false,$user->picture));
                 fwrite ($bf,full_tag("URL",4,false,$user->url));
                 fwrite ($bf,full_tag("DESCRIPTION",4,false,$user->description));

backup/restore.php

@@ -144,6 +144,7 @@
         if (!empty($SESSION->restore->importing)) {
             // set up all the config stuff and skip asking the user about it.
             restore_setup_for_check($SESSION->restore,$backup_unique_code);
+            require_sesskey();
             include_once("restore_execute.html");
         } else {
             include_once("restore_form.html");
@@ -159,6 +160,7 @@
         }
         //Unset this for the future
         unset($SESSION->cancontinue);
+        require_sesskey();
         include_once("restore_execute.html");
     }
     print_simple_box_end();

backup/restore_check.html

@@ -18,8 +18,8 @@
 
     if ($form1 = data_submitted()) {
         $currentcourseshortname = $course_header->course_shortname; //"store_ShortName";
-        $course_header->course_shortname =  stripslashes_safe($form1->shortname);  //"update_ShortName";    
-        $course_header->course_fullname =   stripslashes_safe($form1->fullname);   //"update_FullName";  
+        $course_header->course_shortname = !empty($form1->shortname) ? stripslashes_safe($form1->shortname) : '';  //"update_ShortName";
+        $course_header->course_fullname  = !empty($form1->fullname) ? stripslashes_safe($form1->fullname) : '';   //"update_FullName"
     /// Roll dates only if the backup course has a start date
     /// (some formats like main page, social..., haven't it and rolling dates
     /// from 0 produces crazy dates. MDL-10125 and we have passed some custom startyear/month/day. MDL-12922
@@ -176,15 +176,21 @@
     //Check login
     require_login();
 
+    //Init restoreuserinfo
+    $restoreuserinfo = false;
+
+
     //Check admin
     if (!empty($id)) {
         if (!has_capability('moodle/site:restore', get_context_instance(CONTEXT_COURSE, $id))) {
             error("You need to be a teacher or admin user to use this page.", "$CFG->wwwroot/login/index.php");
         }
+        $restoreuserinfo = has_capability('moodle/restore:userinfo', get_context_instance(CONTEXT_COURSE, $id));
     } else {
         if (!has_capability('moodle/site:restore', get_context_instance(CONTEXT_SYSTEM, SITEID))) {
             error("You need to be an admin user to use this page.", "$CFG->wwwroot/login/index.php");
         }
+        $restoreuserinfo = has_capability('moodle/restore:userinfo', get_context_instance(CONTEXT_SYSTEM));
     }
 
     //Check site
@@ -275,6 +281,38 @@
                 $restore->users = 1;
             }
         }
+
+        // Re-enforce 'moodle/site:restore' at system context to be able to restore all users
+        if ($restore->users == 0 and !has_capability('moodle/site:restore', get_context_instance(CONTEXT_SYSTEM))) {
+            $restore->users = 1; // users => course
+        }
+
+        // Re-enforce moodle/restore:userinfo capability
+        if (!$restoreuserinfo) {
+            $userinfocheck = true;
+            // Confirm that all the settings are properly set to no users
+            // if anything is wrong, message and stop
+            // First global settings
+            if ($restore->users != 2 or $restore->user_files or $restore->messages) {
+                $userinfocheck = false;
+
+            // Now all modules userinfo flag
+            } else {
+                $mods = $restore->mods;
+                foreach ($mods as $mod) {
+                    if ($mod->userinfo) {
+                        $userinfocheck = false;
+                    }
+                }
+            }
+
+            if (!$userinfocheck) { // Something was wrong
+                echo get_string ('restoreuserinfofailed');
+                echo "<hr noshade size=\"1\">";
+                $show_continue_button = false;
+            }
+        }
+
         //Save the restore session object
         $SESSION->restore = $restore;
         if ($show_continue_button) {
@@ -284,6 +322,7 @@
             $hidden["launch"]             = "execute";
             $hidden["file"]               =  $file;
             $hidden["id"]                 =  $id;
+            $hidden["sesskey"]            =  sesskey();
             print_string('longtimewarning','admin');
 
             if ($restore->users && !empty($info->mnet_externalusers) 

backup/restore_form.html

@@ -21,15 +21,20 @@
     //Check login
     require_login();
 
+    //Init restoreuserinfo
+    $restoreuserinfo = false;
+
     //Check admin
     if (!empty($id)) {
         if (!has_capability('moodle/site:restore', get_context_instance(CONTEXT_COURSE, $id))) {
             error("You need to be a teacher or admin user to use this page.", "$CFG->wwwroot/login/index.php");
         }
+        $restoreuserinfo = has_capability('moodle/restore:userinfo', get_context_instance(CONTEXT_COURSE, $id));
     } else {
         if (!has_capability('moodle/site:restore', get_context_instance(CONTEXT_SYSTEM, SITEID))) {
             error("You need to be an admin user to use this page.", "$CFG->wwwroot/login/index.php");   
         }
+        $restoreuserinfo = has_capability('moodle/restore:userinfo', get_context_instance(CONTEXT_SYSTEM));
     }
 
     //Check site
@@ -60,8 +65,10 @@
             }
             //Check include user info
             $var = "restore_user_info_".$modname;
-            if (!isset($$var)) {
+            if (!isset($$var) && $restoreuserinfo) {
                 $$var = 1;
+            } else {
+                $$var = 0;
             }
         }
     }
@@ -274,14 +281,18 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'restore_', false);\">".
              get_string("none")."</a>";
         echo "</td>";
-        echo "<td align=\"right\">";
-        echo '<b>&nbsp;</b>';
-        echo "</td><td>";
-        echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'restore_user_info_', true);\">".
-             get_string("all")."</a>/";
-        echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'restore_user_info_', false);\">".
-             get_string("none")."</a>";
-        echo "</td>";
+        if ($restoreuserinfo) {
+            echo "<td align=\"right\">";
+            echo '<b>&nbsp;</b>';
+            echo "</td><td>";
+            echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'restore_user_info_', true);\">".
+                 get_string("all")."</a>/";
+            echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'restore_user_info_', false);\">".
+                 get_string("none")."</a>";
+            echo "</td>";
+        } else {
+            echo "<td colspan=\"2\">&nbsp;</td>";
+        }
         echo "</tr>";
         echo "<tr><td colspan=\"4\"><hr /></td></tr>";
         $currentrow = 0;
@@ -311,7 +322,7 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
                         //without user data
                         echo "</td><td align=\"right\">&nbsp;";
                         echo "</td><td>";
-                        if ($info->mods[$modname]->userinfo == "true") {
+                        if ($info->mods[$modname]->userinfo == "true" && $restoreuserinfo) {
                             $restore_user_options[1] = get_string("yes");
                             $restore_user_options[0] = get_string("no"); 
                             //choose_from_menu($restore_user_options, $user_info_var, $$user_info_var, "");
@@ -336,7 +347,7 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
                                 echo '</td><td align="right">&nbsp;';
                                 $var = 'restore_user_info_'.$modname.'_instance_'.$instance->id;
                                 $$var = optional_param($var,1);
-                                if ($info->mods[$modname]->instances[$instance->id]->userinfo == 'true') {
+                                if (!empty($info->mods[$modname]->instances) && ($info->mods[$modname]->instances[$instance->id]->userinfo == 'true') && $restoreuserinfo) {
                                     print_checkbox($var,$$var,$$var,get_string('userdata'),'','this.form.elements[\'restore_user_info_'.$modname.'\'].checked=1;');
                                 } else {
                                     echo '<input type="hidden" name="'.$var.'" value="0" />';
@@ -386,9 +397,10 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         echo get_string("users").":";
         echo "</b></td><td colspan=\"2\">";
         //If some user is present in the backup file
-        if ($info->backup_users == "all" or $info->backup_users == "course") {
-            //If all users are in the backup file
-            if ($info->backup_users == "all") {
+        if (($info->backup_users == "all" or $info->backup_users == "course") and $restoreuserinfo) {
+            $user_options = array();
+            //If all users are in the backup file and user has 'moodle/site:restore' at system level
+            if ($info->backup_users == "all" and has_capability('moodle/site:restore', get_context_instance(CONTEXT_SYSTEM))) {
                 $user_options[0] = get_string("all");
             }
             $user_options[1] = get_string("course");
@@ -407,7 +419,8 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         echo get_string("logs").":";                                               
         echo "</b></td><td colspan=\"2\">";
         //If logs are in the backup file, show menu, else fixed to no
-        if ($info->backup_logs == "true") {
+        if ($info->backup_logs == "true" and $restoreuserinfo) {
+            $log_options = array();
             $log_options[0] = get_string("no");
             $log_options[1] = get_string("yes"); 
             choose_from_menu($log_options, "restore_logs", $restore_logs, ""); 
@@ -423,9 +436,10 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         echo get_string ("userfiles").":";
         echo "</b></td><td colspan=\"2\">";
         //If user files are in the backup file, show menu, else fixed to no
-        if ($info->backup_user_files == "true") {
-            $user_file_options[0] = get_string("no"); 
-            $user_file_options[1] = get_string("yes"); 
+        if ($info->backup_user_files == "true" and $restoreuserinfo) {
+            $user_file_options = array();
+            $user_file_options[0] = get_string("no");
+            $user_file_options[1] = get_string("yes");
             choose_from_menu($user_file_options, "restore_user_files", $restore_user_files, "");
         } else {
             echo get_string("no");
@@ -454,11 +468,10 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         //Now print the Messages tr
         echo "<tr>";
         echo "<td align=\"right\" colspan=\"2\"><b>";
-        
         //This tr is slighty different. Everything becomes hidden if
         //we haven't messages is the backup, to avoid confusions to users.
         //If messages are in the backup file, show menu, else fixed to no and show nothing
-        if ($info->backup_messages == "true") {
+        if (isset($info->backup_messages) && $info->backup_messages == "true" && !empty($CFG->messaging) and $restoreuserinfo) {
             echo get_string ('messages','message').":";
             echo "</b></td><td colspan=\"2\">";
             $message_options[0] = get_string("no");
@@ -475,104 +488,106 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
 
 <hr/>
 <?php
+// Only show the roles mapping if restore of user info is allowed
+if ($restoreuserinfo) {
+    print_heading(get_string('rolemappings'));
+    $xml_file  = $CFG->dataroot."/temp/backup/".$backup_unique_code."/moodle.xml";
 
-print_heading(get_string('rolemappings'));
-$xml_file  = $CFG->dataroot."/temp/backup/".$backup_unique_code."/moodle.xml";
+    $info = restore_read_xml_info($xml_file);
 
-$info = restore_read_xml_info($xml_file);
+    // fix for MDL-9068, front page course is just a normal course
+    $siterolesarray = get_assignable_roles (get_context_instance(CONTEXT_COURSE, $course->id), "shortname");
+    $siterolesnamearray = get_assignable_roles (get_context_instance(CONTEXT_COURSE, $course->id), "name");
+    $allroles = get_records('role');
 
-// fix for MDL-9068, front page course is just a normal course
-$siterolesarray = get_assignable_roles (get_context_instance(CONTEXT_COURSE, $course->id), "shortname");
-$siterolesnamearray = get_assignable_roles (get_context_instance(CONTEXT_COURSE, $course->id), "name");
-$allroles = get_records('role');
+    echo ('<table width="100%" class="restore-form-instances">');
+    echo ('<tr><td align="right" style="width:50%"><b>'.get_string('sourcerole').'</b></td><td align="left" style="width:50%"><b>'.get_string('targetrole').'</b></td></tr>');
 
