Bumping version for 1.8.10 release (note new convention for numbering)

from HEAD

COPYING.txt

@@ -0,0 +1,339 @@
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+		    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+			    NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
+
+	    How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.

admin/cron.php

@@ -198,7 +198,7 @@
                 foreach ($assigns as $assign) {
                     if ($context = get_context_instance(CONTEXT_COURSE, $assign->courseid)) {
                         if (role_unassign(0, $assign->id, 0, $context->id)) {
-                            mtrace("Deleted assignment for user $assign->id from course $assign->courseid");
+                            mtrace("removing user $assign->id from course $assign->courseid as they have not accessed the course for over $CFG->longtimenosee days");
                         }
                     }
                 }
@@ -272,7 +272,7 @@
                                                 p.id as prefid 
                                         FROM {$CFG->prefix}user u 
                                              JOIN {$CFG->prefix}user_preferences p ON u.id=p.userid
-                                        WHERE p.name='create_password' AND p.value=1 AND u.email !='' ");
+                                        WHERE p.name='create_password' AND p.value='1' AND u.email !='' ");
 
             foreach ($newusers as $newuserid => $newuser) {
                 $newuser->emailstop = 0; // send email regardless

admin/environment.xml

@@ -80,7 +80,6 @@
         <FEEDBACK>
           <ON_ERROR message="mysql416required" />
         </FEEDBACK>
-        <BYPASS function="bypass_mysql416_reqs" message="mysql416bypassed" />
       </VENDOR>
       <VENDOR name="postgres" version="7.4" />
       <VENDOR name="mssql" version="9.0" />
@@ -140,7 +139,6 @@
         <FEEDBACK>
           <ON_ERROR message="mysql416required" />
         </FEEDBACK>
-        <BYPASS function="bypass_mysql416_reqs" message="mysql416bypassed" />
       </VENDOR>
       <VENDOR name="postgres" version="8.0" />
       <VENDOR name="mssql" version="9.0" />
@@ -200,7 +198,7 @@
           <ON_OK message="questioncwqpfsok" />
         </FEEDBACK>
       </CUSTOM_CHECK>
-      <CUSTOM_CHECK file="lib/customcheckslib.php" function="php_check_register_globals" level="optional">
+      <CUSTOM_CHECK file="lib/customcheckslib.php" function="php_check_register_globals" level="required">
         <FEEDBACK>
           <ON_CHECK message="globalswarning" />
         </FEEDBACK>
@@ -214,20 +212,19 @@
       </FEEDBACK>
     </UNICODE>
     <DATABASE level="required">
-      <VENDOR name="mysql" version="4.1.16">
+      <VENDOR name="mysql" version="5.0.25">
         <FEEDBACK>
           <ON_ERROR message="mysql416required" />
         </FEEDBACK>
-        <BYPASS function="bypass_mysql416_reqs" message="mysql416bypassed" />
       </VENDOR>
-      <VENDOR name="postgres" version="8.0" />
+      <VENDOR name="postgres" version="8.3" />
       <VENDOR name="mssql" version="9.0" />
       <VENDOR name="odbc_mssql" version="9.0" />
       <VENDOR name="mssql_n" version="9.0" />
-      <VENDOR name="oracle" version="9.0" />
+      <VENDOR name="oracle" version="10.0" />
       <VENDOR name="sqlite" version="2.0" />
     </DATABASE>
-    <PHP version="5.2.4" level="required">
+    <PHP version="5.2.8" level="required">
     </PHP>
     <PHP_EXTENSIONS>
       <PHP_EXTENSION name="iconv" level="optional">
@@ -270,13 +267,35 @@
           <ON_ERROR message="ziprequired" />
         </FEEDBACK>
       </PHP_EXTENSION>
-    </PHP_EXTENSIONS>
-    <CUSTOM_CHECKS>
-      <CUSTOM_CHECK file="lib/customcheckslib.php" function="php_check_register_globals" level="optional">
+      <PHP_EXTENSION name="gd" level="optional">
         <FEEDBACK>
-          <ON_CHECK message="globalswarning" />
+          <ON_CHECK message="gdrecommended" />
         </FEEDBACK>
-      </CUSTOM_CHECK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="40M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="safe_mode" value="0" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingsafemode" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+    <CUSTOM_CHECKS>
     </CUSTOM_CHECKS>
   </MOODLE>
 </COMPATIBILITY_MATRIX>

admin/fixuserpix.php

@@ -0,0 +1,275 @@
+<?php
+
+require_once('../config.php');
+/**
+ * SCRIPT CONFIGURATION
+ */
+$starttimer = time()+microtime();
+
+$settings = array();
+$settings['verbose'] = false;
+$settings['username'] = null;
+$settings['password'] = null;
+$settings['eolchar'] = '<br />'; // Character used to break lines
+
+// Argument arrays: 0=>short name, 1=>long name
+$arguments = array(
+ array('short'=>'u', 'long'=>'username', 'help' => 'Your moodle username', 'type'=>'STRING', 'default' => ''),
+ array('short'=>'pw', 'long'=>'password', 'help' => 'Your moodle password', 'type'=>'STRING', 'default' => ''),
+ array('short'=>'v', 'long' => 'verbose', 'help' => 'Display extra information about the process')
+);
+
+// Building the USAGE output of the command line version
+if (isset($argv) && isset($argc)) {
+    $help = "Moodle User Pix Fix. Restores user profile images that were not properly moved during 1.8.2 upgrade to newer versions.\n\n"
+          . "Usage: {$argv[0]}; [OPTION] ...\n"
+          . "Options:\n"
+          . "  -h,    -?, -help, --help               This output\n";
+
+    foreach ($arguments as $arg_array) {
+        $equal = '';
+        if (!empty($arg_array['type'])) {
+            $equal = "={$arg_array['type']}";
+        }
+
+        $padding1 = 5 - strlen($arg_array['short']);
+        $padding2 = 30 - (strlen($arg_array['long']) + strlen($equal));
+        $paddingstr1 = '';
+        for ($i = 0; $i < $padding1; $i++) {
+            $paddingstr1 .= ' ';
+        }
+        $paddingstr2 = '';
+        for ($i = 0; $i < $padding2; $i++) {
+            $paddingstr2 .= ' ';
+        }
+
+        $help .= "  -{$arg_array['short']},$paddingstr1--{$arg_array['long']}$equal$paddingstr2{$arg_array['help']}\n";
+    }
+
+    $help .= "\nEmail nicolasconnault@gmail.com for any suggestions or bug reports.\n";
+
+    if ($argc == 1 || in_array($argv[1], array('--help', '-help', '-h', '-?'))) {
+        echo $help;
+        die();
+
+    } else {
+
+        $settings['eolchar'] = "\n";
+        $argv = arguments($argv);
+        $argscount = 0;
+
+        foreach ($arguments as $arg_array) {
+            $value = null;
+            if (in_array($arg_array['short'], array_keys($argv))) {
+                $value = $argv[$arg_array['short']];
+                unset($argv[$arg_array['short']]);
+            } elseif (in_array($arg_array['long'], array_keys($argv))) {
+                $value = $argv[$arg_array['long']];
+                unset($argv[$arg_array['long']]);
+            }
+            if (!is_null($value)) {
+                $settings[$arg_array['long']] = $value;
+                $argscount++;
+            }
+        }
+
+        // If some params are left in argv, it means they are not supported
+        if ($argscount == 0 || count($argv) > 0) {
+            echo $help;
+            die();
+        }
+    }
+}
+
+/**
+ * SCRIPT SETUP
+ */
+require_once($CFG->libdir . '/formslib.php');
+require_once($CFG->dirroot .'/course/lib.php');
+verbose("Loading libraries...");
+$systemcontext = get_context_instance(CONTEXT_SYSTEM);
+
+/**
+ * WEB INTERFACE FORM
+ */
+
+class pixfix_form extends moodleform {
+    function definition() {
+        global $arguments;
+        $mform =& $this->_form;
+
+        foreach ($arguments as $arg_array) {
+            $type = 'advcheckbox';
+
+            $label = ucfirst(str_replace('-', ' ', $arg_array['long']));
+            if (!empty($arg_array['type'])) {
+                $type = 'text';
+            }
+
+            if ($arg_array['long'] == 'password' || $arg_array['long'] == 'username') {
+                continue;
+            }
+
+            $mform->addElement($type, $arg_array['long'], $label);
+
+            if (isset($arg_array['default'])) {
+                $mform->setDefault($arg_array['long'], $arg_array['default']);
+            }
+        }
+        $this->add_action_buttons(false, 'Restore Images');
+    }
+
+    function definition_after_data() {
+
+    }
+}
+
+$run_script = true;
+$web_interface = false;
+
+// If eolchar is still <br />, load the web interface
+if ($settings['eolchar'] == '<br />') {
+    print_header("User Pix-Fix");
+    print_heading("User Pix-Fix");
+    $mform = new pixfix_form();
+
+    if ($data = $mform->get_data(false)) {
+        foreach ($arguments as $arg_array) {
+            if (!empty($data->{$arg_array['long']})) {
+                $settings[$arg_array['long']] = $data->{$arg_array['long']};
+            }
+        }
+    } else {
+        $run_script = false;
+    }
+
+    if (!has_capability('moodle/site:doanything', $systemcontext)) {
+        // If not logged in, give link to login page for current site
+        notify("You must be logged in as administrator before using this script.");
+        require_login();
+    } else {
+        $mform->display();
+    }
+
+    $web_interface = true;
+}
+
+if ($run_script) {
+
+    // User authentication
+    if (!$web_interface) {
+        if (empty($settings['username'])) {
+            echo "You must enter a valid username for a moodle administrator account on this site.{$settings['eolchar']}";
+            die();
+        } elseif (empty($settings['password'])) {
+            echo "You must enter a valid password for a moodle administrator account on this site.{$settings['eolchar']}";
+            die();
+        } else {
+            if (!$user = authenticate_user_login($settings['username'], $settings['password'])) {
+                echo "Invalid username or password!{$settings['eolchar']}";
+                die();
+            }
+            $USER = complete_user_login($user);
+            if (!has_capability('moodle/site:doanything', $systemcontext)) {
+                echo "You do not have administration privileges on this Moodle site. These are required for running the restore script.{$settings['eolchar']}";
+                die();
+            }
+        }
+    }
+
+    // Script code here
+
+    // Look for old moodledata/users directory
+    $oldusersdir = $CFG->dataroot . '/users';
+
+    if (!file_exists($oldusersdir)) {
+        notify('The old directory for user profile images ('.$oldusersdir.') does not exist. Pictures cannot be restored!');
+    } else {
+        // Find user profile images that are not yet in the new directory
+        $folders = get_directory_list($oldusersdir, '', false, true, false);
+
+        $restored_count = 0;
+
+        foreach ($folders as $userid) {
+            $olddir = $oldusersdir . '/' . $userid;
+            $files = get_directory_list($olddir);
+
+            if (empty($files)) {
+                continue;
+            }
+
+            // Create new user directory
+            if (!$newdir = make_user_directory($userid)) {
+                // some weird directory - do not stop the upgrade, just ignore it
+                continue;
+            }
+
+            // Move contents of old directory to new one
+            if (file_exists($olddir) && file_exists($newdir)) {
+                $restored = false;
+
+                foreach ($files as $file) {
+                    if (!file_exists($newdir . '/' . $file)) {
+                        copy($olddir . '/' . $file, $newdir . '/' . $file);
+                        verbose("Moved $olddir/$file into $newdir/$file");
+                        $restored = true;
+                    }
+                }
+
+                if ($restored) {
+                    $restored_count++;
+                }
+            } else {
+                notify("Could not move the contents of $olddir into $newdir!");
+                $result = false;
+                break;
+            }
+        }
+
+        if ($settings['eolchar'] == '<br />') {
+            print_box_start('generalbox centerpara');
+        }
+        if ($restored_count > 0) {
+            echo "Successfully restored profile images for $restored_count users!" . $settings['eolchar'];
+        } else {
+            echo "Did not find any user profile images in need of restoring." . $settings['eolchar'];
+        }
+        if ($settings['eolchar'] == '<br />') {
+            print_box_end();
+        }
+    }
+}
+
+if ($settings['eolchar'] == '<br />') {
+    print_footer();
+}
+
+/**
+ * Converts the standard $argv into an associative array taking var=val arguments into account
+ * @param array $argv
+ * @return array $_ARG
+ */
+function arguments($argv) {
+    $_ARG = array();
+    foreach ($argv as $arg) {
+        if (ereg('--?([^=]+)=(.*)',$arg,$reg)) {
+            $_ARG[$reg[1]] = $reg[2];
+        } elseif(ereg('-([a-zA-Z0-9]+)',$arg,$reg)) {
+           $_ARG[$reg[1]] = 'true';
+        }
+    }
+    return $_ARG;
+}
+
+/**
+ * If verbose is switched on, prints a string terminated by the global eolchar string.
+ * @param string $string The string to STDOUT
+ */
+function verbose($string) {
+    global $settings;
+    if ($settings['verbose'] && !$settings['quiet']) {
+        echo $string . $settings['eolchar'];
+    }
+}
+
+?>

admin/index.php

@@ -281,6 +281,7 @@
 
                 require_once($CFG->libdir.'/environmentlib.php');
                 print_heading(get_string('environment', 'admin'));
+                remove_dir($CFG->dataroot . '/environment'); /// Always delete downloaded env. info to force use of the released one. MDL-9796
                 if (!check_moodle_environment($release, $environment_results, true)) {
                     print_box_start('generalbox', 'notice'); // MDL-8330
                     print_string('langpackwillbeupdated', 'admin');
@@ -426,7 +427,7 @@
     upgrade_local_db("$CFG->wwwroot/$CFG->admin/index.php");  // Return here afterwards
 
 /// Check for changes to RPC functions
-    require_once($CFG->dirroot.'/admin/mnet/adminlib.php');
+    require_once("$CFG->dirroot/$CFG->admin/mnet/adminlib.php");
     upgrade_RPC_functions("$CFG->wwwroot/$CFG->admin/index.php");  // Return here afterwards
 
 

admin/mnet/access_control.php

@@ -47,7 +47,7 @@ if (!empty($action) and confirm_sesskey()) {
     // fetch the record in question
     $id = required_param('id', PARAM_INT);
     if (!$idrec = get_record('mnet_sso_access_control', 'id', $id)) {
-        error(get_string('recordnoexists','mnet'), '/admin/mnet/access_control.php');
+        error(get_string('recordnoexists','mnet'), "/$CFG->admin/mnet/access_control.php");
     }
 
     switch ($action) {
@@ -62,7 +62,7 @@ if (!empty($action) and confirm_sesskey()) {
             // require the access parameter, and it must be 'allow' or 'deny'
             $accessctrl = trim(strtolower(required_param('accessctrl', PARAM_ALPHA)));
             if ($accessctrl != 'allow' and $accessctrl != 'deny') {
-                error(get_string('invalidaccessparam', 'mnet') , '/admin/mnet/access_control.php');
+                error(get_string('invalidaccessparam', 'mnet') , "/$CFG->admin/mnet/access_control.php");
             }
 
             if (mnet_update_sso_access_control($idrec->username, $idrec->mnet_host_id, $accessctrl)) {
@@ -75,7 +75,7 @@ if (!empty($action) and confirm_sesskey()) {
             break;
 
         default:
-            print_error('invalidactionparam', 'mnet', '/admin/mnet/access_control.php');
+            print_error('invalidactionparam', 'mnet', "/$CFG->admin/mnet/access_control.php");
     }
 }
 
@@ -86,7 +86,7 @@ if ($form = data_submitted() and confirm_sesskey()) {
 
     // check permissions and verify form input
     if (!has_capability('moodle/user:delete', $sitecontext)) {
-        error(get_string('nomodifyacl','mnet'), '/admin/mnet/access_control.php');
+        error(get_string('nomodifyacl','mnet'), "/$CFG->admin/mnet/access_control.php");
     }
     if (empty($form->username)) {
         $formerror['username'] = get_string('enterausername','mnet');

admin/mnet/adminlib.php

@@ -72,7 +72,7 @@ function mnet_get_functions($type, $parentname) {
     if (!file_exists($filename)) return false;
 
     if (extension_loaded('tokenizer')) {
-        include_once $CFG->dirroot.'/admin/mnet/MethodTable.php';
+        include_once "$CFG->dirroot/$CFG->admin/mnet/MethodTable.php";
         $functions = (array)MethodTable::create($filename,false);
     }
 

admin/mnet/delete.html

@@ -1,7 +1,7 @@
 <?php
 print_header("$site->shortname: $strmnetsettings", "$site->fullname",
-             '<a href="'.$CFG->wwwroot.'/admin/index.php">'.$stradministration.'</a> -> '.
-             '<a href="'.$CFG->wwwroot.'/admin/mnet/index.php">'.get_string('mnetsettings', 'mnet').'</a> -> Delete host');
+             '<a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/index.php">'.$stradministration.'</a> -> '.
+             '<a href="'.$CFG->wwwroot.'/'.$CFG->admin.'/mnet/index.php">'.get_string('mnetsettings', 'mnet').'</a> -> Delete host');
 
 print_heading(get_string('mnetsettings', 'mnet'));
 ?>

admin/mnet/enr_course_enrol.php

@@ -86,9 +86,21 @@
     $mnet_request->set_method('enrol/mnet/enrol.php/course_enrolments');
     $mnet_request->add_param($course->remoteid, 'int');
     $mnet_request->send($mnet_peer);
-    $all_enrolled_users = $mnet_request->response;
-
+    $raw_all_enrolled_users = $mnet_request->response;
     unset($mnet_request);
+
+    $all_enrolled_users = array();
+    if (!empty($raw_all_enrolled_users)) {
+        // Try to repair keying of remote users array, numeric usernames get lost in the fracas
+        foreach ($raw_all_enrolled_users as $username => $userdetails) {
+            if (empty($userdetails['username']) || !is_numeric($username)) {
+                //Not able to repair, or no need to repair
+                $all_enrolled_users[$username] = $userdetails;
+            } else {
+                $all_enrolled_users[$userdetails['username']] = $userdetails;
+            }
+        }
+    }
     
