Releasing 1.8.12

one customization that simply shouldn't be there! Thanks Ralf for detecting it. Grrr

admin/cron.php

@@ -272,7 +272,7 @@
                                                 p.id as prefid 
                                         FROM {$CFG->prefix}user u 
                                              JOIN {$CFG->prefix}user_preferences p ON u.id=p.userid
-                                        WHERE p.name='create_password' AND p.value=1 AND u.email !='' ");
+                                        WHERE p.name='create_password' AND p.value='1' AND u.email !='' ");
 
             foreach ($newusers as $newuserid => $newuser) {
                 $newuser->emailstop = 0; // send email regardless

admin/environment.xml

@@ -80,7 +80,6 @@
         <FEEDBACK>
           <ON_ERROR message="mysql416required" />
         </FEEDBACK>
-        <BYPASS function="bypass_mysql416_reqs" message="mysql416bypassed" />
       </VENDOR>
       <VENDOR name="postgres" version="7.4" />
       <VENDOR name="mssql" version="9.0" />
@@ -140,7 +139,6 @@
         <FEEDBACK>
           <ON_ERROR message="mysql416required" />
         </FEEDBACK>
-        <BYPASS function="bypass_mysql416_reqs" message="mysql416bypassed" />
       </VENDOR>
       <VENDOR name="postgres" version="8.0" />
       <VENDOR name="mssql" version="9.0" />
@@ -218,7 +216,6 @@
         <FEEDBACK>
           <ON_ERROR message="mysql416required" />
         </FEEDBACK>
-        <BYPASS function="bypass_mysql416_reqs" message="mysql416bypassed" />
       </VENDOR>
       <VENDOR name="postgres" version="8.3" />
       <VENDOR name="mssql" version="9.0" />
@@ -275,6 +272,11 @@
           <ON_CHECK message="gdrecommended" />
         </FEEDBACK>
       </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
     </PHP_EXTENSIONS>
     <PHP_SETTINGS>
       <PHP_SETTING name="memory_limit" value="40M" level="required">

admin/lang.php

@@ -586,6 +586,10 @@ function lang_fix_value_before_save($value='') {
     if (ini_get_bool('magic_quotes_sybase')) {          // Unescape escaped sybase quotes
         $value = str_replace("''", "'", $value);
     }
+    // escape all embedded variables
+    $value = str_replace('$', '\$', $value);            // Add slashes for $
+    // unescape placeholders: only $a and $a->something are allowed. All other $variables are left escaped
+    $value = preg_replace('/\\\\\$a($|[^_a-zA-Z0-9\-]|\->[a-zA-Z0-9_]+)/', '$a\\1', $value);
     $value = str_replace("'", "\\'", $value);           // Add slashes for '
     $value = str_replace('"', "\\\"", $value);          // Add slashes for "
     $value = str_replace("%","%%",$value);              // Escape % characters

admin/mnet/adminlib.php

@@ -64,7 +64,7 @@ function mnet_get_functions($type, $parentname) {
         foreach($rpcrecords as $rpc) {
             if (!array_key_exists($rpc->function_name, $methodServiceArray)) {
                 $rpc->enabled = 0;
-                update_record('mnet_rpc', $rpc);
+                update_record('mnet_rpc', addslashes_recursive($rpc));
             }
         }
     }

admin/mnet/delete.php

@@ -31,6 +31,8 @@
         redirect('index.php', get_string('postrequired','mnet') ,7);
     }
 
+    require_sesskey();
+
     if ('verify' == $step) {
         $mnet_peer = new mnet_peer();
         $mnet_peer->set_id($hostid);

admin/mnet/enr_course_enrol.php

@@ -86,9 +86,21 @@
     $mnet_request->set_method('enrol/mnet/enrol.php/course_enrolments');
     $mnet_request->add_param($course->remoteid, 'int');
     $mnet_request->send($mnet_peer);
-    $all_enrolled_users = $mnet_request->response;
-
+    $raw_all_enrolled_users = $mnet_request->response;
     unset($mnet_request);
+
+    $all_enrolled_users = array();
+    if (!empty($raw_all_enrolled_users)) {
+        // Try to repair keying of remote users array, numeric usernames get lost in the fracas
+        foreach ($raw_all_enrolled_users as $username => $userdetails) {
+            if (empty($userdetails['username']) || !is_numeric($username)) {
+                //Not able to repair, or no need to repair
+                $all_enrolled_users[$username] = $userdetails;
+            } else {
+                $all_enrolled_users[$userdetails['username']] = $userdetails;
+            }
+        }
+    }
     
     $select = '';
     $all_enrolled_usernames = '';

admin/mnet/peers.html

@@ -55,6 +55,7 @@ if (empty($CFG->mnet_dispatcher_mode) || $CFG->mnet_dispatcher_mode !== 'strict'
                 <div>
                 <input type="hidden" name="hostid" value="<?php echo $host->id; ?>" />
                 <input type="hidden" name="step" value="verify" />
+                <input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
                 <input type="submit" name="submit" value="<?php print_string('delete'); ?>"/>
                 </div>
             </form>

admin/report/security/lib.php

@@ -42,6 +42,7 @@ function report_security_get_issue_list() {
         'report_security_check_mediafilterswf',
         'report_security_check_openprofiles',
         'report_security_check_google',
+        'report_security_check_passwordsaltmain',
         'report_security_check_configrw',
         'report_security_check_defaultuserrole',
         'report_security_check_guestrole',
@@ -740,3 +741,39 @@ function report_security_check_courserole($detailed=false) {
     return $result;
 }
 
+/**
+ * Checks to see whether a password salt has been defined
+ *
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_passwordsaltmain($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_passwordsaltmain';
+    $result->name    = get_string('check_passwordsaltmain_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+
+    if (empty($CFG->passwordsaltmain)) {
+        $result->status = REPORT_SECURITY_WARNING;
+        $result->info   = get_string('check_passwordsaltmain_warning', 'report_security');
+    } else if ($CFG->passwordsaltmain === 'a_very_long_random_string_of_characters#@6&*1'
+            || trim($CFG->passwordsaltmain) === '' || preg_match('/^([a-z0-9]{0,10})$/i', $CFG->passwordsaltmain)) {
+        $result->status = REPORT_SECURITY_WARNING;
+        $result->info   = get_string('check_passwordsaltmain_weak', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_passwordsaltmain_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $docspath = $CFG->docroot.'/'.str_replace('_utf8', '', current_language()).'/report/security/report_security_check_passwordsaltmain';
+        $result->details = get_string('check_passwordsaltmain_details', 'report_security', $docspath);
+    }
+
+    return $result;
+}

admin/roles/allowassign.php

@@ -24,10 +24,10 @@
 
     $roles = get_all_roles();
 
-    if ($grant = data_submitted()) {
+    if ($grant = data_submitted() and confirm_sesskey()) {
 
         foreach ($grant as $grole => $val) {
-            if ($grole == 'dummy') {
+            if ($grole == 'dummy' or !strpos($grole, '_')) {
                 continue;
             }
 
@@ -82,6 +82,7 @@
     print_table($table);
     echo '<div class="buttons"><input type="submit" value="'.get_string('savechanges').'"/>';
     echo '<input type="hidden" name="dummy" value="1" />'; // this is needed otherwise we do not know a form has been submitted
+    echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
     echo '</div></form>';
 
     admin_externalpage_print_footer($adminroot);

admin/roles/allowoverride.php

@@ -22,10 +22,10 @@
 
     $roles = get_all_roles();
 
-    if ($grant = data_submitted()) {
+    if ($grant = data_submitted() and confirm_sesskey()) {
 
         foreach ($grant as $grole => $val) {
-            if ($grole == 'dummy') {
+            if ($grole == 'dummy' or !strpos($grole, '_')) {
                 continue;
             }
 
@@ -80,6 +80,7 @@
     print_table($table);
     echo '<div class="buttons"><input type="submit" value="'.get_string('savechanges').'"/>';
     echo '<input type="hidden" name="dummy" value="1" />'; // this is needed otherwise we do not know a form has been submitted
+    echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
     echo '</div></form>';
 
     admin_externalpage_print_footer($adminroot);

admin/settings/security.php

@@ -47,6 +47,7 @@ $ADMIN->add('security', $temp);
 // "httpsecurity" settingpage
 $temp = new admin_settingpage('httpsecurity', get_string('httpsecurity', 'admin'));
 $temp->add(new admin_setting_configcheckbox('loginhttps', get_string('loginhttps', 'admin'), get_string('configloginhttps', 'admin'), 0));
+$temp->add(new admin_setting_configtext('excludeoldflashclients', get_string('excludeoldflashclients', 'admin'), get_string('configexcludeoldflashclients', 'admin'), '10.0.12', PARAM_TEXT));
 $ADMIN->add('security', $temp);
 
 

admin/user.php

@@ -114,8 +114,8 @@
             $updateuser->id           = $user->id;
             $updateuser->deleted      = 1;
             $updateuser->username     = addslashes("$user->email.".time());  // Remember it just in case
-            $updateuser->email        = '';               // Clear this field to free it up
-            $updateuser->idnumber     = '';               // Clear this field to free it up
+            $updateuser->email        = md5($user->username); // Store hash of username, useful importing/restoring users
+            $updateuser->idnumber     = '';                   // Clear this field to free it up
             $updateuser->timemodified = time();
             if (update_record('user', $updateuser)) {
                 // Removing a user may have more requirements than just removing their role assignments.

admin/xmldb/actions/XMLDBAction.class.php

@@ -47,6 +47,8 @@ class XMLDBAction {
 
     var $postaction;     //Action to execute at the end of the invoke script
 
+    var $sesskey_protected; // Actions must be protected by sesskey mechanishm
+
     /**
      * Constructor
      */
@@ -72,6 +74,7 @@ class XMLDBAction {
         $this->output    = NULL;
         $this->errormsg  = NULL;
         $this->subaction = NULL;
+        $this->sesskey_protected = true;
     }
 
     /**
@@ -130,13 +133,18 @@ class XMLDBAction {
     }
 
     /**
-     * main invoke method, it simply sets the postaction attribute
-     * if possible
+     * main invoke method, it sets the postaction attribute
+     * if possible and checks sesskey_protected if needed
      */
     function invoke() {
 
         global $SESSION;
 
+    /// Sesskey protection
+        if ($this->sesskey_protected) {
+            require_sesskey();
+        }
+
     /// If we are used any dir, save it in the lastused session object
     /// Some actions can use it to perform positioning
         if ($lastused = optional_param ('dir', NULL, PARAM_PATH)) {

admin/xmldb/actions/check_indexes/check_indexes.class.php

@@ -94,7 +94,7 @@ class check_indexes extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmcheckindexes'] . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=check_indexes&amp;confirmed=yes" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=check_indexes&amp;sesskey=' . sesskey() . '&amp;confirmed=yes" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';
@@ -213,6 +213,10 @@ class check_indexes extends XMLDBAction {
                                 $o.='        </ul>';
                             }
                             $o.='    </li>';
+                        /// Give the script some more time (resetting to current if exists)
+                            if ($currenttl = @ini_get('max_execution_time')) {
+                                @ini_set('max_execution_time',$currenttl);
+                            }
                         }
                         $o.='        </ul>';
                     }

admin/xmldb/actions/delete_field/delete_field.class.php

@@ -77,7 +77,7 @@ class delete_field extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletefield'] . '<br /><br />' . $fieldparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_field&amp;confirmed=yes&amp;postaction=edit_table&amp;field=' . $fieldparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_field&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_table&amp;field=' . $fieldparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_index/delete_index.class.php

@@ -77,7 +77,7 @@ class delete_index extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeleteindex'] . '<br /><br />' . $indexparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_index&amp;confirmed=yes&amp;postaction=edit_table&amp;index=' . $indexparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_index&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_table&amp;index=' . $indexparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_key/delete_key.class.php

@@ -77,7 +77,7 @@ class delete_key extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletekey'] . '<br /><br />' . $keyparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_key&amp;confirmed=yes&amp;postaction=edit_table&amp;key=' . $keyparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_key&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_table&amp;key=' . $keyparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_sentence/delete_sentence.class.php

@@ -77,7 +77,7 @@ class delete_sentence extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletesentence'] . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_sentence&amp;confirmed=yes&amp;postaction=edit_statement&amp;sentence=' . $sentenceparam . '&amp;statement=' . urlencode($statementparam) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_sentence&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_statement&amp;sentence=' . $sentenceparam . '&amp;statement=' . urlencode($statementparam) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_statement/delete_statement.class.php