-echo ('<table width="100%" class="restore-form-instances">');
-echo ('<tr><td align="right" style="width:50%"><b>'.get_string('sourcerole').'</b></td><td align="left" style="width:50%"><b>'.get_string('targetrole').'</b></td></tr>');
+    if ($info->backup_moodle_version < 2006092801) {
+        // 1.6 and below backup
 
-if ($info->backup_moodle_version < 2006092801) {
-    // 1.6 and below backup
-    
-    /// Editting teacher
-    echo ('<tr><td align="right">');
-    print_string('defaultcourseteacher');
-    echo ('</td><td algin="left">');
-    
-    // get the first teacheredit legacy
-    $roles = get_roles_with_capability('moodle/legacy:editingteacher', CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM, SITEID));
+        /// Editting teacher
+        echo ('<tr><td align="right">');
+        echo '<label for="menudefaultteacheredit">'.get_string ('defaultcourseteacher').'</label>';
+        echo ('</td><td algin="left">');
 
-    $editteacher = array_shift($roles);
-    choose_from_menu ($siterolesarray, "defaultteacheredit", $editteacher->id, 'new role', '', '0');
-    echo ('</td></tr>');
-    
-    /// Non-editting teacher
-    echo ('<tr><td align="right">');
-    print_string('noneditingteacher');
-    echo ('</td><td algin="left">');
-    
-    // get the first teacheredit legacy
-    $roles = get_roles_with_capability('moodle/legacy:teacher', CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM, SITEID));
-    $teacher = array_shift($roles);
-    
-    choose_from_menu ($siterolesarray, "defaultteacher", $teacher->id, 'new role', '', '0');
-    echo ('</td></tr>');
-     
-    
-    /// Student
-    echo ('<tr><td align="right">');
-    print_string('defaultcoursestudent');
-    echo ('</td><td algin="left">');
-    
-    // get the first teacheredit legacy
-    $roles = get_roles_with_capability('moodle/legacy:student', CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM, SITEID));
-    $studentrole = array_shift($roles);
-    
-    choose_from_menu ($siterolesarray, "defaultstudent", $studentrole->id, 'new role', '', '0');
-    echo ('</td></tr>');
-  
-} else {
-    // 1.7 and above backup
-    $roles = restore_read_xml_roles($xml_file);
-    
-    if (!empty($roles->roles)) { // possible to have course with no roles
-        foreach ($siterolesarray as $siteroleid=>$siteroleshortname) {
-            $siteroleschoicearray[$siteroleid] = $siterolesnamearray[$siteroleid]." (". $siterolesarray[$siteroleid].")";
-        }
+        // get the first teacheredit legacy
+        $roles = get_roles_with_capability('moodle/legacy:editingteacher', CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM));
 
-        foreach ($roles->roles as $roleid=>$role) {
-         
-            $mappableroles = $siteroleschoicearray;
-         
-            echo ('<tr><td align="right">');
-            echo $role->name." (".($role->shortname).")";
-            echo ('</td><td align="left">');
+        $editteacher = reset($roles);
+        choose_from_menu ($siterolesarray, "defaultteacheredit", $editteacher->id, 'new role', '', '0');
+        echo ('</td></tr>');
 
-            /// first, we see if any exact role definition is found
-            /// if found, that is the only option of restoring to
-            
-            if ($samerole = restore_samerole($roleid, $role)) {
-                $matchrole = $samerole->id;
-                // if an exact role is found, it does not matter whether this user can assign this role or not,
-                // this will be presented as a valid option regardless
-                $mappableroles[$samerole->id] = $allroles[$samerole->id]->name." (". $allroles[$samerole->id]->shortname.")";
-            } else {
-                // no exact role found, let's try to match shortname
-                // this is useful in situations where basic roles differ slightly in definition
-                $matchrole = 0;
-                foreach ($siterolesarray as $siteroleid=>$siteroleshortname) {
-                    if ($siteroleshortname == $role->shortname) {
-                        $matchrole = $siteroleid;
-                        break;
+        /// Non-editting teacher
+        echo ('<tr><td align="right">');
+        echo '<label for="menudefaultteacher">'.get_string ('noneditingteacher').'</label>';
+        print_string('noneditingteacher');
+        echo ('</td><td algin="left">');
+
+        // get the first teacheredit legacy
+        $roles = get_roles_with_capability('moodle/legacy:teacher', CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM));
+        $teacher = reset($roles);
+
+        choose_from_menu ($siterolesarray, "defaultteacher", $teacher->id, 'new role', '', '0');
+        echo ('</td></tr>');
+
+
+        /// Student
+        echo ('<tr><td align="right">');
+        echo '<label for="menudefaultstudent">'.get_string ('defaultcoursestudent').'</label>';
+        echo ('</td><td algin="left">');
+
+        // get the first teacheredit legacy
+        $roles = get_roles_with_capability('moodle/legacy:student', CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM));
+        $studentrole = array_shift($roles);
+
+        choose_from_menu ($siterolesarray, "defaultstudent", $studentrole->id, 'new role', '', '0');
+        echo ('</td></tr>');
+
+    } else {
+        // 1.7 and above backup
+        $roles = restore_read_xml_roles($xml_file);
+
+        if (!empty($roles->roles)) { // possible to have course with no roles
+            foreach ($siterolesarray as $siteroleid=>$siteroleshortname) {
+                $siteroleschoicearray[$siteroleid] = $siterolesnamearray[$siteroleid]." (". $siterolesarray[$siteroleid].")";
+            }
+
+            foreach ($roles->roles as $roleid=>$role) {
+
+                $mappableroles = $siteroleschoicearray;
+
+                echo ('<tr><td align="right">');
+                echo '<label for="menuroles_'.$roleid.'">'.format_string($role->name)." (".($role->shortname).")".'</label>';
+                echo ('</td><td align="left">');
+
+                /// first, we see if any exact role definition is found
+                /// if found, that is the only option of restoring to
+
+                if ($samerole = restore_samerole($roleid, $role)) {
+                    $matchrole = $samerole->id;
+                    // if an exact role is found, it does not matter whether this user can assign this role or not,
+                    // this will be presented as a valid option regardless
+                    $mappableroles[$samerole->id] = format_string($allroles[$samerole->id]->name)." (". $allroles[$samerole->id]->shortname.")";
+                } else {
+                    // no exact role found, let's try to match shortname
+                    // this is useful in situations where basic roles differ slightly in definition
+                    $matchrole = 0;
+                    foreach ($siterolesarray as $siteroleid=>$siteroleshortname) {
+                        if ($siteroleshortname == $role->shortname) {
+                            $matchrole = $siteroleid;
+                            break;
+                        }
                     }
                 }
+                choose_from_menu ($mappableroles, "roles_".$roleid, $matchrole, 'new role', '', '0');
+                echo ('</td></tr>');
             }
-            choose_from_menu ($mappableroles, "roles_".$roleid, $matchrole, 'new role', '', '0');
-            echo ('</td></tr>');
         }
-    }
-    
-} // end else
 
-echo ('</table>'); // end of role mappings table
+    } // end else
+    echo ('</table>'); // end of role mappings table
+}
 
 ?>
 <br />
@@ -588,8 +603,10 @@ echo ('</table>'); // end of role mappings table
 
 <?php
 
-/* 
- * If there is a role with exactly the same definition, we pull it out from db
+/**
+ *
+ * @param integer $roleid the id that the role in the backup files had on the old server.
+ * @param object $role the rest of the definition of the role from the backup file.
  */
 function restore_samerole($roleid, $role) {
     global $CFG;

backup/restorelib.php

@@ -1544,6 +1544,8 @@
 
         global $CFG, $db;
 
+        $authcache = array(); // Cache to get some bits from authentication plugins
+
         $status = true;
         //Check it exists
         if (!file_exists($xml_file)) {
@@ -1677,16 +1679,46 @@
                     }
 
                     //We need to analyse the AUTH field to recode it:
-                    //   - if the field isn't set, we are in a pre 1.4 backup and we'll 
-                    //     use manual
-
-                    if (empty($user->auth)) {
+                    //   - if the field isn't set, we are in a pre 1.4 backup and $CFG->registerauth will decide
+                    //   - if the auth isn't enabled in target site, $CFG->registerauth will decide
+                    //   - finally, if the auth resulting isn't enabled, default to 'manual'
+                    if (empty($user->auth) || !is_enabled_auth($user->auth)) {
                         if ($CFG->registerauth == 'email') {
                             $user->auth = 'email';
                         } else {
                             $user->auth = 'manual';
                         }
                     }
+                    if (!is_enabled_auth($user->auth)) { // Final auth check verify, default to manual if not enabled
+                        $user->auth = 'manual';
+                    }
+
+                    // Now that we know the auth method, for users to be created without pass
+                    // if password handling is internal and reset password is available
+                    // we set the password to "restored" (plain text), so the login process
+                    // will know how to handle that situation in order to allow the user to
+                    // recover the password. MDL-20846
+                    if (empty($user->password)) { // Only if restore comes without password
+                        if (!array_key_exists($user->auth, $authcache)) { // Not in cache
+                            $userauth = new stdClass();
+                            $authplugin = get_auth_plugin($user->auth);
+                            $userauth->preventpassindb = $authplugin->prevent_local_passwords();
+                            $userauth->isinternal      = $authplugin->is_internal();
+                            $userauth->canresetpwd     = $authplugin->can_reset_password();
+                            $authcache[$user->auth] = $userauth;
+                        } else {
+                            $userauth = $authcache[$user->auth]; // Get from cache
+                        }
+
+                        // Most external plugins do not store passwords locally
+                        if (!empty($userauth->preventpassindb)) {
+                            $user->password = 'not cached';
+
+                        // If Moodle is responsible for storing/validating pwd and reset functionality is available, mark
+                        } else if ($userauth->isinternal and $userauth->canresetpwd) {
+                            $user->password = 'restored';
+                        }
+                    }
 
                     //We need to process the POLICYAGREED field to recalculate it:
                     //    - if the destination site is different (by wwwroot) reset it.
@@ -2157,7 +2189,7 @@
     //This function creates all the scales
     function restore_create_scales($restore,$xml_file) {
 
-        global $CFG, $db;
+        global $CFG, $USER, $db;
 
         $status = true;
         //Check it exists
@@ -2173,16 +2205,11 @@
         //Now, if we have anything in scales, we have to restore that
         //scales
         if ($scales) {
-            //Get admin->id for later use
-            $admin = get_admin();
-            $adminid = $admin->id;
             if ($scales !== true) {
                 //Iterate over each scale
                 foreach ($scales as $scale) {
                     //Get record from backup_ids
                     $data = backup_getid($restore->backup_unique_code,"scale",$scale->id);
-                    //Init variables
-                    $create_scale = false;
 
                     if ($data) {
                         //Now get completed xmlized object
@@ -2199,42 +2226,41 @@
                         $sca->description = backup_todb($info['SCALE']['#']['DESCRIPTION']['0']['#']);
                         $sca->timemodified = backup_todb($info['SCALE']['#']['TIMEMODIFIED']['0']['#']);
 
