Bumping to final 1.8 release, 1.8.14

If we enable the server validation but don't specify a certificate file path
flag the error and don't let the user save the settings.

COPYING.txt

@@ -0,0 +1,339 @@
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+		    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+			    NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
+
+	    How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.

admin/cron.php

@@ -198,7 +198,7 @@
                 foreach ($assigns as $assign) {
                     if ($context = get_context_instance(CONTEXT_COURSE, $assign->courseid)) {
                         if (role_unassign(0, $assign->id, 0, $context->id)) {
-                            mtrace("Deleted assignment for user $assign->id from course $assign->courseid");
+                            mtrace("removing user $assign->id from course $assign->courseid as they have not accessed the course for over $CFG->longtimenosee days");
                         }
                     }
                 }
@@ -272,7 +272,7 @@
                                                 p.id as prefid 
                                         FROM {$CFG->prefix}user u 
                                              JOIN {$CFG->prefix}user_preferences p ON u.id=p.userid
-                                        WHERE p.name='create_password' AND p.value=1 AND u.email !='' ");
+                                        WHERE p.name='create_password' AND p.value='1' AND u.email !='' ");
 
             foreach ($newusers as $newuserid => $newuser) {
                 $newuser->emailstop = 0; // send email regardless

admin/environment.xml

@@ -80,7 +80,6 @@
         <FEEDBACK>
           <ON_ERROR message="mysql416required" />
         </FEEDBACK>
-        <BYPASS function="bypass_mysql416_reqs" message="mysql416bypassed" />
       </VENDOR>
       <VENDOR name="postgres" version="7.4" />
       <VENDOR name="mssql" version="9.0" />
@@ -140,7 +139,6 @@
         <FEEDBACK>
           <ON_ERROR message="mysql416required" />
         </FEEDBACK>
-        <BYPASS function="bypass_mysql416_reqs" message="mysql416bypassed" />
       </VENDOR>
       <VENDOR name="postgres" version="8.0" />
       <VENDOR name="mssql" version="9.0" />
@@ -200,6 +198,11 @@
           <ON_OK message="questioncwqpfsok" />
         </FEEDBACK>
       </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/customcheckslib.php" function="php_check_register_globals" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="globalswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
     </CUSTOM_CHECKS>
   </MOODLE>
   <MOODLE version="2.0" requires="1.9">
@@ -209,19 +212,19 @@
       </FEEDBACK>
     </UNICODE>
     <DATABASE level="required">
-      <VENDOR name="mysql" version="4.1.16">
+      <VENDOR name="mysql" version="5.0.25">
         <FEEDBACK>
           <ON_ERROR message="mysql416required" />
         </FEEDBACK>
-        <BYPASS function="bypass_mysql416_reqs" message="mysql416bypassed" />
       </VENDOR>
-      <VENDOR name="postgres" version="8.0" />
+      <VENDOR name="postgres" version="8.3" />
       <VENDOR name="mssql" version="9.0" />
       <VENDOR name="odbc_mssql" version="9.0" />
       <VENDOR name="mssql_n" version="9.0" />
-      <VENDOR name="oracle" version="9.0" />
+      <VENDOR name="oracle" version="10.0" />
+      <VENDOR name="sqlite" version="2.0" />
     </DATABASE>
-    <PHP version="5.2.0" level="required">
+    <PHP version="5.2.8" level="required">
     </PHP>
     <PHP_EXTENSIONS>
       <PHP_EXTENSION name="iconv" level="optional">
@@ -234,9 +237,9 @@
           <ON_CHECK message="mbstringrecommended" />
         </FEEDBACK>
       </PHP_EXTENSION>
-      <PHP_EXTENSION name="curl" level="optional">
+      <PHP_EXTENSION name="curl" level="required">
         <FEEDBACK>
-          <ON_CHECK message="curlrecommended" />
+          <ON_CHECK message="curlrequired" />
         </FEEDBACK>
       </PHP_EXTENSION>
       <PHP_EXTENSION name="openssl" level="optional">
@@ -259,14 +262,40 @@
           <ON_ERROR message="ctyperequired" />
         </FEEDBACK>
       </PHP_EXTENSION>
-    </PHP_EXTENSIONS>
-    <CUSTOM_CHECKS>
-      <CUSTOM_CHECK file="question/upgrade.php" function="question_check_no_rqp_questions" level="optional">
+      <PHP_EXTENSION name="zip" level="required">
         <FEEDBACK>
-          <ON_CHECK message="qtyperqpwillberemovedanyway" />
-          <ON_OK message="qtyperqpwillberemoved" />
+          <ON_ERROR message="ziprequired" />
         </FEEDBACK>
-      </CUSTOM_CHECK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="gdrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="40M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="safe_mode" value="0" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingsafemode" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+    <CUSTOM_CHECKS>
     </CUSTOM_CHECKS>
   </MOODLE>
 </COMPATIBILITY_MATRIX>

admin/fixuserpix.php

@@ -0,0 +1,275 @@
+<?php
+
+require_once('../config.php');
+/**
+ * SCRIPT CONFIGURATION
+ */
+$starttimer = time()+microtime();
+
+$settings = array();
+$settings['verbose'] = false;
+$settings['username'] = null;
+$settings['password'] = null;
+$settings['eolchar'] = '<br />'; // Character used to break lines
+
+// Argument arrays: 0=>short name, 1=>long name
+$arguments = array(
+ array('short'=>'u', 'long'=>'username', 'help' => 'Your moodle username', 'type'=>'STRING', 'default' => ''),
+ array('short'=>'pw', 'long'=>'password', 'help' => 'Your moodle password', 'type'=>'STRING', 'default' => ''),
+ array('short'=>'v', 'long' => 'verbose', 'help' => 'Display extra information about the process')
+);
+
+// Building the USAGE output of the command line version
+if (isset($argv) && isset($argc)) {
+    $help = "Moodle User Pix Fix. Restores user profile images that were not properly moved during 1.8.2 upgrade to newer versions.\n\n"
+          . "Usage: {$argv[0]}; [OPTION] ...\n"
+          . "Options:\n"
+          . "  -h,    -?, -help, --help               This output\n";
+
+    foreach ($arguments as $arg_array) {
+        $equal = '';
+        if (!empty($arg_array['type'])) {
+            $equal = "={$arg_array['type']}";
+        }
+
+        $padding1 = 5 - strlen($arg_array['short']);
+        $padding2 = 30 - (strlen($arg_array['long']) + strlen($equal));
+        $paddingstr1 = '';
+        for ($i = 0; $i < $padding1; $i++) {
+            $paddingstr1 .= ' ';
+        }
+        $paddingstr2 = '';
+        for ($i = 0; $i < $padding2; $i++) {
+            $paddingstr2 .= ' ';
+        }
+
+        $help .= "  -{$arg_array['short']},$paddingstr1--{$arg_array['long']}$equal$paddingstr2{$arg_array['help']}\n";
+    }
+
+    $help .= "\nEmail nicolasconnault@gmail.com for any suggestions or bug reports.\n";
+
+    if ($argc == 1 || in_array($argv[1], array('--help', '-help', '-h', '-?'))) {
+        echo $help;
+        die();
+
+    } else {
+
+        $settings['eolchar'] = "\n";
+        $argv = arguments($argv);
+        $argscount = 0;
+
+        foreach ($arguments as $arg_array) {
+            $value = null;
+            if (in_array($arg_array['short'], array_keys($argv))) {
+                $value = $argv[$arg_array['short']];
+                unset($argv[$arg_array['short']]);
+            } elseif (in_array($arg_array['long'], array_keys($argv))) {
+                $value = $argv[$arg_array['long']];
+                unset($argv[$arg_array['long']]);
+            }
+            if (!is_null($value)) {
+                $settings[$arg_array['long']] = $value;
+                $argscount++;
+            }
+        }
+
+        // If some params are left in argv, it means they are not supported
+        if ($argscount == 0 || count($argv) > 0) {
+            echo $help;
+            die();
+        }
+    }
+}
+
+/**
+ * SCRIPT SETUP
+ */
+require_once($CFG->libdir . '/formslib.php');
+require_once($CFG->dirroot .'/course/lib.php');
+verbose("Loading libraries...");
+$systemcontext = get_context_instance(CONTEXT_SYSTEM);
+
+/**
+ * WEB INTERFACE FORM
+ */
+
+class pixfix_form extends moodleform {
+    function definition() {
+        global $arguments;
+        $mform =& $this->_form;
+
+        foreach ($arguments as $arg_array) {
+            $type = 'advcheckbox';
+
+            $label = ucfirst(str_replace('-', ' ', $arg_array['long']));
+            if (!empty($arg_array['type'])) {
+                $type = 'text';
+            }
+
+            if ($arg_array['long'] == 'password' || $arg_array['long'] == 'username') {
+                continue;
+            }
+
+            $mform->addElement($type, $arg_array['long'], $label);
+
+            if (isset($arg_array['default'])) {
+                $mform->setDefault($arg_array['long'], $arg_array['default']);
+            }
+        }
+        $this->add_action_buttons(false, 'Restore Images');
+    }
+
+    function definition_after_data() {
+
+    }
+}
+
+$run_script = true;
+$web_interface = false;
+
+// If eolchar is still <br />, load the web interface
+if ($settings['eolchar'] == '<br />') {
+    print_header("User Pix-Fix");
+    print_heading("User Pix-Fix");
+    $mform = new pixfix_form();
+
+    if ($data = $mform->get_data(false)) {
+        foreach ($arguments as $arg_array) {
+            if (!empty($data->{$arg_array['long']})) {
+                $settings[$arg_array['long']] = $data->{$arg_array['long']};
+            }
+        }
+    } else {
+        $run_script = false;
+    }
+
+    if (!has_capability('moodle/site:doanything', $systemcontext)) {
+        // If not logged in, give link to login page for current site
+        notify("You must be logged in as administrator before using this script.");
+        require_login();
+    } else {
+        $mform->display();
+    }
+
+    $web_interface = true;
+}
+
+if ($run_script) {
+
+    // User authentication
+    if (!$web_interface) {
+        if (empty($settings['username'])) {
+            echo "You must enter a valid username for a moodle administrator account on this site.{$settings['eolchar']}";
+            die();
+        } elseif (empty($settings['password'])) {
+            echo "You must enter a valid password for a moodle administrator account on this site.{$settings['eolchar']}";
+            die();
+        } else {
+            if (!$user = authenticate_user_login($settings['username'], $settings['password'])) {
+                echo "Invalid username or password!{$settings['eolchar']}";
+                die();
+            }
+            $USER = complete_user_login($user);
+            if (!has_capability('moodle/site:doanything', $systemcontext)) {
+                echo "You do not have administration privileges on this Moodle site. These are required for running the restore script.{$settings['eolchar']}";
+                die();
+            }
+        }
+    }
+
+    // Script code here
+
+    // Look for old moodledata/users directory
+    $oldusersdir = $CFG->dataroot . '/users';
+
+    if (!file_exists($oldusersdir)) {
+        notify('The old directory for user profile images ('.$oldusersdir.') does not exist. Pictures cannot be restored!');
+    } else {
+        // Find user profile images that are not yet in the new directory
+        $folders = get_directory_list($oldusersdir, '', false, true, false);
+
+        $restored_count = 0;
+
+        foreach ($folders as $userid) {
+            $olddir = $oldusersdir . '/' . $userid;
+            $files = get_directory_list($olddir);
+
+            if (empty($files)) {
+                continue;
+            }
+
+            // Create new user directory
+            if (!$newdir = make_user_directory($userid)) {
+                // some weird directory - do not stop the upgrade, just ignore it
+                continue;
+            }
+
+            // Move contents of old directory to new one
+            if (file_exists($olddir) && file_exists($newdir)) {
+                $restored = false;
+
+                foreach ($files as $file) {
+                    if (!file_exists($newdir . '/' . $file)) {
+                        copy($olddir . '/' . $file, $newdir . '/' . $file);
+                        verbose("Moved $olddir/$file into $newdir/$file");
+                        $restored = true;
+                    }
+                }
+
+                if ($restored) {
+                    $restored_count++;
+                }
+            } else {
+                notify("Could not move the contents of $olddir into $newdir!");
+                $result = false;
+                break;
+            }
+        }
+
+        if ($settings['eolchar'] == '<br />') {
+            print_box_start('generalbox centerpara');
+        }
+        if ($restored_count > 0) {
+            echo "Successfully restored profile images for $restored_count users!" . $settings['eolchar'];
+        } else {
+            echo "Did not find any user profile images in need of restoring." . $settings['eolchar'];
+        }
+        if ($settings['eolchar'] == '<br />') {
+            print_box_end();
+        }
+    }
+}
+
+if ($settings['eolchar'] == '<br />') {
+    print_footer();
+}
+
+/**
+ * Converts the standard $argv into an associative array taking var=val arguments into account
+ * @param array $argv
+ * @return array $_ARG
+ */
+function arguments($argv) {
+    $_ARG = array();
+    foreach ($argv as $arg) {
+        if (ereg('--?([^=]+)=(.*)',$arg,$reg)) {
+            $_ARG[$reg[1]] = $reg[2];
+        } elseif(ereg('-([a-zA-Z0-9]+)',$arg,$reg)) {
+           $_ARG[$reg[1]] = 'true';
+        }
+    }
+    return $_ARG;
+}
+
+/**
+ * If verbose is switched on, prints a string terminated by the global eolchar string.
+ * @param string $string The string to STDOUT
+ */
+function verbose($string) {
+    global $settings;
+    if ($settings['verbose'] && !$settings['quiet']) {
+        echo $string . $settings['eolchar'];
+    }
+}
+
+?>

admin/health.php

@@ -525,11 +525,203 @@ class problem_000011 extends problem_base {
             }
             return 'Error counter was cleared.';
         } else {
-            return '<p>Session errors can be caused by:<ul><li>unresolved problem in server software (aka random switching of users),</li><li>blocked or modified cookies,</li><li>deleting of active session files.</li></ul></p><p><a href="'.me().'&resetsesserrorcounter=1">Reset counter.</a></p>';
+            return '<p>Session errors can be caused by:</p><ul>' .
+            '<li>unresolved problem in server software (aka random switching of users),</li>' .
+            '<li>blocked or modified cookies,</li>' .
+            '<li>deleting of active session files.</li>' .
+            '</ul><p><a href="'.me().'&amp;resetsesserrorcounter=1">Reset counter</a></p>';
         }
     }
 }
 
+class problem_000012 extends problem_base {
+    function title() {
+        return 'Random questions data consistency';
+    }
+    function exists() {
+        return record_exists_select('question', "qtype = 'random' AND parent <> id");
+    }
+    function severity() {
+        return SEVERITY_ANNOYANCE;
+    }
+    function description() {
+        return '<p>For random questions, question.parent should equal question.id. ' .
+        'There are some questions in your database for which this is not true. ' .
+        'One way that this could have happened is for random questions restored from backup before ' .
+        '<a href="http://tracker.moodle.org/browse/MDL-5482">MDL-5482</a> was fixed.</p>';
+    }
+    function solution() {
+        global $CFG;
+        return '<p>Upgrade to Moodle 1.9.1 or later, or manually execute the SQL</p>' .
+        '<pre>UPDATE ' . $CFG->prefix . 'question SET parent = id WHERE qtype = \'random\' and parent &lt;> id;</pre>';
+    }
+}
+
+class problem_000013 extends problem_base {
+    function title() {
+        return 'Multi-answer questions data consistency';
+    }
+    function exists() {
+        global $CFG;
+        $positionexpr = sql_position(sql_concat("','", "q.id", "','"), 
+                sql_concat("','", "qma.sequence", "','"));
+        return record_exists_sql("
+                SELECT * FROM {$CFG->prefix}question q
+                    JOIN {$CFG->prefix}question_multianswer qma ON $positionexpr > 0
+                WHERE qma.question <> q.parent") ||
+            record_exists_sql("
+                SELECT * FROM {$CFG->prefix}question q
+                    JOIN {$CFG->prefix}question parent_q ON parent_q.id = q.parent
+                WHERE q.category <> parent_q.category");
+    }
+    function severity() {
+        return SEVERITY_ANNOYANCE;
+    }
+    function description() {
+        return '<p>For each sub-question whose id is listed in ' .
+        'question_multianswer.sequence, its question.parent field should equal ' .
+        'question_multianswer.question; and each sub-question should be in the same ' .
+        'category as its parent. There are questions in your database for ' .
+        'which this is not the case. One way that this could have happened is ' .
+        'for multi-answer questions restored from backup before ' .
+        '<a href="http://tracker.moodle.org/browse/MDL-14750">MDL-14750</a> was fixed.</p>';
+    }
+    function solution() {
+        return '<p>Upgrade to Moodle 1.9.1 or later, or manually execute the ' .
+        'code in question_multianswer_fix_subquestion_parents_and_categories in ' .
+        '<a href="http://cvs.moodle.org/moodle/question/type/multianswer/db/upgrade.php?revision=1.1.10.2&amp;view=markup">/question/type/multianswer/db/upgrade.php' .
+        'from the 1.9 stable branch</a>.</p>';
+    }
+}
+
+class problem_000014 extends problem_base {
+    function title() {
+        return 'Only multianswer and random questions should be the parent of another question';
+    }
+    function exists() {
+        global $CFG;
+        return record_exists_sql("
+                SELECT * FROM {$CFG->prefix}question q
+                    JOIN {$CFG->prefix}question parent_q ON parent_q.id = q.parent
+                WHERE parent_q.qtype NOT IN ('random', 'multianswer')");
+    }
+    function severity() {
+        return SEVERITY_ANNOYANCE;
+    }
+    function description() {
+        return '<p>You have questions that violate this in your databse. ' .
+        'You will need to investigate to determine how this happened.</p>';
+    }
+    function solution() {
+        return '<p>It is impossible to give a solution without knowing more about ' .
+        ' how the problem was caused. You may be able to get help from the ' .
+        '<a href="http://moodle.org/mod/forum/view.php?f=121">Quiz forum</a>.</p>';
+    }
+}
+
+class problem_000017 extends problem_base {
+    function title() {
+        return 'Question categories tree structure';
+    }
+    function find_problems() {
+        static $answer = null;
+
+        if (is_null($answer)) {
+            $categories = get_records('question_categories', '', '', 'id');
+
+            // Look for missing parents.
+            $missingparent = array();
+            foreach ($categories as $category) {
+                if ($category->parent != 0 && !array_key_exists($category->parent, $categories)) {
+                    $missingparent[$category->id] = $category;
+                }
+            }
+
+            // Look for loops.
+            $loops = array();
+            while (!empty($categories)) {
+                $current = array_pop($categories);
+                $thisloop = array($current->id => $current);
+                while (true) {
+                    if (isset($thisloop[$current->parent])) {
+                        // Loop detected
+                        $loops[$current->id] = $thisloop;
+                        break;
+                    } else if (!isset($categories[$current->parent])) {
+                        // Got to the top level, or a category we already know is OK.
+                        break;
+                    } else {
+                        // Continue following the path.
+                        $current = $categories[$current->parent];
+                        $thisloop[$current->id] = $current;
+                        unset($categories[$current->id]);
+                    }
+                }
+            }
+
+            $answer = array($missingparent, $loops);
+        }
+
+        return $answer;
+    }
+    function exists() {
+        list($missingparent, $loops) = $this->find_problems();
+        return !empty($missingparent) || !empty($loops);
+    }
+    function severity() {
+        return SEVERITY_ANNOYANCE;
+    }
+    function description() {
+        list($missingparent, $loops) = $this->find_problems();
+
+        $description = '<p>The question categories should be arranged into tree ' .
+                ' structures by the question_categories.parent field. Sometimes ' .
+                ' this tree structure gets messed up.</p>';
+
+        if (!empty($missingparent)) {
+            $description .= '<p>The following categories are missing their parents:</p><ul>';
+            foreach ($missingparent as $cat) {
+                $description .= "<li>Category $cat->id: " . s($cat->name) . "</li>\n";
+            }
+            $description .= "</ul>\n";
+        }
+
+        if (!empty($loops)) {
+            $description .= '<p>The following categories form a loop of parents:</p><ul>';
+            foreach ($loops as $loop) {
+                $description .= "<li><ul>\n";
+                foreach ($loop as $cat) {
+                    $description .= "<li>Category $cat->id: " . s($cat->name) . " has parent $cat->parent</li>\n";
+                }
+                $description .= "</ul></li>\n";
+            }
+            $description .= "</ul>\n";
+        }
+
+        return $description;
+    }
+    function solution() {
+        global $CFG;
+        list($missingparent, $loops) = $this->find_problems();
+
+        $solution = '<p>Consider executing the following SQL queries. These fix ' .
+                'the problem by moving some categories to the top level.</p>';
+
+        if (!empty($missingparent)) {
+            $solution .= "<pre>UPDATE " . $CFG->prefix . "question_categories\n" .
+                    "        SET parent = 0\n" .
+                    "        WHERE id IN (" . implode(',', array_keys($missingparent)) . ");</pre>\n";
+        }
+
+        if (!empty($loops)) {
+            $solution .= "<pre>UPDATE " . $CFG->prefix . "question_categories\n" .
+                    "        SET parent = 0\n" .
+                    "        WHERE id IN (" . implode(',', array_keys($loops)) . ");</pre>\n";
+        }
+
+        return $solution;
+    }
+}
 
 class problem_00000x extends problem_base {
     function title() {

admin/index.php

@@ -281,6 +281,7 @@
 
                 require_once($CFG->libdir.'/environmentlib.php');
                 print_heading(get_string('environment', 'admin'));
+                remove_dir($CFG->dataroot . '/environment'); /// Always delete downloaded env. info to force use of the released one. MDL-9796
                 if (!check_moodle_environment($release, $environment_results, true)) {
                     print_box_start('generalbox', 'notice'); // MDL-8330
                     print_string('langpackwillbeupdated', 'admin');
@@ -426,7 +427,7 @@
     upgrade_local_db("$CFG->wwwroot/$CFG->admin/index.php");  // Return here afterwards
 
 /// Check for changes to RPC functions
-    require_once($CFG->dirroot.'/admin/mnet/adminlib.php');
+    require_once("$CFG->dirroot/$CFG->admin/mnet/adminlib.php");
     upgrade_RPC_functions("$CFG->wwwroot/$CFG->admin/index.php");  // Return here afterwards
 
 

admin/lang.php

@@ -586,6 +586,10 @@ function lang_fix_value_before_save($value='') {
     if (ini_get_bool('magic_quotes_sybase')) {          // Unescape escaped sybase quotes
         $value = str_replace("''", "'", $value);
     }
+    // escape all embedded variables
+    $value = str_replace('$', '\$', $value);            // Add slashes for $
+    // unescape placeholders: only $a and $a->something are allowed. All other $variables are left escaped
+    $value = preg_replace('/\\\\\$a($|[^_a-zA-Z0-9\-]|\->[a-zA-Z0-9_]+)/', '$a\\1', $value);
     $value = str_replace("'", "\\'", $value);           // Add slashes for '
     $value = str_replace('"', "\\\"", $value);          // Add slashes for "
     $value = str_replace("%","%%",$value);              // Escape % characters

admin/mnet/access_control.php

@@ -47,7 +47,7 @@ if (!empty($action) and confirm_sesskey()) {
     // fetch the record in question
     $id = required_param('id', PARAM_INT);
     if (!$idrec = get_record('mnet_sso_access_control', 'id', $id)) {
-        error(get_string('recordnoexists','mnet'), '/admin/mnet/access_control.php');
+        error(get_string('recordnoexists','mnet'), "/$CFG->admin/mnet/access_control.php");
     }
 
     switch ($action) {
@@ -62,7 +62,7 @@ if (!empty($action) and confirm_sesskey()) {
             // require the access parameter, and it must be 'allow' or 'deny'
             $accessctrl = trim(strtolower(required_param('accessctrl', PARAM_ALPHA)));
             if ($accessctrl != 'allow' and $accessctrl != 'deny') {
-                error(get_string('invalidaccessparam', 'mnet') , '/admin/mnet/access_control.php');
+                error(get_string('invalidaccessparam', 'mnet') , "/$CFG->admin/mnet/access_control.php");
             }
 
             if (mnet_update_sso_access_control($idrec->username, $idrec->mnet_host_id, $accessctrl)) {
@@ -75,7 +75,7 @@ if (!empty($action) and confirm_sesskey()) {
             break;
 
         default:
-            print_error('invalidactionparam', 'mnet', '/admin/mnet/access_control.php');
+            print_error('invalidactionparam', 'mnet', "/$CFG->admin/mnet/access_control.php");
     }
 }
 
@@ -86,7 +86,7 @@ if ($form = data_submitted() and confirm_sesskey()) {
 
     // check permissions and verify form input
     if (!has_capability('moodle/user:delete', $sitecontext)) {
-        error(get_string('nomodifyacl','mnet'), '/admin/mnet/access_control.php');
+        error(get_string('nomodifyacl','mnet'), "/$CFG->admin/mnet/access_control.php");
     }
     if (empty($form->username)) {
         $formerror['username'] = get_string('enterausername','mnet');
@@ -180,7 +180,7 @@ if (!$acl) {
         }
         $deletecolumn = "<a href=\"?id={$aclrecord->id}&amp;action=delete&amp;sesskey={$USER->sesskey}\">"
                 . get_string('delete') . "</a>";
-        $table->data[] = array ($aclrecord->username, $aclrecord->mnet_host_id, $accesscolumn, $deletecolumn);
+        $table->data[] = array (s($aclrecord->username), $aclrecord->mnet_host_id, $accesscolumn, $deletecolumn);
     }
 }
 

admin/mnet/adminlib.php

@@ -64,7 +64,7 @@ function mnet_get_functions($type, $parentname) {
         foreach($rpcrecords as $rpc) {
             if (!array_key_exists($rpc->function_name, $methodServiceArray)) {
                 $rpc->enabled = 0;
-                update_record('mnet_rpc', $rpc);
+                update_record('mnet_rpc', addslashes_recursive($rpc));
             }
         }
     }
@@ -72,7 +72,7 @@ function mnet_get_functions($type, $parentname) {
     if (!file_exists($filename)) return false;
 
     if (extension_loaded('tokenizer')) {
-        include_once $CFG->dirroot.'/admin/mnet/MethodTable.php';
+        include_once "$CFG->dirroot/$CFG->admin/mnet/MethodTable.php";
         $functions = (array)MethodTable::create($filename,false);
     }
 

admin/mnet/delete.html

@@ -1,7 +1,7 @@
 <?php
 print_header("$site->shortname: $strmnetsettings", "$site->fullname",
-             '<a href="'.$CFG->wwwroot.'/admin/index.php">'.$stradministration.'</a> -> '.
-             '<a href="'.$CFG->wwwroot.'/admin/mnet/index.php">'.get_string('mnetsettings', 'mnet').'</a> -> Delete host');
+             '<a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/index.php">'.$stradministration.'</a> -> '.
+             '<a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/mnet/index.php">'.get_string('mnetsettings', 'mnet').'</a> -> Delete host');
 
 print_heading(get_string('mnetsettings', 'mnet'));
 ?>

admin/mnet/delete.php

@@ -31,6 +31,8 @@
         redirect('index.php', get_string('postrequired','mnet') ,7);
     }
 