     $select = '';
     $all_enrolled_usernames = '';

admin/mnet/enr_courses.php

@@ -38,7 +38,7 @@
     " class=\"icon\" alt=\"".get_string("course")."\" />";
 
     foreach ($courses as $course) {
-        $link = $CFG->wwwroot . '/admin/mnet/enr_course_enrol.php?'
+        $link = "$CFG->wwwroot/$CFG->admin/mnet/enr_course_enrol.php?"
             . "host={$mnethost}&courseid={$course->id}&sesskey={$USER->sesskey}";
         echo '<tr>'
                . "<td>$icon</td>"

admin/mnet/enr_hosts.php

@@ -38,7 +38,7 @@
            . '</tr>';
     $hosts = $enrolment->list_remote_servers();
     foreach ($hosts as $host) {
-        $coursesurl = "{$CFG->wwwroot}/admin/mnet/enr_courses.php?host={$host->id}&amp;sesskey={$USER->sesskey}";
+        $coursesurl = "{$CFG->wwwroot}/$CFG->admin/mnet/enr_courses.php?host={$host->id}&amp;sesskey={$USER->sesskey}";
         $coursecount = get_field_sql("SELECT count(id) FROM {$CFG->prefix}mnet_enrol_course WHERE hostid={$host->id}");
         if (empty($coursecount)) {
             $coursecount = '?';

admin/report/security/index.php

@@ -0,0 +1,123 @@
+<?php  //$Id$
+
+///////////////////////////////////////////////////////////////////////////
+//                                                                       //
+// NOTICE OF COPYRIGHT                                                   //
+//                                                                       //
+// Moodle - Modular Object-Oriented Dynamic Learning Environment         //
+//          http://moodle.org                                            //
+//                                                                       //
+// Copyright (C) 1999 onwards Martin Dougiamas  http://dougiamas.com     //
+//                                                                       //
+// This program is free software; you can redistribute it and/or modify  //
+// it under the terms of the GNU General Public License as published by  //
+// the Free Software Foundation; either version 2 of the License, or     //
+// (at your option) any later version.                                   //
+//                                                                       //
+// This program is distributed in the hope that it will be useful,       //
+// but WITHOUT ANY WARRANTY; without even the implied warranty of        //
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         //
+// GNU General Public License for more details:                          //
+//                                                                       //
+//          http://www.gnu.org/copyleft/gpl.html                         //
+//                                                                       //
+///////////////////////////////////////////////////////////////////////////
+
+require_once('../../../config.php');
+require_once($CFG->dirroot.'/'.$CFG->admin.'/report/security/lib.php');
+require_once($CFG->libdir.'/adminlib.php');
+
+require_login();
+
+$issue = optional_param('issue', '', PARAM_FILE); // show detailed info about one issue only
+
+$issues = report_security_get_issue_list();
+
+// test if issue valid string
+if (array_search($issue, $issues, true) === false) {
+    $issue = '';
+}
+
+// we may need a bit more memory and this may take a long time to process
+@raise_memory_limit('128M');
+@set_time_limit(0);
+
+// Print the header.
+$adminroot = admin_get_root();
+admin_externalpage_setup('reportsecurity', $adminroot);
+admin_externalpage_print_header($adminroot);
+
+print_heading(get_string('reportsecurity', 'report_security'));
+
+while(@ob_end_flush());
+@flush();
+
+$strok       = '<span class="statusok">'.get_string('statusok', 'report_security').'</span>';
+$strinfo     = '<span class="statusinfo">'.get_string('statusinfo', 'report_security').'</span>';
+$strwarning  = '<span class="statuswarning">'.get_string('statuswarning', 'report_security').'</span>';
+$strserious  = '<span class="statusserious">'.get_string('statusserious', 'report_security').'</span>';
+$strcritical = '<span class="statuscritical">'.get_string('statuscritical', 'report_security').'</span>';
+
+$strissue    = get_string('issue', 'report_security');
+$strstatus   = get_string('status', 'report_security');
+$strdesc     = get_string('description', 'report_security');
+$strconfig   = get_string('configuration', 'report_security');
+
+$statusarr = array(REPORT_SECURITY_OK       => $strok,
+                   REPORT_SECURITY_INFO     => $strinfo,
+                   REPORT_SECURITY_WARNING  => $strwarning,
+                   REPORT_SECURITY_SERIOUS  => $strserious,
+                   REPORT_SECURITY_CRITICAL => $strcritical);
+
+$url = "$CFG->wwwroot/$CFG->admin/report/security/index.php";
+
+if ($issue and ($result = $issue(true))) {
+    $table = new object();
+    $table->head  = array($strissue, $strstatus, $strdesc, $strconfig);
+    $table->size  = array('30%', '10%', '50%', '10%' );
+    $table->align = array('left', 'left', 'left', 'left');
+    $table->width = '90%';
+    $table->data  = array();
+
+    // print detail of one issue only
+    $row = array();
+    $row[0] = report_security_doc_link($issue, $result->name);
+    $row[1] = $statusarr[$result->status];
+    $row[2] = $result->info;
+    $row[3] = is_null($result->link) ? '&nbsp;' : $result->link;
+
+    $CFG->pagepath = "report/security/$issue"; // help link in footer
+
+    $table->data[] = $row;
+
+    print_table($table);
+
+    print_box($result->details, 'generalbox boxwidthnormal boxaligncenter'); // TODO: add proper css
+
+    print_continue($url);
+
+} else {
+    $table = new object();
+    $table->head  = array($strissue, $strstatus, $strdesc);
+    $table->size  = array('30%', '10%', '60%' );
+    $table->align = array('left', 'left', 'left');
+    $table->width = '90%';
+    $table->data  = array();
+
+    foreach ($issues as $issue) {
+        $result = $issue(false);
+        if (!$result) {
+            // ignore this test
+            continue;
+        }
+        $row = array();
+        $row[0] = "<a href='$url?issue=$result->issue'>$result->name</a>";
+        $row[1] = $statusarr[$result->status];
+        $row[2] = $result->info;
+
+        $table->data[] = $row;
+    }
+    print_table($table);
+}
+
+admin_externalpage_print_footer($adminroot);

admin/report/security/lib.php

@@ -0,0 +1,742 @@
+<?php  //$Id$
+
+///////////////////////////////////////////////////////////////////////////
+//                                                                       //
+// NOTICE OF COPYRIGHT                                                   //
+//                                                                       //
+// Moodle - Modular Object-Oriented Dynamic Learning Environment         //
+//          http://moodle.org                                            //
+//                                                                       //
+// Copyright (C) 1999 onwards Martin Dougiamas  http://dougiamas.com     //
+//                                                                       //
+// This program is free software; you can redistribute it and/or modify  //
+// it under the terms of the GNU General Public License as published by  //
+// the Free Software Foundation; either version 2 of the License, or     //
+// (at your option) any later version.                                   //
+//                                                                       //
+// This program is distributed in the hope that it will be useful,       //
+// but WITHOUT ANY WARRANTY; without even the implied warranty of        //
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         //
+// GNU General Public License for more details:                          //
+//                                                                       //
+//          http://www.gnu.org/copyleft/gpl.html                         //
+//                                                                       //
+///////////////////////////////////////////////////////////////////////////
+
+require_once("$CFG->libdir/adminlib.php");
+
+
+define('REPORT_SECURITY_OK', 'ok');
+define('REPORT_SECURITY_INFO', 'info');
+define('REPORT_SECURITY_WARNING', 'warning');
+define('REPORT_SECURITY_SERIOUS', 'serious');
+define('REPORT_SECURITY_CRITICAL', 'critical');
+
+function report_security_get_issue_list() {
+    return array(
+        'report_security_check_globals',
+        'report_security_check_unsecuredataroot',
+        'report_security_check_displayerrors',
+        'report_security_check_noauth',
+        'report_security_check_embed',
+        'report_security_check_mediafilterswf',
+        'report_security_check_openprofiles',
+        'report_security_check_google',
+        'report_security_check_configrw',
+        'report_security_check_defaultuserrole',
+        'report_security_check_guestrole',
+        'report_security_check_defaultcourserole',
+        'report_security_check_courserole',
+
+    );
+}
+
+function report_security_doc_link($issue, $name) {
+    global $CFG;
+
+    if (empty($CFG->docroot)) {
+        return $name;
+    }
+
+    $lang = str_replace('_utf8', '', current_language());
+
+    $str = "<a onclick=\"this.target='docspopup'\" href=\"$CFG->docroot/$lang/report/security/$issue\">";
+    $str .= "<img class=\"iconhelp\" src=\"$CFG->httpswwwroot/pix/docs.gif\" alt=\"\" />$name</a>";
+
+    return $str;
+}
+
+///=============================================
+///               Issue checks
+///=============================================
+
+
+/**
+ * Verifies register globals PHP setting.
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_globals($detailed=false) {
+    $result = new object();
+    $result->issue   = 'report_security_check_globals';
+    $result->name    = get_string('check_globals_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+
+    if (ini_get_bool('register_globals')) {
+        $result->status = REPORT_SECURITY_CRITICAL;
+        $result->info   = get_string('check_globals_error', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_globals_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_globals_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies unsupported noauth setting
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_noauth($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_noauth';
+    $result->name    = get_string('check_noauth_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/auth.php\">".get_string('authentication').'</a>';
+
+    if (is_enabled_auth('none')) {
+        $result->status = REPORT_SECURITY_CRITICAL;
+        $result->info   = get_string('check_noauth_error', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_noauth_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_noauth_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies sloppy embedding - this should have been removed long ago!!
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_embed($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_embed';
+    $result->name    = get_string('check_embed_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/settings.php?section=sitepolicies\">".get_string('sitepolicies', 'admin').'</a>';
+
+    if (!empty($CFG->allowobjectembed)) {
+        $result->status = REPORT_SECURITY_CRITICAL;
+        $result->info   = get_string('check_embed_error', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_embed_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_embed_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies sloppy swf embedding - this should have been removed long ago!!
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_mediafilterswf($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_mediafilterswf';
+    $result->name    = get_string('check_mediafilterswf_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/filters.php\">".get_string('filtersettings', 'admin').'</a>';
+
+    if (!empty($CFG->textfilters)) {
+        $activefilters = explode(',', $CFG->textfilters);
+    } else {
+        $activefilters = array();
+    }
+
+    if (array_search('filter/mediaplugin', $activefilters) !== false and !empty($CFG->filter_mediaplugin_enable_swf)) {
+        $result->status = REPORT_SECURITY_CRITICAL;
+        $result->info   = get_string('check_mediafilterswf_error', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_mediafilterswf_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_mediafilterswf_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies fatal misconfiguration of dataroot
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_unsecuredataroot($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_unsecuredataroot';
+    $result->name    = get_string('check_unsecuredataroot_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+
+    $insecuredataroot = is_dataroot_insecure();
+
+    if ($insecuredataroot) {
+        $result->status = REPORT_SECURITY_SERIOUS;
+        $result->info   = get_string('check_unsecuredataroot_warning', 'report_security', $CFG->dataroot);
+
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_unsecuredataroot_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_unsecuredataroot_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies disaplying of errors - problem for lib files and 3rd party code
+ * because we can not disable debugging in these scripts (they do not include config.php)
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_displayerrors($detailed=false) {
+    $result = new object();
+    $result->issue   = 'report_security_check_displayerrors';
+    $result->name    = get_string('check_displayerrors_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+
+    if (defined('WARN_DISPLAY_ERRORS_ENABLED')) {
+        $result->status = REPORT_SECURITY_WARNING;
+        $result->info   = get_string('check_displayerrors_error', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_displayerrors_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_displayerrors_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies open profiles - originaly open by default, not anymore because spammer abused it a lot
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_openprofiles($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_openprofiles';
+    $result->name    = get_string('check_openprofiles_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/settings.php?section=sitepolicies\">".get_string('sitepolicies', 'admin').'</a>';
+
+    if (empty($CFG->forcelogin) and empty($CFG->forceloginforprofiles)) {
+        $result->status = REPORT_SECURITY_WARNING;
+        $result->info   = get_string('check_openprofiles_error', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_openprofiles_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_openprofiles_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies google access not combined with disabled guest access
+ * because attackers might gain guest access by modifying browser signature.
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_google($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_google';
+    $result->name    = get_string('check_google_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/settings.php?section=sitepolicies\">".get_string('sitepolicies', 'admin').'</a>';
+
+    if (empty($CFG->opentogoogle)) {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_google_ok', 'report_security');
+    } else if (!empty($CFG->guestloginbutton)) {
+        $result->status = REPORT_SECURITY_INFO;
+        $result->info   = get_string('check_google_info', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_SERIOUS;
+        $result->info   = get_string('check_google_error', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_google_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies config.php is not writable anymore after installation,
+ * config files were changed on several outdated server.
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_configrw($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_configrw';
+    $result->name    = get_string('check_configrw_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+
+    if (is_writable($CFG->dirroot.'/config.php')) {
+        $result->status = REPORT_SECURITY_WARNING;
+        $result->info   = get_string('check_configrw_warning', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_configrw_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_configrw_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies sanity of default user role.
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_defaultuserrole($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_defaultuserrole';
+    $result->name    = get_string('check_defaultuserrole_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/settings.php?section=userpolicies\">".get_string('userpolicies', 'admin').'</a>';;
+
+    if (!$default_role = get_record('role', 'id', $CFG->defaultuserroleid)) {
+        $result->status  = REPORT_SECURITY_WARNING;
+        $result->info    = get_string('check_defaultuserrole_notset', 'report_security');
+        $result->details = $result->info;
+
+        return $result;
+    }
+
+    // first test if do anything enabled - that would be really crazy!
+    $sql = "SELECT COUNT(DISTINCT rc.contextid)
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE rc.capability = 'moodle/site:doanything'
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $default_role->id";
+
+    $anythingcount = count_records_sql($sql);
+
+    // risky caps - usually very dangerous
+    $sql = "SELECT COUNT(DISTINCT rc.contextid)
+              FROM {$CFG->prefix}role_capabilities rc
+              JOIN {$CFG->prefix}capabilities cap ON cap.name = rc.capability
+             WHERE ".sql_bitand('cap.riskbitmask', (RISK_XSS | RISK_CONFIG))." <> 0
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $default_role->id";
+
+    $riskycount = count_records_sql($sql);
+
+    // default role can not have view cap in all courses - this would break moodle badly
+    $viewcap = record_exists('role_capabilities', 'roleid', $default_role->id, 'permission', CAP_ALLOW, 'capability', 'moodle/course:view');
+
+    // it may have either no or 'user' legacy type - nothing else, or else it would break during upgrades badly
+    $legacyok = false;
+    $sql = "SELECT rc.capability, 1
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE rc.capability LIKE 'moodle/legacy:%'
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $default_role->id";
+    $legacycaps = get_records_sql($sql);
+    if (!$legacycaps) {
+        $legacyok = true;
+    } else if (count($legacycaps) == 1 and isset($legacycaps['moodle/legacy:user'])) {
+        $legacyok = true;
+    }
+
+    if ($anythingcount or $riskycount or $viewcap or !$legacyok) {
+        $result->status  = REPORT_SECURITY_CRITICAL;
+        $result->info    = get_string('check_defaultuserrole_error', 'report_security', format_string($default_role->name));
+
+    } else {
+        $result->status  = REPORT_SECURITY_OK;
+        $result->info    = get_string('check_defaultuserrole_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_defaultuserrole_details', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies sanity of guest role
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_guestrole($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_guestrole';
+    $result->name    = get_string('check_guestrole_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/settings.php?section=userpolicies\">".get_string('userpolicies', 'admin').'</a>';;
+
+    if (!$guest_role = get_record('role', 'id', $CFG->guestroleid)) {
+        $result->status  = REPORT_SECURITY_WARNING;
+        $result->info    = get_string('check_guestrole_notset', 'report_security');
+        $result->details = $result->info;
+
+        return $result;
+    }
+
+    // first test if do anything enabled - that would be really crazy!
+    $sql = "SELECT COUNT(DISTINCT rc.contextid)
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE rc.capability = 'moodle/site:doanything'
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $guest_role->id";
+
+    $anythingcount = count_records_sql($sql);
+
+    // risky caps - usually very dangerous
+    $sql = "SELECT COUNT(DISTINCT rc.contextid)
+              FROM {$CFG->prefix}role_capabilities rc
+              JOIN {$CFG->prefix}capabilities cap ON cap.name = rc.capability
+             WHERE ".sql_bitand('cap.riskbitmask', (RISK_XSS | RISK_CONFIG))." <> 0
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $guest_role->id";
+
+    $riskycount = count_records_sql($sql);
+
+    // it may have either no or 'guest' legacy type - nothing else, or else it would break during upgrades badly
+    $legacyok = false;
+    $sql = "SELECT rc.capability, 1
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE rc.capability LIKE 'moodle/legacy:%'
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $guest_role->id";
+    $legacycaps = get_records_sql($sql);
+    if (!$legacycaps) {
+        $legacyok = true;
+    } else if (count($legacycaps) == 1 and isset($legacycaps['moodle/legacy:guest'])) {
+        $legacyok = true;
+    }
+
+    if ($anythingcount or $riskycount or !$legacyok) {
+        $result->status  = REPORT_SECURITY_CRITICAL;
+        $result->info    = get_string('check_guestrole_error', 'report_security', format_string($guest_role->name));
+
+    } else {
+        $result->status  = REPORT_SECURITY_OK;
+        $result->info    = get_string('check_guestrole_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $result->details = get_string('check_guestrole_details', 'report_security');
+    }
+
+    return $result;
+}
+
+
+/**
+ * Verifies sanity of site default course role.
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_defaultcourserole($detailed=false) {
+    global $CFG;
+
+    $problems = array();
+
+    $result = new object();
+    $result->issue   = 'report_security_check_defaultcourserole';
+    $result->name    = get_string('check_defaultcourserole_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = "<a href=\"$CFG->wwwroot/$CFG->admin/settings.php?section=userpolicies\">".get_string('userpolicies', 'admin').'</a>';;
+
+    if ($detailed) {
+        $result->details = get_string('check_defaultcourserole_details', 'report_security');
+    }
+
+    if (!$student_role = get_record('role', 'id', $CFG->defaultcourseroleid)) {
+        $result->status  = REPORT_SECURITY_WARNING;
+        $result->info    = get_string('check_defaultcourserole_notset', 'report_security');
+        $result->details = get_string('check_defaultcourserole_details', 'report_security');
+
+        return $result;
+    }
+
+    // first test if do anything enabled - that would be really crazy!
+    $sql = "SELECT DISTINCT rc.contextid
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE rc.capability = 'moodle/site:doanything'
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $student_role->id";
+
+    if ($anything_contexts = get_records_sql($sql)) {
+        foreach($anything_contexts as $contextid) {
+            if ($contextid == SYSCONTEXTID) {
+                $a = "$CFG->wwwroot/$CFG->admin/roles/manage.php?action=view&amp;roleid=$CFG->defaultcourseroleid";
+            } else {
+                $a = "$CFG->wwwroot/$CFG->admin/roles/override.php?contextid=$contextid&amp;roleid=$CFG->defaultcourseroleid";
+            }
+            $problems[] = get_string('check_defaultcourserole_anything', 'report_security', $a);
+        }
+    }
+
+    // risky caps - usually very dangerous
+    $sql = "SELECT DISTINCT rc.contextid
+              FROM {$CFG->prefix}role_capabilities rc
+              JOIN {$CFG->prefix}capabilities cap ON cap.name = rc.capability
+             WHERE ".sql_bitand('cap.riskbitmask', (RISK_XSS | RISK_CONFIG))." <> 0
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $student_role->id";
+
+    if ($riskycontexts = get_records_sql($sql)) {
+        foreach($riskycontexts as $contextid=>$unused) {
+            if ($contextid == SYSCONTEXTID) {
+                $a = "$CFG->wwwroot/$CFG->admin/roles/manage.php?action=view&amp;roleid=$CFG->defaultcourseroleid";
+            } else {
+                $a = "$CFG->wwwroot/$CFG->admin/roles/override.php?contextid=$contextid&amp;roleid=$CFG->defaultcourseroleid";
+            }
+            $problems[] = get_string('check_defaultcourserole_risky', 'report_security', $a);
+        }
+    }
+
+    // course creator or administrator does not make any sense here
+    $sql = "SELECT rc.capability, 1
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE rc.capability LIKE 'moodle/legacy:%'
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid = $student_role->id";
+    $legacycaps = get_records_sql($sql);
+    if (isset($legacycaps['moodle/legacy:coursecreator']) or isset($legacycaps['moodle/legacy:admin'])) {
+        $problems[] = get_string('check_defaultcourserole_legacy', 'report_security');
+    }
+
+    if ($problems) {
+        $result->status  = REPORT_SECURITY_CRITICAL;
+        $result->info    = get_string('check_defaultcourserole_error', 'report_security', format_string($student_role->name));
+        if ($detailed) {
+            $result->details .= "<ul>";
+            foreach ($problems as $problem) {
+                $result->details .= "<li>$problem</li>";
+            }
+            $result->details .= "</ul>";
+        }
+
+    } else {
+        $result->status  = REPORT_SECURITY_OK;
+        $result->info    = get_string('check_defaultcourserole_ok', 'report_security');
+    }
+
+    return $result;
+}
+
+/**
+ * Verifies sanity of default roles in courses.
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_courserole($detailed=false) {
+    global $CFG, $SITE;
+
+    $problems = array();
+
+    $result = new object();
+    $result->issue   = 'report_security_check_courserole';
+    $result->name    = get_string('check_courserole_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+
+    if ($detailed) {
+        $result->details = get_string('check_courserole_details', 'report_security');
+    }
+
+    // get list of all student roles selected in courses excluding the default course role
+    $sql = "SELECT r.*
+              FROM {$CFG->prefix}role r
+              JOIN {$CFG->prefix}course c ON c.defaultrole = r.id
+             WHERE c.id <> $SITE->id AND r.id <> $CFG->defaultcourseroleid";
+
+    if (!$student_roles = get_records_sql($sql)) {
+        $result->status  = REPORT_SECURITY_OK;
+        $result->info    = get_string('check_courserole_notyet', 'report_security');
+        $result->details = get_string('check_courserole_details', 'report_security');
+
+        return $result;
+    }
+
+    $roleids = array_keys($student_roles);
+
+    $sql = "SELECT DISTINCT rc.roleid
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE (rc.capability = 'moodle/legacy:coursecreator' OR rc.capability = 'moodle/legacy:admin'
+                    OR rc.capability = 'moodle/legacy:teacher' OR rc.capability = 'moodle/legacy:editingteacher')
+                   AND rc.permission = ".CAP_ALLOW."";
+
+    $riskyroleids = get_records_sql($sql);
+    $riskyroleids = array_keys($riskyroleids);
+
+
+    // first test if do anything enabled - that would be really crazy!!!!!!
+    $inroles = implode(',', $roleids);
+    $sql = "SELECT rc.roleid, rc.contextid
+              FROM {$CFG->prefix}role_capabilities rc
+             WHERE rc.capability = 'moodle/site:doanything'
+                   AND rc.permission = ".CAP_ALLOW."
+                   AND rc.roleid IN ($inroles)
+          GROUP BY rc.roleid, rc.contextid
+          ORDER BY rc.roleid, rc.contextid";
+
+    $rs = get_recordset_sql($sql);
+    while ($res = rs_fetch_next_record($rs)) {
+        $roleid    = $res->roleid;
+        $contextid = $res->contextid;
+        if ($contextid == SYSCONTEXTID) {
+            $a = "$CFG->wwwroot/$CFG->admin/roles/manage.php?action=view&amp;roleid=$roleid";
+        } else {
+            $a = "$CFG->wwwroot/$CFG->admin/roles/override.php?contextid=$contextid&amp;roleid=$roleid";
+        }
+        $problems[] = get_string('check_courserole_anything', 'report_security', $a);
+    }
+    rs_close($rs);
+
+    // any XSS legacy cap does not make any sense here!
+    $inroles = implode(',', $riskyroleids);
+    $sql = "SELECT DISTINCT c.id, c.shortname
+              FROM {$CFG->prefix}course c
+             WHERE c.defaultrole IN ($inroles)
+          ORDER BY c.sortorder";
+    if ($courses = get_records_sql($sql)) {
+        foreach ($courses as $course) {
+            $a = (object)array('url'=>"$CFG->wwwroot/course/edit.php?id=$course->id", 'shortname'=>$course->shortname);
+            $problems[] = get_string('check_courserole_riskylegacy', 'report_security', $a);
+        }
+    } else {
+        $course = array();
+    }
+
+    // risky caps in any level for roles not marked as risky yet - usually very dangerous!!
+    if ($checkroles = array_diff($roleids, $riskyroleids)) {
+        $inroles = implode(',', $checkroles);
+        $sql = "SELECT rc.roleid, rc.contextid
+                  FROM {$CFG->prefix}role_capabilities rc
+                  JOIN {$CFG->prefix}capabilities cap ON cap.name = rc.capability
+                 WHERE ".sql_bitand('cap.riskbitmask', (RISK_XSS | RISK_CONFIG))." <> 0
+                       AND rc.permission = ".CAP_ALLOW."
+                       AND rc.roleid IN ($inroles)
+              GROUP BY rc.roleid, rc.contextid
+              ORDER BY rc.roleid, rc.contextid";
+        $rs = get_recordset_sql($sql);
+        while ($res = rs_fetch_next_record($rs)) {
+            $roleid    = $res->roleid;
+            $contextid = $res->contextid;
+            if ($contextid == SYSCONTEXTID) {
+                $a = "$CFG->wwwroot/$CFG->admin/roles/manage.php?action=view&amp;roleid=$roleid";
+            } else {
+                $a = "$CFG->wwwroot/$CFG->admin/roles/override.php?contextid=$contextid&amp;roleid=$roleid";
+            }
+            $problems[] = get_string('check_courserole_risky', 'report_security', $a);
+        }
+        rs_close($rs);
+    }
+
+
+    if ($problems) {
+        $result->status  = REPORT_SECURITY_CRITICAL;
+        $result->info    = get_string('check_courserole_error', 'report_security');
+        if ($detailed) {
+            $result->details .= "<ul>";
+            foreach ($problems as $problem) {
+                $result->details .= "<li>$problem</li>";
+            }
+            $result->details .= "</ul>";
+        }
+
+    } else {
+        $result->status  = REPORT_SECURITY_OK;
+        $result->info    = get_string('check_courserole_ok', 'report_security');
+    }
+
+    return $result;
+}
+

