Updated the 18 build version to 20101214

If we enable the server validation but don't specify a certificate file path
flag the error and don't let the user save the settings.

admin/cron.php

@@ -272,7 +272,7 @@
                                                 p.id as prefid 
                                         FROM {$CFG->prefix}user u 
                                              JOIN {$CFG->prefix}user_preferences p ON u.id=p.userid
-                                        WHERE p.name='create_password' AND p.value=1 AND u.email !='' ");
+                                        WHERE p.name='create_password' AND p.value='1' AND u.email !='' ");
 
             foreach ($newusers as $newuserid => $newuser) {
                 $newuser->emailstop = 0; // send email regardless

admin/environment.xml

@@ -80,7 +80,6 @@
         <FEEDBACK>
           <ON_ERROR message="mysql416required" />
         </FEEDBACK>
-        <BYPASS function="bypass_mysql416_reqs" message="mysql416bypassed" />
       </VENDOR>
       <VENDOR name="postgres" version="7.4" />
       <VENDOR name="mssql" version="9.0" />
@@ -140,7 +139,6 @@
         <FEEDBACK>
           <ON_ERROR message="mysql416required" />
         </FEEDBACK>
-        <BYPASS function="bypass_mysql416_reqs" message="mysql416bypassed" />
       </VENDOR>
       <VENDOR name="postgres" version="8.0" />
       <VENDOR name="mssql" version="9.0" />
@@ -218,7 +216,6 @@
         <FEEDBACK>
           <ON_ERROR message="mysql416required" />
         </FEEDBACK>
-        <BYPASS function="bypass_mysql416_reqs" message="mysql416bypassed" />
       </VENDOR>
       <VENDOR name="postgres" version="8.3" />
       <VENDOR name="mssql" version="9.0" />
@@ -275,6 +272,11 @@
           <ON_CHECK message="gdrecommended" />
         </FEEDBACK>
       </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
     </PHP_EXTENSIONS>
     <PHP_SETTINGS>
       <PHP_SETTING name="memory_limit" value="40M" level="required">

admin/lang.php

@@ -586,6 +586,10 @@ function lang_fix_value_before_save($value='') {
     if (ini_get_bool('magic_quotes_sybase')) {          // Unescape escaped sybase quotes
         $value = str_replace("''", "'", $value);
     }
+    // escape all embedded variables
+    $value = str_replace('$', '\$', $value);            // Add slashes for $
+    // unescape placeholders: only $a and $a->something are allowed. All other $variables are left escaped
+    $value = preg_replace('/\\\\\$a($|[^_a-zA-Z0-9\-]|\->[a-zA-Z0-9_]+)/', '$a\\1', $value);
     $value = str_replace("'", "\\'", $value);           // Add slashes for '
     $value = str_replace('"', "\\\"", $value);          // Add slashes for "
     $value = str_replace("%","%%",$value);              // Escape % characters

admin/mnet/access_control.php

@@ -180,7 +180,7 @@ if (!$acl) {
         }
         $deletecolumn = "<a href=\"?id={$aclrecord->id}&amp;action=delete&amp;sesskey={$USER->sesskey}\">"
                 . get_string('delete') . "</a>";
-        $table->data[] = array ($aclrecord->username, $aclrecord->mnet_host_id, $accesscolumn, $deletecolumn);
+        $table->data[] = array (s($aclrecord->username), $aclrecord->mnet_host_id, $accesscolumn, $deletecolumn);
     }
 }
 

admin/mnet/adminlib.php

@@ -64,7 +64,7 @@ function mnet_get_functions($type, $parentname) {
         foreach($rpcrecords as $rpc) {
             if (!array_key_exists($rpc->function_name, $methodServiceArray)) {
                 $rpc->enabled = 0;
-                update_record('mnet_rpc', $rpc);
+                update_record('mnet_rpc', addslashes_recursive($rpc));
             }
         }
     }

admin/mnet/delete.php

@@ -31,6 +31,8 @@
         redirect('index.php', get_string('postrequired','mnet') ,7);
     }
 
+    require_sesskey();
+
     if ('verify' == $step) {
         $mnet_peer = new mnet_peer();
         $mnet_peer->set_id($hostid);

admin/mnet/enr_course_enrol.php

@@ -86,9 +86,21 @@
     $mnet_request->set_method('enrol/mnet/enrol.php/course_enrolments');
     $mnet_request->add_param($course->remoteid, 'int');
     $mnet_request->send($mnet_peer);
-    $all_enrolled_users = $mnet_request->response;
-
+    $raw_all_enrolled_users = $mnet_request->response;
     unset($mnet_request);
+
+    $all_enrolled_users = array();
+    if (!empty($raw_all_enrolled_users)) {
+        // Try to repair keying of remote users array, numeric usernames get lost in the fracas
+        foreach ($raw_all_enrolled_users as $username => $userdetails) {
+            if (empty($userdetails['username']) || !is_numeric($username)) {
+                //Not able to repair, or no need to repair
+                $all_enrolled_users[$username] = $userdetails;
+            } else {
+                $all_enrolled_users[$userdetails['username']] = $userdetails;
+            }
+        }
+    }
     
     $select = '';
     $all_enrolled_usernames = '';

admin/mnet/peers.html

@@ -55,6 +55,7 @@ if (empty($CFG->mnet_dispatcher_mode) || $CFG->mnet_dispatcher_mode !== 'strict'
                 <div>
                 <input type="hidden" name="hostid" value="<?php echo $host->id; ?>" />
                 <input type="hidden" name="step" value="verify" />
+                <input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
                 <input type="submit" name="submit" value="<?php print_string('delete'); ?>"/>
                 </div>
             </form>

admin/report/security/lib.php

@@ -42,6 +42,7 @@ function report_security_get_issue_list() {
         'report_security_check_mediafilterswf',
         'report_security_check_openprofiles',
         'report_security_check_google',
+        'report_security_check_passwordsaltmain',
         'report_security_check_configrw',
         'report_security_check_defaultuserrole',
         'report_security_check_guestrole',
@@ -740,3 +741,39 @@ function report_security_check_courserole($detailed=false) {
     return $result;
 }
 
+/**
+ * Checks to see whether a password salt has been defined
+ *
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_passwordsaltmain($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_passwordsaltmain';
+    $result->name    = get_string('check_passwordsaltmain_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+
+    if (empty($CFG->passwordsaltmain)) {
+        $result->status = REPORT_SECURITY_WARNING;
+        $result->info   = get_string('check_passwordsaltmain_warning', 'report_security');
+    } else if ($CFG->passwordsaltmain === 'a_very_long_random_string_of_characters#@6&*1'
+            || trim($CFG->passwordsaltmain) === '' || preg_match('/^([a-z0-9]{0,10})$/i', $CFG->passwordsaltmain)) {
+        $result->status = REPORT_SECURITY_WARNING;
+        $result->info   = get_string('check_passwordsaltmain_weak', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_passwordsaltmain_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $docspath = $CFG->docroot.'/'.str_replace('_utf8', '', current_language()).'/report/security/report_security_check_passwordsaltmain';
+        $result->details = get_string('check_passwordsaltmain_details', 'report_security', $docspath);
+    }
+
+    return $result;
+}

admin/roles/allowassign.php

@@ -24,10 +24,10 @@
 
     $roles = get_all_roles();
 
-    if ($grant = data_submitted()) {
+    if ($grant = data_submitted() and confirm_sesskey()) {
 
         foreach ($grant as $grole => $val) {
-            if ($grole == 'dummy') {
+            if ($grole == 'dummy' or !strpos($grole, '_')) {
                 continue;
             }
 
@@ -82,6 +82,7 @@
     print_table($table);
     echo '<div class="buttons"><input type="submit" value="'.get_string('savechanges').'"/>';
     echo '<input type="hidden" name="dummy" value="1" />'; // this is needed otherwise we do not know a form has been submitted
+    echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
     echo '</div></form>';
 
     admin_externalpage_print_footer($adminroot);

admin/roles/allowoverride.php

@@ -22,10 +22,10 @@
 
     $roles = get_all_roles();
 
-    if ($grant = data_submitted()) {
+    if ($grant = data_submitted() and confirm_sesskey()) {
 
         foreach ($grant as $grole => $val) {
-            if ($grole == 'dummy') {
+            if ($grole == 'dummy' or !strpos($grole, '_')) {
                 continue;
             }
 
@@ -80,6 +80,7 @@
     print_table($table);
     echo '<div class="buttons"><input type="submit" value="'.get_string('savechanges').'"/>';
     echo '<input type="hidden" name="dummy" value="1" />'; // this is needed otherwise we do not know a form has been submitted
+    echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
     echo '</div></form>';
 
     admin_externalpage_print_footer($adminroot);

admin/settings/security.php

@@ -47,6 +47,7 @@ $ADMIN->add('security', $temp);
 // "httpsecurity" settingpage
 $temp = new admin_settingpage('httpsecurity', get_string('httpsecurity', 'admin'));
 $temp->add(new admin_setting_configcheckbox('loginhttps', get_string('loginhttps', 'admin'), get_string('configloginhttps', 'admin'), 0));
+$temp->add(new admin_setting_configtext('excludeoldflashclients', get_string('excludeoldflashclients', 'admin'), get_string('configexcludeoldflashclients', 'admin'), '10.0.12', PARAM_TEXT));
 $ADMIN->add('security', $temp);
 
 

admin/user.php

@@ -114,8 +114,8 @@
             $updateuser->id           = $user->id;
             $updateuser->deleted      = 1;
             $updateuser->username     = addslashes("$user->email.".time());  // Remember it just in case
-            $updateuser->email        = '';               // Clear this field to free it up
-            $updateuser->idnumber     = '';               // Clear this field to free it up
+            $updateuser->email        = md5($user->username); // Store hash of username, useful importing/restoring users
+            $updateuser->idnumber     = '';                   // Clear this field to free it up
             $updateuser->timemodified = time();
             if (update_record('user', $updateuser)) {
                 // Removing a user may have more requirements than just removing their role assignments.

admin/xmldb/actions/XMLDBAction.class.php

@@ -47,6 +47,8 @@ class XMLDBAction {
 
     var $postaction;     //Action to execute at the end of the invoke script
 
+    var $sesskey_protected; // Actions must be protected by sesskey mechanishm
+
     /**
      * Constructor
      */
@@ -72,6 +74,7 @@ class XMLDBAction {
         $this->output    = NULL;
         $this->errormsg  = NULL;
         $this->subaction = NULL;
+        $this->sesskey_protected = true;
     }
 
     /**
@@ -130,13 +133,18 @@ class XMLDBAction {
     }
 
     /**
-     * main invoke method, it simply sets the postaction attribute
-     * if possible
+     * main invoke method, it sets the postaction attribute
+     * if possible and checks sesskey_protected if needed
      */
     function invoke() {
 
         global $SESSION;
 
+    /// Sesskey protection
+        if ($this->sesskey_protected) {
+            require_sesskey();
+        }
+
     /// If we are used any dir, save it in the lastused session object
     /// Some actions can use it to perform positioning
         if ($lastused = optional_param ('dir', NULL, PARAM_PATH)) {

admin/xmldb/actions/check_indexes/check_indexes.class.php

@@ -94,7 +94,7 @@ class check_indexes extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmcheckindexes'] . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=check_indexes&amp;confirmed=yes" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=check_indexes&amp;sesskey=' . sesskey() . '&amp;confirmed=yes" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';
@@ -213,6 +213,10 @@ class check_indexes extends XMLDBAction {
                                 $o.='        </ul>';
                             }
                             $o.='    </li>';
+                        /// Give the script some more time (resetting to current if exists)
+                            if ($currenttl = @ini_get('max_execution_time')) {
+                                @ini_set('max_execution_time',$currenttl);
+                            }
                         }
                         $o.='        </ul>';
                     }

admin/xmldb/actions/delete_field/delete_field.class.php

@@ -77,7 +77,7 @@ class delete_field extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletefield'] . '<br /><br />' . $fieldparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_field&amp;confirmed=yes&amp;postaction=edit_table&amp;field=' . $fieldparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_field&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_table&amp;field=' . $fieldparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_index/delete_index.class.php

@@ -77,7 +77,7 @@ class delete_index extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeleteindex'] . '<br /><br />' . $indexparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_index&amp;confirmed=yes&amp;postaction=edit_table&amp;index=' . $indexparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_index&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_table&amp;index=' . $indexparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_key/delete_key.class.php

@@ -77,7 +77,7 @@ class delete_key extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletekey'] . '<br /><br />' . $keyparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_key&amp;confirmed=yes&amp;postaction=edit_table&amp;key=' . $keyparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_key&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_table&amp;key=' . $keyparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_sentence/delete_sentence.class.php

@@ -77,7 +77,7 @@ class delete_sentence extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletesentence'] . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_sentence&amp;confirmed=yes&amp;postaction=edit_statement&amp;sentence=' . $sentenceparam . '&amp;statement=' . urlencode($statementparam) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_sentence&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_statement&amp;sentence=' . $sentenceparam . '&amp;statement=' . urlencode($statementparam) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_statement/delete_statement.class.php

@@ -76,7 +76,7 @@ class delete_statement extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletestatement'] . '<br /><br />' . $statementparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_statement&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_statement&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_table/delete_table.class.php

@@ -76,7 +76,7 @@ class delete_table extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletetable'] . '<br /><br />' . $tableparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_table&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_table&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_xml_file/delete_xml_file.class.php

@@ -75,7 +75,7 @@ class delete_xml_file extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletexmlfile'] . '<br /><br />' . $dirpath . '/install.php</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_xml_file&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_xml_file&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/edit_field/edit_field.class.php