+    require_sesskey();
+
     if ('verify' == $step) {
         $mnet_peer = new mnet_peer();
         $mnet_peer->set_id($hostid);

admin/mnet/enr_course_enrol.php

@@ -86,9 +86,21 @@
     $mnet_request->set_method('enrol/mnet/enrol.php/course_enrolments');
     $mnet_request->add_param($course->remoteid, 'int');
     $mnet_request->send($mnet_peer);
-    $all_enrolled_users = $mnet_request->response;
-
+    $raw_all_enrolled_users = $mnet_request->response;
     unset($mnet_request);
+
+    $all_enrolled_users = array();
+    if (!empty($raw_all_enrolled_users)) {
+        // Try to repair keying of remote users array, numeric usernames get lost in the fracas
+        foreach ($raw_all_enrolled_users as $username => $userdetails) {
+            if (empty($userdetails['username']) || !is_numeric($username)) {
+                //Not able to repair, or no need to repair
+                $all_enrolled_users[$username] = $userdetails;
+            } else {
+                $all_enrolled_users[$userdetails['username']] = $userdetails;
+            }
+        }
+    }
     
     $select = '';
     $all_enrolled_usernames = '';

admin/mnet/enr_courses.php

@@ -38,7 +38,7 @@
     " class=\"icon\" alt=\"".get_string("course")."\" />";
 
     foreach ($courses as $course) {
-        $link = $CFG->wwwroot . '/admin/mnet/enr_course_enrol.php?'
+        $link = "$CFG->wwwroot/$CFG->admin/mnet/enr_course_enrol.php?"
             . "host={$mnethost}&courseid={$course->id}&sesskey={$USER->sesskey}";
         echo '<tr>'
                . "<td>$icon</td>"

admin/mnet/enr_hosts.php

@@ -38,7 +38,7 @@
            . '</tr>';
     $hosts = $enrolment->list_remote_servers();
     foreach ($hosts as $host) {
-        $coursesurl = "{$CFG->wwwroot}/admin/mnet/enr_courses.php?host={$host->id}&amp;sesskey={$USER->sesskey}";
+        $coursesurl = "{$CFG->wwwroot}/$CFG->admin/mnet/enr_courses.php?host={$host->id}&amp;sesskey={$USER->sesskey}";
         $coursecount = get_field_sql("SELECT count(id) FROM {$CFG->prefix}mnet_enrol_course WHERE hostid={$host->id}");
         if (empty($coursecount)) {
             $coursecount = '?';

admin/mnet/peers.html

@@ -55,6 +55,7 @@ if (empty($CFG->mnet_dispatcher_mode) || $CFG->mnet_dispatcher_mode !== 'strict'
                 <div>
                 <input type="hidden" name="hostid" value="<?php echo $host->id; ?>" />
                 <input type="hidden" name="step" value="verify" />
+                <input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
                 <input type="submit" name="submit" value="<?php print_string('delete'); ?>"/>
                 </div>
             </form>

admin/mnet/peers.php

@@ -96,6 +96,7 @@ if (($form = data_submitted()) && confirm_sesskey()) {
     
         if (isset($form->deleted) && ($form->deleted == '0' || $form->deleted == '1')) {
             $mnet_peer->deleted = $form->deleted;
+            $mnet_peer->updateparams->deleted = $form->deleted;
         }
     
         if (isset($form->public_key)) {
@@ -106,9 +107,10 @@ if (($form = data_submitted()) && confirm_sesskey()) {
             } else {
                 $oldkey = $mnet_peer->public_key;
                 $mnet_peer->public_key = $form->public_key;
-                $mnet_peer->public_key_expires   = $mnet_peer->check_common_name($form->public_key);
+                $mnet_peer->updateparams->public_key = $form->public_key;
+                $mnet_peer->public_key_expires = $mnet_peer->check_common_name($form->public_key);
+                $mnet_peer->updateparams->public_key_expires = $mnet_peer->check_common_name($form->public_key);
                 if ($mnet_peer->public_key_expires == false) {
-                    $mnet_peer->public_key == $oldkey;
                     $errmsg = '<br />';
                     foreach ($mnet_peer->error as $err) {
                         $errmsg .= $err['code'] . ': ' . $err['text'].'<br />';

admin/report/security/index.php

@@ -0,0 +1,123 @@
+<?php  //$Id$
+
+///////////////////////////////////////////////////////////////////////////
+//                                                                       //
+// NOTICE OF COPYRIGHT                                                   //
+//                                                                       //
+// Moodle - Modular Object-Oriented Dynamic Learning Environment         //
+//          http://moodle.org                                            //
+//                                                                       //
+// Copyright (C) 1999 onwards Martin Dougiamas  http://dougiamas.com     //
+//                                                                       //
+// This program is free software; you can redistribute it and/or modify  //
+// it under the terms of the GNU General Public License as published by  //
+// the Free Software Foundation; either version 2 of the License, or     //
+// (at your option) any later version.                                   //
+//                                                                       //
+// This program is distributed in the hope that it will be useful,       //
+// but WITHOUT ANY WARRANTY; without even the implied warranty of        //
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         //
+// GNU General Public License for more details:                          //
+//                                                                       //
+//          http://www.gnu.org/copyleft/gpl.html                         //
+//                                                                       //
+///////////////////////////////////////////////////////////////////////////
+
+require_once('../../../config.php');
+require_once($CFG->dirroot.'/'.$CFG->admin.'/report/security/lib.php');
+require_once($CFG->libdir.'/adminlib.php');
+
+require_login();
+
+$issue = optional_param('issue', '', PARAM_FILE); // show detailed info about one issue only
+
+$issues = report_security_get_issue_list();
+
+// test if issue valid string
+if (array_search($issue, $issues, true) === false) {
+    $issue = '';
+}
+
+// we may need a bit more memory and this may take a long time to process
+@raise_memory_limit('128M');
+@set_time_limit(0);
+
+// Print the header.
+$adminroot = admin_get_root();
+admin_externalpage_setup('reportsecurity', $adminroot);
+admin_externalpage_print_header($adminroot);
+
+print_heading(get_string('reportsecurity', 'report_security'));
+
+while(@ob_end_flush());
+@flush();
+
+$strok       = '<span class="statusok">'.get_string('statusok', 'report_security').'</span>';
+$strinfo     = '<span class="statusinfo">'.get_string('statusinfo', 'report_security').'</span>';
+$strwarning  = '<span class="statuswarning">'.get_string('statuswarning', 'report_security').'</span>';
+$strserious  = '<span class="statusserious">'.get_string('statusserious', 'report_security').'</span>';
+$strcritical = '<span class="statuscritical">'.get_string('statuscritical', 'report_security').'</span>';
+
+$strissue    = get_string('issue', 'report_security');
+$strstatus   = get_string('status', 'report_security');
+$strdesc     = get_string('description', 'report_security');
+$strconfig   = get_string('configuration', 'report_security');
+
+$statusarr = array(REPORT_SECURITY_OK       => $strok,
+                   REPORT_SECURITY_INFO     => $strinfo,
+                   REPORT_SECURITY_WARNING  => $strwarning,
+                   REPORT_SECURITY_SERIOUS  => $strserious,
+                   REPORT_SECURITY_CRITICAL => $strcritical);
+
+$url = "$CFG->wwwroot/$CFG->admin/report/security/index.php";
+
+if ($issue and ($result = $issue(true))) {
+    $table = new object();
+    $table->head  = array($strissue, $strstatus, $strdesc, $strconfig);
+    $table->size  = array('30%', '10%', '50%', '10%' );
+    $table->align = array('left', 'left', 'left', 'left');
+    $table->width = '90%';
+    $table->data  = array();
+
+    // print detail of one issue only
+    $row = array();
+    $row[0] = report_security_doc_link($issue, $result->name);
+    $row[1] = $statusarr[$result->status];
+    $row[2] = $result->info;
+    $row[3] = is_null($result->link) ? '&nbsp;' : $result->link;
+
+    $CFG->pagepath = "report/security/$issue"; // help link in footer
+
+    $table->data[] = $row;
+
+    print_table($table);
+
+    print_box($result->details, 'generalbox boxwidthnormal boxaligncenter'); // TODO: add proper css
+
+    print_continue($url);
+
+} else {
+    $table = new object();
+    $table->head  = array($strissue, $strstatus, $strdesc);
+    $table->size  = array('30%', '10%', '60%' );
+    $table->align = array('left', 'left', 'left');
+    $table->width = '90%';
+    $table->data  = array();
+
+    foreach ($issues as $issue) {
+        $result = $issue(false);
+        if (!$result) {
+            // ignore this test
+            continue;
+        }
+        $row = array();
+        $row[0] = "<a href='$url?issue=$result->issue'>$result->name</a>";
+        $row[1] = $statusarr[$result->status];
+        $row[2] = $result->info;
+
+        $table->data[] = $row;
+    }
+    print_table($table);
+}
+
+admin_externalpage_print_footer($adminroot);

admin/report/security/lib.php

@@ -0,0 +1,779 @@
+<?php  //$Id$
+
+///////////////////////////////////////////////////////////////////////////
+//                                                                       //
+// NOTICE OF COPYRIGHT                                                   //
+//                                                                       //
+// Moodle - Modular Object-Oriented Dynamic Learning Environment         //
+//          http://moodle.org                                            //
+//                                                                       //
+// Copyright (C) 1999 onwards Martin Dougiamas  http://dougiamas.com     //
+//                                                                       //
+// This program is free software; you can redistribute it and/or modify  //
+// it under the terms of the GNU General Public License as published by  //
+// the Free Software Foundation; either version 2 of the License, or     //
+// (at your option) any later version.                                   //
+//                                                                       //
+// This program is distributed in the hope that it will be useful,       //
+// but WITHOUT ANY WARRANTY; without even the implied warranty of        //
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         //
+// GNU General Public License for more details:                          //
+//                                                                       //
+//          http://www.gnu.org/copyleft/gpl.html                         //
+//                                                                       //
+///////////////////////////////////////////////////////////////////////////
+
+require_once("$CFG->libdir/adminlib.php");
+
+
+define('REPORT_SECURITY_OK', 'ok');
+define('REPORT_SECURITY_INFO', 'info');
+define('REPORT_SECURITY_WARNING', 'warning');
+define('REPORT_SECURITY_SERIOUS', 'serious');
+define('REPORT_SECURITY_CRITICAL', 'critical');
+
+function report_security_get_issue_list() {
+    return array(
+        'report_security_check_globals',
+        'report_security_check_unsecuredataroot',
+        'report_security_check_displayerrors',
+        'report_security_check_noauth',
+        'report_security_check_embed',
+        'report_security_check_mediafilterswf',
+        'report_security_check_openprofiles',
+        'report_security_check_google',
+        'report_security_check_passwordsaltmain',
+        'report_security_check_configrw',
+        'report_security_check_defaultuserrole',
+        'report_security_check_guestrole',
+        'report_security_check_defaultcourserole',
+        'report_security_check_courserole',
+
+    );
+}
+
+function report_security_doc_link($issue, $name) {
+    global $CFG;
+
+    if (empty($CFG->docroot)) {
+        return $name;
+    }
+
+    $lang = str_replace('_utf8', '', current_language());
+
+    $str = "<a onclick=\"this.target='docspopup'\" href=\"$CFG->docroot/$lang/report/security/$issue\">";
+    $str .= "<img class=\"iconhelp\" src=\"$CFG->httpswwwroot/pix/docs.gif\" alt=\"\" />$name</a>";
+
+    return $str;
+}
+
+///=============================================
+///               Issue checks
+///=============================================
+
+
+/**
+ * Verifies register globals PHP setting.
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_globals($detailed=false) {
+    $result = new object();
+    $result->issue   = 'report_security_check_globals';
+    $result->name    = get_string('check_globals_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+
+    if (ini_get_bool('register_globals')) {
+        $result->status = REPORT_SECURITY_CRITICAL;
+        $result->info   = get_string('check_globals_error', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_globals_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_globals_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies unsupported noauth setting
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_noauth($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_noauth';
+    $result->name    = get_string('check_noauth_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/auth.php\">".get_string('authentication').'</a>';
+
+    if (is_enabled_auth('none')) {
+        $result->status = REPORT_SECURITY_CRITICAL;
+        $result->info   = get_string('check_noauth_error', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_noauth_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_noauth_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies sloppy embedding - this should have been removed long ago!!
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_embed($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_embed';
+    $result->name    = get_string('check_embed_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/settings.php?section=sitepolicies\">".get_string('sitepolicies', 'admin').'</a>';
+
+    if (!empty($CFG->allowobjectembed)) {
+        $result->status = REPORT_SECURITY_CRITICAL;
+        $result->info   = get_string('check_embed_error', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_embed_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_embed_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies sloppy swf embedding - this should have been removed long ago!!
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_mediafilterswf($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_mediafilterswf';
+    $result->name    = get_string('check_mediafilterswf_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/filters.php\">".get_string('filtersettings', 'admin').'</a>';
+
+    if (!empty($CFG->textfilters)) {
+        $activefilters = explode(',', $CFG->textfilters);
+    } else {
+        $activefilters = array();
+    }
+
+    if (array_search('filter/mediaplugin', $activefilters) !== false and !empty($CFG->filter_mediaplugin_enable_swf)) {
+        $result->status = REPORT_SECURITY_CRITICAL;
+        $result->info   = get_string('check_mediafilterswf_error', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_mediafilterswf_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_mediafilterswf_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies fatal misconfiguration of dataroot
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_unsecuredataroot($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_unsecuredataroot';
+    $result->name    = get_string('check_unsecuredataroot_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+
+    $insecuredataroot = is_dataroot_insecure();
+
+    if ($insecuredataroot) {
+        $result->status = REPORT_SECURITY_SERIOUS;
+        $result->info   = get_string('check_unsecuredataroot_warning', 'report_security', $CFG->dataroot);
+
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_unsecuredataroot_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_unsecuredataroot_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies disaplying of errors - problem for lib files and 3rd party code
+ * because we can not disable debugging in these scripts (they do not include config.php)
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_displayerrors($detailed=false) {
+    $result = new object();
+    $result->issue   = 'report_security_check_displayerrors';
+    $result->name    = get_string('check_displayerrors_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+
+    if (defined('WARN_DISPLAY_ERRORS_ENABLED')) {
+        $result->status = REPORT_SECURITY_WARNING;
+        $result->info   = get_string('check_displayerrors_error', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_displayerrors_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_displayerrors_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies open profiles - originaly open by default, not anymore because spammer abused it a lot
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_openprofiles($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_openprofiles';
+    $result->name    = get_string('check_openprofiles_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/settings.php?section=sitepolicies\">".get_string('sitepolicies', 'admin').'</a>';
+
+    if (empty($CFG->forcelogin) and empty($CFG->forceloginforprofiles)) {
+        $result->status = REPORT_SECURITY_WARNING;
+        $result->info   = get_string('check_openprofiles_error', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_openprofiles_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_openprofiles_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies google access not combined with disabled guest access
+ * because attackers might gain guest access by modifying browser signature.
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_google($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_google';
+    $result->name    = get_string('check_google_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/settings.php?section=sitepolicies\">".get_string('sitepolicies', 'admin').'</a>';
+
+    if (empty($CFG->opentogoogle)) {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_google_ok', 'report_security');
+    } else if (!empty($CFG->guestloginbutton)) {
+        $result->status = REPORT_SECURITY_INFO;
+        $result->info   = get_string('check_google_info', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_SERIOUS;
+        $result->info   = get_string('check_google_error', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_google_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies config.php is not writable anymore after installation,
+ * config files were changed on several outdated server.
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_configrw($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_configrw';
+    $result->name    = get_string('check_configrw_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+
+    if (is_writable($CFG->dirroot.'/config.php')) {
+        $result->status = REPORT_SECURITY_WARNING;
+        $result->info   = get_string('check_configrw_warning', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_configrw_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_configrw_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies sanity of default user role.
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_defaultuserrole($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_defaultuserrole';
+    $result->name    = get_string('check_defaultuserrole_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/settings.php?section=userpolicies\">".get_string('userpolicies', 'admin').'</a>';;
+
+    if (!$default_role = get_record('role', 'id', $CFG->defaultuserroleid)) {
+        $result->status  = REPORT_SECURITY_WARNING;
+        $result->info    = get_string('check_defaultuserrole_notset', 'report_security');
+        $result->details = $result->info;
+
+        return $result;
+    }
+
+    // first test if do anything enabled - that would be really crazy!
+    $sql = "SELECT COUNT(DISTINCT rc.contextid)
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE rc.capability = 'moodle/site:doanything'
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $default_role->id";
+
+    $anythingcount = count_records_sql($sql);
+
+    // risky caps - usually very dangerous
+    $sql = "SELECT COUNT(DISTINCT rc.contextid)
+              FROM {$CFG->prefix}role_capabilities rc
+              JOIN {$CFG->prefix}capabilities cap ON cap.name = rc.capability
+             WHERE ".sql_bitand('cap.riskbitmask', (RISK_XSS | RISK_CONFIG))." <> 0
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $default_role->id";
+
+    $riskycount = count_records_sql($sql);
+
+    // default role can not have view cap in all courses - this would break moodle badly
+    $viewcap = record_exists('role_capabilities', 'roleid', $default_role->id, 'permission', CAP_ALLOW, 'capability', 'moodle/course:view');
+
+    // it may have either no or 'user' legacy type - nothing else, or else it would break during upgrades badly
+    $legacyok = false;
+    $sql = "SELECT rc.capability, 1
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE rc.capability LIKE 'moodle/legacy:%'
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $default_role->id";
+    $legacycaps = get_records_sql($sql);
+    if (!$legacycaps) {
+        $legacyok = true;
+    } else if (count($legacycaps) == 1 and isset($legacycaps['moodle/legacy:user'])) {
+        $legacyok = true;
+    }
+
+    if ($anythingcount or $riskycount or $viewcap or !$legacyok) {
+        $result->status  = REPORT_SECURITY_CRITICAL;
+        $result->info    = get_string('check_defaultuserrole_error', 'report_security', format_string($default_role->name));
+
+    } else {
+        $result->status  = REPORT_SECURITY_OK;
+        $result->info    = get_string('check_defaultuserrole_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_defaultuserrole_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies sanity of guest role
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_guestrole($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_guestrole';
+    $result->name    = get_string('check_guestrole_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/settings.php?section=userpolicies\">".get_string('userpolicies', 'admin').'</a>';;
+
+    if (!$guest_role = get_record('role', 'id', $CFG->guestroleid)) {
+        $result->status  = REPORT_SECURITY_WARNING;
+        $result->info    = get_string('check_guestrole_notset', 'report_security');
+        $result->details = $result->info;
+
+        return $result;
+    }
+
+    // first test if do anything enabled - that would be really crazy!
+    $sql = "SELECT COUNT(DISTINCT rc.contextid)
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE rc.capability = 'moodle/site:doanything'
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $guest_role->id";
+
+    $anythingcount = count_records_sql($sql);
+
+    // risky caps - usually very dangerous
+    $sql = "SELECT COUNT(DISTINCT rc.contextid)
+              FROM {$CFG->prefix}role_capabilities rc
+              JOIN {$CFG->prefix}capabilities cap ON cap.name = rc.capability
+             WHERE ".sql_bitand('cap.riskbitmask', (RISK_XSS | RISK_CONFIG))." <> 0
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $guest_role->id";
+
+    $riskycount = count_records_sql($sql);
+
+    // it may have either no or 'guest' legacy type - nothing else, or else it would break during upgrades badly
+    $legacyok = false;
+    $sql = "SELECT rc.capability, 1
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE rc.capability LIKE 'moodle/legacy:%'
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $guest_role->id";
+    $legacycaps = get_records_sql($sql);
+    if (!$legacycaps) {
+        $legacyok = true;
+    } else if (count($legacycaps) == 1 and isset($legacycaps['moodle/legacy:guest'])) {
+        $legacyok = true;
+    }
+
+    if ($anythingcount or $riskycount or !$legacyok) {
+        $result->status  = REPORT_SECURITY_CRITICAL;
+        $result->info    = get_string('check_guestrole_error', 'report_security', format_string($guest_role->name));
+
+    } else {
+        $result->status  = REPORT_SECURITY_OK;
+        $result->info    = get_string('check_guestrole_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_guestrole_details', 'report_security');
+    }
+
+    return $result;
+}
+
+
+/**
+ * Verifies sanity of site default course role.
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_defaultcourserole($detailed=false) {
+    global $CFG;
+
+    $problems = array();
+
+    $result = new object();
+    $result->issue   = 'report_security_check_defaultcourserole';
+    $result->name    = get_string('check_defaultcourserole_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/settings.php?section=userpolicies\">".get_string('userpolicies', 'admin').'</a>';;
+
+    if ($detailed) {
+        $result->details = get_string('check_defaultcourserole_details', 'report_security');
+    }
+
+    if (!$student_role = get_record('role', 'id', $CFG->defaultcourseroleid)) {
+        $result->status  = REPORT_SECURITY_WARNING;
+        $result->info    = get_string('check_defaultcourserole_notset', 'report_security');
+        $result->details = get_string('check_defaultcourserole_details', 'report_security');
+
+        return $result;
+    }
+
+    // first test if do anything enabled - that would be really crazy!
+    $sql = "SELECT DISTINCT rc.contextid
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE rc.capability = 'moodle/site:doanything'
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $student_role->id";
+
+    if ($anything_contexts = get_records_sql($sql)) {
+        foreach($anything_contexts as $contextid) {
+            if ($contextid == SYSCONTEXTID) {
+                $a = "$CFG->wwwroot/$CFG->admin/roles/manage.php?action=view&amp;roleid=$CFG->defaultcourseroleid";
+            } else {
+                $a = "$CFG->wwwroot/$CFG->admin/roles/override.php?contextid=$contextid&amp;roleid=$CFG->defaultcourseroleid";
+            }
+            $problems[] = get_string('check_defaultcourserole_anything', 'report_security', $a);
+        }
+    }
+
+    // risky caps - usually very dangerous
+    $sql = "SELECT DISTINCT rc.contextid
+              FROM {$CFG->prefix}role_capabilities rc
+              JOIN {$CFG->prefix}capabilities cap ON cap.name = rc.capability
+             WHERE ".sql_bitand('cap.riskbitmask', (RISK_XSS | RISK_CONFIG))." <> 0
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $student_role->id";
+
+    if ($riskycontexts = get_records_sql($sql)) {
+        foreach($riskycontexts as $contextid=>$unused) {
+            if ($contextid == SYSCONTEXTID) {
+                $a = "$CFG->wwwroot/$CFG->admin/roles/manage.php?action=view&amp;roleid=$CFG->defaultcourseroleid";
+            } else {
+                $a = "$CFG->wwwroot/$CFG->admin/roles/override.php?contextid=$contextid&amp;roleid=$CFG->defaultcourseroleid";
+            }
+            $problems[] = get_string('check_defaultcourserole_risky', 'report_security', $a);
+        }
+    }
+
+    // course creator or administrator does not make any sense here
+    $sql = "SELECT rc.capability, 1
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE rc.capability LIKE 'moodle/legacy:%'
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $student_role->id";
+    $legacycaps = get_records_sql($sql);
+    if (isset($legacycaps['moodle/legacy:coursecreator']) or isset($legacycaps['moodle/legacy:admin'])) {
+        $problems[] = get_string('check_defaultcourserole_legacy', 'report_security');
+    }
+
+    if ($problems) {
+        $result->status  = REPORT_SECURITY_CRITICAL;
+        $result->info    = get_string('check_defaultcourserole_error', 'report_security', format_string($student_role->name));
+        if ($detailed) {
+            $result->details .= "<ul>";
+            foreach ($problems as $problem) {
+                $result->details .= "<li>$problem</li>";
+            }
+            $result->details .= "</ul>";
+        }
+
+    } else {
+        $result->status  = REPORT_SECURITY_OK;
+        $result->info    = get_string('check_defaultcourserole_ok', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies sanity of default roles in courses.
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_courserole($detailed=false) {
+    global $CFG, $SITE;
+
+    $problems = array();
+
+    $result = new object();
+    $result->issue   = 'report_security_check_courserole';
+    $result->name    = get_string('check_courserole_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+
+    if ($detailed) {
+        $result->details = get_string('check_courserole_details', 'report_security');
+    }
+
+    // get list of all student roles selected in courses excluding the default course role
+    $sql = "SELECT r.*
+              FROM {$CFG->prefix}role r
+              JOIN {$CFG->prefix}course c ON c.defaultrole = r.id
+             WHERE c.id <> $SITE->id AND r.id <> $CFG->defaultcourseroleid";
+
+    if (!$student_roles = get_records_sql($sql)) {
+        $result->status  = REPORT_SECURITY_OK;
+        $result->info    = get_string('check_courserole_notyet', 'report_security');
+        $result->details = get_string('check_courserole_details', 'report_security');
+
+        return $result;
+    }
+
+    $roleids = array_keys($student_roles);
+
+    $sql = "SELECT DISTINCT rc.roleid
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE (rc.capability = 'moodle/legacy:coursecreator' OR rc.capability = 'moodle/legacy:admin'
+                    OR rc.capability = 'moodle/legacy:teacher' OR rc.capability = 'moodle/legacy:editingteacher')
+                   AND rc.permission = ".CAP_ALLOW."";
+
+    $riskyroleids = get_records_sql($sql);
+    $riskyroleids = array_keys($riskyroleids);
+
+
+    // first test if do anything enabled - that would be really crazy!!!!!!
+    $inroles = implode(',', $roleids);
+    $sql = "SELECT rc.roleid, rc.contextid
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE rc.capability = 'moodle/site:doanything'
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid IN ($inroles)
+          GROUP BY rc.roleid, rc.contextid
+          ORDER BY rc.roleid, rc.contextid";
+
+    $rs = get_recordset_sql($sql);
+    while ($res = rs_fetch_next_record($rs)) {
+        $roleid    = $res->roleid;
+        $contextid = $res->contextid;
+        if ($contextid == SYSCONTEXTID) {
+            $a = "$CFG->wwwroot/$CFG->admin/roles/manage.php?action=view&amp;roleid=$roleid";
+        } else {
+            $a = "$CFG->wwwroot/$CFG->admin/roles/override.php?contextid=$contextid&amp;roleid=$roleid";
+        }
+        $problems[] = get_string('check_courserole_anything', 'report_security', $a);
+    }
+    rs_close($rs);
+
+    // any XSS legacy cap does not make any sense here!
+    $inroles = implode(',', $riskyroleids);
+    $sql = "SELECT DISTINCT c.id, c.shortname
+              FROM {$CFG->prefix}course c
+             WHERE c.defaultrole IN ($inroles)
+          ORDER BY c.sortorder";
+    if ($courses = get_records_sql($sql)) {
+        foreach ($courses as $course) {
+            $a = (object)array('url'=>"$CFG->wwwroot/course/edit.php?id=$course->id", 'shortname'=>$course->shortname);
+            $problems[] = get_string('check_courserole_riskylegacy', 'report_security', $a);
+        }
+    } else {
+        $course = array();
+    }
+
+    // risky caps in any level for roles not marked as risky yet - usually very dangerous!!
+    if ($checkroles = array_diff($roleids, $riskyroleids)) {
+        $inroles = implode(',', $checkroles);
+        $sql = "SELECT rc.roleid, rc.contextid
+                  FROM {$CFG->prefix}role_capabilities rc
+                  JOIN {$CFG->prefix}capabilities cap ON cap.name = rc.capability
+                 WHERE ".sql_bitand('cap.riskbitmask', (RISK_XSS | RISK_CONFIG))." <> 0
+                       AND rc.permission = ".CAP_ALLOW."
+                       AND rc.roleid IN ($inroles)
+              GROUP BY rc.roleid, rc.contextid
+              ORDER BY rc.roleid, rc.contextid";
+        $rs = get_recordset_sql($sql);
+        while ($res = rs_fetch_next_record($rs)) {
+            $roleid    = $res->roleid;
+            $contextid = $res->contextid;
+            if ($contextid == SYSCONTEXTID) {
+                $a = "$CFG->wwwroot/$CFG->admin/roles/manage.php?action=view&amp;roleid=$roleid";
+            } else {
+                $a = "$CFG->wwwroot/$CFG->admin/roles/override.php?contextid=$contextid&amp;roleid=$roleid";
+            }
+            $problems[] = get_string('check_courserole_risky', 'report_security', $a);
+        }
+        rs_close($rs);
+    }
+
+
+    if ($problems) {
+        $result->status  = REPORT_SECURITY_CRITICAL;
+        $result->info    = get_string('check_courserole_error', 'report_security');
+        if ($detailed) {
+            $result->details .= "<ul>";
+            foreach ($problems as $problem) {
+                $result->details .= "<li>$problem</li>";
+            }
+            $result->details .= "</ul>";
+        }
+
+    } else {
+        $result->status  = REPORT_SECURITY_OK;
+        $result->info    = get_string('check_courserole_ok', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Checks to see whether a password salt has been defined
+ *
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_passwordsaltmain($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_passwordsaltmain';
+    $result->name    = get_string('check_passwordsaltmain_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+
+    if (empty($CFG->passwordsaltmain)) {
+        $result->status = REPORT_SECURITY_WARNING;
+        $result->info   = get_string('check_passwordsaltmain_warning', 'report_security');
+    } else if ($CFG->passwordsaltmain === 'a_very_long_random_string_of_characters#@6&*1'
+            || trim($CFG->passwordsaltmain) === '' || preg_match('/^([a-z0-9]{0,10})$/i', $CFG->passwordsaltmain)) {
+        $result->status = REPORT_SECURITY_WARNING;
+        $result->info   = get_string('check_passwordsaltmain_weak', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_passwordsaltmain_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $docspath = $CFG->docroot.'/'.str_replace('_utf8', '', current_language()).'/report/security/report_security_check_passwordsaltmain';
+        $result->details = get_string('check_passwordsaltmain_details', 'report_security', $docspath);
+    }
+
+    return $result;
+}