-                        //Now search if that scale exists (by scale field) in course 0 (Standar scale)
-                        //or in restore->course_id course (Personal scale)
-                        if ($sca->courseid == 0) {
-                            $course_to_search = 0;
-                        } else {
-                            $course_to_search = $restore->course_id;
-                        }
-                        $sca_db = get_record("scale","scale",$sca->scale,"courseid",$course_to_search);
-                        //If it doesn't exist, create
-                        if (!$sca_db) {
-                            $create_scale = true;
-                        } 
-                        //If we must create the scale
-                        if ($create_scale) {
-                            //Me must recode the courseid if it's <> 0 (common scale)
-                            if ($sca->courseid != 0) {
-                                $sca->courseid = $restore->course_id;
-                            }
-                            //We must recode the userid
+                        // Look for scale (by 'scale' both in standard (course=0) and current course
+                        // with priority to standard scales (ORDER clause)
+                        // scale is not course unique, use get_record_sql to suppress warning
+                        // Going to compare LOB columns so, use the cross-db sql_compare_text() in both sides.
+                        $compare_scale_clause = sql_compare_text('scale')  . "=" .  sql_compare_text("'" . $sca->scale . "'");
+                        // Scale doesn't exist, create it
+                        if (!$sca_db = get_record_sql("SELECT *
+                                                         FROM {$CFG->prefix}scale
+                                                        WHERE $compare_scale_clause
+                                                          AND courseid IN (0, $restore->course_id)
+                                                     ORDER BY courseid", true)) {
+
+                            // Try to recode the user field, defaulting to current user if not found
                             $user = backup_getid($restore->backup_unique_code,"user",$sca->userid);
                             if ($user) {
                                 $sca->userid = $user->new_id;
                             } else {
-                                //Assign it to admin
-                                $sca->userid = $adminid;
+                                $sca->userid = $USER->id;
+                            }
+                            // If scale is standard, if user lacks perms to manage standar scales
+                            // 'downgrade' them to course scales
+                            if ($sca->courseid == 0 and !has_capability('moodle/course:managescales', get_context_instance(CONTEXT_SYSTEM), $sca->userid)) {
+                                $sca->courseid = $restore->course_id;
                             }
                             //The structure is equal to the db, so insert the scale
                             $newid = insert_record ("scale",$sca);
+
+                        // Scale exists, reuse it
                         } else {
-                            //get current scale id
                             $newid = $sca_db->id;
                         }
+
                         if ($newid) {
                             //We have the newid, update backup_ids
-                            backup_putid($restore->backup_unique_code,"scale",
-                                         $scale->id, $newid);
+                            backup_putid($restore->backup_unique_code,"scale", $scale->id, $newid);
                         }
                     }
                 }
@@ -4838,9 +4864,6 @@
                         case "LASTIP": 
                             $this->info->tempuser->lastip = $this->getContents();
                             break;
-                        case "SECRET": 
-                            $this->info->tempuser->secret = $this->getContents();
-                            break;
                         case "PICTURE": 
                             $this->info->tempuser->picture = $this->getContents();
                             break;
@@ -5816,7 +5839,9 @@
             }
             else {
                 if (empty($noredirect)) {
-                    redirect($CFG->wwwroot.'/backup/restore.php?backup_unique_code='.$backup_unique_code.'&launch=form&file='.$file.'&id='.$id);
+                    print_continue($CFG->wwwroot.'/backup/restore.php?backup_unique_code='.$backup_unique_code.'&launch=form&file='.$file.'&id='.$id.'&sesskey='.sesskey());
+                    print_footer();
+                    die;                    
                 } else {
                     return $backup_unique_code;
                 }

backup/version.php

@@ -2,11 +2,11 @@
 
 /// This file defines the current version of the
 /// backup/restore code that is being used.  This can be
-/// compared against the values stored in the 
+/// compared against the values stored in the
 /// database (backup_version) to determine whether upgrades should
 /// be performed (see db/backup_*.php)
 
-    $backup_version = 2007022100;   // The current version is a date (YYYYMMDDXX)
-    $backup_release = "1.8+";       // User-friendly version number
+    $backup_version = 2007022101;   // The current version is a date (YYYYMMDDXX)
+    $backup_release = "1.8.11";       // User-friendly version number
 
 ?>

blog/preferences.html

@@ -8,6 +8,7 @@
 <tr>
     <td colspan="2" align="center">
     <input type="hidden" name="courseid" value="<?php echo $courseid; ?>" />
+    <input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
     <input type="submit" value="<?php print_string("savechanges"); ?>" />
     <input type="button" value="<?php print_string('cancel'); ?>" onclick="javascript:history.go(-1)" /></td>
 </tr>

blog/preferences.php

@@ -22,7 +22,7 @@
 
 /// If data submitted, then process and store.
 
-    if (data_submitted()) {
+    if (data_submitted() and confirm_sesskey()) {
         $pagesize = required_param('pagesize', PARAM_INT);
 
         if ($pagesize < 1) {

calendar/event.php

@@ -123,7 +123,7 @@
                 error('You are not authorized to do this');
             }
 
-            if($form = data_submitted()) {
+            if($form = data_submitted() and confirm_sesskey()) {
 
                 $form->name = clean_param(strip_tags($form->name,'<lang><span>'), PARAM_CLEAN);
 
@@ -188,7 +188,7 @@
         case 'new':
             $title = get_string('newevent', 'calendar');
             $form = data_submitted();
-            if(!empty($form) && !empty($form->name)) {
+            if(!empty($form) && !empty($form->name) && confirm_sesskey()) {
 
                 $form->name = clean_text(strip_tags($form->name, '<lang><span>'));
 
@@ -286,7 +286,7 @@
         case 'delete':
             $confirm = optional_param('confirm', 0, PARAM_INT);
             $repeats = optional_param('repeats', 0, PARAM_INT);
-            if($confirm) {
+            if($confirm and confirm_sesskey()) {
                 // Kill it and redirect to day view
                 if(($event = get_record('event', 'id', $eventid)) !== false) {
 

calendar/event_delete.html

@@ -13,6 +13,7 @@
       <input type="hidden" name="confirm" value="1" />
       <input type="hidden" name="repeats" value="0" />
       <input type="hidden" name="course" value="<?php p($urlcourse); ?>" />
+      <input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
       &nbsp;
       </p>
       </form>
@@ -31,6 +32,7 @@
       <input type="hidden" name="confirm" value="1" />
       <input type="hidden" name="repeats" value="1" />
       <input type="hidden" name="course" value="<?php p($urlcourse); ?>" />
+      <input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
       &nbsp;
       </p>
       </form>

calendar/event_edit.html

@@ -89,6 +89,7 @@
 <input type="hidden" name="format" value="<?php echo $form->format; ?>" />
 <input type="hidden" name="action" value="edit" />
 <input type="hidden" name="course" value="<?php p($urlcourse); ?>" />
+<input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
 </p>
 </form>
 

calendar/event_new.html

@@ -99,6 +99,7 @@
 <input type="hidden" name="action" value="new" />
 <input type="hidden" name="type" value="<?php echo $form->type; ?>" />
 <input type="hidden" name="course" value="<?php p($urlcourse); ?>" />
+<input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
 </p>
 </form>
 

calendar/preferences.html

@@ -71,6 +71,7 @@
 
 <tr>
     <td colspan="2" style="text-align: center;">
+    <input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
     <input type="submit" value="<?php print_string("savechanges") ?>" /></td>
 </tr>
 </table>

calendar/preferences.php

@@ -18,7 +18,7 @@
     
 /// If data submitted, then process and store.
 
-    if ($form = data_submitted()) {
+    if ($form = data_submitted() and confirm_sesskey()) {
         foreach ($form as $preference => $value) {
             switch ($preference) {
                 case 'timeformat':

config-dist.php

@@ -139,6 +139,13 @@ $CFG->admin = 'admin';
 // Useful for webhost operators who have alternate methods of backups
 //      $CFG->disablescheduledbackups = true;
 //
+// Allow user passwords to be included in backup files. Very dangerous
+// setting as far as it publishes password hashes that can be unencrypted
+// if the backup file is publicy available. Use it only if you can guarantee
+// that all your backup files remain only privacy available and are never
+// shared out from your site/institution!
+//      $CFG->includeuserpasswordsinbackup = true;
+//
 // Prevent stats processing and hide the GUI
 //      $CFG->disablestatsprocessing = true;
 //

course/import/groups/index.php

@@ -50,7 +50,7 @@
 
     require_once($CFG->dirroot.'/lib/uploadlib.php');
     $um = new upload_manager('userfile',false,false,null,false,0);
-    if ($um->preprocess_files()) {
+    if ($um->preprocess_files() and confirm_sesskey()) {
         $filename = $um->files['userfile']['tmp_name'];
 
         //Fix mac/dos newlines

course/rest.php

@@ -44,7 +44,12 @@ $context = get_context_instance(CONTEXT_COURSE, $course->id);
 require_login($course->id);
 require_capability('moodle/course:update', $context);
 
+if (!empty($CFG->disablecourseajax)) {
+    errorl_log('Course AJAX not allowed');
+    die;
+}
 
+require_sesskey();
 
 // OK, now let's process the parameters and do stuff
 switch($_SERVER['REQUEST_METHOD']) {

enrol/ldap/enrol.php

@@ -214,6 +214,11 @@ function sync_enrolments($type, $enrol = false) {
                                           $this->enrol_localcoursefield,
                                           $idnumber );
                 if (!is_object($course_obj)) {
+                    if (empty($CFG->enrol_ldap_autocreate)) { // autocreation not allowed
+                        print "[ENROL_LDAP] Course $idnumber does not exist, skipping\n";
+                        continue; // next foreach course
+                    }
+
                     // ok, now then let's create it!
                     print "Creating Course $idnumber...";
                     $newcourseid = $this->create_course($course, true); // we are skipping fix_course_sortorder()

enrol/manual/enrol.html

@@ -19,6 +19,7 @@
               <input type="password" name="password" size="20" value="<?php p($password) ?>"  />
               <input type="hidden" name="id" value="<?php p($course->id) ?>"  />
               <input type="hidden" name="enrol" value="manual" />
+              <input type="hidden" name="sesskey" value="<?php echo sesskey() ?>" />
               <input type="submit" value="<?php print_string("enrolme") ?>" />
             </td>
           </tr>

enrol/manual/enrol.php

@@ -64,12 +64,12 @@ function print_entry($course) {
 
             print_header($strloginto, $course->fullname, "<a href=\".\">$strcourses</a> -> $strloginto");
             echo '<br />';
-            notice_yesno(get_string('enrolmentconfirmation'), "enrol.php?id=$course->id&amp;confirm=1", 
+            notice_yesno(get_string('enrolmentconfirmation'), "enrol.php?id=$course->id&amp;confirm=1&amp;sesskey=".sesskey(),
                                                               "enrol.php?id=$course->id&amp;cancel=1");
             print_footer();
             exit;
 
-        } else if (!empty($_GET['confirm'])) {
+        } else if (!empty($_GET['confirm'])  and confirm_sesskey()) {
 
             if (!enrol_into_course($course, $USER, 'manual')) {
                 print_error('couldnotassignrole');
@@ -130,7 +130,7 @@ function check_entry($form, $course) {
         $form->password = '';
     }
 