@@ -76,7 +76,7 @@ class delete_statement extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletestatement'] . '<br /><br />' . $statementparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_statement&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_statement&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_table/delete_table.class.php

@@ -76,7 +76,7 @@ class delete_table extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletetable'] . '<br /><br />' . $tableparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_table&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_table&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_xml_file/delete_xml_file.class.php

@@ -75,7 +75,7 @@ class delete_xml_file extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletexmlfile'] . '<br /><br />' . $dirpath . '/install.php</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_xml_file&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_xml_file&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/edit_field/edit_field.class.php

@@ -35,6 +35,7 @@ class edit_field extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -103,6 +104,7 @@ class edit_field extends XMLDBAction {
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
         $o.= '    <input type="hidden" name ="field" value="' . $fieldparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_field_save" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';

admin/xmldb/actions/edit_index/edit_index.class.php

@@ -35,6 +35,7 @@ class edit_index extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -103,6 +104,7 @@ class edit_index extends XMLDBAction {
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
         $o.= '    <input type="hidden" name ="index" value="' . $indexparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_index_save" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';

admin/xmldb/actions/edit_key/edit_key.class.php

@@ -35,6 +35,7 @@ class edit_key extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -103,6 +104,7 @@ class edit_key extends XMLDBAction {
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
         $o.= '    <input type="hidden" name ="key" value="' . $keyparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_key_save" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';

admin/xmldb/actions/edit_sentence/edit_sentence.class.php

@@ -35,6 +35,7 @@ class edit_sentence extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -119,6 +120,7 @@ class edit_sentence extends XMLDBAction {
             $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
             $o.= '    <input type="hidden" name ="statement" value="' . $statementparam .'" />';
             $o.= '    <input type="hidden" name ="sentence" value="' . $sentenceparam .'" />';
+            $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
             $o.= '    <input type="hidden" name ="action" value="edit_sentence_save" />';
             $o.= '    <input type="hidden" name ="postaction" value="edit_statement" />';
             $o.= '    <table id="formelements" class="boxaligncenter">';

admin/xmldb/actions/edit_statement/edit_statement.class.php

@@ -35,6 +35,7 @@ class edit_statement extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -106,6 +107,7 @@ class edit_statement extends XMLDBAction {
         $o.= '<div>';        
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="statement" value="' . $statementparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_statement_save" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_statement" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';
@@ -129,7 +131,7 @@ class edit_statement extends XMLDBAction {
             $b .= '&nbsp;[' . $this->str['viewedited'] . ']';
         }
     /// The new sentence button
-        $b .= '&nbsp;<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newsentence'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;sesskey=' . sesskey() . '&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newsentence'] . ']</a>';
     /// The back to edit xml file button
         $b .= '&nbsp;<a href="index.php?action=edit_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['back'] . ']</a>';
         $b .= '</p>';
@@ -157,10 +159,10 @@ class edit_statement extends XMLDBAction {
                 $b .= '<a href="index.php?action=edit_sentence&amp;sentence=' .$key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['edit'] . ']</a>';
                 $b .= '</td><td class="button cell">';
             /// The duplicate button
-                $b .= '<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;basesentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['duplicate'] . ']</a>';
+                $b .= '<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;sesskey=' . sesskey() . '&amp;basesentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['duplicate'] . ']</a>';
                 $b .= '</td><td class="button cell">';
             /// The delete button
-                $b .= '<a href="index.php?action=delete_sentence&amp;sentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                $b .= '<a href="index.php?action=delete_sentence&amp;sesskey=' . sesskey() . '&amp;sentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                 $b .= '</td>';
             /// Print table row
             $o .= '<tr class="r' . $row . '"><td class="table cell">' . $p . $sentence . $b . '</tr>';

admin/xmldb/actions/edit_table/edit_table.class.php

@@ -35,6 +35,7 @@ class edit_table extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -107,6 +108,7 @@ class edit_table extends XMLDBAction {
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_table_save" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';
     /// If the table is being used, we cannot rename it
@@ -134,11 +136,11 @@ class edit_table extends XMLDBAction {
             $b .= '&nbsp;[' . $this->str['viewedited'] . ']';
         }
     /// The new field button
-        $b .= '&nbsp;<a href="index.php?action=new_field&amp;postaction=edit_field&amp;table=' . $tableparam . '&amp;field=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newfield'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_field&amp;sesskey=' . sesskey() . '&amp;postaction=edit_field&amp;table=' . $tableparam . '&amp;field=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newfield'] . ']</a>';
     /// The new key button
-        $b .= '&nbsp;<a href="index.php?action=new_key&amp;postaction=edit_key&amp;table=' . $tableparam . '&amp;key=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newkey'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_key&amp;sesskey=' . sesskey() . '&amp;postaction=edit_key&amp;table=' . $tableparam . '&amp;key=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newkey'] . ']</a>';
     /// The new index button
-        $b .= '&nbsp;<a href="index.php?action=new_index&amp;postaction=edit_index&amp;table=' . $tableparam . '&amp;index=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newindex'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_index&amp;sesskey=' . sesskey() . '&amp;postaction=edit_index&amp;table=' . $tableparam . '&amp;index=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newindex'] . ']</a>';
     /// The back to edit xml file button
         $b .= '&nbsp;<a href="index.php?action=edit_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['back'] . ']</a>';
         $b .= '</p>';
@@ -185,14 +187,14 @@ class edit_table extends XMLDBAction {
                 $b .= '</td><td class="button cell">';
             /// The up button
                 if ($field->getPrevious()) {
-                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=up&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['up'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The down button
                 if ($field->getNext()) {
-                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=down&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['down'] . ']';
                 }
@@ -200,7 +202,7 @@ class edit_table extends XMLDBAction {
             /// The delete button (if we have more than one and it isn't used
                 if (count($fields) > 1 &&
                 !$structure->getFieldUses($table->getName(), $field->getName())) {
-                    $b .= '<a href="index.php?action=delete_field&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_field&amp;sesskey=' . sesskey() . '&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['delete'] . ']';
                 }
@@ -234,21 +236,21 @@ class edit_table extends XMLDBAction {
                 $b .= '</td><td class="button cell">';
             /// The up button
                 if ($key->getPrevious()) {
-                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=up&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['up'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The down button
                 if ($key->getNext()) {
-                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=down&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['down'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The delete button (if the key hasn't uses)
                 if (!$structure->getKeyUses($table->getName(), $key->getName())) {
-                    $b .= '<a href="index.php?action=delete_key&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_key&amp;sesskey=' . sesskey() . '&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['delete'] . ']';
                 }
@@ -274,20 +276,20 @@ class edit_table extends XMLDBAction {
                 $b .= '</td><td class="button cell">';
             /// The up button
                 if ($index->getPrevious()) {
-                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=up&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['up'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The down button
                 if ($index->getNext()) {
-                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=down&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['down'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The delete button
-                    $b .= '<a href="index.php?action=delete_index&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_index&amp;sesskey=' . sesskey() . '&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
             /// The readable info
                 $r = '</td><td class="readableinfo cell">' . $index->readableInfo() . '</td>';
             /// Print table row

admin/xmldb/actions/edit_xml_file/edit_xml_file.class.php

@@ -35,6 +35,7 @@ class edit_xml_file extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -107,6 +108,7 @@ class edit_xml_file extends XMLDBAction {
                 $o.= '    <input type="hidden" name ="postaction" value="edit_xml_file" />';
                 $o.= '    <input type="hidden" name ="path" value="' . s($structure->getPath()) .'" />';
                 $o.= '    <input type="hidden" name ="version" value="' . s($structure->getVersion()) .'" />';
+                $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
                 $o.= '    <table id="formelements" class="boxaligncenter">';
                 $o.= '      <tr valign="top"><td>Path:</td><td>' . s($structure->getPath()) . '</td></tr>';
                 $o.= '      <tr valign="top"><td>Version:</td><td>' . s($structure->getVersion()) . '</td></tr>';
@@ -125,15 +127,15 @@ class edit_xml_file extends XMLDBAction {
                     $b .= '&nbsp;[' . $this->str['viewedited'] . ']';
                 }
             /// The new table button
-                $b .= '&nbsp;<a href="index.php?action=new_table&amp;postaction=edit_table&amp;table=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtable'] . ']</a>';
+                $b .= '&nbsp;<a href="index.php?action=new_table&amp;sesskey=' . sesskey() . '&amp;postaction=edit_table&amp;table=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtable'] . ']</a>';
             /// The new from MySQL button
                 if ($CFG->dbfamily == 'mysql') {
-                    $b .= '&nbsp;<a href="index.php?action=new_table_from_mysql&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtablefrommysql'] . ']</a>';
+                    $b .= '&nbsp;<a href="index.php?action=new_table_from_mysql&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtablefrommysql'] . ']</a>';
                 } else {
                     $b .= '&nbsp;[' . $this->str['newtablefrommysql'] . ']';
                 }
             /// The new statement button
-                $b .= '&nbsp;<a href="index.php?action=new_statement&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newstatement'] . ']</a>';
+                $b .= '&nbsp;<a href="index.php?action=new_statement&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newstatement'] . ']</a>';
             /// The back to main menu button
                 $b .= '&nbsp;<a href="index.php?action=main_view#lastused">[' . $this->str['backtomainview'] . ']</a>';
                 $b .= '</p>';
@@ -169,14 +171,14 @@ class edit_xml_file extends XMLDBAction {
                         $b .= '</td><td class="button cell">';
                     /// The up button
                         if ($table->getPrevious()) {
-                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=up&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['up'] . ']';
                         }
                         $b .= '</td><td class="button cell">';
                     /// The down button
                         if ($table->getNext()) {
-                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=down&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['down'] . ']';
                         }
@@ -185,7 +187,7 @@ class edit_xml_file extends XMLDBAction {
                         if (count($tables) > 1 &&
                             !$structure->getTableUses($table->getName())) {
                             ///!$structure->getTableUses($table->getName())) {
-                            $b .= '<a href="index.php?action=delete_table&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                            $b .= '<a href="index.php?action=delete_table&amp;sesskey=' . sesskey() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['delete'] . ']';
                         }
@@ -214,20 +216,20 @@ class edit_xml_file extends XMLDBAction {
                         $b .= '</td><td class="button cell">';
                     /// The up button
                         if ($statement->getPrevious()) {
-                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=up&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['up'] . ']';
                         }
                         $b .= '</td><td class="button cell">';
                     /// The down button
                         if ($statement->getNext()) {
-                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=down&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['down'] . ']';
                         }
                         $b .= '</td><td class="button cell">';
                     /// The delete button
-                        $b .= '<a href="index.php?action=delete_statement&amp;statement=' . $statement->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                        $b .= '<a href="index.php?action=delete_statement&amp;sesskey=' . sesskey() . '&amp;statement=' . $statement->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                         $b .= '</td>';
                     /// Print statement row
                         $o .= '<tr class="r' . $row . '"><td class="statement cell"><a href="index.php?action=view_statement_xml&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;statement=' . $statement->getName() . '&amp;select=edited">' . $statement->getName() . '</a>' . $b . '</tr>';

admin/xmldb/actions/get_db_directories/get_db_directories.class.php

@@ -39,6 +39,7 @@ class get_db_directories extends XMLDBAction {
         //$this->can_subaction = ACTION_HAVE_SUBACTIONS;
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/load_xml_file/load_xml_file.class.php

@@ -38,6 +38,7 @@ class load_xml_file extends XMLDBAction {
         //$this->can_subaction = ACTION_HAVE_SUBACTIONS;
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/main_view/main_view.class.php