admin/report/spamcleaner/index.php

@@ -0,0 +1,372 @@
+<?php
+
+/**
+ * Spam Cleaner
+ *
+ * Helps an admin to clean up spam in Moodle
+ *
+ * @version $Id$
+ * @authors Dongsheng Cai, Martin Dougiamas, Amr Hourani
+ * @license http://www.gnu.org/copyleft/gpl.html GNU Public License
+ */
+
+// Configuration
+
+// List of known spammy keywords, please add more here
+
+$autokeywords = array(
+                    "<img",
+                    "fuck",
+                    "casino",
+                    "porn",
+                    "xxx",
+                    "cialis",
+                    "viagra",
+                    "poker",
+                    "warcraft"
+                );
+
+/////////////////////////////////////////////////////////////////////////////////
+
+require_once('../../../config.php');
+require_once($CFG->libdir.'/adminlib.php');
+function delete_user($user) {
+    $updateuser = new object();
+    $updateuser->id           = $user->id;
+    $updateuser->deleted      = 1;
+    $updateuser->username     = addslashes("$user->email.".time());
+    $updateuser->email        = '';
+    $updateuser->idnumber     = '';
+    $updateuser->timemodified = time();
+    if (update_record('user', $updateuser)) {
+        role_unassign(0, $user->id);
+        return true;
+    } else {
+        return false;
+    }
+}
+
+$keyword = optional_param('keyword', '', PARAM_RAW);
+$autodetect = optional_param('autodetect', '', PARAM_RAW);
+$del = optional_param('del', '', PARAM_RAW);
+$delall = optional_param('delall', '', PARAM_RAW);
+$ignore = optional_param('ignore', '', PARAM_RAW);
+$reset = optional_param('reset', '', PARAM_RAW);
+$id = optional_param('id', '', PARAM_INT);
+
+require_login();
+$adminroot = admin_get_root();
+admin_externalpage_setup('reportspamcleaner', $adminroot);
+
+// Implement some AJAX calls 
+
+// Delete one user
+if (!empty($del) && confirm_sesskey() && ($id != $USER->id)) {
+    if (isset($SESSION->users_result[$id])) {
+        $user = $SESSION->users_result[$id];
+        if (delete_user($user)) {
+            unset($SESSION->users_result[$id]);
+            echo 1;
+        } else {
+            echo 0;
+        }
+    } else {
+        echo 0;
+    }
+    exit;
+}
+
+// Delete lots of users
+if (!empty($delall) && confirm_sesskey()) {
+    if (!empty($SESSION->users_result)) {
+        foreach ($SESSION->users_result as $userid => $user) {
+            if ($userid != $USER->id) {
+                if (delete_user($user)) {
+                    unset($SESSION->users_result[$userid]);
+                }
+            }
+        }
+    }
+    echo 1;
+    exit;
+}
+
+if (!empty($ignore)) {
+    unset($SESSION->users_result[$id]);
+    echo 1;
+    exit;
+}
+
+admin_externalpage_print_header($adminroot);
+
+// Print headers and things
+
+print_spamcleaner_javascript();
+
+print_box(get_string('spamcleanerintro', 'report_spamcleaner'));
+
+print_box_start();     // The forms section at the top
+
+?>
+
+<div class="mdl-align">
+
+<form method="post" action="index.php">
+  <div>
+    <input type="text" name="keyword" id="keyword_el" value="<?php p($keyword) ?>" /> 
+    <input type="hidden" name="sesskey" value="<?php echo sesskey();?>" />
+    <input type="submit" value="<?php echo get_string('spamsearch', 'report_spamcleaner')?>" />
+  </div>
+</form>
+<p><?php echo get_string('spameg', 'report_spamcleaner');?></p>
+
+<hr />
+
+<form method="post"  action="index.php">
+  <div>
+    <input type="submit" name="autodetect" value="<?php echo get_string('spamauto', 'report_spamcleaner');?>" />
+  </div>
+</form>
+
+
+</div>
+
+<?php
+print_box_end(); 
+
+echo '<div id="result" class="mdl-align">';
+
+// Print list of resulting profiles
+
+if (!empty($keyword)) {               // Use the keyword(s) supplied by the user
+    $keywords = explode(',', $keyword);
+    foreach ($keywords as $key => $keyword) {
+        $keywords[$key] = trim($keyword);
+    }
+    search_spammers($keywords);
+
+} else if (!empty($autodetect)) {     // Use the inbuilt keyword list to detect users
+    search_spammers($autokeywords);
+}
+
+echo '</div>';
+
+/////////////////////////////////////////////////////////////////////////////////
+
+
+///  Functions 
+
+
+function search_spammers($keywords) {
+
+    global $CFG, $USER, $DB; 
+
+    if (!is_array($keywords)) {
+        $keywords = array($keywords);    // Make it into an array
+    }
+
+    $like = sql_ilike();
+
+    $keywordfull = array();
+    foreach ($keywords as $keyword) {
+        $keyword = addslashes($keyword);   // Just to be safe
+        $keywordfull[] = " description $like '%$keyword%' ";
+        $keywordfull2[] = " p.summary $like '%$keyword%' ";
+    }
+    $conditions = '( '.implode(' OR ', $keywordfull).' )';
+    $conditions2 = '( '.implode(' OR ', $keywordfull2).' )';
+
+    $sql = "SELECT * FROM {$CFG->prefix}user WHERE deleted = 0 AND id <> {$USER->id} AND $conditions";  // Exclude oneself
+    $sql2= "SELECT u.*, p.summary FROM {$CFG->prefix}user AS u, {$CFG->prefix}post AS p WHERE $conditions2 AND u.deleted = 0 AND u.id=p.userid AND u.id <> {$USER->id}";
+    $spamusers_desc = get_recordset_sql($sql);
+    $spamusers_blog = get_recordset_sql($sql2);
+
+    $keywordlist = implode(', ', $keywords);
+    print_box(get_string('spamresult', 'report_spamcleaner').s($keywordlist)).' ...';
+
+    print_user_list(array($spamusers_desc, $spamusers_blog), $keywords);
+
+}
+
+function print_user_list($users_rs, $keywords) {
+    global $CFG, $SESSION;
+
+    // reset session everytime this function is called
+    $SESSION->users_result = array();
+    $count = 0;
+
+    foreach ($users_rs as $rs) {
+        while ($user = rs_fetch_next_record($rs)) {
+            if (!$count) {
+                echo '<table border="1" width="100%" id="data-grid"><tr><th>&nbsp;</th><th>'.get_string('user','admin').'</th><th>'.get_string('spamdesc', 'report_spamcleaner').'</th><th>'.get_string('spamoperation', 'report_spamcleaner').'</th></tr>';
+            }
+            $count++;
+            filter_user($user, $keywords, $count);
+        }
+    }
+
+    if (!$count) {
+        echo get_string('spamcannotfinduser', 'report_spamcleaner');
+
+    } else {
+        echo '</table>';
+        echo '<div class="mld-align">
+              <button id="removeall_btn">'.get_string('spamdeleteall', 'report_spamcleaner').'</button>
+              </div>';
+    }
+}
+function filter_user($user, $keywords, $count) {
+    global $CFG;
+    $image_search = false;
+    if (in_array('<img', $keywords)) {
+        $image_search = true;
+    }
+    if (isset($user->summary)) {
+        $user->description = '<h3>'.get_string('spamfromblog', 'report_spamcleaner').'</h3>'.$user->summary;
+        unset($user->summary);
+    }
+    if (preg_match('#<img.*src=[\"\']('.$CFG->pixpath.')#', $user->description, $matches)
+        && $image_search) {
+        $result = false;
+        foreach ($keywords as $keyword) {
+            if (preg_match('#'.$keyword.'#', $user->description)
+                && ($keyword != '<img')) {
+                $result = true;
+            }
+        }
+        if ($result) {
+            echo print_user_entry($user, $keywords, $count);
+        } else {
+            unset($user);
+        }
+    } else {
+        echo print_user_entry($user, $keywords, $count);
+    }
+}
+
+
+function print_user_entry($user, $keywords, $count) {
+
+    global $SESSION, $CFG;
+
+    $smalluserobject = new object;      // All we need to delete them later
+    $smalluserobject->id = $user->id;
+    $smalluserobject->email = $user->email;
+    $smalluserobject->auth = $user->auth;
+    $smalluserobject->firstname = $user->firstname;
+    $smalluserobject->lastname = $user->lastname;
+
+    if (empty($SESSION->users_result[$user->id])) {
+        $SESSION->users_result[$user->id] = $smalluserobject;
+        $html = '<tr valign="top" id="row-'.$user->id.'" class="result-row">';
+        $html .= '<td width="10">'.$count.'</td>';
+        $html .= '<td width="30%" align="left"><a href="'.$CFG->wwwroot."/user/view.php?course=1&amp;id=".$user->id.'" title="'.s($user->username).'">'.fullname($user).'</a>';
+
+        $html .= "<ul>";
+        $profile_set = array('city'=>true, 'country'=>true, 'email'=>true);
+        foreach ($profile_set as $key=>$value) {
+            if (isset($user->$key)){
+                $html .= '<li>'.$user->$key.'</li>';
+            }
+        }
+        $html .= "</ul>";
+        $html .= '</td>';
+
+        foreach ($keywords as $keyword) {
+            $user->description = highlight($keyword, $user->description);
+        }
+
+        $html .= '<td align="left">'.format_text($user->description, FORMAT_MOODLE).'</td>';
+        $html .= '<td width="100px" align="center">';
+        $html .= '<button onclick="del_user(this,'.$user->id.')">'.get_string('deleteuser', 'admin').'</button><br />';
+        $html .= '<button onclick="ignore_user(this,'.$user->id.')">'.get_string('ignore', 'admin').'</button>';
+        $html .= '</td>';
+        $html .= '</tr>';
+        return $html;
+    } else {
+        return null;
+    }
+
+
+}
+
+function print_spamcleaner_javascript()  {
+    global $CFG;
+
+$sesskey = sesskey();
+
+?>
+<script type="text/javascript" src="<?php echo $CFG->wwwroot;?>/lib/yui/yahoo-dom-event/yahoo-dom-event.js"></script>
+<script type="text/javascript" src="<?php echo $CFG->wwwroot;?>/lib/yui/connection/connection-min.js"></script>
+<script type="text/javascript">
+//<![CDATA[
+var row = null;
+var delall_cb = {
+    success: function(o){
+        var resp = o.responseText;
+        if(resp){
+            window.location.href=window.location.href;
+        }
+    }
+}
+function init() {
+    YAHOO.util.Event.addListener("removeall_btn", "click", function(){
+        var yes = confirm('<?php echo get_string('spamdeleteallconfirm', 'report_spamcleaner');?>');
+        if(yes){
+            var cObj = YAHOO.util.Connect.asyncRequest('POST', '<?php echo me();?>?delall=yes&sesskey=<?php echo $sesskey;?>', delall_cb); 
+        }
+    });
+}
+var del_cb = {
+    success: function(o) {
+        var resp = o.responseText;
+        if(row) {
+            if(resp){
+                while(row.tagName != 'TR') {
+                    row = row.parentNode;
+                }
+                row.parentNode.removeChild(row);
+                row = null;
+            } else {
+                alert('<?php echo get_string('spamcannotdelete', 'report_spamcleaner');?>');
+            }
+        }
+    }
+}
+var ignore_cb = {
+    success: function(o){
+        var resp = o.responseText;
+        if(row) {
+            if(resp){
+                while(row.tagName != 'TR') {
+                    row = row.parentNode;
+                }
+                row.parentNode.removeChild(row);
+                row = null;
+            }
+        }
+    }
+}
+function del_user(obj, id) {
+    var yes = confirm('<?php echo get_string('spamdeleteconfirm', 'report_spamcleaner');?>');
+    if(yes){
+        row = obj;
+        var cObj = YAHOO.util.Connect.asyncRequest('POST', '<?php echo me();?>?del=yes&sesskey=<?php echo $sesskey;?>&id='+id, del_cb); 
+    }
+}
+function ignore_user(obj, id) {
+    row = obj;
+    var cObj = YAHOO.util.Connect.asyncRequest('POST', '<?php echo me();?>?ignore=yes&sesskey=<?php echo $sesskey;?>&id='+id, ignore_cb); 
+}
+window.onload = function(){
+    init();
+}
+//]]>
+</script>
+
+<?php 
+}
+
+admin_externalpage_print_footer($adminroot);
+
+?>

admin/report/spamcleaner/settings.php

@@ -0,0 +1,5 @@
+<?php
+
+// spam cleaner
+$ADMIN->add('reports', new admin_externalpage('reportspamcleaner', get_string('spamcleaner','report_spamcleaner'), "$CFG->wwwroot/$CFG->admin/report/spamcleaner/index.php", 'moodle/site:config'));
+

admin/roles/allowassign.php

@@ -24,10 +24,10 @@
 
     $roles = get_all_roles();
 
-    if ($grant = data_submitted()) {
+    if ($grant = data_submitted() and confirm_sesskey()) {
 
         foreach ($grant as $grole => $val) {
-            if ($grole == 'dummy') {
+            if ($grole == 'dummy' or !strpos($grole, '_')) {
                 continue;
             }
 
@@ -82,6 +82,7 @@
     print_table($table);
     echo '<div class="buttons"><input type="submit" value="'.get_string('savechanges').'"/>';
     echo '<input type="hidden" name="dummy" value="1" />'; // this is needed otherwise we do not know a form has been submitted
+    echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
     echo '</div></form>';
 
     admin_externalpage_print_footer($adminroot);

admin/roles/allowoverride.php

@@ -22,10 +22,10 @@
 
     $roles = get_all_roles();
 
-    if ($grant = data_submitted()) {
+    if ($grant = data_submitted() and confirm_sesskey()) {
 
         foreach ($grant as $grole => $val) {
-            if ($grole == 'dummy') {
+            if ($grole == 'dummy' or !strpos($grole, '_')) {
                 continue;
             }
 
@@ -80,6 +80,7 @@
     print_table($table);
     echo '<div class="buttons"><input type="submit" value="'.get_string('savechanges').'"/>';
     echo '<input type="hidden" name="dummy" value="1" />'; // this is needed otherwise we do not know a form has been submitted
+    echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
     echo '</div></form>';
 
     admin_externalpage_print_footer($adminroot);

admin/settings/mnet.php

@@ -3,19 +3,19 @@
 // This file defines settingpages and externalpages under the "mnet" category
 
 $ADMIN->add('mnet', new admin_externalpage('net', get_string('settings', 'mnet'), 
-                                           $CFG->wwwroot . '/admin/mnet/index.php', 
+                                           "$CFG->wwwroot/$CFG->admin/mnet/index.php",
                                            'moodle/site:config'));
 
 $ADMIN->add('mnet', new admin_externalpage('mnetpeers', get_string('mnetpeers', 'mnet'), 
-                                           $CFG->wwwroot . '/admin/mnet/peers.php', 
+                                           "$CFG->wwwroot/$CFG->admin/mnet/peers.php",
                                            'moodle/site:config'));
 $ADMIN->add('mnet', new admin_externalpage('ssoaccesscontrol', get_string('ssoaccesscontrol', 'mnet'),
-                                           $CFG->wwwroot . '/admin/mnet/access_control.php', 
+                                           "$CFG->wwwroot/$CFG->admin/mnet/access_control.php",
                                            'moodle/site:config'));
 $ADMIN->add('mnet', new admin_externalpage('mnetenrol', get_string('mnetenrol', 'mnet'), 
-                                           $CFG->wwwroot . '/admin/mnet/enr_hosts.php', 
+                                           "$CFG->wwwroot/$CFG->admin/mnet/enr_hosts.php",
                                            'moodle/site:config'));
 $ADMIN->add('mnet', new admin_externalpage('trustedhosts', get_string('trustedhosts', 'mnet'), 
-                                           $CFG->wwwroot . '/admin/mnet/trustedhosts.php', 
+                                           "$CFG->wwwroot/$CFG->admin/mnet/trustedhosts.php",
                                            'moodle/site:config'));
 ?>

admin/settings/security.php

@@ -33,9 +33,11 @@ $temp->add(new admin_setting_configselect('bloglevel', get_string('bloglevel', '
                                                                                                                                           1 => get_string('personalblogs','blog'),
                                                                                                                                           0 => get_string('disableblogs','blog'))));
 
+$temp->add(new admin_setting_configcheckbox('profilesforenrolledusersonly', get_string('profilesforenrolledusersonly','admin'),get_string('configprofilesforenrolledusersonly', 'admin'),'1'));
+
 $temp->add(new admin_setting_configcheckbox('cronclionly', get_string('cronclionly', 'admin'), get_string('configcronclionly', 'admin'), 0));
 $temp->add(new admin_setting_configtext('cronremotepassword', get_string('cronremotepassword', 'admin'), get_string('configcronremotepassword', 'admin'), '', PARAM_RAW));
-$temp->add(new admin_setting_configcheckbox('emailchangeconfirmation', get_string('emailchangeconfirmation', 'admin'), get_string('configemailchangeconfirmation', 'admin'), 0));
+$temp->add(new admin_setting_configcheckbox('emailchangeconfirmation', get_string('emailchangeconfirmation', 'admin'), get_string('configemailchangeconfirmation', 'admin'), 1));
 
 $ADMIN->add('security', $temp);
 
@@ -45,6 +47,7 @@ $ADMIN->add('security', $temp);
 // "httpsecurity" settingpage
 $temp = new admin_settingpage('httpsecurity', get_string('httpsecurity', 'admin'));
 $temp->add(new admin_setting_configcheckbox('loginhttps', get_string('loginhttps', 'admin'), get_string('configloginhttps', 'admin'), 0));
+$temp->add(new admin_setting_configtext('excludeoldflashclients', get_string('excludeoldflashclients', 'admin'), get_string('configexcludeoldflashclients', 'admin'), '10.0.12', PARAM_TEXT));
 $ADMIN->add('security', $temp);
 
 

admin/settings/server.php

@@ -17,7 +17,7 @@ $ADMIN->add('server', $temp, 0);
 
 // "email" settingpage
 $temp = new admin_settingpage('mail', get_string('mail','admin'));
-$temp->add(new admin_setting_configtext('smtphosts', get_string('smtphosts', 'admin'), get_string('configsmtphosts', 'admin'), '', PARAM_HOST));
+$temp->add(new admin_setting_configtext('smtphosts', get_string('smtphosts', 'admin'), get_string('configsmtphosts', 'admin'), '', PARAM_RAW));
 $temp->add(new admin_setting_configtext('smtpuser', get_string('smtpuser', 'admin'), get_string('configsmtpuser', 'admin'), '', PARAM_NOTAGS));
 $temp->add(new admin_setting_configtext('smtppass', get_string('smtppass', 'admin'), get_string('configsmtpuser', 'admin'), '', PARAM_RAW));
 $temp->add(new admin_setting_configtext('noreplyaddress', get_string('noreplyaddress', 'admin'), get_string('confignoreplyaddress', 'admin'), 'noreply@' . $_SERVER['HTTP_HOST'], PARAM_NOTAGS));

admin/user.php

@@ -114,8 +114,8 @@
             $updateuser->id           = $user->id;
             $updateuser->deleted      = 1;
             $updateuser->username     = addslashes("$user->email.".time());  // Remember it just in case
-            $updateuser->email        = '';               // Clear this field to free it up
-            $updateuser->idnumber     = '';               // Clear this field to free it up
+            $updateuser->email        = md5($user->username); // Store hash of username, useful importing/restoring users
+            $updateuser->idnumber     = '';                   // Clear this field to free it up
             $updateuser->timemodified = time();
             if (update_record('user', $updateuser)) {
                 // Removing a user may have more requirements than just removing their role assignments.

admin/xmldb/actions/XMLDBAction.class.php

@@ -47,6 +47,8 @@ class XMLDBAction {
 
     var $postaction;     //Action to execute at the end of the invoke script
 
+    var $sesskey_protected; // Actions must be protected by sesskey mechanishm
+
     /**
      * Constructor
      */
@@ -72,6 +74,7 @@ class XMLDBAction {
         $this->output    = NULL;
         $this->errormsg  = NULL;
         $this->subaction = NULL;
+        $this->sesskey_protected = true;
     }
 
     /**
@@ -130,13 +133,18 @@ class XMLDBAction {
     }
 
     /**
-     * main invoke method, it simply sets the postaction attribute
-     * if possible
+     * main invoke method, it sets the postaction attribute
+     * if possible and checks sesskey_protected if needed
      */
     function invoke() {
 
         global $SESSION;
 
+    /// Sesskey protection
+        if ($this->sesskey_protected) {
+            require_sesskey();
+        }
+
     /// If we are used any dir, save it in the lastused session object
     /// Some actions can use it to perform positioning
         if ($lastused = optional_param ('dir', NULL, PARAM_PATH)) {

admin/xmldb/actions/check_indexes/check_indexes.class.php

@@ -94,7 +94,7 @@ class check_indexes extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmcheckindexes'] . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=check_indexes&amp;confirmed=yes" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=check_indexes&amp;sesskey=' . sesskey() . '&amp;confirmed=yes" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';
@@ -213,6 +213,10 @@ class check_indexes extends XMLDBAction {
                                 $o.='        </ul>';
                             }
                             $o.='    </li>';
+                        /// Give the script some more time (resetting to current if exists)
+                            if ($currenttl = @ini_get('max_execution_time')) {
+                                @ini_set('max_execution_time',$currenttl);
+                            }
                         }
                         $o.='        </ul>';
                     }

admin/xmldb/actions/delete_field/delete_field.class.php

@@ -77,7 +77,7 @@ class delete_field extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletefield'] . '<br /><br />' . $fieldparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_field&amp;confirmed=yes&amp;postaction=edit_table&amp;field=' . $fieldparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_field&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_table&amp;field=' . $fieldparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_index/delete_index.class.php

@@ -77,7 +77,7 @@ class delete_index extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeleteindex'] . '<br /><br />' . $indexparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_index&amp;confirmed=yes&amp;postaction=edit_table&amp;index=' . $indexparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_index&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_table&amp;index=' . $indexparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_key/delete_key.class.php

@@ -77,7 +77,7 @@ class delete_key extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletekey'] . '<br /><br />' . $keyparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_key&amp;confirmed=yes&amp;postaction=edit_table&amp;key=' . $keyparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_key&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_table&amp;key=' . $keyparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_sentence/delete_sentence.class.php

@@ -77,7 +77,7 @@ class delete_sentence extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletesentence'] . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_sentence&amp;confirmed=yes&amp;postaction=edit_statement&amp;sentence=' . $sentenceparam . '&amp;statement=' . urlencode($statementparam) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_sentence&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_statement&amp;sentence=' . $sentenceparam . '&amp;statement=' . urlencode($statementparam) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_statement/delete_statement.class.php

@@ -76,7 +76,7 @@ class delete_statement extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletestatement'] . '<br /><br />' . $statementparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_statement&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_statement&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_table/delete_table.class.php

@@ -76,7 +76,7 @@ class delete_table extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletetable'] . '<br /><br />' . $tableparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_table&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_table&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_xml_file/delete_xml_file.class.php

@@ -75,7 +75,7 @@ class delete_xml_file extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletexmlfile'] . '<br /><br />' . $dirpath . '/install.php</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_xml_file&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_xml_file&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/edit_field/edit_field.class.php