-    if (empty($course->password)) {
+    if (empty($course->password) or !confirm_sesskey()) {
         // do not allow entry when no course password set
         // automatic login when manual primary, no login when secondary at all!!
         error('illegal enrolment attempted');

install.php

@@ -532,6 +532,9 @@ if ($nextstage == SAVE) {
     $str .= '$CFG->directorypermissions = 00777;  // try 02777 on a server in Safe Mode'."\r\n";
     $str .= "\r\n";
 
+    $str .= '$CFG->passwordsaltmain = \''.addsingleslashes(complex_random_string()).'\';'."\r\n";
+    $str .= "\r\n";
+
     $str .= 'require_once("$CFG->dirroot/lib/setup.php");'."\r\n";
     $str .= '// MAKE SURE WHEN YOU EDIT THIS FILE THAT THERE ARE NO SPACES, BLANK LINES,'."\r\n";
     $str .= '// RETURNS, OR ANYTHING ELSE AFTER THE TWO CHARACTERS ON THE NEXT LINE.'."\r\n";
@@ -1278,4 +1281,13 @@ function toggledbinfo() {
 
 <?php
 }
+
+/**
+ * Add slashes for single quotes and backslashes
+ * so they can be included in single quoted string
+ * (for config.php)
+ */
+function addsingleslashes($input){
+    return preg_replace("/(['\\\])/", "\\\\$1", $input);
+}
 ?>

install/lang/de_utf8/installer.php

@@ -164,7 +164,7 @@ $string['globalsquoteshelp'] = '<p>Die Kombination von deaktivierten Magic Quote
 </p>';
 $string['globalswarning'] = '<p><strong>Sicherheitshinweis</strong>: Um ordnungsgemäß funktionieren zu können, benötigt <br />Moodle mehrere Änderungen in Ihren aktuellen PHP-Einstellungen.<p/> <p>Sie <em>müssen</em> den Parameter <code>register_globals=off</code> setzen.<p>Diese Einstellung können Sie vornehmen, in dem Sie die Datei <code>php.ini</code>, die Apache/IIS <br />Konfiguration oder die Datei <code>.htaccess</code> bearbeiten.</p>';
 $string['help'] = 'Hilfe';
-$string['iconvrecommended'] = 'Die Installation der ICONV Bibliothek wird zur Leistungsverbesserung dringend empfohlen. Dies ist besonders wichtig, wenn Sie Sprachen mit anderen als lateinischen Zeichensätzen verwenden.';
+$string['iconvrecommended'] = 'Die Installation der Extension ICONV wird zur Leistungsverbesserung dringend empfohlen. Dies ist besonders wichtig, wenn Sie Sprachen mit anderen als lateinischen Zeichensätzen verwenden.';
 $string['info'] = 'Informationen';
 $string['installation'] = 'Installation';
 $string['invalidmd5'] = 'md5 ungültig';
@@ -219,6 +219,7 @@ $string['phpversionhelp'] = '<p>Moodle erwartet PHP mindestens in der Version 4.
 <p>Sie müssen Ihre PHP-Verson aktualisieren oder auf einen Rechner wechseln, der eine neuere Version von PHP nutzt.<br />
 (Im Falle von 5.0.x könnten Sie auch zu einer Version 4.3.x/4.4.x downgraden)</p>';
 $string['postgres7'] = 'PostgreSQL (postgres7)';
+$string['postgresqlwarning'] = '<strong>Hinweis:</strong> Falls Sie Verbindungsprobleme bemerken, könnten Sie versuchen im Feld \'Host\' folgende Einträge zu setzen: \"host=\'postgresql_host\' port=\'5432\' dbname=\'postgresql_database_name\' user=\'postgresql_user\' password=\'postgresql_user_password\'\". Die Felder Name der Datenbank, Nutzer und Passwort bleiben leer. Weitere Informationen finden Sie in den <a href=\"http://docs.moodle.org/en/Installing_Postgres_for_PHP\">Moodle Docs</a>'; // ORPHANED
 $string['previous'] = 'Frühere';
 $string['qtyperqpwillberemoved'] = 'Während des Updates wird der Fragentyp RQP entfernt. Da Sie diesen Fragentyp nicht benutzen, sollten Sie keinerlei Probleme bekommen.';
 $string['qtyperqpwillberemovedanyway'] = 'Während des Updates wird der Fragentyp RQP entfernt. Sie haben einige RQP Fragen in Ihrer Datenbank, die nicht mehr funktionieren werden, falls Sie nicht den dafür notwendigen Code vor der Fortsetzung dieses Updates installieren. http://moodle.org/mod/data/view.php?d=13&amp;rid=797';

install/lang/dv_utf8/installer.php

@@ -0,0 +1,79 @@
+<?php
+/// Please, do not edit this file manually! It's auto generated from
+/// contents stored in your standard lang pack files:
+/// (langconfig.php, install.php, moodle.php, admin.php and error.php)
+///
+/// If you find some missing string in Moodle installation, please,
+/// keep us informed using http://moodle.org/bugs Thanks!
+///
+/// File generated by cvs://contrib/lang2installer/installer_builder
+/// using strings defined in stringnames.txt (same dir)
+
+$string['bypassed'] = 'ބައިޕާސްޑް';
+$string['cannotcreatelangdir'] = 'ލޭންގް (lang) ޑައިރެކްޓްރީއެއް ނުހެދުނު';
+$string['cannotcreatetempdir'] = 'ޓެމްޕް ޑައިރެކްޓްރީ ނުހެދުނު';
+$string['cannotdownloadcomponents'] = 'ކޮމްޕޯނަންޓްތައް ޑައުންލޯޑެއް ނުކުރެވޭ';
+$string['cannotdownloadzipfile'] = 'ޒިޕް ފައިލް ޑައުންލޯޑެއް ނުކުރެވުނު';
+$string['cannotfindcomponent'] = 'ކޮމްޕޯނަންޓް ނުފެނުނު';
+$string['cannotsavemd5file'] = 'އެމްޑީފައިވް ފައިލް ސޭވެއް ނުކުރެވުނު';
+$string['cannotsavezipfile'] = 'ޒިޕް ފައިލް ސޭވެއް ނުކުރެވުނު';
+$string['cannotunzipfile'] = 'ފައިލް އަންޒިޕެއް ނުކުރެވުނު';
+$string['check'] = 'ޗެކް';
+$string['closewindow'] = 'މި ވިންޑޯ ނިވާލަން';
+$string['componentisuptodate'] = 'ކޮމްޕޯނަންޓް އިނީ އަޕްޑޭޓްކޮށް';
+$string['continue'] = 'ކުރިޔަށްދިޔުމަށް';
+$string['ctyperecommended'] = ''; // ORPHANED
+$string['ctyperequired'] = ''; // ORPHANED
+$string['curlrecommended'] = ''; // ORPHANED
+$string['customcheck'] = ''; // ORPHANED
+$string['download'] = 'ޑައުންލޯޑް';
+$string['downloadedfilecheckfailed'] = 'ޑައުންލޯޑް ކުރެވުނު ފައިލްގެ ޗެކް ފެއިލްވެއްޖެ';
+$string['environmenterrortodo'] = ''; // ORPHANED
+$string['environmentrecommendcustomcheck'] = ''; // ORPHANED
+$string['environmentrecommendinstall'] = ''; // ORPHANED
+$string['environmentrecommendversion'] = ''; // ORPHANED
+$string['environmentrequirecustomcheck'] = ''; // ORPHANED
+$string['environmentrequireinstall'] = ''; // ORPHANED
+$string['environmentrequireversion'] = ''; // ORPHANED
+$string['environmentxmlerror'] = ''; // ORPHANED
+$string['error'] = 'މައްސަލަ';
+$string['gdversion'] = ''; // ORPHANED
+$string['globalswarning'] = ''; // ORPHANED
+$string['help'] = 'އެހީ';
+$string['iconvrecommended'] = ''; // ORPHANED
+$string['info'] = 'މަޢުލޫމާތު';
+$string['invalidmd5'] = 'އެމްޑީފައިވް ކަމަކުނުދޭ';
+$string['language'] = 'ބަސް';
+$string['mbstringrecommended'] = ''; // ORPHANED
+$string['missingrequiredfield'] = 'ކޮންމެހެން ބޭނުންވާ ފީލްޑެއް އިނީ ހުސްކޮށް';
+$string['moodledocslink'] = 'މި ޞަފުޙާގެ މޫޑުލްޑޮކްސް';
+$string['mysql416bypassed'] = ''; // ORPHANED
+$string['mysql416required'] = ''; // ORPHANED
+$string['name'] = 'ނަން';
+$string['next'] = 'ދެން ޖެހިގެން';
+$string['ok'] = 'ރަނގަޅު';
+$string['opensslrecommended'] = ''; // ORPHANED
+$string['parentlanguage'] = 'ތަރުޖަމާކުރާ ފަރާތްތައް: ތިބާގެ ބަހުގައި މައި ބަހެއް ވާނަމަ، އެ ބޭނުންކުރެވެންވާނީ ތިބާގެ ބަސްޕެކޭޖުގައި ބަހެއް ނުވަތަ ލިޔުމެއް މަދުވާނަމަ. އޭގެ ކޯޑު މިތާ ލިޔޭ. ހުސްކޮށް ދޫކޮށްލައިފިނަމަ ދެން އިނގިރޭސި ބޭނުންކުރެވޭނެ.';
+$string['password'] = 'ޕާސްވޯޑް';
+$string['php50restricted'] = ''; // ORPHANED
+$string['previous'] = 'ކުރި';
+$string['qtyperqpwillberemoved'] = ''; // ORPHANED
+$string['qtyperqpwillberemovedanyway'] = ''; // ORPHANED
+$string['remotedownloaderror'] = '\"$a->url\">$a->url</a> file manually, copy it to \"$a->dest\" in your server and unzip it there.';
+$string['remotedownloadnotallowed'] = '\"$a->url\">$a->url</a> file manually, copy it to \"$a->dest\" in your server and unzip it there.';
+$string['report'] = 'ރިޕޯޓު';
+$string['restricted'] = 'ހަރުކަށި ކުރެވިފަ';
+$string['serverchecks'] = ''; // ORPHANED
+$string['status'] = 'ހާލަތު';
+$string['thischarset'] = 'UTF-8';
+$string['thisdirection'] = 'rtl';
+$string['thislanguage'] = 'ދިވެހި';
+$string['unicoderecommended'] = ''; // ORPHANED
+$string['unicoderequired'] = ''; // ORPHANED
+$string['user'] = 'ޔޫސަރ';
+$string['wrongdestpath'] = 'މަންޒިލް ނުބައި';
+$string['wrongsourcebase'] = 'ސޯރސް ޔޫއާރްއެލް ބޭސް ނުބައި';
+$string['wrongzipfilename'] = 'ޒިޕްފައިލްގެ ނަން ނުބައި';
+$string['xmlrpcrecommended'] = ''; // ORPHANED
+$string['ziprequired'] = ''; // ORPHANED
+?>