@@ -35,6 +35,7 @@ class main_view extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -84,9 +85,9 @@ class main_view extends XMLDBAction {
     /// The reserved_words button
         $b .= '&nbsp;<a href="index.php?action=view_reserved_words">[' . $this->str['reservedwords'] . ']</a>';
     /// The test button
-        $b .= '&nbsp;<a href="index.php?action=test">[' . $this->str['test'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=test&amp;sesskey=' . sesskey() . '">[' . $this->str['test'] . ']</a>';
     /// The check indexes button
-        $b .= '&nbsp;<a href="index.php?action=check_indexes">[' . $this->str['checkindexes'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=check_indexes&amp;sesskey=' . sesskey() . '">[' . $this->str['checkindexes'] . ']</a>';
         $b .= '</p>';
     /// Send buttons to output
         $o .= $b;
@@ -126,7 +127,7 @@ class main_view extends XMLDBAction {
                 if ($dbdir->path_exists &&
                     !file_exists($key . '/install.xml') &&
                     is_writeable($key)) {
-                    $b .= '<a href="index.php?action=create_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['create'] . ']</a>';
+                    $b .= '<a href="index.php?action=create_xml_file&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['create'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['create'] . ']';
                 }
@@ -159,7 +160,7 @@ class main_view extends XMLDBAction {
                     is_writeable($key) &&
                     !empty($dbdir->xml_loaded) &&
                     !empty($dbdir->xml_changed)) {
-                    $b .= '<a href="index.php?action=save_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['save'] . ']</a>';
+                    $b .= '<a href="index.php?action=save_xml_file&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['save'] . ']</a>';
                 /// Check if the file has been manually edited while being modified in the editor
                     if ($dbdir->filemtime != filemtime($key . '/install.xml')) {
                     /// File manually modified. Add to errors.
@@ -178,7 +179,7 @@ class main_view extends XMLDBAction {
                     is_writeable($key) &&
                     !empty($dbdir->xml_loaded) &&
                     !empty($dbdir->xml_changed)) {
-                    $b .= '<a href="index.php?action=revert_changes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['revert'] . ']</a>';
+                    $b .= '<a href="index.php?action=revert_changes&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['revert'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['revert'] . ']';
                 }
@@ -200,7 +201,7 @@ class main_view extends XMLDBAction {
                     is_readable($key . '/install.xml') &&
                     is_writeable($key) &&
                     empty($dbdir->xml_loaded)) {
-                    $b .= '<a href="index.php?action=delete_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_xml_file&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['delete'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['delete'] . ']';
                 }

admin/xmldb/actions/new_statement/new_statement.class.php

@@ -107,6 +107,7 @@ class new_statement extends XMLDBAction {
             $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
             $o.= '    <input type="hidden" name ="action" value="new_statement" />';
             $o.= '    <input type="hidden" name ="postaction" value="edit_statement" />';
+            $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() . '" />';
             $o.= '    <table id="formelements" class="boxaligncenter" cellpadding="5">';
             $o.= '      <tr><td><label for="type" accesskey="t">' . $this->str['statementtype'] .' </label>' . choose_from_menu($typeoptions, 'type', '', 'choose', '', 0, true) . '<label for="table" accesskey="a">' . $this->str['statementtable'] . ' </label>' .choose_from_menu($selecttables, 'table', '', 'choose', '', 0, true) . '</td></tr>';
             $o.= '      <tr><td colspan="2" align="center"><input type="submit" value="' .$this->str['create'] . '" /></td></tr>';

admin/xmldb/actions/new_table_from_mysql/new_table_from_mysql.class.php

@@ -111,6 +111,7 @@ class new_table_from_mysql extends XMLDBAction {
             $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
             $o.= '    <input type="hidden" name ="action" value="new_table_from_mysql" />';
             $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
+            $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() . '" />';
             $o.= '    <table id="formelements" class="boxaligncenter" cellpadding="5">';
             $o.= '      <tr><td><label for="table" accesskey="t">' . $this->str['createtable'] .' </label>' . choose_from_menu($selecttables, 'table', '', 'choose', '', 0, true) . '<label for="after" accesskey="a">' . $this->str['aftertable'] . ' </label>' .choose_from_menu($aftertables, 'after', '', 'choose', '', 0, true) . '</td></tr>';
             $o.= '      <tr><td colspan="2" align="center"><input type="submit" value="' .$this->str['create'] . '" /></td></tr>';

admin/xmldb/actions/revert_changes/revert_changes.class.php

@@ -75,7 +75,7 @@ class revert_changes extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmrevertchanges'] . '<br /><br />' . $dirpath . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=revert_changes&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=revert_changes&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/test/test.class.php

@@ -955,6 +955,20 @@ class test extends XMLDBAction {
 
         $this->output = $o;
 
+    /// Finally drop all the potentially existing test tables
+        $table = new XMLDBTable('testtable');
+        if (table_exists($table)) {
+            $status = drop_table($table, true, false);
+        }
+        $table = new XMLDBTable ('anothertest');
+        if (table_exists($table)) {
+            $status = drop_table($table, true, false);
+        }
+        $table = new XMLDBTable ('newnameforthetable');
+        if (table_exists($table)) {
+            $status = drop_table($table, true, false);
+        }
+
     /// Launch postaction if exists (leave this here!)
         if ($this->getPostAction() && $result) {
             return $this->launch($this->getPostAction());

admin/xmldb/actions/unload_xml_file/unload_xml_file.class.php

@@ -35,6 +35,7 @@ class unload_xml_file extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_field_xml/view_field_xml.class.php

@@ -35,6 +35,7 @@ class view_field_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_index_xml/view_index_xml.class.php

@@ -35,6 +35,7 @@ class view_index_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_key_xml/view_key_xml.class.php

@@ -35,6 +35,7 @@ class view_key_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_reserved_words/view_reserved_words.class.php

@@ -38,6 +38,7 @@ class view_reserved_words extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+    $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_statement_xml/view_statement_xml.class.php

@@ -35,6 +35,7 @@ class view_statement_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_structure_php/view_structure_php.class.php

@@ -36,6 +36,7 @@ class view_structure_php extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_structure_sql/view_structure_sql.class.php

@@ -36,6 +36,7 @@ class view_structure_sql extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_structure_xml/view_structure_xml.class.php

@@ -35,6 +35,7 @@ class view_structure_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_table_php/view_table_php.class.php

@@ -36,6 +36,7 @@ class view_table_php extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_table_sql/view_table_sql.class.php

@@ -36,6 +36,7 @@ class view_table_sql extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_table_xml/view_table_xml.class.php

@@ -35,6 +35,7 @@ class view_table_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_xml/view_xml.class.php

@@ -38,6 +38,7 @@ class view_xml extends XMLDBAction {
         //$this->can_subaction = ACTION_HAVE_SUBACTIONS;
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

auth/cas/CAS/client.php

@@ -5984,33 +5984,21 @@ class CASClient
 
 
 
-
-
-	  $final_uri .= strtok($_SERVER['REQUEST_URI'],"?");
-
-
-	  $cgi_params = '?'.strtok("?");
-
-
-	  // remove the ticket if present in the CGI parameters
-
-
-	  $cgi_params = preg_replace('/&ticket=[^&]*/','',$cgi_params);
-
-
-	  $cgi_params = preg_replace('/\?ticket=[^&;]*/','?',$cgi_params);
-
-
-	  $cgi_params = preg_replace('/\?%26/','?',$cgi_params);
-
-
-	  $cgi_params = preg_replace('/\?&/','?',$cgi_params);
-
-
-	  $cgi_params = preg_replace('/\?$/','',$cgi_params);
-
-
-	  $final_uri .= $cgi_params;
+      $baseurl = split("\?", $_SERVER['REQUEST_URI'], 2);
+      $final_uri .= $baseurl[0];
+      $query_string = '';
+      if ($_GET) {
+          $kv = array();
+          foreach ($_GET as $key => $value) {
+              if($key !== "ticket"){
+                  $kv[] = urlencode($key). "=" . urlencode($value);
+              }
+          }
+          $query_string = join("&", $kv);
+      }
+      if($query_string){
+          $final_uri .= "?" . $query_string;
+      }
 
 
 	  $this->setURL($final_uri);

auth/cas/CAS/readme_moodle.txt

@@ -0,0 +1,7 @@
+PHP CAS library import
+
+List of changes:
+1/ backported fix for: http://www.ja-sig.org/issues/browse/PHPCAS-52 (MDL-21802) 
+
+
+skodak

auth/cas/auth.php

@@ -58,8 +58,13 @@ class auth_plugin_cas extends auth_plugin_base {
      */
     function user_login ($username, $password) {
 		$this->connectCAS();
-        return phpCAS::isAuthenticated() && (phpCAS::getUser() == $username);
+        return phpCAS::isAuthenticated() && (trim(moodle_strtolower(phpCAS::getUser())) == $username);
     }
+
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/cas/config.html

@@ -602,7 +602,7 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
 
        $opt_deref[LDAP_DEREF_ALWAYS] = get_string('yes');
 
-       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, LDAP_DEREF_NEVER, '');
+       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, '');
 
        if (isset($err['opt_deref'])) formerr($err['opt_deref']);
 
@@ -825,4 +825,4 @@ print_auth_lock_options('cas', $user_fields, $help, true, true);
 
 
 ?>
-</table>
+</table>

auth/db/auth.php

@@ -572,6 +572,13 @@ class auth_plugin_db extends auth_plugin_base {
         }
     }
 
+    function prevent_local_passwords() {
+        if (!isset($this->config->passtype)) {
+            return false;
+        }
+        return ($this->config->passtype != 'internal');
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/email/auth.php

@@ -132,6 +132,10 @@ class auth_plugin_email extends auth_plugin_base {
         }
     }
 
+    function prevent_local_passwords() {
+        return false;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/fc/auth.php

@@ -144,6 +144,10 @@ class auth_plugin_fc extends auth_plugin_base {
         return false;
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/imap/auth.php

@@ -81,6 +81,10 @@ class auth_plugin_imap extends auth_plugin_base {
         return false;  // No match
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/ldap/auth.php

@@ -1607,6 +1607,10 @@ class auth_plugin_ldap extends auth_plugin_base {
         return ($fresult);
     }
 
+    function prevent_local_passwords() {
+        return !empty($this->config->preventpassindb);
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/ldap/config.html

@@ -16,7 +16,7 @@
     if (!isset($config->opt_deref))
         { $config->opt_deref = LDAP_DEREF_NEVER; }
     if (!isset($config->preventpassindb))
-        { $config->preventpassindb = 0; }
+        { $config->preventpassindb = 1; }
     if (!isset($config->bind_dn))
         {$config->bind_dn = ''; }
     if (!isset($config->bind_pw))
@@ -193,7 +193,7 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
        $opt_deref = array();
        $opt_deref[LDAP_DEREF_NEVER] = get_string('no');
        $opt_deref[LDAP_DEREF_ALWAYS] = get_string('yes');
-       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, LDAP_DEREF_NEVER, '');
+       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, '');
        if (isset($err['opt_deref'])) formerr($err['opt_deref']);
     ?>
     </td>

auth/manual/auth.php

@@ -62,6 +62,10 @@ class auth_plugin_manual extends auth_plugin_base {
         return update_internal_user_password($user, $newpassword);
     }
 
+    function prevent_local_passwords() {
+        return false;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/mnet/auth.php

@@ -590,6 +590,10 @@ class auth_plugin_mnet extends auth_plugin_base {
         delete_records_select('mnet_enrol_assignments', $whereclause);
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/nntp/auth.php

@@ -64,6 +64,10 @@ class auth_plugin_nntp extends auth_plugin_base {
         return false;
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/nologin/auth.php

@@ -46,6 +46,11 @@ class auth_plugin_nologin extends auth_plugin_base {
         return false;
     }
 
+    function prevent_local_passwords() {
+        // just in case, we do not want to loose the passwords
+        return false;
+    }
+
     /**
      * No external data sync.
      *

auth/none/auth.php

@@ -62,6 +62,10 @@ class auth_plugin_none extends auth_plugin_base {
         return update_internal_user_password($user, $newpassword);
     }
 
+    function prevent_local_passwords() {
+        return false;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/pam/auth.php

@@ -77,6 +77,10 @@ class auth_plugin_pam extends auth_plugin_base {
         }
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/pop3/auth.php

@@ -81,6 +81,10 @@ class auth_plugin_pop3 extends auth_plugin_base {
         return false;  // No matches found
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/radius/auth.php

@@ -80,6 +80,10 @@ class auth_plugin_radius extends auth_plugin_base {
         $rauth->close();
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/shibboleth/auth.php

@@ -134,6 +134,10 @@ class auth_plugin_shibboleth extends auth_plugin_base {
         return $moodleattributes;
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

backup/backup.php

@@ -115,7 +115,7 @@
     raise_memory_limit("192M");
 
     //Call the form, depending the step we are
-    if (!$launch) {
+    if (!$launch or !data_submitted() or !confirm_sesskey()) {
         // if we're at the start, clear the cache of prefs
         if (isset($SESSION->backupprefs[$course->id])) {
             unset($SESSION->backupprefs[$course->id]);

backup/backup_check.html

@@ -4,6 +4,9 @@
     //Check login   
     require_login();
 