@@ -35,6 +35,7 @@ class edit_field extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -84,7 +85,7 @@ class edit_field extends XMLDBAction {
     /// Fetch request data
         $tableparam = required_param('table', PARAM_CLEAN);
         if (!$table =& $structure->getTable($tableparam)) {
-            $this->errormsg = 'Wrong table specified: ' . $tableparm;
+            $this->errormsg = 'Wrong table specified: ' . $tableparam;
             return false;
         }
         $fieldparam = required_param('field', PARAM_CLEAN);
@@ -103,6 +104,7 @@ class edit_field extends XMLDBAction {
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
         $o.= '    <input type="hidden" name ="field" value="' . $fieldparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_field_save" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';

admin/xmldb/actions/edit_index/edit_index.class.php

@@ -35,6 +35,7 @@ class edit_index extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -84,7 +85,7 @@ class edit_index extends XMLDBAction {
     /// Fetch request data
         $tableparam = required_param('table', PARAM_CLEAN);
         if (!$table =& $structure->getTable($tableparam)) {
-            $this->errormsg = 'Wrong table specified: ' . $tableparm;
+            $this->errormsg = 'Wrong table specified: ' . $tableparam;
             return false;
         }
         $indexparam = required_param('index', PARAM_CLEAN);
@@ -103,6 +104,7 @@ class edit_index extends XMLDBAction {
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
         $o.= '    <input type="hidden" name ="index" value="' . $indexparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_index_save" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';

admin/xmldb/actions/edit_key/edit_key.class.php

@@ -35,6 +35,7 @@ class edit_key extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -84,7 +85,7 @@ class edit_key extends XMLDBAction {
     /// Fetch request data
         $tableparam = required_param('table', PARAM_CLEAN);
         if (!$table =& $structure->getTable($tableparam)) {
-            $this->errormsg = 'Wrong table specified: ' . $tableparm;
+            $this->errormsg = 'Wrong table specified: ' . $tableparam;
             return false;
         }
         $keyparam = required_param('key', PARAM_CLEAN);
@@ -103,6 +104,7 @@ class edit_key extends XMLDBAction {
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
         $o.= '    <input type="hidden" name ="key" value="' . $keyparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_key_save" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';

admin/xmldb/actions/edit_sentence/edit_sentence.class.php

@@ -35,6 +35,7 @@ class edit_sentence extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -119,6 +120,7 @@ class edit_sentence extends XMLDBAction {
             $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
             $o.= '    <input type="hidden" name ="statement" value="' . $statementparam .'" />';
             $o.= '    <input type="hidden" name ="sentence" value="' . $sentenceparam .'" />';
+            $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
             $o.= '    <input type="hidden" name ="action" value="edit_sentence_save" />';
             $o.= '    <input type="hidden" name ="postaction" value="edit_statement" />';
             $o.= '    <table id="formelements" class="boxaligncenter">';

admin/xmldb/actions/edit_statement/edit_statement.class.php

@@ -35,6 +35,7 @@ class edit_statement extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -106,6 +107,7 @@ class edit_statement extends XMLDBAction {
         $o.= '<div>';        
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="statement" value="' . $statementparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_statement_save" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_statement" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';
@@ -129,7 +131,7 @@ class edit_statement extends XMLDBAction {
             $b .= '&nbsp;[' . $this->str['viewedited'] . ']';
         }
     /// The new sentence button
-        $b .= '&nbsp;<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newsentence'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;sesskey=' . sesskey() . '&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newsentence'] . ']</a>';
     /// The back to edit xml file button
         $b .= '&nbsp;<a href="index.php?action=edit_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['back'] . ']</a>';
         $b .= '</p>';
@@ -157,10 +159,10 @@ class edit_statement extends XMLDBAction {
                 $b .= '<a href="index.php?action=edit_sentence&amp;sentence=' .$key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['edit'] . ']</a>';
                 $b .= '</td><td class="button cell">';
             /// The duplicate button
-                $b .= '<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;basesentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['duplicate'] . ']</a>';
+                $b .= '<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;sesskey=' . sesskey() . '&amp;basesentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['duplicate'] . ']</a>';
                 $b .= '</td><td class="button cell">';
             /// The delete button
-                $b .= '<a href="index.php?action=delete_sentence&amp;sentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                $b .= '<a href="index.php?action=delete_sentence&amp;sesskey=' . sesskey() . '&amp;sentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                 $b .= '</td>';
             /// Print table row
             $o .= '<tr class="r' . $row . '"><td class="table cell">' . $p . $sentence . $b . '</tr>';

admin/xmldb/actions/edit_table/edit_table.class.php

@@ -35,6 +35,7 @@ class edit_table extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -107,6 +108,7 @@ class edit_table extends XMLDBAction {
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_table_save" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';
     /// If the table is being used, we cannot rename it
@@ -134,11 +136,11 @@ class edit_table extends XMLDBAction {
             $b .= '&nbsp;[' . $this->str['viewedited'] . ']';
         }
     /// The new field button
-        $b .= '&nbsp;<a href="index.php?action=new_field&amp;postaction=edit_field&amp;table=' . $tableparam . '&amp;field=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newfield'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_field&amp;sesskey=' . sesskey() . '&amp;postaction=edit_field&amp;table=' . $tableparam . '&amp;field=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newfield'] . ']</a>';
     /// The new key button
-        $b .= '&nbsp;<a href="index.php?action=new_key&amp;postaction=edit_key&amp;table=' . $tableparam . '&amp;key=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newkey'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_key&amp;sesskey=' . sesskey() . '&amp;postaction=edit_key&amp;table=' . $tableparam . '&amp;key=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newkey'] . ']</a>';
     /// The new index button
-        $b .= '&nbsp;<a href="index.php?action=new_index&amp;postaction=edit_index&amp;table=' . $tableparam . '&amp;index=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newindex'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_index&amp;sesskey=' . sesskey() . '&amp;postaction=edit_index&amp;table=' . $tableparam . '&amp;index=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newindex'] . ']</a>';
     /// The back to edit xml file button
         $b .= '&nbsp;<a href="index.php?action=edit_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['back'] . ']</a>';
         $b .= '</p>';
@@ -185,14 +187,14 @@ class edit_table extends XMLDBAction {
                 $b .= '</td><td class="button cell">';
             /// The up button
                 if ($field->getPrevious()) {
-                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=up&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['up'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The down button
                 if ($field->getNext()) {
-                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=down&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['down'] . ']';
                 }
@@ -200,7 +202,7 @@ class edit_table extends XMLDBAction {
             /// The delete button (if we have more than one and it isn't used
                 if (count($fields) > 1 &&
                 !$structure->getFieldUses($table->getName(), $field->getName())) {
-                    $b .= '<a href="index.php?action=delete_field&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_field&amp;sesskey=' . sesskey() . '&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['delete'] . ']';
                 }
@@ -234,21 +236,21 @@ class edit_table extends XMLDBAction {
                 $b .= '</td><td class="button cell">';
             /// The up button
                 if ($key->getPrevious()) {
-                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=up&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['up'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The down button
                 if ($key->getNext()) {
-                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=down&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['down'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The delete button (if the key hasn't uses)
                 if (!$structure->getKeyUses($table->getName(), $key->getName())) {
-                    $b .= '<a href="index.php?action=delete_key&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_key&amp;sesskey=' . sesskey() . '&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['delete'] . ']';
                 }
@@ -274,20 +276,20 @@ class edit_table extends XMLDBAction {
                 $b .= '</td><td class="button cell">';
             /// The up button
                 if ($index->getPrevious()) {
-                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=up&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['up'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The down button
                 if ($index->getNext()) {
-                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=down&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['down'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The delete button
-                    $b .= '<a href="index.php?action=delete_index&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_index&amp;sesskey=' . sesskey() . '&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
             /// The readable info
                 $r = '</td><td class="readableinfo cell">' . $index->readableInfo() . '</td>';
             /// Print table row

admin/xmldb/actions/edit_xml_file/edit_xml_file.class.php

@@ -35,6 +35,7 @@ class edit_xml_file extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -107,6 +108,7 @@ class edit_xml_file extends XMLDBAction {
                 $o.= '    <input type="hidden" name ="postaction" value="edit_xml_file" />';
                 $o.= '    <input type="hidden" name ="path" value="' . s($structure->getPath()) .'" />';
                 $o.= '    <input type="hidden" name ="version" value="' . s($structure->getVersion()) .'" />';
+                $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
                 $o.= '    <table id="formelements" class="boxaligncenter">';
                 $o.= '      <tr valign="top"><td>Path:</td><td>' . s($structure->getPath()) . '</td></tr>';
                 $o.= '      <tr valign="top"><td>Version:</td><td>' . s($structure->getVersion()) . '</td></tr>';
@@ -125,15 +127,15 @@ class edit_xml_file extends XMLDBAction {
                     $b .= '&nbsp;[' . $this->str['viewedited'] . ']';
                 }
             /// The new table button
-                $b .= '&nbsp;<a href="index.php?action=new_table&amp;postaction=edit_table&amp;table=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtable'] . ']</a>';
+                $b .= '&nbsp;<a href="index.php?action=new_table&amp;sesskey=' . sesskey() . '&amp;postaction=edit_table&amp;table=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtable'] . ']</a>';
             /// The new from MySQL button
                 if ($CFG->dbfamily == 'mysql') {
-                    $b .= '&nbsp;<a href="index.php?action=new_table_from_mysql&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtablefrommysql'] . ']</a>';
+                    $b .= '&nbsp;<a href="index.php?action=new_table_from_mysql&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtablefrommysql'] . ']</a>';
                 } else {
                     $b .= '&nbsp;[' . $this->str['newtablefrommysql'] . ']';
                 }
             /// The new statement button
-                $b .= '&nbsp;<a href="index.php?action=new_statement&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newstatement'] . ']</a>';
+                $b .= '&nbsp;<a href="index.php?action=new_statement&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newstatement'] . ']</a>';
             /// The back to main menu button
                 $b .= '&nbsp;<a href="index.php?action=main_view#lastused">[' . $this->str['backtomainview'] . ']</a>';
                 $b .= '</p>';
@@ -169,14 +171,14 @@ class edit_xml_file extends XMLDBAction {
                         $b .= '</td><td class="button cell">';
                     /// The up button
                         if ($table->getPrevious()) {
-                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=up&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['up'] . ']';
                         }
                         $b .= '</td><td class="button cell">';
                     /// The down button
                         if ($table->getNext()) {
-                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=down&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['down'] . ']';
                         }
@@ -185,7 +187,7 @@ class edit_xml_file extends XMLDBAction {
                         if (count($tables) > 1 &&
                             !$structure->getTableUses($table->getName())) {
                             ///!$structure->getTableUses($table->getName())) {
-                            $b .= '<a href="index.php?action=delete_table&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                            $b .= '<a href="index.php?action=delete_table&amp;sesskey=' . sesskey() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['delete'] . ']';
                         }
@@ -214,20 +216,20 @@ class edit_xml_file extends XMLDBAction {
                         $b .= '</td><td class="button cell">';
                     /// The up button
                         if ($statement->getPrevious()) {
-                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=up&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['up'] . ']';
                         }
                         $b .= '</td><td class="button cell">';
                     /// The down button
                         if ($statement->getNext()) {
-                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=down&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['down'] . ']';
                         }
                         $b .= '</td><td class="button cell">';
                     /// The delete button
-                        $b .= '<a href="index.php?action=delete_statement&amp;statement=' . $statement->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                        $b .= '<a href="index.php?action=delete_statement&amp;sesskey=' . sesskey() . '&amp;statement=' . $statement->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                         $b .= '</td>';
                     /// Print statement row
                         $o .= '<tr class="r' . $row . '"><td class="statement cell"><a href="index.php?action=view_statement_xml&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;statement=' . $statement->getName() . '&amp;select=edited">' . $statement->getName() . '</a>' . $b . '</tr>';

admin/xmldb/actions/get_db_directories/get_db_directories.class.php

@@ -39,6 +39,7 @@ class get_db_directories extends XMLDBAction {
         //$this->can_subaction = ACTION_HAVE_SUBACTIONS;
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/load_xml_file/load_xml_file.class.php

@@ -38,6 +38,7 @@ class load_xml_file extends XMLDBAction {
         //$this->can_subaction = ACTION_HAVE_SUBACTIONS;
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/main_view/main_view.class.php

@@ -35,6 +35,7 @@ class main_view extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -84,9 +85,9 @@ class main_view extends XMLDBAction {
     /// The reserved_words button
         $b .= '&nbsp;<a href="index.php?action=view_reserved_words">[' . $this->str['reservedwords'] . ']</a>';
     /// The test button
-        $b .= '&nbsp;<a href="index.php?action=test">[' . $this->str['test'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=test&amp;sesskey=' . sesskey() . '">[' . $this->str['test'] . ']</a>';
     /// The check indexes button
-        $b .= '&nbsp;<a href="index.php?action=check_indexes">[' . $this->str['checkindexes'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=check_indexes&amp;sesskey=' . sesskey() . '">[' . $this->str['checkindexes'] . ']</a>';
         $b .= '</p>';
     /// Send buttons to output
         $o .= $b;
@@ -126,7 +127,7 @@ class main_view extends XMLDBAction {
                 if ($dbdir->path_exists &&
                     !file_exists($key . '/install.xml') &&
                     is_writeable($key)) {
-                    $b .= '<a href="index.php?action=create_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['create'] . ']</a>';
+                    $b .= '<a href="index.php?action=create_xml_file&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['create'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['create'] . ']';
                 }
@@ -159,7 +160,7 @@ class main_view extends XMLDBAction {
                     is_writeable($key) &&
                     !empty($dbdir->xml_loaded) &&
                     !empty($dbdir->xml_changed)) {
-                    $b .= '<a href="index.php?action=save_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['save'] . ']</a>';
+                    $b .= '<a href="index.php?action=save_xml_file&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['save'] . ']</a>';
                 /// Check if the file has been manually edited while being modified in the editor
                     if ($dbdir->filemtime != filemtime($key . '/install.xml')) {
                     /// File manually modified. Add to errors.
@@ -178,7 +179,7 @@ class main_view extends XMLDBAction {
                     is_writeable($key) &&
                     !empty($dbdir->xml_loaded) &&
                     !empty($dbdir->xml_changed)) {
-                    $b .= '<a href="index.php?action=revert_changes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['revert'] . ']</a>';
+                    $b .= '<a href="index.php?action=revert_changes&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['revert'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['revert'] . ']';
                 }
@@ -200,7 +201,7 @@ class main_view extends XMLDBAction {
                     is_readable($key . '/install.xml') &&
                     is_writeable($key) &&
                     empty($dbdir->xml_loaded)) {
-                    $b .= '<a href="index.php?action=delete_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_xml_file&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['delete'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['delete'] . ']';
                 }

admin/xmldb/actions/new_statement/new_statement.class.php

@@ -107,6 +107,7 @@ class new_statement extends XMLDBAction {
             $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
             $o.= '    <input type="hidden" name ="action" value="new_statement" />';
             $o.= '    <input type="hidden" name ="postaction" value="edit_statement" />';
+            $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() . '" />';
             $o.= '    <table id="formelements" class="boxaligncenter" cellpadding="5">';
             $o.= '      <tr><td><label for="type" accesskey="t">' . $this->str['statementtype'] .' </label>' . choose_from_menu($typeoptions, 'type', '', 'choose', '', 0, true) . '<label for="table" accesskey="a">' . $this->str['statementtable'] . ' </label>' .choose_from_menu($selecttables, 'table', '', 'choose', '', 0, true) . '</td></tr>';
             $o.= '      <tr><td colspan="2" align="center"><input type="submit" value="' .$this->str['create'] . '" /></td></tr>';

admin/xmldb/actions/new_table_from_mysql/new_table_from_mysql.class.php

@@ -111,6 +111,7 @@ class new_table_from_mysql extends XMLDBAction {
             $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
             $o.= '    <input type="hidden" name ="action" value="new_table_from_mysql" />';
             $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
+            $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() . '" />';
             $o.= '    <table id="formelements" class="boxaligncenter" cellpadding="5">';
             $o.= '      <tr><td><label for="table" accesskey="t">' . $this->str['createtable'] .' </label>' . choose_from_menu($selecttables, 'table', '', 'choose', '', 0, true) . '<label for="after" accesskey="a">' . $this->str['aftertable'] . ' </label>' .choose_from_menu($aftertables, 'after', '', 'choose', '', 0, true) . '</td></tr>';
             $o.= '      <tr><td colspan="2" align="center"><input type="submit" value="' .$this->str['create'] . '" /></td></tr>';

admin/xmldb/actions/revert_changes/revert_changes.class.php

@@ -75,7 +75,7 @@ class revert_changes extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmrevertchanges'] . '<br /><br />' . $dirpath . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=revert_changes&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=revert_changes&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/test/test.class.php

@@ -955,6 +955,20 @@ class test extends XMLDBAction {
 
         $this->output = $o;
 
+    /// Finally drop all the potentially existing test tables
+        $table = new XMLDBTable('testtable');
+        if (table_exists($table)) {
+            $status = drop_table($table, true, false);
+        }
+        $table = new XMLDBTable ('anothertest');
+        if (table_exists($table)) {
+            $status = drop_table($table, true, false);
+        }
+        $table = new XMLDBTable ('newnameforthetable');
+        if (table_exists($table)) {
+            $status = drop_table($table, true, false);
+        }
+
     /// Launch postaction if exists (leave this here!)
         if ($this->getPostAction() && $result) {
             return $this->launch($this->getPostAction());

admin/xmldb/actions/unload_xml_file/unload_xml_file.class.php

@@ -35,6 +35,7 @@ class unload_xml_file extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_field_xml/view_field_xml.class.php

@@ -35,6 +35,7 @@ class view_field_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_index_xml/view_index_xml.class.php

@@ -35,6 +35,7 @@ class view_index_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_key_xml/view_key_xml.class.php

@@ -35,6 +35,7 @@ class view_key_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_reserved_words/view_reserved_words.class.php

@@ -38,6 +38,7 @@ class view_reserved_words extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+    $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_statement_xml/view_statement_xml.class.php

@@ -35,6 +35,7 @@ class view_statement_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_structure_php/view_structure_php.class.php

@@ -36,6 +36,7 @@ class view_structure_php extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_structure_sql/view_structure_sql.class.php

@@ -36,6 +36,7 @@ class view_structure_sql extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_structure_xml/view_structure_xml.class.php

@@ -35,6 +35,7 @@ class view_structure_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_table_php/view_table_php.class.php

@@ -36,6 +36,7 @@ class view_table_php extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_table_sql/view_table_sql.class.php

@@ -36,6 +36,7 @@ class view_table_sql extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -80,7 +81,7 @@ class view_table_sql extends XMLDBAction {
     /// Get parameters
         $tableparam = required_param('table', PARAM_PATH);
         if (!$table =& $structure->getTable($tableparam)) {
-            $this->errormsg = 'Wrong table specified: ' . $tableparm;
+            $this->errormsg = 'Wrong table specified: ' . $tableparam;
             return false;
         }
         $generatorparam = optional_param('generator', null, PARAM_ALPHANUM);

admin/xmldb/actions/view_table_xml/view_table_xml.class.php

@@ -35,6 +35,7 @@ class view_table_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_xml/view_xml.class.php

@@ -38,6 +38,7 @@ class view_xml extends XMLDBAction {
         //$this->can_subaction = ACTION_HAVE_SUBACTIONS;
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

auth/cas/CAS/CAS/PGTStorage/pgt-main.php

@@ -0,0 +1,214 @@
+<?php
+/*
+ * Copyright © 2003-2010, The ESUP-Portail consortium & the JA-SIG Collaborative.
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ * 
+ *     * Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright notice,
+ *       this list of conditions and the following disclaimer in the documentation
+ *       and/or other materials provided with the distribution.
+ *     * Neither the name of the ESUP-Portail consortium & the JA-SIG
+ *       Collaborative nor the names of its contributors may be used to endorse or
+ *       promote products derived from this software without specific prior
+ *       written permission.
+
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+/**
+ * @file CAS/PGTStorage/pgt-main.php
+ * Basic class for PGT storage
+ */
+
+/**
+ * @class PGTStorage
+ * The PGTStorage class is a generic class for PGT storage. This class should
+ * not be instanciated itself but inherited by specific PGT storage classes.
+ *
+ * @author   Pascal Aubry <pascal.aubry at univ-rennes1.fr>
+ *
+ * @ingroup internalPGTStorage
+ */
+
+class PGTStorage
+{
+  /** 
+   * @addtogroup internalPGTStorage
+   * @{ 
+   */
+
+  // ########################################################################
+  //  CONSTRUCTOR
+  // ########################################################################
+  
+  /**
+   * The constructor of the class, should be called only by inherited classes.
+   *
+   * @param $cas_parent the CASclient instance that creates the current object.
+   *
+   * @protected
+   */
+  function PGTStorage($cas_parent)
+    {
+      phpCAS::traceBegin();
+      if ( !$cas_parent->isProxy() ) {
+	phpCAS::error('defining PGT storage makes no sense when not using a CAS proxy'); 
+      }
+      phpCAS::traceEnd();
+    }
+
+  // ########################################################################
+  //  DEBUGGING
+  // ########################################################################
+  
+  /**
+   * This virtual method returns an informational string giving the type of storage
+   * used by the object (used for debugging purposes).
+   *
+   * @public
+   */
+  function getStorageType()
+    {
+      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
+    }
+
+  /**
+   * This virtual method returns an informational string giving informations on the
+   * parameters of the storage.(used for debugging purposes).
+   *
+   * @public
+   */
+  function getStorageInfo()
+    {
+      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
+    }
+
+  // ########################################################################
+  //  ERROR HANDLING
+  // ########################################################################
+  
+  /**
+   * string used to store an error message. Written by PGTStorage::setErrorMessage(),
+   * read by PGTStorage::getErrorMessage().
+   *
+   * @hideinitializer
+   * @private
+   * @deprecated not used.
+   */
+  var $_error_message=FALSE;
+
+  /**
+   * This method sets en error message, which can be read later by 
+   * PGTStorage::getErrorMessage().
+   *
+   * @param $error_message an error message
+   *
+   * @protected
+   * @deprecated not used.
+   */
+  function setErrorMessage($error_message)
+    {
+      $this->_error_message = $error_message;
+    }
+
+  /**
+   * This method returns an error message set by PGTStorage::setErrorMessage().
+   *
+   * @return an error message when set by PGTStorage::setErrorMessage(), FALSE
+   * otherwise.
+   *
+   * @public
+   * @deprecated not used.
+   */
+  function getErrorMessage()
+    {
+      return $this->_error_message;
+    }
+
+  // ########################################################################
+  //  INITIALIZATION
+  // ########################################################################
+
+  /**
+   * a boolean telling if the storage has already been initialized. Written by 
+   * PGTStorage::init(), read by PGTStorage::isInitialized().
+   *
+   * @hideinitializer
+   * @private
+   */
+  var $_initialized = FALSE;
+
+  /**
+   * This method tells if the storage has already been intialized.
+   *
+   * @return a boolean
+   *
+   * @protected
+   */
+  function isInitialized()
+    {
+      return $this->_initialized;
+    }
+
+  /**
+   * This virtual method initializes the object.
+   *
+   * @protected
+   */
+  function init()
+    {
+      $this->_initialized = TRUE;
+    }
+
+  // ########################################################################
+  //  PGT I/O
+  // ########################################################################
+
+  /**
+   * This virtual method stores a PGT and its corresponding PGT Iuo.
+   * @note Should never be called.
+   *
+   * @param $pgt the PGT
+   * @param $pgt_iou the PGT iou
+   *
+   * @protected
+   */
+  function write($pgt,$pgt_iou)
+    {
+      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
+    }
+
+  /**
+   * This virtual method reads a PGT corresponding to a PGT Iou and deletes
+   * the corresponding storage entry.
+   * @note Should never be called.
+   *
+   * @param $pgt_iou the PGT iou
+   *
+   * @protected
+   */
+  function read($pgt_iou)
+    {
+      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
+    }
+
+  /** @} */
+  
+} 
+
+// include specific PGT storage classes
+include_once(dirname(__FILE__).'/pgt-file.php'); 
+  
+?>