@@ -35,6 +35,7 @@ class edit_field extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -103,6 +104,7 @@ class edit_field extends XMLDBAction {
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
         $o.= '    <input type="hidden" name ="field" value="' . $fieldparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_field_save" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';

admin/xmldb/actions/edit_index/edit_index.class.php

@@ -35,6 +35,7 @@ class edit_index extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -103,6 +104,7 @@ class edit_index extends XMLDBAction {
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
         $o.= '    <input type="hidden" name ="index" value="' . $indexparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_index_save" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';

admin/xmldb/actions/edit_key/edit_key.class.php

@@ -35,6 +35,7 @@ class edit_key extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -103,6 +104,7 @@ class edit_key extends XMLDBAction {
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
         $o.= '    <input type="hidden" name ="key" value="' . $keyparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_key_save" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';

admin/xmldb/actions/edit_sentence/edit_sentence.class.php

@@ -35,6 +35,7 @@ class edit_sentence extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -119,6 +120,7 @@ class edit_sentence extends XMLDBAction {
             $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
             $o.= '    <input type="hidden" name ="statement" value="' . $statementparam .'" />';
             $o.= '    <input type="hidden" name ="sentence" value="' . $sentenceparam .'" />';
+            $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
             $o.= '    <input type="hidden" name ="action" value="edit_sentence_save" />';
             $o.= '    <input type="hidden" name ="postaction" value="edit_statement" />';
             $o.= '    <table id="formelements" class="boxaligncenter">';

admin/xmldb/actions/edit_statement/edit_statement.class.php

@@ -35,6 +35,7 @@ class edit_statement extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -106,6 +107,7 @@ class edit_statement extends XMLDBAction {
         $o.= '<div>';        
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="statement" value="' . $statementparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_statement_save" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_statement" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';
@@ -129,7 +131,7 @@ class edit_statement extends XMLDBAction {
             $b .= '&nbsp;[' . $this->str['viewedited'] . ']';
         }
     /// The new sentence button
-        $b .= '&nbsp;<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newsentence'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;sesskey=' . sesskey() . '&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newsentence'] . ']</a>';
     /// The back to edit xml file button
         $b .= '&nbsp;<a href="index.php?action=edit_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['back'] . ']</a>';
         $b .= '</p>';
@@ -157,10 +159,10 @@ class edit_statement extends XMLDBAction {
                 $b .= '<a href="index.php?action=edit_sentence&amp;sentence=' .$key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['edit'] . ']</a>';
                 $b .= '</td><td class="button cell">';
             /// The duplicate button
-                $b .= '<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;basesentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['duplicate'] . ']</a>';
+                $b .= '<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;sesskey=' . sesskey() . '&amp;basesentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['duplicate'] . ']</a>';
                 $b .= '</td><td class="button cell">';
             /// The delete button
-                $b .= '<a href="index.php?action=delete_sentence&amp;sentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                $b .= '<a href="index.php?action=delete_sentence&amp;sesskey=' . sesskey() . '&amp;sentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                 $b .= '</td>';
             /// Print table row
             $o .= '<tr class="r' . $row . '"><td class="table cell">' . $p . $sentence . $b . '</tr>';

admin/xmldb/actions/edit_table/edit_table.class.php

@@ -35,6 +35,7 @@ class edit_table extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -107,6 +108,7 @@ class edit_table extends XMLDBAction {
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_table_save" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';
     /// If the table is being used, we cannot rename it
@@ -134,11 +136,11 @@ class edit_table extends XMLDBAction {
             $b .= '&nbsp;[' . $this->str['viewedited'] . ']';
         }
     /// The new field button
-        $b .= '&nbsp;<a href="index.php?action=new_field&amp;postaction=edit_field&amp;table=' . $tableparam . '&amp;field=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newfield'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_field&amp;sesskey=' . sesskey() . '&amp;postaction=edit_field&amp;table=' . $tableparam . '&amp;field=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newfield'] . ']</a>';
     /// The new key button
-        $b .= '&nbsp;<a href="index.php?action=new_key&amp;postaction=edit_key&amp;table=' . $tableparam . '&amp;key=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newkey'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_key&amp;sesskey=' . sesskey() . '&amp;postaction=edit_key&amp;table=' . $tableparam . '&amp;key=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newkey'] . ']</a>';
     /// The new index button
-        $b .= '&nbsp;<a href="index.php?action=new_index&amp;postaction=edit_index&amp;table=' . $tableparam . '&amp;index=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newindex'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_index&amp;sesskey=' . sesskey() . '&amp;postaction=edit_index&amp;table=' . $tableparam . '&amp;index=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newindex'] . ']</a>';
     /// The back to edit xml file button
         $b .= '&nbsp;<a href="index.php?action=edit_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['back'] . ']</a>';
         $b .= '</p>';
@@ -185,14 +187,14 @@ class edit_table extends XMLDBAction {
                 $b .= '</td><td class="button cell">';
             /// The up button
                 if ($field->getPrevious()) {
-                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=up&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['up'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The down button
                 if ($field->getNext()) {
-                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=down&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['down'] . ']';
                 }
@@ -200,7 +202,7 @@ class edit_table extends XMLDBAction {
             /// The delete button (if we have more than one and it isn't used
                 if (count($fields) > 1 &&
                 !$structure->getFieldUses($table->getName(), $field->getName())) {
-                    $b .= '<a href="index.php?action=delete_field&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_field&amp;sesskey=' . sesskey() . '&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['delete'] . ']';
                 }
@@ -234,21 +236,21 @@ class edit_table extends XMLDBAction {
                 $b .= '</td><td class="button cell">';
             /// The up button
                 if ($key->getPrevious()) {
-                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=up&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['up'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The down button
                 if ($key->getNext()) {
-                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=down&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['down'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The delete button (if the key hasn't uses)
                 if (!$structure->getKeyUses($table->getName(), $key->getName())) {
-                    $b .= '<a href="index.php?action=delete_key&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_key&amp;sesskey=' . sesskey() . '&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['delete'] . ']';
                 }
@@ -274,20 +276,20 @@ class edit_table extends XMLDBAction {
                 $b .= '</td><td class="button cell">';
             /// The up button
                 if ($index->getPrevious()) {
-                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=up&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['up'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The down button
                 if ($index->getNext()) {
-                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=down&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['down'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The delete button
-                    $b .= '<a href="index.php?action=delete_index&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_index&amp;sesskey=' . sesskey() . '&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
             /// The readable info
                 $r = '</td><td class="readableinfo cell">' . $index->readableInfo() . '</td>';
             /// Print table row

admin/xmldb/actions/edit_xml_file/edit_xml_file.class.php

@@ -35,6 +35,7 @@ class edit_xml_file extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -107,6 +108,7 @@ class edit_xml_file extends XMLDBAction {
                 $o.= '    <input type="hidden" name ="postaction" value="edit_xml_file" />';
                 $o.= '    <input type="hidden" name ="path" value="' . s($structure->getPath()) .'" />';
                 $o.= '    <input type="hidden" name ="version" value="' . s($structure->getVersion()) .'" />';
+                $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
                 $o.= '    <table id="formelements" class="boxaligncenter">';
                 $o.= '      <tr valign="top"><td>Path:</td><td>' . s($structure->getPath()) . '</td></tr>';
                 $o.= '      <tr valign="top"><td>Version:</td><td>' . s($structure->getVersion()) . '</td></tr>';
@@ -125,15 +127,15 @@ class edit_xml_file extends XMLDBAction {
                     $b .= '&nbsp;[' . $this->str['viewedited'] . ']';
                 }
             /// The new table button
-                $b .= '&nbsp;<a href="index.php?action=new_table&amp;postaction=edit_table&amp;table=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtable'] . ']</a>';
+                $b .= '&nbsp;<a href="index.php?action=new_table&amp;sesskey=' . sesskey() . '&amp;postaction=edit_table&amp;table=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtable'] . ']</a>';
             /// The new from MySQL button
                 if ($CFG->dbfamily == 'mysql') {
-                    $b .= '&nbsp;<a href="index.php?action=new_table_from_mysql&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtablefrommysql'] . ']</a>';
+                    $b .= '&nbsp;<a href="index.php?action=new_table_from_mysql&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtablefrommysql'] . ']</a>';
                 } else {
                     $b .= '&nbsp;[' . $this->str['newtablefrommysql'] . ']';
                 }
             /// The new statement button
-                $b .= '&nbsp;<a href="index.php?action=new_statement&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newstatement'] . ']</a>';
+                $b .= '&nbsp;<a href="index.php?action=new_statement&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newstatement'] . ']</a>';
             /// The back to main menu button
                 $b .= '&nbsp;<a href="index.php?action=main_view#lastused">[' . $this->str['backtomainview'] . ']</a>';
                 $b .= '</p>';
@@ -169,14 +171,14 @@ class edit_xml_file extends XMLDBAction {
                         $b .= '</td><td class="button cell">';
                     /// The up button
                         if ($table->getPrevious()) {
-                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=up&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['up'] . ']';
                         }
                         $b .= '</td><td class="button cell">';
                     /// The down button
                         if ($table->getNext()) {
-                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=down&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['down'] . ']';
                         }
@@ -185,7 +187,7 @@ class edit_xml_file extends XMLDBAction {
                         if (count($tables) > 1 &&
                             !$structure->getTableUses($table->getName())) {
                             ///!$structure->getTableUses($table->getName())) {
-                            $b .= '<a href="index.php?action=delete_table&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                            $b .= '<a href="index.php?action=delete_table&amp;sesskey=' . sesskey() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['delete'] . ']';
                         }
@@ -214,20 +216,20 @@ class edit_xml_file extends XMLDBAction {
                         $b .= '</td><td class="button cell">';
                     /// The up button
                         if ($statement->getPrevious()) {
-                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=up&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['up'] . ']';
                         }
                         $b .= '</td><td class="button cell">';
                     /// The down button
                         if ($statement->getNext()) {
-                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=down&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['down'] . ']';
                         }
                         $b .= '</td><td class="button cell">';
                     /// The delete button
-                        $b .= '<a href="index.php?action=delete_statement&amp;statement=' . $statement->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                        $b .= '<a href="index.php?action=delete_statement&amp;sesskey=' . sesskey() . '&amp;statement=' . $statement->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                         $b .= '</td>';
                     /// Print statement row
                         $o .= '<tr class="r' . $row . '"><td class="statement cell"><a href="index.php?action=view_statement_xml&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;statement=' . $statement->getName() . '&amp;select=edited">' . $statement->getName() . '</a>' . $b . '</tr>';

admin/xmldb/actions/get_db_directories/get_db_directories.class.php

@@ -39,6 +39,7 @@ class get_db_directories extends XMLDBAction {
         //$this->can_subaction = ACTION_HAVE_SUBACTIONS;
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/load_xml_file/load_xml_file.class.php

@@ -38,6 +38,7 @@ class load_xml_file extends XMLDBAction {
         //$this->can_subaction = ACTION_HAVE_SUBACTIONS;
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/main_view/main_view.class.php

@@ -35,6 +35,7 @@ class main_view extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -84,9 +85,9 @@ class main_view extends XMLDBAction {
     /// The reserved_words button
         $b .= '&nbsp;<a href="index.php?action=view_reserved_words">[' . $this->str['reservedwords'] . ']</a>';
     /// The test button
-        $b .= '&nbsp;<a href="index.php?action=test">[' . $this->str['test'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=test&amp;sesskey=' . sesskey() . '">[' . $this->str['test'] . ']</a>';
     /// The check indexes button
-        $b .= '&nbsp;<a href="index.php?action=check_indexes">[' . $this->str['checkindexes'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=check_indexes&amp;sesskey=' . sesskey() . '">[' . $this->str['checkindexes'] . ']</a>';
         $b .= '</p>';
     /// Send buttons to output
         $o .= $b;
@@ -126,7 +127,7 @@ class main_view extends XMLDBAction {
                 if ($dbdir->path_exists &&
                     !file_exists($key . '/install.xml') &&
                     is_writeable($key)) {
-                    $b .= '<a href="index.php?action=create_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['create'] . ']</a>';
+                    $b .= '<a href="index.php?action=create_xml_file&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['create'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['create'] . ']';
                 }
@@ -159,7 +160,7 @@ class main_view extends XMLDBAction {
                     is_writeable($key) &&
                     !empty($dbdir->xml_loaded) &&
                     !empty($dbdir->xml_changed)) {
-                    $b .= '<a href="index.php?action=save_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['save'] . ']</a>';
+                    $b .= '<a href="index.php?action=save_xml_file&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['save'] . ']</a>';
                 /// Check if the file has been manually edited while being modified in the editor
                     if ($dbdir->filemtime != filemtime($key . '/install.xml')) {
                     /// File manually modified. Add to errors.
@@ -178,7 +179,7 @@ class main_view extends XMLDBAction {
                     is_writeable($key) &&
                     !empty($dbdir->xml_loaded) &&
                     !empty($dbdir->xml_changed)) {
-                    $b .= '<a href="index.php?action=revert_changes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['revert'] . ']</a>';
+                    $b .= '<a href="index.php?action=revert_changes&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['revert'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['revert'] . ']';
                 }
@@ -200,7 +201,7 @@ class main_view extends XMLDBAction {
                     is_readable($key . '/install.xml') &&
                     is_writeable($key) &&
                     empty($dbdir->xml_loaded)) {
-                    $b .= '<a href="index.php?action=delete_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_xml_file&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['delete'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['delete'] . ']';
                 }

admin/xmldb/actions/new_statement/new_statement.class.php

@@ -107,6 +107,7 @@ class new_statement extends XMLDBAction {
             $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
             $o.= '    <input type="hidden" name ="action" value="new_statement" />';
             $o.= '    <input type="hidden" name ="postaction" value="edit_statement" />';
+            $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() . '" />';
             $o.= '    <table id="formelements" class="boxaligncenter" cellpadding="5">';
             $o.= '      <tr><td><label for="type" accesskey="t">' . $this->str['statementtype'] .' </label>' . choose_from_menu($typeoptions, 'type', '', 'choose', '', 0, true) . '<label for="table" accesskey="a">' . $this->str['statementtable'] . ' </label>' .choose_from_menu($selecttables, 'table', '', 'choose', '', 0, true) . '</td></tr>';
             $o.= '      <tr><td colspan="2" align="center"><input type="submit" value="' .$this->str['create'] . '" /></td></tr>';

admin/xmldb/actions/new_table_from_mysql/new_table_from_mysql.class.php

@@ -111,6 +111,7 @@ class new_table_from_mysql extends XMLDBAction {
             $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
             $o.= '    <input type="hidden" name ="action" value="new_table_from_mysql" />';
             $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
+            $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() . '" />';
             $o.= '    <table id="formelements" class="boxaligncenter" cellpadding="5">';
             $o.= '      <tr><td><label for="table" accesskey="t">' . $this->str['createtable'] .' </label>' . choose_from_menu($selecttables, 'table', '', 'choose', '', 0, true) . '<label for="after" accesskey="a">' . $this->str['aftertable'] . ' </label>' .choose_from_menu($aftertables, 'after', '', 'choose', '', 0, true) . '</td></tr>';
             $o.= '      <tr><td colspan="2" align="center"><input type="submit" value="' .$this->str['create'] . '" /></td></tr>';

admin/xmldb/actions/revert_changes/revert_changes.class.php

@@ -75,7 +75,7 @@ class revert_changes extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmrevertchanges'] . '<br /><br />' . $dirpath . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=revert_changes&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=revert_changes&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/test/test.class.php

@@ -955,6 +955,20 @@ class test extends XMLDBAction {
 
         $this->output = $o;
 
+    /// Finally drop all the potentially existing test tables
+        $table = new XMLDBTable('testtable');
+        if (table_exists($table)) {
+            $status = drop_table($table, true, false);
+        }
+        $table = new XMLDBTable ('anothertest');
+        if (table_exists($table)) {
+            $status = drop_table($table, true, false);
+        }
+        $table = new XMLDBTable ('newnameforthetable');
+        if (table_exists($table)) {
+            $status = drop_table($table, true, false);
+        }
+
     /// Launch postaction if exists (leave this here!)
         if ($this->getPostAction() && $result) {
             return $this->launch($this->getPostAction());

admin/xmldb/actions/unload_xml_file/unload_xml_file.class.php

@@ -35,6 +35,7 @@ class unload_xml_file extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_field_xml/view_field_xml.class.php

@@ -35,6 +35,7 @@ class view_field_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_index_xml/view_index_xml.class.php

@@ -35,6 +35,7 @@ class view_index_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_key_xml/view_key_xml.class.php

@@ -35,6 +35,7 @@ class view_key_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_reserved_words/view_reserved_words.class.php

@@ -38,6 +38,7 @@ class view_reserved_words extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+    $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_statement_xml/view_statement_xml.class.php

@@ -35,6 +35,7 @@ class view_statement_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_structure_php/view_structure_php.class.php

@@ -36,6 +36,7 @@ class view_structure_php extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_structure_sql/view_structure_sql.class.php

@@ -36,6 +36,7 @@ class view_structure_sql extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_structure_xml/view_structure_xml.class.php

@@ -35,6 +35,7 @@ class view_structure_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_table_php/view_table_php.class.php