+    // Init backupuserinfo
+    $backupuserinfo = false;
+
     if (!empty($course->id)) {
         if (!has_capability('moodle/site:backup', get_context_instance(CONTEXT_COURSE, $course->id))) {
             if (empty($to)) {
@@ -14,10 +17,12 @@
                 }
             }
         }
+        $backupuserinfo = has_capability('moodle/backup:userinfo', get_context_instance(CONTEXT_COURSE, $course->id));
     } else {
         if (!has_capability('moodle/site:backup', get_context_instance(CONTEXT_SYSTEM, SITEID))) {
             error("You need to be an admin user to use this page.", "$CFG->wwwroot/login/index.php");
         }
+        $backupuserinfo = has_capability('moodle/backup:userinfo', get_context_instance(CONTEXT_SYSTEM));
     }
 
     
@@ -38,6 +43,7 @@
 <form id="form" method="post" action="backup.php">
 <table cellpadding="5" style="text-align:center;margin-left:auto;margin-right:auto">
 <?php
+    echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
 
     if (empty($to)) {
         //Now print the Backup Name tr
@@ -58,6 +64,16 @@
 
     }
 
+    // Re-enforce 'moodle/site:backup' at system context to be able to backup all users
+    if ($backupprefs->backup_users == 0 and !has_capability('moodle/site:backup', get_context_instance(CONTEXT_SYSTEM))) {
+        $backupprefs->backup_users = 1; // users => course
+    }
+
+    // Re-enforce moodle/backup:userinfo capability
+    if (!$backupuserinfo) {
+        $backupprefs->backup_users = 2; // users => none
+    }
+
     //Here we check if backup_users = None. Then, we switch off every module
     //user info, user_files, logs and exercises, workshop and messages backups. A Warning is showed to
     //inform the user.

backup/backup_form.html

@@ -4,6 +4,9 @@
     //Check login   
     require_login();
 
+    //Init backupuserinfo
+    $backupuserinfo = false;
+
     if (!empty($course->id)) {
         if (!has_capability('moodle/site:backup', get_context_instance(CONTEXT_COURSE, $course->id))) {
             if (empty($to)) {
@@ -14,10 +17,12 @@
                 }
             }
         }
+        $backupuserinfo = has_capability('moodle/backup:userinfo', get_context_instance(CONTEXT_COURSE, $course->id));
     } else {
         if (!has_capability('moodle/site:backup', get_context_instance(CONTEXT_SYSTEM, SITEID))) {
             error("You need to be an admin user to use this page.", "$CFG->wwwroot/login/index.php");
         }
+        $backupuserinfo = has_capability('moodle/backup:userinfo', get_context_instance(CONTEXT_SYSTEM));
     }
 
     //Check site
@@ -115,6 +120,8 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
 <form id="form1" method="post" action="backup.php">
 <table cellpadding="5" style="margin-left:auto;margin-right:auto;">
 <?php
+    echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
+
 /// Acummulator for hidden options and proper XHTML output
     $hidden_options = '';
     //Now, check modules and info and show posibilities
@@ -127,12 +134,16 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_', true);\">". get_string("all")."</a>/";
         echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_', false);\">".  get_string("none")."</a>";
         echo "</td>";
-        echo "<td align=\"right\">";
-        echo '<b>&nbsp;</b>';
-        echo "</td><td>";
-        echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_user_info_', true);\">". get_string("all")."</a>/";
-        echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_user_info_', false);\">". get_string("none")."</a>";
-        echo "</td>";
+        if (empty($to) and $backupuserinfo) {
+            echo "<td align=\"right\">";
+            echo '<b>&nbsp;</b>';
+            echo "</td><td>";
+            echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_user_info_', true);\">". get_string("all")."</a>/";
+            echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_user_info_', false);\">". get_string("none")."</a>";
+            echo "</td>";
+        } else {
+            echo "<td colspan=\"2\">&nbsp;</td>";
+        }
         echo "</tr>";
         echo "<tr><td colspan=\"4\"><hr /></td></tr>";
         $currentrow = 0;
@@ -155,8 +166,8 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
                 echo "</td><td align=\"right\">&nbsp;";
                 echo "</td><td>";
                 $var = "backup_user_info_".$modname;
-                if (empty($to)) {
-                    $backup_user_options[0] = get_string("withoutuserdata"); 
+                if (empty($to) and $backupuserinfo) {
+                    $backup_user_options[0] = get_string("withoutuserdata");
                     $backup_user_options[1] = get_string("withuserdata");
                     //choose_from_menu($backup_user_options, $var, $$var, "");
                     print_checkbox($var, $$var, $$var, get_string("userdata"),'','selectItemInCheckboxByName(\'form1\',\'backup_user_info_'.$modname.'\',this.checked)');
@@ -177,7 +188,7 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
                         echo '</td><td align="right">&nbsp;';
                         $var = 'backup_user_info_'.$modname.'_instance_'.$instance->id;
                         $$var = optional_param($var,1);
-                        if (empty($to)) {
+                        if (empty($to) and $backupuserinfo) {
                             print_checkbox($var,$$var,$$var,get_string('userdata'),'','this.form.elements[\'backup_user_info_'.$modname.'\'].checked=1;');
                         } else {
                             echo '<input type="hidden" name="'.$var.'" value="0" />';
@@ -207,23 +218,25 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
             $hidden_options .= '<input type="hidden" name="backup_metacourse" value="0" />';
         }
 
-        if (empty($to)) {
+        if (empty($to) and $backupuserinfo) {
             //Now print the Users tr
             echo "<tr>";
             echo "<td align=\"right\" colspan=\"2\"><b>";
             echo get_string("users").":";
             echo "</b></td><td colspan=\"2\">";
-            $user_options[0] = get_string("all");
+            if (has_capability('moodle/site:backup', get_context_instance(CONTEXT_SYSTEM))) {
+                $user_options[0] = get_string("all");
+            }
             $user_options[1] = get_string("course");
             $user_options[2] = get_string("none");
             choose_from_menu($user_options, "backup_users", $backup_users, "");
             echo "</td></tr>";
         }
         else {
-            $hidden_options .= '<input type="hidden" name="backup_users" value="0" />';
+            $hidden_options .= '<input type="hidden" name="backup_users" value="2" />';
         }
-        
-        if (empty($to)) {
+
+        if (empty($to) and $backupuserinfo) {
             //Now print the Logs tr
             echo "<tr>";
             echo "<td align=\"right\" colspan=\"2\"><b>";
@@ -237,8 +250,8 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         else {
             $hidden_options .= '<input type="hidden" name="backup_logs" value="0" />';
         }
- 
-        if (empty($to)) {
+
+        if (empty($to) and $backupuserinfo) {
             //Now print the User Files tr
             echo "<tr>";
             echo "<td align=\"right\" colspan=\"2\"><b>";
@@ -262,7 +275,7 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         choose_from_menu($course_file_options, "backup_course_files", $backup_course_files, "");
         echo "</td></tr>";
 
-        if (empty($to) && $course->id == SITEID) {
+        if (empty($to) and $backupuserinfo and $course->id == SITEID) {
             //If we are in a SITEID backup print the Messages tr
             echo "<tr>";
             echo "<td align=\"right\" colspan=\"2\"><b>";

backup/backuplib.php

@@ -82,8 +82,8 @@
 
     //Returns every needed user (participant) in a course
     //It uses the xxxx_get_participants() function
-    //plus users needed to backup scales.
-    //WARNING: It returns only NEEDED users, not every 
+    //plus users needed to backup messages
+    //WARNING: It returns only NEEDED users, not every
     //   every student and teacher in the course, so it
     //must be merged with backup_get_enrrolled_users !!
 
@@ -119,21 +119,6 @@
             }
         }
 
-        //Now, add scale users (from site and course scales)
-        //Get users
-        $scaleusers = get_records_sql("SELECT DISTINCT userid,userid
-                                       FROM {$CFG->prefix}scale
-                                       WHERE courseid = '0' or courseid = '$courseid'");
-        //Add scale users to results
-        if ($scaleusers) {
-            foreach ($scaleusers as $scaleuser) {
-                //If userid != 0
-                if ($scaleuser->userid != 0) {
-                    $result[$scaleuser->userid]->id = $scaleuser->userid;
-                }
-            }
-        }
-
         //Now, add message users if necessary
         if ($includemessages) {
             include_once("$CFG->dirroot/message/lib.php");
@@ -163,7 +148,7 @@
         // get all users with moodle/course:view capability, this will include people
         // assigned at cat level, or site level
         // but it should be ok if they have no direct assignment at course, mod, block level
-        return get_users_by_capability(get_context_instance(CONTEXT_COURSE, $courseid), 'moodle/course:view');
+        return get_users_by_capability(get_context_instance(CONTEXT_COURSE, $courseid), 'moodle/course:view', '', '', '', '', '', '', false);
     }
 
     //Returns all users ids (every record in users table)
@@ -1102,7 +1087,11 @@
                 fwrite ($bf,full_tag("POLICYAGREED",4,false,$user->policyagreed));
                 fwrite ($bf,full_tag("DELETED",4,false,$user->deleted));
                 fwrite ($bf,full_tag("USERNAME",4,false,$user->username));
-                fwrite ($bf,full_tag("PASSWORD",4,false,$user->password));
+                // Prevent user passwords in backup files unless
+                // $CFG->includeuserpasswordsinbackup is defined. MDL-20838
+                if (!empty($CFG->includeuserpasswordsinbackup)) {
+                    fwrite ($bf,full_tag("PASSWORD",4,false,$user->password));
+                }
                 fwrite ($bf,full_tag("IDNUMBER",4,false,$user->idnumber));
                 fwrite ($bf,full_tag("FIRSTNAME",4,false,$user->firstname));
                 fwrite ($bf,full_tag("LASTNAME",4,false,$user->lastname));
@@ -1128,7 +1117,6 @@
                 fwrite ($bf,full_tag("LASTLOGIN",4,false,$user->lastlogin));
                 fwrite ($bf,full_tag("CURRENTLOGIN",4,false,$user->currentlogin));
                 fwrite ($bf,full_tag("LASTIP",4,false,$user->lastip));
-                fwrite ($bf,full_tag("SECRET",4,false,$user->secret));
                 fwrite ($bf,full_tag("PICTURE",4,false,$user->picture));
                 fwrite ($bf,full_tag("URL",4,false,$user->url));
                 fwrite ($bf,full_tag("DESCRIPTION",4,false,$user->description));

backup/restore.php

@@ -144,6 +144,7 @@
         if (!empty($SESSION->restore->importing)) {
             // set up all the config stuff and skip asking the user about it.
             restore_setup_for_check($SESSION->restore,$backup_unique_code);
+            require_sesskey();
             include_once("restore_execute.html");
         } else {
             include_once("restore_form.html");
@@ -159,6 +160,7 @@
         }
         //Unset this for the future
         unset($SESSION->cancontinue);
+        require_sesskey();
         include_once("restore_execute.html");
     }
     print_simple_box_end();

backup/restore_check.html

@@ -18,8 +18,8 @@
 
     if ($form1 = data_submitted()) {
         $currentcourseshortname = $course_header->course_shortname; //"store_ShortName";
-        $course_header->course_shortname =  stripslashes_safe($form1->shortname);  //"update_ShortName";    
-        $course_header->course_fullname =   stripslashes_safe($form1->fullname);   //"update_FullName";  
+        $course_header->course_shortname = !empty($form1->shortname) ? stripslashes_safe($form1->shortname) : '';  //"update_ShortName";
+        $course_header->course_fullname  = !empty($form1->fullname) ? stripslashes_safe($form1->fullname) : '';   //"update_FullName"
     /// Roll dates only if the backup course has a start date
     /// (some formats like main page, social..., haven't it and rolling dates
     /// from 0 produces crazy dates. MDL-10125 and we have passed some custom startyear/month/day. MDL-12922
@@ -176,15 +176,21 @@
     //Check login
     require_login();
 
+    //Init restoreuserinfo
+    $restoreuserinfo = false;
+
+
     //Check admin
     if (!empty($id)) {
         if (!has_capability('moodle/site:restore', get_context_instance(CONTEXT_COURSE, $id))) {
             error("You need to be a teacher or admin user to use this page.", "$CFG->wwwroot/login/index.php");
         }
+        $restoreuserinfo = has_capability('moodle/restore:userinfo', get_context_instance(CONTEXT_COURSE, $id));
     } else {
         if (!has_capability('moodle/site:restore', get_context_instance(CONTEXT_SYSTEM, SITEID))) {
             error("You need to be an admin user to use this page.", "$CFG->wwwroot/login/index.php");
         }
+        $restoreuserinfo = has_capability('moodle/restore:userinfo', get_context_instance(CONTEXT_SYSTEM));
     }
 