install/lang/eu_utf8/installer.php

@@ -20,8 +20,8 @@ $string['cannotcreatetempdir'] = 'Ezin da temp direktorioa sortu';
 $string['cannotdownloadcomponents'] = 'Ezin dira osagaiak jaitsi';
 $string['cannotdownloadzipfile'] = 'Ezin da ZIP fitxategia jaitsi';
 $string['cannotfindcomponent'] = 'Ezin da osagaia aurkitu';
-$string['cannotsavemd5file'] = 'Ezin da Md5 fitxategia gorde.';
-$string['cannotsavezipfile'] = 'Ezin da ZIP fitxategia gorde.';
+$string['cannotsavemd5file'] = 'Ezin da Md5 fitxategia gorde';
+$string['cannotsavezipfile'] = 'Ezin da ZIP fitxategia gorde';
 $string['cannotunzipfile'] = 'Ezin da fitxategia deskonprimatu';
 $string['caution'] = 'Kontuz';
 $string['check'] = 'Egiaztatu';
@@ -217,6 +217,7 @@ $string['postgres7'] = 'PostgreSQL (postgres7)';
 $string['previous'] = 'Aurrekoa';
 $string['qtyperqpwillberemoved'] = 'Eguneratzean RQP motako galderak ezabatu egingo dira. Ez baduzu erabiltzen galdera-mota hori, ez duzu inongo arazorik izango.';
 $string['qtyperqpwillberemovedanyway'] = 'Eguneratzean RQP motako galderak ezabatu egingo dira. Zure datu-basean badira hainbat RQP galdera eta eguneraketarekin jarraitu aurretik kodea http://moodle.org/mod/data/view.php?d=13&rid=797-tik berrinstalatzen ez baduzu ez dute aurrerantzean funtzionatuko.';
+$string['remotedownloaderror'] = 'Errorea osagaia zure zerbitzarian jaistean, mesedez egiaztatu proxy-ezarpenak, PHP cURL luzapea erabat gomendatzen da.<br/><br /> <a href=\"*$a->url*\">*$a->url*</a> fitxategia eskuz jaitsi beharko zenuke, zure zerbitzariko \"*$a->dest*\" -ra kopiatu eta bertan deskonprimatu.';
 $string['remotedownloadnotallowed'] = 'Osagaiak ezin dira zure zerbitzarira jaitsi (allow_url_fopen ez dago aktibatuta).<br /><br /><a href=\"$a->url\">$a->url</a> fitxategia eskuz jaitsi eta \"$a->dest\" kokapenean kopiatu behar duzu.';
 $string['report'] = 'Txostena';
 $string['restricted'] = 'Baimena behar da';

install/lang/fr_utf8/installer.php

@@ -145,7 +145,7 @@ $string['globalsquoteserror'] = 'Veuillez corriger vos réglages PHP : désacti
 $string['globalsquoteshelp'] = '<p>Pour des raisons de sécurité, la combinaison de la désactivation de l\'option « Magic Quotes GPC » et de l\'activation de l\'option « Register Globals » n\'est pas recommandée.</p> <p>Le réglage recommandé est <b>magic_quotes_gpc = On</b> et <b>register_globals = Off</b> dans votre fichier « php.ini ».</p> <p>Si vous n\'avez pas accès au fichier « php.ini », il vous est peut-être possible de placer les deux lignes suivantes dans un fichier dénommé « .htaccess » placé dans votre dossier Moodle.</p> <blockquote><div>php_value magic_quotes_gpc On</div></blockquote> <blockquote><div>php_value register_globals Off</div></blockquote>';
 $string['globalswarning'] = '<p><strong>NOTIFICATION DE SÉCURITÉ !</strong></p><p>Pour fonctionner correctement, Moodle nécessite <br />certaines modifications de vos réglages PHP actuels.<p/><p>Vous <em>devez</em> spécifier le réglage <code>register_globals=off</code>.<p>Ce réglage s\'effectue en modifiant le fichier <code>php.ini</code>, la configuration <br />de Apache/IIS ou le fichier <code>.htaccess</code>.</p>';
 $string['help'] = 'Aide';
-$string['iconvrecommended'] = 'Bien que la bibliothèque ICONV soit facultative, il est vivement recommandé de l\'installer sur le serveur pour de meilleures performance, notamment si votre site supporte des caractères non latins.';
+$string['iconvrecommended'] = 'Bien que l\'extension ICONV de PHP soit facultative, il est vivement recommandé de l\'installer sur le serveur pour de meilleures performance, notamment si votre site supporte des caractères non latins.';
 $string['info'] = 'Information';
 $string['installation'] = 'Installation';
 $string['installation'] = 'Installation';

install/lang/ja_utf8/installer.php

@@ -132,12 +132,12 @@ $string['downloadlanguagenotneeded'] = 'デフォルトの言語パック「 $a
 $string['downloadlanguagesub'] = 'あなたは、言語パックをダウンロードして、この言語でインストールを継続することができます。<br /><br />もし、あなたが言語パックをダウンロードできない場合、インストールは英語で継続されます。 (インストールの完了後、さらに言語パックをダウンロードして、インストールすることができます。)';
 $string['environmenterrortodo'] = 'このバージョンのMoodleをインストールする前に、発見された動作環境の問題 (エラー) を解消してください!';
 $string['environmenthead'] = 'あなたの環境を確認しています ...';
-$string['environmentrecommendcustomcheck'] = 'このテストに不適合の場合、潜在的な問題があることを意味します。';
+$string['environmentrecommendcustomcheck'] = 'このテストに不適合の場合、潜在的な問題が存在することを意味します。';
 $string['environmentrecommendinstall'] = '最適な動作のため、インストールおよび有効化してください。';
 $string['environmentrecommendversion'] = 'バージョン $a->needed 以上を推奨します。あなたは現在 $a->current を使用しています。';
-$string['environmentrequirecustomcheck'] = 'このテストはパスする必要があります。';
+$string['environmentrequirecustomcheck'] = 'このテストには、パスする必要があります。';
 $string['environmentrequireinstall'] = '必ずインストールおよび有効化してください。';
-$string['environmentrequireversion'] = 'バージョン $a->needed 以上が必須です。あなたは現在 $a->current を使用しています。';
+$string['environmentrequireversion'] = 'バージョン $a->needed 以上が必須です。あなたは、現在 $a->current を使用しています。';
 $string['environmentsub'] = 'あなたのシステムに関する様々な要素が、システム要件に合致するか確認しています。';
 $string['environmentxmlerror'] = '環境データ ($a->error_code) の読み込み中にエラーが発生しました。';
 $string['error'] = 'エラー';
@@ -167,7 +167,7 @@ $string['globalsquoteshelp'] = '<p>Magic Quotes GPCの無効化およびRegister
 <blockquote><div>php_value register_globals Off</div></blockquote>';
 $string['globalswarning'] = '<p><strong>セキュリティ警告</strong>: Moodleを適切に動作させるため、<br />現在のPHP設定を変更する必要があります。<p/><p><code>register_globals=off</code>  の<em>設定を行って</em>ください。<p>この設定は、<code>php.ini</code>、Apache/IIS <br />設定、または <code>.htaccess</code> ファイルの編集により管理することができます。</p>';
 $string['help'] = 'ヘルプ';
-$string['iconvrecommended'] = 'より良いパフォーマンスを得るため、ICONVライブラリのインストールおよび稼動を強くお勧めします。あなたのサイトがラテン文字以外をサポートしている場合、特にお勧めします。';
+$string['iconvrecommended'] = 'より良いパフォーマンスを得るため、ICONVライブラリのインストールを強くお勧めします。あなたのサイトが非ラテン言語をサポートしている場合、特にお勧めします。';
 $string['info'] = '情報';
 $string['installation'] = 'インストレーション';
 $string['invalidmd5'] = '無効なmp5ファイルです。';
@@ -182,7 +182,7 @@ $string['magicquotesruntimehelp'] = '<p>Moodleを正常に動作させるため
 