@@ -36,6 +36,7 @@ class view_table_php extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_table_sql/view_table_sql.class.php

@@ -36,6 +36,7 @@ class view_table_sql extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_table_xml/view_table_xml.class.php

@@ -35,6 +35,7 @@ class view_table_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_xml/view_xml.class.php

@@ -38,6 +38,7 @@ class view_xml extends XMLDBAction {
         //$this->can_subaction = ACTION_HAVE_SUBACTIONS;
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

auth/cas/CAS/CAS/PGTStorage/pgt-main.php

@@ -0,0 +1,214 @@
+<?php
+/*
+ * Copyright © 2003-2010, The ESUP-Portail consortium & the JA-SIG Collaborative.
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ * 
+ *     * Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright notice,
+ *       this list of conditions and the following disclaimer in the documentation
+ *       and/or other materials provided with the distribution.
+ *     * Neither the name of the ESUP-Portail consortium & the JA-SIG
+ *       Collaborative nor the names of its contributors may be used to endorse or
+ *       promote products derived from this software without specific prior
+ *       written permission.
+
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+/**
+ * @file CAS/PGTStorage/pgt-main.php
+ * Basic class for PGT storage
+ */
+
+/**
+ * @class PGTStorage
+ * The PGTStorage class is a generic class for PGT storage. This class should
+ * not be instanciated itself but inherited by specific PGT storage classes.
+ *
+ * @author   Pascal Aubry <pascal.aubry at univ-rennes1.fr>
+ *
+ * @ingroup internalPGTStorage
+ */
+
+class PGTStorage
+{
+  /** 
+   * @addtogroup internalPGTStorage
+   * @{ 
+   */
+
+  // ########################################################################
+  //  CONSTRUCTOR
+  // ########################################################################
+  
+  /**
+   * The constructor of the class, should be called only by inherited classes.
+   *
+   * @param $cas_parent the CASclient instance that creates the current object.
+   *
+   * @protected
+   */
+  function PGTStorage($cas_parent)
+    {
+      phpCAS::traceBegin();
+      if ( !$cas_parent->isProxy() ) {
+	phpCAS::error('defining PGT storage makes no sense when not using a CAS proxy'); 
+      }
+      phpCAS::traceEnd();
+    }
+
+  // ########################################################################
+  //  DEBUGGING
+  // ########################################################################
+  
+  /**
+   * This virtual method returns an informational string giving the type of storage
+   * used by the object (used for debugging purposes).
+   *
+   * @public
+   */
+  function getStorageType()
+    {
+      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
+    }
+
+  /**
+   * This virtual method returns an informational string giving informations on the
+   * parameters of the storage.(used for debugging purposes).
+   *
+   * @public
+   */
+  function getStorageInfo()
+    {
+      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
+    }
+
+  // ########################################################################
+  //  ERROR HANDLING
+  // ########################################################################
+  
+  /**
+   * string used to store an error message. Written by PGTStorage::setErrorMessage(),
+   * read by PGTStorage::getErrorMessage().
+   *
+   * @hideinitializer
+   * @private
+   * @deprecated not used.
+   */
+  var $_error_message=FALSE;
+
+  /**
+   * This method sets en error message, which can be read later by 
+   * PGTStorage::getErrorMessage().
+   *
+   * @param $error_message an error message
+   *
+   * @protected
+   * @deprecated not used.
+   */
+  function setErrorMessage($error_message)
+    {
+      $this->_error_message = $error_message;
+    }
+
+  /**
+   * This method returns an error message set by PGTStorage::setErrorMessage().
+   *
+   * @return an error message when set by PGTStorage::setErrorMessage(), FALSE
+   * otherwise.
+   *
+   * @public
+   * @deprecated not used.
+   */
+  function getErrorMessage()
+    {
+      return $this->_error_message;
+    }
+
+  // ########################################################################
+  //  INITIALIZATION
+  // ########################################################################
+
+  /**
+   * a boolean telling if the storage has already been initialized. Written by 
+   * PGTStorage::init(), read by PGTStorage::isInitialized().
+   *
+   * @hideinitializer
+   * @private
+   */
+  var $_initialized = FALSE;
+
+  /**
+   * This method tells if the storage has already been intialized.
+   *
+   * @return a boolean
+   *
+   * @protected
+   */
+  function isInitialized()
+    {
+      return $this->_initialized;
+    }
+
+  /**
+   * This virtual method initializes the object.
+   *
+   * @protected
+   */
+  function init()
+    {
+      $this->_initialized = TRUE;
+    }
+
+  // ########################################################################
+  //  PGT I/O
+  // ########################################################################
+
+  /**
+   * This virtual method stores a PGT and its corresponding PGT Iuo.
+   * @note Should never be called.
+   *
+   * @param $pgt the PGT
+   * @param $pgt_iou the PGT iou
+   *
+   * @protected
+   */
+  function write($pgt,$pgt_iou)
+    {
+      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
+    }
+
+  /**
+   * This virtual method reads a PGT corresponding to a PGT Iou and deletes
+   * the corresponding storage entry.
+   * @note Should never be called.
+   *
+   * @param $pgt_iou the PGT iou
+   *
+   * @protected
+   */
+  function read($pgt_iou)
+    {
+      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
+    }
+
+  /** @} */
+  
+} 
+
+// include specific PGT storage classes
+include_once(dirname(__FILE__).'/pgt-file.php'); 
+  
+?>

auth/cas/CAS/CAS/domxml-php4-to-php5.php

@@ -10,12 +10,12 @@
 			require_once('domxml-php4-to-php5.php');
 	}
 
-	Version 1.20a, 2008-11-06, http://alexandre.alapetite.net/doc-alex/domxml-php4-php5/
+	Version 1.21.1a, 2009-03-13, http://alexandre.alapetite.fr/doc-alex/domxml-php4-php5/
 
 	------------------------------------------------------------------
-	Written by Alexandre Alapetite, http://alexandre.alapetite.net/cv/
+	Written by Alexandre Alapetite, http://alexandre.alapetite.fr/cv/
 
-	Copyright 2004-2008, GNU Lesser General Public License,
+	Copyright 2004-2009, GNU Lesser General Public License,
 	http://www.gnu.org/licenses/lgpl.html
 
 	This program is free software: you can redistribute it and/or modify
@@ -39,7 +39,7 @@
 	   in order to improve this file for the benefit of everybody.
 
 	If you want to distribute this code, please do it as a link to:
-	http://alexandre.alapetite.net/doc-alex/domxml-php4-php5/
+	http://alexandre.alapetite.fr/doc-alex/domxml-php4-php5/
 */
 
 define('DOMXML_LOAD_PARSING',0);
@@ -179,6 +179,7 @@ class php4DOMDocument extends php4DOMNode
 	}
 	function html_dump_mem() {return $this->myDOMNode->saveHTML();}
 	function root() {return parent::_newDOMElement($this->myDOMNode->documentElement,$this);}
+	function xinclude() {return $this->myDOMNode->xinclude();}
 	function xpath_new_context() {return new php4DOMXPath($this);}
 }
 
@@ -262,7 +263,7 @@ class php4DOMNode
 				return false;
 		}
 	}
-	function add_child($newnode) {return append_child($newnode);}
+	function add_child($newnode) {return $this->append_child($newnode);}
 	function add_namespace($uri,$prefix) {return false;}
 	function append_child($newnode) {return self::_newDOMElement($this->myDOMNode->appendChild($this->_importNode($newnode)),$this->myOwnerDocument);}
 	function append_sibling($newnode) {return self::_newDOMElement($this->myDOMNode->parentNode->appendChild($this->_importNode($newnode)),$this->myOwnerDocument);}
@@ -458,8 +459,8 @@ class php4DOMXPath
 	}
 	function xpath_eval($eval_str,$contextnode=null)
 	{
-		if (method_exists($this->myDOMXPath,'evaluate')) $xp=isset($contextnode) ? $this->myDOMXPath->evaluate($eval_str,$contextnode->myDOMNode) : $this->myDOMXPath->evaluate($eval_str);
-		else $xp=isset($contextnode) ? $this->myDOMXPath->query($eval_str,$contextnode->myDOMNode) : $this->myDOMXPath->query($eval_str);
+		if (method_exists($this->myDOMXPath,'evaluate')) $xp=isset($contextnode->myDOMNode) ? $this->myDOMXPath->evaluate($eval_str,$contextnode->myDOMNode) : $this->myDOMXPath->evaluate($eval_str);
+		else $xp=isset($contextnode->myDOMNode) ? $this->myDOMXPath->query($eval_str,$contextnode->myDOMNode) : $this->myDOMXPath->query($eval_str);
 		$xp=new php4DOMNodelist($xp,$this->myOwnerDocument);
 		return ($xp->type===XPATH_UNDEFINED) ? false : $xp;
 	}
@@ -467,7 +468,7 @@ class php4DOMXPath
 }
 
 if (extension_loaded('xsl'))
-{//See also: http://alexandre.alapetite.net/doc-alex/xslt-php4-php5/
+{//See also: http://alexandre.alapetite.fr/doc-alex/xslt-php4-php5/
 	function domxml_xslt_stylesheet($xslstring) {return new php4DomXsltStylesheet(DOMDocument::loadXML($xslstring));}
 	function domxml_xslt_stylesheet_doc($dom_document) {return new php4DomXsltStylesheet($dom_document);}
 	function domxml_xslt_stylesheet_file($xslfile) {return new php4DomXsltStylesheet(DOMDocument::load($xslfile));}

auth/cas/CAS/CAS/languages/catalan.php

@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * @file languages/spanish.php
+ * @author Iván-Benjamín García Torà <ivaniclixx AT gmail DOT com>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'usant servidor',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => 'Autentificació CAS necessària!',
+ CAS_STR_LOGOUT 
+ => 'Sortida de CAS necessària!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'Ja hauria d\ haver estat redireccionat al servidor CAS. Feu click <a href="%s">aquí</a> per a continuar.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => 'Autentificació CAS fallida!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>No estàs autentificat.</p><p>Pots tornar a intentar-ho fent click <a href="%s">aquí</a>.</p><p>Si el problema persisteix hauría de contactar amb l\'<a href="mailto:%s">administrador d\'aquest llocc</a>.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => 'El servei `<b>%s</b>\' no està disponible (<b>%s</b>).'
+);
+
+?>

auth/cas/CAS/CAS/languages/english.php

@@ -1,79 +1,27 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file languages/english.php
-
-
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
-
-
- * @sa @link internalLang Internationalization @endlink
-
-
- * @ingroup internalLang
-
-
- */
-
-
-
-
-
-$this->_strings = array(
-
-
- CAS_STR_USING_SERVER 
-
-
- => 'using server',
-
-
- CAS_STR_AUTHENTICATION_WANTED 
-
-
- => 'CAS Authentication wanted!',
-
-
- CAS_STR_LOGOUT 
-
-
- => 'CAS logout wanted!',
-
-
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
-
- => 'You should already have been redirected to the CAS server. Click <a href="%s">here</a> to continue.',
-
-
- CAS_STR_AUTHENTICATION_FAILED 
-
-
- => 'CAS Authentication failed!',
-
-
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
-
- => '<p>You were not authenticated.</p><p>You may submit your request again by clicking <a href="%s">here</a>.</p><p>If the problem persists, you may contact <a href="mailto:%s">the administrator of this site</a>.</p>',
-
-
- CAS_STR_SERVICE_UNAVAILABLE
-
-
- => 'The service `<b>%s</b>\' is not available (<b>%s</b>).'
-
-
-);
-
-
-
-
-
+<?php
+
+/**
+ * @file languages/english.php
+ * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'using server',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => 'CAS Authentication wanted!',
+ CAS_STR_LOGOUT 
+ => 'CAS logout wanted!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'You should already have been redirected to the CAS server. Click <a href="%s">here</a> to continue.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => 'CAS Authentication failed!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>You were not authenticated.</p><p>You may submit your request again by clicking <a href="%s">here</a>.</p><p>If the problem persists, you may contact <a href="mailto:%s">the administrator of this site</a>.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => 'The service `<b>%s</b>\' is not available (<b>%s</b>).'
+);
+
 ?>

auth/cas/CAS/CAS/languages/french.php

@@ -1,82 +1,28 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file languages/english.php
-
-
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
-
-
- * @sa @link internalLang Internationalization @endlink
-
-
- * @ingroup internalLang
-
-
- */
-
-
-
-
-
-$this->_strings = array(
-
-
- CAS_STR_USING_SERVER 
-
-
- => 'utilisant le serveur',
-
-
- CAS_STR_AUTHENTICATION_WANTED 
-
-
- => 'Authentication CAS nécessaire&nbsp;!',
-
-
- CAS_STR_LOGOUT 
-
-
- => 'Déconnexion demandée&nbsp;!',
-
-
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
-
- => 'Vous auriez du etre redirigé(e) vers le serveur CAS. Cliquez <a href="%s">ici</a> pour continuer.',
-
-
- CAS_STR_AUTHENTICATION_FAILED 
-
-
- => 'Authentification CAS infructueuse&nbsp;!',
-
-
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
-
- => '<p>Vous n\'avez pas été authentifié(e).</p><p>Vous pouvez soumettre votre requete à nouveau en cliquant <a href="%s">ici</a>.</p><p>Si le problème persiste, vous pouvez contacter <a href="mailto:%s">l\'administrateur de ce site</a>.</p>',
-
-
- CAS_STR_SERVICE_UNAVAILABLE
-
-
- => 'Le service `<b>%s</b>\' est indisponible (<b>%s</b>)'
-
-
-
-
-
-);
-
-
-
-
-
+<?php
+
+/**
+ * @file languages/english.php
+ * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'utilisant le serveur',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => 'Authentication CAS n�cessaire&nbsp;!',
+ CAS_STR_LOGOUT 
+ => 'D�connexion demand�e&nbsp;!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'Vous auriez du etre redirig�(e) vers le serveur CAS. Cliquez <a href="%s">ici</a> pour continuer.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => 'Authentification CAS infructueuse&nbsp;!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>Vous n\'avez pas �t� authentifi�(e).</p><p>Vous pouvez soumettre votre requete � nouveau en cliquant <a href="%s">ici</a>.</p><p>Si le probl�me persiste, vous pouvez contacter <a href="mailto:%s">l\'administrateur de ce site</a>.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => 'Le service `<b>%s</b>\' est indisponible (<b>%s</b>)'
+
+);
+
 ?>

auth/cas/CAS/CAS/languages/german.php

@@ -1,79 +1,27 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file languages/german.php
-
-
- * @author Henrik Genssen <hg at mediafactory.de>
-
-
- * @sa @link internalLang Internationalization @endlink
-
-
- * @ingroup internalLang
-
-
- */
-
-
-
-
-
-$this->_strings = array(
-
-
- CAS_STR_USING_SERVER 
-
-
- => 'via Server',
-
-
- CAS_STR_AUTHENTICATION_WANTED 
-
-
- => 'CAS Authentifizierung erforderlich!',
-
-
- CAS_STR_LOGOUT 
-
-
- => 'CAS Abmeldung!',
-
-
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
-
- => 'eigentlich h&auml;ten Sie zum CAS Server weitergeleitet werden sollen. Dr&uuml;cken Sie <a href="%s">hier</a> um fortzufahren.',
-
-
- CAS_STR_AUTHENTICATION_FAILED 
-
-
- => 'CAS Anmeldung fehlgeschlagen!',
-
-
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
-
- => '<p>Sie wurden nicht angemeldet.</p><p>Um es erneut zu versuchen klicken Sie <a href="%s">hier</a>.</p><p>Wenn das Problem bestehen bleibt, kontkatieren Sie den <a href="mailto:%s">Administrator</a> dieser Seite.</p>',
-
-
- CAS_STR_SERVICE_UNAVAILABLE
-
-
- => 'Der Dienst `<b>%s</b>\' ist nicht verf&uuml;gbar (<b>%s</b>).'
-
-
-);
-
-
-
-
-
+<?php
+
+/**
+ * @file languages/german.php
+ * @author Henrik Genssen <hg at mediafactory.de>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'via Server',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => 'CAS Authentifizierung erforderlich!',
+ CAS_STR_LOGOUT 
+ => 'CAS Abmeldung!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'eigentlich h&auml;ten Sie zum CAS Server weitergeleitet werden sollen. Dr&uuml;cken Sie <a href="%s">hier</a> um fortzufahren.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => 'CAS Anmeldung fehlgeschlagen!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>Sie wurden nicht angemeldet.</p><p>Um es erneut zu versuchen klicken Sie <a href="%s">hier</a>.</p><p>Wenn das Problem bestehen bleibt, kontkatieren Sie den <a href="mailto:%s">Administrator</a> dieser Seite.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => 'Der Dienst `<b>%s</b>\' ist nicht verf&uuml;gbar (<b>%s</b>).'
+);
+
 ?>

auth/cas/CAS/CAS/languages/greek.php

@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * @file languages/greek.php
+ * @author Vangelis Haniotakis <haniotak at ucnet.uoc.gr>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => '��������������� � ������������',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => '���������� � ����������� CAS!',
+ CAS_STR_LOGOUT 
+ => '���������� � ���������� ��� CAS!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => '�� ������ �� ������ �������������� ���� ����������� CAS. ����� ���� <a href="%s">���</a> ��� �� ����������.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => '� ����������� CAS �������!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>��� ���������������.</p><p>�������� �� ����������������, �������� ���� <a href="%s">���</a>.</p><p>��� �� �������� ���������, ����� �� ����� �� ��� <a href="mailto:%s">�����������</a>.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => '� �������� `<b>%s</b>\' ��� ����� ��������� (<b>%s</b>).'
+);
+
+?>

auth/cas/CAS/CAS/languages/japanese.php

@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * @file languages/japanese.php
+ * @author fnorif (fnorif@yahoo.co.jp)
+ * 
+ * Now Encoding is EUC-JP and LF
+ **/
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'using server',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => 'CAS�ˤ��ǧ�ڤ�Ԥ��ޤ�',
+ CAS_STR_LOGOUT 
+ => 'CAS����?�����Ȥ��ޤ�!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'CAS�����Ф˹Ԥ�ɬ�פ�����ޤ�����ưŪ��ž������ʤ����� <a href="%s">������</a> �򥯥�å�����³�Ԥ��ޤ���',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => 'CAS�ˤ��ǧ�ڤ˼��Ԥ��ޤ���',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>ǧ�ڤǤ��ޤ���Ǥ���.</p><p>�⤦���٥ꥯ�����Ȥ������������<a href="%s">������</a>�򥯥�å�.</p><p>���꤬��褷�ʤ����� <a href="mailto:%s">���Υ����Ȥδ����</a>���䤤��碌�Ƥ�������.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => '�����ӥ� `<b>%s</b>\' �����ѤǤ��ޤ��� (<b>%s</b>).'
+);
+
+?>

auth/cas/CAS/CAS/languages/languages.php

@@ -1,70 +1,24 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file languages/languages.php
-
-
- * Internationalization constants
-
-
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
-
-
- * @sa @link internalLang Internationalization @endlink
-
-
- * @ingroup internalLang
-
-
- */
-
-
-
-
-
-//@{
-
-
-/**
-
-
- * a phpCAS string index
-
-
- */
-
-
-define("CAS_STR_USING_SERVER",                1);
-
-
-define("CAS_STR_AUTHENTICATION_WANTED",       2);
-
-
-define("CAS_STR_LOGOUT",                      3);
-
-
-define("CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED", 4);
-
-
-define("CAS_STR_AUTHENTICATION_FAILED",       5);
-
-
-define("CAS_STR_YOU_WERE_NOT_AUTHENTICATED",  6);
-
-
-define("CAS_STR_SERVICE_UNAVAILABLE",         7);
-
-
-//@}
-
-
-
-
-
+<?php
+
+/**
+ * @file languages/languages.php
+ * Internationalization constants
+ * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+//@{
+/**
+ * a phpCAS string index
+ */
+define("CAS_STR_USING_SERVER",                1);
+define("CAS_STR_AUTHENTICATION_WANTED",       2);
+define("CAS_STR_LOGOUT",                      3);
+define("CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED", 4);
+define("CAS_STR_AUTHENTICATION_FAILED",       5);
+define("CAS_STR_YOU_WERE_NOT_AUTHENTICATED",  6);
+define("CAS_STR_SERVICE_UNAVAILABLE",         7);
+//@}
+
 ?>

auth/cas/CAS/CAS/languages/spanish.php

@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * @file languages/spanish.php
+ * @author Iván-Benjamín García Torà <ivaniclixx AT gmail DOT com>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'usando servidor',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => '¡Autentificación CAS necesaria!',
+ CAS_STR_LOGOUT 
+ => '¡Salida CAS necesaria!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'Ya debería haber sido redireccionado al servidor CAS. Haga click <a href="%s">aquí</a> para continuar.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => '¡Autentificación CAS fallida!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>No estás autentificado.</p><p>Puedes volver a intentarlo haciendo click <a href="%s">aquí</a>.</p><p>Si el problema persiste debería contactar con el <a href="mailto:%s">administrador de este sitio</a>.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => 'El servicio `<b>%s</b>\' no está disponible (<b>%s</b>).'
+);
+
+?>

auth/cas/CAS/PGTStorage/pgt-db.php

@@ -1,568 +0,0 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file CAS/PGTStorage/pgt-db.php
-
-
- * Basic class for PGT database storage
-
-
- */
-
-
-
-
-
-// include phpDB library (the test was introduced in release 0.4.8 for 
-
-
-// the integration into Tikiwiki).
-
-
-if (!class_exists('DB')) {
-
-
-  @include_once('DB.php');
-
-
-}
-
-
-
-
-
-/**
-
-
- * @class PGTStorageDB
-
-
- * The PGTStorageDB class is a class for PGT database storage. An instance of 
-
-
- * this class is returned by CASClient::SetPGTStorageDB().
-
-
- *
-
-
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
-
-
- *
-
-
- * @ingroup internalPGTStorageDB
-
-
- */
-
-
-
-
-
-class PGTStorageDB extends PGTStorage
-
-
-{
-
-
-  /** 
-
-
-   * @addtogroup internalPGTStorageDB
-
-
-   * @{ 
-
-
-   */
-
-
-
-
-
-  /**
-
-
-   * a string representing a PEAR DB URL to connect to the database. Written by
-
-
-   * PGTStorageDB::PGTStorageDB(), read by getURL().
-
-
-   *
-
-
-   * @hideinitializer
-
-
-   * @private
-
-
-   */
-
-
-  var $_url='';
-
-
-
-
-
-  /**
-
-
-   * This method returns the PEAR DB URL to use to connect to the database.
-
-
-   *
-
-
-   * @return a PEAR DB URL
-
-
-   *
-
-
-   * @private
-
-
-   */
-
-
-  function getURL()
-
-
-    {
-
-
-      return $this->_url;
-
-
-    }
-
-
-
-
-
-  /**
-
-
-   * The handle of the connection to the database where PGT's are stored. Written by
-
-
-   * PGTStorageDB::init(), read by getLink().
-
-
-   *
-
-
-   * @hideinitializer
-
-
-   * @private
-
-
-   */
-
-
-  var $_link = null;
-
-
-
-
-
-  /**
-
-
-   * This method returns the handle of the connection to the database where PGT's are 
-
-
-   * stored.
-
-
-   *
-
-
-   * @return a handle of connection.
-
-
-   *
-
-
-   * @private
-
-
-   */
-
-
-  function getLink()
-
-
-    {
-
-
-      return $this->_link;
-
-
-    }
-
-
-
-
-
-  /**
-
-
-   * The name of the table where PGT's are stored. Written by 
-
-
-   * PGTStorageDB::PGTStorageDB(), read by getTable().
-
-
-   *
-
-
-   * @hideinitializer
-
-
-   * @private
-
-
-   */
-
-
-  var $_table = '';
-
-
-
-
-
-  /**
-
-
-   * This method returns the name of the table where PGT's are stored.
-
-
-   *
-
-
-   * @return the name of a table.
-
-
-   *
-
-
-   * @private
-
-
-   */
-
-
-  function getTable()
-
-
-    {
-
-
-      return $this->_table;
-
-
-    }
-
-
-
-
-
-  // ########################################################################
-
-
-  //  DEBUGGING
-
-
-  // ########################################################################
-
-
-  
-
-
-  /**
-
-
-   * This method returns an informational string giving the type of storage
-
-
-   * used by the object (used for debugging purposes).
-
-
-   *
-
-
-   * @return an informational string.
-
-
-   * @public
-
-
-   */
-
-
-  function getStorageType()
-
-
-    {
-
-
-      return "database";
-
-
-    }
-
-
-
-
-
-  /**
-
-
-   * This method returns an informational string giving informations on the
-
-
-   * parameters of the storage.(used for debugging purposes).
-
-
-   *
-
-
-   * @public
-
-
-   */
-
-
-  function getStorageInfo()
-
-
-    {
-
-
-      return 'url=`'.$this->getURL().'\', table=`'.$this->getTable().'\'';
-
-
-    }
-
-
-
-
-
-  // ########################################################################
-
-
-  //  CONSTRUCTOR
-
-
-  // ########################################################################
-
-
-  
-
-
-  /**
-
-
-   * The class constructor, called by CASClient::SetPGTStorageDB().
-
-
-   *
-
-
-   * @param $cas_parent the CASClient instance that creates the object.
-
-
-   * @param $user the user to access the data with
-
-
-   * @param $password the user's password
-
-
-   * @param $database_type the type of the database hosting the data
-
-
-   * @param $hostname the server hosting the database
-
-
-   * @param $port the port the server is listening on
-
-
-   * @param $database the name of the database
-
-
-   * @param $table the name of the table storing the data
-
-
-   *
-
-
-   * @public
-
-
-   */
-
-
-  function PGTStorageDB($cas_parent,$user,$password,$database_type,$hostname,$port,$database,$table)
-
-
-    {
-
-
-      phpCAS::traceBegin();
-
-
-
-
-
-      // call the ancestor's constructor
-
-
-      $this->PGTStorage($cas_parent);
-
-
-
-
-
-      if ( empty($database_type) ) $database_type = CAS_PGT_STORAGE_DB_DEFAULT_DATABASE_TYPE;
-
-
-      if ( empty($hostname) ) $hostname = CAS_PGT_STORAGE_DB_DEFAULT_HOSTNAME;
-
-
-      if ( $port==0 ) $port = CAS_PGT_STORAGE_DB_DEFAULT_PORT;
-
-
-      if ( empty($database) ) $database = CAS_PGT_STORAGE_DB_DEFAULT_DATABASE;
-
-
-      if ( empty($table) ) $table = CAS_PGT_STORAGE_DB_DEFAULT_TABLE;
-
-
-
-
-
-      // build and store the PEAR DB URL
-
-
-      $this->_url = $database_type.':'.'//'.$user.':'.$password.'@'.$hostname.':'.$port.'/'.$database;
-
-
-
-
-
-      // XXX should use setURL and setTable
-
-
-      phpCAS::traceEnd();
-
-
-    }
-
-
-  
-
-
-  // ########################################################################
-
-
-  //  INITIALIZATION
-
-
-  // ########################################################################
-
-
-  
-
-
-  /**
-
-
-   * This method is used to initialize the storage. Halts on error.
-
-
-   *
-
-
-   * @public
-
-
-   */
-
-
-  function init()
-
-
-    {
-
-
-      phpCAS::traceBegin();
-
-
-      // if the storage has already been initialized, return immediatly
-
-
-      if ( $this->isInitialized() )
-
-
-	return;
-
-
-      // call the ancestor's method (mark as initialized)
-
-
-      parent::init();
-
-
-      
-
-
-      // try to connect to the database
-
-
-      $this->_link = DB::connect($this->getURL());
-
-
-      if ( DB::isError($this->_link) ) {
-
-
-	phpCAS::error('could not connect to database ('.DB::errorMessage($this->_link).')');
-
-
-      }
-
-
-      var_dump($this->_link);
-
-
-      phpCAS::traceBEnd();
-
-
-    }
-
-
-
-
-
-  /** @} */
-
-
-}
-
-
-
-
-
-?>

auth/cas/CAS/PGTStorage/pgt-main.php

@@ -1,188 +0,0 @@
-<?php
-
-
-
-/**
-
- * @file CAS/PGTStorage/pgt-main.php
-
- * Basic class for PGT storage
-
- */
-
-
-
-/**
-
- * @class PGTStorage
-
- * The PGTStorage class is a generic class for PGT storage. This class should
-
- * not be instanciated itself but inherited by specific PGT storage classes.
-
- *
-
- * @author   Pascal Aubry <pascal.aubry at univ-rennes1.fr>
-
- *
-
- * @ingroup internalPGTStorage
-
- */
-
-
-
-class PGTStorage
-
-{
-
-  /** 
-
-   * @addtogroup internalPGTStorage
-
-   * @{ 
-
-   */
-
-
-
-  // ########################################################################
-
-  //  CONSTRUCTOR
-
-  // ########################################################################
-
-  
-
-  /**
-
-   * The constructor of the class, should be called only by inherited classes.
-
-   *
-
-   * @param $cas_parent the CASclient instance that creates the current object.
-
-   *
-
-   * @protected
-
-   */
-
-  function PGTStorage($cas_parent)
-
-    {
-
-      phpCAS::traceBegin();
-
-      if ( !$cas_parent->isProxy() ) {
-
-	phpCAS::error('defining PGT storage makes no sense when not using a CAS proxy'); 
-
-      }
-
-      phpCAS::traceEnd();
-
-    }
-
-
-
-  // ########################################################################
-
-  //  DEBUGGING
-
-  // ########################################################################
-
-  
-
-  /**
-
-   * This virtual method returns an informational string giving the type of storage
-
-   * used by the object (used for debugging purposes).
-
-   *
-
-   * @public
-
-   */
-
-  function getStorageType()
-
-    {
-
-      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
-
-    }
-
-
-
-  /**
-
-   * This virtual method returns an informational string giving informations on the
-
-   * parameters of the storage.(used for debugging purposes).
-
-   *
-
-   * @public
-
-   */
-
-  function getStorageInfo()
-
-    {
-
-      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
-
-    }
-
-
-
-  // ########################################################################
-
-  //  ERROR HANDLING
-
-  // ########################################################################
-
-  
-
-  /**
-
-   * string used to store an error message. Written by PGTStorage::setErrorMessage(),
-
-   * read by PGTStorage::getErrorMessage().
-
-   *
-
-   * @hideinitializer
-
-   * @private
-
-   * @deprecated not used.
-
-   */
-
-  var $_error_message=FALSE;
-
-
-
-  /**
-
-   * This method sets en error message, which can be read later by 
-
-   * PGTStorage::getErrorMessage().
-
-   *
-
-   * @param $error_message an error message
-
-   *
-
-   * @protected
-
-   * @deprecated not used.
-
-   */
-
-  function setErrorMessage($error_message)
-

auth/cas/CAS/languages/greek.php

@@ -1,79 +0,0 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file languages/greek.php
-
-
- * @author Vangelis Haniotakis <haniotak at ucnet.uoc.gr>
-
-
- * @sa @link internalLang Internationalization @endlink
-
-
- * @ingroup internalLang
-
-
- */
-
-
-
-
-
-$this->_strings = array(
-
-
- CAS_STR_USING_SERVER 
-
-
- => '÷ñçóéìïðïéåßôáé ï åîõðçñåôçôÞò',
-
-
- CAS_STR_AUTHENTICATION_WANTED 
-
-
- => 'Áðáéôåßôáé ç ôáõôïðïßçóç CAS!',
-
-
- CAS_STR_LOGOUT 
-
-
- => 'Áðáéôåßôáé ç áðïóýíäåóç áðü CAS!',
-
-
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
-
- => 'Èá Ýðñåðå íá åß÷áôå áíáêáôåõèõíèåß óôïí åîõðçñåôçôÞ CAS. ÊÜíôå êëßê <a href="%s">åäþ</a> ãéá íá óõíå÷ßóåôå.',
-
-
- CAS_STR_AUTHENTICATION_FAILED 
-
-
- => 'Ç ôáõôïðïßçóç CAS áðÝôõ÷å!',
-
-
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
-
- => '<p>Äåí ôáõôïðïéçèÞêáôå.</p><p>Ìðïñåßôå íá îáíáðñïóðáèÞóåôå, êÜíïíôáò êëßê <a href="%s">åäþ</a>.</p><p>Åáí ôï ðñüâëçìá åðéìåßíåé, åëÜôå óå åðáöÞ ìå ôïí <a href="mailto:%s">äéá÷åéñéóôÞ</a>.</p>',
-
-
- CAS_STR_SERVICE_UNAVAILABLE
-
-
- => 'Ç õðçñåóßá `<b>%s</b>\' äåí åßíáé äéáèÝóéìç (<b>%s</b>).'
-
-
-);
-
-
-
-
-
-?>

auth/cas/CAS/languages/japanese.php

@@ -1,53 +0,0 @@
-<?php
-
-
-
-/**
-
- * @file languages/japanese.php
-
- * @author fnorif (fnorif@yahoo.co.jp)
-
- * 
-
- * Now Encoding is EUC-JP and LF
-
- **/
-
-
-
-$this->_strings = array(
-
- CAS_STR_USING_SERVER 
-
- => 'using server',
-
- CAS_STR_AUTHENTICATION_WANTED 
-
- => 'CASによる認証を行います',
-
- CAS_STR_LOGOUT 
-
- => 'CASからログアウトします!',
-
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
- => 'CASサーバに行く必要があります。自動的に転送されない場合は <a href="%s">こちら</a> をクリックして続行します。',
-
- CAS_STR_AUTHENTICATION_FAILED 
-
- => 'CASによる認証に失敗しました',
-
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
- => '<p>認証できませんでした.</p><p>もう一度リクエストを送信する場合は<a href="%s">こちら</a>をクリック.</p><p>問題が解決しない場合は <a href="mailto:%s">このサイトの管理者</a>に問い合わせてください.</p>',
-
- CAS_STR_SERVICE_UNAVAILABLE
-
- => 'サービス `<b>%s</b>\' は利用できません (<b>%s</b>).'
-
-);
-
-
-
-?>

auth/cas/auth.php

@@ -58,8 +58,13 @@ class auth_plugin_cas extends auth_plugin_base {
      */
     function user_login ($username, $password) {
 		$this->connectCAS();
-        return phpCAS::isAuthenticated() && (phpCAS::getUser() == $username);
+        return phpCAS::isAuthenticated() && (trim(moodle_strtolower(phpCAS::getUser())) == $username);
     }
+
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *
@@ -92,8 +97,10 @@ class auth_plugin_cas extends auth_plugin_base {
       $username = optional_param("username");
 
       if (!empty($username)) {
-		  if (strstr($SESSION->wantsurl,'ticket') || strstr($SESSION->wantsurl,'NOCAS'))
-			  unset($SESSION->wantsurl);
+          if (isset($SESSION->wantsurl) && (strstr($SESSION->wantsurl, 'ticket') ||
+                                            strstr($SESSION->wantsurl, 'NOCAS'))) {
+              unset($SESSION->wantsurl);
+          }
           return;		  
         }
 
@@ -107,6 +114,13 @@ class auth_plugin_cas extends auth_plugin_base {
 // Connection to CAS server
 	 $this->connectCAS();
 
+     if($this->config->certificate_check && $this->config->certificate_path){
+         phpCAS::setCasServerCACert($this->config->certificate_path);
+     }else{
+         // Don't try to validate the server SSL credentials
+         phpCAS::setNoCasServerValidation();
+     }
+
 	  // Gestion de la connection CAS si acc�s direct d'un ent ou autre	 
 	 if (phpCAS::checkAuthentication()) {
 		$frm->username=phpCAS::getUser();
@@ -116,7 +130,7 @@ class auth_plugin_cas extends auth_plugin_base {
 		return;
 	 }	 	
 
-	  if ($_GET["loginguest"]== true) {
+      if (isset($_GET["loginguest"]) && ($_GET["loginguest"]== true)) {
 			$frm->username="guest";
 			$frm->password="guest";
 			return;
@@ -152,7 +166,7 @@ class auth_plugin_cas extends auth_plugin_base {
 	  if ($this->config->logoutcas ) {
 	        $backurl = $CFG->wwwroot;
 		  $this->connectCAS();
-	        phpCAS::logout($backurl);        
+          phpCAS::logoutWithURL($backurl);
 	     }
     }
     /**
@@ -166,12 +180,13 @@ class auth_plugin_cas extends auth_plugin_base {
 	global $PHPCAS_CLIENT;
 // mode proxy CAS
 if ( !is_object($PHPCAS_CLIENT) ) {
+    // Make sure phpCAS doesn't try to start a new PHP session when connecting to the CAS server.
 	if  ($this->config->proxycas) {
-	    phpCAS::proxy($this->config->casversion, $this-> config->hostname, (int) $this->config->port, $this->config->baseuri);
+	    phpCAS::proxy($this->config->casversion, $this-> config->hostname, (int) $this->config->port, $this->config->baseuri, false);
 	}
 // mode client CAS
 	else {
-	    phpCAS::client($this->config->casversion, $this-> config->hostname, (int) $this->config->port, $this->config->baseuri);
+	    phpCAS::client($this->config->casversion, $this-> config->hostname, (int) $this->config->port, $this->config->baseuri, false);
 	}
     }
 	
@@ -187,6 +202,18 @@ if ( !is_object($PHPCAS_CLIENT) ) {
     function config_form($config, $err, $user_fields) {
         include 'config.html';
     }
+    /**
+     * A chance to validate form data, and last chance to
+     * do stuff before it is inserted in config_plugin
+     * @param object object with submitted configuration settings (without system magic quotes)
+     * @param array $err array of error messages
+     */
+    function validate_form(&$form, &$err) {
+        $certificate_path = trim($form->certificate_path);
+        if ($form->certificate_check && empty($certificate_path)) {
+            $err['certificate_path'] = get_string('auth_cas_certificate_path_empty', 'auth');
+        }
+    }
     /**
      * Returns the URL for changing the user's pw, or empty if the default can
      * be used.
@@ -233,6 +260,10 @@ if ( !is_object($PHPCAS_CLIENT) ) {
             $config->logoutcas = '';
         if (!isset ($config->multiauth))
             $config->multiauth = '';
+        if (!isset ($config->certificate_check))
+            $config->certificate_check = '';
+        if (!isset ($config->certificate_path))
+            $config->certificate_path = '';
         // LDAP settings
         if (!isset($config->host_url))
             { $config->host_url = ''; }
@@ -275,6 +306,8 @@ if ( !is_object($PHPCAS_CLIENT) ) {
         set_config('proxycas',     $config->proxycas,     'auth/cas');
         set_config('logoutcas',     $config->logoutcas,     'auth/cas');
         set_config('multiauth',     $config->multiauth,     'auth/cas');
+        set_config('certificate_check',     $config->certificate_check,     'auth/cas');
+        set_config('certificate_path',     $config->certificate_path,     'auth/cas');
         // save LDAP settings
         set_config('host_url', $config->host_url, 'auth/cas');
         set_config('ldapencoding', $config->ldapencoding, 'auth/cas');
@@ -355,6 +388,13 @@ if ( !is_object($PHPCAS_CLIENT) ) {
      * @return mixed array with no magic quotes or false on error
      */
     function get_userinfo($username) {
+        // No LDAP servers configured, so user info has to be provided
+        // via other methods (CSV file, manually, etc.). Return empty
+        // array so existing user info is not lost.
+        if (empty($this->config->host_url)) {
+            return array();
+        }
+
         $textlib = textlib_get_instance();
         $extusername = $textlib->convert(stripslashes($username), 'utf-8', $this->config->ldapencoding);
         $ldapconnection = $this->ldap_connect();
@@ -466,6 +506,9 @@ if ( !is_object($PHPCAS_CLIENT) ) {
             if (!empty($this->config->version)) {
                 ldap_set_option($connresult, LDAP_OPT_PROTOCOL_VERSION, $this->config->version);
             }
+            if ($this->config->user_type == 'ad') {
+                 ldap_set_option($connresult, LDAP_OPT_REFERRALS, 0);
+            }
             if (!empty($binddn)) {
                 //bind with search-user
                 //$debuginfo .= 'Using bind user'.$binddn.'and password:'.$bindpwd;
@@ -612,6 +655,12 @@ if ( !is_object($PHPCAS_CLIENT) ) {
      */
     function sync_users ($bulk_insert_records = 1000, $do_updates = true) {
         global $CFG;
+
+        if(empty($this->config->host_url)) {
+            echo "No LDAP server configured for CAS! Syncing disabled.\n";
+            return;
+        }
+
         $textlib = textlib_get_instance();
         $droptablesql = array(); /// sql commands to drop the table (because session scope could be a problem for
                                  /// some persistent drivers like ODBTP (mssql) or if this function is invoked
@@ -780,9 +829,9 @@ if ( !is_object($PHPCAS_CLIENT) ) {
                     $updateuser->id = $user->id;
                     $updateuser->auth = 'cas';
                     if (update_record('user', $updateuser)) {
-                        echo "\t"; print_string('auth_dbreviveser', 'auth', array($user->username, $user->id)); echo "\n";
+                        echo "\t"; print_string('auth_dbreviveduser', 'auth', array($user->username, $user->id)); echo "\n";
                     } else {
-                        echo "\t"; print_string('auth_dbreviveusererror', 'auth', $user->username); echo "\n";
+                        echo "\t"; print_string('auth_dbrevivedusererror', 'auth', $user->username); echo "\n";
                     }
                 }
                 commit_sql();
@@ -973,7 +1022,7 @@ if ( !is_object($PHPCAS_CLIENT) ) {
      * @return boolean result
      */
     function iscreator($username) {
-        if ((empty($this->config->attrcreators) && empty($this->config->groupecreators)) or empty($this->config->memberattribute)) {
+        if (empty($this->config->host_url) or (empty($this->config->attrcreators) && empty($this->config->groupecreators)) or empty($this->config->memberattribute)) {
             return null;
         }
         $textlib = textlib_get_instance();

auth/cas/config.html

@@ -48,6 +48,14 @@
 
         $config->multiauth = '';
 
+    if (!isset ($config->certificate_check)) 
+
+        $config->certificate_check = '';
+
+    if (!isset ($config->certificate_path))
+
+        $config->certificate_path = '';
+
   // set to defaults if undefined (LDAP)
 
     if (!isset($config->host_url))
@@ -134,7 +142,7 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
 
 
 
-<table cellspacing="0" cellpadding="5" border="0" align="center">
+<table cellspacing="0" cellpadding="5" border="0">
 
 
 
@@ -364,6 +372,44 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
 
 
 
+<tr valign="top"  class="required">
+
+    <td align="right"><?php print_string('auth_cas_certificate_check_key', 'auth') ?>:</td>
+
+    <td>
+
+        <?php choose_from_menu ($yesno, 'certificate_check', $config->certificate_check, ''); ?>
+
+    </td>
+
+    <td><?php print_string('auth_cas_certificate_check', 'auth') ?></td>
+
+</tr>
+
+
+
+<tr valign="top" class="required">
+
+    <td align="right"><?php print_string('auth_cas_certificate_path_key', 'auth') ?>:</td>
+
+    <td>
+
+        <input name="certificate_path" type="text" size="30" value="<?php echo $config->certificate_path ?>" />
+
+        <?php if (isset($err['certificate_path'])) formerr($err['certificate_path']); ?>
+
+    </td>
+
+    <td>
+
+        <?php print_string('auth_cas_certificate_path', 'auth') ?>
+      
+    </td>
+
+</tr>
+
+
+
 <tr>
 
    <td colspan="2">
@@ -602,7 +648,7 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
 
        $opt_deref[LDAP_DEREF_ALWAYS] = get_string('yes');
 
-       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, LDAP_DEREF_NEVER, '');
+       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, '');
 
        if (isset($err['opt_deref'])) formerr($err['opt_deref']);
 
@@ -722,7 +768,7 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
 
 <tr valign="top" class="required">
 
-        <td align="right"><label for="attrcreators_key"><?php print_string('auth_ldap_attrcreators_key','auth') ?></label></td>
+        <td align="right"><label for="attrcreators"><?php print_string('auth_ldap_attrcreators_key','auth') ?></label></td>
 
         <td>
 
@@ -742,7 +788,7 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
 
 <tr valign="top" class="required">
 
-        <td align="right"><label for="groupecreators_key"><?php print_string('auth_ldap_groupecreators_key','auth') ?></label></td>
+        <td align="right"><label for="groupecreators"><?php print_string('auth_ldap_groupecreators_key','auth') ?></label></td>
 
         <td>
 
@@ -825,4 +871,4 @@ print_auth_lock_options('cas', $user_fields, $help, true, true);
 
 
 ?>
-</table>
+</table>

auth/db/auth.php

@@ -372,7 +372,7 @@ class auth_plugin_db extends auth_plugin_base {
                 if ($old_user = get_record('user', 'username', $user->username, 'deleted', 1, 'mnethostid', $user->mnethostid)) {
                     $user->id = $old_user->id;
                     set_field('user', 'deleted', 0, 'username', $user->username);
-                    echo "\t"; print_string('auth_dbreviveuser', 'auth', array(stripslashes($user->username), $user->id)); echo "\n";
+                    echo "\t"; print_string('auth_dbreviveduser', 'auth', array(stripslashes($user->username), $user->id)); echo "\n";
                 } elseif ($id = insert_record ('user',$user)) { // it is truly a new user
                     echo "\t"; print_string('auth_dbinsertuser','auth',array(stripslashes($user->username), $id)); echo "\n";
                     // if relevant, tag for password generation
@@ -572,6 +572,13 @@ class auth_plugin_db extends auth_plugin_base {
         }
     }
 
+    function prevent_local_passwords() {
+        if (!isset($this->config->passtype)) {
+            return false;
+        }
+        return ($this->config->passtype != 'internal');
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/email/auth.php

@@ -132,6 +132,10 @@ class auth_plugin_email extends auth_plugin_base {
         }
     }
 
+    function prevent_local_passwords() {
+        return false;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/fc/auth.php

@@ -144,6 +144,10 @@ class auth_plugin_fc extends auth_plugin_base {
         return false;
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/imap/auth.php

@@ -81,6 +81,10 @@ class auth_plugin_imap extends auth_plugin_base {
         return false;  // No match
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/ldap/auth.php

@@ -556,9 +556,9 @@ class auth_plugin_ldap extends auth_plugin_base {
                     $updateuser->id = $user->id;
                     $updateuser->auth = 'ldap';
                     if (update_record('user', $updateuser)) {
-                        echo "\t"; print_string('auth_dbreviveser', 'auth', array($user->username, $user->id)); echo "\n";
+                        echo "\t"; print_string('auth_dbreviveduser', 'auth', array($user->username, $user->id)); echo "\n";
                     } else {
-                        echo "\t"; print_string('auth_dbreviveusererror', 'auth', $user->username); echo "\n";
+                        echo "\t"; print_string('auth_dbrevivedusererror', 'auth', $user->username); echo "\n";
                     }
                 }
                 commit_sql();
@@ -1607,6 +1607,10 @@ class auth_plugin_ldap extends auth_plugin_base {
         return ($fresult);
     }
 
+    function prevent_local_passwords() {
+        return !empty($this->config->preventpassindb);
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/ldap/config.html

@@ -16,7 +16,7 @@
     if (!isset($config->opt_deref))
         { $config->opt_deref = LDAP_DEREF_NEVER; }
     if (!isset($config->preventpassindb))
-        { $config->preventpassindb = 0; }
+        { $config->preventpassindb = 1; }
     if (!isset($config->bind_dn))
         {$config->bind_dn = ''; }
     if (!isset($config->bind_pw))
@@ -193,7 +193,7 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
        $opt_deref = array();
        $opt_deref[LDAP_DEREF_NEVER] = get_string('no');
        $opt_deref[LDAP_DEREF_ALWAYS] = get_string('yes');
-       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, LDAP_DEREF_NEVER, '');
+       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, '');
        if (isset($err['opt_deref'])) formerr($err['opt_deref']);
     ?>
     </td>

auth/manual/auth.php

@@ -62,6 +62,10 @@ class auth_plugin_manual extends auth_plugin_base {
         return update_internal_user_password($user, $newpassword);
     }
 
+    function prevent_local_passwords() {
+        return false;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/mnet/auth.php

@@ -590,6 +590,10 @@ class auth_plugin_mnet extends auth_plugin_base {
         delete_records_select('mnet_enrol_assignments', $whereclause);
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/nntp/auth.php

@@ -64,6 +64,10 @@ class auth_plugin_nntp extends auth_plugin_base {
         return false;
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/nologin/auth.php

@@ -46,6 +46,11 @@ class auth_plugin_nologin extends auth_plugin_base {
         return false;
     }
 
+    function prevent_local_passwords() {
+        // just in case, we do not want to loose the passwords
+        return false;
+    }
+
     /**
      * No external data sync.
      *

auth/none/auth.php

@@ -62,6 +62,10 @@ class auth_plugin_none extends auth_plugin_base {
         return update_internal_user_password($user, $newpassword);
     }
 
+    function prevent_local_passwords() {
+        return false;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/pam/auth.php

@@ -77,6 +77,10 @@ class auth_plugin_pam extends auth_plugin_base {
         }
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/pop3/auth.php

@@ -81,6 +81,10 @@ class auth_plugin_pop3 extends auth_plugin_base {
         return false;  // No matches found
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/radius/auth.php

@@ -80,6 +80,10 @@ class auth_plugin_radius extends auth_plugin_base {
         $rauth->close();
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/shibboleth/auth.php

@@ -134,6 +134,10 @@ class auth_plugin_shibboleth extends auth_plugin_base {
         return $moodleattributes;
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

backup/backup.php

@@ -115,7 +115,7 @@
     raise_memory_limit("192M");
 
     //Call the form, depending the step we are
-    if (!$launch) {
+    if (!$launch or !data_submitted() or !confirm_sesskey()) {
         // if we're at the start, clear the cache of prefs
         if (isset($SESSION->backupprefs[$course->id])) {
             unset($SESSION->backupprefs[$course->id]);

backup/backup_check.html

@@ -4,6 +4,9 @@
     //Check login   
     require_login();
 
+    // Init backupuserinfo
+    $backupuserinfo = false;
+
     if (!empty($course->id)) {
         if (!has_capability('moodle/site:backup', get_context_instance(CONTEXT_COURSE, $course->id))) {
             if (empty($to)) {
@@ -14,10 +17,12 @@
                 }
             }
         }
+        $backupuserinfo = has_capability('moodle/backup:userinfo', get_context_instance(CONTEXT_COURSE, $course->id));
     } else {
         if (!has_capability('moodle/site:backup', get_context_instance(CONTEXT_SYSTEM, SITEID))) {
             error("You need to be an admin user to use this page.", "$CFG->wwwroot/login/index.php");
         }
+        $backupuserinfo = has_capability('moodle/backup:userinfo', get_context_instance(CONTEXT_SYSTEM));
     }
 
     
@@ -38,6 +43,7 @@
 <form id="form" method="post" action="backup.php">
 <table cellpadding="5" style="text-align:center;margin-left:auto;margin-right:auto">
 <?php
+    echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
 
     if (empty($to)) {
         //Now print the Backup Name tr
@@ -58,6 +64,16 @@
 
     }
 
+    // Re-enforce 'moodle/site:backup' at system context to be able to backup all users
+    if ($backupprefs->backup_users == 0 and !has_capability('moodle/site:backup', get_context_instance(CONTEXT_SYSTEM))) {
+        $backupprefs->backup_users = 1; // users => course
+    }
+
+    // Re-enforce moodle/backup:userinfo capability
+    if (!$backupuserinfo) {
+        $backupprefs->backup_users = 2; // users => none
+    }
+
     //Here we check if backup_users = None. Then, we switch off every module
     //user info, user_files, logs and exercises, workshop and messages backups. A Warning is showed to
     //inform the user.

backup/backup_form.html

@@ -4,6 +4,9 @@
     //Check login   
     require_login();
 
+    //Init backupuserinfo
+    $backupuserinfo = false;
+
     if (!empty($course->id)) {
         if (!has_capability('moodle/site:backup', get_context_instance(CONTEXT_COURSE, $course->id))) {
             if (empty($to)) {
@@ -14,10 +17,12 @@
                 }
             }
         }
+        $backupuserinfo = has_capability('moodle/backup:userinfo', get_context_instance(CONTEXT_COURSE, $course->id));
     } else {
         if (!has_capability('moodle/site:backup', get_context_instance(CONTEXT_SYSTEM, SITEID))) {
             error("You need to be an admin user to use this page.", "$CFG->wwwroot/login/index.php");
         }
+        $backupuserinfo = has_capability('moodle/backup:userinfo', get_context_instance(CONTEXT_SYSTEM));
     }
 
     //Check site
@@ -115,6 +120,8 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
 <form id="form1" method="post" action="backup.php">
 <table cellpadding="5" style="margin-left:auto;margin-right:auto;">
 <?php
+    echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
+
 /// Acummulator for hidden options and proper XHTML output
     $hidden_options = '';
     //Now, check modules and info and show posibilities
@@ -127,12 +134,16 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_', true);\">". get_string("all")."</a>/";
         echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_', false);\">".  get_string("none")."</a>";
         echo "</td>";
-        echo "<td align=\"right\">";
-        echo '<b>&nbsp;</b>';
-        echo "</td><td>";
-        echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_user_info_', true);\">". get_string("all")."</a>/";
-        echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_user_info_', false);\">". get_string("none")."</a>";
-        echo "</td>";
+        if (empty($to) and $backupuserinfo) {
+            echo "<td align=\"right\">";
+            echo '<b>&nbsp;</b>';
+            echo "</td><td>";
+            echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_user_info_', true);\">". get_string("all")."</a>/";
+            echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_user_info_', false);\">". get_string("none")."</a>";
+            echo "</td>";
+        } else {
+            echo "<td colspan=\"2\">&nbsp;</td>";
+        }
         echo "</tr>";
         echo "<tr><td colspan=\"4\"><hr /></td></tr>";
         $currentrow = 0;
@@ -155,8 +166,8 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
                 echo "</td><td align=\"right\">&nbsp;";
                 echo "</td><td>";
                 $var = "backup_user_info_".$modname;
-                if (empty($to)) {
-                    $backup_user_options[0] = get_string("withoutuserdata"); 
+                if (empty($to) and $backupuserinfo) {
+                    $backup_user_options[0] = get_string("withoutuserdata");
                     $backup_user_options[1] = get_string("withuserdata");
                     //choose_from_menu($backup_user_options, $var, $$var, "");
                     print_checkbox($var, $$var, $$var, get_string("userdata"),'','selectItemInCheckboxByName(\'form1\',\'backup_user_info_'.$modname.'\',this.checked)');
@@ -177,7 +188,7 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
                         echo '</td><td align="right">&nbsp;';
                         $var = 'backup_user_info_'.$modname.'_instance_'.$instance->id;
                         $$var = optional_param($var,1);
-                        if (empty($to)) {
+                        if (empty($to) and $backupuserinfo) {
                             print_checkbox($var,$$var,$$var,get_string('userdata'),'','this.form.elements[\'backup_user_info_'.$modname.'\'].checked=1;');
                         } else {
                             echo '<input type="hidden" name="'.$var.'" value="0" />';
@@ -207,23 +218,25 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
             $hidden_options .= '<input type="hidden" name="backup_metacourse" value="0" />';
         }
 
-        if (empty($to)) {
+        if (empty($to) and $backupuserinfo) {
             //Now print the Users tr
             echo "<tr>";
             echo "<td align=\"right\" colspan=\"2\"><b>";
             echo get_string("users").":";
             echo "</b></td><td colspan=\"2\">";
-            $user_options[0] = get_string("all");
+            if (has_capability('moodle/site:backup', get_context_instance(CONTEXT_SYSTEM))) {
+                $user_options[0] = get_string("all");
+            }
             $user_options[1] = get_string("course");
             $user_options[2] = get_string("none");
             choose_from_menu($user_options, "backup_users", $backup_users, "");
             echo "</td></tr>";
         }
         else {
-            $hidden_options .= '<input type="hidden" name="backup_users" value="0" />';
+            $hidden_options .= '<input type="hidden" name="backup_users" value="2" />';
         }
-        
-        if (empty($to)) {
+
+        if (empty($to) and $backupuserinfo) {
             //Now print the Logs tr
             echo "<tr>";
             echo "<td align=\"right\" colspan=\"2\"><b>";
@@ -237,8 +250,8 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         else {
             $hidden_options .= '<input type="hidden" name="backup_logs" value="0" />';
         }
- 
-        if (empty($to)) {
+
+        if (empty($to) and $backupuserinfo) {
             //Now print the User Files tr
             echo "<tr>";
             echo "<td align=\"right\" colspan=\"2\"><b>";
@@ -262,7 +275,7 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         choose_from_menu($course_file_options, "backup_course_files", $backup_course_files, "");
         echo "</td></tr>";
 
-        if (empty($to) && $course->id == SITEID) {
+        if (empty($to) and $backupuserinfo and $course->id == SITEID) {
             //If we are in a SITEID backup print the Messages tr
             echo "<tr>";
             echo "<td align=\"right\" colspan=\"2\"><b>";

backup/backuplib.php

@@ -82,8 +82,8 @@
 
     //Returns every needed user (participant) in a course
     //It uses the xxxx_get_participants() function
-    //plus users needed to backup scales.
-    //WARNING: It returns only NEEDED users, not every 
+    //plus users needed to backup messages
+    //WARNING: It returns only NEEDED users, not every
     //   every student and teacher in the course, so it
     //must be merged with backup_get_enrrolled_users !!
 
@@ -119,21 +119,6 @@
             }
         }
 
-        //Now, add scale users (from site and course scales)
-        //Get users
-        $scaleusers = get_records_sql("SELECT DISTINCT userid,userid
-                                       FROM {$CFG->prefix}scale
-                                       WHERE courseid = '0' or courseid = '$courseid'");
-        //Add scale users to results
-        if ($scaleusers) {
-            foreach ($scaleusers as $scaleuser) {
-                //If userid != 0
-                if ($scaleuser->userid != 0) {
-                    $result[$scaleuser->userid]->id = $scaleuser->userid;
-                }
-            }
-        }
-
         //Now, add message users if necessary
         if ($includemessages) {
             include_once("$CFG->dirroot/message/lib.php");
@@ -163,7 +148,7 @@
         // get all users with moodle/course:view capability, this will include people
         // assigned at cat level, or site level
         // but it should be ok if they have no direct assignment at course, mod, block level
-        return get_users_by_capability(get_context_instance(CONTEXT_COURSE, $courseid), 'moodle/course:view');
+        return get_users_by_capability(get_context_instance(CONTEXT_COURSE, $courseid), 'moodle/course:view', '', '', '', '', '', '', false);
     }
 
     //Returns all users ids (every record in users table)
@@ -1102,7 +1087,11 @@
                 fwrite ($bf,full_tag("POLICYAGREED",4,false,$user->policyagreed));
                 fwrite ($bf,full_tag("DELETED",4,false,$user->deleted));
                 fwrite ($bf,full_tag("USERNAME",4,false,$user->username));
-                fwrite ($bf,full_tag("PASSWORD",4,false,$user->password));
+                // Prevent user passwords in backup files unless
+                // $CFG->includeuserpasswordsinbackup is defined. MDL-20838
+                if (!empty($CFG->includeuserpasswordsinbackup)) {
+                    fwrite ($bf,full_tag("PASSWORD",4,false,$user->password));
+                }
                 fwrite ($bf,full_tag("IDNUMBER",4,false,$user->idnumber));
                 fwrite ($bf,full_tag("FIRSTNAME",4,false,$user->firstname));
                 fwrite ($bf,full_tag("LASTNAME",4,false,$user->lastname));
@@ -1128,7 +1117,6 @@
                 fwrite ($bf,full_tag("LASTLOGIN",4,false,$user->lastlogin));
                 fwrite ($bf,full_tag("CURRENTLOGIN",4,false,$user->currentlogin));
                 fwrite ($bf,full_tag("LASTIP",4,false,$user->lastip));
-                fwrite ($bf,full_tag("SECRET",4,false,$user->secret));
                 fwrite ($bf,full_tag("PICTURE",4,false,$user->picture));
                 fwrite ($bf,full_tag("URL",4,false,$user->url));
                 fwrite ($bf,full_tag("DESCRIPTION",4,false,$user->description));

backup/restore.php

@@ -144,6 +144,7 @@
         if (!empty($SESSION->restore->importing)) {
             // set up all the config stuff and skip asking the user about it.
             restore_setup_for_check($SESSION->restore,$backup_unique_code);
+            require_sesskey();
             include_once("restore_execute.html");
         } else {
             include_once("restore_form.html");
@@ -159,6 +160,7 @@
         }
         //Unset this for the future
         unset($SESSION->cancontinue);
+        require_sesskey();
         include_once("restore_execute.html");
     }
     print_simple_box_end();

backup/restore_check.html

@@ -18,8 +18,8 @@
 
     if ($form1 = data_submitted()) {
         $currentcourseshortname = $course_header->course_shortname; //"store_ShortName";
-        $course_header->course_shortname =  stripslashes_safe($form1->shortname);  //"update_ShortName";    
-        $course_header->course_fullname =   stripslashes_safe($form1->fullname);   //"update_FullName";  
+        $course_header->course_shortname = !empty($form1->shortname) ? stripslashes_safe($form1->shortname) : '';  //"update_ShortName";
+        $course_header->course_fullname  = !empty($form1->fullname) ? stripslashes_safe($form1->fullname) : '';   //"update_FullName"
     /// Roll dates only if the backup course has a start date
     /// (some formats like main page, social..., haven't it and rolling dates
     /// from 0 produces crazy dates. MDL-10125 and we have passed some custom startyear/month/day. MDL-12922
@@ -176,15 +176,21 @@
     //Check login
     require_login();
 
+    //Init restoreuserinfo
+    $restoreuserinfo = false;
+
+
     //Check admin
     if (!empty($id)) {
         if (!has_capability('moodle/site:restore', get_context_instance(CONTEXT_COURSE, $id))) {
             error("You need to be a teacher or admin user to use this page.", "$CFG->wwwroot/login/index.php");
         }
+        $restoreuserinfo = has_capability('moodle/restore:userinfo', get_context_instance(CONTEXT_COURSE, $id));
     } else {
         if (!has_capability('moodle/site:restore', get_context_instance(CONTEXT_SYSTEM, SITEID))) {
             error("You need to be an admin user to use this page.", "$CFG->wwwroot/login/index.php");
         }
+        $restoreuserinfo = has_capability('moodle/restore:userinfo', get_context_instance(CONTEXT_SYSTEM));
     }
 
     //Check site
@@ -275,6 +281,38 @@
                 $restore->users = 1;
             }
         }
+
+        // Re-enforce 'moodle/site:restore' at system context to be able to restore all users
+        if ($restore->users == 0 and !has_capability('moodle/site:restore', get_context_instance(CONTEXT_SYSTEM))) {
+            $restore->users = 1; // users => course
+        }
+
+        // Re-enforce moodle/restore:userinfo capability
+        if (!$restoreuserinfo) {
+            $userinfocheck = true;
+            // Confirm that all the settings are properly set to no users
+            // if anything is wrong, message and stop
+            // First global settings
+            if ($restore->users != 2 or $restore->user_files or $restore->messages) {
+                $userinfocheck = false;
+
+            // Now all modules userinfo flag
+            } else {
+                $mods = $restore->mods;
+                foreach ($mods as $mod) {
+                    if ($mod->userinfo) {
+                        $userinfocheck = false;
+                    }
+                }
+            }
+
+            if (!$userinfocheck) { // Something was wrong
+                echo get_string ('restoreuserinfofailed');
+                echo "<hr noshade size=\"1\">";
+                $show_continue_button = false;
+            }
+        }
+
         //Save the restore session object
         $SESSION->restore = $restore;
         if ($show_continue_button) {
@@ -284,6 +322,7 @@
             $hidden["launch"]             = "execute";
             $hidden["file"]               =  $file;
             $hidden["id"]                 =  $id;
+            $hidden["sesskey"]            =  sesskey();
             print_string('longtimewarning','admin');
 
             if ($restore->users && !empty($info->mnet_externalusers) 

backup/restore_form.html

@@ -21,15 +21,20 @@
     //Check login
     require_login();
 
+    //Init restoreuserinfo
+    $restoreuserinfo = false;
+
     //Check admin
     if (!empty($id)) {
         if (!has_capability('moodle/site:restore', get_context_instance(CONTEXT_COURSE, $id))) {
             error("You need to be a teacher or admin user to use this page.", "$CFG->wwwroot/login/index.php");
         }
+        $restoreuserinfo = has_capability('moodle/restore:userinfo', get_context_instance(CONTEXT_COURSE, $id));
     } else {
         if (!has_capability('moodle/site:restore', get_context_instance(CONTEXT_SYSTEM, SITEID))) {
             error("You need to be an admin user to use this page.", "$CFG->wwwroot/login/index.php");   
         }
+        $restoreuserinfo = has_capability('moodle/restore:userinfo', get_context_instance(CONTEXT_SYSTEM));
     }
 
     //Check site
@@ -60,8 +65,10 @@
             }
             //Check include user info
             $var = "restore_user_info_".$modname;
-            if (!isset($$var)) {
+            if (!isset($$var) && $restoreuserinfo) {
                 $$var = 1;
+            } else {
+                $$var = 0;
             }
         }
     }
@@ -274,14 +281,18 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'restore_', false);\">".
              get_string("none")."</a>";
         echo "</td>";
-        echo "<td align=\"right\">";
-        echo '<b>&nbsp;</b>';
-        echo "</td><td>";
-        echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'restore_user_info_', true);\">".
-             get_string("all")."</a>/";
-        echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'restore_user_info_', false);\">".
-             get_string("none")."</a>";
-        echo "</td>";
+        if ($restoreuserinfo) {
+            echo "<td align=\"right\">";
+            echo '<b>&nbsp;</b>';
+            echo "</td><td>";
+            echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'restore_user_info_', true);\">".
+                 get_string("all")."</a>/";
+            echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'restore_user_info_', false);\">".
+                 get_string("none")."</a>";
+            echo "</td>";
+        } else {
+            echo "<td colspan=\"2\">&nbsp;</td>";
+        }
         echo "</tr>";
         echo "<tr><td colspan=\"4\"><hr /></td></tr>";
         $currentrow = 0;
@@ -311,7 +322,7 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
                         //without user data
                         echo "</td><td align=\"right\">&nbsp;";
                         echo "</td><td>";
-                        if ($info->mods[$modname]->userinfo == "true") {
+                        if ($info->mods[$modname]->userinfo == "true" && $restoreuserinfo) {
                             $restore_user_options[1] = get_string("yes");
                             $restore_user_options[0] = get_string("no"); 
                             //choose_from_menu($restore_user_options, $user_info_var, $$user_info_var, "");
@@ -336,7 +347,7 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
                                 echo '</td><td align="right">&nbsp;';
                                 $var = 'restore_user_info_'.$modname.'_instance_'.$instance->id;
                                 $$var = optional_param($var,1);
-                                if ($info->mods[$modname]->instances[$instance->id]->userinfo == 'true') {
+                                if (!empty($info->mods[$modname]->instances) && ($info->mods[$modname]->instances[$instance->id]->userinfo == 'true') && $restoreuserinfo) {
                                     print_checkbox($var,$$var,$$var,get_string('userdata'),'','this.form.elements[\'restore_user_info_'.$modname.'\'].checked=1;');
                                 } else {
                                     echo '<input type="hidden" name="'.$var.'" value="0" />';
@@ -386,9 +397,10 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         echo get_string("users").":";
         echo "</b></td><td colspan=\"2\">";
         //If some user is present in the backup file
-        if ($info->backup_users == "all" or $info->backup_users == "course") {
-            //If all users are in the backup file
-            if ($info->backup_users == "all") {
+        if (($info->backup_users == "all" or $info->backup_users == "course") and $restoreuserinfo) {
+            $user_options = array();
+            //If all users are in the backup file and user has 'moodle/site:restore' at system level
+            if ($info->backup_users == "all" and has_capability('moodle/site:restore', get_context_instance(CONTEXT_SYSTEM))) {
                 $user_options[0] = get_string("all");
             }
             $user_options[1] = get_string("course");
@@ -407,7 +419,8 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         echo get_string("logs").":";                                               
         echo "</b></td><td colspan=\"2\">";
         //If logs are in the backup file, show menu, else fixed to no
-        if ($info->backup_logs == "true") {
+        if ($info->backup_logs == "true" and $restoreuserinfo) {
+            $log_options = array();
             $log_options[0] = get_string("no");
             $log_options[1] = get_string("yes"); 
             choose_from_menu($log_options, "restore_logs", $restore_logs, ""); 
@@ -423,9 +436,10 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         echo get_string ("userfiles").":";
         echo "</b></td><td colspan=\"2\">";
         //If user files are in the backup file, show menu, else fixed to no
-        if ($info->backup_user_files == "true") {
-            $user_file_options[0] = get_string("no"); 
-            $user_file_options[1] = get_string("yes"); 
+        if ($info->backup_user_files == "true" and $restoreuserinfo) {
+            $user_file_options = array();
+            $user_file_options[0] = get_string("no");
+            $user_file_options[1] = get_string("yes");
             choose_from_menu($user_file_options, "restore_user_files", $restore_user_files, "");
         } else {
             echo get_string("no");
@@ -454,11 +468,10 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         //Now print the Messages tr
         echo "<tr>";
         echo "<td align=\"right\" colspan=\"2\"><b>";
-        
         //This tr is slighty different. Everything becomes hidden if
         //we haven't messages is the backup, to avoid confusions to users.
         //If messages are in the backup file, show menu, else fixed to no and show nothing
-        if ($info->backup_messages == "true") {
+        if (isset($info->backup_messages) && $info->backup_messages == "true" && !empty($CFG->messaging) and $restoreuserinfo) {
             echo get_string ('messages','message').":";
             echo "</b></td><td colspan=\"2\">";
             $message_options[0] = get_string("no");
@@ -475,104 +488,106 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
 
 <hr/>
 <?php
+// Only show the roles mapping if restore of user info is allowed
+if ($restoreuserinfo) {
+    print_heading(get_string('rolemappings'));
+    $xml_file  = $CFG->dataroot."/temp/backup/".$backup_unique_code."/moodle.xml";
 
-print_heading(get_string('rolemappings'));
-$xml_file  = $CFG->dataroot."/temp/backup/".$backup_unique_code."/moodle.xml";
+    $info = restore_read_xml_info($xml_file);
 
-$info = restore_read_xml_info($xml_file);
+    // fix for MDL-9068, front page course is just a normal course
+    $siterolesarray = get_assignable_roles (get_context_instance(CONTEXT_COURSE, $course->id), "shortname");
+    $siterolesnamearray = get_assignable_roles (get_context_instance(CONTEXT_COURSE, $course->id), "name");
+    $allroles = get_records('role');
 
-// fix for MDL-9068, front page course is just a normal course
-$siterolesarray = get_assignable_roles (get_context_instance(CONTEXT_COURSE, $course->id), "shortname");
-$siterolesnamearray = get_assignable_roles (get_context_instance(CONTEXT_COURSE, $course->id), "name");
-$allroles = get_records('role');
+    echo ('<table width="100%" class="restore-form-instances">');
+    echo ('<tr><td align="right" style="width:50%"><b>'.get_string('sourcerole').'</b></td><td align="left" style="width:50%"><b>'.get_string('targetrole').'</b></td></tr>');
 
-echo ('<table width="100%" class="restore-form-instances">');
-echo ('<tr><td align="right" style="width:50%"><b>'.get_string('sourcerole').'</b></td><td align="left" style="width:50%"><b>'.get_string('targetrole').'</b></td></tr>');
+    if ($info->backup_moodle_version < 2006092801) {
+        // 1.6 and below backup
 
-if ($info->backup_moodle_version < 2006092801) {
-    // 1.6 and below backup
-    
-    /// Editting teacher
-    echo ('<tr><td align="right">');
-    print_string('defaultcourseteacher');
-    echo ('</td><td algin="left">');
-    
-    // get the first teacheredit legacy
-    $roles = get_roles_with_capability('moodle/legacy:editingteacher', CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM, SITEID));
+        /// Editting teacher
+        echo ('<tr><td align="right">');
+        echo '<label for="menudefaultteacheredit">'.get_string ('defaultcourseteacher').'</label>';
+        echo ('</td><td algin="left">');
 
-    $editteacher = array_shift($roles);
-    choose_from_menu ($siterolesarray, "defaultteacheredit", $editteacher->id, 'new role', '', '0');
-    echo ('</td></tr>');
-    
-    /// Non-editting teacher
-    echo ('<tr><td align="right">');
-    print_string('noneditingteacher');
-    echo ('</td><td algin="left">');
-    
-    // get the first teacheredit legacy
-    $roles = get_roles_with_capability('moodle/legacy:teacher', CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM, SITEID));
-    $teacher = array_shift($roles);
-    
-    choose_from_menu ($siterolesarray, "defaultteacher", $teacher->id, 'new role', '', '0');
-    echo ('</td></tr>');
-     
-    
-    /// Student
-    echo ('<tr><td align="right">');
-    print_string('defaultcoursestudent');
-    echo ('</td><td algin="left">');
-    
-    // get the first teacheredit legacy
-    $roles = get_roles_with_capability('moodle/legacy:student', CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM, SITEID));
-    $studentrole = array_shift($roles);
-    
-    choose_from_menu ($siterolesarray, "defaultstudent", $studentrole->id, 'new role', '', '0');
-    echo ('</td></tr>');
-  
-} else {
-    // 1.7 and above backup
-    $roles = restore_read_xml_roles($xml_file);
-    
-    if (!empty($roles->roles)) { // possible to have course with no roles
-        foreach ($siterolesarray as $siteroleid=>$siteroleshortname) {
-            $siteroleschoicearray[$siteroleid] = $siterolesnamearray[$siteroleid]." (". $siterolesarray[$siteroleid].")";
-        }
+        // get the first teacheredit legacy
+        $roles = get_roles_with_capability('moodle/legacy:editingteacher', CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM));
 
-        foreach ($roles->roles as $roleid=>$role) {
-         
-            $mappableroles = $siteroleschoicearray;
-         
-            echo ('<tr><td align="right">');
-            echo $role->name." (".($role->shortname).")";
-            echo ('</td><td align="left">');
+        $editteacher = reset($roles);
+        choose_from_menu ($siterolesarray, "defaultteacheredit", $editteacher->id, 'new role', '', '0');
+        echo ('</td></tr>');
 
-            /// first, we see if any exact role definition is found
-            /// if found, that is the only option of restoring to
-            
-            if ($samerole = restore_samerole($roleid, $role)) {
-                $matchrole = $samerole->id;
-                // if an exact role is found, it does not matter whether this user can assign this role or not,
-                // this will be presented as a valid option regardless
-                $mappableroles[$samerole->id] = $allroles[$samerole->id]->name." (". $allroles[$samerole->id]->shortname.")";
-            } else {
-                // no exact role found, let's try to match shortname
-                // this is useful in situations where basic roles differ slightly in definition
-                $matchrole = 0;
-                foreach ($siterolesarray as $siteroleid=>$siteroleshortname) {
-                    if ($siteroleshortname == $role->shortname) {
-                        $matchrole = $siteroleid;
-                        break;
+        /// Non-editting teacher
+        echo ('<tr><td align="right">');
+        echo '<label for="menudefaultteacher">'.get_string ('noneditingteacher').'</label>';
+        print_string('noneditingteacher');
+        echo ('</td><td algin="left">');
+
+        // get the first teacheredit legacy
+        $roles = get_roles_with_capability('moodle/legacy:teacher', CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM));
+        $teacher = reset($roles);
+
+        choose_from_menu ($siterolesarray, "defaultteacher", $teacher->id, 'new role', '', '0');
+        echo ('</td></tr>');
+
+
+        /// Student
+        echo ('<tr><td align="right">');
+        echo '<label for="menudefaultstudent">'.get_string ('defaultcoursestudent').'</label>';
+        echo ('</td><td algin="left">');
+
+        // get the first teacheredit legacy
+        $roles = get_roles_with_capability('moodle/legacy:student', CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM));
+        $studentrole = array_shift($roles);
+
+        choose_from_menu ($siterolesarray, "defaultstudent", $studentrole->id, 'new role', '', '0');
+        echo ('</td></tr>');
+
+    } else {
+        // 1.7 and above backup
+        $roles = restore_read_xml_roles($xml_file);
+
+        if (!empty($roles->roles)) { // possible to have course with no roles
+            foreach ($siterolesarray as $siteroleid=>$siteroleshortname) {
+                $siteroleschoicearray[$siteroleid] = $siterolesnamearray[$siteroleid]." (". $siterolesarray[$siteroleid].")";
+            }
+
+            foreach ($roles->roles as $roleid=>$role) {
+
+                $mappableroles = $siteroleschoicearray;
+
+                echo ('<tr><td align="right">');
+                echo '<label for="menuroles_'.$roleid.'">'.format_string($role->name)." (".($role->shortname).")".'</label>';
+                echo ('</td><td align="left">');
+
+                /// first, we see if any exact role definition is found
+                /// if found, that is the only option of restoring to
+
+                if ($samerole = restore_samerole($roleid, $role)) {
+                    $matchrole = $samerole->id;
+                    // if an exact role is found, it does not matter whether this user can assign this role or not,
+                    // this will be presented as a valid option regardless
+                    $mappableroles[$samerole->id] = format_string($allroles[$samerole->id]->name)." (". $allroles[$samerole->id]->shortname.")";
+                } else {
+                    // no exact role found, let's try to match shortname
+                    // this is useful in situations where basic roles differ slightly in definition
+                    $matchrole = 0;
+                    foreach ($siterolesarray as $siteroleid=>$siteroleshortname) {
+                        if ($siteroleshortname == $role->shortname) {
+                            $matchrole = $siteroleid;
+                            break;
+                        }
                     }
                 }
+                choose_from_menu ($mappableroles, "roles_".$roleid, $matchrole, 'new role', '', '0');
+                echo ('</td></tr>');
             }
-            choose_from_menu ($mappableroles, "roles_".$roleid, $matchrole, 'new role', '', '0');
-            echo ('</td></tr>');
         }
-    }
-    
-} // end else
 
-echo ('</table>'); // end of role mappings table
+    } // end else
+    echo ('</table>'); // end of role mappings table
+}
 
 ?>
 <br />
@@ -588,8 +603,10 @@ echo ('</table>'); // end of role mappings table
 
 <?php
 
-/* 
- * If there is a role with exactly the same definition, we pull it out from db
+/**
+ *
+ * @param integer $roleid the id that the role in the backup files had on the old server.
+ * @param object $role the rest of the definition of the role from the backup file.
  */
 function restore_samerole($roleid, $role) {
     global $CFG;

backup/restorelib.php

@@ -1544,6 +1544,8 @@
 
         global $CFG, $db;
 
+        $authcache = array(); // Cache to get some bits from authentication plugins
+
         $status = true;
         //Check it exists
         if (!file_exists($xml_file)) {
@@ -1677,16 +1679,46 @@
                     }
 
                     //We need to analyse the AUTH field to recode it:
-                    //   - if the field isn't set, we are in a pre 1.4 backup and we'll 
-                    //     use manual
-
-                    if (empty($user->auth)) {
+                    //   - if the field isn't set, we are in a pre 1.4 backup and $CFG->registerauth will decide
+                    //   - if the auth isn't enabled in target site, $CFG->registerauth will decide
+                    //   - finally, if the auth resulting isn't enabled, default to 'manual'
+                    if (empty($user->auth) || !is_enabled_auth($user->auth)) {
                         if ($CFG->registerauth == 'email') {
                             $user->auth = 'email';
                         } else {
                             $user->auth = 'manual';
                         }
                     }
+                    if (!is_enabled_auth($user->auth)) { // Final auth check verify, default to manual if not enabled
+                        $user->auth = 'manual';
+                    }
+
+                    // Now that we know the auth method, for users to be created without pass
+                    // if password handling is internal and reset password is available
+                    // we set the password to "restored" (plain text), so the login process
+                    // will know how to handle that situation in order to allow the user to
+                    // recover the password. MDL-20846
+                    if (empty($user->password)) { // Only if restore comes without password
+                        if (!array_key_exists($user->auth, $authcache)) { // Not in cache
+                            $userauth = new stdClass();
+                            $authplugin = get_auth_plugin($user->auth);
+                            $userauth->preventpassindb = $authplugin->prevent_local_passwords();
+                            $userauth->isinternal      = $authplugin->is_internal();
+                            $userauth->canresetpwd     = $authplugin->can_reset_password();
+                            $authcache[$user->auth] = $userauth;
+                        } else {
+                            $userauth = $authcache[$user->auth]; // Get from cache
+                        }
+
+                        // Most external plugins do not store passwords locally
+                        if (!empty($userauth->preventpassindb)) {
+                            $user->password = 'not cached';
+
+                        // If Moodle is responsible for storing/validating pwd and reset functionality is available, mark
+                        } else if ($userauth->isinternal and $userauth->canresetpwd) {
+                            $user->password = 'restored';
+                        }
+                    }
 
                     //We need to process the POLICYAGREED field to recalculate it:
                     //    - if the destination site is different (by wwwroot) reset it.
@@ -2157,7 +2189,7 @@
     //This function creates all the scales
     function restore_create_scales($restore,$xml_file) {
 
-        global $CFG, $db;
+        global $CFG, $USER, $db;
 
         $status = true;
         //Check it exists
@@ -2173,16 +2205,11 @@
         //Now, if we have anything in scales, we have to restore that
         //scales
         if ($scales) {
-            //Get admin->id for later use
-            $admin = get_admin();
-            $adminid = $admin->id;
             if ($scales !== true) {
                 //Iterate over each scale
                 foreach ($scales as $scale) {
                     //Get record from backup_ids
                     $data = backup_getid($restore->backup_unique_code,"scale",$scale->id);
-                    //Init variables
-                    $create_scale = false;
 
                     if ($data) {
                         //Now get completed xmlized object
@@ -2199,42 +2226,45 @@
                         $sca->description = backup_todb($info['SCALE']['#']['DESCRIPTION']['0']['#']);
                         $sca->timemodified = backup_todb($info['SCALE']['#']['TIMEMODIFIED']['0']['#']);
 
-                        //Now search if that scale exists (by scale field) in course 0 (Standar scale)
-                        //or in restore->course_id course (Personal scale)
-                        if ($sca->courseid == 0) {
-                            $course_to_search = 0;
-                        } else {
-                            $course_to_search = $restore->course_id;
-                        }
-                        $sca_db = get_record("scale","scale",$sca->scale,"courseid",$course_to_search);
-                        //If it doesn't exist, create
-                        if (!$sca_db) {
-                            $create_scale = true;
-                        } 
-                        //If we must create the scale
-                        if ($create_scale) {
-                            //Me must recode the courseid if it's <> 0 (common scale)
-                            if ($sca->courseid != 0) {
-                                $sca->courseid = $restore->course_id;
-                            }
-                            //We must recode the userid
+                        // Look for scale (by 'scale' both in standard (course=0) and current course
+                        // with priority to standard scales (ORDER clause)
+                        // scale is not course unique, use get_record_sql to suppress warning
+                        // Going to compare LOB columns so, use the cross-db sql_compare_text() in both sides.
+                        $compare_scale_clause = sql_compare_text('scale')  . "=" .  sql_compare_text("'" . $sca->scale . "'");
+                        // Scale doesn't exist, create it
+                        if (!$sca_db = get_record_sql("SELECT *
+                                                         FROM {$CFG->prefix}scale
+                                                        WHERE $compare_scale_clause
+                                                          AND courseid IN (0, $restore->course_id)
+                                                     ORDER BY courseid", true)) {
+
+                            // Try to recode the user field, defaulting to current user if not found
                             $user = backup_getid($restore->backup_unique_code,"user",$sca->userid);
                             if ($user) {
                                 $sca->userid = $user->new_id;
                             } else {
-                                //Assign it to admin
-                                $sca->userid = $adminid;
+                                $sca->userid = $USER->id;
+                            }
+                            // If course scale, recode the course field
+                            if ($sca->courseid != 0) {
+                                $sca->courseid = $restore->course_id;
+                            }
+                            // If scale is standard, if user lacks perms to manage standar scales
+                            // 'downgrade' them to course scales
+                            if ($sca->courseid == 0 and !has_capability('moodle/course:managescales', get_context_instance(CONTEXT_SYSTEM), $sca->userid)) {
+                                $sca->courseid = $restore->course_id;
                             }
                             //The structure is equal to the db, so insert the scale
                             $newid = insert_record ("scale",$sca);
+
+                        // Scale exists, reuse it
                         } else {
-                            //get current scale id
                             $newid = $sca_db->id;
                         }
+
                         if ($newid) {
                             //We have the newid, update backup_ids
-                            backup_putid($restore->backup_unique_code,"scale",
-                                         $scale->id, $newid);
+                            backup_putid($restore->backup_unique_code,"scale", $scale->id, $newid);
                         }
                     }
                 }
@@ -4838,9 +4868,6 @@
                         case "LASTIP": 
                             $this->info->tempuser->lastip = $this->getContents();
                             break;
-                        case "SECRET": 
-                            $this->info->tempuser->secret = $this->getContents();
-                            break;
                         case "PICTURE": 
                             $this->info->tempuser->picture = $this->getContents();
                             break;
@@ -5816,7 +5843,9 @@
             }
             else {
                 if (empty($noredirect)) {
-                    redirect($CFG->wwwroot.'/backup/restore.php?backup_unique_code='.$backup_unique_code.'&launch=form&file='.$file.'&id='.$id);
+                    print_continue($CFG->wwwroot.'/backup/restore.php?backup_unique_code='.$backup_unique_code.'&launch=form&file='.$file.'&id='.$id.'&sesskey='.sesskey());
+                    print_footer();
+                    die;                    
                 } else {
                     return $backup_unique_code;
                 }

backup/version.php

@@ -2,11 +2,11 @@
 
 /// This file defines the current version of the
 /// backup/restore code that is being used.  This can be
-/// compared against the values stored in the 
+/// compared against the values stored in the
 /// database (backup_version) to determine whether upgrades should
 /// be performed (see db/backup_*.php)
 
-    $backup_version = 2007022100;   // The current version is a date (YYYYMMDDXX)
-    $backup_release = "1.8+";       // User-friendly version number
+    $backup_version = 2007022101;   // The current version is a date (YYYYMMDDXX)
+    $backup_release = "1.8.11";       // User-friendly version number
 
 ?>

blog/edit.php

@@ -111,8 +111,8 @@ switch ($action) {
             error('Incorrect blog post id');
         }
         $post->id           = $existing->id;
-        $post->subject      = $existing->subject;
-        $post->summary      = $existing->summary;
+        $post->subject      = clean_text($existing->subject);
+        $post->summary      = clean_text($existing->summary, $existing->format);
         $post->publishstate = $existing->publishstate;
         $post->format       = $existing->format;
         $post->action       = $action;

blog/lib.php

@@ -657,17 +657,20 @@
 
 
     /// Find the base url from $_GET variables, for print_paging_bar
+    /// WARNING:  EVIL EVIL EVIL!  This function directly acesses $_GET which is a big no no. MDL-22631
+    /// I added some clean_param() calls for now but $_GET should just not ever be used directly.  
+    /// The function is totally gone in Moodle 2.0.
     function get_baseurl($filtertype, $filterselect) {
 
-        $getcopy  = $_GET;
-
-        unset($getcopy['blogpage']);
+        unset($_GET['blogpage']);
 
         $strippedurl = strip_querystring(qualified_me());
-        if(!empty($getcopy)) {
+        if(!empty($_GET)) {
             $first = false;
             $querystring = '';
-            foreach($getcopy as $var => $val) {
+            foreach($_GET as $var => $val) {
+                $var = clean_param($var, PARAM_ALPHANUM);   // See MDL-22631
+                $val = clean_param($val, PARAM_CLEAN);
                 if(!$first) {
                     $first = true;
                     if ($var != 'filterselect' && $var != 'filtertype') {
@@ -678,8 +681,8 @@
                     }
                 } else {
                     if ($var != 'filterselect' && $var != 'filtertype') {
-                    $querystring .= '&'.$var.'='.$val;
-                    $hasparam = true;
+                        $querystring .= '&'.$var.'='.$val;
+                        $hasparam = true;
                     }
                 }
             }

blog/preferences.html

@@ -8,6 +8,7 @@
 <tr>
     <td colspan="2" align="center">
     <input type="hidden" name="courseid" value="<?php echo $courseid; ?>" />
+    <input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
     <input type="submit" value="<?php print_string("savechanges"); ?>" />
     <input type="button" value="<?php print_string('cancel'); ?>" onclick="javascript:history.go(-1)" /></td>
 </tr>

blog/preferences.php

@@ -22,7 +22,7 @@
 
 /// If data submitted, then process and store.
 
-    if (data_submitted()) {
+    if (data_submitted() and confirm_sesskey()) {
         $pagesize = required_param('pagesize', PARAM_INT);
 
         if ($pagesize < 1) {

calendar/event.php

@@ -123,7 +123,7 @@
                 error('You are not authorized to do this');
             }
 
-            if($form = data_submitted()) {
+            if($form = data_submitted() and confirm_sesskey()) {
 
                 $form->name = clean_param(strip_tags($form->name,'<lang><span>'), PARAM_CLEAN);
 
@@ -188,7 +188,7 @@
         case 'new':
             $title = get_string('newevent', 'calendar');
             $form = data_submitted();
-            if(!empty($form) && !empty($form->name)) {
+            if(!empty($form) && !empty($form->name) && confirm_sesskey()) {
 
                 $form->name = clean_text(strip_tags($form->name, '<lang><span>'));
 
@@ -286,7 +286,7 @@
         case 'delete':
             $confirm = optional_param('confirm', 0, PARAM_INT);
             $repeats = optional_param('repeats', 0, PARAM_INT);
-            if($confirm) {
+            if($confirm and confirm_sesskey()) {
                 // Kill it and redirect to day view
                 if(($event = get_record('event', 'id', $eventid)) !== false) {
 
@@ -334,9 +334,9 @@
 
         case 'edit':
             if(empty($form)) {
-                $form->name = $event->name;
+                $form->name = clean_text($event->name);
                 $form->courseid = $event->courseid; // Not to update, but for date validation
-                $form->description = $event->description;
+                $form->description = clean_text($event->description);
                 $form->timestart = $event->timestart;
                 $form->timeduration = $event->timeduration;
                 $form->id = $event->id;

calendar/event_delete.html

@@ -13,6 +13,7 @@
       <input type="hidden" name="confirm" value="1" />
       <input type="hidden" name="repeats" value="0" />
       <input type="hidden" name="course" value="<?php p($urlcourse); ?>" />
+      <input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
       &nbsp;
       </p>
       </form>
@@ -31,6 +32,7 @@
       <input type="hidden" name="confirm" value="1" />
       <input type="hidden" name="repeats" value="1" />
       <input type="hidden" name="course" value="<?php p($urlcourse); ?>" />
+      <input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
       &nbsp;
       </p>
       </form>

calendar/event_edit.html

@@ -89,6 +89,7 @@
 <input type="hidden" name="format" value="<?php echo $form->format; ?>" />
 <input type="hidden" name="action" value="edit" />
 <input type="hidden" name="course" value="<?php p($urlcourse); ?>" />
+<input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
 </p>
 </form>