     //Check site
@@ -275,6 +281,38 @@
                 $restore->users = 1;
             }
         }
+
+        // Re-enforce 'moodle/site:restore' at system context to be able to restore all users
+        if ($restore->users == 0 and !has_capability('moodle/site:restore', get_context_instance(CONTEXT_SYSTEM))) {
+            $restore->users = 1; // users => course
+        }
+
+        // Re-enforce moodle/restore:userinfo capability
+        if (!$restoreuserinfo) {
+            $userinfocheck = true;
+            // Confirm that all the settings are properly set to no users
+            // if anything is wrong, message and stop
+            // First global settings
+            if ($restore->users != 2 or $restore->user_files or $restore->messages) {
+                $userinfocheck = false;
+
+            // Now all modules userinfo flag
+            } else {
+                $mods = $restore->mods;
+                foreach ($mods as $mod) {
+                    if ($mod->userinfo) {
+                        $userinfocheck = false;
+                    }
+                }
+            }
+
+            if (!$userinfocheck) { // Something was wrong
+                echo get_string ('restoreuserinfofailed');
+                echo "<hr noshade size=\"1\">";
+                $show_continue_button = false;
+            }
+        }
+
         //Save the restore session object
         $SESSION->restore = $restore;
         if ($show_continue_button) {
@@ -284,6 +322,7 @@
             $hidden["launch"]             = "execute";
             $hidden["file"]               =  $file;
             $hidden["id"]                 =  $id;
+            $hidden["sesskey"]            =  sesskey();
             print_string('longtimewarning','admin');
 
             if ($restore->users && !empty($info->mnet_externalusers) 

backup/restore_form.html

@@ -21,15 +21,20 @@
     //Check login
     require_login();
 
+    //Init restoreuserinfo
+    $restoreuserinfo = false;
+
     //Check admin
     if (!empty($id)) {
         if (!has_capability('moodle/site:restore', get_context_instance(CONTEXT_COURSE, $id))) {
             error("You need to be a teacher or admin user to use this page.", "$CFG->wwwroot/login/index.php");
         }
+        $restoreuserinfo = has_capability('moodle/restore:userinfo', get_context_instance(CONTEXT_COURSE, $id));
     } else {
         if (!has_capability('moodle/site:restore', get_context_instance(CONTEXT_SYSTEM, SITEID))) {
             error("You need to be an admin user to use this page.", "$CFG->wwwroot/login/index.php");   
         }
+        $restoreuserinfo = has_capability('moodle/restore:userinfo', get_context_instance(CONTEXT_SYSTEM));
     }
 
     //Check site
@@ -60,8 +65,10 @@
             }
             //Check include user info
             $var = "restore_user_info_".$modname;
-            if (!isset($$var)) {
+            if (!isset($$var) && $restoreuserinfo) {
                 $$var = 1;
+            } else {
+                $$var = 0;
             }
         }
     }
@@ -274,14 +281,18 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'restore_', false);\">".
              get_string("none")."</a>";
         echo "</td>";
-        echo "<td align=\"right\">";
-        echo '<b>&nbsp;</b>';
-        echo "</td><td>";
-        echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'restore_user_info_', true);\">".
-             get_string("all")."</a>/";
-        echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'restore_user_info_', false);\">".
-             get_string("none")."</a>";
-        echo "</td>";
+        if ($restoreuserinfo) {
+            echo "<td align=\"right\">";
+            echo '<b>&nbsp;</b>';
+            echo "</td><td>";
+            echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'restore_user_info_', true);\">".
+                 get_string("all")."</a>/";
+            echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'restore_user_info_', false);\">".
+                 get_string("none")."</a>";
+            echo "</td>";
+        } else {
+            echo "<td colspan=\"2\">&nbsp;</td>";
+        }
         echo "</tr>";
         echo "<tr><td colspan=\"4\"><hr /></td></tr>";
         $currentrow = 0;
@@ -311,7 +322,7 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
                         //without user data
                         echo "</td><td align=\"right\">&nbsp;";
                         echo "</td><td>";
-                        if ($info->mods[$modname]->userinfo == "true") {
+                        if ($info->mods[$modname]->userinfo == "true" && $restoreuserinfo) {
                             $restore_user_options[1] = get_string("yes");
                             $restore_user_options[0] = get_string("no"); 
                             //choose_from_menu($restore_user_options, $user_info_var, $$user_info_var, "");
@@ -336,7 +347,7 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
                                 echo '</td><td align="right">&nbsp;';
                                 $var = 'restore_user_info_'.$modname.'_instance_'.$instance->id;
                                 $$var = optional_param($var,1);
-                                if ($info->mods[$modname]->instances[$instance->id]->userinfo == 'true') {
+                                if (!empty($info->mods[$modname]->instances) && ($info->mods[$modname]->instances[$instance->id]->userinfo == 'true') && $restoreuserinfo) {
                                     print_checkbox($var,$$var,$$var,get_string('userdata'),'','this.form.elements[\'restore_user_info_'.$modname.'\'].checked=1;');
                                 } else {
                                     echo '<input type="hidden" name="'.$var.'" value="0" />';
@@ -386,9 +397,10 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         echo get_string("users").":";
         echo "</b></td><td colspan=\"2\">";
         //If some user is present in the backup file
-        if ($info->backup_users == "all" or $info->backup_users == "course") {
-            //If all users are in the backup file
-            if ($info->backup_users == "all") {
+        if (($info->backup_users == "all" or $info->backup_users == "course") and $restoreuserinfo) {
+            $user_options = array();
+            //If all users are in the backup file and user has 'moodle/site:restore' at system level
+            if ($info->backup_users == "all" and has_capability('moodle/site:restore', get_context_instance(CONTEXT_SYSTEM))) {
                 $user_options[0] = get_string("all");
             }
             $user_options[1] = get_string("course");
@@ -407,7 +419,8 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         echo get_string("logs").":";                                               
         echo "</b></td><td colspan=\"2\">";
         //If logs are in the backup file, show menu, else fixed to no
-        if ($info->backup_logs == "true") {
+        if ($info->backup_logs == "true" and $restoreuserinfo) {
+            $log_options = array();
             $log_options[0] = get_string("no");
             $log_options[1] = get_string("yes"); 
             choose_from_menu($log_options, "restore_logs", $restore_logs, ""); 
@@ -423,9 +436,10 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         echo get_string ("userfiles").":";
         echo "</b></td><td colspan=\"2\">";
         //If user files are in the backup file, show menu, else fixed to no
-        if ($info->backup_user_files == "true") {
-            $user_file_options[0] = get_string("no"); 
-            $user_file_options[1] = get_string("yes"); 
+        if ($info->backup_user_files == "true" and $restoreuserinfo) {
+            $user_file_options = array();
+            $user_file_options[0] = get_string("no");
+            $user_file_options[1] = get_string("yes");
             choose_from_menu($user_file_options, "restore_user_files", $restore_user_files, "");
         } else {
             echo get_string("no");
@@ -454,11 +468,10 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         //Now print the Messages tr
         echo "<tr>";
         echo "<td align=\"right\" colspan=\"2\"><b>";
-        
         //This tr is slighty different. Everything becomes hidden if
         //we haven't messages is the backup, to avoid confusions to users.
         //If messages are in the backup file, show menu, else fixed to no and show nothing
-        if ($info->backup_messages == "true") {
+        if (isset($info->backup_messages) && $info->backup_messages == "true" && !empty($CFG->messaging) and $restoreuserinfo) {
             echo get_string ('messages','message').":";
             echo "</b></td><td colspan=\"2\">";
             $message_options[0] = get_string("no");
@@ -475,104 +488,106 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
 
 <hr/>
 <?php
+// Only show the roles mapping if restore of user info is allowed
+if ($restoreuserinfo) {
+    print_heading(get_string('rolemappings'));
+    $xml_file  = $CFG->dataroot."/temp/backup/".$backup_unique_code."/moodle.xml";
 
-print_heading(get_string('rolemappings'));
-$xml_file  = $CFG->dataroot."/temp/backup/".$backup_unique_code."/moodle.xml";
+    $info = restore_read_xml_info($xml_file);
 
-$info = restore_read_xml_info($xml_file);
+    // fix for MDL-9068, front page course is just a normal course
+    $siterolesarray = get_assignable_roles (get_context_instance(CONTEXT_COURSE, $course->id), "shortname");
+    $siterolesnamearray = get_assignable_roles (get_context_instance(CONTEXT_COURSE, $course->id), "name");
+    $allroles = get_records('role');
 
-// fix for MDL-9068, front page course is just a normal course
-$siterolesarray = get_assignable_roles (get_context_instance(CONTEXT_COURSE, $course->id), "shortname");
-$siterolesnamearray = get_assignable_roles (get_context_instance(CONTEXT_COURSE, $course->id), "name");
-$allroles = get_records('role');
+    echo ('<table width="100%" class="restore-form-instances">');
+    echo ('<tr><td align="right" style="width:50%"><b>'.get_string('sourcerole').'</b></td><td align="left" style="width:50%"><b>'.get_string('targetrole').'</b></td></tr>');
 
-echo ('<table width="100%" class="restore-form-instances">');
-echo ('<tr><td align="right" style="width:50%"><b>'.get_string('sourcerole').'</b></td><td align="left" style="width:50%"><b>'.get_string('targetrole').'</b></td></tr>');
+    if ($info->backup_moodle_version < 2006092801) {
+        // 1.6 and below backup
 
-if ($info->backup_moodle_version < 2006092801) {
-    // 1.6 and below backup
-    
-    /// Editting teacher
-    echo ('<tr><td align="right">');
-    print_string('defaultcourseteacher');
-    echo ('</td><td algin="left">');
-    
-    // get the first teacheredit legacy
-    $roles = get_roles_with_capability('moodle/legacy:editingteacher', CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM, SITEID));
+        /// Editting teacher
+        echo ('<tr><td align="right">');
+        echo '<label for="menudefaultteacheredit">'.get_string ('defaultcourseteacher').'</label>';
+        echo ('</td><td algin="left">');
 
-    $editteacher = array_shift($roles);
-    choose_from_menu ($siterolesarray, "defaultteacheredit", $editteacher->id, 'new role', '', '0');
-    echo ('</td></tr>');
-    
-    /// Non-editting teacher
-    echo ('<tr><td align="right">');
-    print_string('noneditingteacher');
-    echo ('</td><td algin="left">');
-    
-    // get the first teacheredit legacy
-    $roles = get_roles_with_capability('moodle/legacy:teacher', CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM, SITEID));
-    $teacher = array_shift($roles);
-    
-    choose_from_menu ($siterolesarray, "defaultteacher", $teacher->id, 'new role', '', '0');
-    echo ('</td></tr>');
-     
-    
-    /// Student
-    echo ('<tr><td align="right">');
-    print_string('defaultcoursestudent');
-    echo ('</td><td algin="left">');
-    
-    // get the first teacheredit legacy
-    $roles = get_roles_with_capability('moodle/legacy:student', CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM, SITEID));
-    $studentrole = array_shift($roles);
-    
-    choose_from_menu ($siterolesarray, "defaultstudent", $studentrole->id, 'new role', '', '0');
-    echo ('</td></tr>');
-  
-} else {
-    // 1.7 and above backup
-    $roles = restore_read_xml_roles($xml_file);
-    
-    if (!empty($roles->roles)) { // possible to have course with no roles
-        foreach ($siterolesarray as $siteroleid=>$siteroleshortname) {
-            $siteroleschoicearray[$siteroleid] = $siterolesnamearray[$siteroleid]." (". $siterolesarray[$siteroleid].")";
-        }
+        // get the first teacheredit legacy
+        $roles = get_roles_with_capability('moodle/legacy:editingteacher', CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM));
 
-        foreach ($roles->roles as $roleid=>$role) {
-         
-            $mappableroles = $siteroleschoicearray;
-         
-            echo ('<tr><td align="right">');
-            echo $role->name." (".($role->shortname).")";
-            echo ('</td><td align="left">');
+        $editteacher = reset($roles);
+        choose_from_menu ($siterolesarray, "defaultteacheredit", $editteacher->id, 'new role', '', '0');
+        echo ('</td></tr>');
 