auth/cas/CAS/CAS/domxml-php4-to-php5.php

@@ -0,0 +1,499 @@
+<?php
+/*
+	Requires PHP5, uses built-in DOM extension.
+	To be used in PHP4 scripts using DOMXML extension: allows PHP4/DOMXML scripts to run on PHP5/DOM.
+	(Optional: requires PHP5/XSL extension for domxml_xslt functions, PHP>=5.1 for XPath evaluation functions, and PHP>=5.1/libxml for DOMXML error reports)
+
+	Typical use:
+	{
+		if (PHP_VERSION>='5')
+			require_once('domxml-php4-to-php5.php');
+	}
+
+	Version 1.21.1a, 2009-03-13, http://alexandre.alapetite.fr/doc-alex/domxml-php4-php5/
+
+	------------------------------------------------------------------
+	Written by Alexandre Alapetite, http://alexandre.alapetite.fr/cv/
+
+	Copyright 2004-2009, GNU Lesser General Public License,
+	http://www.gnu.org/licenses/lgpl.html
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU Lesser General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+	GNU Lesser General Public License for more details.
+	You should have received a copy of the GNU Lesser General Public License
+	along with this program. If not, see <http://www.gnu.org/licenses/lgpl.html>
+
+	== Rights and obligations ==
+	- Attribution: You must give the original author credit.
+	- Share Alike: If you alter or transform this library,
+	   you may distribute the resulting library only under the same license GNU/LGPL.
+	- In case of jurisdiction dispute, the French law is authoritative.
+	- Any of these conditions can be waived if you get permission from Alexandre Alapetite.
+	- Not required, but please send to Alexandre Alapetite the modifications you make,
+	   in order to improve this file for the benefit of everybody.
+
+	If you want to distribute this code, please do it as a link to:
+	http://alexandre.alapetite.fr/doc-alex/domxml-php4-php5/
+*/
+
+define('DOMXML_LOAD_PARSING',0);
+define('DOMXML_LOAD_VALIDATING',1);
+define('DOMXML_LOAD_RECOVERING',2);
+define('DOMXML_LOAD_SUBSTITUTE_ENTITIES',4);
+//define('DOMXML_LOAD_COMPLETE_ATTRS',8);
+define('DOMXML_LOAD_DONT_KEEP_BLANKS',16);
+
+function domxml_new_doc($version) {return new php4DOMDocument();}
+function domxml_new_xmldoc($version) {return new php4DOMDocument();}
+function domxml_open_file($filename,$mode=DOMXML_LOAD_PARSING,&$error=null)
+{
+	$dom=new php4DOMDocument($mode);
+	$errorMode=(func_num_args()>2)&&defined('LIBXML_VERSION');
+	if ($errorMode) libxml_use_internal_errors(true);
+	if (!$dom->myDOMNode->load($filename)) $dom=null;
+	if ($errorMode)
+	{
+		$error=array_map('_error_report',libxml_get_errors());
+		libxml_clear_errors();
+	}
+	return $dom;
+}
+function domxml_open_mem($str,$mode=DOMXML_LOAD_PARSING,&$error=null)
+{
+	$dom=new php4DOMDocument($mode);
+	$errorMode=(func_num_args()>2)&&defined('LIBXML_VERSION');
+	if ($errorMode) libxml_use_internal_errors(true);
+	if (!$dom->myDOMNode->loadXML($str)) $dom=null;
+	if ($errorMode)
+	{
+		$error=array_map('_error_report',libxml_get_errors());
+		libxml_clear_errors();
+	}
+	return $dom;
+}
+function html_doc($html_doc,$from_file=false)
+{
+	$dom=new php4DOMDocument();
+	if ($from_file) $result=$dom->myDOMNode->loadHTMLFile($html_doc);
+	else $result=$dom->myDOMNode->loadHTML($html_doc);
+	return $result ? $dom : null;
+}
+function html_doc_file($filename) {return html_doc($filename,true);}
+function xmldoc($str) {return domxml_open_mem($str);}
+function xmldocfile($filename) {return domxml_open_file($filename);}
+function xpath_eval($xpath_context,$eval_str,$contextnode=null) {return $xpath_context->xpath_eval($eval_str,$contextnode);}
+function xpath_new_context($dom_document) {return new php4DOMXPath($dom_document);}
+function xpath_register_ns($xpath_context,$prefix,$namespaceURI) {return $xpath_context->myDOMXPath->registerNamespace($prefix,$namespaceURI);}
+function _entityDecode($text) {return html_entity_decode(strtr($text,array('&apos;'=>'\'')),ENT_QUOTES,'UTF-8');}
+function _error_report($error) {return array('errormessage'=>$error->message,'nodename'=>'','line'=>$error->line,'col'=>$error->column)+($error->file==''?array():array('directory'=>dirname($error->file),'file'=>basename($error->file)));}
+
+class php4DOMAttr extends php4DOMNode
+{
+	function __get($name)
+	{
+		if ($name==='name') return $this->myDOMNode->name;
+		else return parent::__get($name);
+	}
+	function name() {return $this->myDOMNode->name;}
+	function set_content($text) {}
+	//function set_value($content) {return $this->myDOMNode->value=htmlspecialchars($content,ENT_QUOTES);}
+	function specified() {return $this->myDOMNode->specified;}
+	function value() {return $this->myDOMNode->value;}
+}
+
+class php4DOMDocument extends php4DOMNode
+{
+	function php4DOMDocument($mode=DOMXML_LOAD_PARSING)
+	{
+		$this->myDOMNode=new DOMDocument();
+		$this->myOwnerDocument=$this;
+		if ($mode & DOMXML_LOAD_VALIDATING) $this->myDOMNode->validateOnParse=true;
+		if ($mode & DOMXML_LOAD_RECOVERING) $this->myDOMNode->recover=true;
+		if ($mode & DOMXML_LOAD_SUBSTITUTE_ENTITIES) $this->myDOMNode->substituteEntities=true;
+		if ($mode & DOMXML_LOAD_DONT_KEEP_BLANKS) $this->myDOMNode->preserveWhiteSpace=false;
+	}
+	function add_root($name)
+	{
+		if ($this->myDOMNode->hasChildNodes()) $this->myDOMNode->removeChild($this->myDOMNode->firstChild);
+		return new php4DOMElement($this->myDOMNode->appendChild($this->myDOMNode->createElement($name)),$this->myOwnerDocument);
+	}
+	function create_attribute($name,$value)
+	{
+		$myAttr=$this->myDOMNode->createAttribute($name);
+		$myAttr->value=htmlspecialchars($value,ENT_QUOTES);
+		return new php4DOMAttr($myAttr,$this);
+	}
+	function create_cdata_section($content) {return new php4DOMNode($this->myDOMNode->createCDATASection($content),$this);}
+	function create_comment($data) {return new php4DOMNode($this->myDOMNode->createComment($data),$this);}
+	function create_element($name) {return new php4DOMElement($this->myDOMNode->createElement($name),$this);}
+	function create_element_ns($uri,$name,$prefix=null)
+	{
+		if ($prefix==null) $prefix=$this->myDOMNode->lookupPrefix($uri);
+		if (($prefix==null)&&(($this->myDOMNode->documentElement==null)||(!$this->myDOMNode->documentElement->isDefaultNamespace($uri)))) $prefix='a'.sprintf('%u',crc32($uri));
+		return new php4DOMElement($this->myDOMNode->createElementNS($uri,$prefix==null ? $name : $prefix.':'.$name),$this);
+	}
+	function create_entity_reference($content) {return new php4DOMNode($this->myDOMNode->createEntityReference($content),$this);} //By Walter Ebert 2007-01-22
+	function create_processing_instruction($target,$data=''){return new php4DomProcessingInstruction($this->myDOMNode->createProcessingInstruction($target,$data),$this);}
+	function create_text_node($content) {return new php4DOMText($this->myDOMNode->createTextNode($content),$this);}
+	function document_element() {return parent::_newDOMElement($this->myDOMNode->documentElement,$this);}
+	function dump_file($filename,$compressionmode=false,$format=false)
+	{
+		$format0=$this->myDOMNode->formatOutput;
+		$this->myDOMNode->formatOutput=$format;
+		$res=$this->myDOMNode->save($filename);
+		$this->myDOMNode->formatOutput=$format0;
+		return $res;
+	}
+	function dump_mem($format=false,$encoding=false)
+	{
+		$format0=$this->myDOMNode->formatOutput;
+		$this->myDOMNode->formatOutput=$format;
+		$encoding0=$this->myDOMNode->encoding;
+		if ($encoding) $this->myDOMNode->encoding=$encoding;
+		$dump=$this->myDOMNode->saveXML();
+		$this->myDOMNode->formatOutput=$format0;
+		if ($encoding) $this->myDOMNode->encoding= $encoding0=='' ? 'UTF-8' : $encoding0; //UTF-8 is XML default encoding
+		return $dump;
+	}
+	function free()
+	{
+		if ($this->myDOMNode->hasChildNodes()) $this->myDOMNode->removeChild($this->myDOMNode->firstChild);
+		$this->myDOMNode=null;
+		$this->myOwnerDocument=null;
+	}
+	function get_element_by_id($id) {return parent::_newDOMElement($this->myDOMNode->getElementById($id),$this);}
+	function get_elements_by_tagname($name)
+	{
+		$myDOMNodeList=$this->myDOMNode->getElementsByTagName($name);
+		$nodeSet=array();
+		$i=0;
+		if (isset($myDOMNodeList))
+			while ($node=$myDOMNodeList->item($i++)) $nodeSet[]=new php4DOMElement($node,$this);
+		return $nodeSet;
+	}
+	function html_dump_mem() {return $this->myDOMNode->saveHTML();}
+	function root() {return parent::_newDOMElement($this->myDOMNode->documentElement,$this);}
+	function xinclude() {return $this->myDOMNode->xinclude();}
+	function xpath_new_context() {return new php4DOMXPath($this);}
+}
+
+class php4DOMElement extends php4DOMNode
+{
+	function add_namespace($uri,$prefix)
+	{
+		if ($this->myDOMNode->hasAttributeNS('http://www.w3.org/2000/xmlns/',$prefix)) return false;
+		else
+		{
+			$this->myDOMNode->setAttributeNS('http://www.w3.org/2000/xmlns/','xmlns:'.$prefix,$uri); //By Daniel Walker 2006-09-08
+			return true;
+		}
+	}
+	function get_attribute($name) {return $this->myDOMNode->getAttribute($name);}
+	function get_attribute_node($name) {return parent::_newDOMElement($this->myDOMNode->getAttributeNode($name),$this->myOwnerDocument);}
+	function get_elements_by_tagname($name)
+	{
+		$myDOMNodeList=$this->myDOMNode->getElementsByTagName($name);
+		$nodeSet=array();
+		$i=0;
+		if (isset($myDOMNodeList))
+			while ($node=$myDOMNodeList->item($i++)) $nodeSet[]=new php4DOMElement($node,$this->myOwnerDocument);
+		return $nodeSet;
+	}
+	function has_attribute($name) {return $this->myDOMNode->hasAttribute($name);}
+	function remove_attribute($name) {return $this->myDOMNode->removeAttribute($name);}
+	function set_attribute($name,$value)
+	{
+		//return $this->myDOMNode->setAttribute($name,$value); //Does not return a DomAttr
+		$myAttr=$this->myDOMNode->ownerDocument->createAttribute($name);
+		$myAttr->value=htmlspecialchars($value,ENT_QUOTES); //Entity problem reported by AL-DesignWorks 2007-09-07
+		$this->myDOMNode->setAttributeNode($myAttr);
+		return new php4DOMAttr($myAttr,$this->myOwnerDocument);
+	}
+	/*function set_attribute_node($attr)
+	{
+		$this->myDOMNode->setAttributeNode($this->_importNode($attr));
+		return $attr;
+	}*/
+	function set_name($name)
+	{
+		if ($this->myDOMNode->prefix=='') $newNode=$this->myDOMNode->ownerDocument->createElement($name);
+		else $newNode=$this->myDOMNode->ownerDocument->createElementNS($this->myDOMNode->namespaceURI,$this->myDOMNode->prefix.':'.$name);
+		$myDOMNodeList=$this->myDOMNode->attributes;
+		$i=0;
+		if (isset($myDOMNodeList))
+			while ($node=$myDOMNodeList->item($i++))
+				if ($node->namespaceURI=='') $newNode->setAttribute($node->name,$node->value);
+				else $newNode->setAttributeNS($node->namespaceURI,$node->nodeName,$node->value);
+		$myDOMNodeList=$this->myDOMNode->childNodes;
+		if (isset($myDOMNodeList))
+			while ($node=$myDOMNodeList->item(0)) $newNode->appendChild($node);
+		$this->myDOMNode->parentNode->replaceChild($newNode,$this->myDOMNode);
+		$this->myDOMNode=$newNode;
+		return true;
+	}
+	function tagname() {return $this->tagname;}
+}
+
+class php4DOMNode
+{
+	public $myDOMNode;
+	public $myOwnerDocument;
+	function php4DOMNode($aDomNode,$aOwnerDocument)
+	{
+		$this->myDOMNode=$aDomNode;
+		$this->myOwnerDocument=$aOwnerDocument;
+	}
+	function __get($name)
+	{
+		switch ($name)
+		{
+			case 'type': return $this->myDOMNode->nodeType;
+			case 'tagname': return ($this->myDOMNode->nodeType===XML_ELEMENT_NODE) ? $this->myDOMNode->localName : $this->myDOMNode->tagName; //Avoid namespace prefix for DOMElement
+			case 'content': return $this->myDOMNode->textContent;
+			case 'value': return $this->myDOMNode->value;
+			default:
+				$myErrors=debug_backtrace();
+				trigger_error('Undefined property: '.get_class($this).'::$'.$name.' ['.$myErrors[0]['file'].':'.$myErrors[0]['line'].']',E_USER_NOTICE);
+				return false;
+		}
+	}
+	function add_child($newnode) {return $this->append_child($newnode);}
+	function add_namespace($uri,$prefix) {return false;}
+	function append_child($newnode) {return self::_newDOMElement($this->myDOMNode->appendChild($this->_importNode($newnode)),$this->myOwnerDocument);}
+	function append_sibling($newnode) {return self::_newDOMElement($this->myDOMNode->parentNode->appendChild($this->_importNode($newnode)),$this->myOwnerDocument);}
+	function attributes()
+	{
+		$myDOMNodeList=$this->myDOMNode->attributes;
+		if (!(isset($myDOMNodeList)&&$this->myDOMNode->hasAttributes())) return null;
+		$nodeSet=array();
+		$i=0;
+		while ($node=$myDOMNodeList->item($i++)) $nodeSet[]=new php4DOMAttr($node,$this->myOwnerDocument);
+		return $nodeSet;
+	}
+	function child_nodes()
+	{
+		$myDOMNodeList=$this->myDOMNode->childNodes;
+		$nodeSet=array();
+		$i=0;
+		if (isset($myDOMNodeList))
+			while ($node=$myDOMNodeList->item($i++)) $nodeSet[]=self::_newDOMElement($node,$this->myOwnerDocument);
+		return $nodeSet;
+	}
+	function children() {return $this->child_nodes();}
+	function clone_node($deep=false) {return self::_newDOMElement($this->myDOMNode->cloneNode($deep),$this->myOwnerDocument);}
+	//dump_node($node) should only be called on php4DOMDocument
+	function dump_node($node=null) {return $node==null ? $this->myOwnerDocument->myDOMNode->saveXML($this->myDOMNode) : $this->myOwnerDocument->myDOMNode->saveXML($node->myDOMNode);}
+	function first_child() {return self::_newDOMElement($this->myDOMNode->firstChild,$this->myOwnerDocument);}
+	function get_content() {return $this->myDOMNode->textContent;}
+	function has_attributes() {return $this->myDOMNode->hasAttributes();}
+	function has_child_nodes() {return $this->myDOMNode->hasChildNodes();}
+	function insert_before($newnode,$refnode) {return self::_newDOMElement($this->myDOMNode->insertBefore($this->_importNode($newnode),$refnode==null?null:$refnode->myDOMNode),$this->myOwnerDocument);}
+	function is_blank_node() {return ($this->myDOMNode->nodeType===XML_TEXT_NODE)&&preg_match('%^\s*$%',$this->myDOMNode->nodeValue);}
+	function last_child() {return self::_newDOMElement($this->myDOMNode->lastChild,$this->myOwnerDocument);}
+	function new_child($name,$content)
+	{
+		$mySubNode=$this->myDOMNode->ownerDocument->createElement($name);
+		$mySubNode->appendChild($this->myDOMNode->ownerDocument->createTextNode(_entityDecode($content)));
+		$this->myDOMNode->appendChild($mySubNode);
+		return new php4DOMElement($mySubNode,$this->myOwnerDocument);
+	}
+	function next_sibling() {return self::_newDOMElement($this->myDOMNode->nextSibling,$this->myOwnerDocument);}
+	function node_name() {return ($this->myDOMNode->nodeType===XML_ELEMENT_NODE) ? $this->myDOMNode->localName : $this->myDOMNode->nodeName;} //Avoid namespace prefix for DOMElement
+	function node_type() {return $this->myDOMNode->nodeType;}
+	function node_value() {return $this->myDOMNode->nodeValue;}
+	function owner_document() {return $this->myOwnerDocument;}
+	function parent_node() {return self::_newDOMElement($this->myDOMNode->parentNode,$this->myOwnerDocument);}
+	function prefix() {return $this->myDOMNode->prefix;}
+	function previous_sibling() {return self::_newDOMElement($this->myDOMNode->previousSibling,$this->myOwnerDocument);}
+	function remove_child($oldchild) {return self::_newDOMElement($this->myDOMNode->removeChild($oldchild->myDOMNode),$this->myOwnerDocument);}
+	function replace_child($newnode,$oldnode) {return self::_newDOMElement($this->myDOMNode->replaceChild($this->_importNode($newnode),$oldnode->myDOMNode),$this->myOwnerDocument);}
+	function replace_node($newnode) {return self::_newDOMElement($this->myDOMNode->parentNode->replaceChild($this->_importNode($newnode),$this->myDOMNode),$this->myOwnerDocument);}
+	function set_content($text) {return $this->myDOMNode->appendChild($this->myDOMNode->ownerDocument->createTextNode(_entityDecode($text)));} //Entity problem reported by AL-DesignWorks 2007-09-07
+	//function set_name($name) {return $this->myOwnerDocument->renameNode($this->myDOMNode,$this->myDOMNode->namespaceURI,$name);}
+	function set_namespace($uri,$prefix=null)
+	{//Contributions by Daniel Walker 2006-09-08
+		$nsprefix=$this->myDOMNode->lookupPrefix($uri);
+		if ($nsprefix==null)
+		{
+			$nsprefix= $prefix==null ? $nsprefix='a'.sprintf('%u',crc32($uri)) : $prefix;
+			if ($this->myDOMNode->nodeType===XML_ATTRIBUTE_NODE)
+			{
+				if (($prefix!=null)&&$this->myDOMNode->ownerElement->hasAttributeNS('http://www.w3.org/2000/xmlns/',$nsprefix)&&
+					($this->myDOMNode->ownerElement->getAttributeNS('http://www.w3.org/2000/xmlns/',$nsprefix)!=$uri))
+				{//Remove namespace
+					$parent=$this->myDOMNode->ownerElement;
+					$parent->removeAttributeNode($this->myDOMNode);
+					$parent->setAttribute($this->myDOMNode->localName,$this->myDOMNode->nodeValue);
+					$this->myDOMNode=$parent->getAttributeNode($this->myDOMNode->localName);
+					return;
+				}
+				$this->myDOMNode->ownerElement->setAttributeNS('http://www.w3.org/2000/xmlns/','xmlns:'.$nsprefix,$uri);
+			}
+		}
+		if ($this->myDOMNode->nodeType===XML_ATTRIBUTE_NODE)
+		{
+			$parent=$this->myDOMNode->ownerElement;
+			$parent->removeAttributeNode($this->myDOMNode);
+			$parent->setAttributeNS($uri,$nsprefix.':'.$this->myDOMNode->localName,$this->myDOMNode->nodeValue);
+			$this->myDOMNode=$parent->getAttributeNodeNS($uri,$this->myDOMNode->localName);
+		}
+		elseif ($this->myDOMNode->nodeType===XML_ELEMENT_NODE)
+		{
+			$NewNode=$this->myDOMNode->ownerDocument->createElementNS($uri,$nsprefix.':'.$this->myDOMNode->localName);
+			foreach ($this->myDOMNode->attributes as $n) $NewNode->appendChild($n->cloneNode(true));
+			foreach ($this->myDOMNode->childNodes as $n) $NewNode->appendChild($n->cloneNode(true));
+			$xpath=new DOMXPath($this->myDOMNode->ownerDocument);
+			$myDOMNodeList=$xpath->query('namespace::*[name()!="xml"]',$this->myDOMNode); //Add old namespaces
+			foreach ($myDOMNodeList as $n) $NewNode->setAttributeNS('http://www.w3.org/2000/xmlns/',$n->nodeName,$n->nodeValue); 
+			$this->myDOMNode->parentNode->replaceChild($NewNode,$this->myDOMNode);
+			$this->myDOMNode=$NewNode;
+		}
+	}
+	function unlink_node()
+	{
+		if ($this->myDOMNode->parentNode!=null)
+		{
+			if ($this->myDOMNode->nodeType===XML_ATTRIBUTE_NODE) $this->myDOMNode->parentNode->removeAttributeNode($this->myDOMNode);
+			else $this->myDOMNode->parentNode->removeChild($this->myDOMNode);
+		}
+	}
+	protected function _importNode($newnode) {return $this->myOwnerDocument===$newnode->myOwnerDocument ? $newnode->myDOMNode : $this->myOwnerDocument->myDOMNode->importNode($newnode->myDOMNode,true);} //To import DOMNode from another DOMDocument
+	static function _newDOMElement($aDOMNode,$aOwnerDocument)
+	{//Check the PHP5 DOMNode before creating a new associated PHP4 DOMNode wrapper
+		if ($aDOMNode==null) return null;
+		switch ($aDOMNode->nodeType)
+		{
+			case XML_ELEMENT_NODE: return new php4DOMElement($aDOMNode,$aOwnerDocument);
+			case XML_TEXT_NODE: return new php4DOMText($aDOMNode,$aOwnerDocument);
+			case XML_ATTRIBUTE_NODE: return new php4DOMAttr($aDOMNode,$aOwnerDocument);
+			case XML_PI_NODE: return new php4DomProcessingInstruction($aDOMNode,$aOwnerDocument);
+			default: return new php4DOMNode($aDOMNode,$aOwnerDocument);
+		}
+	}
+}
+
+class php4DomProcessingInstruction extends php4DOMNode
+{
+	function data() {return $this->myDOMNode->data;}
+	function target() {return $this->myDOMNode->target;}
+}
+
+class php4DOMText extends php4DOMNode
+{
+	function __get($name)
+	{
+		if ($name==='tagname') return '#text';
+		else return parent::__get($name);
+	}
+	function tagname() {return '#text';}
+	function set_content($text) {$this->myDOMNode->nodeValue=$text; return true;}
+}
+
+if (!defined('XPATH_NODESET'))
+{
+	define('XPATH_UNDEFINED',0);
+	define('XPATH_NODESET',1);
+	define('XPATH_BOOLEAN',2);
+	define('XPATH_NUMBER',3);
+	define('XPATH_STRING',4);
+	/*define('XPATH_POINT',5);
+	define('XPATH_RANGE',6);
+	define('XPATH_LOCATIONSET',7);
+	define('XPATH_USERS',8);
+	define('XPATH_XSLT_TREE',9);*/
+}
+
+class php4DOMNodelist
+{
+	private $myDOMNodelist;
+	public $nodeset;
+	public $type=XPATH_UNDEFINED;
+	public $value;
+	function php4DOMNodelist($aDOMNodelist,$aOwnerDocument)
+	{
+		if (!isset($aDOMNodelist)) return; 
+		elseif (is_object($aDOMNodelist)||is_array($aDOMNodelist))
+		{
+			if ($aDOMNodelist->length>0)
+			{
+				$this->myDOMNodelist=$aDOMNodelist;
+				$this->nodeset=array();
+				$this->type=XPATH_NODESET;
+				$i=0;
+				while ($node=$this->myDOMNodelist->item($i++)) $this->nodeset[]=php4DOMNode::_newDOMElement($node,$aOwnerDocument);
+			}
+		}
+		elseif (is_int($aDOMNodelist)||is_float($aDOMNodelist))
+		{
+			$this->type=XPATH_NUMBER;
+			$this->value=$aDOMNodelist;
+		}
+		elseif (is_bool($aDOMNodelist))
+		{
+			$this->type=XPATH_BOOLEAN;
+			$this->value=$aDOMNodelist;
+		}
+		elseif (is_string($aDOMNodelist))
+		{
+			$this->type=XPATH_STRING;
+			$this->value=$aDOMNodelist;
+		}
+	}
+}
+
+class php4DOMXPath
+{
+	public $myDOMXPath;
+	private $myOwnerDocument;
+	function php4DOMXPath($dom_document)
+	{
+		//TODO: If $dom_document is a DomElement, make that default $contextnode and modify XPath. Ex: '/test'
+		$this->myOwnerDocument=$dom_document->myOwnerDocument;
+		$this->myDOMXPath=new DOMXPath($this->myOwnerDocument->myDOMNode);
+	}
+	function xpath_eval($eval_str,$contextnode=null)
+	{
+		if (method_exists($this->myDOMXPath,'evaluate')) $xp=isset($contextnode->myDOMNode) ? $this->myDOMXPath->evaluate($eval_str,$contextnode->myDOMNode) : $this->myDOMXPath->evaluate($eval_str);
+		else $xp=isset($contextnode->myDOMNode) ? $this->myDOMXPath->query($eval_str,$contextnode->myDOMNode) : $this->myDOMXPath->query($eval_str);
+		$xp=new php4DOMNodelist($xp,$this->myOwnerDocument);
+		return ($xp->type===XPATH_UNDEFINED) ? false : $xp;
+	}
+	function xpath_register_ns($prefix,$namespaceURI) {return $this->myDOMXPath->registerNamespace($prefix,$namespaceURI);}
+}
+
+if (extension_loaded('xsl'))
+{//See also: http://alexandre.alapetite.fr/doc-alex/xslt-php4-php5/
+	function domxml_xslt_stylesheet($xslstring) {return new php4DomXsltStylesheet(DOMDocument::loadXML($xslstring));}
+	function domxml_xslt_stylesheet_doc($dom_document) {return new php4DomXsltStylesheet($dom_document);}
+	function domxml_xslt_stylesheet_file($xslfile) {return new php4DomXsltStylesheet(DOMDocument::load($xslfile));}
+	class php4DomXsltStylesheet
+	{
+		private $myxsltProcessor;
+		function php4DomXsltStylesheet($dom_document)
+		{
+			$this->myxsltProcessor=new xsltProcessor();
+			$this->myxsltProcessor->importStyleSheet($dom_document);
+		}
+		function process($dom_document,$xslt_parameters=array(),$param_is_xpath=false)
+		{
+			foreach ($xslt_parameters as $param=>$value) $this->myxsltProcessor->setParameter('',$param,$value);
+			$myphp4DOMDocument=new php4DOMDocument();
+			$myphp4DOMDocument->myDOMNode=$this->myxsltProcessor->transformToDoc($dom_document->myDOMNode);
+			return $myphp4DOMDocument;
+		}
+		function result_dump_file($dom_document,$filename)
+		{
+			$html=$dom_document->myDOMNode->saveHTML();
+			file_put_contents($filename,$html);
+			return $html;
+		}
+		function result_dump_mem($dom_document) {return $dom_document->myDOMNode->saveHTML();}
+	}
+}
+?>

auth/cas/CAS/CAS/languages/catalan.php

@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * @file languages/spanish.php
+ * @author Iván-Benjamín García Torà <ivaniclixx AT gmail DOT com>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'usant servidor',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => 'Autentificació CAS necessària!',
+ CAS_STR_LOGOUT 
+ => 'Sortida de CAS necessària!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'Ja hauria d\ haver estat redireccionat al servidor CAS. Feu click <a href="%s">aquí</a> per a continuar.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => 'Autentificació CAS fallida!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>No estàs autentificat.</p><p>Pots tornar a intentar-ho fent click <a href="%s">aquí</a>.</p><p>Si el problema persisteix hauría de contactar amb l\'<a href="mailto:%s">administrador d\'aquest llocc</a>.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => 'El servei `<b>%s</b>\' no està disponible (<b>%s</b>).'
+);
+
+?>

auth/cas/CAS/CAS/languages/english.php

@@ -1,79 +1,27 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file languages/english.php
-
-
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
-
-
- * @sa @link internalLang Internationalization @endlink
-
-
- * @ingroup internalLang
-
-
- */
-
-
-
-
-
-$this->_strings = array(
-
-
- CAS_STR_USING_SERVER 
-
-
- => 'using server',
-
-
- CAS_STR_AUTHENTICATION_WANTED 
-
-
- => 'CAS Authentication wanted!',
-
-
- CAS_STR_LOGOUT 
-
-
- => 'CAS logout wanted!',
-
-
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
-
- => 'You should already have been redirected to the CAS server. Click <a href="%s">here</a> to continue.',
-
-
- CAS_STR_AUTHENTICATION_FAILED 
-
-
- => 'CAS Authentication failed!',
-
-
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
-
- => '<p>You were not authenticated.</p><p>You may submit your request again by clicking <a href="%s">here</a>.</p><p>If the problem persists, you may contact <a href="mailto:%s">the administrator of this site</a>.</p>',
-
-
- CAS_STR_SERVICE_UNAVAILABLE
-
-
- => 'The service `<b>%s</b>\' is not available (<b>%s</b>).'
-
-
-);
-
-
-
-
-
+<?php
+
+/**
+ * @file languages/english.php
+ * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'using server',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => 'CAS Authentication wanted!',
+ CAS_STR_LOGOUT 
+ => 'CAS logout wanted!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'You should already have been redirected to the CAS server. Click <a href="%s">here</a> to continue.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => 'CAS Authentication failed!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>You were not authenticated.</p><p>You may submit your request again by clicking <a href="%s">here</a>.</p><p>If the problem persists, you may contact <a href="mailto:%s">the administrator of this site</a>.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => 'The service `<b>%s</b>\' is not available (<b>%s</b>).'
+);
+
 ?>