 <p>php.iniファイルにアクセスできない場合は、Moodleディレクトリの.htaccessファイルに次の行を追加してください:</p>
 <blockquote><div>php_value magic_quotes_runtime Off</div></blockquote>';
-$string['mbstringrecommended'] = 'より良いパフォーマンスを得るため、mbstringライブラリのインストールおよび稼動を強くお勧めします。あなたのサイトがラテン文字以外をサポートしている場合、特にお勧めします。';
+$string['mbstringrecommended'] = 'サイトパフォーマンスを改善するため、mbstringライブラリのインストールおよび稼動を強くお勧めします。あなたのサイトがラテン文字以外をサポートしている場合、特にお勧めします。';
 $string['memorylimit'] = 'Memory Limit';
 $string['memorylimiterror'] = 'PHPのmemory limitが低すぎます ... 後で問題が発生する可能性があります。';
 $string['memorylimithelp'] = '<p>現在、サーバのPHPメモリー制限が $a に設定されています。</p>
@@ -203,7 +203,7 @@ $string['mssqlextensionisnotpresentinphp'] = 'PHPのMSSQL拡張モジュール
 $string['mssql_n'] = 'SQL*Server UTF-8サポート (mssql_n)';
 $string['mysql'] = 'MySQL (mysql)';
 $string['mysql416bypassed'] = 'あなたのサイトがiso-8859-1 (ラテン) 言語のみ使用している場合、現在インストールされている MySQL 4.1.12 (またはそれ以上) を使用することができます。';
-$string['mysql416required'] = 'Moodle1.6では、将来すべてのデータをUTF-8に変換するため、MySQL 4.1.16が要求される最低限のバージョンです。';
+$string['mysql416required'] = '将来すべてのデータをUTF-8に変換できるため、Moodle 1.6では、MySQL 4.1.16が要求される最低限のバージョンです。';
 $string['mysqlextensionisnotpresentinphp'] = 'PHPのMySQL拡張モジュールが適切に設定されていないため、MySQLと通信できません。あなたのphp.iniファイルをチェックするか、PHPを再コンパイルしてください。';
 $string['mysqli'] = 'Improved MySQL (mysqli)';
 $string['mysqliextensionisnotpresentinphp'] = 'PHPのMySQLi拡張モジュールが適切に設定されていないため、MySQLと通信できません。あなたのphp.iniファイルをチェックするか、PHPを再コンパイルしてください。MySQLi拡張モジュールは、PHP4では使用できません。';
@@ -218,7 +218,7 @@ $string['opensslrecommended'] = 'Moodleネットワーキング機能を有効
 $string['pass'] = 'パス';
 $string['password'] = 'パスワード';
 $string['pgsqlextensionisnotpresentinphp'] = 'PHPのPGSQL拡張モジュールが適切に設定されていないため、PostgreSQLと通信できません。あなたのphp.iniファイルをチェックするか、PHPを再コンパイルしてください。';
-$string['php50restricted'] = 'PHP 5.0.x には数多くの既知の問題があります。5.1.x にアップグレードするか、4.3.x または 4.4.x にダウングレードしてください。';
+$string['php50restricted'] = 'PHP 5.0.x には、数多くの既知の問題があります。5.1.x にアップグレードするか、4.3.x または 4.4.x にダウングレードしてください。';
 $string['phpversion'] = 'PHPバージョン';
 $string['phpversionerror'] = 'PHPバージョンは少なくとも 4.3.0 または 5.1.0 をお使いください (5.0.x には既知の多数の問題があります)。'; // ORPHANED
 $string['phpversionhelp'] = '<p>Moodleには、少なくとも 4.3.0 または 5.1.0 のPHPバージョンが必要です (5.0.x には既知の多数の問題があります)。</p>
@@ -228,7 +228,7 @@ $string['phpversionhelp'] = '<p>Moodleには、少なくとも 4.3.0 または 5
 $string['postgres7'] = 'PostgreSQL (postgres7)';
 $string['previous'] = '前へ';
 $string['qtyperqpwillberemoved'] = 'アップグレード中、RQP問題タイプは削除されます。あなたはこの問題タイプを使用していませんので、トラブルが発生することはありません。';
-$string['qtyperqpwillberemovedanyway'] = 'アップグレード中、RQP問題タイプは削除されます。あなたのデータベース内にRQP問題タイプが登録されています。アップグレードを続ける前に、 http://moodle.org/mod/data/view.php?d=13&amp;rid=797 から対応するプログラムをインストールしない場合、これらの問題は動作しなくなります。';
+$string['qtyperqpwillberemovedanyway'] = 'アップグレード中、RQP問題タイプは削除されます。あなたのデータベース内にRQP問題タイプが登録されています。アップグレードを続ける前に、http://moodle.org/mod/data/view.php?d=13&amp;rid=797 から対応するプログラムをインストールしない場合、これらの問題は動作しなくなります。';
 $string['remotedownloaderror'] = 'あなたのサーバへのコンポーネントのダウンロードに失敗しました。プロクシ設定を確認してください。PHP cURL拡張モジュールの使用を強くお勧めします。<br /><br /><a href=\"$a->url\">$a->url</a>ファイルを手動でダウンロードした後、あなたのサーバの「$a->dest」にコピーおよび解凍してください。';
 $string['remotedownloadnotallowed'] = 'あなたのサーバーにコンポーネントをダウンロードすることができません (allow_url_fopen が無効)。<br /><br /><a href=\"$a->url\">$a->url</a> ファイルを手動でダウンロードして、サーバの「 $a->dest 」にコピーした後、解凍してください。';
 $string['report'] = 'レポート';
@@ -248,8 +248,8 @@ $string['status'] = '状態';
 $string['thischarset'] = 'UTF-8';
 $string['thisdirection'] = 'ltr';
 $string['thislanguage'] = '日本語';
-$string['unicoderecommended'] = 'あなたのすべてのデータをユニコードフォーマット (UTF-8) で保存することをお勧めします。Moodleの新しいインストールは、ユニコードをデフォルトキャラクタにセットしたデータベースで実行してください。アップグレードの場合、UTF-8移行プロセスを実行してださい (詳細は管理ページをご覧ください)。';
-$string['unicoderequired'] = 'あなたのすべてのデータをユニコードフォーマット (UTF-8) で保存することが必須です。Moodleの新しいインストールは、ユニコードをデフォルトキャラクタにセットしたデータベースで実行してください。アップグレードの場合、UTF-8移行プロセスを実行してださい (詳細は管理ページをご覧ください)。';
+$string['unicoderecommended'] = 'あなたのすべてのデータをユニコードフォーマット (UTF-8) で保存することをお勧めします。Moodleの新しいインストールは、ユニコードをデフォルトキャラクタにセットしたデータベースで実行してください。アップグレードの場合、UTF-8移行処理を実行してださい (詳細は管理ページをご覧ください)。';
+$string['unicoderequired'] = 'あなたのすべてのデータをユニコードフォーマット (UTF-8) で保存することが必須です。Moodleの新しいインストールは、ユニコードをデフォルトキャラクタにセットしたデータベースで実行してください。アップグレードの場合、UTF-8移行処理を実行してださい (詳細は管理ページをご覧ください)。';
 $string['user'] = 'ユーザ';
 $string['welcomep10'] = '$a->installername ($a->installerversion)';
 $string['welcomep20'] = 'インストールが正常に完了したため、このページをご覧いただいています。あなたのコンピュータで <strong>$a->packname $a->packversion</strong> パッケージを起動してください。おめでとうございます!';

install/lang/pl_utf8/installer.php

@@ -36,7 +36,7 @@ $string['componentisuptodate'] = 'Komponent jest aktualny';
 $string['configfilenotwritten'] = 'Instalator nie mógł automatycznie utworzyć plik config.php zawierający Twoje parametry instalacyjne, prawdopodobnie dlatego że katalog Moodle nie ma prawa zapisu. Musisz ręcznie przekopiować poniższy kod do pliku config.php, który powinien znajdować się w głównym katalogu Moodle.';
 $string['configfilewritten'] = 'config.php został pomyślnie stworzony';
 $string['configurationcompletehead'] = 'Konfiguracja skończona';
-$string['configurationcompletesub'] = 'Moodle starał się zapisać twoją konfigurację w pliku w katalogu głównym instalacji Moodle.';
+$string['configurationcompletesub'] = 'Moodle starał sie zapisać twoją konfigurację w pliku w katalogu głównym instalacji Moodle.';
 $string['continue'] = 'Kontynuuj';
 $string['database'] = 'Baza danych';
 $string['databasecreationsettingshead'] = 'Teraz musisz skonfigurować ustawienia bazy danych, w której będzie przechowywana większa część danych Moodle. Zostanie ona stworzona automatycznie w czasie instalacji z wyszczególnionymi poniżej ustawieniami.';
@@ -53,10 +53,8 @@ $string['databasesettingssub'] = '<b>Typ:</b>  mysql or postgres7<br/>
 <b>Użytkownik:</b> Użytkownik Twojej bazy danych<br />
 <b>Hasło:</b> Hasło dostępu do bazy danych<br />
 <b>Prefiksy tabel:</b> opcjonalny prefiks używany przed wszystkimi nazwami tabeli';
-$string['databasesettingswillbecreated'] = '<b>Uwaga:</b> Instalator będzie próbował automatycznie utworzyć bazę danych jeśli jej nie będzie.';
 $string['dataroot'] = 'Katalog z danymi';
 $string['datarooterror'] = 'Katalog z danymi który podałeś nie może być znaleziony lub utworzony. Popraw ścieżkę lub utwórz katalog ręcznie.';
-$string['datarootpublicerror'] = 'Katalog z danymi który podałeś jest dostępny bezpośrednio z internetu. Musisz użyć innego katalogu.';
 $string['dbconnectionerror'] = 'Nie można połączyć się z podaną bazą danych. Sprawdź ustawienia Twojej bazy danych.';
 $string['dbcreationerror'] = 'Błąd tworzenia bazy danych. Nie można stworzyć bazy danych o takiej nazwie z dostarczonymi ustawieniami';
 $string['dbhost'] = 'Serwer baz danych';
@@ -85,11 +83,10 @@ $string['downloadlanguagenotneeded'] = 'Możesz kontynuować proces instalacji,
 $string['downloadlanguagesub'] = 'Teraz masz możliwość załadowania pakietu językowego i kontynuowania procesu instalacji w tym języku.<br/><br/>Jeśli nie możesz załadować pakietu, instalacja będzie się odbywać dalej po angielsku (kiedy się skończy, będziesz mieć możliwość załadowania i zainstalowania dodatkowych pakietów językowych)';
 $string['environmenterrortodo'] = 'Musisz usunąć wszystkie problemy (błędy) w środowisku serwera zanim rozpocznie się instalacja tej wersji Moodle!';
 $string['environmenthead'] = 'Sprawdzam środowisko (ustawienia) ...';
-$string['environmentrecommendcustomcheck'] = 'Jeśli ten test się nie powiedzie, wskazuje to na potencjalne problemy';
 $string['environmentrecommendinstall'] = 'jest zalecane, żeby było zainstalowane/włączone';
 $string['environmentrecommendversion'] = 'wersja $a->needed jest zalecana a ty używasz wersji $a->current';
 $string['environmentrequirecustomcheck'] = 'ten test musi być zaliczony';
-$string['environmentrequireinstall'] = 'Musi być zainstalowane i włączone';
+$string['environmentrequireinstall'] = 'jest niezbędnę, żeby było zainstalowane/włączone';
 $string['environmentrequireversion'] = 'wersja $a->needed jest niezbędna a ty używasz wersji $a->current';
 $string['environmentsub'] = 'Sprawdzamy, czy różne komponenty systemu spełniają wymagania systemu';
 $string['environmentxmlerror'] = 'Błąd odczytywania danych środowiska ($a->error_code)';
@@ -113,7 +110,7 @@ $string['globalsquotes'] = 'Groźne zarządzanie zmiennymi globalnymi';
 $string['globalsquoteserror'] = 'Ustal swoje ustawienia PHP:  niedostępne register_globals i/lub udostępnione magic_quotes_gpc';
 $string['globalsquoteshelp'] = '<p> Nie jest zalecane ustawienie równocześnie kombinacji niedostępnego Magoc Quotes GPC i udostępnionego Register Globals.</p>
 
-<p> Zalecane ustawienie: <b>magic_quotes_gpc = On</b> i <b>register_globals = Off</b> in your php.ini</p>
+<p> Zalecane ustawienie: <b>magic_quotes_gpc = On</b> i <b>register_globals = Off</b> w twoim pliku php.ini</p>
 