-            /// first, we see if any exact role definition is found
-            /// if found, that is the only option of restoring to
-            
-            if ($samerole = restore_samerole($roleid, $role)) {
-                $matchrole = $samerole->id;
-                // if an exact role is found, it does not matter whether this user can assign this role or not,
-                // this will be presented as a valid option regardless
-                $mappableroles[$samerole->id] = $allroles[$samerole->id]->name." (". $allroles[$samerole->id]->shortname.")";
-            } else {
-                // no exact role found, let's try to match shortname
-                // this is useful in situations where basic roles differ slightly in definition
-                $matchrole = 0;
-                foreach ($siterolesarray as $siteroleid=>$siteroleshortname) {
-                    if ($siteroleshortname == $role->shortname) {
-                        $matchrole = $siteroleid;
-                        break;
+        /// Non-editting teacher
+        echo ('<tr><td align="right">');
+        echo '<label for="menudefaultteacher">'.get_string ('noneditingteacher').'</label>';
+        print_string('noneditingteacher');
+        echo ('</td><td algin="left">');
+
+        // get the first teacheredit legacy
+        $roles = get_roles_with_capability('moodle/legacy:teacher', CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM));
+        $teacher = reset($roles);
+
+        choose_from_menu ($siterolesarray, "defaultteacher", $teacher->id, 'new role', '', '0');
+        echo ('</td></tr>');
+
+
+        /// Student
+        echo ('<tr><td align="right">');
+        echo '<label for="menudefaultstudent">'.get_string ('defaultcoursestudent').'</label>';
+        echo ('</td><td algin="left">');
+
+        // get the first teacheredit legacy
+        $roles = get_roles_with_capability('moodle/legacy:student', CAP_ALLOW, get_context_instance(CONTEXT_SYSTEM));
+        $studentrole = array_shift($roles);
+
+        choose_from_menu ($siterolesarray, "defaultstudent", $studentrole->id, 'new role', '', '0');
+        echo ('</td></tr>');
+
+    } else {
+        // 1.7 and above backup
+        $roles = restore_read_xml_roles($xml_file);
+
+        if (!empty($roles->roles)) { // possible to have course with no roles
+            foreach ($siterolesarray as $siteroleid=>$siteroleshortname) {
+                $siteroleschoicearray[$siteroleid] = $siterolesnamearray[$siteroleid]." (". $siterolesarray[$siteroleid].")";
+            }
+
+            foreach ($roles->roles as $roleid=>$role) {
+
+                $mappableroles = $siteroleschoicearray;
+
+                echo ('<tr><td align="right">');
+                echo '<label for="menuroles_'.$roleid.'">'.format_string($role->name)." (".($role->shortname).")".'</label>';
+                echo ('</td><td align="left">');
+
+                /// first, we see if any exact role definition is found
+                /// if found, that is the only option of restoring to
+
+                if ($samerole = restore_samerole($roleid, $role)) {
+                    $matchrole = $samerole->id;
+                    // if an exact role is found, it does not matter whether this user can assign this role or not,
+                    // this will be presented as a valid option regardless
+                    $mappableroles[$samerole->id] = format_string($allroles[$samerole->id]->name)." (". $allroles[$samerole->id]->shortname.")";
+                } else {
+                    // no exact role found, let's try to match shortname
+                    // this is useful in situations where basic roles differ slightly in definition
+                    $matchrole = 0;
+                    foreach ($siterolesarray as $siteroleid=>$siteroleshortname) {
+                        if ($siteroleshortname == $role->shortname) {
+                            $matchrole = $siteroleid;
+                            break;
+                        }
                     }
                 }
+                choose_from_menu ($mappableroles, "roles_".$roleid, $matchrole, 'new role', '', '0');
+                echo ('</td></tr>');
             }
-            choose_from_menu ($mappableroles, "roles_".$roleid, $matchrole, 'new role', '', '0');
-            echo ('</td></tr>');
         }
-    }
-    
-} // end else
 
-echo ('</table>'); // end of role mappings table
+    } // end else
+    echo ('</table>'); // end of role mappings table
+}
 
 ?>
 <br />
@@ -588,8 +603,10 @@ echo ('</table>'); // end of role mappings table
 
 <?php
 
-/* 
- * If there is a role with exactly the same definition, we pull it out from db
+/**
+ *
+ * @param integer $roleid the id that the role in the backup files had on the old server.
+ * @param object $role the rest of the definition of the role from the backup file.
  */
 function restore_samerole($roleid, $role) {
     global $CFG;

backup/restorelib.php

@@ -1544,6 +1544,8 @@
 
         global $CFG, $db;
 
+        $authcache = array(); // Cache to get some bits from authentication plugins
+
         $status = true;
         //Check it exists
         if (!file_exists($xml_file)) {
@@ -1677,16 +1679,46 @@
                     }
 
                     //We need to analyse the AUTH field to recode it:
-                    //   - if the field isn't set, we are in a pre 1.4 backup and we'll 
-                    //     use manual
-
-                    if (empty($user->auth)) {
+                    //   - if the field isn't set, we are in a pre 1.4 backup and $CFG->registerauth will decide
+                    //   - if the auth isn't enabled in target site, $CFG->registerauth will decide
+                    //   - finally, if the auth resulting isn't enabled, default to 'manual'
+                    if (empty($user->auth) || !is_enabled_auth($user->auth)) {
                         if ($CFG->registerauth == 'email') {
                             $user->auth = 'email';
                         } else {
                             $user->auth = 'manual';
                         }
                     }
+                    if (!is_enabled_auth($user->auth)) { // Final auth check verify, default to manual if not enabled
+                        $user->auth = 'manual';
+                    }
+
+                    // Now that we know the auth method, for users to be created without pass
+                    // if password handling is internal and reset password is available
+                    // we set the password to "restored" (plain text), so the login process
+                    // will know how to handle that situation in order to allow the user to
+                    // recover the password. MDL-20846
+                    if (empty($user->password)) { // Only if restore comes without password
+                        if (!array_key_exists($user->auth, $authcache)) { // Not in cache
+                            $userauth = new stdClass();
+                            $authplugin = get_auth_plugin($user->auth);
+                            $userauth->preventpassindb = $authplugin->prevent_local_passwords();
+                            $userauth->isinternal      = $authplugin->is_internal();
+                            $userauth->canresetpwd     = $authplugin->can_reset_password();
+                            $authcache[$user->auth] = $userauth;
+                        } else {
+                            $userauth = $authcache[$user->auth]; // Get from cache
+                        }
+
+                        // Most external plugins do not store passwords locally
+                        if (!empty($userauth->preventpassindb)) {
+                            $user->password = 'not cached';
+
+                        // If Moodle is responsible for storing/validating pwd and reset functionality is available, mark
+                        } else if ($userauth->isinternal and $userauth->canresetpwd) {
+                            $user->password = 'restored';
+                        }
+                    }
 
                     //We need to process the POLICYAGREED field to recalculate it:
                     //    - if the destination site is different (by wwwroot) reset it.
@@ -2157,7 +2189,7 @@
     //This function creates all the scales
     function restore_create_scales($restore,$xml_file) {
 
-        global $CFG, $db;
+        global $CFG, $USER, $db;
 
         $status = true;
         //Check it exists
@@ -2173,16 +2205,11 @@
         //Now, if we have anything in scales, we have to restore that
         //scales
         if ($scales) {
-            //Get admin->id for later use
-            $admin = get_admin();
-            $adminid = $admin->id;
             if ($scales !== true) {
                 //Iterate over each scale
                 foreach ($scales as $scale) {
                     //Get record from backup_ids
                     $data = backup_getid($restore->backup_unique_code,"scale",$scale->id);
-                    //Init variables
-                    $create_scale = false;
 
                     if ($data) {
                         //Now get completed xmlized object
@@ -2199,42 +2226,41 @@
                         $sca->description = backup_todb($info['SCALE']['#']['DESCRIPTION']['0']['#']);
                         $sca->timemodified = backup_todb($info['SCALE']['#']['TIMEMODIFIED']['0']['#']);
 
-                        //Now search if that scale exists (by scale field) in course 0 (Standar scale)
-                        //or in restore->course_id course (Personal scale)
-                        if ($sca->courseid == 0) {
-                            $course_to_search = 0;
-                        } else {
-                            $course_to_search = $restore->course_id;
-                        }
-                        $sca_db = get_record("scale","scale",$sca->scale,"courseid",$course_to_search);
-                        //If it doesn't exist, create
-                        if (!$sca_db) {
-                            $create_scale = true;
-                        } 
-                        //If we must create the scale
-                        if ($create_scale) {
-                            //Me must recode the courseid if it's <> 0 (common scale)
-                            if ($sca->courseid != 0) {
-                                $sca->courseid = $restore->course_id;
-                            }
-                            //We must recode the userid
+                        // Look for scale (by 'scale' both in standard (course=0) and current course
+                        // with priority to standard scales (ORDER clause)
+                        // scale is not course unique, use get_record_sql to suppress warning
+                        // Going to compare LOB columns so, use the cross-db sql_compare_text() in both sides.
+                        $compare_scale_clause = sql_compare_text('scale')  . "=" .  sql_compare_text("'" . $sca->scale . "'");
+                        // Scale doesn't exist, create it
+                        if (!$sca_db = get_record_sql("SELECT *
+                                                         FROM {$CFG->prefix}scale
+                                                        WHERE $compare_scale_clause
+                                                          AND courseid IN (0, $restore->course_id)
+                                                     ORDER BY courseid", true)) {
+
+                            // Try to recode the user field, defaulting to current user if not found
                             $user = backup_getid($restore->backup_unique_code,"user",$sca->userid);
                             if ($user) {
                                 $sca->userid = $user->new_id;
                             } else {
-                                //Assign it to admin
-                                $sca->userid = $adminid;
+                                $sca->userid = $USER->id;
+                            }
+                            // If scale is standard, if user lacks perms to manage standar scales
+                            // 'downgrade' them to course scales
+                            if ($sca->courseid == 0 and !has_capability('moodle/course:managescales', get_context_instance(CONTEXT_SYSTEM), $sca->userid)) {
+                                $sca->courseid = $restore->course_id;
                             }
                             //The structure is equal to the db, so insert the scale
                             $newid = insert_record ("scale",$sca);
+
+                        // Scale exists, reuse it
                         } else {
-                            //get current scale id
                             $newid = $sca_db->id;
                         }
+
                         if ($newid) {
                             //We have the newid, update backup_ids
-                            backup_putid($restore->backup_unique_code,"scale",
-                                         $scale->id, $newid);
+                            backup_putid($restore->backup_unique_code,"scale", $scale->id, $newid);
                         }
                     }
                 }
@@ -4838,9 +4864,6 @@
                         case "LASTIP": 
                             $this->info->tempuser->lastip = $this->getContents();
                             break;
-                        case "SECRET": 
-                            $this->info->tempuser->secret = $this->getContents();
-                            break;
                         case "PICTURE": 
                             $this->info->tempuser->picture = $this->getContents();
                             break;
@@ -5816,7 +5839,9 @@
             }
             else {
                 if (empty($noredirect)) {
-                    redirect($CFG->wwwroot.'/backup/restore.php?backup_unique_code='.$backup_unique_code.'&launch=form&file='.$file.'&id='.$id);
+                    print_continue($CFG->wwwroot.'/backup/restore.php?backup_unique_code='.$backup_unique_code.'&launch=form&file='.$file.'&id='.$id.'&sesskey='.sesskey());
+                    print_footer();
+                    die;                    
                 } else {
                     return $backup_unique_code;
                 }

backup/version.php

@@ -2,11 +2,11 @@
 
 /// This file defines the current version of the
 /// backup/restore code that is being used.  This can be
-/// compared against the values stored in the 
+/// compared against the values stored in the
 /// database (backup_version) to determine whether upgrades should
 /// be performed (see db/backup_*.php)
 
-    $backup_version = 2007022100;   // The current version is a date (YYYYMMDDXX)
-    $backup_release = "1.8+";       // User-friendly version number
+    $backup_version = 2007022101;   // The current version is a date (YYYYMMDDXX)
+    $backup_release = "1.8.11";       // User-friendly version number
 
 ?>

blog/edit.php

@@ -111,8 +111,8 @@ switch ($action) {
             error('Incorrect blog post id');
         }
         $post->id           = $existing->id;
-        $post->subject      = $existing->subject;
-        $post->summary      = $existing->summary;
+        $post->subject      = clean_text($existing->subject);
+        $post->summary      = clean_text($existing->summary, $existing->format);
         $post->publishstate = $existing->publishstate;
         $post->format       = $existing->format;
         $post->action       = $action;

blog/preferences.html

@@ -8,6 +8,7 @@
 <tr>
     <td colspan="2" align="center">
     <input type="hidden" name="courseid" value="<?php echo $courseid; ?>" />
+    <input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
     <input type="submit" value="<?php print_string("savechanges"); ?>" />
     <input type="button" value="<?php print_string('cancel'); ?>" onclick="javascript:history.go(-1)" /></td>
 </tr>

blog/preferences.php

@@ -22,7 +22,7 @@
 
 /// If data submitted, then process and store.
 