auth/cas/CAS/CAS/languages/french.php

@@ -1,82 +1,28 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file languages/english.php
-
-
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
-
-
- * @sa @link internalLang Internationalization @endlink
-
-
- * @ingroup internalLang
-
-
- */
-
-
-
-
-
-$this->_strings = array(
-
-
- CAS_STR_USING_SERVER 
-
-
- => 'utilisant le serveur',
-
-
- CAS_STR_AUTHENTICATION_WANTED 
-
-
- => 'Authentication CAS nécessaire&nbsp;!',
-
-
- CAS_STR_LOGOUT 
-
-
- => 'Déconnexion demandée&nbsp;!',
-
-
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
-
- => 'Vous auriez du etre redirigé(e) vers le serveur CAS. Cliquez <a href="%s">ici</a> pour continuer.',
-
-
- CAS_STR_AUTHENTICATION_FAILED 
-
-
- => 'Authentification CAS infructueuse&nbsp;!',
-
-
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
-
- => '<p>Vous n\'avez pas été authentifié(e).</p><p>Vous pouvez soumettre votre requete à nouveau en cliquant <a href="%s">ici</a>.</p><p>Si le problème persiste, vous pouvez contacter <a href="mailto:%s">l\'administrateur de ce site</a>.</p>',
-
-
- CAS_STR_SERVICE_UNAVAILABLE
-
-
- => 'Le service `<b>%s</b>\' est indisponible (<b>%s</b>)'
-
-
-
-
-
-);
-
-
-
-
-
+<?php
+
+/**
+ * @file languages/english.php
+ * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'utilisant le serveur',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => 'Authentication CAS n�cessaire&nbsp;!',
+ CAS_STR_LOGOUT 
+ => 'D�connexion demand�e&nbsp;!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'Vous auriez du etre redirig�(e) vers le serveur CAS. Cliquez <a href="%s">ici</a> pour continuer.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => 'Authentification CAS infructueuse&nbsp;!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>Vous n\'avez pas �t� authentifi�(e).</p><p>Vous pouvez soumettre votre requete � nouveau en cliquant <a href="%s">ici</a>.</p><p>Si le probl�me persiste, vous pouvez contacter <a href="mailto:%s">l\'administrateur de ce site</a>.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => 'Le service `<b>%s</b>\' est indisponible (<b>%s</b>)'
+
+);
+
 ?>

auth/cas/CAS/CAS/languages/german.php

@@ -1,79 +1,27 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file languages/german.php
-
-
- * @author Henrik Genssen <hg at mediafactory.de>
-
-
- * @sa @link internalLang Internationalization @endlink
-
-
- * @ingroup internalLang
-
-
- */
-
-
-
-
-
-$this->_strings = array(
-
-
- CAS_STR_USING_SERVER 
-
-
- => 'via Server',
-
-
- CAS_STR_AUTHENTICATION_WANTED 
-
-
- => 'CAS Authentifizierung erforderlich!',
-
-
- CAS_STR_LOGOUT 
-
-
- => 'CAS Abmeldung!',
-
-
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
-
- => 'eigentlich h&auml;ten Sie zum CAS Server weitergeleitet werden sollen. Dr&uuml;cken Sie <a href="%s">hier</a> um fortzufahren.',
-
-
- CAS_STR_AUTHENTICATION_FAILED 
-
-
- => 'CAS Anmeldung fehlgeschlagen!',
-
-
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
-
- => '<p>Sie wurden nicht angemeldet.</p><p>Um es erneut zu versuchen klicken Sie <a href="%s">hier</a>.</p><p>Wenn das Problem bestehen bleibt, kontkatieren Sie den <a href="mailto:%s">Administrator</a> dieser Seite.</p>',
-
-
- CAS_STR_SERVICE_UNAVAILABLE
-
-
- => 'Der Dienst `<b>%s</b>\' ist nicht verf&uuml;gbar (<b>%s</b>).'
-
-
-);
-
-
-
-
-
+<?php
+
+/**
+ * @file languages/german.php
+ * @author Henrik Genssen <hg at mediafactory.de>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'via Server',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => 'CAS Authentifizierung erforderlich!',
+ CAS_STR_LOGOUT 
+ => 'CAS Abmeldung!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'eigentlich h&auml;ten Sie zum CAS Server weitergeleitet werden sollen. Dr&uuml;cken Sie <a href="%s">hier</a> um fortzufahren.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => 'CAS Anmeldung fehlgeschlagen!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>Sie wurden nicht angemeldet.</p><p>Um es erneut zu versuchen klicken Sie <a href="%s">hier</a>.</p><p>Wenn das Problem bestehen bleibt, kontkatieren Sie den <a href="mailto:%s">Administrator</a> dieser Seite.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => 'Der Dienst `<b>%s</b>\' ist nicht verf&uuml;gbar (<b>%s</b>).'
+);
+
 ?>

auth/cas/CAS/CAS/languages/greek.php

@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * @file languages/greek.php
+ * @author Vangelis Haniotakis <haniotak at ucnet.uoc.gr>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => '��������������� � ������������',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => '���������� � ����������� CAS!',
+ CAS_STR_LOGOUT 
+ => '���������� � ���������� ��� CAS!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => '�� ������ �� ������ �������������� ���� ����������� CAS. ����� ���� <a href="%s">���</a> ��� �� ����������.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => '� ����������� CAS �������!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>��� ���������������.</p><p>�������� �� ����������������, �������� ���� <a href="%s">���</a>.</p><p>��� �� �������� ���������, ����� �� ����� �� ��� <a href="mailto:%s">�����������</a>.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => '� �������� `<b>%s</b>\' ��� ����� ��������� (<b>%s</b>).'
+);
+
+?>

auth/cas/CAS/CAS/languages/japanese.php

@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * @file languages/japanese.php
+ * @author fnorif (fnorif@yahoo.co.jp)
+ * 
+ * Now Encoding is EUC-JP and LF
+ **/
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'using server',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => 'CAS�ˤ��ǧ�ڤ�Ԥ��ޤ�',
+ CAS_STR_LOGOUT 
+ => 'CAS����?�����Ȥ��ޤ�!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'CAS�����Ф˹Ԥ�ɬ�פ�����ޤ�����ưŪ��ž������ʤ����� <a href="%s">������</a> �򥯥�å�����³�Ԥ��ޤ���',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => 'CAS�ˤ��ǧ�ڤ˼��Ԥ��ޤ���',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>ǧ�ڤǤ��ޤ���Ǥ���.</p><p>�⤦���٥ꥯ�����Ȥ������������<a href="%s">������</a>�򥯥�å�.</p><p>���꤬��褷�ʤ����� <a href="mailto:%s">���Υ����Ȥδ����</a>���䤤��碌�Ƥ�������.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => '�����ӥ� `<b>%s</b>\' �����ѤǤ��ޤ��� (<b>%s</b>).'
+);
+
+?>

auth/cas/CAS/CAS/languages/languages.php

@@ -1,70 +1,24 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file languages/languages.php
-
-
- * Internationalization constants
-
-
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
-
-
- * @sa @link internalLang Internationalization @endlink
-
-
- * @ingroup internalLang
-
-
- */
-
-
-
-
-
-//@{
-
-
-/**
-
-
- * a phpCAS string index
-
-
- */
-
-
-define("CAS_STR_USING_SERVER",                1);
-
-
-define("CAS_STR_AUTHENTICATION_WANTED",       2);
-
-
-define("CAS_STR_LOGOUT",                      3);
-
-
-define("CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED", 4);
-
-
-define("CAS_STR_AUTHENTICATION_FAILED",       5);
-
-
-define("CAS_STR_YOU_WERE_NOT_AUTHENTICATED",  6);
-
-
-define("CAS_STR_SERVICE_UNAVAILABLE",         7);
-
-
-//@}
-
-
-
-
-
+<?php
+
+/**
+ * @file languages/languages.php
+ * Internationalization constants
+ * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+//@{
+/**
+ * a phpCAS string index
+ */
+define("CAS_STR_USING_SERVER",                1);
+define("CAS_STR_AUTHENTICATION_WANTED",       2);
+define("CAS_STR_LOGOUT",                      3);
+define("CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED", 4);
+define("CAS_STR_AUTHENTICATION_FAILED",       5);
+define("CAS_STR_YOU_WERE_NOT_AUTHENTICATED",  6);
+define("CAS_STR_SERVICE_UNAVAILABLE",         7);
+//@}
+
 ?>

auth/cas/CAS/CAS/languages/spanish.php

@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * @file languages/spanish.php
+ * @author Iván-Benjamín García Torà <ivaniclixx AT gmail DOT com>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'usando servidor',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => '¡Autentificación CAS necesaria!',
+ CAS_STR_LOGOUT 
+ => '¡Salida CAS necesaria!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'Ya debería haber sido redireccionado al servidor CAS. Haga click <a href="%s">aquí</a> para continuar.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => '¡Autentificación CAS fallida!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>No estás autentificado.</p><p>Puedes volver a intentarlo haciendo click <a href="%s">aquí</a>.</p><p>Si el problema persiste debería contactar con el <a href="mailto:%s">administrador de este sitio</a>.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => 'El servicio `<b>%s</b>\' no está disponible (<b>%s</b>).'
+);
+
+?>

auth/cas/CAS/PGTStorage/pgt-db.php

@@ -1,568 +0,0 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file CAS/PGTStorage/pgt-db.php
-
-
- * Basic class for PGT database storage
-
-
- */
-
-
-
-
-
-// include phpDB library (the test was introduced in release 0.4.8 for 
-
-
-// the integration into Tikiwiki).
-
-
-if (!class_exists('DB')) {
-
-
-  @include_once('DB.php');
-
-
-}
-
-
-
-
-
-/**
-
-
- * @class PGTStorageDB
-
-
- * The PGTStorageDB class is a class for PGT database storage. An instance of 
-
-
- * this class is returned by CASClient::SetPGTStorageDB().
-
-
- *
-
-
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
-
-
- *
-
-
- * @ingroup internalPGTStorageDB
-
-
- */
-
-
-
-
-
-class PGTStorageDB extends PGTStorage
-
-
-{
-
-
-  /** 
-
-
-   * @addtogroup internalPGTStorageDB
-
-
-   * @{ 
-
-
-   */
-
-
-
-
-
-  /**
-
-
-   * a string representing a PEAR DB URL to connect to the database. Written by
-
-
-   * PGTStorageDB::PGTStorageDB(), read by getURL().
-
-
-   *
-
-
-   * @hideinitializer
-
-
-   * @private
-
-
-   */
-
-
-  var $_url='';
-
-
-
-
-
-  /**
-
-
-   * This method returns the PEAR DB URL to use to connect to the database.
-
-
-   *
-
-
-   * @return a PEAR DB URL
-
-
-   *
-
-
-   * @private
-
-
-   */
-
-
-  function getURL()
-
-
-    {
-
-
-      return $this->_url;
-
-
-    }
-
-
-
-
-
-  /**
-
-
-   * The handle of the connection to the database where PGT's are stored. Written by
-
-
-   * PGTStorageDB::init(), read by getLink().
-
-
-   *
-
-
-   * @hideinitializer
-
-
-   * @private
-
-
-   */
-
-
-  var $_link = null;
-
-
-
-
-
-  /**
-
-
-   * This method returns the handle of the connection to the database where PGT's are 
-
-
-   * stored.
-
-
-   *
-
-
-   * @return a handle of connection.
-
-
-   *
-
-
-   * @private
-
-
-   */
-
-
-  function getLink()
-
-
-    {
-
-
-      return $this->_link;
-
-
-    }
-
-
-
-
-
-  /**
-
-
-   * The name of the table where PGT's are stored. Written by 
-
-
-   * PGTStorageDB::PGTStorageDB(), read by getTable().
-
-
-   *
-
-
-   * @hideinitializer
-
-
-   * @private
-
-
-   */
-
-
-  var $_table = '';
-
-
-
-
-
-  /**
-
-
-   * This method returns the name of the table where PGT's are stored.
-
-
-   *
-
-
-   * @return the name of a table.
-
-
-   *
-
-
-   * @private
-
-
-   */
-
-
-  function getTable()
-
-
-    {
-
-
-      return $this->_table;
-
-
-    }
-
-
-
-
-
-  // ########################################################################
-
-
-  //  DEBUGGING
-
-
-  // ########################################################################
-
-
-  
-
-
-  /**
-
-
-   * This method returns an informational string giving the type of storage
-
-
-   * used by the object (used for debugging purposes).
-
-
-   *
-
-
-   * @return an informational string.
-
-
-   * @public
-
-
-   */
-
-
-  function getStorageType()
-
-
-    {
-
-
-      return "database";
-
-
-    }
-
-
-
-
-
-  /**
-
-
-   * This method returns an informational string giving informations on the
-
-
-   * parameters of the storage.(used for debugging purposes).
-
-
-   *
-
-
-   * @public
-
-
-   */
-
-
-  function getStorageInfo()
-
-
-    {
-
-
-      return 'url=`'.$this->getURL().'\', table=`'.$this->getTable().'\'';
-
-
-    }
-
-
-
-
-
-  // ########################################################################
-
-
-  //  CONSTRUCTOR
-
-
-  // ########################################################################
-
-
-  
-
-
-  /**
-
-
-   * The class constructor, called by CASClient::SetPGTStorageDB().
-
-
-   *
-
-
-   * @param $cas_parent the CASClient instance that creates the object.
-
-
-   * @param $user the user to access the data with
-
-
-   * @param $password the user's password
-
-
-   * @param $database_type the type of the database hosting the data
-
-
-   * @param $hostname the server hosting the database
-
-
-   * @param $port the port the server is listening on
-
-
-   * @param $database the name of the database
-
-
-   * @param $table the name of the table storing the data
-
-
-   *
-
-
-   * @public
-
-
-   */
-
-
-  function PGTStorageDB($cas_parent,$user,$password,$database_type,$hostname,$port,$database,$table)
-
-
-    {
-
-
-      phpCAS::traceBegin();
-
-
-
-
-
-      // call the ancestor's constructor
-
-
-      $this->PGTStorage($cas_parent);
-
-
-
-
-
-      if ( empty($database_type) ) $database_type = CAS_PGT_STORAGE_DB_DEFAULT_DATABASE_TYPE;
-
-
-      if ( empty($hostname) ) $hostname = CAS_PGT_STORAGE_DB_DEFAULT_HOSTNAME;
-
-
-      if ( $port==0 ) $port = CAS_PGT_STORAGE_DB_DEFAULT_PORT;
-
-
-      if ( empty($database) ) $database = CAS_PGT_STORAGE_DB_DEFAULT_DATABASE;
-
-
-      if ( empty($table) ) $table = CAS_PGT_STORAGE_DB_DEFAULT_TABLE;
-
-
-
-
-
-      // build and store the PEAR DB URL
-
-
-      $this->_url = $database_type.':'.'//'.$user.':'.$password.'@'.$hostname.':'.$port.'/'.$database;
-
-
-
-
-
-      // XXX should use setURL and setTable
-
-
-      phpCAS::traceEnd();
-
-
-    }
-
-
-  
-
-
-  // ########################################################################
-
-
-  //  INITIALIZATION
-
-
-  // ########################################################################
-
-
-  
-
-
-  /**
-
-
-   * This method is used to initialize the storage. Halts on error.
-
-
-   *
-
-
-   * @public
-
-
-   */
-
-
-  function init()
-
-
-    {
-
-
-      phpCAS::traceBegin();
-
-
-      // if the storage has already been initialized, return immediatly
-
-
-      if ( $this->isInitialized() )
-
-
-	return;
-
-
-      // call the ancestor's method (mark as initialized)
-
-
-      parent::init();
-
-
-      
-
-
-      // try to connect to the database
-
-
-      $this->_link = DB::connect($this->getURL());
-
-
-      if ( DB::isError($this->_link) ) {
-
-
-	phpCAS::error('could not connect to database ('.DB::errorMessage($this->_link).')');
-
-
-      }
-
-
-      var_dump($this->_link);
-
-
-      phpCAS::traceBEnd();
-
-
-    }
-
-
-
-
-
-  /** @} */
-
-
-}
-
-
-
-
-
-?>

auth/cas/CAS/PGTStorage/pgt-main.php

@@ -1,188 +0,0 @@
-<?php
-
-
-
-/**
-
- * @file CAS/PGTStorage/pgt-main.php
-
- * Basic class for PGT storage
-
- */
-
-
-
-/**
-
- * @class PGTStorage
-
- * The PGTStorage class is a generic class for PGT storage. This class should
-
- * not be instanciated itself but inherited by specific PGT storage classes.
-
- *
-
- * @author   Pascal Aubry <pascal.aubry at univ-rennes1.fr>
-
- *
-
- * @ingroup internalPGTStorage
-
- */
-
-
-
-class PGTStorage
-
-{
-
-  /** 
-
-   * @addtogroup internalPGTStorage
-
-   * @{ 
-
-   */
-
-
-
-  // ########################################################################
-
-  //  CONSTRUCTOR
-
-  // ########################################################################
-
-  
-
-  /**
-
-   * The constructor of the class, should be called only by inherited classes.
-
-   *
-
-   * @param $cas_parent the CASclient instance that creates the current object.
-
-   *
-
-   * @protected
-
-   */
-
-  function PGTStorage($cas_parent)
-
-    {
-
-      phpCAS::traceBegin();
-
-      if ( !$cas_parent->isProxy() ) {
-
-	phpCAS::error('defining PGT storage makes no sense when not using a CAS proxy'); 
-
-      }
-
-      phpCAS::traceEnd();
-
-    }
-
-
-
-  // ########################################################################
-
-  //  DEBUGGING
-
-  // ########################################################################
-
-  
-
-  /**
-
-   * This virtual method returns an informational string giving the type of storage
-
-   * used by the object (used for debugging purposes).
-
-   *
-
-   * @public
-
-   */
-
-  function getStorageType()
-
-    {
-
-      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
-
-    }
-
-
-
-  /**
-
-   * This virtual method returns an informational string giving informations on the
-
-   * parameters of the storage.(used for debugging purposes).
-
-   *
-
-   * @public
-
-   */
-
-  function getStorageInfo()
-
-    {
-
-      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
-
-    }
-
-
-
-  // ########################################################################
-
-  //  ERROR HANDLING
-
-  // ########################################################################
-
-  
-
-  /**
-
-   * string used to store an error message. Written by PGTStorage::setErrorMessage(),
-
-   * read by PGTStorage::getErrorMessage().
-
-   *
-
-   * @hideinitializer
-
-   * @private
-
-   * @deprecated not used.
-
-   */
-
-  var $_error_message=FALSE;
-
-
-
-  /**
-
-   * This method sets en error message, which can be read later by 
-
-   * PGTStorage::getErrorMessage().
-
-   *
-
-   * @param $error_message an error message
-
-   *
-
-   * @protected
-
-   * @deprecated not used.
-
-   */
-
-  function setErrorMessage($error_message)
-