 <p> Jeśli nie posiadasz dostępu do swojego php.ini, możesz zamieścić następującą linię w pliku called.htacces w swoim katalogu Moodle.
 	<blockquote>php_value magic_quotes_gpc On</blockquote>
@@ -145,23 +142,21 @@ Istnieje kilka sposobów przeprowadzenia tej operacji, których możesz spróbow
 <ol>
 <li> Jeśli możesz przekompiluj PHP za pomocą <i>--enable-memory-limit</i>.
 Pozwoli to Moodle ustawić samoczynnie limit pamięci. </li>
-<li> Jeśli masz dostęp do swojego pliku php.ini, możesz w nim zmienić ustawienie <b>memory_limit</b> do wielkości 40M. Jeśli nie posiadasz tego dostępu możesz poprosić swojego administratora aby zrobił to za Ciebie.</li>
+<li> Jeśli masz dostęp do swojego pliku php.ini, możesz w nim zmienić ustawienie <b>memory_limit</b> do wielkođci 40M. Jeśli nie posiadasz tego dostępu możesz poprosić swojego administratora aby zrobił to za Ciebie.</li>
 <li> Na niektórych serwerach PHP można stworzyć plik. htaccess w katalogu Moodle zawierający poniższą linię:
 <p><blockquote>php_value memory_limit 40M</blockquote></p>
 <p> jednakże na niektórych serwerach będzie uniemożliwiało to działanie <b> wszystkich </b> stron PHP (ujrzysz błędy na stronie), a więc będziesz zmuszony usunąć plik .htaccess. </p></li></ol>”';
 $string['missingrequiredfield'] = 'Brak wymaganego pola';
 $string['moodledocslink'] = 'Dokumentacja Moodle dla tej strony';
 $string['mssql'] = 'SQL*Server (mssql)';
-$string['mssqlextensionisnotpresentinphp'] = 'PHP nie został prawidłowo skonfigurowany z serwerem SQL, aby mógł komunikować się z MSSQL. Sprawdź proszę swój plik php.ini lub przekompiluj PHP.';
 $string['mssql_n'] = 'SQL*Server z UTF-8 support (mssql_n)';
 $string['mysql'] = 'MySQL (mysql)';
-$string['mysqlextensionisnotpresentinphp'] = 'PHP nie został prawidłowo skonfigurowany z rozszerzeniem MySQL aby mógł  komunikować się z MySQL. Sprawdź proszę swój plik php.ini lub przekompiluj PHP';
+$string['mysqlextensionisnotpresentinphp'] = 'PHP nie został prawidłowo skonfigurowany z rozszerzeniem MySQL, co może zostać zakomunikowane przez MySQL. Sprawdź proszę swój plik php.ini lub przekompiluj PHP';
 $string['name'] = 'Nazwa';
 $string['next'] = 'Następne';
 $string['ok'] = 'OK';
 $string['opensslrecommended'] = 'Instalacja opcjonalnej biblioteki OpenSSL jest wysoce zalecane -- aktywuje sieciową funkcjonalność Moodle.';
-$string['parentlanguage'] = '<<DO TŁUMACZY: Jeżeli Twój język ma Język nadrzędny który powinien być użyty w przypadku braku tlumaczenia, wpisz tutaj odpowiedni kod (np: nl). Pozostawienia pustego powoduje używanie języka angielskiego.>>';
-$string['pass'] = 'Udane';
+$string['parentlanguage'] = '<<DO TŁUMACZY: Jeżeli Twój język ma Język nadrzędny który powinien być użyty w przypadku braku tłumaczenia, wpisz tutaj odpowiedni kod (np: nl). Pozostawienia pustego powoduje używanie języka angielskiego.>>';
 $string['password'] = 'Hasło';
 $string['php50restricted'] = 'PHP 5.0.x posiada kilka znanych błędów, proszę uaktualnić do wersji 5.1.x lub zredukować do wersji 4.3.x lub 4.4.x';
 $string['phpversion'] = 'Wersja PHP';
@@ -184,8 +179,8 @@ $string['safemodehelp'] = '“<p> Moodle może mieć wiele zróżnicowanych prob
 <p> Można kontynuować instalacje, lecz należy spodziewać się pewnych problemów w przyszłości.</p>';
 $string['sessionautostart'] = 'Automatyczny start sesji';
 $string['sessionautostarterror'] = 'To powinno być wyłączone';
-$string['sessionautostarthelp'] = '<p>Moodle wymaga obsługi sesji i nie będzie bez tego funkcjonować.</p>
-<p>Sesja może być zainicjowana w pliku php.ini poszukaj w nim parametrów session.auto_start sesji </p>';
+$string['sessionautostarthelp'] = '<p>Moodle wymaga obsługi sesjii nie będzie bez niego funkcjonować.</p>
+<p>Sesja może być zainicjowana w pliku php.ini  poszukaj parametrów session.auto_start sesji </p>';
 $string['status'] = 'Status';
 $string['thischarset'] = 'UTF-8';
 $string['thisdirection'] = 'ltr';
@@ -198,11 +193,13 @@ $string['welcomep20'] = 'Widzisz tę stronę, ponieważ z powodzeniem zainstalow
 $string['welcomep30'] = 'Ten instalator <strong>$a->installername</strong> zawiera aplikacje, by stworzyć środowisko, w którym będzie działać <strong>Moodle</strong>, czyli';
 $string['welcomep40'] = 'Pakiet zawiera<strong>Moodle $a->moodlerelease ($a->moodleversion)</strong>.';
 $string['welcomep50'] = 'Wszystkie aplikacje w tym pakiecie maja własne, oddzielne licencje. Kompletny pakiet <strong>$a->installername</strong> jest <a href=\"http://www.opensource.org/docs/definition_plain.html\">open source</a> i jest dystrybuowany na <a href=\"http://www.gnu.org/copyleft/gpl.html\">GPL</a> licencji.';
-$string['welcomep60'] = 'Następujące strony przeprowadzą cię przez instalację Moodle na twoim komputerze. Możesz zaakceptować ustawienia domyślne lub, opcjonalnie, dostosować je do swoich potrzeb.';
+$string['welcomep60'] = 'Nastepujące strony przeprowadzą cię przez instalację Moodle na twoim komputerze. Możesz zaakceptować ustawienia domyślne lub, opcjonalnie, dostosować je do swoich potrzeb.';
 $string['welcomep70'] = 'Kliknij \"Dalej\" żeby kontynuować instalację Moodle';
 $string['wrongdestpath'] = 'Błędna ścieżka docelowa';
 $string['wrongsourcebase'] = 'Błędne źródło bazy URL';
 $string['wrongzipfilename'] = 'Błędna nazwa pliku ZIP';
 $string['wwwroot'] = 'Adres w sieci';
 $string['wwwrooterror'] = 'Adres w sieci wydaje się być niepoprawny - wydaje się że nie ma tam instalacji Moodle';
+$string['xmlrpcrecommended'] = 'Instalacja opcjonalnego rozszerzenia xmlrpc jest wskazana dla zapewnienia Moodle sieciowej (Networking) funkcjonalności.';
+$string['ziprequired'] = 'Rozszerzenie Zip PHP jest obecnie wymagane przez Moodle. Binaria info-ZIP i biblioteki PclZip nie są już używane.';
 ?>

install/lang/ro_utf8/installer.php

@@ -13,6 +13,8 @@ $string['bypassed'] = 'Ignorat';
 $string['check'] = 'Verifică';
 $string['closewindow'] = 'Inchide fereastra';
 $string['continue'] = 'Continuă';
+$string['download'] = 'Descarcă';
+$string['environmentrequirecustomcheck'] = 'acest test trebuie să treacă';
 $string['error'] = 'Eroare';
 $string['help'] = 'Ajutor';
 $string['info'] = 'Informaţii';
@@ -27,7 +29,9 @@ $string['report'] = 'Raport';
 $string['restricted'] = 'Restricţionat';
 $string['status'] = 'Status';
 $string['thischarset'] = 'UTF-8';
+$string['thischarset'] = 'UTF-8';
 $string['thisdirection'] = 'ltr';
 $string['thislanguage'] = 'Română';
+$string['thislanguage'] = 'Română';
 $string['user'] = 'Utilizator';
 ?>

lang/en_utf8/admin.php

@@ -587,6 +587,11 @@ $string['upgradesure'] = 'Your Moodle files have been changed, and you are about
 Once you do this you can not go back again. <br /><br />
 Please note that this process can take a long time. <br /><br />
 Are you sure you want to upgrade this server to this version?';
+$string['upgrade1811notice'] = '<p>Moodle 1.8.11 contains a number of security fixes to user passwords and backups to protect the user information on your site.<br />
+As a result some of your settings and permissions relating to backups may have changed.<br />
+Please see the <a href=\'http://docs.moodle.org/en/Moodle_1.8.11_release_notes\' target=\'_blank\'>Moodle 1.8.11 release</a> notes for full details.</p>';
+$string['upgrade1811noticesubject'] = 'Moodle 1.8.11 upgrade security notices';
+$string['upgrade1811salt'] = 'It is also now strongly recommended that you set a password salt to greatly reduce the risk of password theft.<br />Please refer to the <a href=\"$a\" target=\"_blank\">password salting documentation</a> for details.</a>';
 $string['upgradingdata'] = 'Upgrading data';
 $string['upgradinglogs'] = 'Upgrading logs';
 $string['upwards'] = 'upwards';

lang/en_utf8/moodle.php

@@ -1191,8 +1191,11 @@ $string['resources'] = 'Resources';
 $string['restore'] = 'Restore';
 $string['restorecancelled'] = 'Restore canceled';
 $string['restorecoursenow'] = 'Restore this course now!';
+$string['restoredaccount'] = 'Restored account';
+$string['restoredaccountinfo'] = 'This account was imported from another server and the password has been lost. To set a new password by email, please click \"Continue\"';
 $string['restorefinished'] = 'Restore completed successfully';
 $string['restoreto'] = 'Restore to';
+$string['restoreuserinfofailed'] = 'The restore process has stopped because you don\'t have permission to restore user data.';
 $string['restricted'] = 'Restricted';
 $string['restrictmodules'] = 'Restrict activity modules?';
 $string['returningtosite'] = 'Returning to this web site?';

lang/en_utf8/report_security.php

@@ -119,6 +119,16 @@ $string['check_passwordpolicy_error'] = 'Password policy not set.';
 $string['check_passwordpolicy_name'] = 'Password policy';
 $string['check_passwordpolicy_ok'] = 'Password policy enabled.';
 
+$string['check_passwordsaltmain_name'] = 'Password salt';
+$string['check_passwordsaltmain_warning'] = 'No password salt has been set';
+$string['check_passwordsaltmain_ok'] = 'Password salt is OK';
+$string['check_passwordsaltmain_weak'] = 'Password salt is weak';
+$string['check_passwordsaltmain_details'] = '<p>Setting a password salt greatly reduces the risk of password theft.</p>
+<p>To set a password salt, add the following line to your config.php file:</p>
+<code>\$CFG->passwordsaltmain = \'some long random string here with lots of characters\';</code>
+<p>The random string of characters should be a mix of letters, numbers and other characters. A string length of at least 40 characters is recommended.</p>
+<p>Please refer to the <a href=\"$a\" target=\"_blank\">password salting documentation</a> if you wish to change the password salt. Once set, do NOT delete your password salt otherwise you will no longer be able to login to your site!</p>';
+
 $string['check_riskadmin_detailsok'] = '<p>Please verify the following list of system administrators:</p>$a';
 $string['check_riskadmin_detailswarning'] = '<p>Please verify the following list of system administrators:</p>$a->admins
 <p>It is recommended to assign administrator role in system context only. Following users have unsupported admin role assignments:</p>$a->unsupported';

lang/en_utf8/role.php

@@ -1,4 +1,4 @@
-<?PHP // $Id$ 
+<?PHP // $Id$
       // role.php - created with Moodle 1.7 beta + (2006101003)
 
 
@@ -8,6 +8,7 @@ $string['allowassign'] = 'Allow role assignments';
 $string['allowoverride'] = 'Allow role overrides';
 $string['assignroles'] = 'Assign roles';
 $string['assignglobalroles'] = 'Assign system roles';
+$string['backup:userinfo'] = 'Backup user data';
 $string['blog:create'] = 'Create new blog entries';
 $string['blog:manageentries'] = 'Edit and manage entries';
 $string['blog:manageofficialtags'] = 'Manage official tags';
@@ -89,6 +90,7 @@ $string['resetrole'] = 'Reset to defaults';
 $string['resetrolenolegacy'] = 'Clear permissions';
 $string['resetrolesure'] = 'Are you sure that you want to reset role \"$a->name ($a->shortname)\" to defaults?<p></p>The defaults are taken from the selected legacy capability ($a->legacytype).';
 $string['resetrolesurenolegacy'] = 'Are you sure that you want to clear all permissions defined in this role \"$a->name ($a->shortname)\"?';
+$string['restore:userinfo'] = 'Restore user data';
 $string['risks'] = 'Risks';
 $string['role:assign'] = 'Assign roles to users';
 $string['role:manage'] = 'Create and manage roles';

lib/ajax/ajaxcourse.js

@@ -176,7 +176,7 @@ main_class.prototype.connect = function(method, urlStub, callback, body) {
     if (callback == null) {
         callback = {}
     }
-    return YAHOO.util.Connect.asyncRequest(method, this.portal.strings['wwwroot']+"/course/rest.php?courseId="+main.portal.id+"&"+urlStub, callback, body);
+    return YAHOO.util.Connect.asyncRequest(method, this.portal.strings['wwwroot']+"/course/rest.php?courseId="+main.portal.id+"&sesskey="+this.portal.strings['sesskey']+"&"+urlStub, callback, body);
 }
 