-    if (data_submitted()) {
+    if (data_submitted() and confirm_sesskey()) {
         $pagesize = required_param('pagesize', PARAM_INT);
 
         if ($pagesize < 1) {

calendar/event.php

@@ -123,7 +123,7 @@
                 error('You are not authorized to do this');
             }
 
-            if($form = data_submitted()) {
+            if($form = data_submitted() and confirm_sesskey()) {
 
                 $form->name = clean_param(strip_tags($form->name,'<lang><span>'), PARAM_CLEAN);
 
@@ -188,7 +188,7 @@
         case 'new':
             $title = get_string('newevent', 'calendar');
             $form = data_submitted();
-            if(!empty($form) && !empty($form->name)) {
+            if(!empty($form) && !empty($form->name) && confirm_sesskey()) {
 
                 $form->name = clean_text(strip_tags($form->name, '<lang><span>'));
 
@@ -286,7 +286,7 @@
         case 'delete':
             $confirm = optional_param('confirm', 0, PARAM_INT);
             $repeats = optional_param('repeats', 0, PARAM_INT);
-            if($confirm) {
+            if($confirm and confirm_sesskey()) {
                 // Kill it and redirect to day view
                 if(($event = get_record('event', 'id', $eventid)) !== false) {
 
@@ -334,9 +334,9 @@
 
         case 'edit':
             if(empty($form)) {
-                $form->name = $event->name;
+                $form->name = clean_text($event->name);
                 $form->courseid = $event->courseid; // Not to update, but for date validation
-                $form->description = $event->description;
+                $form->description = clean_text($event->description);
                 $form->timestart = $event->timestart;
                 $form->timeduration = $event->timeduration;
                 $form->id = $event->id;

calendar/event_delete.html

@@ -13,6 +13,7 @@
       <input type="hidden" name="confirm" value="1" />
       <input type="hidden" name="repeats" value="0" />
       <input type="hidden" name="course" value="<?php p($urlcourse); ?>" />
+      <input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
       &nbsp;
       </p>
       </form>
@@ -31,6 +32,7 @@
       <input type="hidden" name="confirm" value="1" />
       <input type="hidden" name="repeats" value="1" />
       <input type="hidden" name="course" value="<?php p($urlcourse); ?>" />
+      <input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
       &nbsp;
       </p>
       </form>

calendar/event_edit.html

@@ -89,6 +89,7 @@
 <input type="hidden" name="format" value="<?php echo $form->format; ?>" />
 <input type="hidden" name="action" value="edit" />
 <input type="hidden" name="course" value="<?php p($urlcourse); ?>" />
+<input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
 </p>
 </form>
 

calendar/event_new.html

@@ -99,6 +99,7 @@
 <input type="hidden" name="action" value="new" />
 <input type="hidden" name="type" value="<?php echo $form->type; ?>" />
 <input type="hidden" name="course" value="<?php p($urlcourse); ?>" />
+<input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
 </p>
 </form>
 

calendar/preferences.html

@@ -71,6 +71,7 @@
 
 <tr>
     <td colspan="2" style="text-align: center;">
+    <input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
     <input type="submit" value="<?php print_string("savechanges") ?>" /></td>
 </tr>
 </table>

calendar/preferences.php

@@ -18,7 +18,7 @@
     
 /// If data submitted, then process and store.
 
-    if ($form = data_submitted()) {
+    if ($form = data_submitted() and confirm_sesskey()) {
         foreach ($form as $preference => $value) {
             switch ($preference) {
                 case 'timeformat':

config-dist.php

@@ -139,6 +139,13 @@ $CFG->admin = 'admin';
 // Useful for webhost operators who have alternate methods of backups
 //      $CFG->disablescheduledbackups = true;
 //
+// Allow user passwords to be included in backup files. Very dangerous
+// setting as far as it publishes password hashes that can be unencrypted
+// if the backup file is publicy available. Use it only if you can guarantee
+// that all your backup files remain only privacy available and are never
+// shared out from your site/institution!
+//      $CFG->includeuserpasswordsinbackup = true;
+//
 // Prevent stats processing and hide the GUI
 //      $CFG->disablestatsprocessing = true;
 //

course/category.php

@@ -160,7 +160,17 @@
             $courses = array();        
             foreach ( $data as $key => $value ) {
                 if (preg_match('/^c\d+$/', $key)) {
-                    array_push($courses, substr($key, 1));
+                    $courseid = substr($key, 1);
+                    array_push($courses, $courseid);
+
+                    // check this course's category
+                    if ($movingcourse = get_record('course', 'id', $courseid)) {
+                        if ($movingcourse->category != $id ) {
+                            error('The course doesn\'t belong to this category');
+                        }
+                    } else {
+                        error('Error finding the course');
+                    }
                 }
             } 
             move_courses($courses, $data->moveto);
@@ -169,7 +179,6 @@
     /// Hide or show a course
 
         if ((!empty($hide) or !empty($show)) and confirm_sesskey()) {
-            require_capability('moodle/course:visibility', $context);
             if (!empty($hide)) {
                 $course = get_record("course", "id", $hide);
                 $visible = 0;
@@ -178,8 +187,10 @@
                 $visible = 1;
             }
             if ($course) {
-                if (! set_field("course", "visible", $visible, "id", $course->id)) {
-                    notify("Could not update that course!");
+                $coursecontext = get_context_instance(CONTEXT_COURSE, $course->id);
+                require_capability('moodle/course:visibility', $coursecontext);
+                if (!set_field('course', 'visible', $visible, 'id', $course->id)) {
+                    notify('Could not update that course!');
                 }
             }
         }
@@ -212,8 +223,11 @@
                                          'category',  $category->id,
                                          'sortorder', $movecourse->sortorder + 1);
             }
-
             if ($swapcourse and $movecourse) {        // Renumber everything for robustness
+                // check course's category
+                if ($movecourse->category != $id) {
+                    error('The course doesn\'t belong to this category');
+                }
                 begin_sql();
                 if (!(    set_field("course", "sortorder", $max, "id", $swapcourse->id)
                        && set_field("course", "sortorder", $swapcourse->sortorder, "id", $movecourse->id)

course/import/groups/index.php

@@ -50,7 +50,7 @@
 
     require_once($CFG->dirroot.'/lib/uploadlib.php');
     $um = new upload_manager('userfile',false,false,null,false,0);
-    if ($um->preprocess_files()) {
+    if ($um->preprocess_files() and confirm_sesskey()) {
         $filename = $um->files['userfile']['tmp_name'];
 
         //Fix mac/dos newlines

course/rest.php

@@ -44,7 +44,12 @@ $context = get_context_instance(CONTEXT_COURSE, $course->id);
 require_login($course->id);
 require_capability('moodle/course:update', $context);
 
+if (!empty($CFG->disablecourseajax)) {
+    errorl_log('Course AJAX not allowed');
+    die;
+}
 
+require_sesskey();
 
 // OK, now let's process the parameters and do stuff
 switch($_SERVER['REQUEST_METHOD']) {

enrol/ldap/enrol.php

@@ -214,6 +214,11 @@ function sync_enrolments($type, $enrol = false) {
                                           $this->enrol_localcoursefield,
                                           $idnumber );
                 if (!is_object($course_obj)) {
+                    if (empty($CFG->enrol_ldap_autocreate)) { // autocreation not allowed
+                        print "[ENROL_LDAP] Course $idnumber does not exist, skipping\n";
+                        continue; // next foreach course
+                    }
+
                     // ok, now then let's create it!
                     print "Creating Course $idnumber...";
                     $newcourseid = $this->create_course($course, true); // we are skipping fix_course_sortorder()

enrol/manual/enrol.html

@@ -19,6 +19,7 @@
               <input type="password" name="password" size="20" value="<?php p($password) ?>"  />
               <input type="hidden" name="id" value="<?php p($course->id) ?>"  />
               <input type="hidden" name="enrol" value="manual" />
+              <input type="hidden" name="sesskey" value="<?php echo sesskey() ?>" />
               <input type="submit" value="<?php print_string("enrolme") ?>" />
             </td>
           </tr>

enrol/manual/enrol.php

@@ -64,12 +64,12 @@ function print_entry($course) {
 
             print_header($strloginto, $course->fullname, "<a href=\".\">$strcourses</a> -> $strloginto");
             echo '<br />';
-            notice_yesno(get_string('enrolmentconfirmation'), "enrol.php?id=$course->id&amp;confirm=1", 
+            notice_yesno(get_string('enrolmentconfirmation'), "enrol.php?id=$course->id&amp;confirm=1&amp;sesskey=".sesskey(),
                                                               "enrol.php?id=$course->id&amp;cancel=1");
             print_footer();
             exit;
 
-        } else if (!empty($_GET['confirm'])) {
+        } else if (!empty($_GET['confirm'])  and confirm_sesskey()) {
 
             if (!enrol_into_course($course, $USER, 'manual')) {
                 print_error('couldnotassignrole');
@@ -130,7 +130,7 @@ function check_entry($form, $course) {
         $form->password = '';
     }
 
-    if (empty($course->password)) {
+    if (empty($course->password) or !confirm_sesskey()) {
         // do not allow entry when no course password set
         // automatic login when manual primary, no login when secondary at all!!
         error('illegal enrolment attempted');

enrol/mnet/enrol.php

@@ -287,6 +287,7 @@ class enrolment_plugin_mnet {
             $returnarray[$user->username] = array('enrol' => $user->enrol, 
                                                   'timemodified' => $user->timemodified, 
                                                   'shortname' => $user->shortname, 
+                                                  'username' => $user->username,
                                                   'name' => $user->name);
         }
         return $returnarray;

enrol/paypal/ipn.php

@@ -98,6 +98,13 @@
                 die;
             }
 
+            // If currency is incorrectly set then someone maybe trying to cheat the system 
+
+            if ($data->mc_currency != $course->currency) {
+                email_paypal_error_to_admin("Currency does not match course settings, received: ".addslashes($data->mc_currency), $data);
+                die;
+            }
+
             // If status is pending and reason is other than echeck then we are on hold until further notice
             // Email user to let them know. Email admin.
 

filter/algebra/algebradebug.php

@@ -25,6 +25,8 @@
       $CFG->algebrafilterdirwin = "filter\\algebra";
     }
 
+    require_login();
+    require_capability('moodle/site:config', get_context_instance(CONTEXT_SYSTEM));
 
     $query = urldecode($_SERVER['QUERY_STRING']);
     error_reporting(E_ALL);

filter/tex/README.mimetex

@@ -1,10 +1,10 @@
 
  --------------------------------------------------------------------------
- January 11, 2004                                              Version 1.40
+ September 6, 2008                                             Version 1.70
 
                   m i m e T e X   R e a d m e   F i l e
 
- Copyright(c) 2002-2004, John Forkosh Associates, Inc. All rights reserved.
+ Copyright(c) 2002-2008, John Forkosh Associates, Inc. All rights reserved.
  --------------------------------------------------------------------------
 
                             by: John Forkosh
@@ -12,17 +12,21 @@
 
           This file is part of mimeTeX, which is free software.
           You may redistribute and/or modify it under the terms
-          of the GNU General Public License, version 2 or later,
+          of the GNU General Public License, version 3 or later,
           as published by the Free Software Foundation. See
                    http://www.gnu.org/licenses/gpl.html
 
-          Follow the Quick Start instructions immediately below
-          or the detailed instructions in Section III to install
-          mimeTeX on your machine, and then point your browser to
-                  http://www.yourdomain.com/mimetex.html
-          for a complete discussion, including demo/tutorial and
-          reference.  Installation problems?  Point your browser
-          to my page at
+          MimeTeX is discussed and illustrated online at
+          its homepage
+                    http://www.forkosh.com/mimetex.html
+          Or you can follow the Quick Start instructions below
+          (or the more detailed instructions in Section III)
+          to immediately install mimeTeX on your own machine.
+          Then point your browser to
+                    http://www.yourdomain.com/mimetex.html
+          for a demo/tutorial and reference.
+               Installation problems?  Point your browser to
+          mimeTeX's homepage
                     http://www.forkosh.com/mimetex.html
           then click its "full mimeTeX manual" link and see
           Section II.
@@ -31,57 +35,63 @@
 I.  QUICK START
 ------------------------------------------------------------------------
   To compile and install mimeTeX
-       o unzip mimetex.zip in any convenient working directory
-       o to produce an executable that emits anti-aliased gif images
+       * unzip mimetex.zip in any convenient working directory
+       * to produce an executable that emits anti-aliased
+         gif images (recommended)
               cc -DAA mimetex.c gifsave.c -lm -o mimetex.cgi
          -or- for gif images without anti-aliasing
               cc -DGIF mimetex.c gifsave.c -lm -o mimetex.cgi
          -or- to produce an executable that emits mime xbitmaps
               cc -DXBITMAP mimetex.c -lm -o mimetex.cgi
-       o mv mimetex.cgi  to your server's cgi-bin/ directory
-       o mv mimetex.html to your server's htdocs/  directory
-       o if the relative path from htdocs to cgi-bin isn't
+         (For Windows, see "Compile Notes" in Section III below.)
+       * mv mimetex.cgi  to your server's cgi-bin/ directory
+       * mv mimetex.html to your server's htdocs/  directory
+       * if the relative path from htdocs to cgi-bin isn't
          ../cgi-bin then edit mimetex.html and change the
-         few dozen occurrences as necessary
-  To quickly learn about mimeTeX
-       o point your browser to www.yourdomain.com/mimetex.html
+         few dozen occurrences as necessary.
+  Then, to quickly learn more about mimeTeX
+       * point your browser to www.yourdomain.com/mimetex.html
   Any problems with the above?
-       o read the more detailed instructions in Section III below,
-         or see www.forkosh.com/mimetex.html
+       * read the more detailed instructions below,
+         or see http://www.forkosh.com/mimetex.html
 
 
 II.  INTRODUCTION
 ------------------------------------------------------------------------
-  MimeTeX is licensed under the gpl.  It parses LaTeX math expressions,
-  emitting either gif images or mime xbitmaps of them, rather than the
-  usual TeX dvi's.  And mimeTeX is an entirely separate little program
-  that doesn't use TeX in any way.  Therefore, mimeTeX images are easily
-  inserted directly into html documents using a standard html <img> tag,
-       <img src="../cgi-bin/mimetex.cgi?f(x)=\int_{-\infty}^x~e^{-t^2}dt"
-        border=0 align=absmiddle>
-  without intermediate dvi-to-gif conversion, and without storing lots
-  of little gif image files, one file for each converted expression.
-  This makes your web site and html documents more easily maintained.
-
-  Thus, mimeTeX is primarily intended to help you write native html
-  documents containing math.  In this sense it's a kind of "lightweight"
-  alternative to MathML, with the advantage that mimeTeX preserves LaTeX
-  syntax, and works with any browser and server.
+  MimeTeX, licensed under the gpl, lets you easily embed LaTeX math in
+  your html pages.  It parses a LaTeX math expression and immediately
+  emits the corresponding gif image, rather than the usual TeX dvi.
+       And mimeTeX is an entirely separate little program that doesn't
+  use TeX or its fonts in any way.  It's just one cgi that you put in
+  your site's cgi-bin/ directory, with no other dependencies.
+  So mimeTeX is very easy to install.  And it's equally easy to use.
+  Just place an html <img> tag in your document wherever you want to
+  see the corresponding LaTeX expression.  For example,
+    <img src="../cgi-bin/mimetex.cgi?f(x)=\int_{-\infty}^x~e^{-t^2}dt"
+     border=0 align=absmiddle>
+  generates and displays the corresponding gif image on-the-fly,
+  wherever you put that <img> tag.  MimeTeX doesn't need intermediate
+  dvi-to-gif conversion, and it doesn't clutter your filesystem with
+  separate little gif files for each converted expression.  (Optional
+  image caching does store gif files, and subsequently reads them as
+  needed, rather than re-rendering the same images every time a page
+  is reloaded.)
 
 
 III.  COMPILATION AND INSTALLATION
 ------------------------------------------------------------------------
-  I've comnpiled and run mimeTeX under Linux and NetBSD using gcc.
-  The source code is entirely ansi-standard C, and should compile
+  I've built and run mimeTeX under Linux and NetBSD using gcc.
+  The source code is ansi-standard C, and should compile
   and execute under all environments without any change whatsoever.
-  Build instructions below are for Unix.  Modify them as necessary
-  for your particular situation.
+  Build instructions below are for Unix. Modify them as necessary
+  for your particular situation.  Note the -DWINDOWS switch if
+  applicable.
 
   Unzip mimetex.zip in any convenient working directory.
-  You should now have files
+  Your working directory should now contain
        mimetex.zip    your gnu zipped mimeTeX distribution containing...
        README         this file (see mimetex.html for demo/tutorial)
-       LICENSE        GPL license, under which you may use mimeTeX
+       COPYING        GPL license, under which you may use mimeTeX
        mimetex.c      mimeTeX source program and all required functions
        mimetex.h      header file for mimetex.c (and for gfuntype.c)
        gfuntype.c     parses output from  gftype -i  and writes bitmap data
@@ -93,32 +103,35 @@ III.  COMPILATION AND INSTALLATION
   Conversion for Windows, Macs, VMS, etc, can usually be accomplished
   with unzip's -a option, i.e.,  unzip -a mimetex.zip
 
-  Now, to produce an executable that emits anti-aliased gif images
-       (which is how the "official" www.forkosh.com/mimetex.html page
-       is displayed), compile mimetex with the command
-          cc -DAA mimetex.c gifsave.c -lm -o mimetex.cgi
+  Now, to compile a mimeTeX executable that emits anti-aliased gif
+  images (recommended for most uses), type the command
+            cc -DAA mimetex.c gifsave.c -lm -o mimetex.cgi
 
-       Or, to produce an executable that emits gif images
-       without anti-aliasing, compile mimetex with the command
-          cc -DGIF mimetex.c gifsave.c -lm -o mimetex.cgi
+  Or, for an executable that emits gif images without
+  anti-aliasing,
+            cc -DGIF mimetex.c gifsave.c -lm -o mimetex.cgi
 
-       Alternatively, for an executable that emits mime xbitmaps,
-       just compile mimetex with the command
-          cc -DXBITMAP mimetex.c -lm -o mimetex.cgi
+  Alternatively, to compile a mimeTeX executable that emits
+  mime xbitmaps, just type the command
+            cc -DXBITMAP mimetex.c -lm -o mimetex.cgi
 
-       Several additional command-line options that you may find
-       useful are discussed in Section IIc (href="#options")
-       of mimetex.html .
+  Compile Notes:
+     * If (and only if) you're compiling a Windows executable
+       with the -DAA or -DGIF option (but not -DXBITMAP), then
+       add -DWINDOWS also.  For example,
+            cc -DAA -DWINDOWS mimetex.c gifsave.c -lm -o mimetex.cgi
+       The above Unix-like syntax works with MinGW (http://www.mingw.org)
+       and djgpp (http://www.delorie.com/djgpp/) Windows compilers, but
+       probably not with most others, where it's only intended as a
+       "template".
+     * Several additional command-line options that you may find
+       useful are discussed in Section IId (href="#options")
+       of your mimetex.html page.
 
-  That's all there is to building mimeTeX.  You can now test mimetex.cgi
-  from the Unix command line by typing, e.g.,
-       ./mimetex.cgi x^2+y^2
-  which should emit an ascii raster something like the left-hand
-  illustration.  And if you've compiled mimeTeX with the anti-aliasing
-  -DAA option, then you'll also see the right-hand illustration.
-  It shows asterisks in the same positions as the left-hand illustration,
-  and anti-aliased grayscale colormap indexes assigned to neighboring
-  pixels.  And you'll also be shown the actual rgb value for each index.
+  That's all there is to building mimeTeX.  You can now test your
+  mimetex.cgi executable from the Unix command line by typing, e.g.,
+       ./mimetex.cgi "x^2+y^2"
+  which should emit two ascii rasters something like the following
     Ascii dump of bitmap image...     Hex dump of colormap indexes...
     ........**..................**..  .......1**1................1**1.
     .......*..*.....*..........*..*.  .......*23*.....*..........*23*.
@@ -132,34 +145,50 @@ III.  COMPILATION AND INSTALLATION
     ................*....**.........  ................*....**1........
                                   The 5 colormap indexes denote rgb...
                                  .-->255 1-->196 2-->186 3-->177 *-->0
-  If you get much fancier than x^2+y^2, remember that many characters have
-  to be escaped from the Unix command line, e.g., x\<y or f\(x\)=x^2, etc.
-  Of course, you won't need these extra escapes when running mimetex from
-  a browser.
+  The right-hand illustration shows asterisks in the same positions as
+  the left-hand one, along with anti-aliased grayscale colormap indexes
+  assigned to neighboring pixels, and with the rgb value for each
+  index.  Just typing ./mimetex.cgi without an argument should produce
+  ascii rasters for the default expression f(x)=x^2.  If you see the
+  two ascii rasters then your binary's good, so mv it to your server's
+  cgi-bin/ directory and set permissions as necessary.
 
-  Once mimetex.cgi is working (and you're done playing with it),
-  mv it to your server's cgi-bin/ directory, where cgi programs
-  are expected (and chmod/chown it if necessary).  Then mv
-  mimetex.html to your server's htdocs/ directory.  Now point
-  your browser to www.yourdomain.com/mimetex.html , and it should
-  be rendered exactly like my page at www.forkosh.com/mimetex.html .
-       One "gotcha":  the two directories are typically of the form
-  somewhere/www/cgi-bin/ and somewhere/www/htdocs/ ,  so I set up
-  mimtex.html to get mimetex.cgi from the relative path ../cgi-bin/ .
-  If your directories are non-conforming, you may have to edit the
-  few dozen occurrences of ../cgi-bin/mimetex.cgi in mimetex.html
-  (globally changing ../cgi-bin/mimetex.cgi should work).
-  Sometimes a suitable symlink works; if not, you'll have to edit.
+  Once mimetex.cgi is working, mv it to your server's cgi-bin/ directory
+  (wherever cgi programs are expected), and chmod/chown it as necessary.
+  Then mv mimetex.html to your server's htdocs/ directory.  Now point
+  your browser to www.yourdomain.com/mimetex.html and you should see
+  your mimeTeX user's manual reference page.
 
-  Either way, once mimetex.html displays properly, and you've reviewed
-  the tutorial it contains, you can begin writing html documents using
-  mimetex.cgi to render your math.
+  Install Notes:
+     * These two directories are typically of the form
+       somewhere/www/cgi-bin/  and  somewhere/www/htdocs/
+       so I set up mimtex.html to access mimetex.cgi from
+       the relative path ../cgi-bin/   If your directories
+       are non-conforming, you may have to edit the few dozen
+       occurrences of ../cgi-bin/mimetex.cgi in mimetex.html
+       Sometimes a suitable symlink works.  If not, you'll
+       have to edit.  In that case, globally changing
+       ../cgi-bin/mimetex.cgi  often works.
+     * Either way, once mimetex.html displays properly, you can
+       assume everything is working, and can begin authoring html
+       documents using mimetex.cgi to render your own math.
 
 
 IV.  REVISION HISTORY
 ------------------------------------------------------------------------
-  01/11/04  J.Forkosh      version 1.40 beta released on www.forkosh.com
-                           LaTeX compatibility and various new features
+  A more detailed account of mimeTeX's revision history
+  is maintained at  http://www.forkosh.com/mimetexchangelog.html
+  ---
+  09/06/08  J.Forkosh      version 1.70 released.
+  11/30/04  J.Forkosh      version 1.60 released
+  10/02/04  J.Forkosh      version 1.50 released on CTAN with various new
+                           features and fixes, and updated documentation.
+  07/18/04  J.Forkosh      version 1.40 re-released on CTAN with minor
+                           changes, e.g., \mathbb font and nested \array's
+                           now supported.
+  03/21/04  J.Forkosh      version 1.40 released on CTAN, with improved
+                           LaTeX compatibility, various new features and
+                           fixes, including fix to work under Windows.
   12/21/03  J.Forkosh      version 1.30 released on CTAN, with improved
                            LaTeX compatibility and anti-aliasing, various new
                            features, and thoroughly updated documentation.
@@ -183,9 +212,5 @@ V.  CONCLUDING REMARKS
   I hope you find mimeTeX useful.  If so, a contribution to your
   country's TeX Users Group, or to the GNU project, is suggested,
   especially if you're a company that's currently profitable.
-  
-  If you also like mimeTeX's source, I'm an independent contractor
-  incorporated in the US as John Forkosh Associates, Inc.  A resume
-  is at www.forkosh.com or email john@forkosh.com
 ========================= END-OF-FILE README ===========================