auth/cas/CAS/domxml-php4-php5.php

@@ -1,829 +0,0 @@
-<?php
-
-
-/**
-
-
- * @file domxml-php4-php5.php
-
-
- * Require PHP5, uses built-in DOM extension.
-
-
- * To be used in PHP4 scripts using DOMXML extension.
-
-
- * Allows PHP4/DOMXML scripts to run on PHP5/DOM.
-
-
- * (Requires PHP5/XSL extension for domxml_xslt functions)
-
-
- *
-
-
- * Typical use:
-
-
- * <pre>
-
-
- * {
-
-
- *  if (version_compare(PHP_VERSION,'5','>='))
-
-
- *   require_once('domxml-php4-to-php5.php');
-
-
- * }
-
-
- * </pre>
-
-
- *
-
-
- * Version 1.5.5, 2005-01-18, http://alexandre.alapetite.net/doc-alex/domxml-php4-php5/
-
-
- *
-
-
- * ------------------------------------------------------------------<br>
-
-
- * Written by Alexandre Alapetite, http://alexandre.alapetite.net/cv/
-
-
- *
-
-
- * Copyright 2004, Licence: Creative Commons "Attribution-ShareAlike 2.0 France" BY-SA (FR),
-
-
- * http://creativecommons.org/licenses/by-sa/2.0/fr/
-
-
- * http://alexandre.alapetite.net/divers/apropos/#by-sa
-
-
- * - Attribution. You must give the original author credit
-
-
- * - Share Alike. If you alter, transform, or build upon this work,
-
-
- *   you may distribute the resulting work only under a license identical to this one
-
-
- * - The French law is authoritative
-
-
- * - Any of these conditions can be waived if you get permission from Alexandre Alapetite
-
-
- * - Please send to Alexandre Alapetite the modifications you make,
-
-
- *   in order to improve this file for the benefit of everybody
-
-
- *
-
-
- * If you want to distribute this code, please do it as a link to:
-
-
- * http://alexandre.alapetite.net/doc-alex/domxml-php4-php5/
-
-
- */
-
-
-
-
-
-function domxml_new_doc($version) {return new php4DOMDocument('');}
-
-
-function domxml_open_file($filename) {return new php4DOMDocument($filename);}
-
-
-function domxml_open_mem($str)
-
-
-{
-
-
- $dom=new php4DOMDocument('');
-
-
- $dom->myDOMNode->loadXML($str);
-
-
- return $dom;
-
-
-}
-
-
-function xpath_eval($xpath_context,$eval_str,$contextnode=null) {return $xpath_context->query($eval_str,$contextnode);}
-
-
-function xpath_new_context($dom_document) {return new php4DOMXPath($dom_document);}
-
-
-
-
-
-class php4DOMAttr extends php4DOMNode
-
-
-{
-
-
- function php4DOMAttr($aDOMAttr) {$this->myDOMNode=$aDOMAttr;}
-
-
- function Name() {return $this->myDOMNode->name;}
-
-
- function Specified() {return $this->myDOMNode->specified;}
-
-
- function Value() {return $this->myDOMNode->value;}
-
-
-}
-
-
-
-
-
-class php4DOMDocument extends php4DOMNode
-
-
-{
-
-
- function php4DOMDocument($filename='')
-
-
- {
-
-
-  $this->myDOMNode=new DOMDocument();
-
-
-  if ($filename!='') $this->myDOMNode->load($filename);
-
-
- }
-
-
- function create_attribute($name,$value)
-
-
- {
-
-
-  $myAttr=$this->myDOMNode->createAttribute($name);
-
-
-  $myAttr->value=$value;
-
-
-  return new php4DOMAttr($myAttr,$this);
-
-
- }
-
-
- function create_cdata_section($content) {return new php4DOMNode($this->myDOMNode->createCDATASection($content),$this);}
-
-
- function create_comment($data) {return new php4DOMNode($this->myDOMNode->createComment($data),$this);}
-
-
- function create_element($name) {return new php4DOMElement($this->myDOMNode->createElement($name),$this);}
-
-
- function create_text_node($content) {return new php4DOMNode($this->myDOMNode->createTextNode($content),$this);}
-
-
- function document_element() {return new php4DOMElement($this->myDOMNode->documentElement,$this);}
-
-
- function dump_file($filename,$compressionmode=false,$format=false) {return $this->myDOMNode->save($filename);}
-
-
- function dump_mem($format=false,$encoding=false) {return $this->myDOMNode->saveXML();}
-
-
- function get_element_by_id($id) {return new php4DOMElement($this->myDOMNode->getElementById($id),$this);}
-
-
- function get_elements_by_tagname($name)
-
-
- {
-
-
-  $myDOMNodeList=$this->myDOMNode->getElementsByTagName($name);
-
-
-  $nodeSet=array();
-
-
-  $i=0;
-
-
-  if (isset($myDOMNodeList))
-
-
-   while ($node=$myDOMNodeList->item($i))
-
-
-   {
-
-
-    $nodeSet[]=new php4DOMElement($node,$this);
-
-
-    $i++;
-
-
-   }
-
-
-  return $nodeSet;
-
-
- }
-
-
- function html_dump_mem() {return $this->myDOMNode->saveHTML();}
-
-
- function root() {return new php4DOMElement($this->myDOMNode->documentElement,$this);}
-
-
-}
-
-
-
-
-
-class php4DOMElement extends php4DOMNode
-
-
-{
-
-
- function get_attribute($name) {return $this->myDOMNode->getAttribute($name);}
-
-
- function get_elements_by_tagname($name)
-
-
- {
-
-
-  $myDOMNodeList=$this->myDOMNode->getElementsByTagName($name);
-
-
-  $nodeSet=array();
-
-
-  $i=0;
-
-
-  if (isset($myDOMNodeList))
-
-
-   while ($node=$myDOMNodeList->item($i))
-
-
-   {
-
-
-    $nodeSet[]=new php4DOMElement($node,$this->myOwnerDocument);
-
-
-    $i++;
-
-
-   }
-
-
-  return $nodeSet;
-
-
- }
-
-
- function has_attribute($name) {return $this->myDOMNode->hasAttribute($name);}
-
-
- function remove_attribute($name) {return $this->myDOMNode->removeAttribute($name);}
-
-
- function set_attribute($name,$value) {return $this->myDOMNode->setAttribute($name,$value);}
-
-
- function tagname() {return $this->myDOMNode->tagName;}
-
-
-}
-
-
-
-
-
-class php4DOMNode
-
-
-{
-
-
- var $myDOMNode;
-
-
- var $myOwnerDocument;
-
-
- function php4DOMNode($aDomNode,$aOwnerDocument)
-
-
- {
-
-
-  $this->myDOMNode=$aDomNode;
-
-
-  $this->myOwnerDocument=$aOwnerDocument;
-
-
- }
-
-
- function __get($name)
-
-
- {
-
-
-  if ($name=='type') return $this->myDOMNode->nodeType;
-
-
-  elseif ($name=='tagname') return $this->myDOMNode->tagName;
-
-
-  elseif ($name=='content') return $this->myDOMNode->textContent;
-
-
-  else
-
-
-  {
-
-
-   $myErrors=debug_backtrace();
-
-
-   trigger_error('Undefined property: '.get_class($this).'::$'.$name.' ['.$myErrors[0]['file'].':'.$myErrors[0]['line'].']',E_USER_NOTICE);
-
-
-   return false;
-
-
-  }
-
-
- }
-
-
- function append_child($newnode) {return new php4DOMElement($this->myDOMNode->appendChild($newnode->myDOMNode),$this->myOwnerDocument);}
-
-
- function append_sibling($newnode) {return new php4DOMElement($this->myDOMNode->parentNode->appendChild($newnode->myDOMNode),$this->myOwnerDocument);}
-
-
- function attributes()
-
-
- {
-
-
-  $myDOMNodeList=$this->myDOMNode->attributes;
-
-
-  $nodeSet=array();
-
-
-  $i=0;
-
-
-  if (isset($myDOMNodeList))
-
-
-   while ($node=$myDOMNodeList->item($i))
-
-
-   {
-
-
-    $nodeSet[]=new php4DOMAttr($node,$this->myOwnerDocument);
-
-
-    $i++;
-
-
-   }
-
-
-  return $nodeSet;
-
-
- }
-
-
- function child_nodes()
-
-
- {
-
-
-  $myDOMNodeList=$this->myDOMNode->childNodes;
-
-
-  $nodeSet=array();
-
-
-  $i=0;
-
-
-  if (isset($myDOMNodeList))
-
-
-   while ($node=$myDOMNodeList->item($i))
-
-
-   {
-
-
-    $nodeSet[]=new php4DOMElement($node,$this->myOwnerDocument);
-
-
-    $i++;
-
-
-   }
-
-
-  return $nodeSet;
-
-
- }
-
-
- function children() {return $this->child_nodes();}
-
-
- function clone_node($deep=false) {return new php4DOMElement($this->myDOMNode->cloneNode($deep),$this->myOwnerDocument);}
-
-
- function first_child() {return new php4DOMElement($this->myDOMNode->firstChild,$this->myOwnerDocument);}
-
-
- function get_content() {return $this->myDOMNode->textContent;}
-
-
- function has_attributes() {return $this->myDOMNode->hasAttributes();}
-
-
- function has_child_nodes() {return $this->myDOMNode->hasChildNodes();}
-
-
- function insert_before($newnode,$refnode) {return new php4DOMElement($this->myDOMNode->insertBefore($newnode->myDOMNode,$refnode->myDOMNode),$this->myOwnerDocument);}
-
-
- function is_blank_node()
-
-
- {
-
-
-  $myDOMNodeList=$this->myDOMNode->childNodes;
-
-
-  $i=0;
-
-
-  if (isset($myDOMNodeList))
-
-
-   while ($node=$myDOMNodeList->item($i))
-
-
-   {
-
-
-    if (($node->nodeType==XML_ELEMENT_NODE)||
-
-
-        (($node->nodeType==XML_TEXT_NODE)&&!ereg('^([[:cntrl:]]|[[:space:]])*$',$node->nodeValue)))
-
-
-     return false;
-
-
-    $i++;
-
-
-   }
-
-
-  return true;
-
-
- }
-
-
- function last_child() {return new php4DOMElement($this->myDOMNode->lastChild,$this->myOwnerDocument);}
-
-
- function new_child($name,$content)
-
-
- {
-
-
-  $mySubNode=$this->myDOMNode->ownerDocument->createElement($name);
-
-
-  $mySubNode->appendChild($this->myDOMNode->ownerDocument->createTextNode($content));
-
-
-  $this->myDOMNode->appendChild($mySubNode);
-
-
-  return new php4DOMElement($mySubNode,$this->myOwnerDocument);
-
-
- }
-
-
- function next_sibling() {return new php4DOMElement($this->myDOMNode->nextSibling,$this->myOwnerDocument);}
-
-
- function node_name() {return $this->myDOMNode->localName;}
-
-
- function node_type() {return $this->myDOMNode->nodeType;}
-
-
- function node_value() {return $this->myDOMNode->nodeValue;}
-
-
- function owner_document() {return $this->myOwnerDocument;}
-
-
- function parent_node() {return new php4DOMElement($this->myDOMNode->parentNode,$this->myOwnerDocument);}
-
-
- function prefix() {return $this->myDOMNode->prefix;}
-
-
- function previous_sibling() {return new php4DOMElement($this->myDOMNode->previousSibling,$this->myOwnerDocument);}
-
-
- function remove_child($oldchild) {return new php4DOMElement($this->myDOMNode->removeChild($oldchild->myDOMNode),$this->myOwnerDocument);}
-
-
- function replace_child($oldnode,$newnode) {return new php4DOMElement($this->myDOMNode->replaceChild($oldnode->myDOMNode,$newnode->myDOMNode),$this->myOwnerDocument);}
-
-
- function set_content($text)
-
-
- {
-
-
-  if (($this->myDOMNode->hasChildNodes())&&($this->myDOMNode->firstChild->nodeType==XML_TEXT_NODE))
-
-
-   $this->myDOMNode->removeChild($this->myDOMNode->firstChild);
-
-
-  return $this->myDOMNode->appendChild($this->myDOMNode->ownerDocument->createTextNode($text));
-
-
- }
-
-
-}
-
-
-
-
-
-class php4DOMNodelist
-
-
-{
-
-
- var $myDOMNodelist;
-
-
- var $nodeset;
-
-
- function php4DOMNodelist($aDOMNodelist,$aOwnerDocument)
-
-
- {
-
-
-  $this->myDOMNodelist=$aDOMNodelist;
-
-
-  $this->nodeset=array();
-
-
-  $i=0;
-
-
-  if (isset($this->myDOMNodelist))
-
-
-   while ($node=$this->myDOMNodelist->item($i))
-
-
-   {
-
-
-    $this->nodeset[]=new php4DOMElement($node,$aOwnerDocument);
-
-
-    $i++;
-
-
-   }
-
-
- }
-
-
-}
-
-
-
-
-
-class php4DOMXPath
-
-
-{
-
-
- var $myDOMXPath;
-
-
- var $myOwnerDocument;
-
-
- function php4DOMXPath($dom_document)
-
-
- {
-
-
-  $this->myOwnerDocument=$dom_document;
-
-
-  $this->myDOMXPath=new DOMXPath($dom_document->myDOMNode);
-
-
- }
-
-
- function query($eval_str,$contextnode)
-
-
- {
-
-
-  if (isset($contextnode)) return new php4DOMNodelist($this->myDOMXPath->query($eval_str,$contextnode->myDOMNode),$this->myOwnerDocument);
-
-
-  else return new php4DOMNodelist($this->myDOMXPath->query($eval_str),$this->myOwnerDocument);
-
-
- }
-
-
- function xpath_register_ns($prefix,$namespaceURI) {return $this->myDOMXPath->registerNamespace($prefix,$namespaceURI);}
-
-
-}
-
-
-
-
-
-if (extension_loaded('xsl'))
-
-
-{//See also: http://alexandre.alapetite.net/doc-alex/xslt-php4-php5/
-
-
- function domxml_xslt_stylesheet($xslstring) {return new php4DomXsltStylesheet(DOMDocument::loadXML($xslstring));}
-
-
- function domxml_xslt_stylesheet_doc($dom_document) {return new php4DomXsltStylesheet($dom_document);}
-
-
- function domxml_xslt_stylesheet_file($xslfile) {return new php4DomXsltStylesheet(DOMDocument::load($xslfile));}
-
-
- class php4DomXsltStylesheet
-
-
- {
-
-
-  var $myxsltProcessor;
-
-
-  function php4DomXsltStylesheet($dom_document)
-
-
-  {
-
-
-   $this->myxsltProcessor=new xsltProcessor();
-
-
-   $this->myxsltProcessor->importStyleSheet($dom_document);
-
-
-  }
-
-
-  function process($dom_document,$xslt_parameters=array(),$param_is_xpath=false)
-
-
-  {
-
-
-   foreach ($xslt_parameters as $param=>$value)
-
-
-    $this->myxsltProcessor->setParameter('',$param,$value);
-
-
-   $myphp4DOMDocument=new php4DOMDocument();
-
-
-   $myphp4DOMDocument->myDOMNode=$this->myxsltProcessor->transformToDoc($dom_document->myDOMNode);
-
-
-   return $myphp4DOMDocument;
-
-
-  }
-
-
-  function result_dump_file($dom_document,$filename)
-
-
-  {
-
-
-   $html=$dom_document->myDOMNode->saveHTML();
-
-
-   file_put_contents($filename,$html);
-
-
-   return $html;
-
-
-  }
-
-
-  function result_dump_mem($dom_document) {return $dom_document->myDOMNode->saveHTML();}
-
-
- }
-
-
-}
-
-
-?>

auth/cas/CAS/languages/greek.php

@@ -1,79 +0,0 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file languages/greek.php
-
-
- * @author Vangelis Haniotakis <haniotak at ucnet.uoc.gr>
-
-
- * @sa @link internalLang Internationalization @endlink
-
-
- * @ingroup internalLang
-
-
- */
-
-
-
-
-
-$this->_strings = array(
-
-
- CAS_STR_USING_SERVER 
-
-
- => '÷ñçóéìïðïéåßôáé ï åîõðçñåôçôÞò',
-
-
- CAS_STR_AUTHENTICATION_WANTED 
-
-
- => 'Áðáéôåßôáé ç ôáõôïðïßçóç CAS!',
-
-
- CAS_STR_LOGOUT 
-
-
- => 'Áðáéôåßôáé ç áðïóýíäåóç áðü CAS!',
-
-
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
-
- => 'Èá Ýðñåðå íá åß÷áôå áíáêáôåõèõíèåß óôïí åîõðçñåôçôÞ CAS. ÊÜíôå êëßê <a href="%s">åäþ</a> ãéá íá óõíå÷ßóåôå.',
-
-
- CAS_STR_AUTHENTICATION_FAILED 
-
-
- => 'Ç ôáõôïðïßçóç CAS áðÝôõ÷å!',
-
-
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
-
- => '<p>Äåí ôáõôïðïéçèÞêáôå.</p><p>Ìðïñåßôå íá îáíáðñïóðáèÞóåôå, êÜíïíôáò êëßê <a href="%s">åäþ</a>.</p><p>Åáí ôï ðñüâëçìá åðéìåßíåé, åëÜôå óå åðáöÞ ìå ôïí <a href="mailto:%s">äéá÷åéñéóôÞ</a>.</p>',
-
-
- CAS_STR_SERVICE_UNAVAILABLE
-
-
- => 'Ç õðçñåóßá `<b>%s</b>\' äåí åßíáé äéáèÝóéìç (<b>%s</b>).'
-
-
-);
-
-
-
-
-
-?>

auth/cas/CAS/languages/japanese.php

@@ -1,53 +0,0 @@
-<?php
-
-
-
-/**
-
- * @file languages/japanese.php
-
- * @author fnorif (fnorif@yahoo.co.jp)
-
- * 
-
- * Now Encoding is EUC-JP and LF
-
- **/
-
-
-
-$this->_strings = array(
-
- CAS_STR_USING_SERVER 
-
- => 'using server',
-
- CAS_STR_AUTHENTICATION_WANTED 
-
- => 'CASによる認証を行います',
-
- CAS_STR_LOGOUT 
-
- => 'CASからログアウトします!',
-
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
- => 'CASサーバに行く必要があります。自動的に転送されない場合は <a href="%s">こちら</a> をクリックして続行します。',
-
- CAS_STR_AUTHENTICATION_FAILED 
-
- => 'CASによる認証に失敗しました',
-
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
- => '<p>認証できませんでした.</p><p>もう一度リクエストを送信する場合は<a href="%s">こちら</a>をクリック.</p><p>問題が解決しない場合は <a href="mailto:%s">このサイトの管理者</a>に問い合わせてください.</p>',
-
- CAS_STR_SERVICE_UNAVAILABLE
-
- => 'サービス `<b>%s</b>\' は利用できません (<b>%s</b>).'
-
-);
-
-
-
-?>

auth/cas/auth.php

@@ -57,9 +57,14 @@ class auth_plugin_cas extends auth_plugin_base {
      * @return bool Authentication success or failure.
      */
     function user_login ($username, $password) {
-		$this->connectCAS();	
-        return phpCAS::isAuthenticated();
+		$this->connectCAS();
+        return phpCAS::isAuthenticated() && (trim(moodle_strtolower(phpCAS::getUser())) == $username);
     }
+
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *
@@ -92,12 +97,14 @@ class auth_plugin_cas extends auth_plugin_base {
       $username = optional_param("username");
 
       if (!empty($username)) {
-		  if (strstr($SESSION->wantsurl,'ticket') || strstr($SESSION->wantsurl,'NOCAS'))
-			  unset($SESSION->wantsurl);
+          if (isset($SESSION->wantsurl) && (strstr($SESSION->wantsurl, 'ticket') ||
+                                            strstr($SESSION->wantsurl, 'NOCAS'))) {
+              unset($SESSION->wantsurl);
+          }
           return;		  
         }
 
-		// Test si cas activé et paramêtres non remplis
+		// Test si cas activ� et param�tres non remplis
 	  if (empty($this->config->hostname)) {
 		  return;
 		  }
@@ -107,7 +114,14 @@ class auth_plugin_cas extends auth_plugin_base {
 // Connection to CAS server
 	 $this->connectCAS();
 
-	  // Gestion de la connection CAS si accès direct d'un ent ou autre	 
+     if($this->config->certificate_check && $this->config->certificate_path){
+         phpCAS::setCasServerCACert($this->config->certificate_path);
+     }else{
+         // Don't try to validate the server SSL credentials
+         phpCAS::setNoCasServerValidation();
+     }
+
+	  // Gestion de la connection CAS si acc�s direct d'un ent ou autre	 
 	 if (phpCAS::checkAuthentication()) {
 		$frm->username=phpCAS::getUser();
 //		if (phpCAS::getUser()=='esup9992')
@@ -116,7 +130,7 @@ class auth_plugin_cas extends auth_plugin_base {
 		return;
 	 }	 	
 
-	  if ($_GET["loginguest"]== true) {
+      if (isset($_GET["loginguest"]) && ($_GET["loginguest"]== true)) {
 			$frm->username="guest";
 			$frm->password="guest";
 			return;
@@ -152,7 +166,7 @@ class auth_plugin_cas extends auth_plugin_base {
 	  if ($this->config->logoutcas ) {
 	        $backurl = $CFG->wwwroot;
 		  $this->connectCAS();
-	        phpCAS::logout($backurl);        
+          phpCAS::logoutWithURL($backurl);
 	     }
     }
     /**
@@ -166,12 +180,13 @@ class auth_plugin_cas extends auth_plugin_base {
 	global $PHPCAS_CLIENT;
 // mode proxy CAS
 if ( !is_object($PHPCAS_CLIENT) ) {
+    // Make sure phpCAS doesn't try to start a new PHP session when connecting to the CAS server.
 	if  ($this->config->proxycas) {
-	    phpCAS::proxy($this->config->casversion, $this-> config->hostname, (int) $this->config->port, $this->config->baseuri);
+	    phpCAS::proxy($this->config->casversion, $this-> config->hostname, (int) $this->config->port, $this->config->baseuri, false);
 	}
 // mode client CAS
 	else {
-	    phpCAS::client($this->config->casversion, $this-> config->hostname, (int) $this->config->port, $this->config->baseuri);
+	    phpCAS::client($this->config->casversion, $this-> config->hostname, (int) $this->config->port, $this->config->baseuri, false);
 	}
     }
 	
@@ -187,6 +202,18 @@ if ( !is_object($PHPCAS_CLIENT) ) {
     function config_form($config, $err, $user_fields) {
         include 'config.html';
     }
+    /**
+     * A chance to validate form data, and last chance to
+     * do stuff before it is inserted in config_plugin
+     * @param object object with submitted configuration settings (without system magic quotes)
+     * @param array $err array of error messages
+     */
+    function validate_form(&$form, &$err) {
+        $certificate_path = trim($form->certificate_path);
+        if ($form->certificate_check && empty($certificate_path)) {
+            $err['certificate_path'] = get_string('auth_cas_certificate_path_empty', 'auth');
+        }
+    }
     /**
      * Returns the URL for changing the user's pw, or empty if the default can
      * be used.
@@ -233,6 +260,10 @@ if ( !is_object($PHPCAS_CLIENT) ) {
             $config->logoutcas = '';
         if (!isset ($config->multiauth))
             $config->multiauth = '';
+        if (!isset ($config->certificate_check))
+            $config->certificate_check = '';
+        if (!isset ($config->certificate_path))
+            $config->certificate_path = '';
         // LDAP settings
         if (!isset($config->host_url))
             { $config->host_url = ''; }
@@ -275,6 +306,8 @@ if ( !is_object($PHPCAS_CLIENT) ) {
         set_config('proxycas',     $config->proxycas,     'auth/cas');
         set_config('logoutcas',     $config->logoutcas,     'auth/cas');
         set_config('multiauth',     $config->multiauth,     'auth/cas');
+        set_config('certificate_check',     $config->certificate_check,     'auth/cas');
+        set_config('certificate_path',     $config->certificate_path,     'auth/cas');
         // save LDAP settings
         set_config('host_url', $config->host_url, 'auth/cas');
         set_config('ldapencoding', $config->ldapencoding, 'auth/cas');
@@ -355,6 +388,13 @@ if ( !is_object($PHPCAS_CLIENT) ) {
      * @return mixed array with no magic quotes or false on error
      */
     function get_userinfo($username) {
+        // No LDAP servers configured, so user info has to be provided
+        // via other methods (CSV file, manually, etc.). Return empty
+        // array so existing user info is not lost.
+        if (empty($this->config->host_url)) {
+            return array();
+        }
+
         $textlib = textlib_get_instance();
         $extusername = $textlib->convert(stripslashes($username), 'utf-8', $this->config->ldapencoding);
         $ldapconnection = $this->ldap_connect();
@@ -405,7 +445,7 @@ if ( !is_object($PHPCAS_CLIENT) ) {
                 $result[$key] = $ldapval;
             }
         }
-        @ldap_close($ldapconnection);
+        $this->ldap_close($ldapconnection);
         return $result;
     }
     /**
@@ -435,6 +475,16 @@ if ( !is_object($PHPCAS_CLIENT) ) {
      * @return connection result
      */
     function ldap_connect($binddn='',$bindpwd='') {
+        // Cache ldap connections (they are expensive to set up
+        // and can drain the TCP/IP ressources on the server if we 
+        // are syncing a lot of users (as we try to open a new connection
+        // to get the user details). This is the least invasive way
+        // to reuse existing connections without greater code surgery.
+        if(!empty($this->ldapconnection)) {
+            $this->ldapconns++;
+            return $this->ldapconnection;
+        }
+
         //Select bind password, With empty values use
         //ldap_bind_* variables or anonymous bind if ldap_bind_* are empty
         if ($binddn == '' and $bindpwd == '') {
@@ -456,6 +506,9 @@ if ( !is_object($PHPCAS_CLIENT) ) {
             if (!empty($this->config->version)) {
                 ldap_set_option($connresult, LDAP_OPT_PROTOCOL_VERSION, $this->config->version);
             }
+            if ($this->config->user_type == 'ad') {
+                 ldap_set_option($connresult, LDAP_OPT_REFERRALS, 0);
+            }
             if (!empty($binddn)) {
                 //bind with search-user
                 //$debuginfo .= 'Using bind user'.$binddn.'and password:'.$bindpwd;
@@ -469,6 +522,10 @@ if ( !is_object($PHPCAS_CLIENT) ) {
                 ldap_set_option($connresult, LDAP_OPT_DEREF, $this->config->opt_deref);
             }
             if ($bindresult) {
+                // Set the connection counter so we can call PHP's ldap_close()
+                // when we call $this->ldap_close() for the last 'open' connection.
+                $this->ldapconns = 1;  
+                $this->ldapconnection = $connresult;
                 return $connresult;
             }
             $debuginfo .= "<br/>Server: '$server' <br/> Connection: '$connresult'<br/> Bind result: '$bindresult'</br>";
@@ -477,6 +534,18 @@ if ( !is_object($PHPCAS_CLIENT) ) {
         print_error('auth_ldap_noconnect_all','auth',$this->config->user_type);
         return false;
     }
+    /**
+     * disconnects from a ldap server
+     *
+     */
+    function ldap_close() {
+        $this->ldapconns--;
+        if($this->ldapconns == 0) {
+            @ldap_close($this->ldapconnection);
+            unset($this->ldapconnection);
+        }
+    }
+
     /**
      * retuns user attribute mappings between moodle and ldap
      *
@@ -586,6 +655,12 @@ if ( !is_object($PHPCAS_CLIENT) ) {
      */
     function sync_users ($bulk_insert_records = 1000, $do_updates = true) {
         global $CFG;
+
+        if(empty($this->config->host_url)) {
+            echo "No LDAP server configured for CAS! Syncing disabled.\n";
+            return;
+        }
+
         $textlib = textlib_get_instance();
         $droptablesql = array(); /// sql commands to drop the table (because session scope could be a problem for
                                  /// some persistent drivers like ODBTP (mssql) or if this function is invoked
@@ -629,7 +704,7 @@ if ( !is_object($PHPCAS_CLIENT) ) {
         print "Connecting to ldap...\n";
         $ldapconnection = $this->ldap_connect();
         if (!$ldapconnection) {
-            @ldap_close($ldapconnection);
+            $this->ldap_close($ldapconnection);
             print get_string('auth_ldap_noconnect','auth',$this->config->host_url);
             exit;
         }
@@ -754,9 +829,9 @@ if ( !is_object($PHPCAS_CLIENT) ) {
                     $updateuser->id = $user->id;
                     $updateuser->auth = 'cas';
                     if (update_record('user', $updateuser)) {
-                        echo "\t"; print_string('auth_dbreviveser', 'auth', array($user->username, $user->id)); echo "\n";
+                        echo "\t"; print_string('auth_dbreviveduser', 'auth', array($user->username, $user->id)); echo "\n";
                     } else {
-                        echo "\t"; print_string('auth_dbreviveusererror', 'auth', $user->username); echo "\n";
+                        echo "\t"; print_string('auth_dbrevivedusererror', 'auth', $user->username); echo "\n";
                     }
                 }
                 commit_sql();
@@ -878,6 +953,7 @@ if ( !is_object($PHPCAS_CLIENT) ) {
         } else {
             print "No users to be added\n";
         }
+        $this->ldap_close();
         return true;
     }
     /**
@@ -946,7 +1022,7 @@ if ( !is_object($PHPCAS_CLIENT) ) {
      * @return boolean result
      */
     function iscreator($username) {
-        if ((empty($this->config->attrcreators) && empty($this->config->groupecreators)) or empty($this->config->memberattribute)) {
+        if (empty($this->config->host_url) or (empty($this->config->attrcreators) && empty($this->config->groupecreators)) or empty($this->config->memberattribute)) {
             return null;
         }
         $textlib = textlib_get_instance();
@@ -1016,6 +1092,7 @@ if (!empty($this->config->attrcreators)) {
                 }
           }
         }
+        $this->ldap_close();
         return $result;
     }
    /**
@@ -1055,6 +1132,7 @@ if (!empty($this->config->attrcreators)) {
                 array_push($fresult, ($users[$i][$this->config->user_attribute][0]) );
             }
         }
+        $this->ldap_close();
         return $fresult;
     }
     /**
@@ -1123,4 +1201,4 @@ if (!empty($this->config->attrcreators)) {
         return $text;
     }
 }
-?>
+?>

auth/cas/config.html

@@ -48,6 +48,14 @@
 
         $config->multiauth = '';
 
+    if (!isset ($config->certificate_check)) 
+
+        $config->certificate_check = '';
+
+    if (!isset ($config->certificate_path))
+
+        $config->certificate_path = '';
+
   // set to defaults if undefined (LDAP)
 
     if (!isset($config->host_url))
@@ -134,7 +142,7 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
 
 
 
-<table cellspacing="0" cellpadding="5" border="0" align="center">
+<table cellspacing="0" cellpadding="5" border="0">
 
 
 
@@ -364,6 +372,44 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
 
 
 
+<tr valign="top"  class="required">
+
+    <td align="right"><?php print_string('auth_cas_certificate_check_key', 'auth') ?>:</td>
+
+    <td>
+
+        <?php choose_from_menu ($yesno, 'certificate_check', $config->certificate_check, ''); ?>
+
+    </td>
+
+    <td><?php print_string('auth_cas_certificate_check', 'auth') ?></td>
+
+</tr>
+
+
+
+<tr valign="top" class="required">
+
+    <td align="right"><?php print_string('auth_cas_certificate_path_key', 'auth') ?>:</td>
+
+    <td>
+
+        <input name="certificate_path" type="text" size="30" value="<?php echo $config->certificate_path ?>" />
+
+        <?php if (isset($err['certificate_path'])) formerr($err['certificate_path']); ?>
+
+    </td>
+
+    <td>
+
+        <?php print_string('auth_cas_certificate_path', 'auth') ?>
+      
+    </td>
+
+</tr>
+
+
+
 <tr>
 
    <td colspan="2">
@@ -602,7 +648,7 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
 
        $opt_deref[LDAP_DEREF_ALWAYS] = get_string('yes');
 
-       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, LDAP_DEREF_NEVER, '');
+       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, '');
 
        if (isset($err['opt_deref'])) formerr($err['opt_deref']);
 
@@ -722,7 +768,7 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
 
 <tr valign="top" class="required">
 
-        <td align="right"><label for="attrcreators_key"><?php print_string('auth_ldap_attrcreators_key','auth') ?></label></td>
+        <td align="right"><label for="attrcreators"><?php print_string('auth_ldap_attrcreators_key','auth') ?></label></td>
 
         <td>
 
@@ -742,7 +788,7 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
 
 <tr valign="top" class="required">
 
-        <td align="right"><label for="groupecreators_key"><?php print_string('auth_ldap_groupecreators_key','auth') ?></label></td>
+        <td align="right"><label for="groupecreators"><?php print_string('auth_ldap_groupecreators_key','auth') ?></label></td>
 
         <td>
 
@@ -825,4 +871,4 @@ print_auth_lock_options('cas', $user_fields, $help, true, true);
 