admin/report/spamcleaner/index.php

@@ -0,0 +1,372 @@
+<?php
+
+/**
+ * Spam Cleaner
+ *
+ * Helps an admin to clean up spam in Moodle
+ *
+ * @version $Id$
+ * @authors Dongsheng Cai, Martin Dougiamas, Amr Hourani
+ * @license http://www.gnu.org/copyleft/gpl.html GNU Public License
+ */
+
+// Configuration
+
+// List of known spammy keywords, please add more here
+
+$autokeywords = array(
+                    "<img",
+                    "fuck",
+                    "casino",
+                    "porn",
+                    "xxx",
+                    "cialis",
+                    "viagra",
+                    "poker",
+                    "warcraft"
+                );
+
+/////////////////////////////////////////////////////////////////////////////////
+
+require_once('../../../config.php');
+require_once($CFG->libdir.'/adminlib.php');
+function delete_user($user) {
+    $updateuser = new object();
+    $updateuser->id           = $user->id;
+    $updateuser->deleted      = 1;
+    $updateuser->username     = addslashes("$user->email.".time());
+    $updateuser->email        = '';
+    $updateuser->idnumber     = '';
+    $updateuser->timemodified = time();
+    if (update_record('user', $updateuser)) {
+        role_unassign(0, $user->id);
+        return true;
+    } else {
+        return false;
+    }
+}
+
+$keyword = optional_param('keyword', '', PARAM_RAW);
+$autodetect = optional_param('autodetect', '', PARAM_RAW);
+$del = optional_param('del', '', PARAM_RAW);
+$delall = optional_param('delall', '', PARAM_RAW);
+$ignore = optional_param('ignore', '', PARAM_RAW);
+$reset = optional_param('reset', '', PARAM_RAW);
+$id = optional_param('id', '', PARAM_INT);
+
+require_login();
+$adminroot = admin_get_root();
+admin_externalpage_setup('reportspamcleaner', $adminroot);
+
+// Implement some AJAX calls 
+
+// Delete one user
+if (!empty($del) && confirm_sesskey() && ($id != $USER->id)) {
+    if (isset($SESSION->users_result[$id])) {
+        $user = $SESSION->users_result[$id];
+        if (delete_user($user)) {
+            unset($SESSION->users_result[$id]);
+            echo 1;
+        } else {
+            echo 0;
+        }
+    } else {
+        echo 0;
+    }
+    exit;
+}
+
+// Delete lots of users
+if (!empty($delall) && confirm_sesskey()) {
+    if (!empty($SESSION->users_result)) {
+        foreach ($SESSION->users_result as $userid => $user) {
+            if ($userid != $USER->id) {
+                if (delete_user($user)) {
+                    unset($SESSION->users_result[$userid]);
+                }
+            }
+        }
+    }
+    echo 1;
+    exit;
+}
+
+if (!empty($ignore)) {
+    unset($SESSION->users_result[$id]);
+    echo 1;
+    exit;
+}
+
+admin_externalpage_print_header($adminroot);
+
+// Print headers and things
+
+print_spamcleaner_javascript();
+
+print_box(get_string('spamcleanerintro', 'report_spamcleaner'));
+
+print_box_start();     // The forms section at the top
+
+?>
+
+<div class="mdl-align">
+
+<form method="post" action="index.php">
+  <div>
+    <input type="text" name="keyword" id="keyword_el" value="<?php p($keyword) ?>" /> 
+    <input type="hidden" name="sesskey" value="<?php echo sesskey();?>" />
+    <input type="submit" value="<?php echo get_string('spamsearch', 'report_spamcleaner')?>" />
+  </div>
+</form>
+<p><?php echo get_string('spameg', 'report_spamcleaner');?></p>
+
+<hr />
+
+<form method="post"  action="index.php">
+  <div>
+    <input type="submit" name="autodetect" value="<?php echo get_string('spamauto', 'report_spamcleaner');?>" />
+  </div>
+</form>
+
+
+</div>
+
+<?php
+print_box_end(); 
+
+echo '<div id="result" class="mdl-align">';
+
+// Print list of resulting profiles
+
+if (!empty($keyword)) {               // Use the keyword(s) supplied by the user
+    $keywords = explode(',', $keyword);
+    foreach ($keywords as $key => $keyword) {
+        $keywords[$key] = trim($keyword);
+    }
+    search_spammers($keywords);
+
+} else if (!empty($autodetect)) {     // Use the inbuilt keyword list to detect users
+    search_spammers($autokeywords);
+}
+
+echo '</div>';
+
+/////////////////////////////////////////////////////////////////////////////////
+
+
+///  Functions 
+
+
+function search_spammers($keywords) {
+
+    global $CFG, $USER, $DB; 
+
+    if (!is_array($keywords)) {
+        $keywords = array($keywords);    // Make it into an array
+    }
+
+    $like = sql_ilike();
+
+    $keywordfull = array();
+    foreach ($keywords as $keyword) {
+        $keyword = addslashes($keyword);   // Just to be safe
+        $keywordfull[] = " description $like '%$keyword%' ";
+        $keywordfull2[] = " p.summary $like '%$keyword%' ";
+    }
+    $conditions = '( '.implode(' OR ', $keywordfull).' )';
+    $conditions2 = '( '.implode(' OR ', $keywordfull2).' )';
+
+    $sql = "SELECT * FROM {$CFG->prefix}user WHERE deleted = 0 AND id <> {$USER->id} AND $conditions";  // Exclude oneself
+    $sql2= "SELECT u.*, p.summary FROM {$CFG->prefix}user AS u, {$CFG->prefix}post AS p WHERE $conditions2 AND u.deleted = 0 AND u.id=p.userid AND u.id <> {$USER->id}";
+    $spamusers_desc = get_recordset_sql($sql);
+    $spamusers_blog = get_recordset_sql($sql2);
+
+    $keywordlist = implode(', ', $keywords);
+    print_box(get_string('spamresult', 'report_spamcleaner').s($keywordlist)).' ...';
+
+    print_user_list(array($spamusers_desc, $spamusers_blog), $keywords);
+
+}
+
+function print_user_list($users_rs, $keywords) {
+    global $CFG, $SESSION;
+
+    // reset session everytime this function is called
+    $SESSION->users_result = array();
+    $count = 0;
+
+    foreach ($users_rs as $rs) {
+        while ($user = rs_fetch_next_record($rs)) {
+            if (!$count) {
+                echo '<table border="1" width="100%" id="data-grid"><tr><th>&nbsp;</th><th>'.get_string('user','admin').'</th><th>'.get_string('spamdesc', 'report_spamcleaner').'</th><th>'.get_string('spamoperation', 'report_spamcleaner').'</th></tr>';
+            }
+            $count++;
+            filter_user($user, $keywords, $count);
+        }
+    }
+
+    if (!$count) {
+        echo get_string('spamcannotfinduser', 'report_spamcleaner');
+
+    } else {
+        echo '</table>';
+        echo '<div class="mld-align">
+              <button id="removeall_btn">'.get_string('spamdeleteall', 'report_spamcleaner').'</button>
+              </div>';
+    }
+}
+function filter_user($user, $keywords, $count) {
+    global $CFG;
+    $image_search = false;
+    if (in_array('<img', $keywords)) {
+        $image_search = true;
+    }
+    if (isset($user->summary)) {
+        $user->description = '<h3>'.get_string('spamfromblog', 'report_spamcleaner').'</h3>'.$user->summary;
+        unset($user->summary);
+    }
+    if (preg_match('#<img.*src=[\"\']('.$CFG->pixpath.')#', $user->description, $matches)
+        && $image_search) {
+        $result = false;
+        foreach ($keywords as $keyword) {
+            if (preg_match('#'.$keyword.'#', $user->description)
+                && ($keyword != '<img')) {
+                $result = true;
+            }
+        }
+        if ($result) {
+            echo print_user_entry($user, $keywords, $count);
+        } else {
+            unset($user);
+        }
+    } else {
+        echo print_user_entry($user, $keywords, $count);
+    }
+}
+
+
+function print_user_entry($user, $keywords, $count) {
+
+    global $SESSION, $CFG;
+
+    $smalluserobject = new object;      // All we need to delete them later
+    $smalluserobject->id = $user->id;
+    $smalluserobject->email = $user->email;
+    $smalluserobject->auth = $user->auth;
+    $smalluserobject->firstname = $user->firstname;
+    $smalluserobject->lastname = $user->lastname;
+
+    if (empty($SESSION->users_result[$user->id])) {
+        $SESSION->users_result[$user->id] = $smalluserobject;
+        $html = '<tr valign="top" id="row-'.$user->id.'" class="result-row">';
+        $html .= '<td width="10">'.$count.'</td>';
+        $html .= '<td width="30%" align="left"><a href="'.$CFG->wwwroot."/user/view.php?course=1&amp;id=".$user->id.'" title="'.s($user->username).'">'.fullname($user).'</a>';
+
+        $html .= "<ul>";
+        $profile_set = array('city'=>true, 'country'=>true, 'email'=>true);
+        foreach ($profile_set as $key=>$value) {
+            if (isset($user->$key)){
+                $html .= '<li>'.$user->$key.'</li>';
+            }
+        }
+        $html .= "</ul>";
+        $html .= '</td>';
+
+        foreach ($keywords as $keyword) {
+            $user->description = highlight($keyword, $user->description);
+        }
+
+        $html .= '<td align="left">'.format_text($user->description, FORMAT_MOODLE).'</td>';
+        $html .= '<td width="100px" align="center">';
+        $html .= '<button onclick="del_user(this,'.$user->id.')">'.get_string('deleteuser', 'admin').'</button><br />';
+        $html .= '<button onclick="ignore_user(this,'.$user->id.')">'.get_string('ignore', 'admin').'</button>';
+        $html .= '</td>';
+        $html .= '</tr>';
+        return $html;
+    } else {
+        return null;
+    }
+
+
+}
+
+function print_spamcleaner_javascript()  {
+    global $CFG;
+
+$sesskey = sesskey();
+
+?>
+<script type="text/javascript" src="<?php echo $CFG->wwwroot;?>/lib/yui/yahoo-dom-event/yahoo-dom-event.js"></script>
+<script type="text/javascript" src="<?php echo $CFG->wwwroot;?>/lib/yui/connection/connection-min.js"></script>
+<script type="text/javascript">
+//<![CDATA[
+var row = null;
+var delall_cb = {
+    success: function(o){
+        var resp = o.responseText;
+        if(resp){
+            window.location.href=window.location.href;
+        }
+    }
+}
+function init() {
+    YAHOO.util.Event.addListener("removeall_btn", "click", function(){
+        var yes = confirm('<?php echo get_string('spamdeleteallconfirm', 'report_spamcleaner');?>');
+        if(yes){
+            var cObj = YAHOO.util.Connect.asyncRequest('POST', '<?php echo me();?>?delall=yes&sesskey=<?php echo $sesskey;?>', delall_cb); 
+        }
+    });
+}
+var del_cb = {
+    success: function(o) {
+        var resp = o.responseText;
+        if(row) {
+            if(resp){
+                while(row.tagName != 'TR') {
+                    row = row.parentNode;
+                }
+                row.parentNode.removeChild(row);
+                row = null;
+            } else {
+                alert('<?php echo get_string('spamcannotdelete', 'report_spamcleaner');?>');
+            }
+        }
+    }
+}
+var ignore_cb = {
+    success: function(o){
+        var resp = o.responseText;
+        if(row) {
+            if(resp){
+                while(row.tagName != 'TR') {
+                    row = row.parentNode;
+                }
+                row.parentNode.removeChild(row);
+                row = null;
+            }
+        }
+    }
+}
+function del_user(obj, id) {
+    var yes = confirm('<?php echo get_string('spamdeleteconfirm', 'report_spamcleaner');?>');
+    if(yes){
+        row = obj;
+        var cObj = YAHOO.util.Connect.asyncRequest('POST', '<?php echo me();?>?del=yes&sesskey=<?php echo $sesskey;?>&id='+id, del_cb); 
+    }
+}
+function ignore_user(obj, id) {
+    row = obj;
+    var cObj = YAHOO.util.Connect.asyncRequest('POST', '<?php echo me();?>?ignore=yes&sesskey=<?php echo $sesskey;?>&id='+id, ignore_cb); 
+}
+window.onload = function(){
+    init();
+}
+//]]>
+</script>
+
+<?php 
+}
+
+admin_externalpage_print_footer($adminroot);
+
+?>

admin/report/spamcleaner/settings.php

@@ -0,0 +1,5 @@
+<?php
+
+// spam cleaner
+$ADMIN->add('reports', new admin_externalpage('reportspamcleaner', get_string('spamcleaner','report_spamcleaner'), "$CFG->wwwroot/$CFG->admin/report/spamcleaner/index.php", 'moodle/site:config'));
+

admin/settings/mnet.php

@@ -3,19 +3,19 @@
 // This file defines settingpages and externalpages under the "mnet" category
 
 $ADMIN->add('mnet', new admin_externalpage('net', get_string('settings', 'mnet'), 
-                                           $CFG->wwwroot . '/admin/mnet/index.php', 
+                                           "$CFG->wwwroot/$CFG->admin/mnet/index.php",
                                            'moodle/site:config'));
 
 $ADMIN->add('mnet', new admin_externalpage('mnetpeers', get_string('mnetpeers', 'mnet'), 
-                                           $CFG->wwwroot . '/admin/mnet/peers.php', 
+                                           "$CFG->wwwroot/$CFG->admin/mnet/peers.php",
                                            'moodle/site:config'));
 $ADMIN->add('mnet', new admin_externalpage('ssoaccesscontrol', get_string('ssoaccesscontrol', 'mnet'),
-                                           $CFG->wwwroot . '/admin/mnet/access_control.php', 
+                                           "$CFG->wwwroot/$CFG->admin/mnet/access_control.php",
                                            'moodle/site:config'));
 $ADMIN->add('mnet', new admin_externalpage('mnetenrol', get_string('mnetenrol', 'mnet'), 
-                                           $CFG->wwwroot . '/admin/mnet/enr_hosts.php', 
+                                           "$CFG->wwwroot/$CFG->admin/mnet/enr_hosts.php",
                                            'moodle/site:config'));
 $ADMIN->add('mnet', new admin_externalpage('trustedhosts', get_string('trustedhosts', 'mnet'), 
-                                           $CFG->wwwroot . '/admin/mnet/trustedhosts.php', 
+                                           "$CFG->wwwroot/$CFG->admin/mnet/trustedhosts.php",
                                            'moodle/site:config'));
 ?>

admin/settings/security.php

@@ -33,6 +33,8 @@ $temp->add(new admin_setting_configselect('bloglevel', get_string('bloglevel', '
                                                                                                                                           1 => get_string('personalblogs','blog'),
                                                                                                                                           0 => get_string('disableblogs','blog'))));
 
+$temp->add(new admin_setting_configcheckbox('profilesforenrolledusersonly', get_string('profilesforenrolledusersonly','admin'),get_string('configprofilesforenrolledusersonly', 'admin'),'1'));
+
 $temp->add(new admin_setting_configcheckbox('cronclionly', get_string('cronclionly', 'admin'), get_string('configcronclionly', 'admin'), 0));
 $temp->add(new admin_setting_configtext('cronremotepassword', get_string('cronremotepassword', 'admin'), get_string('configcronremotepassword', 'admin'), '', PARAM_RAW));
 $temp->add(new admin_setting_configcheckbox('emailchangeconfirmation', get_string('emailchangeconfirmation', 'admin'), get_string('configemailchangeconfirmation', 'admin'), 1));

admin/xmldb/actions/check_indexes/check_indexes.class.php

@@ -213,6 +213,10 @@ class check_indexes extends XMLDBAction {
                                 $o.='        </ul>';
                             }
                             $o.='    </li>';
+                        /// Give the script some more time (resetting to current if exists)
+                            if ($currenttl = @ini_get('max_execution_time')) {
+                                @ini_set('max_execution_time',$currenttl);
+                            }
                         }
                         $o.='        </ul>';
                     }

admin/xmldb/actions/edit_field/edit_field.class.php

@@ -84,7 +84,7 @@ class edit_field extends XMLDBAction {
     /// Fetch request data
         $tableparam = required_param('table', PARAM_CLEAN);
         if (!$table =& $structure->getTable($tableparam)) {
-            $this->errormsg = 'Wrong table specified: ' . $tableparm;
+            $this->errormsg = 'Wrong table specified: ' . $tableparam;
             return false;
         }
         $fieldparam = required_param('field', PARAM_CLEAN);

admin/xmldb/actions/edit_index/edit_index.class.php

@@ -84,7 +84,7 @@ class edit_index extends XMLDBAction {
     /// Fetch request data
         $tableparam = required_param('table', PARAM_CLEAN);
         if (!$table =& $structure->getTable($tableparam)) {
-            $this->errormsg = 'Wrong table specified: ' . $tableparm;
+            $this->errormsg = 'Wrong table specified: ' . $tableparam;
             return false;
         }
         $indexparam = required_param('index', PARAM_CLEAN);

admin/xmldb/actions/edit_key/edit_key.class.php

@@ -84,7 +84,7 @@ class edit_key extends XMLDBAction {
     /// Fetch request data
         $tableparam = required_param('table', PARAM_CLEAN);
         if (!$table =& $structure->getTable($tableparam)) {
-            $this->errormsg = 'Wrong table specified: ' . $tableparm;
+            $this->errormsg = 'Wrong table specified: ' . $tableparam;
             return false;
         }
         $keyparam = required_param('key', PARAM_CLEAN);

admin/xmldb/actions/view_table_sql/view_table_sql.class.php

@@ -80,7 +80,7 @@ class view_table_sql extends XMLDBAction {
     /// Get parameters
         $tableparam = required_param('table', PARAM_PATH);
         if (!$table =& $structure->getTable($tableparam)) {
-            $this->errormsg = 'Wrong table specified: ' . $tableparm;
+            $this->errormsg = 'Wrong table specified: ' . $tableparam;
             return false;
         }
         $generatorparam = optional_param('generator', null, PARAM_ALPHANUM);

auth/cas/auth.php

@@ -57,8 +57,8 @@ class auth_plugin_cas extends auth_plugin_base {
      * @return bool Authentication success or failure.
      */
     function user_login ($username, $password) {
-		$this->connectCAS();	
-        return phpCAS::isAuthenticated();
+		$this->connectCAS();
+        return phpCAS::isAuthenticated() && (trim(moodle_strtolower(phpCAS::getUser())) == $username);
     }
     /**
      * Returns true if this authentication plugin is 'internal'.
@@ -97,7 +97,7 @@ class auth_plugin_cas extends auth_plugin_base {
           return;		  
         }
 
-		// Test si cas activé et paramêtres non remplis
+		// Test si cas activ� et param�tres non remplis
 	  if (empty($this->config->hostname)) {
 		  return;
 		  }
@@ -107,7 +107,7 @@ class auth_plugin_cas extends auth_plugin_base {
 // Connection to CAS server
 	 $this->connectCAS();
 
-	  // Gestion de la connection CAS si accès direct d'un ent ou autre	 
+	  // Gestion de la connection CAS si acc�s direct d'un ent ou autre	 
 	 if (phpCAS::checkAuthentication()) {
 		$frm->username=phpCAS::getUser();
 //		if (phpCAS::getUser()=='esup9992')
@@ -405,7 +405,7 @@ if ( !is_object($PHPCAS_CLIENT) ) {
                 $result[$key] = $ldapval;
             }
         }
-        @ldap_close($ldapconnection);
+        $this->ldap_close($ldapconnection);
         return $result;
     }
     /**
@@ -435,6 +435,16 @@ if ( !is_object($PHPCAS_CLIENT) ) {
      * @return connection result
      */
     function ldap_connect($binddn='',$bindpwd='') {
+        // Cache ldap connections (they are expensive to set up
+        // and can drain the TCP/IP ressources on the server if we 
+        // are syncing a lot of users (as we try to open a new connection
+        // to get the user details). This is the least invasive way
+        // to reuse existing connections without greater code surgery.
+        if(!empty($this->ldapconnection)) {
+            $this->ldapconns++;
+            return $this->ldapconnection;
+        }
+
         //Select bind password, With empty values use
         //ldap_bind_* variables or anonymous bind if ldap_bind_* are empty
         if ($binddn == '' and $bindpwd == '') {
@@ -469,6 +479,10 @@ if ( !is_object($PHPCAS_CLIENT) ) {
                 ldap_set_option($connresult, LDAP_OPT_DEREF, $this->config->opt_deref);
             }
             if ($bindresult) {
+                // Set the connection counter so we can call PHP's ldap_close()
+                // when we call $this->ldap_close() for the last 'open' connection.
+                $this->ldapconns = 1;  
+                $this->ldapconnection = $connresult;
                 return $connresult;
             }
             $debuginfo .= "<br/>Server: '$server' <br/> Connection: '$connresult'<br/> Bind result: '$bindresult'</br>";
@@ -477,6 +491,18 @@ if ( !is_object($PHPCAS_CLIENT) ) {
         print_error('auth_ldap_noconnect_all','auth',$this->config->user_type);
         return false;
     }
+    /**
+     * disconnects from a ldap server
+     *
+     */
+    function ldap_close() {
+        $this->ldapconns--;
+        if($this->ldapconns == 0) {
+            @ldap_close($this->ldapconnection);
+            unset($this->ldapconnection);
+        }
+    }
+
     /**
      * retuns user attribute mappings between moodle and ldap
      *
@@ -629,7 +655,7 @@ if ( !is_object($PHPCAS_CLIENT) ) {
         print "Connecting to ldap...\n";
         $ldapconnection = $this->ldap_connect();
         if (!$ldapconnection) {
-            @ldap_close($ldapconnection);
+            $this->ldap_close($ldapconnection);
             print get_string('auth_ldap_noconnect','auth',$this->config->host_url);
             exit;
         }
@@ -878,6 +904,7 @@ if ( !is_object($PHPCAS_CLIENT) ) {
         } else {
             print "No users to be added\n";
         }
+        $this->ldap_close();
         return true;
     }
     /**
@@ -1016,6 +1043,7 @@ if (!empty($this->config->attrcreators)) {
                 }
           }
         }
+        $this->ldap_close();
         return $result;
     }
    /**
@@ -1055,6 +1083,7 @@ if (!empty($this->config->attrcreators)) {
                 array_push($fresult, ($users[$i][$this->config->user_attribute][0]) );
             }
         }
+        $this->ldap_close();
         return $fresult;
     }
     /**

auth/fc/fcFPP.php

@@ -16,7 +16,8 @@
 /*                                                                      */
 /* This program is free software. You can redistribute it and/or modify */
 /* it under the terms of the GNU General Public License as published by */
-/* the Free Software Foundation; either version 2 of the License.       */
+/* the Free Software Foundation; either version 2 of the License or any */
+/* later version.                                                       */
 /************************************************************************/
 /* Author: Torsten Anderson, torsten.anderson@skeria.skelleftea.se
  */

auth/ldap/auth.php

@@ -109,19 +109,19 @@ class auth_plugin_ldap extends auth_plugin_base {
 
             //if ldap_user_dn is empty, user does not exist
             if (!$ldap_user_dn) {
-                ldap_close($ldapconnection);
+                $this->ldap_close();
                 return false;
             }
 
             // Try to bind with current username and password
             $ldap_login = @ldap_bind($ldapconnection, $ldap_user_dn, $extpassword);
-            ldap_close($ldapconnection);
+            $this->ldap_close();
             if ($ldap_login) {
                 return true;
             }
         }
         else {
-            @ldap_close($ldapconnection);
+            $this->ldap_close();
             print_error('auth_ldap_noconnect','auth','',$this->config->host_url);
         }
         return false;
@@ -195,7 +195,7 @@ class auth_plugin_ldap extends auth_plugin_base {
             }
         }
 
-        @ldap_close($ldapconnection);
+        $this->ldap_close();
         return $result;
     }
 
@@ -301,7 +301,7 @@ class auth_plugin_ldap extends auth_plugin_base {
                print_error('auth_ldap_unsupportedusertype','auth','',$this->config->user_type);
         }
         $uadd = ldap_add($ldapconnection, $this->config->user_attribute.'="'.$this->ldap_addslashes($userobject->username).','.$this->config->create_context.'"', $newuser);
-        ldap_close($ldapconnection);
+        $this->ldap_close();
         return $uadd;
 
     }
@@ -416,7 +416,7 @@ class auth_plugin_ldap extends auth_plugin_base {
         $ldapconnection = $this->ldap_connect();
 
         if (!$ldapconnection) {
-            @ldap_close($ldapconnection);
+            $this->ldap_close();
             print get_string('auth_ldap_noconnect','auth',$this->config->host_url);
             exit;
         }
@@ -671,6 +671,9 @@ class auth_plugin_ldap extends auth_plugin_base {
                 $user->confirmed  = 1;
                 $user->auth       = 'ldap';
                 $user->mnethostid = $CFG->mnet_localhost_id;
+                // get_userinfo_asobj() might have replaced $user->username with the value
+                // from the LDAP server (which can be mixed-case). Make sure it's lowercase
+                $user->username = trim(moodle_strtolower($user->username));
                 if (empty($user->lang)) {
                     $user->lang = $CFG->lang;
                 }
@@ -697,6 +700,7 @@ class auth_plugin_ldap extends auth_plugin_base {
         } else {
             print "No users to be added\n";
         }
+        $this->ldap_close();
         return true;
     }
 
@@ -791,7 +795,7 @@ class auth_plugin_ldap extends auth_plugin_base {
                 error ('auth: ldap user_activate() does not support selected usertype:"'.$this->config->user_type.'" (..yet)');
         }
         $result = ldap_modify($ldapconnection, $userdn, $newinfo);
-        ldap_close($ldapconnection);
+        $this->ldap_close();
         return $result;
     }
 
@@ -816,7 +820,7 @@ class auth_plugin_ldap extends auth_plugin_base {
                 error ('auth: ldap user_disable() does not support selected usertype (..yet)');
         }
         $result = ldap_modify($ldapconnection, $userdn, $newinfo);
-        ldap_close($ldapconnection);
+        $this->ldap_close();
         return $result;
     }*/
 
@@ -1001,11 +1005,11 @@ class auth_plugin_ldap extends auth_plugin_base {
             }
         } else {
             error_log("ERROR:No user found in LDAP");
-            @ldap_close($ldapconnection);
+            $this->ldap_close();
             return false;
         }
 
-        @ldap_close($ldapconnection);
+        $this->ldap_close();
 
         return true;
 
@@ -1129,7 +1133,7 @@ class auth_plugin_ldap extends auth_plugin_base {
 
         }
 
-        @ldap_close($ldapconnection);
+        $this->ldap_close();
         return $result;
     }
 
@@ -1362,6 +1366,16 @@ class auth_plugin_ldap extends auth_plugin_base {
      * @return connection result
      */
     function ldap_connect($binddn='',$bindpwd='') {
+        // Cache ldap connections (they are expensive to set up
+        // and can drain the TCP/IP ressources on the server if we 
+        // are syncing a lot of users (as we try to open a new connection
+        // to get the user details). This is the least invasive way
+        // to reuse existing connections without greater code surgery.
+        if(!empty($this->ldapconnection)) {
+            $this->ldapconns++;
+            return $this->ldapconnection;
+        }
+
         //Select bind password, With empty values use
         //ldap_bind_* variables or anonymous bind if ldap_bind_* are empty
         if ($binddn == '' and $bindpwd == '') {
@@ -1408,6 +1422,10 @@ class auth_plugin_ldap extends auth_plugin_base {
             }
 
             if ($bindresult) {
+		// Set the connection counter so we can call PHP's ldap_close()
+		// when we call $this->ldap_close() for the last 'open' connection.
+                $this->ldapconns = 1;  
+                $this->ldapconnection = $connresult;
                 return $connresult;
             }
 
@@ -1419,6 +1437,18 @@ class auth_plugin_ldap extends auth_plugin_base {
         return false;
     }
 
+    /**
+     * disconnects from a ldap server
+     *
+     */
+    function ldap_close() {
+        $this->ldapconns--;
+        if($this->ldapconns == 0) {
+            @ldap_close($this->ldapconnection);
+            unset($this->ldapconnection);
+        }
+    }
+
     /**
      * retuns dn of username
      *

auth/ldap/config.html

@@ -86,7 +86,7 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
     <td align="right"><label for="menuversion"><?php print_string('auth_ldap_version_key','auth') ?></label></td>
     <td>
     <?php
-       $varsions = array();
+       $versions = array();
        $versions[2] = '2';
        $versions[3] = '3';
        choose_from_menu($versions, 'version', $config->version, '');

auth/mnet/auth.php

@@ -771,76 +771,76 @@ class auth_plugin_mnet extends auth_plugin_base {
                           join("\n", $mnet_request->error));
                 break;
             }
+            $mnethostlogssql = '
+            SELECT
+                mhostlogs.remoteid, mhostlogs.time, mhostlogs.userid, mhostlogs.ip,
+                mhostlogs.course, mhostlogs.module, mhostlogs.cmid, mhostlogs.action,
+                mhostlogs.url, mhostlogs.info, mhostlogs.username, c.fullname as coursename,
+                c.modinfo
+            FROM
+                (
+                    SELECT
+                        l.id as remoteid, l.time, l.userid, l.ip, l.course, l.module, l.cmid,
+                        l.action, l.url, l.info, u.username
+                    FROM
+                        ' . $CFG->prefix . 'user u
+                        INNER JOIN ' . $CFG->prefix . 'log l on l.userid = u.id
+                    WHERE
+                        u.mnethostid = ' . $mnethostid . '
+                        AND l.id > ' . $mnet_request->response['last log id'] . '
+                    ORDER BY remoteid ASC
+                    LIMIT 500
+                ) mhostlogs
+                INNER JOIN ' . $CFG->prefix . 'course c on c.id = mhostlogs.course
+            ORDER by mhostlogs.remoteid ASC';
 
-            $query = "SELECT
-                          l.id as remoteid,
-                          l.time,
-                          l.userid,
-                          l.ip,
-                          l.course,
-                          l.module,
-                          l.cmid,
-                          l.action,
-                          l.url,
-                          l.info,
-                          c.fullname as coursename,
-                          c.modinfo as modinfo,
-                          u.username
-                      FROM
-                          {$CFG->prefix}user u,
-                          {$CFG->prefix}log l,
-                          {$CFG->prefix}course c
-                      WHERE
-                          l.userid = u.id AND
-                          u.mnethostid = '$mnethostid' AND
-                          l.id > '".$mnet_request->response['last log id']."' AND
-                          c.id = l.course
-                      ORDER BY
-                          remoteid ASC";
+            $mnethostlogs = get_records_sql($mnethostlogssql);
 
-            $results = get_records_sql($query);
+            if ($mnethostlogs == false) {
+                continue;
+            }
 
-            if (false == $results) continue;
+            $processedlogs = array();
 
-            $param = array();
-
-            foreach($results as $result) {
-                if (!empty($result->modinfo) && !empty($result->cmid)) {
-                    $modinfo = unserialize($result->modinfo);
-                    unset($result->modinfo);
+            foreach($mnethostlogs as $hostlog) {
+                // Extract the name of the relevant module instance from the
+                // course modinfo if possible.
+                if (!empty($hostlog->modinfo) && !empty($hostlog->cmid)) {
+                    $modinfo = unserialize($hostlog->modinfo);
+                    unset($hostlog->modinfo);
                     $modulearray = array();
                     foreach($modinfo as $module) {
                         $modulearray[$module->cm] = urldecode($module->name);
                     }
-                    $result->resource_name = $modulearray[$result->cmid];
+                    $hostlog->resource_name = $modulearray[$hostlog->cmid];
                 } else {
-                    $result->resource_name = '';
+                    $hostlog->resource_name = '';
                 }
 
-                $param[] = array (
-                                    'remoteid'      => $result->remoteid,
-                                    'time'          => $result->time,
-                                    'userid'        => $result->userid,
-                                    'ip'            => $result->ip,
-                                    'course'        => $result->course,
-                                    'coursename'    => $result->coursename,
-                                    'module'        => $result->module,
-                                    'cmid'          => $result->cmid,
-                                    'action'        => $result->action,
-                                    'url'           => $result->url,
-                                    'info'          => $result->info,
-                                    'resource_name' => $result->resource_name,
-                                    'username'      => $result->username
+                $processedlogs[] = array (
+                                    'remoteid'      => $hostlog->remoteid,
+                                    'time'          => $hostlog->time,
+                                    'userid'        => $hostlog->userid,
+                                    'ip'            => $hostlog->ip,
+                                    'course'        => $hostlog->course,
+                                    'coursename'    => $hostlog->coursename,
+                                    'module'        => $hostlog->module,
+                                    'cmid'          => $hostlog->cmid,
+                                    'action'        => $hostlog->action,
+                                    'url'           => $hostlog->url,
+                                    'info'          => $hostlog->info,
+                                    'resource_name' => $hostlog->resource_name,
+                                    'username'      => $hostlog->username
                                  );
             }
 
-            unset($result);
+            unset($hostlog);
 
             $mnet_request = new mnet_xmlrpc_client();
             $mnet_request->set_method('auth/mnet/auth.php/refresh_log');
 
             // set $token and $useragent parameters
-            $mnet_request->add_param($param);
+            $mnet_request->add_param($processedlogs);
 
             if ($mnet_request->send($mnet_peer) === true) {
                 if ($mnet_request->response['code'] > 0) {
@@ -885,10 +885,12 @@ class auth_plugin_mnet extends auth_plugin_base {
 
             unset($logEntryObj->username);
 
+            $logEntryObj = $this->trim_logline($logEntryObj);
             $insertok = insert_record('mnet_log', addslashes_object($logEntryObj), false);
 
             if ($insertok) {
                 $MNET_REMOTE_CLIENT->last_log_id = $logEntryObj->remoteid;
+                $MNET_REMOTE_CLIENT->updateparams->last_log_id = $logEntryObj->remoteid;
             } else {
                 $returnString .= 'Record with id '.$logEntryObj->remoteid." failed to insert.\n";
             }
@@ -1351,6 +1353,25 @@ class auth_plugin_mnet extends auth_plugin_base {
         }
     }
 
+    /**
+     * Trims a log line from mnet peer to limit each part to a length which can be stored in our DB
+     *
+     * @param object $logline The log information to be trimmed
+     * @return object The passed logline object trimmed to not exceed storable limits
+     */
+    function trim_logline ($logline) {
+        $limits = array('ip' => 15, 'coursename' => 40, 'module' => 20, 'action' => 40,
+                        'url' => 255);
+        foreach ($limits as $property => $limit) {
+            if (isset($logline->$property)) {
+                $logline->$property = substr($logline->$property, 0, $limit);
+            }
+        }
+
+        return $logline;
+    }
+
+
 }
 
 ?>

auth/shibboleth/README.txt

@@ -170,6 +170,39 @@ Example file:
 ?>
 --
 
+
+How to upgrade your Service Provider to 2.x
+-------------------------------------------------------------------------------
+
+In case your upgrade your Service Provider 1.3.x to 2.x, be aware of the fact 
+that in version 2.0 the default behaviour regarding attribute propagation 
+changed.
+While the Service Provider 1.3.x published the Shibboleth attributes to the
+web server environment as HTTP Request headers, the Service Provider 2.x 
+publishes attributes as environment variables, which increases the security for
+some platforms.
+However, this change has the effect that the attribute names change.
+E.g. while the surname attribute was published as 'HTTP_SHIB_PERSON_SURNAME' 
+with 1.3.x, this attribute will be available in $_SERVER['Shib-Person-surname']
+or depending on your /etc/shibboleth/attribute-map.xml file just as 
+$_SERVER['sn'].
+Because Moodle needs to know what Shibboleth attributes it shall map onto which
+Moodle user profile field, one has to make sure the mapping is updated as well
+after the Service Provider upgrade.
+
+********************************************************************************
+Because you risk locking yourself out of Moodle it is strongly 
+recommended to use the following approach when upgrading the Service Provider:
+1. Enable manual authentication before the upgrade. 
+2. Make sure that you have at least one manual account with administration 
+   privileges working before upgrading your Service Provider to 2.x.
+3. After the SP upgrade, use this account to log into Moodle and adapt the 
+   attribute mapping in 'Site Administration -> Users -> Shibboleth' to reflect 
+   the changed attribute names.
+4. Test the login with a Shibboleth account
+5. If all is working, disable manual authentication again
+********************************************************************************
+
 --------------------------------------------------------------------------------
 In case of problems and questions with Shibboleth authentication, contact
 Lukas Haemmerle <haemmerle@switch.ch> or Markus Hagman <hagman@hytti.uku.fi>

auth/shibboleth/index.php

@@ -86,7 +86,7 @@
 
     // If we can find any (user independent) Shibboleth attributes but no user
     // attributes we probably didn't receive any user attributes
-    elseif (!empty($_SERVER['HTTP_SHIB_APPLICATION_ID'])) {
+    elseif (!empty($_SERVER['HTTP_SHIB_APPLICATION_ID'])  || !empty($_SERVER['Shib-Application-ID'])) {
         error(get_string( 'shib_no_attributes_error', 'auth' , '\''.$pluginconfig->user_attribute.'\', \''.$pluginconfig->field_map_firstname.'\', \''.$pluginconfig->field_map_lastname.'\' and \''.$pluginconfig->field_map_email.'\''));
     } else {
          error(get_string( 'shib_not_set_up_error', 'auth'));

backup/backup_scheduled.php

@@ -177,7 +177,7 @@ function schedule_backup_cron() {
         //Reference
         if ($count_error != 0 || $count_unfinished != 0) {
             $message .= "  ".get_string('backupfailed')."\n\n";
-            $dest_url = $CFG->wwwroot.'/admin/report/backups/index.php';
+            $dest_url = "$CFG->wwwroot/$CFG->admin/report/backups/index.php";
             $message .= "  ".get_string('backuptakealook','',$dest_url)."\n\n";
             //Set message priority
             $admin->priority = 1;

backup/restore_check.html

@@ -22,8 +22,8 @@
         $course_header->course_fullname =   stripslashes_safe($form1->fullname);   //"update_FullName";  
     /// Roll dates only if the backup course has a start date
     /// (some formats like main page, social..., haven't it and rolling dates
-    /// from 0 produces crazy dates. MDL-10125
-        if ($course_header->course_startdate) {
+    /// from 0 produces crazy dates. MDL-10125 and we have passed some custom startyear/month/day. MDL-12922
+        if ($course_header->course_startdate && !empty($form1->startyear)) {
             $form1->startdate = make_timestamp($form1->startyear, $form1->startmonth, $form1->startday);
             $currentcoursestartdate = $course_header->course_startdate;
             $coursestartdatedateoffset = $form1->startdate - $currentcoursestartdate;

backup/restore_form.html

@@ -254,6 +254,11 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         }
         helpbutton("coursestartdate", get_string("startdate"));
         echo "</td></tr>";
+    } else {
+    /// If user cannot create course, prevent any change in startyear/month/day (so restore wont calculate any roll. MDL-12922
+        echo '<input type="hidden" name="startyear" value="0" />';
+        echo '<input type="hidden" name="startmonth" value="0" />';
+        echo '<input type="hidden" name="startday" value="0" />';
     }
     //Line
     echo "<tr><td colspan=\"4\"><hr /></td></tr>";
@@ -635,4 +640,4 @@ function restore_is_samerole($rolea, $roleb) {
     }
     return true;
 }
-?>
+?>

backup/restorelib.php

@@ -974,6 +974,11 @@
                     //Get section id when restoring in existing course
                     $rec = get_record("course_sections","course",$restore->course_id,
                                                         "section",$section->section);
+                    //If section exists, has empty summary and backup has some summary, use it. MDL-8848
+                    if ($rec && empty($rec->summary) && !empty($section->summary)) {
+                        $rec->summary = $section->summary;
+                        update_record("course_sections", $rec);
+                    }
                     //If that section doesn't exist, get section 0 (every mod will be
                     //asigned there
                     if(!$rec) {

blocks/admin/block_admin.php

@@ -164,10 +164,10 @@ class block_admin extends block_list {
 
         if (empty($course->metacourse) && ($course->id!==SITEID)) {
             if (has_capability('moodle/legacy:guest', $context, NULL, false)) {   // Are a guest now
-                $this->content->items[]='<a href="enrol.php?id='.$this->instance->pageid.'">'.get_string('enrolme', '', format_string($course->shortname)).'</a>';
+                $this->content->items[]='<a href="'.$CFG->wwwroot.'/course/enrol.php?id='.$this->instance->pageid.'">'.get_string('enrolme', '', format_string($course->shortname)).'</a>';
                 $this->content->icons[]='<img src="'.$CFG->pixpath.'/i/user.gif" class="icon" alt="" />';
             } else if (has_capability('moodle/role:unassignself', $context, NULL, false)) {  // Have some role
-                $this->content->items[]='<a href="unenrol.php?id='.$this->instance->pageid.'">'.get_string('unenrolme', '', format_string($course->shortname)).'</a>';
+                $this->content->items[]='<a href="'.$CFG->wwwroot.'/course/unenrol.php?id='.$this->instance->pageid.'">'.get_string('unenrolme', '', format_string($course->shortname)).'</a>';
                 $this->content->icons[]='<img src="'.$CFG->pixpath.'/i/user.gif" class="icon" alt="" />';
             }
         }

blocks/admin_tree/block_admin_tree.php

@@ -196,7 +196,7 @@ class block_admin_tree extends block_base {
             $searchcontent = isset($CFG->adminsearchquery) ? $CFG->adminsearchquery : '';
 
             $this->content->footer = '<div class="adminsearchform">'.
-                                     '<form action="'.$CFG->wwwroot.'/admin/search.php" method="get"><div>'.
+                                     '<form action="'.$CFG->wwwroot.'/'.$CFG->admin.'/search.php" method="get"><div>'.
                                      '<label for="query" class="accesshide">'.get_string('searchinsettings', 'admin').'</label>'.
                                      '<input type="text" name="query" id="query" size="8" value="'.s($searchcontent).'" />'.
                                      '<input type="submit" value="'.get_string('search').'" /></div>'.

blocks/html/block_html.php

@@ -12,7 +12,7 @@ class block_html extends block_base {
     }
 
     function specialization() {
-        $this->title = isset($this->config->title) ? $this->config->title : get_string('newhtmlblock', 'block_html');
+        $this->title = isset($this->config->title) ? format_string($this->config->title) : get_string('newhtmlblock', 'block_html');
     }
 
     function instance_allow_multiple() {
@@ -24,8 +24,13 @@ class block_html extends block_base {
             return $this->content;
         }
 
-        $filteropt = new stdClass;
-        $filteropt->noclean = true;
+        if (!empty($this->instance->pinned) or $this->instance->pagetype === 'course-view') {
+            // fancy html allowed only on course page and in pinned blocks for security reasons
+            $filteropt = new stdClass;
+            $filteropt->noclean = true;
+        } else {
+            $filteropt = null;
+        }
 
         $this->content = new stdClass;
         $this->content->text = isset($this->config->text) ? format_text($this->config->text, FORMAT_HTML, $filteropt) : '';

blocks/html/config_instance.html

@@ -1,4 +1,11 @@
-<?php $usehtmleditor = can_use_html_editor(); ?>
+<?php
+    $usehtmleditor = can_use_html_editor();
+
+    $text = isset($this->config->text) ? $this->config->text : '';
+    if (empty($this->instance->pinned) and $this->instance->pagetype !== 'course-view') {
+        $text = clean_text($text, FORMAT_HTML);
+    }
+?>
 <table cellpadding="9" cellspacing="0">
 <tr valign="top">
     <td align="right"><?php print_string('configtitle', 'block_html'); ?>:</td>
@@ -6,7 +13,7 @@
 </tr>
 <tr valign="top">
     <td align="right"><?php print_string('configcontent', 'block_html'); ?>:</td>
-    <td><?php print_textarea($usehtmleditor, 25, 50, 0, 0, 'text', isset($this->config->text)?$this->config->text:'') ?></td>
+    <td><?php print_textarea($usehtmleditor, 25, 50, 0, 0, 'text', $text) ?></td>
 </tr>
 <tr>
     <td colspan="3" align="center">

blog/lib.php

@@ -216,8 +216,8 @@
         echo '<div class="audience">'.$blogtype.'</div>';
 
         // Print whole message
-        echo format_text($template['body']);
-        
+        echo $template['body'];
+
         /// Print attachments
         echo $attachedimages;
     /// Links to tags

calendar/export_execute.php

@@ -11,12 +11,12 @@ $authtoken = required_param('authtoken', PARAM_ALPHANUM);
 //Fetch user information
 if (!$user = get_complete_user_data('username', $username)) {
    //No such user
-   die("No such user '$username'");
+    die('Invalid authentication');
 }
 
 //Check authentication token
 if ($authtoken != sha1($username . $user->password)) {
-    die('Invalid authentication token');
+    die('Invalid authentication');
 }
 
 $what = optional_param('preset_what', 'all', PARAM_ALPHA);

course/category.php

@@ -160,7 +160,17 @@
             $courses = array();        
             foreach ( $data as $key => $value ) {
                 if (preg_match('/^c\d+$/', $key)) {
-                    array_push($courses, substr($key, 1));
+                    $courseid = substr($key, 1);
+                    array_push($courses, $courseid);
+
+                    // check this course's category
+                    if ($movingcourse = get_record('course', 'id', $courseid)) {
+                        if ($movingcourse->category != $id ) {
+                            error('The course doesn\'t belong to this category');
+                        }
+                    } else {
+                        error('Error finding the course');
+                    }
                 }
             } 
             move_courses($courses, $data->moveto);
@@ -169,7 +179,6 @@
     /// Hide or show a course
 
         if ((!empty($hide) or !empty($show)) and confirm_sesskey()) {
-            require_capability('moodle/course:visibility', $context);
             if (!empty($hide)) {
                 $course = get_record("course", "id", $hide);
                 $visible = 0;
@@ -178,8 +187,10 @@
                 $visible = 1;
             }
             if ($course) {
-                if (! set_field("course", "visible", $visible, "id", $course->id)) {
-                    notify("Could not update that course!");
+                $coursecontext = get_context_instance(CONTEXT_COURSE, $course->id);
+                require_capability('moodle/course:visibility', $coursecontext);
+                if (!set_field('course', 'visible', $visible, 'id', $course->id)) {
+                    notify('Could not update that course!');
                 }
             }
         }
@@ -212,8 +223,11 @@
                                          'category',  $category->id,
                                          'sortorder', $movecourse->sortorder + 1);
             }
-
             if ($swapcourse and $movecourse) {        // Renumber everything for robustness
+                // check course's category
+                if ($movecourse->category != $id) {
+                    error('The course doesn\'t belong to this category');
+                }
                 begin_sql();
                 if (!(    set_field("course", "sortorder", $max, "id", $swapcourse->id)
                        && set_field("course", "sortorder", $swapcourse->sortorder, "id", $movecourse->id)

course/editsection.php

@@ -52,7 +52,7 @@
         $stredit      = get_string('edit', '', " $sectionname");
         $strsummaryof = get_string('summaryof', '', " $sectionname");
     } else {
-        $sectionname  = get_string("name$course->format");
+        $sectionname  = get_section_name($course->format);
         $stredit      = get_string('edit', '', " $sectionname $section->section");
         $strsummaryof = get_string('summaryof', '', " $sectionname $form->section");
     }

course/lib.php

@@ -244,24 +244,52 @@ function make_log_url($module, $url) {
         case 'message':
         case 'calendar':
         case 'blog':
-            return "/$module/$url";
+            if (strpos($url, '../') === 0) {
+                $url = ltrim($url, '.');
+            } else {
+                $url = "/course/$url";
+            }
             break;
         case 'mnet course':
-            return "/course/$url";
+            $url = "/course/$url";
             break;
         case 'upload':
-            return $url;
+            $url = $url;
             break;
         case 'library':
         case '':
-            return '/';
+            $url = '/';
             break;
         default:
-            return "/mod/$module/$url";
+            $url = "/mod/$module/$url";
             break;
     }
-}
 
+    //now let's sanitise urls - there might be some ugly nasties:-(
+    $parts = explode('?', $url);
+    $script = array_shift($parts);
+    if (strpos($script, 'http') === 0) {
+        $script = clean_param($script, PARAM_URL);
+    } else {
+        $script = clean_param($script, PARAM_PATH);
+    }
+
+    $query = '';
+    if ($parts) {
+        $query = implode('', $parts);
+        $query = str_replace('&', '&', $query); // both & and & are stored in db :-|
+        $parts = explode('&', $query);
+        $eq = urlencode('=');
+        foreach ($parts as $key=>$part) {
+            $part = urlencode(urldecode($part));
+            $part = str_replace($eq, '=', $part);
+            $parts[$key] = $part;
+        }
+        $query = '?'.implode('&', $parts);
+    }
+
+    return $script.$query;
+}
 
 function build_mnet_logs_array($hostid, $course, $user=0, $date=0, $order="l.time ASC", $limitfrom='', $limitnum='',
                    $modname="", $modid=0, $modaction="", $groupid=0) {
@@ -504,10 +532,6 @@ function print_log($course, $user=0, $date=0, $order="l.time ASC", $page=0, $per
         //Filter log->info
         $log->info = format_string($log->info);
 
-        $log->url  = strip_tags(urldecode($log->url));   // Some XSS protection
-        $log->info = strip_tags(urldecode($log->info));  // Some XSS protection
-        $log->url  = s($log->url); /// XSS protection and XHTML compatibility - should be in link_to_popup_window() instead!!
-
         echo '<tr class="r'.$row.'">';
         if ($course->id == SITEID) {
             echo "<td class=\"cell c0\">\n";
@@ -615,10 +639,6 @@ function print_mnet_log($hostid, $course, $user=0, $date=0, $order="l.time ASC",
         //Filter log->info 
         $log->info = format_string($log->info);
 
-        $log->url  = strip_tags(urldecode($log->url));   // Some XSS protection
-        $log->info = strip_tags(urldecode($log->info));  // Some XSS protection
-        $log->url  = str_replace('&', '&amp;', $log->url); /// XHTML compatibility
-
         echo '<tr class="r'.$row.'">';
         if ($course->id == SITEID) {
             echo "<td class=\"r$row c0\" >\n";
@@ -710,10 +730,7 @@ function print_log_csv($course, $user, $date, $order='l.time DESC', $modname,
 
         //Filter log->info
         $log->info = format_string($log->info);
-
-        $log->url  = strip_tags(urldecode($log->url));     // Some XSS protection
         $log->info = strip_tags(urldecode($log->info));    // Some XSS protection
-        $log->url  = str_replace('&', '&amp;', $log->url); // XHTML compatibility
 
         $firstField = $courses[$log->course];
         $fullname = fullname($log, has_capability('moodle/site:viewfullnames', get_context_instance(CONTEXT_COURSE, $course->id)));
@@ -1378,14 +1395,15 @@ function print_section($course, $section, $mods, $modnamesused, $absolute=false,
                 }
 
                 if ($mod->modname == "label") {
+                    echo "<span class=\"";
                     if (!$mod->visible) {
-                        echo "<span class=\"dimmed_text\">";
+                        echo 'dimmed_text';
+                    } else {
+                        echo 'label';
                     }
+                    echo '">';
                     echo format_text($extra, FORMAT_HTML, $labelformatoptions);
-                    if (!$mod->visible) {
-                        echo "</span>";
-                    }
-
+                    echo "</span>"; 
                 } else { // Normal activity
 
                     //Accessibility: for files get description via icon.
@@ -2541,16 +2559,8 @@ function move_courses ($courseids, $categoryid) {
 
                     $course->category  = $categoryid;
                     $course->sortorder = $sortorder;
-                    $course->fullname = addslashes($course->fullname);
-                    $course->shortname = addslashes($course->shortname);
-                    $course->summary = addslashes($course->summary);
-                    $course->password = addslashes($course->password);
-                    $course->teacher = addslashes($course->teacher);
-                    $course->teachers = addslashes($course->teachers);
-                    $course->student = addslashes($course->student);
-                    $course->students = addslashes($course->students);
 
-                    if (!update_record('course', $course)) {
+                    if (!update_record('course', addslashes_recursive($course))) {
                         notify("An error occurred - course not moved!");
                     }
                     // parents changed (course category), do not delete child context relations

course/mod.php

@@ -587,7 +587,7 @@
         $form->mode         = "add";
         $form->sesskey      = !empty($USER->id) ? $USER->sesskey : '';
 
-        $sectionname    = get_string("name$course->format");
+        $sectionname    = get_section_name($course->format);
         $fullmodulename = get_string("modulename", $module->name);
 
         if ($form->section) {
@@ -636,7 +636,7 @@
             $form->type = $type;
         }
 
-        $sectionname    = get_string("name$course->format");
+        $sectionname    = get_section_name($course->format);
         $fullmodulename = get_string("modulename", $module->name);
 
         if ($form->section && $course->format != 'site') {

enrol/flatfile/enrol.php

@@ -238,7 +238,7 @@ function get_access_icons($course) {
    
                         if ($fields[1] == "student") {
 
-                            if ($teachers = get_users_by_capability($context, 'moodle/course:update', 'u.*,ra.hidden', 'sortorder ASC')) {
+                            if ($teachers = get_users_by_capability($context, 'moodle/course:update', 'u.*,ra.hidden', 'ra.sortorder ASC')) {
                                 foreach ($teachers as $u) {
                                     if (!$u->hidden || has_capability('moodle/role:viewhiddenassigns', $context)) {
                                         $teacher = $u;

enrol/mnet/enrol.php

@@ -287,6 +287,7 @@ class enrolment_plugin_mnet {
             $returnarray[$user->username] = array('enrol' => $user->enrol, 
                                                   'timemodified' => $user->timemodified, 
                                                   'shortname' => $user->shortname, 
+                                                  'username' => $user->username,
                                                   'name' => $user->name);
         }
         return $returnarray;

enrol/paypal/ipn.php

@@ -98,6 +98,13 @@
                 die;
             }
 
+            // If currency is incorrectly set then someone maybe trying to cheat the system 
+
+            if ($data->mc_currency != $course->currency) {
+                email_paypal_error_to_admin("Currency does not match course settings, received: ".addslashes($data->mc_currency), $data);
+                die;
+            }
+
             // If status is pending and reason is other than echeck then we are on hold until further notice
             // Email user to let them know. Email admin.
 

filter/activitynames/filter.php

@@ -41,13 +41,15 @@
                     //Exclude labels and hidden items
                     if ($activity->mod != "label" && $activity->visible) {
                         $title = trim(strip_tags(urldecode($activity->name)));
+                        $currentname = trim(urldecode($activity->name));
+                        $entitisedname  = s($currentname);
                         /// Avoid empty or unlinkable activity names
                         if (!empty($title)) {
                             $title = str_replace('"', "'", $title);
                             $href_tag_begin = "<a class=\"autolink\" title=\"$title\" href=\"$CFG->wwwroot/mod/$activity->mod/view.php?id=$activity->cm\" $CFG->frametarget>";
-                            $currentname = urldecode($activity->name);
-                            if ($currentname = trim($currentname)) {
-                                $activitylist[] = new filterobject($currentname, $href_tag_begin, '</a>', false, true);
+                            $activitylist[] = new filterobject($currentname, $href_tag_begin, '</a>', false, true);
+                            if ($currentname != $entitisedname) { /// If name has some entity (&amp; &quot; &lt; &gt;) add that filter too. MDL-17545
+                                $activitylist[] = new filterobject($entitisedname, $href_tag_begin, '</a>', false, true);
                             }
                         }
                     }

filter/algebra/algebradebug.php

@@ -16,6 +16,8 @@
         }
     }
 
+    require_once($CFG->dirroot.'/filter/tex/lib.php');
+
     $CFG->texfilterdir = "filter/tex";
     $CFG->algebrafilterdir = "filter/algebra";
     $CFG->algebraimagedir = "filter/algebra";
@@ -23,6 +25,8 @@
       $CFG->algebrafilterdirwin = "filter\\algebra";
     }
 
+    require_login();
+    require_capability('moodle/site:config', get_context_instance(CONTEXT_SYSTEM));
 
     $query = urldecode($_SERVER['QUERY_STRING']);
     error_reporting(E_ALL);
@@ -233,6 +237,7 @@ function tex2image($texexp, $md5, $return=false) {
         } 
         $commandpath = "";
         $cmd = "";
+        $texexp = tex_sanitize_formula($texexp);
         $texexp = escapeshellarg($texexp);
         switch (PHP_OS) {
             case "Linux":

filter/algebra/pix.php

@@ -19,6 +19,7 @@
     // disable moodle specific debug messages
     disable_debugging();
 
+    require_once($CFG->dirroot.'/filter/tex/lib.php');
     require_once($CFG->libdir.'/filelib.php');
 
     $CFG->texfilterdir     = 'filter/tex';
@@ -54,6 +55,7 @@
             $texexp = str_replace('>','>',$texexp);
             $texexp = preg_replace('!\r\n?!',' ',$texexp);
             $texexp = '\Large ' . $texexp;
+            $texexp = tex_sanitize_formula($texexp);
             $texexp = escapeshellarg($texexp);
 
             if ((PHP_OS == "WINNT") || (PHP_OS == "WIN32") || (PHP_OS == "Windows")) {

filter/mediaplugin/flvplayer.README.txt

@@ -1,4 +1,4 @@
 The FLV player is by Jeroen Wijering - www.jeroenwijering.com 
-and included in Moodle by his permission under the GPL.
+and included in Moodle by his permission under the GNU GPL version 2 or later.
 
 Thanks, Jeroen!

filter/tex/README.mimetex

@@ -1,10 +1,10 @@
 
  --------------------------------------------------------------------------
- January 11, 2004                                              Version 1.40
+ September 6, 2008                                             Version 1.70
 
                   m i m e T e X   R e a d m e   F i l e
 
- Copyright(c) 2002-2004, John Forkosh Associates, Inc. All rights reserved.
+ Copyright(c) 2002-2008, John Forkosh Associates, Inc. All rights reserved.
  --------------------------------------------------------------------------
 
                             by: John Forkosh
@@ -12,17 +12,21 @@
 
           This file is part of mimeTeX, which is free software.
           You may redistribute and/or modify it under the terms
-          of the GNU General Public License, version 2 or later,
+          of the GNU General Public License, version 3 or later,
           as published by the Free Software Foundation. See
                    http://www.gnu.org/licenses/gpl.html
 
-          Follow the Quick Start instructions immediately below
-          or the detailed instructions in Section III to install
-          mimeTeX on your machine, and then point your browser to
-                  http://www.yourdomain.com/mimetex.html
-          for a complete discussion, including demo/tutorial and
-          reference.  Installation problems?  Point your browser
-          to my page at
+          MimeTeX is discussed and illustrated online at
+          its homepage
+                    http://www.forkosh.com/mimetex.html
+          Or you can follow the Quick Start instructions below
+          (or the more detailed instructions in Section III)
+          to immediately install mimeTeX on your own machine.
+          Then point your browser to
+                    http://www.yourdomain.com/mimetex.html
+          for a demo/tutorial and reference.
+               Installation problems?  Point your browser to
+          mimeTeX's homepage
                     http://www.forkosh.com/mimetex.html
           then click its "full mimeTeX manual" link and see
           Section II.
@@ -31,57 +35,63 @@
 I.  QUICK START
 ------------------------------------------------------------------------
   To compile and install mimeTeX
-       o unzip mimetex.zip in any convenient working directory
-       o to produce an executable that emits anti-aliased gif images
+       * unzip mimetex.zip in any convenient working directory
+       * to produce an executable that emits anti-aliased
+         gif images (recommended)
               cc -DAA mimetex.c gifsave.c -lm -o mimetex.cgi
          -or- for gif images without anti-aliasing
               cc -DGIF mimetex.c gifsave.c -lm -o mimetex.cgi
          -or- to produce an executable that emits mime xbitmaps
               cc -DXBITMAP mimetex.c -lm -o mimetex.cgi
-       o mv mimetex.cgi  to your server's cgi-bin/ directory
-       o mv mimetex.html to your server's htdocs/  directory
-       o if the relative path from htdocs to cgi-bin isn't
+         (For Windows, see "Compile Notes" in Section III below.)
+       * mv mimetex.cgi  to your server's cgi-bin/ directory
+       * mv mimetex.html to your server's htdocs/  directory
+       * if the relative path from htdocs to cgi-bin isn't
          ../cgi-bin then edit mimetex.html and change the
-         few dozen occurrences as necessary
-  To quickly learn about mimeTeX
-       o point your browser to www.yourdomain.com/mimetex.html
+         few dozen occurrences as necessary.
+  Then, to quickly learn more about mimeTeX
+       * point your browser to www.yourdomain.com/mimetex.html
   Any problems with the above?
-       o read the more detailed instructions in Section III below,
-         or see www.forkosh.com/mimetex.html
+       * read the more detailed instructions below,
+         or see http://www.forkosh.com/mimetex.html
 
 
 II.  INTRODUCTION
 ------------------------------------------------------------------------
-  MimeTeX is licensed under the gpl.  It parses LaTeX math expressions,
-  emitting either gif images or mime xbitmaps of them, rather than the
-  usual TeX dvi's.  And mimeTeX is an entirely separate little program
-  that doesn't use TeX in any way.  Therefore, mimeTeX images are easily
-  inserted directly into html documents using a standard html <img> tag,
-       <img src="../cgi-bin/mimetex.cgi?f(x)=\int_{-\infty}^x~e^{-t^2}dt"
-        border=0 align=absmiddle>
-  without intermediate dvi-to-gif conversion, and without storing lots
-  of little gif image files, one file for each converted expression.
-  This makes your web site and html documents more easily maintained.
-
-  Thus, mimeTeX is primarily intended to help you write native html
-  documents containing math.  In this sense it's a kind of "lightweight"
-  alternative to MathML, with the advantage that mimeTeX preserves LaTeX
-  syntax, and works with any browser and server.
+  MimeTeX, licensed under the gpl, lets you easily embed LaTeX math in
+  your html pages.  It parses a LaTeX math expression and immediately
+  emits the corresponding gif image, rather than the usual TeX dvi.
+       And mimeTeX is an entirely separate little program that doesn't
+  use TeX or its fonts in any way.  It's just one cgi that you put in
+  your site's cgi-bin/ directory, with no other dependencies.
+  So mimeTeX is very easy to install.  And it's equally easy to use.
+  Just place an html <img> tag in your document wherever you want to
+  see the corresponding LaTeX expression.  For example,
+    <img src="../cgi-bin/mimetex.cgi?f(x)=\int_{-\infty}^x~e^{-t^2}dt"
+     border=0 align=absmiddle>
+  generates and displays the corresponding gif image on-the-fly,
+  wherever you put that <img> tag.  MimeTeX doesn't need intermediate
+  dvi-to-gif conversion, and it doesn't clutter your filesystem with
+  separate little gif files for each converted expression.  (Optional
+  image caching does store gif files, and subsequently reads them as
+  needed, rather than re-rendering the same images every time a page
+  is reloaded.)
 
 
 III.  COMPILATION AND INSTALLATION
 ------------------------------------------------------------------------
-  I've comnpiled and run mimeTeX under Linux and NetBSD using gcc.
-  The source code is entirely ansi-standard C, and should compile
+  I've built and run mimeTeX under Linux and NetBSD using gcc.
+  The source code is ansi-standard C, and should compile
   and execute under all environments without any change whatsoever.
-  Build instructions below are for Unix.  Modify them as necessary
-  for your particular situation.
+  Build instructions below are for Unix. Modify them as necessary
+  for your particular situation.  Note the -DWINDOWS switch if
+  applicable.
 
   Unzip mimetex.zip in any convenient working directory.
-  You should now have files
+  Your working directory should now contain
        mimetex.zip    your gnu zipped mimeTeX distribution containing...
        README         this file (see mimetex.html for demo/tutorial)
-       LICENSE        GPL license, under which you may use mimeTeX
+       COPYING        GPL license, under which you may use mimeTeX
        mimetex.c      mimeTeX source program and all required functions
        mimetex.h      header file for mimetex.c (and for gfuntype.c)
        gfuntype.c     parses output from  gftype -i  and writes bitmap data
@@ -93,32 +103,35 @@ III.  COMPILATION AND INSTALLATION
   Conversion for Windows, Macs, VMS, etc, can usually be accomplished
   with unzip's -a option, i.e.,  unzip -a mimetex.zip
 
-  Now, to produce an executable that emits anti-aliased gif images
-       (which is how the "official" www.forkosh.com/mimetex.html page
-       is displayed), compile mimetex with the command
-          cc -DAA mimetex.c gifsave.c -lm -o mimetex.cgi
+  Now, to compile a mimeTeX executable that emits anti-aliased gif
+  images (recommended for most uses), type the command
+            cc -DAA mimetex.c gifsave.c -lm -o mimetex.cgi
 
-       Or, to produce an executable that emits gif images
-       without anti-aliasing, compile mimetex with the command
-          cc -DGIF mimetex.c gifsave.c -lm -o mimetex.cgi
+  Or, for an executable that emits gif images without
+  anti-aliasing,
+            cc -DGIF mimetex.c gifsave.c -lm -o mimetex.cgi
 
-       Alternatively, for an executable that emits mime xbitmaps,
-       just compile mimetex with the command
-          cc -DXBITMAP mimetex.c -lm -o mimetex.cgi
+  Alternatively, to compile a mimeTeX executable that emits
+  mime xbitmaps, just type the command
+            cc -DXBITMAP mimetex.c -lm -o mimetex.cgi
 
-       Several additional command-line options that you may find
-       useful are discussed in Section IIc (href="#options")
-       of mimetex.html .
+  Compile Notes:
+     * If (and only if) you're compiling a Windows executable
+       with the -DAA or -DGIF option (but not -DXBITMAP), then
+       add -DWINDOWS also.  For example,
+            cc -DAA -DWINDOWS mimetex.c gifsave.c -lm -o mimetex.cgi
+       The above Unix-like syntax works with MinGW (http://www.mingw.org)
+       and djgpp (http://www.delorie.com/djgpp/) Windows compilers, but
+       probably not with most others, where it's only intended as a
+       "template".
+     * Several additional command-line options that you may find
+       useful are discussed in Section IId (href="#options")
+       of your mimetex.html page.
 
-  That's all there is to building mimeTeX.  You can now test mimetex.cgi
-  from the Unix command line by typing, e.g.,
-       ./mimetex.cgi x^2+y^2
-  which should emit an ascii raster something like the left-hand
-  illustration.  And if you've compiled mimeTeX with the anti-aliasing
-  -DAA option, then you'll also see the right-hand illustration.
-  It shows asterisks in the same positions as the left-hand illustration,
-  and anti-aliased grayscale colormap indexes assigned to neighboring
-  pixels.  And you'll also be shown the actual rgb value for each index.
+  That's all there is to building mimeTeX.  You can now test your
+  mimetex.cgi executable from the Unix command line by typing, e.g.,
+       ./mimetex.cgi "x^2+y^2"
+  which should emit two ascii rasters something like the following
     Ascii dump of bitmap image...     Hex dump of colormap indexes...
     ........**..................**..  .......1**1................1**1.
     .......*..*.....*..........*..*.  .......*23*.....*..........*23*.
@@ -132,34 +145,50 @@ III.  COMPILATION AND INSTALLATION
     ................*....**.........  ................*....**1........
                                   The 5 colormap indexes denote rgb...
                                  .-->255 1-->196 2-->186 3-->177 *-->0
-  If you get much fancier than x^2+y^2, remember that many characters have
-  to be escaped from the Unix command line, e.g., x\<y or f\(x\)=x^2, etc.
-  Of course, you won't need these extra escapes when running mimetex from
-  a browser.
+  The right-hand illustration shows asterisks in the same positions as
+  the left-hand one, along with anti-aliased grayscale colormap indexes
+  assigned to neighboring pixels, and with the rgb value for each
+  index.  Just typing ./mimetex.cgi without an argument should produce
+  ascii rasters for the default expression f(x)=x^2.  If you see the
+  two ascii rasters then your binary's good, so mv it to your server's
+  cgi-bin/ directory and set permissions as necessary.
 
-  Once mimetex.cgi is working (and you're done playing with it),
-  mv it to your server's cgi-bin/ directory, where cgi programs
-  are expected (and chmod/chown it if necessary).  Then mv
-  mimetex.html to your server's htdocs/ directory.  Now point
-  your browser to www.yourdomain.com/mimetex.html , and it should
-  be rendered exactly like my page at www.forkosh.com/mimetex.html .
-       One "gotcha":  the two directories are typically of the form
-  somewhere/www/cgi-bin/ and somewhere/www/htdocs/ ,  so I set up
-  mimtex.html to get mimetex.cgi from the relative path ../cgi-bin/ .
-  If your directories are non-conforming, you may have to edit the
-  few dozen occurrences of ../cgi-bin/mimetex.cgi in mimetex.html
-  (globally changing ../cgi-bin/mimetex.cgi should work).
-  Sometimes a suitable symlink works; if not, you'll have to edit.
+  Once mimetex.cgi is working, mv it to your server's cgi-bin/ directory
+  (wherever cgi programs are expected), and chmod/chown it as necessary.
+  Then mv mimetex.html to your server's htdocs/ directory.  Now point
+  your browser to www.yourdomain.com/mimetex.html and you should see
+  your mimeTeX user's manual reference page.
 
-  Either way, once mimetex.html displays properly, and you've reviewed
-  the tutorial it contains, you can begin writing html documents using
-  mimetex.cgi to render your math.
+  Install Notes:
+     * These two directories are typically of the form
+       somewhere/www/cgi-bin/  and  somewhere/www/htdocs/
+       so I set up mimtex.html to access mimetex.cgi from
+       the relative path ../cgi-bin/   If your directories
+       are non-conforming, you may have to edit the few dozen
+       occurrences of ../cgi-bin/mimetex.cgi in mimetex.html
+       Sometimes a suitable symlink works.  If not, you'll
+       have to edit.  In that case, globally changing
+       ../cgi-bin/mimetex.cgi  often works.
+     * Either way, once mimetex.html displays properly, you can
+       assume everything is working, and can begin authoring html
+       documents using mimetex.cgi to render your own math.
 
 
 IV.  REVISION HISTORY
 ------------------------------------------------------------------------
-  01/11/04  J.Forkosh      version 1.40 beta released on www.forkosh.com
-                           LaTeX compatibility and various new features
+  A more detailed account of mimeTeX's revision history
+  is maintained at  http://www.forkosh.com/mimetexchangelog.html
+  ---
+  09/06/08  J.Forkosh      version 1.70 released.
+  11/30/04  J.Forkosh      version 1.60 released
+  10/02/04  J.Forkosh      version 1.50 released on CTAN with various new
+                           features and fixes, and updated documentation.
+  07/18/04  J.Forkosh      version 1.40 re-released on CTAN with minor
+                           changes, e.g., \mathbb font and nested \array's
+                           now supported.
+  03/21/04  J.Forkosh      version 1.40 released on CTAN, with improved
+                           LaTeX compatibility, various new features and
+                           fixes, including fix to work under Windows.
   12/21/03  J.Forkosh      version 1.30 released on CTAN, with improved
                            LaTeX compatibility and anti-aliasing, various new
                            features, and thoroughly updated documentation.
@@ -183,9 +212,5 @@ V.  CONCLUDING REMARKS
   I hope you find mimeTeX useful.  If so, a contribution to your
   country's TeX Users Group, or to the GNU project, is suggested,
   especially if you're a company that's currently profitable.
-  
-  If you also like mimeTeX's source, I'm an independent contractor
-  incorporated in the US as John Forkosh Associates, Inc.  A resume
-  is at www.forkosh.com or email john@forkosh.com
 ========================= END-OF-FILE README ===========================
 

filter/tex/latex.php

@@ -44,9 +44,11 @@
          * @return string the latex document
          */
         function construct_latex_document( $formula, $fontsize=12 ) {
-            // $fontsize don't affects to formula's size. $density can change size
-
             global $CFG;
+
+            $formula = tex_sanitize_formula($formula);
+
+            // $fontsize don't affects to formula's size. $density can change size
             $doc =  "\\documentclass[{$fontsize}pt]{article}\n"; 
             $doc .=  $CFG->filter_tex_latexpreamble;
             $doc .= "\\pagestyle{empty}\n";

filter/tex/lib.php

@@ -0,0 +1,40 @@
+<?php  //$Id$
+
+function tex_sanitize_formula($texexp) {
+    /// Check $texexp against blacklist (whitelisting could be more complete but also harder to maintain)
+    $tex_blacklist = array(
+        'include','command','loop','repeat','open','toks','output',
+        'input','catcode','name','^^',
+        '\def','\edef','\gdef','\xdef',
+        '\every','\errhelp','\errorstopmode','\scrollmode','\nonstopmode',
+        '\batchmode','\read','\write','csname','\newhelp','\uppercase',
+        '\lowercase','\relax','\aftergroup',
+        '\afterassignment','\expandafter','\noexpand','\special',
+        '\let', '\futurelet','\else','\fi','\chardef','\makeatletter','\afterground',
+        '\noexpand','\line','\mathcode','\item','\section','\mbox','\declarerobustcommand'
+    );
+
+    return  str_ireplace($tex_blacklist, 'forbiddenkeyword', $texexp);
+}
+
+/**
+ * Purge all caches when settings changed.
+ */
+function filter_tex_updatedcallback($name) {
+    global $CFG;
+
+    if (file_exists("$CFG->dataroot/filter/tex")) {
+        remove_dir("$CFG->dataroot/filter/tex");
+    }
+    if (file_exists("$CFG->dataroot/filter/algebra")) {
+        remove_dir("$CFG->dataroot/filter/algebra");
+    }
+    if (file_exists("$CFG->dataroot/temp/latex")) {
+        remove_dir("$CFG->dataroot/temp/latex");
+    }
+
+    delete_records('cache_filters', 'filter', 'tex');
+    delete_records('cache_filters', 'filter', 'algebra');
+}
+
+?>

filter/tex/pix.php

@@ -20,8 +20,9 @@
     disable_debugging();
 
     require_once($CFG->libdir.'/filelib.php');
+    require_once($CFG->dirroot.'/filter/tex/lib.php');
+    require_once($CFG->dirroot.'/filter/tex/latex.php');
     require_once('defaultsettings.php' );
-    require_once('latex.php');
 
     $CFG->texfilterdir = 'filter/tex';
     $CFG->teximagedir  = 'filter/tex';
@@ -69,6 +70,7 @@
                 $texexp = str_replace('>','>',$texexp);
                 $texexp = preg_replace('!\r\n?!',' ',$texexp);
                 $texexp = '\Large ' . $texexp;
+                $texexp = tex_sanitize_formula($texexp);
                 $texexp = escapeshellarg($texexp);
 
                 if ((PHP_OS == "WINNT") || (PHP_OS == "WIN32") || (PHP_OS == "Windows")) {

filter/tex/readme_moodle.txt

@@ -0,0 +1,25 @@
+Description of mimeTeX v 1.70 import into Moodle
+
+Compiling mimeTeX:
+
+===Windows===
+1/ get "Automated MinGW Installer" from https://sourceforge.net/projects/mingw/files/
+2/ install mingw
+3/ go into directory with extracted source files
+4/ execute "c:\mingw\bin\gcc -DAA -DWINDOWS mimetex.c gifsave.c -lm -o mimetex.exe"
+
+===Linux===
+1/ install gcc
+2/ go into directory with extracted source files
+3/ execute "cc -DAA mimetex.c gifsave.c -lm -o mimetex.linux"
+
+===FreeBSD===
+1/ go into directory with extracted source files
+2/ execute "cc -DAA mimetex.c gifsave.c -lm -o mimetex.freebsd"
+
+===Apple OSX===
+1/ install gcc
+2/ go into directory with extracted source files
+3/ execute "cc -DAA mimetex.c gifsave.c -lm -o mimetex.darwin"
+
+skodak

filter/tex/texdebug.php

@@ -1,12 +1,9 @@
-<?PHP // $Id$
+<?php // $Id$
       // This function fetches math. images from the data directory
       // If not, it obtains the corresponding TeX expression from the cache_tex db table
       // and uses mimeTeX to create the image file
 
-    $nomoodlecookie = true;     // Because it interferes with caching
-
     require_once("../../config.php");
-    require( 'latex.php' );
 
     if (empty($CFG->textfilters)) {
         error ('Filter not enabled!');
@@ -17,6 +14,9 @@
         }
     }
 
+    require_once($CFG->dirroot.'/filter/tex/lib.php');
+    require_once($CFG->dirroot.'/filter/tex/latex.php');
+
     $CFG->texfilterdir = "filter/tex";
     $CFG->teximagedir = "filter/tex";
  
@@ -24,6 +24,9 @@
     $param->action = optional_param( 'action','',PARAM_ALPHA );
     $param->tex = optional_param( 'tex','' );
 
+    require_login();
+    require_capability('moodle/site:config', get_context_instance(CONTEXT_SYSTEM), $USER->id); /// Required cap to run this. MDL-18552
+
     $query = urldecode($_SERVER['QUERY_STRING']);
     error_reporting(E_ALL);
     $output = '';
@@ -140,6 +143,7 @@
             }
             $commandpath = "";
             $cmd = "";
+            $texexp = tex_sanitize_formula($texexp);
             $texexp = escapeshellarg($texexp);
             switch (PHP_OS) {
                 case "Linux":

filter/tex/texed.php

@@ -6,6 +6,7 @@
     $nomoodlecookie = true;     // Because it interferes with caching
 
     require_once("../../config.php");
+    require_once($CFG->dirroot.'/filter/tex/lib.php');
 
     if (empty($CFG->textfilters)) {
         error ('Filter not enabled!');
@@ -32,6 +33,7 @@
             make_upload_directory($CFG->teximagedir);
         }
         $pathname = "$CFG->dataroot/$CFG->teximagedir/$image";
+        $texexp = tex_sanitize_formula($texexp);
         $texexp = escapeshellarg($texexp);
 
         switch (PHP_OS) {

grade/lib.php

@@ -238,7 +238,7 @@ function grade_get_formatted_grades() {
                                 }
                                 $all_categories["$cur_category"]["$instance->name"]['grade_against'] = $all_categories["$cur_category"]["$instance->name"]['scaled_max'];
                                 if (!isset($all_categories["$cur_category"]['stats']['weight'])) {
-                                    $weight = grade_get_category_weight($course->id, $cur_category);        
+                                    $weight = grade_get_category_weight($course->id, addslashes($cur_category));
                                     $all_categories["$cur_category"]['stats']['weight'] = $weight->weight;
                                 }
         
@@ -248,7 +248,7 @@ function grade_get_formatted_grades() {
                                 $all_categories["$cur_category"]["$instance->name"]['modname'] = $modname->name;
         
                                 // get bonus points and drop the x lowest                            
-                                $drop = get_record('grade_category', 'courseid', $course->id, 'name', $cur_category);
+                                $drop = get_record('grade_category', 'courseid', $course->id, 'name', addslashes($cur_category));
                                 $all_categories["$cur_category"]['stats']['drop'] = $drop->drop_x_lowest;
                                 $all_categories["$cur_category"]['stats']['bonus_points'] = $drop->bonus_points;
                             }
@@ -2324,7 +2324,7 @@ function grade_set_grade_weights() {
             $submitted_category = optional_param($form_catname);    
             if (is_numeric($submitted_category)) {
                 // see if there is a weight if so see if it needs to be updated
-                $weight = grade_get_category_weight($course->id, $category->name);
+                $weight = grade_get_category_weight($course->id, addslashes($category->name));
                 if ($weight) {
                     if ($weight->weight != $submitted_category)
                     {                        

group/index.php

@@ -11,6 +11,7 @@
 require_once('../config.php');
 require_once('lib.php');
 require_once($CFG->libdir.'/moodlelib.php');
+ini_set('include_path', $CFG->libdir.'/pear'.PATH_SEPARATOR.ini_get('include_path'));
 require_once('HTML/AJAX/JSON.php');
 
 require_js('yui_yahoo');

index.php

@@ -103,7 +103,7 @@
                                             BLOCK_R_MAX_WIDTH);
 
     print_header($SITE->fullname, $SITE->fullname, 'home', '',
-                 '<meta name="description" content="'. s(strip_tags($SITE->summary)) .'" />',
+                 '<meta name="description" content="'. strip_tags(format_text($SITE->summary, FORMAT_HTML)) .'" />',
                  true, '', user_login_string($SITE).$langmenu);
 
 ?>

install.php

@@ -427,7 +427,8 @@ if ($INSTALL['stage'] == ENVIRONMENT) {
     $dbconnected = $db->Connect($INSTALL['dbhost'],$INSTALL['dbuser'],$INSTALL['dbpass'],$INSTALL['dbname']);
     error_reporting(7);  // Show errors
     if ($dbconnected) {
-    /// Execute environment check, printing results
+    /// Execute environment check, not printing results
+        @remove_dir($INSTALL['dataroot'] . '/environment'); /// Always delete downloaded env. info to force use of the released one. MDL-9796
         if (!check_moodle_environment($INSTALL['release'], $environment_results, false)) {
              $nextstage = ENVIRONMENT;
         }
@@ -714,6 +715,8 @@ if ($nextstage == SAVE) {
 function form_table($nextstage = WELCOME, $formaction = "install.php") {
     global $INSTALL, $db;
 
+    $enablenext = true;
+
     /// Print the standard form if we aren't in the DOWNLOADLANG page
     /// because it has its own form.
     if ($nextstage != DOWNLOADLANG) {
@@ -748,12 +751,16 @@ function form_table($nextstage = WELCOME, $formaction = "install.php") {
 
             /// Check that PHP is of a sufficient version
             print_compatibility_row(inst_check_php_version(), get_string('phpversion', 'install'), get_string('phpversionerror', 'install'), 'phpversionhelp');
+            $enablenext = $enablenext && inst_check_php_version();
             /// Check session auto start
             print_compatibility_row(!ini_get_bool('session.auto_start'), get_string('sessionautostart', 'install'), get_string('sessionautostarterror', 'install'), 'sessionautostarthelp');
+            $enablenext = $enablenext && !ini_get_bool('session.auto_start');
             /// Check magic quotes
             print_compatibility_row(!ini_get_bool('magic_quotes_runtime'), get_string('magicquotesruntime', 'install'), get_string('magicquotesruntimeerror', 'install'), 'magicquotesruntimehelp');
+            $enablenext = $enablenext && !ini_get_bool('magic_quotes_runtime');
             /// Check unsupported PHP configuration
-            print_compatibility_row(ini_get_bool('magic_quotes_gpc') || (!ini_get_bool('register_globals')), get_string('globalsquotes', 'install'), get_string('globalsquoteserror', 'install'), 'globalsquoteshelp');
+            print_compatibility_row(!ini_get_bool('register_globals'), get_string('globalsquotes', 'install'), get_string('globalswarning', 'install'));
+            $enablenext = $enablenext && !ini_get_bool('register_globals');
             /// Check safe mode
             print_compatibility_row(!ini_get_bool('safe_mode'), get_string('safemode', 'install'), get_string('safemodeerror', 'install'), 'safemodehelp', true);
             /// Check file uploads
@@ -861,6 +868,7 @@ function form_table($nextstage = WELCOME, $formaction = "install.php") {
                     error_reporting(7);  // Show errors
                     if ($dbconnected) {
                     /// Execute environment check, printing results
+                        @remove_dir($INSTALL['dataroot'] . '/environment'); /// Always delete downloaded env. info to force use of the released one. MDL-9796
                         check_moodle_environment($INSTALL['release'], $environment_results, true);
                     } else {
                     /// We never should reach this because DB has been tested before arriving here
@@ -925,9 +933,11 @@ function form_table($nextstage = WELCOME, $formaction = "install.php") {
             <input type="hidden" name="stage" value="<?php echo $nextstage ?>" />
 <?php
     }
+
+    $disabled = $enablenext ? '' : 'disabled="disabled"';
 ?>
 
-            <?php echo ($nextstage < SAVE) ? "<input type=\"submit\" name=\"next\" value=\"".get_string('next')."  &raquo;\" style=\"float: ".fix_align_rtl("right")."\"/>\n" : "&nbsp;\n" ?>
+            <?php echo ($nextstage < SAVE) ? "<input $disabled type=\"submit\" name=\"next\" value=\"".get_string('next')."  &raquo;\" style=\"float: ".fix_align_rtl("right")."\"/>\n" : "&nbsp;\n" ?>
             <?php echo ($nextstage > WELCOME) ? "<input type=\"submit\" name=\"prev\" value=\"&laquo;  ".get_string('previous')."\" style=\"float: ".fix_align_rtl("left")."\"/>\n" : "&nbsp;\n" ?>
 
 <?php
@@ -971,7 +981,9 @@ function print_compatibility_row($success, $testtext, $errormessage, $helpfield=
         echo "</p></td>\n";
         echo "<td valign=\"top\">";
         echo "<p>$errormessage ";
-        install_helpbutton("install.php?help=$helpfield");
+        if ($helpfield !== '') {
+            install_helpbutton("install.php?help=$helpfield");
+        }
         echo "</p></td>\n";
     }
     echo "</tr>\n";

install/lang/af_utf8/installer.php

@@ -11,10 +11,8 @@
 
 $string['closewindow'] = 'Maak die venster toe';
 $string['continue'] = 'Gaan voort';
-$string['doyouagree'] = 'Het jy die voorwaardes gelees en verstaan jy dit?';
 $string['error'] = 'Fout';
 $string['help'] = 'Help';
-$string['invalidemail'] = 'Ongeldige email adres';
 $string['language'] = 'Taal';
 $string['name'] = 'Naam';
 $string['next'] = 'Volgende';

install/lang/ar_utf8/installer.php

@@ -12,7 +12,6 @@
 $string['admindirerror'] = 'مجلد الإدارة المحدد غير صحيح';
 $string['admindirname'] = 'مجلد الإدارة';
 $string['admindirsettinghead'] = 'أعداد دليل المدير';
-$string['availablelangs'] = 'حزم اللغة المتوفره';
 $string['bypassed'] = 'مرور';
 $string['cannotcreatelangdir'] = 'لم يتم أنشاء دليل اللغة';
 $string['cannotcreatetempdir'] = 'لم يتم أنشاء الدليل المؤقت';
@@ -24,13 +23,10 @@ $string['cannotsavezipfile'] = 'لم يتم حفظ الملف المضغوط';
 $string['cannotunzipfile'] = 'لم يتم فك الملف المضغوط';
 $string['caution'] = 'تحذير';
 $string['check'] = 'أختر';
-$string['chooselanguage'] = 'اختر اللغة';
 $string['chooselanguagehead'] = 'اختر اللغة';
 $string['closewindow'] = 'أغلق هذه النافذة';
-$string['compatibilitysettings'] = 'أفحص إعدادات الـ PHP';
 $string['compatibilitysettingshead'] = 'أفحص إعدادات الـ PHP';
 $string['configfilewritten'] = 'تم انشاء ملف config.php بنجاح';
-$string['configurationcomplete'] = 'تمت عملية الإعداد';
 $string['configurationcompletehead'] = 'تمت عملية الإعداد';
 $string['continue'] = 'استمر';
 $string['database'] = 'قاعدة بيانات';
@@ -39,14 +35,12 @@ $string['datarooterror'] = 'إعداد المعلومات غير صحيح';
 $string['dbconnectionerror'] = 'لم يتم التوصيل بقاعدة البيانات المحددة. تأكد من إعدادات قاعدة البيانات.';
 $string['dbcreationerror'] = 'خطاء في إنشاء قاعدة البيانات. لم يم انشاء قاعدة البيانات المسماه في الأعدادات المعطاه.';
 $string['dbhost'] = 'الخادم المضيف';
-$string['dbpass'] = 'كلمة مرور';
 $string['dbprefix'] = 'مقدمة الجداول';
 $string['dbtype'] = 'نوع';
 $string['dirroot'] = 'دليل مودل';
 $string['dirrooterror'] = 'إعدادّّّ\"المجلد\" غير صحيح. حاول إعادة الإعداد';
 $string['download'] = 'تنزيل';
 $string['downloadlanguagehead'] = 'تنزيل حزمة اللغة';
-$string['doyouagree'] = 'هل قمت بقراءة هذه الشروط واستيعابها؟';
 $string['environmenterrortodo'] = 'يجب عليك تصحيح كل المشاكل (الأخطاء) الموضحه أعلاه قبل الأستمرار في ثتبيت هذا الأصدار لموّدل';
 $string['environmenthead'] = 'يتم فحص البيئة';
 $string['environmentrecommendinstall'] = 'ينصح بتثبيته/تمكينه';
@@ -63,7 +57,6 @@ $string['help'] = 'مساعدة';
 $string['iconvrecommended'] = 'ينصح بشدة تثبيت مكتبة ICONV الاختيارية وذلك لتحسين أداء موقعك خصوصا لو كنت تستخدم لغات غير لاتينيه.';
 $string['info'] = 'معلومات';
 $string['installation'] = 'تثبيت';
-$string['invalidemail'] = 'عنوان البريد الإلكتروني غير صحيح';
 $string['language'] = 'اللغة';
 $string['magicquotesruntimeerror'] = 'هذا يجب ان يكون معطل';
 $string['mbstringrecommended'] = 'يفضل وبشدة تثبيت مكتبة (MBSTRING) الاختيارية وذلك لتسحين اداء الموقع وبذات لوكان موقعك يدعم لغات غير لاتينية.';

install/lang/be_utf8/installer.php

@@ -11,32 +11,23 @@
 
 $string['admindirerror'] = 'Абраны каталог адміністратара няслушны';
 $string['admindirname'] = 'Каталог адміністратара';
-$string['admindirsetting'] = 'Толькі некаторыя web-сайты выкарыстоўваюць /admin як спецыяльны адрас для доступу да панелі кіравання ці іншага. На жаль, ён канфліктуе з стандартным змяшчэннем старонак адміністравання Moodle. Вы можаце адрэдагаваць гэтую памылку, пераназваў папку admin ў вашай інсталяцыі і пазначыў яе імя тут. Напрыклад:
-<br /> <br /><b>moodleadmin</b><br /> <br />
-Будзе правільная настроўваць спасылкі на admin ў Moodle.';
 $string['caution'] = 'Папярэджанне';
-$string['chooselanguage'] = 'Выбярыце мову';
 $string['closewindow'] = 'Згарнуць вакно';
-$string['compatibilitysettings'] = 'Праверка настроек PHP...';
 $string['configfilenotwritten'] = 'Скрыпт ўстаноўкі не змог аўтаматычна стварыць файл config.php, які ўтрымлівае Вамі абраныя настроўкі, па прычыне, што нельга пісаць у папку з устаноўкай Moodle. Вы можаце ўручную скапіяваць наступны код ў файл з назвай config.php і змясць яго ў карнявую папку ўстаноўкі Moodle.';
 $string['configfilewritten'] = 'config.php быў паспяхова створаны';
-$string['configurationcomplete'] = 'Настройка завершаная';
 $string['continue'] = 'Працягнуць';
 $string['database'] = 'База Дадзеных';
 $string['dataroot'] = 'Каталог дадзеных';
 $string['dbhost'] = 'Хост сэрвера';
-$string['dbpass'] = 'Пароль';
 $string['dbprefix'] = 'Прэфікс табліцаў';
 $string['dbtype'] = 'Тып';
 $string['dirroot'] = 'Каталог Moodle';
 $string['download'] = 'Загрузіць';
-$string['doyouagree'] = 'Ці прачыталі Вы ўмовы?';
 $string['error'] = 'Памылка';
 $string['fail'] = 'Памылка';
 $string['gdversion'] = 'GD версія';
 $string['help'] = 'Дапамога';
 $string['installation'] = 'Ладаванне';
-$string['invalidemail'] = 'Няправільны фармат для e-mail';
 $string['language'] = 'Мова';
 $string['memorylimit'] = 'Мяжа памяці';
 $string['name'] = 'Назва';

install/lang/bg_utf8/installer.php

@@ -11,11 +11,9 @@
 
 $string['closewindow'] = 'Затваряне на прозореца';
 $string['continue'] = 'Напред';
-$string['doyouagree'] = 'Прочетохте ли и разбрахте ли условията?';
 $string['error'] = 'Грешка';
 $string['help'] = 'Помощ';
 $string['info'] = "Information";
-$string['invalidemail'] = 'Невалиден електронен адрес';
 $string['language'] = 'Език';
 $string['name'] = 'Име';
 $string['next'] = 'Напред';