 

lib/authlib.php

@@ -107,6 +107,15 @@ class auth_plugin_base {
         return true;
     }
 
+    /**
+     * Indicates if password hashes should be stored in local moodle database.
+     * @return bool true means md5 password hash stored in user table, false means flag 'not_cached' stored there instead
+     */
+    function prevent_local_passwords() {
+        // NOTE: this will be changed to true in 2.0
+        return false;
+    }
+
     /**
      * Updates the user's password. In previous versions of Moodle, the function
      * auth_user_update_password accepted a username as the first parameter. The

lib/datalib.php

@@ -1585,11 +1585,8 @@ function add_to_log($courseid, $module, $action, $url='', $info='', $cm=0, $user
 
     if (defined('MDL_PERFDB')) { global $PERF ; $PERF->dbqueries++; $PERF->logwrites++;};
 
-    if ($CFG->type = 'oci8po') {
-        if (empty($info)) {
-            $info = ' ';
-        }
-    }
+    $info = empty($info) ? sql_empty() : $info; // Use proper empties for each database
+    $url  = empty($url)  ? sql_empty() : $url;
 
     $result = $db->Execute('INSERT INTO '. $CFG->prefix .'log (time, userid, course, ip, module, cmid, action, url, info)
         VALUES (' . "'$timenow', '$userid', '$courseid', '$REMOTE_ADDR', '$module', '$cm', '$action', '$url', '$info')");

lib/db/access.php

@@ -168,6 +168,17 @@ $moodle_capabilities = array(
         )
     ),
 
+    'moodle/backup:userinfo' => array(
+
+        'riskbitmask' => RISK_PERSONAL,
+
+        'captype' => 'read',
+        'contextlevel' => CONTEXT_COURSE,
+        'legacy' => array(
+            'admin' => CAP_ALLOW
+        )
+    ),
+
     'moodle/site:restore' => array(
 
         'riskbitmask' => RISK_SPAM | RISK_PERSONAL | RISK_XSS,
@@ -180,6 +191,17 @@ $moodle_capabilities = array(
         )
     ),
 
+    'moodle/restore:userinfo' => array(
+
+        'riskbitmask' => RISK_SPAM | RISK_PERSONAL | RISK_XSS | RISK_CONFIG,
+
+        'captype' => 'write',
+        'contextlevel' => CONTEXT_COURSE,
+        'legacy' => array(
+            'admin' => CAP_ALLOW
+        )
+    ),
+
     'moodle/site:manageblocks' => array(
 
         'riskbitmask' => RISK_SPAM | RISK_XSS,

lib/db/upgrade.php

@@ -780,6 +780,88 @@ function xmldb_main_upgrade($oldversion=0) {
         filter_tex_updatedcallback(null);
     }
 
+    if ($result && $oldversion < 2007021599.11) {
+        $messagesubject = get_string('upgrade1811noticesubject', 'admin');
+        $message  = addslashes(get_string('upgrade1811notice', 'admin'));
+        if (empty($CFG->passwordmainsalt)) {
+            $docspath = $CFG->docroot.'/'.str_replace('_utf8', '', current_language()).'/report/security/report_security_check_passwordsaltmain';
+            $message .= "\n".get_string('upgrade1811salt', 'admin', $docspath);
+        }
+
+        notify($message, 'notifysuccess');
+
+        // Force administrators to change password on next login
+        $systemcontext = get_context_instance(CONTEXT_SYSTEM);
+        $sql = "SELECT DISTINCT u.id, u.firstname, u.lastname, u.picture, u.imagealt, u.email, u.password, u.auth
+              FROM {$CFG->prefix}role_capabilities rc
+              JOIN {$CFG->prefix}role_assignments ra ON (ra.contextid = rc.contextid AND ra.roleid = rc.roleid)
+              JOIN {$CFG->prefix}user u ON u.id = ra.userid
+             WHERE rc.capability = 'moodle/site:doanything'
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND u.deleted = 0
+                   AND rc.contextid = ".$systemcontext->id." AND (u.auth='manual' OR u.auth='email')";
+
+        $adminusers = get_records_sql($sql);
+        foreach ($adminusers as $adminuser) {
+            if ($preference = get_record('user_preferences', 'userid', $adminuser->id, 'name', 'auth_forcepasswordchange')) {
+                if ($preference->value == '1') {
+                    continue;
+                }
+                set_field('user_preferences', 'value', '1', 'id', $preference->id);
+            } else {
+                $preference = new stdClass;
+                $preference->userid = $adminuser->id;
+                $preference->name   = 'auth_forcepasswordchange';
+                $preference->value  = '1';
+                insert_record('user_preferences', $preference);
+            }
+            $adminuser->maildisplay = 0; // do not use return email to self, it might actually help emails to get through and prevents notices
+            // Message them with the notice about upgrading
+            email_to_user($adminuser, $adminuser, $messagesubject, html_to_text($message), $message);
+        }
+
+        unset($adminusers);
+        unset($preference);
+        unset($message);
+        unset($messagesubject);
+    }
+
+    if ($result && $oldversion < 2007021599.15) {
+        // this block tries to undo incorrect forcing of new passwords for admins that have no
+        // way to change passwords MDL-20933
+        $systemcontext = get_context_instance(CONTEXT_SYSTEM);
+        $sql = "SELECT DISTINCT u.id, u.firstname, u.lastname, u.picture, u.imagealt, u.email, u.password
+                  FROM {$CFG->prefix}role_capabilities rc
+                  JOIN {$CFG->prefix}role_assignments ra ON (ra.contextid = rc.contextid AND ra.roleid = rc.roleid)
+                  JOIN {$CFG->prefix}user u ON u.id = ra.userid
+                 WHERE rc.capability = 'moodle/site:doanything'
+                       AND rc.permission = ".CAP_ALLOW."
+                       AND u.deleted = 0
+                       AND rc.contextid = ".$systemcontext->id." AND u.auth<>'manual' AND u.auth<>'email'";
+
+        if ($adminusers = get_records_sql($sql)) {
+            foreach ($adminusers as $adminuser) {
+                delete_records('user_preferences', 'userid', $adminuser->id, 'name', 'auth_forcepasswordchange');
+            }
+        }
+        unset($adminusers);
+    }
+
+    if ($result && $oldversion < 2007021599.16) {
+        // NOTE: this is quite hacky, but anyway it should work fine in 1.9,
+        //       in 2.0 we should always use plugin upgrade code for things like this
+
+        $authsavailable = get_list_of_plugins('auth');
+        foreach($authsavailable as $authname) {
+            if (!$auth = get_auth_plugin($authname)) {
+                continue;
+            }
+            if ($auth->prevent_local_passwords()) {
+                execute_sql("UPDATE {$CFG->prefix}user SET password='not cached' WHERE auth='$authname'");
+            }
+        }
+    }
+
     return $result;
 
 }

lib/moodlelib.php

@@ -1603,6 +1603,16 @@ function confirm_sesskey($sesskey=NULL) {
     return ($USER->sesskey === $sesskey);
 }
 
+/**
+ * Check the session key using {@link confirm_sesskey()},
+ * and cause a fatal error if it does not match.
+ */
+function require_sesskey() {
+    if (!confirm_sesskey()) {
+        print_error('invalidsesskey');
+    }
+}
+
 /**
  * Setup all global $CFG course variables, set locale and also themes
  * This function can be used on pages that do not require login instead of require_login()
@@ -2514,6 +2524,22 @@ function is_internal_auth($auth) {
     return $authplugin->is_internal();
 }
 
+/**
+ * Returns true if the user is a 'restored' one
+ *
+ * Used in the login process to inform the user
+ * and allow him/her to reset the password
+ *
+ * @uses $CFG
+ * @param string $username username to be checked
+ * @return bool
+ */
+function is_restored_user($username) {
+    global $CFG;
+
+    return record_exists('user', 'username', $username, 'mnethostid', $CFG->mnet_localhost_id, 'password', 'restored');
+}
+
 /**
  * Returns an array of user fields
  *
@@ -2878,7 +2904,7 @@ function update_internal_user_password(&$user, $password) {
     global $CFG;
 
     $authplugin = get_auth_plugin($user->auth);
-    if (!empty($authplugin->config->preventpassindb)) {
+    if ($authplugin->prevent_local_passwords()) {
         $hashedpassword = 'not cached';
     } else {
         $hashedpassword = hash_internal_user_password($password);
@@ -5879,6 +5905,30 @@ function random_string ($length=15) {
     return $string;
 }
 
+/**
+ * Generate a complex random string (usefull for md5 salts)
+ *
+ * This function is based on the above {@link random_string()} however it uses a
+ * larger pool of characters and generates a string between 24 and 32 characters
+ *
+ * @param int $length Optional if set generates a string to exactly this length
+ * @return string
+ */
+function complex_random_string($length=null) {
+    $pool  = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
+    $pool .= '`~!@#%^&*()_+-=[];,./<>?:{} ';
+    $poollen = strlen($pool);
+    mt_srand ((double) microtime() * 1000000);
+    if ($length===null) {
+        $length = floor(rand(24,32));
+    }
+    $string = '';
+    for ($i = 0; $i < $length; $i++) {
+        $string .= $pool[(mt_rand()%$poollen)];
+    }
+    return $string;
+}
+
 /*
  * Given some text (which may contain HTML) and an ideal length,
  * this function truncates the text neatly on a word boundary if possible

lib/smarty/Config_File.class.php

@@ -17,8 +17,12 @@
  * License along with this library; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  *
- * @link http://smarty.php.net/
- * @version 2.6.9
+ * For questions, help, comments, discussion, etc., please join the
+ * Smarty mailing list. Send a blank e-mail to
+ * smarty-discussion-subscribe@googlegroups.com 
+ *
+ * @link http://www.smarty.net/
+ * @version 2.6.26
  * @copyright Copyright: 2001-2005 New Digital Group, Inc.
  * @author Andrei Zmievski <andrei@php.net>
  * @access public
@@ -105,7 +109,7 @@ class Config_File {
      * @param string $var_name (optional) variable to get info for
      * @return string|array a value or array of values
      */
-    function &get($file_name, $section_name = NULL, $var_name = NULL)
+    function get($file_name, $section_name = NULL, $var_name = NULL)
     {
         if (empty($file_name)) {
             $this->_trigger_error_msg('Empty config file name');
@@ -285,9 +289,9 @@ class Config_File {
             $line = $lines[$i];
             if (empty($line)) continue;
 
-            if ( $line{0} == '[' && preg_match('!^\[(.*?)\]!', $line, $match) ) {
+            if ( substr($line, 0, 1) == '[' && preg_match('!^\[(.*?)\]!', $line, $match) ) {
                 /* section found */
-                if ($match[1]{0} == '.') {
+                if (substr($match[1], 0, 1) == '.') {
                     /* hidden section */
                     if ($this->read_hidden) {
                         $section_name = substr($match[1], 1);
@@ -347,7 +351,7 @@ class Config_File {
      */
     function _set_config_var(&$container, $var_name, $var_value, $booleanize)
     {
-        if ($var_name{0} == '.') {
+        if (substr($var_name, 0, 1) == '.') {
             if (!$this->read_hidden)
                 return;
             else