 
 ?>
-</table>
+</table>

auth/db/auth.php

@@ -173,6 +173,7 @@ class auth_plugin_db extends auth_plugin_base {
             if ($rs = $authdb->Execute($sql)) {
                 if ( $rs->RecordCount() == 1 ) {
                     $fields_obj = rs_fetch_record($rs);
+                    $fields_obj = (object)array_change_key_case((array)$fields_obj , CASE_LOWER);                 
                     foreach ($selectfields as $localname=>$externalname) {
                         $result[$localname] = $textlib->convert($fields_obj->{$localname}, $this->config->extencoding, 'utf-8');
                      }
@@ -371,7 +372,7 @@ class auth_plugin_db extends auth_plugin_base {
                 if ($old_user = get_record('user', 'username', $user->username, 'deleted', 1, 'mnethostid', $user->mnethostid)) {
                     $user->id = $old_user->id;
                     set_field('user', 'deleted', 0, 'username', $user->username);
-                    echo "\t"; print_string('auth_dbreviveuser', 'auth', array(stripslashes($user->username), $user->id)); echo "\n";
+                    echo "\t"; print_string('auth_dbreviveduser', 'auth', array(stripslashes($user->username), $user->id)); echo "\n";
                 } elseif ($id = insert_record ('user',$user)) { // it is truly a new user
                     echo "\t"; print_string('auth_dbinsertuser','auth',array(stripslashes($user->username), $id)); echo "\n";
                     // if relevant, tag for password generation
@@ -429,6 +430,7 @@ class auth_plugin_db extends auth_plugin_base {
             print_error('auth_dbcantconnect','auth');
         } else if ( $rs->RecordCount() ) {
             while ($rec = rs_fetch_next_record($rs)) {
+                $rec = (object)array_change_key_case((array)$rec , CASE_LOWER);
                 array_push($result, $rec->username);
             }
         }
@@ -570,6 +572,13 @@ class auth_plugin_db extends auth_plugin_base {
         }
     }
 
+    function prevent_local_passwords() {
+        if (!isset($this->config->passtype)) {
+            return false;
+        }
+        return ($this->config->passtype != 'internal');
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/email/auth.php

@@ -132,6 +132,10 @@ class auth_plugin_email extends auth_plugin_base {
         }
     }
 
+    function prevent_local_passwords() {
+        return false;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/fc/auth.php

@@ -144,6 +144,10 @@ class auth_plugin_fc extends auth_plugin_base {
         return false;
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/fc/fcFPP.php

@@ -16,7 +16,8 @@
 /*                                                                      */
 /* This program is free software. You can redistribute it and/or modify */
 /* it under the terms of the GNU General Public License as published by */
-/* the Free Software Foundation; either version 2 of the License.       */
+/* the Free Software Foundation; either version 2 of the License or any */
+/* later version.                                                       */
 /************************************************************************/
 /* Author: Torsten Anderson, torsten.anderson@skeria.skelleftea.se
  */

auth/imap/auth.php

@@ -81,6 +81,10 @@ class auth_plugin_imap extends auth_plugin_base {
         return false;  // No match
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/ldap/auth.php

@@ -45,11 +45,36 @@ class auth_plugin_ldap extends auth_plugin_base {
                 $this->config->{$key} = $value[$this->config->user_type];
             }
         }
-        //hack prefix to objectclass
-        if (empty($this->config->objectclass)) {        // Can't send empty filter
-            $this->config->objectclass='objectClass=*';
-        } else if (stripos($this->config->objectclass, 'objectClass=') !== 0) {
-            $this->config->objectclass = 'objectClass='.$this->config->objectclass;
+
+        // Hack prefix to objectclass
+        if (empty($this->config->objectclass)) {
+            // Can't send empty filter
+            $this->config->objectclass='(objectClass=*)';
+        } else if (stripos($this->config->objectclass, 'objectClass=') === 0) {
+            // Value is 'objectClass=some-string-here', so just add ()
+            // around the value (filter _must_ have them).
+            $this->config->objectclass = '('.$this->config->objectclass.')';
+        } else if (stripos($this->config->objectclass, '(') !== 0) {
+            // Value is 'some-string-not-starting-with-left-parentheses',
+            // which is assumed to be the objectClass matching value.
+            // So build a valid filter with it.
+            $this->config->objectclass = '(objectClass='.$this->config->objectclass.')';
+        } else {
+            // There is an additional possible value
+            // '(some-string-here)', that can be used to specify any
+            // valid filter string, to select subsets of users based
+            // on any criteria. For example, we could select the users
+            // whose objectClass is 'user' and have the
+            // 'enabledMoodleUser' attribute, with something like:
+            //
+            //   (&(objectClass=user)(enabledMoodleUser=1))
+            //
+            // This is only used in the functions that deal with the
+            // whole potential set of users (currently sync_users()
+            // and get_user_list() only).
+            //
+            // In this particular case we don't need to do anything,
+            // so leave $this->config->objectclass as is.
         }
 
     }
@@ -84,19 +109,19 @@ class auth_plugin_ldap extends auth_plugin_base {
 
             //if ldap_user_dn is empty, user does not exist
             if (!$ldap_user_dn) {
-                ldap_close($ldapconnection);
+                $this->ldap_close();
                 return false;
             }
 
             // Try to bind with current username and password
             $ldap_login = @ldap_bind($ldapconnection, $ldap_user_dn, $extpassword);
-            ldap_close($ldapconnection);
+            $this->ldap_close();
             if ($ldap_login) {
                 return true;
             }
         }
         else {
-            @ldap_close($ldapconnection);
+            $this->ldap_close();
             print_error('auth_ldap_noconnect','auth','',$this->config->host_url);
         }
         return false;
@@ -170,7 +195,7 @@ class auth_plugin_ldap extends auth_plugin_base {
             }
         }
 
-        @ldap_close($ldapconnection);
+        $this->ldap_close();
         return $result;
     }
 
@@ -276,7 +301,7 @@ class auth_plugin_ldap extends auth_plugin_base {
                print_error('auth_ldap_unsupportedusertype','auth','',$this->config->user_type);
         }
         $uadd = ldap_add($ldapconnection, $this->config->user_attribute.'="'.$this->ldap_addslashes($userobject->username).','.$this->config->create_context.'"', $newuser);
-        ldap_close($ldapconnection);
+        $this->ldap_close();
         return $uadd;
 
     }
@@ -303,7 +328,7 @@ class auth_plugin_ldap extends auth_plugin_base {
         $ldapconnection = $this->ldap_connect();
         $user_dn = $this->ldap_find_userdn($ldapconnection, $extusername);
         $search_attribs = array($this->config->expireattr);
-        $sr = ldap_read($ldapconnection, $user_dn, 'objectclass=*', $search_attribs);
+        $sr = ldap_read($ldapconnection, $user_dn, '(objectClass=*)', $search_attribs);
         if ($sr)  {
             $info = $this->ldap_get_entries($ldapconnection, $sr);
             if (!empty ($info) and !empty($info[0][$this->config->expireattr][0])) {
@@ -391,7 +416,7 @@ class auth_plugin_ldap extends auth_plugin_base {
         $ldapconnection = $this->ldap_connect();
 
         if (!$ldapconnection) {
-            @ldap_close($ldapconnection);
+            $this->ldap_close();
             print get_string('auth_ldap_noconnect','auth',$this->config->host_url);
             exit;
         }
@@ -400,7 +425,7 @@ class auth_plugin_ldap extends auth_plugin_base {
         //// get user's list from ldap to sql in a scalable fashion
         ////
         // prepare some data we'll need
-        $filter = "(&(".$this->config->user_attribute."=*)(".$this->config->objectclass."))";
+        $filter = '(&('.$this->config->user_attribute.'=*)'.$this->config->objectclass.')';
 
         $contexts = explode(";",$this->config->contexts);
 
@@ -531,9 +556,9 @@ class auth_plugin_ldap extends auth_plugin_base {
                     $updateuser->id = $user->id;
                     $updateuser->auth = 'ldap';
                     if (update_record('user', $updateuser)) {
-                        echo "\t"; print_string('auth_dbreviveser', 'auth', array($user->username, $user->id)); echo "\n";
+                        echo "\t"; print_string('auth_dbreviveduser', 'auth', array($user->username, $user->id)); echo "\n";
                     } else {
-                        echo "\t"; print_string('auth_dbreviveusererror', 'auth', $user->username); echo "\n";
+                        echo "\t"; print_string('auth_dbrevivedusererror', 'auth', $user->username); echo "\n";
                     }
                 }
                 commit_sql();
@@ -646,6 +671,9 @@ class auth_plugin_ldap extends auth_plugin_base {
                 $user->confirmed  = 1;
                 $user->auth       = 'ldap';
                 $user->mnethostid = $CFG->mnet_localhost_id;
+                // get_userinfo_asobj() might have replaced $user->username with the value
+                // from the LDAP server (which can be mixed-case). Make sure it's lowercase
+                $user->username = trim(moodle_strtolower($user->username));
                 if (empty($user->lang)) {
                     $user->lang = $CFG->lang;
                 }
@@ -672,6 +700,7 @@ class auth_plugin_ldap extends auth_plugin_base {
         } else {
             print "No users to be added\n";
         }
+        $this->ldap_close();
         return true;
     }
 
@@ -766,7 +795,7 @@ class auth_plugin_ldap extends auth_plugin_base {
                 error ('auth: ldap user_activate() does not support selected usertype:"'.$this->config->user_type.'" (..yet)');
         }
         $result = ldap_modify($ldapconnection, $userdn, $newinfo);
-        ldap_close($ldapconnection);
+        $this->ldap_close();
         return $result;
     }
 
@@ -791,7 +820,7 @@ class auth_plugin_ldap extends auth_plugin_base {
                 error ('auth: ldap user_disable() does not support selected usertype (..yet)');
         }
         $result = ldap_modify($ldapconnection, $userdn, $newinfo);
-        ldap_close($ldapconnection);
+        $this->ldap_close();
         return $result;
     }*/
 
@@ -976,11 +1005,11 @@ class auth_plugin_ldap extends auth_plugin_base {
             }
         } else {
             error_log("ERROR:No user found in LDAP");
-            @ldap_close($ldapconnection);
+            $this->ldap_close();
             return false;
         }
 
-        @ldap_close($ldapconnection);
+        $this->ldap_close();
 
         return true;
 
@@ -1042,7 +1071,7 @@ class auth_plugin_ldap extends auth_plugin_base {
                 }
                 //Update password expiration time, grace logins count
                 $search_attribs = array($this->config->expireattr, 'passwordExpirationInterval','loginGraceLimit' );
-                $sr = ldap_read($ldapconnection, $user_dn, 'objectclass=*', $search_attribs);
+                $sr = ldap_read($ldapconnection, $user_dn, '(objectClass=*)', $search_attribs);
                 if ($sr)  {
                     $info=$this->ldap_get_entries($ldapconnection, $sr);
                     $newattrs = array();
@@ -1104,7 +1133,7 @@ class auth_plugin_ldap extends auth_plugin_base {
 
         }
 
-        @ldap_close($ldapconnection);
+        $this->ldap_close();
         return $result;
     }
 
@@ -1337,6 +1366,16 @@ class auth_plugin_ldap extends auth_plugin_base {
      * @return connection result
      */
     function ldap_connect($binddn='',$bindpwd='') {
+        // Cache ldap connections (they are expensive to set up
+        // and can drain the TCP/IP ressources on the server if we 
+        // are syncing a lot of users (as we try to open a new connection
+        // to get the user details). This is the least invasive way
+        // to reuse existing connections without greater code surgery.
+        if(!empty($this->ldapconnection)) {
+            $this->ldapconns++;
+            return $this->ldapconnection;
+        }
+
         //Select bind password, With empty values use
         //ldap_bind_* variables or anonymous bind if ldap_bind_* are empty
         if ($binddn == '' and $bindpwd == '') {
@@ -1383,6 +1422,10 @@ class auth_plugin_ldap extends auth_plugin_base {
             }
 
             if ($bindresult) {
+		// Set the connection counter so we can call PHP's ldap_close()
+		// when we call $this->ldap_close() for the last 'open' connection.
+                $this->ldapconns = 1;  
+                $this->ldapconnection = $connresult;
                 return $connresult;
             }
 
@@ -1394,6 +1437,18 @@ class auth_plugin_ldap extends auth_plugin_base {
         return false;
     }
 
+    /**
+     * disconnects from a ldap server
+     *
+     */
+    function ldap_close() {
+        $this->ldapconns--;
+        if($this->ldapconns == 0) {
+            @ldap_close($this->ldapconnection);
+            unset($this->ldapconnection);
+        }
+    }
+
     /**
      * retuns dn of username
      *
@@ -1481,7 +1536,7 @@ class auth_plugin_ldap extends auth_plugin_base {
         $ldapconnection = $this->ldap_connect();
 
         if ($filter=="*") {
-           $filter = "(&(".$this->config->user_attribute."=*)(".$this->config->objectclass."))";
+           $filter = '(&('.$this->config->user_attribute.'=*)'.$this->config->objectclass.')';
         }
 
         $contexts = explode(";",$this->config->contexts);
@@ -1552,6 +1607,10 @@ class auth_plugin_ldap extends auth_plugin_base {
         return ($fresult);
     }
 
+    function prevent_local_passwords() {
+        return !empty($this->config->preventpassindb);
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *
@@ -1673,7 +1732,7 @@ class auth_plugin_ldap extends auth_plugin_base {
         if (!isset($config->forcechangepassword))
             {$config->forcechangepassword = 0; }
         if (!isset($config->stdchangepassword))
-            {$config->forcechangepassword = 0; }
+            {$config->stdchangepassword = 0; }
         if (!isset($config->passtype))
             {$config->passtype = 'plaintext'; }
         if (!isset($config->changepasswordurl))
@@ -1694,7 +1753,7 @@ class auth_plugin_ldap extends auth_plugin_base {
         set_config('bind_dn', $config->bind_dn, 'auth/ldap');
         set_config('bind_pw', $config->bind_pw, 'auth/ldap');
         set_config('version', $config->version, 'auth/ldap');
-        set_config('objectclass', $config->objectclass, 'auth/ldap');
+        set_config('objectclass', trim($config->objectclass), 'auth/ldap');
         set_config('memberattribute', $config->memberattribute, 'auth/ldap');
         set_config('memberattribute_isdn', $config->memberattribute_isdn, 'auth/ldap');
         set_config('creators', $config->creators, 'auth/ldap');
@@ -1761,7 +1820,7 @@ class auth_plugin_ldap extends auth_plugin_base {
 
         // If UF_DONT_EXPIRE_PASSWD flag is set in user's
         // userAccountControl attribute, the password doesn't expire.
-        $sr = ldap_read($ldapconn, $user_dn, 'objectclass=*',
+        $sr = ldap_read($ldapconn, $user_dn, '(objectClass=*)',
                         array('userAccountControl'));
         if (!$sr) {
             error_log("ldap: error getting userAccountControl for $user_dn");
@@ -1807,7 +1866,7 @@ class auth_plugin_ldap extends auth_plugin_base {
         // details below).
         // ----------------------------------------------------------------
     
-        $sr = ldap_read($ldapconn, ROOTDSE, 'objectclass=*',
+        $sr = ldap_read($ldapconn, ROOTDSE, '(objectClass=*)',
                         array('defaultNamingContext'));
         if (!$sr) {
             error_log("ldap: error querying rootDSE for Active Directory");
@@ -1817,7 +1876,7 @@ class auth_plugin_ldap extends auth_plugin_base {
         $info = $this->ldap_get_entries($ldapconn, $sr);
         $domaindn = $info[0]['defaultNamingContext'][0];
     
-        $sr = ldap_read ($ldapconn, $domaindn, 'objectclass=*',
+        $sr = ldap_read ($ldapconn, $domaindn, '(objectClass=*)',
                          array('maxPwdAge'));
         $info = $this->ldap_get_entries($ldapconn, $sr);
         $maxpwdage = $info[0]['maxPwdAge'][0];

auth/ldap/config.html

@@ -16,7 +16,7 @@
     if (!isset($config->opt_deref))
         { $config->opt_deref = LDAP_DEREF_NEVER; }
     if (!isset($config->preventpassindb))
-        { $config->preventpassindb = 0; }
+        { $config->preventpassindb = 1; }
     if (!isset($config->bind_dn))
         {$config->bind_dn = ''; }
     if (!isset($config->bind_pw))
@@ -86,7 +86,7 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
     <td align="right"><label for="menuversion"><?php print_string('auth_ldap_version_key','auth') ?></label></td>
     <td>
     <?php
-       $varsions = array();
+       $versions = array();
        $versions[2] = '2';
        $versions[3] = '3';
        choose_from_menu($versions, 'version', $config->version, '');
@@ -193,7 +193,7 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
        $opt_deref = array();
        $opt_deref[LDAP_DEREF_NEVER] = get_string('no');
        $opt_deref[LDAP_DEREF_ALWAYS] = get_string('yes');
-       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, LDAP_DEREF_NEVER, '');
+       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, '');
        if (isset($err['opt_deref'])) formerr($err['opt_deref']);
     ?>
     </td>

auth/manual/auth.php

@@ -62,6 +62,10 @@ class auth_plugin_manual extends auth_plugin_base {
         return update_internal_user_password($user, $newpassword);
     }
 
+    function prevent_local_passwords() {
+        return false;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/mnet/auth.php

@@ -244,7 +244,7 @@ class auth_plugin_mnet extends auth_plugin_base {
         require_once $CFG->dirroot . '/mnet/xmlrpc/client.php';
 
         // verify the remote host is configured locally before attempting RPC call
-        if (! $remotehost = get_record('mnet_host', 'wwwroot', $remotewwwroot)) {
+        if (! $remotehost = get_record('mnet_host', 'wwwroot', $remotewwwroot, 'deleted', 0)) {
             error(get_string('notpermittedtoland', 'mnet'));
         }
 
@@ -590,6 +590,10 @@ class auth_plugin_mnet extends auth_plugin_base {
         delete_records_select('mnet_enrol_assignments', $whereclause);
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *
@@ -771,76 +775,76 @@ class auth_plugin_mnet extends auth_plugin_base {
                           join("\n", $mnet_request->error));
                 break;
             }
+            $mnethostlogssql = '
+            SELECT
+                mhostlogs.remoteid, mhostlogs.time, mhostlogs.userid, mhostlogs.ip,
+                mhostlogs.course, mhostlogs.module, mhostlogs.cmid, mhostlogs.action,
+                mhostlogs.url, mhostlogs.info, mhostlogs.username, c.fullname as coursename,
+                c.modinfo
+            FROM
+                (
+                    SELECT
+                        l.id as remoteid, l.time, l.userid, l.ip, l.course, l.module, l.cmid,
+                        l.action, l.url, l.info, u.username
+                    FROM
+                        ' . $CFG->prefix . 'user u
+                        INNER JOIN ' . $CFG->prefix . 'log l on l.userid = u.id
+                    WHERE
+                        u.mnethostid = ' . $mnethostid . '
+                        AND l.id > ' . $mnet_request->response['last log id'] . '
+                    ORDER BY remoteid ASC
+                    LIMIT 500
+                ) mhostlogs
+                INNER JOIN ' . $CFG->prefix . 'course c on c.id = mhostlogs.course
+            ORDER by mhostlogs.remoteid ASC';
 
-            $query = "SELECT
-                          l.id as remoteid,
-                          l.time,
-                          l.userid,
-                          l.ip,
-                          l.course,
-                          l.module,
-                          l.cmid,
-                          l.action,
-                          l.url,
-                          l.info,
-                          c.fullname as coursename,
-                          c.modinfo as modinfo,
-                          u.username
-                      FROM
-                          {$CFG->prefix}user u,
-                          {$CFG->prefix}log l,
-                          {$CFG->prefix}course c
-                      WHERE
-                          l.userid = u.id AND
-                          u.mnethostid = '$mnethostid' AND
-                          l.id > '".$mnet_request->response['last log id']."' AND
-                          c.id = l.course
-                      ORDER BY
-                          remoteid ASC";
+            $mnethostlogs = get_records_sql($mnethostlogssql);
 
-            $results = get_records_sql($query);
+            if ($mnethostlogs == false) {
+                continue;
+            }
 
-            if (false == $results) continue;
+            $processedlogs = array();
 
-            $param = array();
-
-            foreach($results as $result) {
-                if (!empty($result->modinfo) && !empty($result->cmid)) {
-                    $modinfo = unserialize($result->modinfo);
-                    unset($result->modinfo);
+            foreach($mnethostlogs as $hostlog) {
+                // Extract the name of the relevant module instance from the
+                // course modinfo if possible.
+                if (!empty($hostlog->modinfo) && !empty($hostlog->cmid)) {
+                    $modinfo = unserialize($hostlog->modinfo);
+                    unset($hostlog->modinfo);
                     $modulearray = array();
                     foreach($modinfo as $module) {
                         $modulearray[$module->cm] = urldecode($module->name);
                     }
-                    $result->resource_name = $modulearray[$result->cmid];
+                    $hostlog->resource_name = $modulearray[$hostlog->cmid];
                 } else {
-                    $result->resource_name = '';
+                    $hostlog->resource_name = '';
                 }
 
-                $param[] = array (
-                                    'remoteid'      => $result->remoteid,
-                                    'time'          => $result->time,
-                                    'userid'        => $result->userid,
-                                    'ip'            => $result->ip,
-                                    'course'        => $result->course,
-                                    'coursename'    => $result->coursename,
-                                    'module'        => $result->module,
-                                    'cmid'          => $result->cmid,
-                                    'action'        => $result->action,
-                                    'url'           => $result->url,
-                                    'info'          => $result->info,
-                                    'resource_name' => $result->resource_name,
-                                    'username'      => $result->username
+                $processedlogs[] = array (
+                                    'remoteid'      => $hostlog->remoteid,
+                                    'time'          => $hostlog->time,
+                                    'userid'        => $hostlog->userid,
+                                    'ip'            => $hostlog->ip,
+                                    'course'        => $hostlog->course,
+                                    'coursename'    => $hostlog->coursename,
+                                    'module'        => $hostlog->module,
+                                    'cmid'          => $hostlog->cmid,
+                                    'action'        => $hostlog->action,
+                                    'url'           => $hostlog->url,
+                                    'info'          => $hostlog->info,
+                                    'resource_name' => $hostlog->resource_name,
+                                    'username'      => $hostlog->username
                                  );
             }
 
-            unset($result);
+            unset($hostlog);
 
             $mnet_request = new mnet_xmlrpc_client();
             $mnet_request->set_method('auth/mnet/auth.php/refresh_log');
 
             // set $token and $useragent parameters
-            $mnet_request->add_param($param);
+            $mnet_request->add_param($processedlogs);
 
             if ($mnet_request->send($mnet_peer) === true) {
                 if ($mnet_request->response['code'] > 0) {
@@ -885,10 +889,12 @@ class auth_plugin_mnet extends auth_plugin_base {
 
             unset($logEntryObj->username);
 
+            $logEntryObj = $this->trim_logline($logEntryObj);
             $insertok = insert_record('mnet_log', addslashes_object($logEntryObj), false);
 
             if ($insertok) {
                 $MNET_REMOTE_CLIENT->last_log_id = $logEntryObj->remoteid;
+                $MNET_REMOTE_CLIENT->updateparams->last_log_id = $logEntryObj->remoteid;
             } else {
                 $returnString .= 'Record with id '.$logEntryObj->remoteid." failed to insert.\n";
             }
@@ -1311,9 +1317,12 @@ class auth_plugin_mnet extends auth_plugin_base {
                 svc.apiversion,
                 h2s.id as h2s_id
             FROM
+                {$CFG->prefix}mnet_host h,
                 {$CFG->prefix}mnet_service svc,
                 {$CFG->prefix}mnet_host2service h2s
             WHERE
+                h.deleted = '0' AND
+                h.id = h2s.hostid AND
                 h2s.hostid = '$mnethostid' AND
                 h2s.serviceid = svc.id AND
                 svc.name = '$servicename' AND
@@ -1348,6 +1357,25 @@ class auth_plugin_mnet extends auth_plugin_base {
         }
     }
 
+    /**
+     * Trims a log line from mnet peer to limit each part to a length which can be stored in our DB
+     *
+     * @param object $logline The log information to be trimmed
+     * @return object The passed logline object trimmed to not exceed storable limits
+     */
+    function trim_logline ($logline) {
+        $limits = array('ip' => 15, 'coursename' => 40, 'module' => 20, 'action' => 40,
+                        'url' => 255);
+        foreach ($limits as $property => $limit) {
+            if (isset($logline->$property)) {
+                $logline->$property = substr($logline->$property, 0, $limit);
+            }
+        }
+
+        return $logline;
+    }
+
+
 }
 
 ?>

auth/nntp/auth.php

@@ -64,6 +64,10 @@ class auth_plugin_nntp extends auth_plugin_base {
         return false;
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/nologin/auth.php

@@ -46,6 +46,11 @@ class auth_plugin_nologin extends auth_plugin_base {
         return false;
     }
 
+    function prevent_local_passwords() {
+        // just in case, we do not want to loose the passwords
+        return false;
+    }
+
     /**
      * No external data sync.
      *

auth/none/auth.php

@@ -62,6 +62,10 @@ class auth_plugin_none extends auth_plugin_base {
         return update_internal_user_password($user, $newpassword);
     }
 
+    function prevent_local_passwords() {
+        return false;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/pam/auth.php

@@ -77,6 +77,10 @@ class auth_plugin_pam extends auth_plugin_base {
         }
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/pop3/auth.php

@@ -81,6 +81,10 @@ class auth_plugin_pop3 extends auth_plugin_base {
         return false;  // No matches found
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/radius/auth.php

@@ -80,6 +80,10 @@ class auth_plugin_radius extends auth_plugin_base {
         $rauth->close();
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/shibboleth/README.txt

@@ -170,6 +170,39 @@ Example file:
 ?>
 --
 
+
+How to upgrade your Service Provider to 2.x
+-------------------------------------------------------------------------------
+
+In case your upgrade your Service Provider 1.3.x to 2.x, be aware of the fact 
+that in version 2.0 the default behaviour regarding attribute propagation 
+changed.
+While the Service Provider 1.3.x published the Shibboleth attributes to the
+web server environment as HTTP Request headers, the Service Provider 2.x 
+publishes attributes as environment variables, which increases the security for
+some platforms.
+However, this change has the effect that the attribute names change.
+E.g. while the surname attribute was published as 'HTTP_SHIB_PERSON_SURNAME' 
+with 1.3.x, this attribute will be available in $_SERVER['Shib-Person-surname']
+or depending on your /etc/shibboleth/attribute-map.xml file just as 
+$_SERVER['sn'].
+Because Moodle needs to know what Shibboleth attributes it shall map onto which
+Moodle user profile field, one has to make sure the mapping is updated as well
+after the Service Provider upgrade.
+
+********************************************************************************
+Because you risk locking yourself out of Moodle it is strongly 
+recommended to use the following approach when upgrading the Service Provider:
+1. Enable manual authentication before the upgrade. 
+2. Make sure that you have at least one manual account with administration 
+   privileges working before upgrading your Service Provider to 2.x.
+3. After the SP upgrade, use this account to log into Moodle and adapt the 
+   attribute mapping in 'Site Administration -> Users -> Shibboleth' to reflect 
+   the changed attribute names.
+4. Test the login with a Shibboleth account
+5. If all is working, disable manual authentication again
+********************************************************************************
+
 --------------------------------------------------------------------------------
 In case of problems and questions with Shibboleth authentication, contact
 Lukas Haemmerle <haemmerle@switch.ch> or Markus Hagman <hagman@hytti.uku.fi>

auth/shibboleth/auth.php

@@ -134,6 +134,10 @@ class auth_plugin_shibboleth extends auth_plugin_base {
         return $moodleattributes;
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *