Moodle 1.9.13 release

weekly release 1.9.12+
MDL-28411 Post-integration improvement of string changes
2011-08-01 16:53:14 +08:00 · 2011-07-26 11:04:59 +02:00 · 2011-07-26 16:09:12 +08:00 · 2011-07-25 16:40:56 +02:00 · 2011-07-25 12:59:49 +08:00 · 2011-07-25 12:59:18 +08:00
119 changed files with 3859 additions and 2870 deletions
@@ -0,0 +1,27 @@
+# This file specifies intentionally untracked files that all Moodle git
+# repositories should ignore. It is recommended not to modify this file in your
+# local clone. Instead, use .git/info/exclude and add new records there as
+# needed.
+#
+# Example: if you deploy a contributed plugin mod/foobar into your site, put
+# the following line into .git/info/exclude file in your Moodle clone:
+# /mod/foobar/
+#
+# See gitignore(5) man page for more details
+#
+/config.php
+/lib/editor/tinymce/extra/tools/temp/
+*~
+*.swp
+/tags
+/TAGS
+/cscope.*
+/.patches/
+/.idea/
+/nbproject/
+CVS
+.DS_Store
+/.settings/
+/.project
+/.buildpath
+/.cache
@@ -321,6 +321,125 @@
      </PHP_SETTING>
    </PHP_SETTINGS>
    <CUSTOM_CHECKS>
+      <CUSTOM_CHECK file="lib/customcheckslib.php" function="php_check_php533" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="php533warning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
    </CUSTOM_CHECKS>
  </MOODLE>
+  <MOODLE version="2.1" requires="1.9">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mysql" version="5.0.25">
+        <FEEDBACK>
+          <ON_ERROR message="mysql416required" />
+        </FEEDBACK>
+      </VENDOR>
+      <VENDOR name="postgres" version="8.3" />
+      <VENDOR name="mssql" version="9.0" />
+      <VENDOR name="odbc_mssql" version="9.0" />
+      <VENDOR name="mssql_n" version="9.0" />
+      <VENDOR name="oracle" version="10.2" />
+      <VENDOR name="sqlite" version="2.0" />
+    </DATABASE>
+    <PHP version="5.3.2" level="required">
+    </PHP>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opensslrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="gdrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="intlrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="40M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="safe_mode" value="0" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingsafemode" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+  </MOODLE>
 </COMPATIBILITY_MATRIX>
@@ -75,12 +75,12 @@
                .$param->extras
                ." ORDER BY ".$param->orderby;
        }
-        error_log($sql);

        $courses = get_records_sql($sql, 0, $numcourses);

        if (empty($courses)) {
-            notify(get_string('statsnodata'));echo '</td></tr></table>';echo '<p>after notify</p>';
+            notify(get_string('statsnodata'));
+            echo '</td></tr></table>';

        } else {
            if (empty($CFG->gdversion)) {
@@ -1050,8 +1050,7 @@ function report_security_check_riskadmin($detailed=false) {
                     AND (sc.path = c.path OR sc.path LIKE ".sql_concat('c.path', "'/%'")." OR c.path LIKE ".sql_concat('sc.path', "'/%'").")
                     AND u.id = ra.userid AND u.deleted = 0
                     AND ra.contextid = sc.id AND ra.roleid = rc.roleid AND ra.contextid <> ".SYSCONTEXTID."
-            GROUP BY u.id, u.firstname, u.lastname, u.picture, u.imagealt, u.email, ra.contextid, ra.roleid
-            ORDER BY u.lastname, u.firstname";
+            GROUP BY u.id, u.firstname, u.lastname, u.picture, u.imagealt, u.email, ra.contextid, ra.roleid";

    $unsupcount = count_records_sql("SELECT COUNT('x') FROM ($sqlunsup) unsup");

@@ -1077,6 +1076,7 @@ function report_security_check_riskadmin($detailed=false) {
        $result->info = get_string('check_riskadmin_warning', 'report_security', $a);

        if ($detailed) {
+            $sqlunsup .= " ORDER BY u.lastname, u.firstname";
            $rs = get_recordset_sql($sqlunsup);
            $users = array();
            while ($user = rs_fetch_next_record($rs)) {
@@ -1113,13 +1113,13 @@ function report_security_check_riskbackup($detailed=false) {
    $syscontext = get_context_instance(CONTEXT_SYSTEM);

    $systemroles = get_records_sql(
-        "SELECT DISTINCT r.*
+        "SELECT DISTINCT r.id, r.name, r.shortname, r.sortorder
           FROM {$CFG->prefix}role r
           JOIN {$CFG->prefix}role_capabilities rc ON rc.roleid = r.id
          WHERE rc.capability = 'moodle/backup:userinfo' AND rc.contextid = $syscontext->id AND rc.permission = ".CAP_ALLOW."");

    $overriddenroles = get_records_sql(
-        "SELECT DISTINCT r.*, rc.contextid
+        "SELECT DISTINCT r.id, r.name, r.shortname, r.sortorder, rc.contextid
           FROM {$CFG->prefix}role r
           JOIN {$CFG->prefix}role_capabilities rc ON rc.roleid = r.id
          WHERE rc.capability = 'moodle/backup:userinfo' AND rc.contextid <> $syscontext->id AND rc.permission = ".CAP_ALLOW."");
@@ -558,7 +558,7 @@ if ($formdata = $mform->is_cancelled()) {
                continue;
            }
            // save custom profile fields data
-            profile_save_data($user);
+            profile_save_data(addslashes_recursive($user));

            // make sure user context exists
            get_context_instance(CONTEXT_USER, $user->id);
@@ -665,7 +665,7 @@ if ($formdata = $mform->is_cancelled()) {
                    $newgroupdata = new object();
                    $newgroupdata->name = $addgroup;
                    $newgroupdata->courseid = $ccache[$shortname]->id;
-                    if ($ccache[$shortname]->groups[$addgroup]->id = groups_create_group($newgroupdata)){
+                    if ($ccache[$shortname]->groups[$addgroup]->id = groups_create_group(addslashes_recursive($newgroupdata))){
                        $ccache[$shortname]->groups[$addgroup]->name = $newgroupdata->name;
                    } else {
                        $upt->track('enrolments', get_string('unknowngroup', 'error', $addgroup), 'error');
@@ -114,8 +114,12 @@ class auth_plugin_cas extends auth_plugin_base {
 // Connection to CAS server
 	 $this->connectCAS();

+     if($this->config->certificate_check && $this->config->certificate_path){
+         phpCAS::setCasServerCACert($this->config->certificate_path);
+     }else{
         // Don't try to validate the server SSL credentials
         phpCAS::setNoCasServerValidation();
+     }

 	  // Gestion de la connection CAS si acc�s direct d'un ent ou autre	
 	 if (phpCAS::checkAuthentication()) {
@@ -202,6 +206,19 @@ if ( !is_object($PHPCAS_CLIENT) ) {
    function config_form($config, $err, $user_fields) {
        include 'config.html';
    }
+
+    /**
+     * A chance to validate form data, and last chance to
+     * do stuff before it is inserted in config_plugin
+     * @param object object with submitted configuration settings (without system magic quotes)
+     * @param array $err array of error messages
+     */
+    function validate_form(&$form, &$err) {
+        $certificate_path = trim($form->certificate_path);
+        if ($form->certificate_check && empty($certificate_path)) {
+            $err['certificate_path'] = get_string('auth_cas_certificate_path_empty', 'auth');
+        }
+    }
    /**
     * Returns the URL for changing the user's pw, or empty if the default can
     * be used.
@@ -248,6 +265,10 @@ if ( !is_object($PHPCAS_CLIENT) ) {
            $config->logoutcas = '';
        if (!isset ($config->multiauth))
            $config->multiauth = '';
+        if (!isset ($config->certificate_check))
+            $config->certificate_check = '';
+        if (!isset ($config->certificate_path))
+            $config->certificate_path = '';
        // LDAP settings
        if (!isset($config->host_url))
            { $config->host_url = ''; }
@@ -290,6 +311,8 @@ if ( !is_object($PHPCAS_CLIENT) ) {
        set_config('proxycas',     $config->proxycas,     'auth/cas');
        set_config('logoutcas',     $config->logoutcas,     'auth/cas');
        set_config('multiauth',     $config->multiauth,     'auth/cas');
+        set_config('certificate_check',     $config->certificate_check,     'auth/cas');
+        set_config('certificate_path',     $config->certificate_path,     'auth/cas');
        // save LDAP settings
        set_config('host_url', $config->host_url, 'auth/cas');
        set_config('ldapencoding', $config->ldapencoding, 'auth/cas');
@@ -48,6 +48,14 @@

        $config->multiauth = '';

+    if (!isset ($config->certificate_check)) 
+
+        $config->certificate_check = '';
+
+    if (!isset ($config->certificate_path))
+
+        $config->certificate_path = '';
+
  // set to defaults if undefined (LDAP)

    if (!isset($config->host_url))
@@ -364,6 +372,44 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?



+<tr valign="top"  class="required">
+
+    <td align="right"><?php print_string('auth_cas_certificate_check_key', 'auth') ?>:</td>
+
+    <td>
+
+        <?php choose_from_menu ($yesno, 'certificate_check', $config->certificate_check, ''); ?>
+
+    </td>
+
+    <td><?php print_string('auth_cas_certificate_check', 'auth') ?></td>
+
+</tr>
+
+
+
+<tr valign="top" class="required">
+
+    <td align="right"><?php print_string('auth_cas_certificate_path_key', 'auth') ?>:</td>
+
+    <td>
+
+        <input name="certificate_path" type="text" size="30" value="<?php echo $config->certificate_path ?>" />
+
+        <?php if (isset($err['certificate_path'])) formerr($err['certificate_path']); ?>
+
+    </td>
+
+    <td>
+
+        <?php print_string('auth_cas_certificate_path', 'auth') ?>
+      
+    </td>
+
+</tr>
+
+
+
 <tr>

   <td colspan="2">
@@ -101,6 +101,7 @@ if (isset($rss_record)) {


 if ($act == 'updfeed') {
+    require_sesskey();

    if (!$managefeeds) {
        error(get_string('noguestpost', 'forum').
@@ -153,6 +154,7 @@ if ($act == 'updfeed') {
    redirect($referrer, $message);

 } else if ($act == 'addfeed' ) {
+    require_sesskey();

    $canaddprivfeeds = has_capability('block/rss_client:createprivatefeeds', $context);
    $canaddsharedfeeds = has_capability('block/rss_client:createsharedfeeds', $context);
@@ -225,6 +227,7 @@ if ($act == 'updfeed') {
    rss_print_form($act, $url, $rssid, $preferredtitle, $shared, $id, $context);

 } else if ($act == 'delfeed') {
+    require_sesskey();

    if (!$managefeeds) {
        error(get_string('noguestpost', 'forum').
@@ -57,7 +57,7 @@
        if ($resort and confirm_sesskey()) {
            if ($courses = get_courses($category->id, "fullname ASC", 'c.id,c.fullname,c.sortorder')) {
                // move it off the range
-                
+
                $sortorderresult = get_record_sql('SELECT MIN(sortorder) AS min, 1
                                         FROM ' . $CFG->prefix . 'course WHERE category=' . $category->id);
                $sortordermin = $sortorderresult->min;
@@ -131,7 +131,10 @@
 /// Print current category description
    if (!$editingon && $category->description) {
        print_box_start();
-        echo format_text($category->description); // for multilang filter
+        $options = new stdClass();
+        $options->noclean = true;
+        $options->para = false;
+        echo format_text($category->description, FORMAT_MOODLE, $options); // for multilang filter
        print_box_end();
    }

@@ -61,6 +61,8 @@ if ($mform->is_cancelled()) {
        // Update an existing category.
        $newcategory->id = $category->id;
        if ($newcategory->parent != $category->parent) {
+            // check category manage capability if parent changed
+            require_capability('moodle/category:manage', get_category_or_system_context((int)$newcategory->parent));
            $parent_cat = get_record('course_categories', 'id', $newcategory->parent);
            move_category($newcategory, $parent_cat);
        }
@@ -9,11 +9,17 @@ class editcategory_form extends moodleform {
        $category = $this->_customdata;

        // get list of categories to use as parents, with site as the first one
-        $options = array(get_string('top'));
+        $options = array();
+        if (has_capability('moodle/category:manage', get_system_context()) || $category->parent == 0) {
+            $options[0] = get_string('top');
+        }
        $parents = array();
        if ($category->id) {
            // Editing an existing category.
            make_categories_list($options, $parents, 'moodle/category:manage', $category->id);
+            if (empty($options[$category->parent])) {
+               $options[$category->parent] = get_field('course_categories', 'name', 'id', $category->parent);
+            }
            $strsubmit = get_string('savechanges');
        } else {
            // Making a new category
@@ -5,6 +5,6 @@


 $CFG->ajaxcapable = true;
-$CFG->ajaxtestedbrowsers = array('MSIE' => 6.0, 'Gecko' => 20061111);
+$CFG->ajaxtestedbrowsers = array('MSIE' => 6.0, 'Gecko' => 20061111, 'Safari'=>531, 'Chrome'=>6.0);

 ?>
@@ -221,11 +221,11 @@
            echo '<td class="right side">';
            if ($displaysection == $section) {      // Show the zoom boxes
                echo '<a href="view.php?id='.$course->id.'&amp;topic=0#section-'.$section.'" title="'.$strshowalltopics.'">'.
-                     '<img src="'.$CFG->pixpath.'/i/all.gif" alt="'.$strshowalltopics.'" /></a><br />';
+                     '<img src="'.$CFG->pixpath.'/i/all.gif" class="icon topicall" alt="'.$strshowalltopics.'" /></a><br />';
            } else {
                $strshowonlytopic = get_string('showonlytopic', '', $section);
                echo '<a href="view.php?id='.$course->id.'&amp;topic='.$section.'" title="'.$strshowonlytopic.'">'.
-                     '<img src="'.$CFG->pixpath.'/i/one.gif" alt="'.$strshowonlytopic.'" /></a><br />';
+                     '<img src="'.$CFG->pixpath.'/i/one.gif" class="icon topicone" alt="'.$strshowonlytopic.'" /></a><br />';
            }

            if (isediting($course->id) && has_capability('moodle/course:update', get_context_instance(CONTEXT_COURSE, $course->id))) {
@@ -5,6 +5,6 @@


 $CFG->ajaxcapable = true;
-$CFG->ajaxtestedbrowsers = array('MSIE' => 6.0, 'Gecko' => 20061111);
+$CFG->ajaxtestedbrowsers = array('MSIE' => 6.0, 'Gecko' => 20061111, 'Safari'=>531, 'Chrome'=>6.0);

 ?>
@@ -523,7 +523,7 @@ function print_log_csv($course, $user, $date, $order='l.time DESC', $modname,
    header("Pragma: public");

    echo get_string('savedat').userdate(time(), $strftimedatetime)."\n";
-    echo $text;
+    echo $text."\n";

    if (empty($logs['logs'])) {
        return true;
@@ -186,7 +186,7 @@
                FROM (SELECT * FROM {$CFG->prefix}role_assignments WHERE contextid $relatedcontexts AND roleid = $roleid ) ra
                JOIN {$CFG->prefix}user u ON u.id = ra.userid
                LEFT JOIN (
-                    SELECT userid, COUNT(action) actioncount FROM {$CFG->prefix}log WHERE cmid = $instanceid AND time > $timefrom AND $actionsql GROUP BY userid
+                    SELECT userid, COUNT(action) AS actioncount FROM {$CFG->prefix}log WHERE cmid = $instanceid AND time > $timefrom AND $actionsql GROUP BY userid
                ) l ON (l.userid = ra.userid)";


@@ -87,7 +87,7 @@ Cron
 ====

 If your class offers a cron() method, it will be invoked by
-the standard Moodle cron every 5 minutes. Note that if the
+the standard Moodle cron every time it is called. Note that if the
 tasks are not lightweight you must control how frequently they
 execute, perhaps offering a config option.

@@ -71,7 +71,7 @@ class enrolment_plugin_authorize
            $curcost = get_course_cost($course);
            echo '<div class="mdl-align">';
            echo '<p>'.get_string('paymentrequired').'</p>';
-            echo '<p><b>'.get_string('cost').": $curcost[currency] $curcost[cost]".'</b></p>';
+            echo '<p><b>'.get_string('cost').': '. $curcost['currency'] . $curcost['localizedcost'] .'</b></p>';
            echo '<p><a href="'.$CFG->httpswwwroot.'/login/">'.get_string('loginsite').'</a></p>';
            echo '</div>';
        }
@@ -387,7 +387,7 @@ class enrolment_plugin_authorize
            }

            $str .= '<div class="cost" title="'.$strrequirespayment.'">'.$strcost.': ';
-            $str .= $currency . ' ' . $curcost['cost'].'</div>';
+            $str .= $currency . ' ' . $curcost['localizedcost'].'</div>';
        }

        return $str;
@@ -12,10 +12,11 @@ function get_course_cost($course)
    if (!empty($course->cost)) {
        $cost = (float)(((float)$course->cost) < 0) ? $CFG->enrol_cost : $course->cost;
    }
-
-    $cost = format_float($cost, 2);
+    $costlocalizeddisplay = format_float($cost, 2);
+    $cost = format_float($cost, 2, false);
    $ret = array(
        'cost' => $cost,
+        'localizedcost' => $costlocalizeddisplay,
        'currency' => $currency
    );

@@ -93,7 +93,7 @@ function setup_enrolments(&$user) {
                //error_log('[ENROL_DB] Found '.count($existing).' existing roles and '.$count.' in external database');

                foreach ($courselist as $coursefield) {   /// Check the list of courses against existing
-                    $course = get_record('course', $CFG->enrol_localcoursefield, $coursefield);
+                    $course = get_record('course', $CFG->enrol_localcoursefield, addslashes($coursefield));
                    if (!is_object($course)) {
                        if (empty($CFG->enrol_db_autocreate)) { // autocreation not allowed
                            if (debugging('',DEBUG_ALL)) {
@@ -157,13 +157,13 @@ function get_access_icons($course) {
                        continue;
                    }

-                    if (! $user = get_record("user", "idnumber", $fields[2]) ) {
+                    if (! $user = get_record("user", "idnumber", addslashes($fields[2])) ) {
                        $this->log .= "Unknown user idnumber in field 3 - ignoring line\n";
                        continue;
                    }


-                    if (! $course = get_record("course", "idnumber", $fields[3]) ) {
+                    if (! $course = get_record("course", "idnumber", addslashes($fields[3])) ) {
                        $this->log .= "Unknown course idnumber in field 4 - ignoring line\n";
                        continue;
                    }
@@ -4,8 +4,8 @@ require_once("$CFG->dirroot/enrol/enrol.class.php");

 class enrolment_plugin_ldap {

-    var $log;    
-    
+    var $log;
+
    var $enrol_localcoursefield = 'idnumber';

 /**
@@ -23,7 +23,7 @@ function setup_enrolments(&$user) {
        notify("[ENROL_LDAP] LDAP-module cannot connect to server: {$CFG->enrol_ldap_host_url}");
        return false;
    }
-    
+
    // we are connected OK, continue...

    // Get all the possible roles
@@ -37,7 +37,7 @@ function setup_enrolments(&$user) {
    if (!$roleassignments) {
        $roleassignments = array();
    }
-    
+
    // Get the ones that came from LDAP
    $ldap_assignments = array_filter($roleassignments, create_function('$x', 'return $x->enrol == \'ldap\';'));

@@ -46,20 +46,20 @@ function setup_enrolments(&$user) {
    // Get enrolments for each type of role from LDAP.
    foreach($roles as $role) {
        $enrolments = $this->find_ext_enrolments(
-            $ldap_connection, 
-            $user->idnumber , 
+            $ldap_connection,
+            $user->idnumber ,
            $role);

        //error_log('[ENROL_LDAP] LDAP reports ' . count($enrolments) . ' enrolments of type ' . $role->shortname . '.');

        foreach ($enrolments as $enrol){
-    
+
            $course_ext_id = $enrol[$CFG->enrol_ldap_course_idnumber][0];
            if(empty($course_ext_id)){
                error_log("[ENROL_LDAP] The course external id is invalid!\n");
                continue; // next; skip this one!
            }
-            
+
            // create the course  ir required
            $course_obj = get_record( 'course',
                                      $this->enrol_localcoursefield,
@@ -74,18 +74,18 @@ function setup_enrolments(&$user) {
                    error_log("[ENROL_LDAP] User $user->username enrolled to a nonexistant course $course_ext_id \n");
                }
            }
-            
+
            // deal with enrolment in the moodle db
-            if (!empty($course_obj)) { // does course exist now?     
-        
+            if (!empty($course_obj)) { // does course exist now?
+
                $context = get_context_instance(CONTEXT_COURSE, $course_obj->id);
                //$courseroles = get_user_roles($context, $user->id);
-            
+
                if (!get_record('role_assignments', 'roleid', $role->id, 'userid', $user->id, 'contextid', $context->id)) {
                    //error_log("[ENROL_LDAP] Assigning role '{$role->name}' to {$user->id} ({$user->username}) in course {$course_obj->id} ({$course_obj->shortname})");
                    if (!role_assign($role->id, $user->id, 0, $context->id, 0, 0, 0, 'ldap')){
                        error_log("[ENROL_LDAP] Failed to assign role '{$role->name}' to $user->id ($user->username) into course $course_obj->id ($course_obj->shortname)");
-                    } 
+                    }
                } else {
                    //error_log("[ENROL_LDAP] Role '{$role->name}' already assigned to {$user->id} ({$user->username}) in course {$course_obj->id} ({$course_obj->shortname})");
                }
@@ -115,7 +115,7 @@ function setup_enrolments(&$user) {
    @ldap_close($ldap_connection);

    //error_log('[ENROL_LDAP] finished with setup_enrolments');
-    
+
    return true;
 }

@@ -137,7 +137,7 @@ function sync_enrolments($type, $enrol = false) {
        notify("LDAP-module cannot connect to server: $CFG->ldap_host_url");
        return false;
    }
-    
+
    // we are connected OK, continue...
    $this->enrol_ldap_bind($ldap_connection);

@@ -145,7 +145,7 @@ function sync_enrolments($type, $enrol = false) {
    $ldap_contexts = explode(";",$CFG->{'enrol_ldap_contexts_role'.$role->id});

    // get all the fields we will want for the potential course creation
-    // as they are light. don't get membership -- potentially a lot of data. 
+    // as they are light. don't get membership -- potentially a lot of data.
    $ldap_fields_wanted = array( 'dn', $CFG->enrol_ldap_course_idnumber);
    if (!empty($CFG->enrol_ldap_course_fullname)){
        array_push($ldap_fields_wanted, $CFG->enrol_ldap_course_fullname);
@@ -161,11 +161,11 @@ function sync_enrolments($type, $enrol = false) {
    }

    // define the search pattern
-    if (!empty($CFG->enrol_ldap_objectclass)){ 
+    if (!empty($CFG->enrol_ldap_objectclass)){
        $ldap_search_pattern='(objectclass='.$CFG->enrol_ldap_objectclass.')';
    } else {
       $ldap_search_pattern="(objectclass=*)";
-        
+
    }

    // first, pack the sortorder...
@@ -176,19 +176,19 @@ function sync_enrolments($type, $enrol = false) {
        $context = trim($context);
        if ($CFG->enrol_ldap_search_sub){
            //use ldap_search to find first user from subtree
-            $ldap_result = @ldap_search($ldap_connection, 
-                                        $context, 
+            $ldap_result = @ldap_search($ldap_connection,
+                                        $context,
                                        $ldap_search_pattern,
                                        $ldap_fields_wanted);

        } else {
            //search only in this context
-            $ldap_result = @ldap_list($ldap_connection, 
-                                        $context, 
+            $ldap_result = @ldap_list($ldap_connection,
+                                        $context,
                                        $ldap_search_pattern,
                                        $ldap_fields_wanted,0,0);
        }
- 
+
        // check and push results
        $records = $ldap_result
            ? ldap_get_entries($ldap_connection,$ldap_result)
@@ -197,9 +197,9 @@ function sync_enrolments($type, $enrol = false) {
        // ldap libraries return an odd array, really. fix it:
        $flat_records=array();
        for ($c=0;$c<$records['count'];$c++) {
-            array_push($flat_records, $records["$c"]); 
+            array_push($flat_records, $records["$c"]);
        }
-        // free mem -- is there a leak? 
+        // free mem -- is there a leak?
        $records=0; $ldap_result=0;

        if (count($flat_records)) {
@@ -208,7 +208,7 @@ function sync_enrolments($type, $enrol = false) {
            foreach($flat_records as $course){
                $idnumber = $course{$CFG->enrol_ldap_course_idnumber}[0];
                print "== Synching $idnumber\n";
-                // does the course exist in moodle already? 
+                // does the course exist in moodle already?
                $course_obj = false;
                $course_obj = get_record( 'course',
                                          $this->enrol_localcoursefield,
@@ -237,22 +237,22 @@ function sync_enrolments($type, $enrol = false) {
                    $context = get_context_instance(CONTEXT_COURSE, $course_obj->id);

                    // pull the ldap membership into a nice array
-                    // this is an odd array -- mix of hash and array -- 
+                    // this is an odd array -- mix of hash and array --
                    $ldapmembers=array();

                    if(array_key_exists('enrol_ldap_memberattribute_role'.$role->id, $CFG)
                     && !empty($CFG->{'enrol_ldap_memberattribute_role'.$role->id})
                     && !empty($course[strtolower($CFG->{'enrol_ldap_memberattribute_role'.$role->id} ) ])){ // may have no membership!

-                        $ldapmembers = $course[strtolower($CFG->{'enrol_ldap_memberattribute_role'.$role->id} )]; 
+                        $ldapmembers = $course[strtolower($CFG->{'enrol_ldap_memberattribute_role'.$role->id} )];
                        unset($ldapmembers['count']); // remove oddity ;)
                        $ldapmembers = addslashes_recursive($ldapmembers);
                    }
-                    
+
                    // prune old ldap enrolments
                    // hopefully they'll fit in the max buffer size for the RDBMS
                    $sql = '
-                        SELECT enr.userid AS user, 1
+                        SELECT enr.userid
                        FROM '.$CFG->prefix.'role_assignments enr
                        JOIN '.$CFG->prefix.'user usr ON usr.id=enr.userid
                        WHERE enr.roleid = '.$role->id.'
@@ -266,7 +266,7 @@ function sync_enrolments($type, $enrol = false) {
                    $todelete = get_records_sql($sql);
                    if(!empty($todelete)){
                        foreach ($todelete as $member) {
-                            $member = $member->user;
+                            $member = $member->userid;

                            if (role_unassign($role->id, $member, 0, $context->id, 'ldap')) {
                                print "Unassigned $type from $member for course $course_obj->id ($course_obj->shortname)\n";
@@ -275,21 +275,21 @@ function sync_enrolments($type, $enrol = false) {
                            }
                        }
                    }
-                    
-                    // insert current enrolments 
+
+                    // insert current enrolments
                    // bad we can't do INSERT IGNORE with postgres...
                    foreach ($ldapmembers as $ldapmember) {
                        $sql = 'SELECT id,1 FROM '.$CFG->prefix.'user '
                                ." WHERE idnumber='$ldapmember'";
-                        $member = get_record_sql($sql); 
-//                        print "sql: $sql \nidnumber = ".stripslashes($ldapmember)." \n".var_dump($member); 
+                        $member = get_record_sql($sql);
+//                        print "sql: $sql \nidnumber = ".stripslashes($ldapmember)." \n".var_dump($member);
                        if(empty($member) || empty($member->id)){
                            print "Could not find user ".stripslashes($ldapmember).", skipping\n";
                            continue;
                        }
                        $member = $member->id;
-                        if (!get_record('role_assignments', 'roleid', $role->id, 
-                                        'contextid', $context->id, 
+                        if (!get_record('role_assignments', 'roleid', $role->id,
+                                        'contextid', $context->id,
                                        'userid', $member, 'enrol', 'ldap')){
                            if (role_assign($role->id, $member, 0, $context->id, 0, 0, 0, 'ldap')){
                                print "Assigned role $type to $member (".stripslashes($ldapmember).") for course $course_obj->id ($course_obj->shortname)\n";
@@ -302,10 +302,10 @@ function sync_enrolments($type, $enrol = false) {
            }
        }
    }
-    
+
    // we are done now, a bit of housekeeping
    fix_course_sortorder();
-    
+
    @ldap_close($ldap_connection);
    return true;
 }
@@ -321,7 +321,7 @@ function config_form($frm) {
    global $CFG;

    $this->check_legacy_config();
-    
+
    include("$CFG->dirroot/enrol/ldap/config.html");
 }

@@ -339,7 +339,7 @@ function process_config($config) {
        $config->enrol_ldap_version = '';
    }
    set_config('enrol_ldap_version', $config->enrol_ldap_version);
-    
+
    if (!isset ($config->enrol_ldap_bind_dn)) {
        $config->enrol_ldap_bind_dn = '';
    }
@@ -348,58 +348,58 @@ function process_config($config) {
    if (!isset ($config->enrol_ldap_bind_pw)) {
        $config->enrol_ldap_bind_pw = '';
    }
-    set_config('enrol_ldap_bind_pw', $config->enrol_ldap_bind_pw);    
-    
+    set_config('enrol_ldap_bind_pw', $config->enrol_ldap_bind_pw);
+
    if (!isset ($config->enrol_ldap_objectclass)) {
        $config->enrol_ldap_objectclass = '';
    }
-    set_config('enrol_ldap_objectclass', $config->enrol_ldap_objectclass);    
-    
+    set_config('enrol_ldap_objectclass', $config->enrol_ldap_objectclass);
+
    if (!isset ($config->enrol_ldap_category)) {
        $config->enrol_ldap_category  = '';
    }
-    set_config('enrol_ldap_category', $config->enrol_ldap_category);    
-    
+    set_config('enrol_ldap_category', $config->enrol_ldap_category);
+
    if (!isset ($config->enrol_ldap_template)) {
        $config->enrol_ldap_template = '';
    }
-    set_config('enrol_ldap_template', $config->enrol_ldap_template);    
-    
+    set_config('enrol_ldap_template', $config->enrol_ldap_template);
+
    if (!isset ($config->enrol_ldap_course_fullname)) {
        $config->enrol_ldap_course_fullname = '';
    }
-    set_config('enrol_ldap_course_fullname', $config->enrol_ldap_course_fullname);    
+    set_config('enrol_ldap_course_fullname', $config->enrol_ldap_course_fullname);

    if (!isset ($config->enrol_ldap_course_shortname)) {
        $config->enrol_ldap_course_shortname = '';
    }
-    set_config('enrol_ldap_course_shortname', $config->enrol_ldap_course_shortname);    
-    
+    set_config('enrol_ldap_course_shortname', $config->enrol_ldap_course_shortname);
+
    if (!isset ($config->enrol_ldap_course_summary)) {
        $config->enrol_ldap_course_summary = '';
    }
-    set_config('enrol_ldap_course_summary', $config->enrol_ldap_course_summary);    
-    
+    set_config('enrol_ldap_course_summary', $config->enrol_ldap_course_summary);
+
    if (!isset ($config->enrol_ldap_course_idnumber)) {
        $config->enrol_ldap_course_idnumber = '';
    }
-    set_config('enrol_ldap_course_idnumber', $config->enrol_ldap_course_idnumber); 
-    
+    set_config('enrol_ldap_course_idnumber', $config->enrol_ldap_course_idnumber);
+
    if (!isset ($config->enrol_localcoursefield)) {
        $config->enrol_localcoursefield = '';
    }
    set_config('enrol_localcoursefield', $config->enrol_localcoursefield);
-    
+
    if (!isset ($config->enrol_ldap_user_memberfield)) {
        $config->enrol_ldap_user_memberfield = '';
    }
-    set_config('enrol_ldap_user_memberfield', $config->enrol_ldap_user_memberfield); 
-    
+    set_config('enrol_ldap_user_memberfield', $config->enrol_ldap_user_memberfield);
+
    if (!isset ($config->enrol_ldap_search_sub)) {
        $config->enrol_ldap_search_sub = '0';
    }
-    set_config('enrol_ldap_search_sub', $config->enrol_ldap_search_sub); 
-    
+    set_config('enrol_ldap_search_sub', $config->enrol_ldap_search_sub);
+
    if (!isset ($config->enrol_ldap_autocreate)) {
        $config->enrol_ldap_autocreate = '0';
    }
@@ -410,11 +410,11 @@ function process_config($config) {
        if (!isset($config->{'enrol_ldap_contexts_role'.$role->id})) {
            $config->{'enrol_ldap_contexts_role'.$role->id} = '';
        }
-        
+
        if (!isset($config->{'enrol_ldap_memberattribute_role'.$role->id})) {
            $config->{'enrol_ldap_memberattribute_role'.$role->id} = '';
        }
-        
+
        set_config('enrol_ldap_contexts_role'.$role->id, $config->{'enrol_ldap_contexts_role'.$role->id});
        set_config('enrol_ldap_memberattribute_role'.$role->id, $config->{'enrol_ldap_memberattribute_role'.$role->id});
    }
@@ -435,7 +435,7 @@ function enrol_ldap_connect(){

        if (!empty($CFG->enrol_ldap_bind_dn)) {
            $bind = ldap_bind( $result,
-                                 $CFG->enrol_ldap_bind_dn, 
+                                 $CFG->enrol_ldap_bind_dn,
                                 $CFG->enrol_ldap_bind_pw );
            if (!$bind) {
                notify("Error in binding to LDAP server");
@@ -464,11 +464,11 @@ function enrol_ldap_bind($ldap_connection){
        }

    } else {
-        //bind anonymously 
+        //bind anonymously
        if ( !ldap_bind($ldap_connection)){
            notify("Error: could not bind ldap anonymously");
            return false;
-        }  
+        }
    }

    return true;
@@ -477,13 +477,13 @@ function enrol_ldap_bind($ldap_connection){
 function find_ext_enrolments ($ldap_connection, $memberuid, $role){
 /// role is a record from the mdl_role table
 /// return multidimentional array array with of courses (at least dn and idnumber)
-/// 
+///

    global $CFG;

    if(empty($memberuid)) { // No "idnumber" stored for this user, so no LDAP enrolments
        return array();
-    } 
+    }

    //default return value
    $courses = array();
@@ -493,7 +493,7 @@ function find_ext_enrolments ($ldap_connection, $memberuid, $role){
    $ldap_contexts = explode(";",$CFG->{'enrol_ldap_contexts_role'.$role->id});

    // get all the fields we will want for the potential course creation
-    // as they are light. don't get membership -- potentially a lot of data. 
+    // as they are light. don't get membership -- potentially a lot of data.
    $ldap_fields_wanted = array( 'dn', $CFG->enrol_ldap_course_idnumber);
    if (!empty($CFG->enrol_ldap_course_fullname)){
        array_push($ldap_fields_wanted, $CFG->enrol_ldap_course_fullname);
@@ -507,7 +507,7 @@ function find_ext_enrolments ($ldap_connection, $memberuid, $role){

    // define the search pattern
    $ldap_search_pattern = "(".$CFG->{'enrol_ldap_memberattribute_role'.$role->id}."=".$this->filter_addslashes($memberuid).")";
-    if (!empty($CFG->enrol_ldap_objectclass)){ 
+    if (!empty($CFG->enrol_ldap_objectclass)){
        $ldap_search_pattern='(&(objectclass='.$CFG->enrol_ldap_objectclass.')'.$ldap_search_pattern.')';
    }

@@ -516,31 +516,31 @@ function find_ext_enrolments ($ldap_connection, $memberuid, $role){
        if (empty($context)) {
            continue; // next;
        }
-        
+
        if ($CFG->enrol_ldap_search_sub){
            //use ldap_search to find first user from subtree
-            $ldap_result = ldap_search($ldap_connection, 
-                                        $context, 
+            $ldap_result = ldap_search($ldap_connection,
+                                        $context,
                                        $ldap_search_pattern,
                                        $ldap_fields_wanted);

        } else {
            //search only in this context
-            $ldap_result = ldap_list($ldap_connection, 
-                                        $context, 
+            $ldap_result = ldap_list($ldap_connection,
+                                        $context,
                                        $ldap_search_pattern,
                                        $ldap_fields_wanted);
        }
- 
+
        // check and push results
-        $records = ldap_get_entries($ldap_connection,$ldap_result);        
+        $records = ldap_get_entries($ldap_connection,$ldap_result);

        // ldap libraries return an odd array, really. fix it:
        $flat_records=array();
        for ($c=0;$c<$records['count'];$c++) {
-            array_push($flat_records, $records["$c"]); 
+            array_push($flat_records, $records["$c"]);
        }
-        
+
        if (count($flat_records)) {
            $courses = array_merge($courses, $flat_records);
        }
@@ -551,7 +551,7 @@ function find_ext_enrolments ($ldap_connection, $memberuid, $role){

 // will create the moodle course from the template
 // course_ext is an array as obtained from ldap -- flattened somewhat
-// NOTE: if you pass true for $skip_fix_course_sortorder 
+// NOTE: if you pass true for $skip_fix_course_sortorder
 // you will want to call fix_course_sortorder() after your are done
 // with course creation
 function create_course ($course_ext,$skip_fix_course_sortorder=0){
@@ -578,7 +578,7 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
    $course->shortname = $course_ext[$CFG->enrol_ldap_course_shortname][0];
    if (   empty($course->idnumber)
        || empty($course->fullname)
-        || empty($course->shortname) ) { 
+        || empty($course->shortname) ) {
        // we are in trouble!
        error_log("Cannot create course: missing required data from the LDAP record!");
         error_log(var_export($course, true));
@@ -588,10 +588,10 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
    $course->summary = empty($CFG->enrol_ldap_course_summary) || empty($course_ext[$CFG->enrol_ldap_course_summary][0])
        ? ''
        : $course_ext[$CFG->enrol_ldap_course_summary][0];
-    
+
    if(!empty($CFG->enrol_ldap_category)){ // optional ... but ensure it is set!
        $course->category = $CFG->enrol_ldap_category;
-    } 
+    }
    if ($course->category == 0){ // must be avoided as it'll break moodle
        $course->category = 1; // the misc 'catch-all' category
    }
@@ -600,13 +600,13 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
    $sort = get_record_sql('SELECT MAX(sortorder) AS max, 1 FROM ' . $CFG->prefix . 'course WHERE category=' . $course->category);
    $sort = $sort->max;
    $sort++;
-    $course->sortorder = $sort; 
+    $course->sortorder = $sort;

    // override with local data
    $course->startdate = time();
    $course->timecreated = time();
    $course->visible     = 1;
-    
+
    $course = addslashes_recursive($course);

    // store it and log
@@ -619,8 +619,8 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
        blocks_repopulate_page($page); // Return value no


-        if(!$skip_fix_course_sortorder){ 
-            fix_course_sortorder(); 
+        if(!$skip_fix_course_sortorder){
+            fix_course_sortorder();
        }
        add_to_log($newcourseid, "course", "new", "view.php?id=$newcourseid", "enrol/ldap auto-creation");
    } else {
@@ -628,7 +628,7 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
        notify("Serious Error! Could not create the new course!");
        return false;
    }
-    
+
    return $newcourseid;
 }

@@ -665,7 +665,7 @@ function check_legacy_config () {

        unset_config('enrol_ldap_teacher_contexts');
    }
-    
+
    if (isset($CFG->enrol_ldap_teacher_memberattribute)) {
        if (isset($teacher_role)
         or $teacher_role = get_record('role', 'shortname', 'teacher')) {
@@ -13,7 +13,7 @@

      //TODO: Blog attachments do not have access control implemented - anybody can read them!
      //      It might be better to move the code to separate file because the access
-      //      control is quite complex - see bolg/index.php 
+      //      control is quite complex - see bolg/index.php

    require_once('config.php');
    require_once('lib/filelib.php');
@@ -29,7 +29,7 @@

    $relativepath = get_file_argument('file.php');
    $forcedownload = optional_param('forcedownload', 0, PARAM_BOOL);
-    
+
    // relative path must start with '/', because of backup/restore!!!
    if (!$relativepath) {
        error('No valid arguments supplied or incorrect server configuration');
@@ -39,12 +39,20 @@

    $pathname = $CFG->dataroot.$relativepath;

+    // protect imsenterprise plugin data
+    if (strtolower("$CFG->dataroot/1/imsenterprise-enrol.xml") === strtolower(realpath($pathname))
+        or (!empty($CFG->enrol_imsfilelocation) and strtolower($CFG->enrol_imsfilelocation) === strtolower(realpath($pathname)))) {
+        require_login();
+        require_capability('moodle/site:config', get_context_instance(CONTEXT_SYSTEM));
+        $forcedownload = 1;
+    }
+
    // extract relative path components
    $args = explode('/', trim($relativepath, '/'));
    if (count($args) == 0) { // always at least courseid, may search for index.html in course root
        error('No valid arguments supplied');
    }
-  
+
    // security: limit access to existing course subdirectories
    if (($args[0]!='blog') and (!$course = get_record_sql("SELECT * FROM {$CFG->prefix}course WHERE id='".(int)$args[0]."'"))) {
        error('Invalid course ID');
@@ -84,7 +92,7 @@
        if (!has_capability('moodle/site:backup', get_context_instance(CONTEXT_COURSE, $course->id))) {
            error('Access not allowed');
        } else {
-            $lifetime = 0; //disable browser caching for backups 
+            $lifetime = 0; //disable browser caching for backups
        }
    }

@@ -120,7 +128,7 @@
            if (!has_capability('mod/assignment:grade', get_context_instance(CONTEXT_MODULE, $cm->id))) {
                error('Access not allowed');
            }
-        } 
+        }
    }

    // security: force download of all attachments submitted by students
@@ -144,11 +152,11 @@
    }
    if ($args[0] == 'blog') {
        $forcedownload  = 1; // force download of all attachments
-    }    
+    }

    // security: some protection of hidden resource files
    // warning: it may break backwards compatibility
-    if ((!empty($CFG->preventaccesstohiddenfiles)) 
+    if ((!empty($CFG->preventaccesstohiddenfiles))
        and (count($args) >= 2)
        and (!(strtolower($args[1]) == 'moddata' and strtolower($args[2]) != 'resource')) // do not block files from other modules!
        and (!has_capability('moodle/course:viewhiddenactivities', get_context_instance(CONTEXT_COURSE, $course->id)))) {
@@ -8,8 +8,8 @@
 //  USER is a persistent variable using sessions

    require('../config.php');
-    require($CFG->libdir.'/filelib.php');
-    require($CFG->libdir.'/adminlib.php');
+    require_once($CFG->libdir . '/filelib.php');
+    require_once($CFG->libdir . '/adminlib.php');

    $id      = required_param('id', PARAM_INT);
    $file    = optional_param('file', '', PARAM_PATH);
@@ -36,80 +36,80 @@ function mediaplugin_filter($courseid, $text) {
    $newtext = $text; // fullclone is slow and not needed here

    if ($CFG->filter_mediaplugin_enable_mp3) {
-        $search = '/<a.*?href="([^<]+\.mp3)"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.mp3)"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_mp3_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_ogg) {
-        $search =   '/<a[^>]*?href="([^<]+\.ogg)"[^>]*>.*?<\/a>/is';
+        $search =   '/<a\s[^>]*href="([^"]+\.ogg)"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'filter_mediaplugin_ogg_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_ogv) {
-        $search =   '/<a[^>]*?href="([^<]+\.ogv)"[^>]*>.*?<\/a>/is';
+        $search =   '/<a\s[^>]*href="([^"]+\.ogv)"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'filter_mediaplugin_ogv_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_swf) {
-        $search = '/<a.*?href="([^<]+\.swf)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.swf)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_swf_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_flv) {
-        $search = '/<a.*?href="([^<]+\.flv)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.flv)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_flv_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_mov) {
-        $search = '/<a.*?href="([^<]+\.mov)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.mov)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);

        // MDL-18658
-        $search = '/<a.*?href="([^<]+\.mp4)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.mp4)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);

-        $search = '/<a.*?href="([^<]+\.m4v)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.m4v)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);

-        $search = '/<a.*?href="([^<]+\.m4a)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^<]+\.m4a)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_wmv) {
-        $search = '/<a.*?href="([^<]+\.wmv)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.wmv)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_wmp_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_mpg) {
-        $search = '/<a.*?href="([^<]+\.mpe?g)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.mpe?g)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_avi) {
-        $search = '/<a.*?href="([^<]+\.avi)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.avi)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_wmp_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_ram) {
-        $search = '/<a.*?href="([^<]+\.ram)"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.ram)"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_real_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_rpm) {
-        $search = '/<a.*?href="([^<]+\.rpm)"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.rpm)"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_real_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_rm) {
-        $search = '/<a.*?href="([^<]+\.rm)"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.rm)"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_real_callback', $newtext);
    }

    if (!empty($CFG->filter_mediaplugin_enable_youtube)) {
-        $search = '/<a[^>]*?href="([^<]*)youtube.com\/watch\?v=([^"]*)"[^>]*>(.*?)<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]*)youtube.com\/watch\?v=([^"]*)"[^>]*>(.*?)<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_youtube_callback', $newtext);

-        $search = '/<a[^>]*?href="([^<]*)youtube.com\/v\/([^"]*)"[^>]*>(.*?)<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]*)youtube.com\/v\/([^"]*)"[^>]*>(.*?)<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_youtube_callback', $newtext);
    }

@@ -143,14 +143,15 @@ function mediaplugin_filter_mp3_callback($link) {
    static $count = 0;
    $count++;
    $id = 'filter_mp3_'.time().$count; //we need something unique because it might be stored in text cache
+    $url = $link[1];
+    $jsurl = addslashes_js($link[1]);

-    $url = addslashes_js($link[1]);
-
-    return $link[0].
+    $printlink = '<a href="'.$url.'">'.get_string('mp3audio', 'mediaplugin').'</a>';
+    return $printlink.
 '<span class="mediaplugin mediaplugin_mp3" id="'.$id.'">('.get_string('mp3audio', 'mediaplugin').')</span>
 <script type="text/javascript">
 //<![CDATA[
-  var FO = { movie:"'.$CFG->wwwroot.'/filter/mediaplugin/mp3player.swf?src='.$url.'",
+  var FO = { movie:"'.$CFG->wwwroot.'/filter/mediaplugin/mp3player.swf?src='.$jsurl.'",
    width:"90", height:"15", majorversion:"6", build:"40", flashvars:"'.$c.'", quality: "high" };
  UFO.create(FO, "'.$id.'");
 //]]>
@@ -158,38 +159,44 @@ function mediaplugin_filter_mp3_callback($link) {
 }

 function filter_mediaplugin_ogg_callback($link) {
-    global $CFG, $OUTPUT, $PAGE;
+    global $CFG;

    static $count = 0;
    $count++;
    $id = 'filter_ogg_'.time().$count; //we need something unique because it might be stored in text cache

-    $url = addslashes_js($link[1]);
-    $printlink = html_writer::link($url, get_string('oggaudio', 'filter_mediaplugin'));
-    $unsupportedplugins = get_string('unsupportedplugins', 'filter_mediaplugin', $printlink);
+    $url = $link[1];
+    $printlink = '<a href="'.$url.'">'.get_string('oggaudio', 'mediaplugin').'</a>';
+
+    $unsupportedplugins = get_string('unsupportedplugins', 'mediaplugin', $printlink);
    $output = <<<OET
+    <span class="mediaplugin mediaplugin_ogg" id="$id">
    <audio id="$id" src="$url" controls="true" width="100">
        $unsupportedplugins
    </audio>
+    </span>
 OET;

    return $output;
 }

 function filter_mediaplugin_ogv_callback($link) {
-    global $CFG, $OUTPUT, $PAGE;
+    global $CFG;

    static $count = 0;
    $count++;
    $id = 'filter_ogv_'.time().$count; //we need something unique because it might be stored in text cache

-    $url = addslashes_js($link[1]);
-    $printlink = html_writer::link($url, get_string('ogvvideo', 'filter_mediaplugin'));
-    $unsupportedplugins = get_string('unsupportedplugins', 'filter_mediaplugin', $printlink);
+    $url = $link[1];
+    $printlink = '<a href="'.$url.'">'.get_string('ogvvideo', 'mediaplugin').'</a>';
+
+    $unsupportedplugins = get_string('unsupportedplugins', 'mediaplugin', $printlink);
    $output = <<<OET
+    <span class="mediaplugin mediaplugin_ogv" id="$id">
    <video id="$id" src="$url" controls="true" width="600" >
        $unsupportedplugins
    </video>
+    </span>
 OET;

    return $output;
@@ -202,13 +209,15 @@ function mediaplugin_filter_swf_callback($link) {

    $width  = empty($link[3]) ? '400' : $link[3];
    $height = empty($link[4]) ? '300' : $link[4];
-    $url = addslashes_js($link[1]);
+    $url = $link[1];
+    $jsurl = addslashes_js($link[1]);
+    $printlink = '<a href="'.$url.'">'.get_string('flashvideo', 'mediaplugin').'</a>';

-    return $link[0].
+    return $printlink.
 '<span class="mediaplugin mediaplugin_swf" id="'.$id.'">('.get_string('flashanimation', 'mediaplugin').')</span>
 <script type="text/javascript">
 //<![CDATA[
-  var FO = { movie:"'.$url.'", width:"'.$width.'", height:"'.$height.'", majorversion:"6", build:"40",
+  var FO = { movie:"'.$jsurl.'", width:"'.$width.'", height:"'.$height.'", majorversion:"6", build:"40",
    allowscriptaccess:"never", quality: "high" };
  UFO.create(FO, "'.$id.'");
 //]]>
@@ -224,13 +233,15 @@ function mediaplugin_filter_flv_callback($link) {

    $width  = empty($link[3]) ? '480' : $link[3];
    $height = empty($link[4]) ? '360' : $link[4];
-    $url = addslashes_js($link[1]);
+    $url = $link[1];
+    $jsurl = addslashes_js($link[1]);
+    $printlink = '<a href="'.$url.'">'.get_string('flashvideo', 'mediaplugin').'</a>';

-    return $link[0].
+    return $printlink.
 '<span class="mediaplugin mediaplugin_flv" id="'.$id.'">('.get_string('flashvideo', 'mediaplugin').')</span>
 <script type="text/javascript">
 //<![CDATA[
-  var FO = { movie:"'.$CFG->wwwroot.'/filter/mediaplugin/flvplayer.swf?file='.$url.'",
+  var FO = { movie:"'.$CFG->wwwroot.'/filter/mediaplugin/flvplayer.swf?file='.$jsurl.'",
    width:"'.$width.'", height:"'.$height.'", majorversion:"6", build:"40",
    allowscriptaccess:"never", quality: "high", allowfullscreen: "true" };
  UFO.create(FO, "'.$id.'");
@@ -239,29 +250,31 @@ function mediaplugin_filter_flv_callback($link) {
 }

 function mediaplugin_filter_real_callback($link, $autostart=false) {
-    $url = addslashes_js($link[1]);
+    $url = $link[1];
+    $jsurl = addslashes_js($link[1]);
    $mimetype = mimeinfo('type', $url);
    $autostart = $autostart ? 'true' : 'false';
+    $printlink = '<a href="'.$url.'">'.get_string('realaudio', 'mediaplugin').'</a>';

 // embed kept for now see MDL-8674
-    return $link[0].
+    return $printlink.
 '<span class="mediaplugin mediaplugin_real">
 <script type="text/javascript">
 //<![CDATA[
 document.write(\'<object classid="clsid:CFCDAA03-8BE4-11cf-B84B-0020AFBBCCFA" width="240" height="180">\\
-  <param name="src" value="'.$url.'" />\\
+  <param name="src" value="'.$jsurl.'" />\\
  <param name="autostart" value="'.$autostart.'" />\\
  <param name="controls" value="imagewindow" />\\
  <param name="console" value="video" />\\
  <param name="loop" value="true" />\\
-  <embed src="'.$url.'" width="240" height="180" loop="true" type="'.$mimetype.'" controls="imagewindow" console="video" autostart="'.$autostart.'" />\\
+  <embed src="'.$jsurl.'" width="240" height="180" loop="true" type="'.$mimetype.'" controls="imagewindow" console="video" autostart="'.$autostart.'" />\\
  </object><br />\\
  <object classid="clsid:CFCDAA03-8BE4-11cf-B84B-0020AFBBCCFA" width="240" height="30">\\
-  <param name="src" value="'.$url.'" />\\
+  <param name="src" value="'.$jsurl.'" />\\
  <param name="autostart" value="'.$autostart.'" />\\
  <param name="controls" value="ControlPanel" />\\
  <param name="console" value="video" />\\
-  <embed src="'.$url.'" width="240" height="30" controls="ControlPanel" type="'.$mimetype.'" console="video" autostart="'.$autostart.'" />\\
+  <embed src="'.$jsurl.'" width="240" height="30" controls="ControlPanel" type="'.$mimetype.'" console="video" autostart="'.$autostart.'" />\\
  </object>\');
 //]]>
 </script></span>';
@@ -272,18 +285,20 @@ document.write(\'<object classid="clsid:CFCDAA03-8BE4-11cf-B84B-0020AFBBCCFA" wi
 */
 function mediaplugin_filter_youtube_callback($link, $autostart=false) {

-    $site = addslashes_js($link[1]);
-    $url = addslashes_js($link[2]);
-    $info = addslashes_js($link[3]);
+    $site = s($link[1]);
+    $url = $link[2];
+    $info = s($link[3]);

-    return '<object title="'.$info.'"
+    return '<span class="mediaplugin mediaplugin_youtube">'.
+           '<object title="'.$info.'"
                    class="mediaplugin mediaplugin_youtube" type="application/x-shockwave-flash"
                    data="'.$site.'youtube.com/v/'.$url.'&amp;fs=1&amp;rel=0" width="425" height="344">'.
           '<param name="movie" value="'.$site.'youtube.com/v/'.$url.'&amp;fs=1&amp;rel=0" />'.
           '<param name="FlashVars" value="playerMode=embedded" />'.
           '<param name="wmode" value="transparent" />'.
           '<param name="allowFullScreen" value="true" />'.
-           '</object>';
+           '</object>'.
+           '</span>';
 }

 /**
@@ -302,8 +317,9 @@ function mediaplugin_filter_wmp_callback($link, $autostart=false) {
    }
    $mimetype = mimeinfo('type', $url);
    $autostart = $autostart ? 'true' : 'false';
+    $printlink = '<a href="'.$url.'">'.get_string('wmpvideo', 'mediaplugin').'</a>';

-    return $link[0].
+    return $printlink.
 '<span class="mediaplugin mediaplugin_wmp">
 <object classid="CLSID:6BF52A52-394A-11d3-B153-00C04F79FAA6" '.$mpsize.'
  standby="Loading Microsoft(R) Windows(R) Media Player components..."
@@ -341,8 +357,9 @@ function mediaplugin_filter_qt_callback($link, $autostart=false) {
    }
    $mimetype = mimeinfo('type', $url);
    $autostart = $autostart ? 'true' : 'false';
+    $printlink = '<a href="'.$url.'">'.get_string('quicktime', 'mediaplugin').'</a>';

-    return $link[0].
+    return $printlink.
 '<span class="mediaplugin mediaplugin_qt">
 <object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"
  codebase="http://www.apple.com/qtactivex/qtplugin.cab" '.$size.'>
@@ -54,13 +54,20 @@ class grade_export {
        $this->groupid = $groupid;
        $this->grade_items = grade_item::fetch_all(array('courseid'=>$this->course->id));

+        //Populating the columns here is required by /grade/export/(whatever)/export.php
+        //however index.php, when the form is submitted, will construct the collection here
+        //with an empty $itemlist then reconstruct it in process_form() using $formdata
        $this->columns = array();
        if (!empty($itemlist)) {
-            $itemids = explode(',', $itemlist);
-            // remove items that are not requested
-            foreach ($itemids as $itemid) {
-                if (array_key_exists($itemid, $this->grade_items)) {
-                    $this->columns[$itemid] =& $this->grade_items[$itemid];
+            if ($itemlist=='-1') {
+            //user deselected all items
+            } else {
+                $itemids = explode(',', $itemlist);
+                // remove items that are not requested
+                foreach ($itemids as $itemid) {
+                    if (array_key_exists($itemid, $this->grade_items)) {
+                        $this->columns[$itemid] =& $this->grade_items[$itemid];
+                    }
                }
            }
        } else {
@@ -87,9 +94,13 @@ class grade_export {

        $this->columns = array();
        if (!empty($formdata->itemids)) {
-            foreach ($formdata->itemids as $itemid=>$selected) {
-                if ($selected and array_key_exists($itemid, $this->grade_items)) {
-                    $this->columns[$itemid] =& $this->grade_items[$itemid];
+            if ($formdata->itemids=='-1') {
+                //user deselected all items
+            } else {
+                foreach ($formdata->itemids as $itemid=>$selected) {
+                    if ($selected and array_key_exists($itemid, $this->grade_items)) {
+                        $this->columns[$itemid] =& $this->grade_items[$itemid];
+                    }
                }
            }
        } else {
@@ -267,10 +278,14 @@ class grade_export {
     */
    function get_export_params() {
        $itemids = array_keys($this->columns);
+        $itemidsparam = implode(',', $itemids);
+        if (empty($itemidsparam)) {
+            $itemidsparam = '-1';
+        }

        $params = array('id'                =>$this->course->id,
                        'groupid'           =>$this->groupid,
-                        'itemids'           =>implode(',', $itemids),
+                        'itemids'           =>$itemidsparam,
                        'export_letters'    =>$this->export_letters,
                        'export_feedback'   =>$this->export_feedback,
                        'updatedgradesonly' =>$this->updatedgradesonly,
@@ -108,10 +108,14 @@ class graded_users_iterator {

        $users_sql = "SELECT u.* $ofields
                        FROM {$CFG->prefix}user u
-                             INNER JOIN {$CFG->prefix}role_assignments ra ON u.id = ra.userid
                             $groupsql
-                       WHERE ra.roleid $gradebookroles
-                             AND ra.contextid $relatedcontexts
+                        JOIN (
+                                 SELECT DISTINCT ra.userid
+                                   FROM {$CFG->prefix}role_assignments ra
+                                  WHERE ra.roleid $gradebookroles
+                                    AND ra.contextid $relatedcontexts
+                             ) rainner ON rainner.userid = u.id
+                       WHERE u.deleted = 0
                             $groupwheresql
                    ORDER BY $order";

@@ -123,13 +127,17 @@ class graded_users_iterator {

            $grades_sql = "SELECT g.* $ofields
                             FROM {$CFG->prefix}grade_grades g
-                                  INNER JOIN {$CFG->prefix}user u ON g.userid = u.id
-                                  INNER JOIN {$CFG->prefix}role_assignments ra ON u.id = ra.userid
+                             JOIN {$CFG->prefix}user u ON g.userid = u.id
                                  $groupsql
-                            WHERE ra.roleid $gradebookroles
-                                  AND ra.contextid $relatedcontexts
-                                  AND g.itemid IN ($itemids)
-                                  $groupwheresql
+                             JOIN (
+                                      SELECT DISTINCT ra.userid
+                                        FROM {$CFG->prefix}role_assignments ra
+                                       WHERE ra.roleid $gradebookroles
+                                         AND ra.contextid $relatedcontexts
+                                  ) rainner ON rainner.userid = u.id
+                            WHERE u.deleted = 0
+                              AND g.itemid IN ($itemids)
+                              $groupwheresql
                         ORDER BY $order, g.itemid ASC";
            $this->grades_rs = get_recordset_sql($grades_sql);
        } else {
@@ -14,15 +14,15 @@ function set_row(idx) {
 }

 /** highlight/unset the column of a table **/
-function set_col(col,gradecelloffset) {
+function set_col(col,gradecelloffset,lastheaderrow) {
    var table = document.getElementById('user-grades');

    //highlight the column header
-    flip_vmarked(table,2,col);
+    flip_vmarked(table,lastheaderrow,col);

    //add any grade cell offset (due to colspans) then iterate down the table
    col += gradecelloffset;
-    for (var row = 3; row < table.rows.length; row++) {
+    for (var row = lastheaderrow + 1; row < table.rows.length; row++) {
        flip_vmarked(table,row,col);
    }
 }
@@ -35,4 +35,4 @@ function flip_vmarked(table,row,col) {
            table.rows[row].cells[col].className += ' vmarked';
        }
    }
-}
+}
@@ -78,6 +78,10 @@ class grade_report_grader extends grade_report {
     * */
    var $canviewhidden;

+    /** @var boolean, whether the current user is allowed to see the user report.
+     * This affects the table layout. */
+    var $canviewuserreport;
+
    var $preferences_page=false;

    /**
@@ -93,6 +97,7 @@ class grade_report_grader extends grade_report {
        parent::grade_report($courseid, $gpr, $context, $page);

        $this->canviewhidden = has_capability('moodle/grade:viewhidden', get_context_instance(CONTEXT_COURSE, $this->course->id));
+        $this->canviewuserreport = has_capability('gradereport/'.$CFG->grade_profilereport.':view', $this->context);

        // load collapsed settings for this report
        if ($collapsed = get_user_preferences('grade_report_grader_collapsed_categories')) {
@@ -322,41 +327,38 @@ class grade_report_grader extends grade_report {
        global $CFG;

        if (is_numeric($this->sortitemid)) {
-            // the MAX() magic is required in order to please PG
-            $sort = "MAX(g.finalgrade) $this->sortorder";
-
-            $sql = "SELECT u.id, u.firstname, u.lastname, u.imagealt, u.picture, u.idnumber
-                      FROM {$CFG->prefix}user u
-                           JOIN {$CFG->prefix}role_assignments ra ON ra.userid = u.id
-                           $this->groupsql
-                           LEFT JOIN {$CFG->prefix}grade_grades g ON (g.userid = u.id AND g.itemid = $this->sortitemid)
-                     WHERE ra.roleid in ($this->gradebookroles) AND u.deleted = 0
-                           $this->groupwheresql
-                           AND ra.contextid ".get_related_contexts_string($this->context)."
-                  GROUP BY u.id, u.firstname, u.lastname, u.imagealt, u.picture, u.idnumber
-                  ORDER BY $sort";
-
+            $sortjoin = "LEFT JOIN {$CFG->prefix}grade_grades g ON " .
+                    "g.userid = u.id AND g.itemid = $this->sortitemid";
+            $sort = "g.finalgrade $this->sortorder";
        } else {
+            $sortjoin = '';
            switch($this->sortitemid) {
                case 'lastname':
-                    $sort = "u.lastname $this->sortorder, u.firstname $this->sortorder"; break;
+                    $sort = "u.lastname $this->sortorder, u.firstname $this->sortorder";
+                    break;
                case 'firstname':
-                    $sort = "u.firstname $this->sortorder, u.lastname $this->sortorder"; break;
+                    $sort = "u.firstname $this->sortorder, u.lastname $this->sortorder";
+                    break;
                case 'idnumber':
                default:
-                    $sort = "u.idnumber $this->sortorder"; break;
+                    $sort = "u.idnumber $this->sortorder";
+                    break;
            }
-
-            $sql = "SELECT DISTINCT u.id, u.firstname, u.lastname, u.imagealt, u.picture, u.idnumber
-                      FROM {$CFG->prefix}user u
-                           JOIN {$CFG->prefix}role_assignments ra ON u.id = ra.userid
-                           $this->groupsql
-                     WHERE ra.roleid in ($this->gradebookroles)
-                           $this->groupwheresql
-                           AND ra.contextid ".get_related_contexts_string($this->context)."
-                  ORDER BY $sort";
        }

+        $sql = "SELECT u.id, u.firstname, u.lastname, u.imagealt, u.picture, u.idnumber
+                  FROM {$CFG->prefix}user u
+                       $this->groupsql
+                       $sortjoin
+                  JOIN (
+                           SELECT DISTINCT ra.userid
+                             FROM {$CFG->prefix}role_assignments ra
+                            WHERE ra.roleid IN ($this->gradebookroles)
+                              AND ra.contextid " . get_related_contexts_string($this->context) . "
+                       ) rainner ON rainner.userid = u.id
+                 WHERE u.deleted = 0
+                   $this->groupwheresql
+              ORDER BY $sort";

        $this->users = get_records_sql($sql, $this->get_pref('studentsperpage') * $this->page,
                            $this->get_pref('studentsperpage'));
@@ -662,14 +664,15 @@ class grade_report_grader extends grade_report {
                    //The width of the table varies depending on fixedstudents.
                    // $fixedstudents == 0, students and grades display in the same table.
                    // $fixedstudents == 1, students and grades are display in separate table.
-                    if ($fixedstudents) {
+                    if ($fixedstudents || !$this->canviewuserreport) {
                        $incrementcellindex = '0';
                    } else {
                        $incrementcellindex = '1';
                    }
                    //MDL-21088 - IE 7 ignores nowraps on tds or ths so we this in a span with a nowrap on it.
-                    $headerhtml .= '<th class=" '.$columnclass.' '.$type.$catlevel.$hidden.'" scope="col" onclick="set_col(this.cellIndex,' . $incrementcellindex . ')"><span>'
-                                .shorten_text($headerlink) . $arrow;
+                    $headerhtml .= '<th class=" '.$columnclass.' '.$type.$catlevel.$hidden.
+                            '" scope="col" onclick="set_col(this.cellIndex,' . $incrementcellindex . ',' . (count($this->gtree->levels) - 1) .
+                            ')"><span>' . shorten_text($headerlink) . $arrow;
                    $headerhtml .= '</span></th>';
                }

@@ -745,7 +748,7 @@ class grade_report_grader extends grade_report {
                //we're either going to add a th or a colspan to keep things aligned
                $userreportcell = '';
                $userreportcellcolspan = '';
-                if (has_capability('gradereport/'.$CFG->grade_profilereport.':view', $this->context)) {
+                if ($this->canviewuserreport) {
                    $a->user = fullname($user, $canviewfullname);
                    $strgradesforuser = get_string('gradesforuser', 'grades', $a);
                    $userreportcell = '<th class="header userreport"><a href="'.$CFG->wwwroot.'/grade/report/'.$CFG->grade_profilereport.'/index.php?id='.$this->courseid.'&amp;userid='.$user->id.'">'
@@ -1032,7 +1035,7 @@ class grade_report_grader extends grade_report {
                //either add a th or a colspan to keep things aligned
                $userreportcell = '';
                $userreportcellcolspan = '';
-                if (has_capability('gradereport/'.$CFG->grade_profilereport.':view', $this->context)) {
+                if ($this->canviewuserreport) {
                    $a->user = fullname($user, $canviewfullname);
                    $strgradesforuser = get_string('gradesforuser', 'grades', $a);
                    $userreportcell = '<th class="userreport"><a href="'.$CFG->wwwroot.'/grade/report/'.$CFG->grade_profilereport.'/index.php?id='.$this->courseid.'&amp;userid='.$user->id.'">'
@@ -1146,20 +1149,24 @@ class grade_report_grader extends grade_report {
        if ($showaverages) {

            // find sums of all grade items in course
-            $SQL = "SELECT g.itemid, SUM(g.finalgrade) AS sum
+            $sql = "SELECT g.itemid, SUM(g.finalgrade) AS sum
                      FROM {$CFG->prefix}grade_items gi
-                           JOIN {$CFG->prefix}grade_grades g      ON g.itemid = gi.id
-                           JOIN {$CFG->prefix}user u              ON u.id = g.userid
-                           JOIN {$CFG->prefix}role_assignments ra ON ra.userid = u.id
+                           JOIN {$CFG->prefix}grade_grades g ON g.itemid = gi.id
+                           JOIN {$CFG->prefix}user u ON u.id = g.userid
                           $groupsql
-                     WHERE gi.courseid = $this->courseid
-                           AND ra.roleid in ($this->gradebookroles)
-                           AND ra.contextid ".get_related_contexts_string($this->context)."
-                           AND g.finalgrade IS NOT NULL
-                           $groupwheresql
+                           JOIN (
+                               SELECT DISTINCT ra.userid
+                                 FROM {$CFG->prefix}role_assignments ra
+                                WHERE ra.roleid IN ($this->gradebookroles)
+                                  AND ra.contextid " . get_related_contexts_string($this->context) . "
+                           ) rainner ON rainner.userid = u.id
+                       WHERE gi.courseid = $this->courseid
+                       AND u.deleted = 0
+                       AND g.finalgrade IS NOT NULL
+                       $groupwheresql
                  GROUP BY g.itemid";
            $sum_array = array();
-            if ($sums = get_records_sql($SQL)) {
+            if ($sums = get_records_sql($sql)) {
                foreach ($sums as $itemid => $csum) {
                    $sum_array[$itemid] = $csum->sum;
                }
@@ -1171,20 +1178,21 @@ class grade_report_grader extends grade_report {

            // MDL-10875 Empty grades must be evaluated as grademin, NOT always 0
            // This query returns a count of ungraded grades (NULL finalgrade OR no matching record in grade_grades table)
-            $SQL = "SELECT gi.id, COUNT(u.id) AS count
+            $sql = "SELECT gi.id, COUNT(DISTINCT u.id) AS count
                      FROM {$CFG->prefix}grade_items gi
                           CROSS JOIN {$CFG->prefix}user u
-                           JOIN {$CFG->prefix}role_assignments ra        ON ra.userid = u.id
-                           LEFT OUTER JOIN  {$CFG->prefix}grade_grades g ON (g.itemid = gi.id AND g.userid = u.id AND g.finalgrade IS NOT NULL)
+                           JOIN {$CFG->prefix}role_assignments ra       ON ra.userid = u.id
+                           LEFT OUTER JOIN {$CFG->prefix}grade_grades g ON g.itemid = gi.id AND g.userid = u.id AND g.finalgrade IS NOT NULL
                           $groupsql
                     WHERE gi.courseid = $this->courseid
-                           AND ra.roleid in ($this->gradebookroles)
-                           AND ra.contextid ".get_related_contexts_string($this->context)."
+                           AND ra.roleid IN ($this->gradebookroles)
+                           AND u.deleted = 0
+                           AND ra.contextid " . get_related_contexts_string($this->context) . "
                           AND g.id IS NULL
                           $groupwheresql
                  GROUP BY gi.id";

-            $ungraded_counts = get_records_sql($SQL);
+            $ungraded_counts = get_records_sql($sql);

            $fixedstudents = $this->is_fixed_students();
            if (!$fixedstudents) {
@@ -100,7 +100,8 @@ class grade_report_user extends grade_report {
        $this->showpercentage  = grade_get_setting($this->courseid, 'report_user_showpercentage', $CFG->grade_report_user_showpercentage);
        $this->showhiddenitems = grade_get_setting($this->courseid, 'report_user_showhiddenitems', $CFG->grade_report_user_showhiddenitems);
        $this->showtotalsifcontainhidden = grade_get_setting($this->courseid, 'report_user_showtotalsifcontainhidden', $CFG->grade_report_user_showtotalsifcontainhidden);
-
+        
+        //comment this out to hide the range column on the user report. Control of this via a setting was added to 2.0 (MDL-20617)
        $this->showrange = true;

        $this->switch = grade_get_setting($this->courseid, 'aggregationposition', $CFG->grade_aggregationposition);
@@ -208,7 +208,7 @@
                            $subtext = get_string('subscribe', 'forum');
                        }
                        print_heading_block($newsforum->name);
-                        echo '<div class="subscribelink"><a href="mod/forum/subscribe.php?id='.$newsforum->id.'">'.$subtext.'</a></div>';
+                        echo '<div class="subscribelink"><a href="mod/forum/subscribe.php?id='.$newsforum->id.'&amp;sesskey='.sesskey().'">'.$subtext.'</a></div>';
                    } else {
                        print_heading_block($newsforum->name);
                    }
@@ -114,7 +114,7 @@ $string['configdisablecourseajax'] = 'Do not use AJAX when editing main course p
 $string['configenablecalendarexport'] = 'Enable exporting or subscribing to calendars.';
 $string['configenablecourserequests'] = 'This will allow any user to request a course be created.';
 $string['configenableglobalsearch'] = 'This setting enables global text searching in resources and activities, it is not compatible with PHP 4.';
-$string['configenablegroupings'] = 'This setting enables groupings of groups.';
+$string['configenablegroupings'] = 'This setting enables the creation of groupings and the \'Available for group members only\' option. Groupings are a standard feature in Moodle 2.0 onwards whereas \'Available for group members only\' remains an experimental feature.';
 $string['configenablehtmlpurifier'] = 'Use HTML Purifier instead of KSES for cleaning of untrusted text. HTML Purifier is actively developed and is believed to be more secure, but it is more resource intensive. Expect minor visual differences in the resulting html code. Please note that embed and object tags can not be enabled, MathML tags and old lang tags are not supported. ';
 $string['configenablerssfeeds'] = 'This switch will enable RSS feeds from across the site.  To actually see any change you will need to enable RSS feeds in the individual modules too - go to the Modules settings under Admin Configuration.';
 $string['configenablerssfeedsdisabled'] = 'It is not available because RSS feeds are disabled in all the Site. To enable them, go to the Variables settings under Admin Configuration.';
@@ -209,8 +209,8 @@ $string['configcronremotepassword'] = 'This means that the cron.php script canno
 </pre>If this is left empty, no password is required.';
 $string['configrcache'] = 'Use the cache to store database records. Remember to set \'cachetype\' as well!';
 $string['configrcachettl'] = 'Time-to-live for cached records, in seconds. Use a short (&lt;15) value here.';
-$string['configrecaptchaprivatekey'] = 'String of characters used to communicate between your Moodle server and the recaptcha.net server. Obtain one for this site by visiting http://recaptcha.net';
-$string['configrecaptchapublickey'] = 'String of characters used to display the reCAPTCHA element in the signup form. Generated by http://recaptcha.net';
+$string['configrecaptchaprivatekey'] = 'String of characters used to communicate between your Moodle server and the recaptcha server. Obtain one for this site by visiting http://www.google.com/recaptcha';
+$string['configrecaptchapublickey'] = 'String of characters used to display the reCAPTCHA element in the signup form. Generated by http://www.google.com/recaptcha';
 $string['configregenloginsession'] = 'Regeneration of the session id during each login request is highly recommended for security reasons. This setting might not be compatible with some authentication plugins.';
 $string['configrequestedstudentname'] = 'Word for student used in requested courses';
 $string['configrequestedstudentsname'] = 'Word for students used in requested courses';
@@ -358,7 +358,7 @@ $string['enableajax'] = 'Enable AJAX';
 $string['enablecalendarexport'] = 'Enable calendar export';
 $string['enablecourserequests'] = 'Enable course requests';
 $string['enableglobalsearch'] = 'Enable global search';
-$string['enablegroupings'] = 'Enable groupings';
+$string['enablegroupings'] = 'Enable groupings and \'Available for group members only\'';
 $string['enablehtmlpurifier'] = 'Enable HTML Purifier';
 $string['enablerecordcache'] = 'Enable Record Cache';
 $string['enablerssfeeds'] = 'Enable RSS feeds';
@@ -588,6 +588,7 @@ $string['performance'] = 'Performance';
 $string['pgcluster'] = 'PostgreSQL Cluster';
 $string['pgclusterdescription'] = 'PostgreSQL version/cluster parameter for command line operations. If you only have one postgresql on your system or you are not sure what this is, leave this blank.';
 $string['php50restricted'] = 'PHP 5.0.x has a number of known problems, please upgrade to 5.1.x or downgrade to 4.3.x or 4.4.x';
+$string['php533warning'] = 'PHP 5.3.3 and upwards is recommended';
 $string['phpfloatproblem'] = 'Detected unexpected problem in handling of PHP float numbers - $a';
 $string['pleaseregister'] = 'Please register your site to remove this button';
 $string['pleaserefreshregistration'] = 'Your site has been registered with moodle.org, please consider updating the registration if significant changes happened since your last update, on $a';
@@ -36,9 +36,14 @@ $string['auth_nologintitle'] = 'No login';
 $string['auth_cas_proxycas_key'] = "Proxy mode";
 $string['auth_cas_logoutcas_key'] = "Logout CAS";
 $string['auth_cas_multiauth_key'] = "Multi-authentication";
-$string['auth_cas_proxycas'] = "Turn this to 'yes'' if you use CASin proxy-mode";
-$string['auth_cas_logoutcas'] = "Turn this to 'yes'' if tou want to logout from CAS when you deconnect from Moodle";
-$string['auth_cas_multiauth'] = "Turn this to 'yes'' if you want to have multi-authentication (CAS + other authentication)";
+$string['auth_cas_certificate_check_key'] = "Server validation";
+$string['auth_cas_certificate_path_key'] = "Certificate path";
+$string['auth_cas_proxycas'] = "Turn this to ''yes'' if you use CASin proxy-mode";
+$string['auth_cas_logoutcas'] = "Turn this to ''yes'' if tou want to logout from CAS when you deconnect from Moodle";
+$string['auth_cas_multiauth'] = "Turn this to ''yes'' if you want to have multi-authentication (CAS + other authentication)";
+$string['auth_cas_certificate_check'] = "Turn this to ''yes'' if you want to validate the server certificate";
+$string['auth_cas_certificate_path'] = "Path of the CA chain file (PEM Format) to validate the server certificate";
+$string['auth_cas_certificate_path_empty'] = "If you turn on Server validation, you need to specify a certificate path";
 $string['accesCAS'] = "CAS users";
 $string['accesNOCAS'] = "other users";
 $string['CASform'] = "Authentication choice";
@@ -120,7 +125,7 @@ $string['auth_emailnowexists'] = 'The email address you tried to assign to your
 $string['auth_emailtitle'] = 'Email-based self-registration';
 $string['auth_emailnoinsert'] = 'Could not add your record to the database!';
 $string['auth_emailnoemail'] = 'Tried to send you an email but failed!';
-$string['auth_emailrecaptcha'] = 'Adds a visual/audio confirmation form element to the signup page for email self-registering users. This protects your site against spammers and contributes to a worthwhile cause. See http://recaptcha.net/learnmore.html for more details. <br /><em>PHP cURL extension is required.</em>';
+$string['auth_emailrecaptcha'] = 'Adds a visual/audio confirmation form element to the signup page for email self-registering users. This protects your site against spammers and contributes to a worthwhile cause. See http://www.google.com/recaptcha/learnmore for more details. <br /><em>PHP cURL extension is required.</em>';
 $string['auth_emailrecaptcha_key'] = 'Enable reCAPTCHA element';
 $string['auth_emailsettings'] = 'Settings';
 $string['auth_emailupdatemessage'] = 'Dear $a->fullname,
@@ -255,7 +260,7 @@ $string['auth_ntlmsso_enabled'] = 'Set to yes to attempt Single Sign On with the
 $string['auth_ntlmsso_ie_fastpath'] = 'Set to yes to enable the NTLM SSO fast path (bypasses certain steps and only works if the client\'s browser is MS Internet Explorer).';
 $string['auth_ntlmsso_ie_fastpath_key'] = 'MS IE fast path?';
 $string['auth_ntlmsso_subnet_key'] = 'Subnet';
-$string['auth_ntlmsso_subnet'] = 'If set, it will only attempt SSO with clients in this subnet. Format: xxx.xxx.xxx.xxx/bitmask';
+$string['auth_ntlmsso_subnet'] = 'If set, it will only attempt SSO with clients in this subnet. Format: xxx.xxx.xxx.xxx/bitmask. Separate multiple subnets with \',\' (comma).';
 $string['ntlmsso_attempting'] = 'Attempting Single Sign On via NTLM...';
 $string['ntlmsso_failed'] = 'Auto-login failed, try the normal login page...';
 $string['ntlmsso_isdisabled'] = 'NTLM SSO is disabled.';
@@ -47,6 +47,8 @@ $string['configreplytouser'] = 'When a forum post is mailed out, should it conta
 $string['configshortpost'] = 'Any post under this length (in characters not including HTML) is considered short (see below).';
 $string['configtrackreadposts'] = 'Set to \'yes\' if you want to track read/unread for each user.';
 $string['configusermarksread'] = 'If \'yes\', the user must manually mark a post as read. If \'no\', when the post is viewed it is marked as read.';
+$string['confirmsubscribe'] = 'Do you really want to subscribe to forum \'{$a}\'?';
+$string['confirmunsubscribe'] = 'Do you really want to unsubscribe from forum \'{$a}\'?';
 $string['couldnotadd'] = 'Could not add your post due to an unknown error';
 $string['couldnotdeleteratings'] = 'Sorry, that cannot be deleted as people have already rated it';
 $string['couldnotdeletereplies'] = 'Sorry, that cannot be deleted as people have already responded to it';
@@ -92,7 +94,7 @@ $string['forum'] = 'Forum';
 $string['forum:addnews'] = 'Add news';
 $string['forumauthorhidden'] = 'Author (hidden)';
 $string['forumblockingalmosttoomanyposts'] = 'You are approaching the posting threshold. You have posted $a->numposts times in the last $a->blockperiod and the limit is $a->blockafter posts.';
-$string['forumbodyhidden'] = 'This post cannot be viewed by you, probably because you have not posted in the discussion yet.';
+$string['forumbodyhidden'] = 'This post cannot be viewed by you, probably because you have not posted in the discussion or the maximum editing time hasn\'t passed yet.';
 $string['forum:createattachment'] = 'Create attachments';
 $string['forum:deleteanypost'] = 'Delete any posts (anytime)';
 $string['forum:deleteownpost'] = 'Delete own posts (within deadline)';
@@ -12,6 +12,7 @@ $string['allowcomments'] = 'Allow comments on entries';
 $string['allowduplicatedentries'] = 'Duplicated entries allowed';
 $string['allowprintview'] = 'Allow print view';
 $string['allowratings'] = 'Allow entries to be rated?';
+$string['andmorenewentries'] = 'and {$a} more new entries.';
 $string['answer'] = 'Answer';
 $string['approve'] = 'Approve';
 $string['areyousuredelete'] = 'Are you sure you want to delete this entry?';
@@ -9,5 +9,8 @@ $string['flashvideo'] = 'Flash video';
 $string['mp3audio'] = 'MP3 audio';
 $string['oggaudio'] = 'OGG audio';
 $string['ogvvideo'] = 'OGV video';
+$string['quicktime'] = 'Quicktime';
+$string['realaudio'] = 'Real audio';
+$string['wmpvideo'] = 'WMP video';
 $string['unsupportedplugins'] = '(The browser does not support this type of file. {$a})';
 ?>
@@ -5011,7 +5011,7 @@ function sort_by_roleassignment_authority($users, $context, $roles=array(), $sor
 * @param bool gethidden - whether to fetch hidden enrolments too
 * @return array()
 */
-function get_role_users($roleid, $context, $parent=false, $fields='', $sort='u.lastname ASC', $gethidden=true, $group='', $limitfrom='', $limitnum='') {
+function get_role_users($roleid, $context, $parent=false, $fields='', $sort='u.lastname ASC, u.firstname ASC', $gethidden=true, $group='', $limitfrom='', $limitnum='') {
    global $CFG;

    if (empty($fields)) {
@@ -1,4 +1,4 @@
-<?php
+<?php
 /*
 	Bulgarian language, v1.0, 25.03.2004, encoding by UTF-8 charset
 	contributed by Valentin Sheiretsky <valio#valio.eu.org>
@@ -34,4 +34,4 @@ $ADODB_LANG_ARRAY = array (
            DB_ERROR_NOSUCHDB           => 'несъществуваща база данни',
            DB_ERROR_ACCESS_VIOLATION   => 'нямате достатъчно права'
 );
-?>
+?>
@@ -94,8 +94,8 @@ section_class.prototype.init_buttons = function() {
        commandContainer.appendChild(highlightbutton);
        this.highlightButton = highlightbutton;
    }
-    
-    if (this.sectionId > 0 ) {        
+
+    if (this.sectionId > 0 ) {
        var viewbutton = main.mk_button('div', '/i/hide.gif', main.getString('hidesection', this.sectionId), [['title', main.portal.strings['hide'] ]]);
    YAHOO.util.Event.addListener(viewbutton, 'click', this.toggle_hide, this,true);
    commandContainer.appendChild(viewbutton);
@@ -141,12 +141,12 @@ section_class.prototype.process_section = function() {

    // Find/edit resources
    this.resources_ul = this.content_td.getElementsByTagName('ul')[0];
-    var i=0;    
-    while (this.resources_ul && this.resources_ul.className != 'section img-text') {        
+    var i=0;
+    while (this.resources_ul && this.resources_ul.className != 'section img-text') {
        this.resources_ul = this.content_td.getElementsByTagName('ul')[i];
        i++;
    }
-    
+
    if (!this.resources_ul) {
        this.resources_ul = document.createElement('ul');
        this.resources_ul.className='section';
@@ -158,10 +158,12 @@ section_class.prototype.process_section = function() {
        var resource = this.resources_ul.getElementsByTagName('li')[i];
        this.resources[this.resources.length] = new resource_class(resource.id, 'resources', null, this);
    }
-    this.summary = YAHOO.util.Dom.getElementsByClassName('summary', null, this.getEl())[0].firstChild.data || '';
+    var summarysection = YAHOO.util.Dom.getElementsByClassName('summary', null, this.getEl())[0].firstChild;
+    if (summarysection != null) {
+        this.summary = summarysection.data || '';
+    }
 }

-
 section_class.prototype.startDrag = function(x, y) {
    //operates in point mode
    YAHOO.util.DDM.mode = YAHOO.util.DDM.POINT;
@@ -54,4 +54,12 @@ function php_check_register_globals($result) {
    return $result;
 }

+function php_check_php533($result) {
+    if (version_compare(phpversion(), '5.3.3') < 0) {
+        $result->status = false;
+    } else {
+        $result = null;
+    }
+    return $result;
+}
 ?>
@@ -933,6 +933,9 @@
      <KEYS>
        <KEY NAME="primary" TYPE="primary" FIELDS="id"/>
      </KEYS>
+      <INDEXES>
+        <INDEX NAME="userfieldidx" UNIQUE="false" FIELDS="userid, fieldid"/>
+      </INDEXES>
    </TABLE>
    <TABLE NAME="mnet_enrol_course" COMMENT="Information about courses on remote hosts" PREVIOUS="user_info_data" NEXT="mnet_enrol_assignments">
      <FIELDS>
@@ -3351,6 +3351,23 @@ function xmldb_main_upgrade($oldversion=0) {
        set_config('filter_mediaplugin_enable_ogg', 1);
        upgrade_main_savepoint($result, 2007101590.01);
    }
+
+    if ($result && $oldversion < 2007101591.01) {
+
+    /// Define index userfieldidx (not unique) to be added to user_info_data
+        $table = new XMLDBTable('user_info_data');
+        $index = new XMLDBIndex('userfieldidx');
+        $index->setAttributes(XMLDB_INDEX_NOTUNIQUE, array('userid', 'fieldid'));
+
+    /// Launch add index userfieldidx
+        if (!index_exists($table, $index)) {
+            $result = $result && add_index($table, $index);
+        }
+
+    /// Main savepoint reached
+        upgrade_main_savepoint($result, 2007101591.01);
+    }
+
    return $result;
 }

@@ -1677,6 +1677,12 @@ function error ($message, $link='') {
        }
    }

+    // when printing an error the continue button should never link offsite
+    if (stripos($link, $CFG->wwwroot) === false &&
+        stripos($link, $CFG->httpswwwroot) === false) {
+        $link = $CFG->wwwroot.'/';
+    }
+
    if (!empty($link)) {
        print_continue($link);
    }
@@ -2371,6 +2371,7 @@ HTMLArea.is_mac_ie = (HTMLArea.is_ie && HTMLArea.is_mac);
 HTMLArea.is_win_ie = (HTMLArea.is_ie && !HTMLArea.is_mac);
 HTMLArea.is_gecko  = (navigator.product == "Gecko");
 HTMLArea.is_safari = (HTMLArea.agt.indexOf("safari") != -1);
+HTMLArea.is_webkit = (HTMLArea.agt.indexOf("applewebkit") != -1); // eg: chrome

 // variable used to pass the object to the popup editor window.
 HTMLArea._object = null;
@@ -2398,6 +2399,9 @@ HTMLArea.cloneObject = function(obj) {

 // FIXME!!! this should return false for IE < 5.5
 HTMLArea.checkSupportedBrowser = function() {
+    if (HTMLArea.is_webkit) {
+        return true;
+    }
    if (HTMLArea.is_gecko) {
        if (navigator.productSub < 20021201) {
            alert("You need at least Mozilla-1.3 Alpha.\n" +
@@ -3,6 +3,7 @@
    require("../../../../config.php");

    $id = optional_param('id', SITEID, PARAM_INT);
+    $httpsrequired = optional_param('httpsrequired', 0, PARAM_BOOL);

    require_login($id);
    require_capability('moodle/course:managefiles', get_context_instance(CONTEXT_COURSE, $id));
@@ -2,8 +2,10 @@
    require("../../../../config.php");

    $id = optional_param('id', SITEID, PARAM_INT);
+    $httpsrequired = optional_param('httpsrequired', 0, PARAM_BOOL);

    require_course_login($id);
+
    @header('Content-Type: text/html; charset=utf-8');

    if ($httpsrequired or (!empty($_SERVER['HTTPS']) and $_SERVER['HTTPS'] != 'off')) {
@@ -122,7 +122,16 @@ class MoodleExcelWorksheet {
     */
    function MoodleExcelWorksheet($name, &$workbook, $latin_output=false) {

-    /// Internally, add one sheet to the workbook    
+        if (strlen($name) > 31) {
+            // Excel does not seem able to cope with sheet names > 31 chars.
+            // With $latin_output = false, it does not cope at all.
+            // With $latin_output = true it is supposed to work, but in our experience,
+            // it doesn't. Therefore, truncate in all circumstances.
+            $textlib = textlib_get_instance();
+            $name = $textlib->substr($name, 0, 31);
+        }
+
+    /// Internally, add one sheet to the workbook
        $this->pear_excel_worksheet =& $workbook->addWorksheet($name);
        $this->latin_output = $latin_output;
    /// Set encoding to UTF-16LE 
@@ -196,7 +205,13 @@ class MoodleExcelWorksheet {
        $format = $this->MoodleExcelFormat2PearExcelFormat($format);
    /// Convert the date to Excel format
        $timezone = get_user_timezone_offset();
-        $value =  ((usertime($date) + (int)($timezone * HOURSECS * 2)) / 86400) + 25569;
+        if ($timezone == 99) {
+            // system timezone offset in seconds
+            $offset = (int)date('Z');
+        } else {
+            $offset = (int)($timezone * HOURSECS * 2);
+        }
+        $value = ((usertime($date) + $offset) / 86400) + 25569;
    /// Add  the date safely to the PEAR Worksheet
        $this->pear_excel_worksheet->writeNumber($row, $col, $value, $format);
    }
@@ -656,12 +656,14 @@ class moodleform {
    /**
     * Adds a link/button that controls the checked state of a group of checkboxes.
     * @param int    $groupid The id of the group of advcheckboxes this element controls
-     * @param string $text The text of the link. Defaults to "select all/none"
+     * @param string $text The text of the link. Defaults to selectallornone ("select all/none")
     * @param array  $attributes associative array of HTML attributes
     * @param int    $originalValue The original general state of the checkboxes before the user first clicks this element
     */
-    function add_checkbox_controller($groupid, $buttontext, $attributes, $originalValue = 0) {
+    function add_checkbox_controller($groupid, $text = null, $attributes = null, $originalValue = 0) {
        global $CFG;
+
+        // Set the default text if none was specified
        if (empty($text)) {
            $text = get_string('selectallornone', 'form');
        }
@@ -173,13 +173,14 @@ class grade_object {
            $wheresql = implode("AND", $wheresql);
        }

-        if ($datas = get_records_select($table, $wheresql, 'id')) {
+        if ($rs = get_recordset_select($table, $wheresql, 'id')) {
            $result = array();
-            foreach($datas as $data) {
+            while ($data = rs_fetch_next_record($rs)) {
                $instance = new $classname();
                grade_object::set_properties($instance, $data);
                $result[$instance->id] = $instance;
            }
+            rs_close($rs);
            return $result;

        } else {
@@ -157,7 +157,7 @@ function groups_get_user_groups($courseid, $userid=0) {

    $result    = array();
    $allgroups = array();
-    
+
    while ($group = rs_fetch_next_record($rs)) {
        $allgroups[$group->id] = $group->id;
        if (is_null($group->groupingid)) {
@@ -589,10 +589,8 @@ class html2text
     */
    function _strtoupper($str)
    {
-        if (function_exists('mb_strtoupper'))
-            return mb_strtoupper($str);
-        else
-            return strtoupper($str);
+        $tl = textlib_get_instance();
+        return $tl->strtoupper($str);
    }
 }

@@ -60,4 +60,25 @@ index b7e3e3e..96ef508 100644
         }
     }

- -- Tim Hunt 2010-08-04
+-- Tim Hunt 2010-08-04
+
+
+3- Use textlib, not crappy functions that break UTF-8, in the _strtoupper method.
+
+Index: lib/html2text.php
+--- lib/html2text.php   2 Sep 2010 12:49:29 -0000   1.16
+++ lib/html2text.php   2 Nov 2010 19:57:09 -0000
+@@ -580,9 +580,7 @@
+      */
+     function _strtoupper($str)
+     {
+-        if (function_exists('mb_strtoupper'))
+-            return mb_strtoupper($str);
+-        else
+-            return strtoupper($str);
+        $tl = textlib_get_instance();
+        return $tl->strtoupper($str);
+     }
+ }
+
+-- Tim Hunt 2010-11-02
@@ -567,8 +567,12 @@ function clean_param($param, $type) {
            }

        case PARAM_TAG:
+            // Please note it is not safe to use the tag name directly anywhere,
+            // it must be processed with s(), urlencode() before embedding anywhere.
+            // remove some nasties
+            $param = preg_replace('~[[:cntrl:]]|[<>`]~u', '', $param);
            //as long as magic_quotes_gpc is used, a backslash will be a
-            //problem, so remove *all* backslash.
+            //problem, so remove *all* backslash - BUT watch out for SQL injections caused by this sloppy design (skodak)
            $param = str_replace('\\', '', $param);
            //convert many whitespace chars into one
            $param = preg_replace('/\s+/', ' ', $param);
@@ -576,7 +580,6 @@ function clean_param($param, $type) {
            $param = $textlib->substr(trim($param), 0, TAG_MAX_LENGTH);
            return $param;

-
        case PARAM_TAGLIST:
            $tags = explode(',', $param);
            $result = array();
@@ -1112,27 +1115,28 @@ function get_user_preferences($name=NULL, $default=NULL, $otheruserid=NULL) {
 * @param int $hour The hour part to create timestamp of
 * @param int $minute The minute part to create timestamp of
 * @param int $second The second part to create timestamp of
- * @param float $timezone ?
- * @param bool $applydst ?
+ * @param mixed $timezone Timezone modifier, if 99 then use default user's timezone
+ * @param bool $applydst Toggle Daylight Saving Time, default true, will be 
+ *             applied only if timezone is 99 or string.
 * @return int timestamp
 * @todo Finish documenting this function
 */
 function make_timestamp($year, $month=1, $day=1, $hour=0, $minute=0, $second=0, $timezone=99, $applydst=true) {

-    $strtimezone = NULL;
-    if (!is_numeric($timezone)) {
-        $strtimezone = $timezone;
-    }
+    //save input timezone, required for dst offset check.
+    $passedtimezone = $timezone;

    $timezone = get_user_timezone_offset($timezone);

-    if (abs($timezone) > 13) {
+    if (abs($timezone) > 13) {  //server time
        $time = mktime((int)$hour, (int)$minute, (int)$second, (int)$month, (int)$day, (int)$year);
    } else {
        $time = gmmktime((int)$hour, (int)$minute, (int)$second, (int)$month, (int)$day, (int)$year);
        $time = usertime($time, $timezone);
-        if($applydst) {
-            $time -= dst_offset_on($time, $strtimezone);
+
+        //Apply dst for string timezones or if 99 then try dst offset with user's default timezone
+        if ($applydst && ((99 == $passedtimezone) || !is_numeric($passedtimezone))) {
+            $time -= dst_offset_on($time, $passedtimezone);
        }
    }

@@ -1219,7 +1223,8 @@ function make_timestamp($year, $month=1, $day=1, $hour=0, $minute=0, $second=0,
 * @uses HOURSECS
 * @param  int $date timestamp in GMT
 * @param string $format strftime format
- * @param float $timezone
+ * @param mixed $timezone by default, uses the user's time zone. if numeric and
+ *      not 99 then daylight saving will not be added.
 * @param bool $fixday If true (default) then the leading
 * zero from %d is removed. If false then the leading zero is mantained.
 * @return string
@@ -1228,11 +1233,6 @@ function userdate($date, $format='', $timezone=99, $fixday = true) {

    global $CFG;

-    $strtimezone = NULL;
-    if (!is_numeric($timezone)) {
-        $strtimezone = $timezone;
-    }
-
    if (empty($format)) {
        $format = get_string('strftimedaydatetime');
    }
@@ -1244,7 +1244,11 @@ function userdate($date, $format='', $timezone=99, $fixday = true) {
        $fixday = ($formatnoday != $format);
    }

-    $date += dst_offset_on($date, $strtimezone);
+    //add daylight saving offset for string timezones only, as we can't get dst for
+    //float values. if timezone is 99 (user default timezone), then try update dst.
+    if ((99 == $timezone) || !is_numeric($timezone)) {
+        $date += dst_offset_on($date, $timezone);
+    }

    $timezone = get_user_timezone_offset($timezone);

@@ -1286,16 +1290,15 @@ function userdate($date, $format='', $timezone=99, $fixday = true) {
 *
 * @uses HOURSECS
 * @param int $time Timestamp in GMT
- * @param float $timezone ?
+ * @param mixed $timezone offset time with timezone, if float and not 99, then no
+ *        dst offset is applyed
 * @return array An array that represents the date in user time
 * @todo Finish documenting this function
 */
 function usergetdate($time, $timezone=99) {

-    $strtimezone = NULL;
-    if (!is_numeric($timezone)) {
-        $strtimezone = $timezone;
-    }
+    //save input timezone, required for dst offset check.
+    $passedtimezone = $timezone;

    $timezone = get_user_timezone_offset($timezone);

@@ -1303,8 +1306,12 @@ function usergetdate($time, $timezone=99) {
        return getdate($time);
    }

-    // There is no gmgetdate so we use gmdate instead
-    $time += dst_offset_on($time, $strtimezone);
+    //add daylight saving offset for string timezones only, as we can't get dst for
+    //float values. if timezone is 99 (user default timezone), then try update dst.
+    if ($passedtimezone == 99 || !is_numeric($passedtimezone)) {
+        $time += dst_offset_on($time, $passedtimezone);
+    }
+
    $time += intval((float)$timezone * HOURSECS);

    $datestring = gmstrftime('%B_%A_%j_%Y_%m_%w_%d_%H_%M_%S', $time);
@@ -1453,7 +1460,7 @@ function get_timezone_offset($tz) {
 *
 * @uses $USER
 * @uses $CFG
- * @param float $tz If this value is provided and not equal to 99, it will be returned as is and no other settings will be checked
+ * @param mixed $tz If this value is provided and not equal to 99, it will be returned as is and no other settings will be checked
 * @return mixed
 */
 function get_user_timezone($tz = 99) {
@@ -2978,7 +2985,7 @@ function create_user_record($username, $password, $auth='manual') {
    $newuser->mnethostid = $CFG->mnet_localhost_id;

    if (insert_record('user', $newuser)) {
-        $user = get_complete_user_data('username', $newuser->username);
+        $user = get_complete_user_data('username', $newuser->username, $CFG->mnet_localhost_id);
        if(!empty($CFG->{'auth_'.$newuser->auth.'_forcechangepassword'})){
            set_user_preference('auth_forcepasswordchange', 1, $user->id);
        }
@@ -2995,17 +3002,19 @@ function create_user_record($username, $password, $auth='manual') {
 * @param string $username New user's username to add to record
 * @return user A {@link $USER} object
 */
-function update_user_record($username, $authplugin) {
+function update_user_record($username, $unused) {
+    global $CFG;
+
    $username = trim(moodle_strtolower($username)); /// just in case check text case

-    $oldinfo = get_record('user', 'username', $username, '','','','', 'username, auth');
+    $oldinfo = get_record('user', 'username', $username, 'mnethostid', $CFG->mnet_localhost_id, '','', 'id, username, auth');
    $userauth = get_auth_plugin($oldinfo->auth);

    if ($newinfo = $userauth->get_userinfo($username)) {
        $newinfo = truncate_userinfo($newinfo);
        foreach ($newinfo as $key => $value){
-            if ($key === 'username') {
-                // 'username' is not a mapped updateable/lockable field, so skip it.
+            if ($key === 'username' or $key === 'id' or $key === 'auth' or $key === 'mnethostid' or $key === 'deleted') {
+                // these fields must not be changed
                continue;
            }
            $confval = $userauth->config->{'field_updatelocal_' . $key};
@@ -3022,14 +3031,14 @@ function update_user_record($username, $authplugin) {
                // nothing_ for this field. Thus it makes sense to let this value
                // stand in until LDAP is giving a value for this field.
                if (!(empty($value) && $lockval === 'unlockedifempty')) {
-                    set_field('user', $key, $value, 'username', $username)
+                    set_field('user', $key, $value, 'id', $oldinfo->id)
                        || error_log("Error updating $key for $username");
                }
            }
        }
    }

-    return get_complete_user_data('username', $username);
+    return get_complete_user_data('username', $username, $CFG->mnet_localhost_id);
 }

 function truncate_userinfo($info) {
@@ -6417,13 +6426,25 @@ function check_php_version($version='4.1.0') {
          }
          break;

+      case 'Chrome':
+          if (preg_match("/Chrome\/(.*)[ ]+/i", $agent, $match)) {
+              if (version_compare($match[1], $version) >= 0) {
+                  return true;
+              }
+          }
+          break;
+
      case 'Safari':  /// Safari
-          // Look for AppleWebKit, excluding strings with OmniWeb, Shiira and SimbianOS
+          // Look for AppleWebKit, excluding strings with OmniWeb, Shiira and SymbianOS
          if (strpos($agent, 'OmniWeb')) { // Reject OmniWeb
              return false;
          } elseif (strpos($agent, 'Shiira')) { // Reject Shiira
              return false;
-          } elseif (strpos($agent, 'SimbianOS')) { // Reject SimbianOS
+          } elseif (strpos($agent, 'SymbianOS')) { // Reject SymbianOS
+              return false;
+          }
+          if (strpos($agent, 'iPhone') or strpos($agent, 'iPad') or strpos($agent, 'iPod')) {
+              // No Apple mobile devices here - editor does not work, course ajax is not touch compatible, etc.
              return false;
          }

@@ -6520,6 +6541,8 @@ function can_use_html_editor() {
            return 'MSIE';
        } else if (check_browser_version('Gecko', 20030516)) {
            return 'Gecko';
+        } else if (check_browser_version('Safari', 531)) {
+            return 'AppleWebKit';
        }
    }
    return false;
@@ -664,6 +664,7 @@ function olson_parse_at ($at, $set = 'set', $gmtoffset) {
        $at  = substr($at, 0, strlen($at)-1); // chop
    }

+    $at = (strpos($at, ':') === false) ? $at . ':0' : $at;
    list($hours, $mins) = explode(':', $at);

    // GMT -- return as is!
@@ -517,7 +517,7 @@ function question_delete_course($course, $feedback=true) {
    //Cache some strings
    $strcatdeleted = get_string('unusedcategorydeleted', 'quiz');
    $coursecontext = get_context_instance(CONTEXT_COURSE, $course->id);
-    $categoriescourse = get_records('question_categories', 'contextid', $coursecontext->id, 'parent', 'id, parent, name');
+    $categoriescourse = get_records('question_categories', 'contextid', $coursecontext->id, 'parent', 'id, parent, name, contextid');

    if ($categoriescourse) {

@@ -676,7 +676,7 @@ function question_delete_activity($cm, $feedback=true) {
    //Cache some strings
    $strcatdeleted = get_string('unusedcategorydeleted', 'quiz');
    $modcontext = get_context_instance(CONTEXT_MODULE, $cm->id);
-    if ($categoriesmods = get_records('question_categories', 'contextid', $modcontext->id, 'parent', 'id, parent, name')){
+    if ($categoriesmods = get_records('question_categories', 'contextid', $modcontext->id, 'parent', 'id, parent, name, contextid')){
        //Sort categories following their tree (parent-child) relationships
        //this will make the feedback more readable
        $categoriesmods = sort_categories_by_tree($categoriesmods);
@@ -1796,7 +1796,7 @@ function sort_categories_by_tree(&$categories, $id = 0, $level = 1) {
    if ($level == 1) {
        foreach ($keys as $key) {
            //If not processed and it's a good candidate to start (because its parent doesn't exist in the course)
-            if (!isset($categories[$key]->processed) && !record_exists('question_categories', 'course', $categories[$key]->course, 'id', $categories[$key]->parent)) {
+            if (!isset($categories[$key]->processed) && !record_exists('question_categories', 'contextid', $categories[$key]->contextid, 'id', $categories[$key]->parent)) {
                $children[$key] = $categories[$key];
                $categories[$key]->processed = true;
                $children = $children + sort_categories_by_tree($categories, $children[$key]->id, $level+1);
@@ -2,13 +2,13 @@
 /*
 * This is a PHP library that handles calling reCAPTCHA.
 *    - Documentation and latest version
- *          http://recaptcha.net/plugins/php/
+ *          {@link http://code.google.com/apis/recaptcha/docs/php.html}
 *    - Get a reCAPTCHA API Key
- *          http://recaptcha.net/api/getkey
+ *          {@link https://www.google.com/recaptcha/admin/create}
 *    - Discussion group
 *          http://groups.google.com/group/recaptcha
 *
- * Copyright (c) 2007 reCAPTCHA -- http://recaptcha.net
+ * Copyright (c) 2007 reCAPTCHA -- {@link http://www.google.com/recaptcha}
 * AUTHORS:
 *   Mike Crawford
 *   Ben Maurer
@@ -30,14 +30,17 @@
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
+ *
+ * @package moodlecore
+ * @copyright (c) 2007 reCAPTCHA -- {@link http://www.google.com/recaptcha}
 */

 /**
 * The reCAPTCHA server URL's
 */
-define("RECAPTCHA_API_SERVER", "http://api.recaptcha.net");
-define("RECAPTCHA_API_SECURE_SERVER", "https://api-secure.recaptcha.net");
-define("RECAPTCHA_VERIFY_SERVER", "api-verify.recaptcha.net");
+define("RECAPTCHA_API_SERVER", "http://www.google.com/recaptcha/api");
+define("RECAPTCHA_API_SECURE_SERVER", "https://www.google.com/recaptcha/api");
+define("RECAPTCHA_VERIFY_SERVER", "www.google.com");

 /**
 * Encodes the given data into a query string format
@@ -107,15 +110,15 @@ function recaptcha_get_html ($pubkey, $error = null, $use_ssl = false) {

    $recaptchatype = optional_param('recaptcha', 'image', PARAM_TEXT);

-	if ($pubkey == null || $pubkey == '') {
-		die ("To use reCAPTCHA you must get an API key from <a href='http://recaptcha.net/api/getkey'>http://recaptcha.net/api/getkey</a>");
-	}
-	
-	if ($use_ssl) {
-                $server = RECAPTCHA_API_SECURE_SERVER;
-        } else {
-                $server = RECAPTCHA_API_SERVER;
-        }
+    if ($pubkey == null || $pubkey == '') {
+		die ("To use reCAPTCHA you must get an API key from <a href='https://www.google.com/recaptcha/admin/create'>https://www.google.com/recaptcha/admin/create</a>");
+    }
+
+    if ($use_ssl) {
+        $server = RECAPTCHA_API_SECURE_SERVER;
+    } else {
+        $server = RECAPTCHA_API_SERVER;
+    }

        $errorpart = "";
        if ($error) {
@@ -175,6 +178,9 @@ function recaptcha_get_html ($pubkey, $error = null, $use_ssl = false) {

 /**
 * A ReCaptchaResponse is returned from recaptcha_check_answer()
+ *
+ * @package moodlecore
+ * @copyright (c) 2007 reCAPTCHA -- {@link http://www.google.com/recaptcha}
 */
 class ReCaptchaResponse {
        var $is_valid;
@@ -192,9 +198,9 @@ class ReCaptchaResponse {
  */
 function recaptcha_check_answer ($privkey, $remoteip, $challenge, $response, $https=false)
 {
-	if ($privkey == null || $privkey == '') {
-		die ("To use reCAPTCHA you must get an API key from <a href='http://recaptcha.net/api/getkey'>http://recaptcha.net/api/getkey</a>");
-	}
+    if ($privkey == null || $privkey == '') {
+		die ("To use reCAPTCHA you must get an API key from <a href='https://www.google.com/recaptcha/admin/create'>https://www.google.com/recaptcha/admin/create</a>");
+    }

 	if ($remoteip == null || $remoteip == '') {
 		die ("For security reasons, you must pass the remote ip to reCAPTCHA");
@@ -210,12 +216,12 @@ function recaptcha_check_answer ($privkey, $remoteip, $challenge, $response, $ht
                return $recaptcha_response;
        }

-        $response = _recaptcha_http_post (RECAPTCHA_VERIFY_SERVER, "/verify",
-                                          array (
-                                                 'privatekey' => $privkey,
-                                                 'remoteip' => $remoteip,
-                                                 'challenge' => $challenge,
-                                                 'response' => $response
+        $response = _recaptcha_http_post(RECAPTCHA_VERIFY_SERVER, "/recaptcha/api/verify",
+                                         array (
+                                                'privatekey' => $privkey,
+                                                'remoteip' => $remoteip,
+                                                'challenge' => $challenge,
+                                                'response' => $response
                                                ),
                                         $https        
                                          );
@@ -242,7 +248,7 @@ function recaptcha_check_answer ($privkey, $remoteip, $challenge, $response, $ht
 * @param string $appname The name of your application
 */
 function recaptcha_get_signup_url ($domain = null, $appname = null) {
-	return "http://recaptcha.net/api/getkey?" .  _recaptcha_qsencode (array ('domain' => $domain, 'app' => $appname));
+	return "https://www.google.com/recaptcha/admin/create?" .  _recaptcha_qsencode (array ('domains' => $domain, 'app' => $appname));
 }

 function _recaptcha_aes_pad($val) {
@@ -270,16 +276,16 @@ function _recaptcha_mailhide_urlbase64 ($x) {

 /* gets the reCAPTCHA Mailhide url for a given email, public key and private key */
 function recaptcha_mailhide_url($pubkey, $privkey, $email) {
-	if ($pubkey == '' || $pubkey == null || $privkey == "" || $privkey == null) {
-		die ("To use reCAPTCHA Mailhide, you have to sign up for a public and private key, " .
-		     "you can do so at <a href='http://mailhide.recaptcha.net/apikey'>http://mailhide.recaptcha.net/apikey</a>");
-	}
-	
+    if ($pubkey == '' || $pubkey == null || $privkey == "" || $privkey == null) {
+        die ("To use reCAPTCHA Mailhide, you have to sign up for a public and private key, " .
+		     "you can do so at <a href='http://www.google.com/recaptcha/mailhide/apikey'>http://www.google.com/recaptcha/mailhide/apikey</a>");
+    }

-	$ky = pack('H*', $privkey);
-	$cryptmail = _recaptcha_aes_encrypt ($email, $ky);
-	
-	return "http://mailhide.recaptcha.net/d?k=" . $pubkey . "&c=" . _recaptcha_mailhide_urlbase64 ($cryptmail);
+
+    $ky = pack('H*', $privkey);
+    $cryptmail = _recaptcha_aes_encrypt ($email, $ky);
+
+	return "http://www.google.com/recaptcha/mailhide/d?k=" . $pubkey . "&c=" . _recaptcha_mailhide_urlbase64 ($cryptmail);
 }

 /**
@@ -304,7 +310,7 @@ function _recaptcha_mailhide_email_parts ($email) {
 * Gets html to display an email address given a public an private key.
 * to get a key, go to:
 *
- * http://mailhide.recaptcha.net/apikey
+ * http://www.google.com/recaptcha/mailhide/apikey
 */
 function recaptcha_mailhide_html($pubkey, $privkey, $email) {
 	$emailparts = _recaptcha_mailhide_email_parts ($email);
@@ -177,7 +177,7 @@ function rss_standard_header($title = NULL, $link = NULL, $description = NULL) {
        //write image info
        $rsspix = $CFG->pixpath."/i/rsssitelogo.gif";

-        //write the info 
+        //write the info
        $result .= rss_start_tag('image', 2, true);
        $result .= rss_full_tag('url', 3, false, $rsspix);
        $result .= rss_full_tag('title', 3, false, 'moodle');
@@ -226,10 +226,10 @@ function rss_add_items($items) {
            $result .= rss_full_tag('link',3,false,$item->link);
            $result .= rss_add_enclosures($item);
            $result .= rss_full_tag('pubDate',3,false,gmdate('D, d M Y H:i:s',$item->pubdate).' GMT');  # MDL-12563
-            //Include the author if exists 
+            //Include the author if exists
            if (isset($item->author)) {
                //$result .= rss_full_tag('author',3,false,$item->author);
-                //We put it in the description instead because it's more important 
+                //We put it in the description instead because it's more important
                //for moodle than most other feeds, and most rss software seems to ignore
                //the author field ...
                $item->description = get_string('byname','',$item->author).'. &nbsp;<p>'.$item->description.'</p>';
@@ -415,7 +415,7 @@ function rss_display_feeds($courseid, $userid, $rssid='', $context) {
                $feedicons = '<a href="'. $CFG->wwwroot .'/blocks/rss_client/block_rss_client_action.php?id='. $courseid .'&amp;act=rssedit&amp;rssid='. $feed->id .'&amp;shared='.$feed->shared.'&amp;blogid='. $blogid .'">'.
                             '<img src="'. $CFG->pixpath .'/t/edit.gif" alt="'. get_string('edit').'" title="'. get_string('edit') .'" /></a>&nbsp;'.

-                             '<a href="'. $CFG->wwwroot .'/blocks/rss_client/block_rss_client_action.php?id='. $courseid .'&amp;act=delfeed&amp;rssid='. $feed->id.'&amp;shared='.$feed->shared.'blogid='. $blogid .'" 
+                             '<a href="'. $CFG->wwwroot .'/blocks/rss_client/block_rss_client_action.php?id='. $courseid .'&amp;act=delfeed&amp;sesskey='.sesskey().'&amp;rssid='. $feed->id.'&amp;shared='.$feed->shared.'blogid='. $blogid .'"
                onclick="return confirm(\''. get_string('deletefeedconfirm', 'block_rss_client') .'\');">'.
                             '<img src="'. $CFG->pixpath .'/t/delete.gif" alt="'. get_string('delete').'" title="'. get_string('delete') .'" /></a>';
            }
@@ -519,6 +519,7 @@ function rss_get_form($act='none', $url='', $rssid='', $preferredtitle='', $shar
    $returnstring .= '<input type="hidden" name="id" value="'. $courseid .'" />'."\n";
    $returnstring .= '<input type="hidden" name="blogid" value="'. $blogid .'" />'."\n";
    $returnstring .= '<input type="hidden" name="user" value="'. $USER->id .'" />'."\n";
+    $returnstring .= '<input type="hidden" name="sesskey" value="'. sesskey() .'" />'."\n";
    $returnstring .= '<br /><input type="submit" value="';
    $validatestring = "<a href=\"#\" onclick=\"window.open('http://feedvalidator.org/check.cgi?url='+getElementById('block_rss').elements['url'].value,'validate','width=640,height=480,scrollbars=yes,status=yes,resizable=yes');return true;\">". get_string('validatefeed', 'block_rss_client')."</a>";

@@ -530,7 +531,7 @@ function rss_get_form($act='none', $url='', $rssid='', $preferredtitle='', $shar

    $returnstring .= '" />&nbsp;'. $validatestring ."\n";
    $returnstring .= '</div></form>'."\n";
-    
+
    return $returnstring;
 }

@@ -255,7 +255,14 @@ class moodlelib_test extends UnitTestCase {
    }
    
    function test_usergetdate() {
-        global $USER;
+        global $USER, $CFG;
+
+        //Check if forcetimezone is set then save it and set it to use user timezone
+        $cfgforcetimezone = null;
+        if (isset($CFG->forcetimezone)) {
+            $cfgforcetimezone = $CFG->forcetimezone;
+            $CFG->forcetimezone = 99; //get user default timezone.
+        }

        $userstimezone = $USER->timezone;
        $USER->timezone = 2;//set the timezone to a known state
@@ -292,9 +299,274 @@ class moodlelib_test extends UnitTestCase {
        $this->assertEqual($weekday,'Wednesday');
        $this->assertEqual($month,'December');

+        //restore forcetimezone if changed.
+        if (!is_null($cfgforcetimezone)) {
+            $CFG->forcetimezone = $cfgforcetimezone;
+        }
+
        //set the timezone back to what it was
        $USER->timezone = $userstimezone;
    }

+    public function test_userdate() {
+        global $USER, $CFG;
+
+        $testvalues = array(
+            array(
+                'time' => '1309514400',
+                'usertimezone' => 'America/Moncton',
+                'timezone' => '0.0', //no dst offset
+                'expectedoutput' => 'Friday, 1 July 2011, 10:00 AM'
+            ),
+            array(
+                'time' => '1309514400',
+                'usertimezone' => 'America/Moncton',
+                'timezone' => '99', //dst offset and timezone offset.
+                'expectedoutput' => 'Friday, 1 July 2011, 07:00 AM'
+            ),
+            array(
+                'time' => '1309514400',
+                'usertimezone' => 'America/Moncton',
+                'timezone' => 'America/Moncton', //dst offset and timezone offset.
+                'expectedoutput' => 'Friday, 1 July 2011, 07:00 AM'
+            ),
+            array(
+                'time' => '1293876000 ',
+                'usertimezone' => 'America/Moncton',
+                'timezone' => '0.0', //no dst offset
+                'expectedoutput' => 'Saturday, 1 January 2011, 10:00 AM'
+            ),
+            array(
+                'time' => '1293876000 ',
+                'usertimezone' => 'America/Moncton',
+                'timezone' => '99', //no dst offset in jan, so just timezone offset.
+                'expectedoutput' => 'Saturday, 1 January 2011, 06:00 AM'
+            ),
+            array(
+                'time' => '1293876000 ',
+                'usertimezone' => 'America/Moncton',
+                'timezone' => 'America/Moncton', //no dst offset in jan
+                'expectedoutput' => 'Saturday, 1 January 2011, 06:00 AM'
+            ),
+            array(
+                'time' => '1293876000 ',
+                'usertimezone' => '2',
+                'timezone' => '99', //take user timezone
+                'expectedoutput' => 'Saturday, 1 January 2011, 12:00 PM'
+            ),
+            array(
+                'time' => '1293876000 ',
+                'usertimezone' => '-2',
+                'timezone' => '99', //take user timezone
+                'expectedoutput' => 'Saturday, 1 January 2011, 08:00 AM'
+            ),
+            array(
+                'time' => '1293876000 ',
+                'usertimezone' => '-10',
+                'timezone' => '2', //take this timezone
+                'expectedoutput' => 'Saturday, 1 January 2011, 12:00 PM'
+            ),
+            array(
+                'time' => '1293876000 ',
+                'usertimezone' => '-10',
+                'timezone' => '-2', //take this timezone
+                'expectedoutput' => 'Saturday, 1 January 2011, 08:00 AM'
+            )
+        );
+
+        //Check if forcetimezone is set then save it and set it to use user timezone
+        $cfgforcetimezone = null;
+        if (isset($CFG->forcetimezone)) {
+            $cfgforcetimezone = $CFG->forcetimezone;
+            $CFG->forcetimezone = 99; //get user default timezone.
+        }
+        //store user default timezone to restore later
+        $userstimezone = $USER->timezone;
+
+        // The string version of date comes from server locale setting and does
+        // not respect user language, so it is necessary to reset that.
+        $oldlocale = setlocale(LC_TIME, '0');
+        setlocale(LC_TIME, 'en_AU.UTF-8');
+
+        //get instance of textlib for strtolower
+        $textlib = textlib_get_instance();
+        foreach ($testvalues as $vals) {
+            $USER->timezone = $vals['usertimezone'];
+            $actualoutput = userdate($vals['time'], '%A, %d %B %Y, %I:%M %p', $vals['timezone']);
+
+            //On different systems case of AM PM changes so compare case insenitive
+            $vals['expectedoutput'] = $textlib->strtolower($vals['expectedoutput']);
+            $actualoutput = $textlib->strtolower($actualoutput);
+
+            $this->assertEqual($vals['expectedoutput'], $actualoutput,
+                "Expected: {$vals['expectedoutput']} => Actual: {$actualoutput},
+                Please check if timezones are updated (Site adminstration -> location -> update timezone)");
+        }
+
+        //restore user timezone back to what it was
+        $USER->timezone = $userstimezone;
+
+        //restore forcetimezone
+        if (!is_null($cfgforcetimezone)) {
+            $CFG->forcetimezone = $cfgforcetimezone;
+        }
+
+        //restore system default values.
+        setlocale(LC_TIME, $oldlocale);
+    }
+
+    public function test_make_timestamp() {
+        global $USER, $CFG;
+
+        $testvalues = array(
+            array(
+                'usertimezone' => 'America/Moncton',
+                'year' => '2011',
+                'month' => '7',
+                'day' => '1',
+                'hour' => '10',
+                'minutes' => '00',
+                'seconds' => '00',
+                'timezone' => '0.0', //no dst offset
+                'applydst' => false,
+                'expectedoutput' => '1309528800'
+            ),
+            array(
+                'usertimezone' => 'America/Moncton',
+                'year' => '2011',
+                'month' => '7',
+                'day' => '1',
+                'hour' => '10',
+                'minutes' => '00',
+                'seconds' => '00',
+                'timezone' => '99', //user default timezone
+                'applydst' => false, //don't apply dst
+                'expectedoutput' => '1309528800'
+            ),
+            array(
+                'usertimezone' => 'America/Moncton',
+                'year' => '2011',
+                'month' => '7',
+                'day' => '1',
+                'hour' => '10',
+                'minutes' => '00',
+                'seconds' => '00',
+                'timezone' => '99', //user default timezone
+                'applydst' => true, //apply dst
+                'expectedoutput' => '1309525200'
+            ),
+            array(
+                'usertimezone' => 'America/Moncton',
+                'year' => '2011',
+                'month' => '7',
+                'day' => '1',
+                'hour' => '10',
+                'minutes' => '00',
+                'seconds' => '00',
+                'timezone' => 'America/Moncton', //string timezone
+                'applydst' => true, //apply dst
+                'expectedoutput' => '1309525200'
+            ),
+            array(
+                'usertimezone' => '2',//no dst applyed
+                'year' => '2011',
+                'month' => '7',
+                'day' => '1',
+                'hour' => '10',
+                'minutes' => '00',
+                'seconds' => '00',
+                'timezone' => '99', //take user timezone
+                'applydst' => true, //apply dst
+                'expectedoutput' => '1309507200'
+            ),
+            array(
+                'usertimezone' => '-2',//no dst applyed
+                'year' => '2011',
+                'month' => '7',
+                'day' => '1',
+                'hour' => '10',
+                'minutes' => '00',
+                'seconds' => '00',
+                'timezone' => '99', //take usertimezone
+                'applydst' => true, //apply dst
+                'expectedoutput' => '1309521600'
+            ),
+            array(
+                'usertimezone' => '-10',//no dst applyed
+                'year' => '2011',
+                'month' => '7',
+                'day' => '1',
+                'hour' => '10',
+                'minutes' => '00',
+                'seconds' => '00',
+                'timezone' => '2', //take this timezone
+                'applydst' => true, //apply dst
+                'expectedoutput' => '1309507200'
+            ),
+            array(
+                'usertimezone' => '-10',//no dst applyed
+                'year' => '2011',
+                'month' => '7',
+                'day' => '1',
+                'hour' => '10',
+                'minutes' => '00',
+                'seconds' => '00',
+                'timezone' => '-2', //take this timezone
+                'applydst' => true, //apply dst,
+                'expectedoutput' => '1309521600'
+            )
+        );
+
+        //Check if forcetimezone is set then save it and set it to use user timezone
+        $cfgforcetimezone = null;
+        if (isset($CFG->forcetimezone)) {
+            $cfgforcetimezone = $CFG->forcetimezone;
+            $CFG->forcetimezone = 99; //get user default timezone.
+        }
+
+        //store user default timezone to restore later
+        $userstimezone = $USER->timezone;
+
+        // The string version of date comes from server locale setting and does
+        // not respect user language, so it is necessary to reset that.
+        $oldlocale = setlocale(LC_TIME, '0');
+        setlocale(LC_TIME, 'en_AU.UTF-8');
+
+        //get instance of textlib for strtolower
+        $textlib = textlib_get_instance();
+        //Test make_timestamp with all testvals and assert if anything wrong.
+        foreach ($testvalues as $vals) {
+            $USER->timezone = $vals['usertimezone'];
+            $actualoutput = make_timestamp(
+                    $vals['year'],
+                    $vals['month'],
+                    $vals['day'],
+                    $vals['hour'],
+                    $vals['minutes'],
+                    $vals['seconds'],
+                    $vals['timezone'],
+                    $vals['applydst']
+                    );
+
+            //On different systems case of AM PM changes so compare case insenitive
+            $vals['expectedoutput'] = $textlib->strtolower($vals['expectedoutput']);
+            $actualoutput = $textlib->strtolower($actualoutput);
+
+            $this->assertEqual($vals['expectedoutput'], $actualoutput,
+                "Expected: {$vals['expectedoutput']} => Actual: {$actualoutput},
+                Please check if timezones are updated (Site adminstration -> location -> update timezone)");
+        }
+
+        //restore user timezone back to what it was
+        $USER->timezone = $userstimezone;
+
+        //restore forcetimezone
+        if (!is_null($cfgforcetimezone)) {
+            $CFG->forcetimezone = $cfgforcetimezone;
+        }
+
+        //restore system default values.
+        setlocale(LC_TIME, $oldlocale);
+    }
 }
-?>
+?>
@@ -251,5 +251,9 @@ END;
        $long = "Here is a long string, more than 75 characters long, since by default html_to_text wraps text at 75 chars.";
        $this->assertEqual($long, html_to_text($long, 0));
    }
+
+    public function test_html_to_text_dont_screw_up_utf8() {
+        $this->assertEqual("\n\nAll the WORLD’S a stage.", html_to_text('<p>All the <strong>world’s</strong> a stage.</p>'));
+    }
 }
 ?>
@@ -216,33 +216,41 @@ function get_referer($stripquery=true) {
 *
 * @return string
 */
- function me() {
-
+function me() {
    if (!empty($_SERVER['REQUEST_URI'])) {
-        return $_SERVER['REQUEST_URI'];
+        $return = $_SERVER['REQUEST_URI'];

    } else if (!empty($_SERVER['PHP_SELF'])) {
        if (!empty($_SERVER['QUERY_STRING'])) {
-            return $_SERVER['PHP_SELF'] .'?'. $_SERVER['QUERY_STRING'];
+            $return = $_SERVER['PHP_SELF'] .'?'. $_SERVER['QUERY_STRING'];
+        } else {
+            $return = $_SERVER['PHP_SELF'];
        }
-        return $_SERVER['PHP_SELF'];

    } else if (!empty($_SERVER['SCRIPT_NAME'])) {
        if (!empty($_SERVER['QUERY_STRING'])) {
-            return $_SERVER['SCRIPT_NAME'] .'?'. $_SERVER['QUERY_STRING'];
+            $return = $_SERVER['SCRIPT_NAME'] .'?'. $_SERVER['QUERY_STRING'];
+        } else {
+            $return = $_SERVER['SCRIPT_NAME'];
        }
-        return $_SERVER['SCRIPT_NAME'];

    } else if (!empty($_SERVER['URL'])) {     // May help IIS (not well tested)
        if (!empty($_SERVER['QUERY_STRING'])) {
-            return $_SERVER['URL'] .'?'. $_SERVER['QUERY_STRING'];
+            $return = $_SERVER['URL'] .'?'. $_SERVER['QUERY_STRING'];
+        } else {
+            $return = $_SERVER['URL'];
        }
-        return $_SERVER['URL'];

    } else {
        notify('Warning: Could not find any of these web server variables: $REQUEST_URI, $PHP_SELF, $SCRIPT_NAME or $URL');
        return false;
    }
+
+    // sanitize the url a bit more, the encoding style may be different in vars above
+    $return = str_replace('"', '%22', $return);
+    $return = str_replace('\'', '%27', $return);
+
+    return $return;
 }

 /**
@@ -1502,7 +1510,7 @@ function format_text($text, $format=FORMAT_MOODLE, $options=NULL, $courseid=NULL

    static $croncache = array();

-    if ($text === '') {
+    if ($text === '' || is_null($text)) {
        return ''; // no need to do any filters and cleaning
    }

@@ -2757,9 +2765,9 @@ function print_header ($title='', $heading='', $navigation='', $focus='',

    $pageclass .= ' dir-'.get_string('thisdirection');

-    $pageclass .= ' lang-'.$currentlanguage;
+    $pageclass .= ' lang-'.s($currentlanguage);

-    $bodytags .= ' class="'.$pageclass.'" id="'.$pageid.'"';
+    $bodytags .= ' class="'.s($pageclass).'" id="'.s($pageid).'"';

    ob_start();
    include($CFG->header);
@@ -5833,12 +5841,20 @@ function print_error($errorcode, $module='error', $link='', $a=NULL, $extralocat
        }
    }

+    // when printing an error the continue button should never link offsite
+    if (stripos($link, $CFG->wwwroot) === false &&
+        stripos($link, $CFG->httpswwwroot) === false) {
+        $link = $CFG->wwwroot.'/';
+    }
+
    if (!empty($CFG->errordocroot)) {
-        $errordocroot = $CFG->errordocroot;
-    } else if (!empty($CFG->docroot)) {
-        $errordocroot = $CFG->docroot;
+        $errordoclink = $CFG->errordocroot.'/en';
    } else {
-        $errordocroot = 'http://docs.moodle.org';
+        $errordoclink = get_doc_root();
+        if (is_null($errordoclink)) {
+            $lang = current_language();
+            $errordoclink = 'http://docs.moodle.org/19/'.$lang; //no doc links set. point to default.
+        }
    }

    if (defined('FULLME') && FULLME == 'cron') {
@@ -5855,7 +5871,7 @@ function print_error($errorcode, $module='error', $link='', $a=NULL, $extralocat

    $message = clean_text('<p class="errormessage">'.$message.'</p>'.
               '<p class="errorcode">'.
-               '<a href="'.$errordocroot.'/en/error/'.$modulelink.'/'.$errorcode.'">'.
+               '<a href="'.$errordoclink.'/error/'.$modulelink.'/'.$errorcode.'">'.
                 get_string('moreinformation').'</a></p>');

    if (! defined('HEADER_PRINTED')) {
@@ -6949,18 +6965,16 @@ function page_doc_link($text='', $iconpath='') {
 function doc_link($path='', $text='', $iconpath='') {
    global $CFG;

-    if (empty($CFG->docroot)) {
-        return '';
-    }
-
    $target = '';
    if (!empty($CFG->doctonewwindow)) {
        $target = ' target="_blank"';
    }

-    $lang = str_replace('_utf8', '', current_language());
+    if (is_null($docroot = get_doc_root())) {
+        return '';
+    }

-    $str = '<a href="' .$CFG->docroot. '/' .$lang. '/' .$path. '"' .$target. '>';
+    $str = '<a href="' .$docroot. '/' .$path. '"' .$target. '>';

    if (empty($iconpath)) {
        $iconpath = $CFG->httpswwwroot . '/pix/docs.gif';
@@ -6972,6 +6986,32 @@ function doc_link($path='', $text='', $iconpath='') {
    return $str;
 }

+/**
+ * A function that checks if docroot is set, builds and returns the docs root url according to version release.
+ * @return string documentation url, null if doc root isn't set (ie:during installation perhaps).
+ */
+function get_doc_root() {
+    global $CFG;
+
+    if (empty($CFG->docroot)) {
+        return null;
+    }
+
+    $lang = str_replace('_utf8', '', current_language());
+    if (!empty($CFG->release)) {
+        $release = $CFG->release;
+    } else {
+        //derive branch from the first three letters of version.php's $release with the period taken out.($CFG->release isn't populated yet during upgrade)
+        include($CFG->dirroot.'/version.php');
+    }
+    if (preg_match('/^(.)\.(.)/', $release, $matches)) {
+        $branch = $matches[1].$matches[2];
+    } else {
+        $branch = '.';
+    }
+
+    return $CFG->docroot. '/' .$branch. '/' .$lang;
+}

 /**
 * Returns true if the current site debugging settings are equal or above specified level.
@@ -179,7 +179,7 @@ httpsrequired();
                $urltogo = $CFG->wwwroot.'/user/edit.php';
                // We don't delete $SESSION->wantsurl yet, so we get there later

-            } else if (isset($SESSION->wantsurl) and (strpos($SESSION->wantsurl, $CFG->wwwroot) === 0)) {
+            } else if (isset($SESSION->wantsurl) and (strpos($SESSION->wantsurl, $CFG->wwwroot) === 0 or strpos($SESSION->wantsurl, str_replace('http://', 'https://', $CFG->wwwroot)) === 0)) {
                $urltogo = $SESSION->wantsurl;    /// Because it's an address in this site
                unset($SESSION->wantsurl);

@@ -149,7 +149,7 @@ class mnet_xmlrpc_client {
            // Find methods that we subscribe to on this host
            $sql = "
                SELECT
-                    *
+                    r.id
                FROM
                    {$CFG->prefix}mnet_rpc r,
                    {$CFG->prefix}mnet_service2rpc s2r,
@@ -161,8 +161,7 @@ class mnet_xmlrpc_client {
                    h2s.subscribe = '1' AND
                    h2s.hostid in ({$id_list})";

-            $permission = get_record_sql($sql);
-            if ($permission == false) {
+            if (!record_exists_sql($sql)) {
                global $USER;
                $this->error[] = '7:User with ID '. $USER->id .
                                 ' attempted to call unauthorised method '.
@@ -333,6 +332,14 @@ class mnet_xmlrpc_client {
                $this->error[] = $this->response['faultCode'] . " : " . $this->response['faultString'];
            }
        }
+
+        // ok, it's signed, but is it signed with the right certificate ?
+        // do this *after* we check for an out of date key
+        if (!openssl_verify($this->xmlrpcresponse, base64_decode($sig_parser->signature), 
+                $mnet_peer->public_key)) {
+            $this->error[] = 'Invalid signature';
+        }
+
        return empty($this->error);
    }
 }
@@ -838,8 +838,7 @@ class assignment_base {
        if ($users) {
            $select = 'SELECT u.id, u.firstname, u.lastname, u.picture, u.imagealt,
                              s.id AS submissionid, s.grade, s.submissioncomment,
-                              s.timemodified, s.timemarked,
-                              COALESCE(SIGN(SIGN(s.timemarked) + SIGN(s.timemarked - s.timemodified)), 0) AS status ';
+                              s.timemodified, s.timemarked ';
            $sql = 'FROM '.$CFG->prefix.'user u '.
                   'LEFT JOIN '.$CFG->prefix.'assignment_submissions s ON u.id = s.userid
                                                                      AND s.assignment = '.$this->assignment->id.' '.
@@ -1167,8 +1166,7 @@ class assignment_base {

        $select = 'SELECT u.id, u.firstname, u.lastname, u.picture, u.imagealt,
                          s.id AS submissionid, s.grade, s.submissioncomment,
-                          s.timemodified, s.timemarked,
-                          COALESCE(SIGN(SIGN(s.timemarked) + SIGN(s.timemarked - s.timemodified)), 0) AS status ';
+                          s.timemodified, s.timemarked ';
        $sql = 'FROM '.$CFG->prefix.'user u '.
               'LEFT JOIN '.$CFG->prefix.'assignment_submissions s ON u.id = s.userid
                                                                  AND s.assignment = '.$this->assignment->id.' '.
@@ -591,7 +591,7 @@ class assignment_upload extends assignment_base {
        require_once($CFG->dirroot.'/lib/uploadlib.php');
        $um = new upload_manager('newfile',false,true,$this->course,false,$this->assignment->maxbytes,true);

-        if ($um->process_file_uploads($dir)) {
+        if ($um->process_file_uploads($dir) and confirm_sesskey()) {
            $submission = $this->get_submission($USER->id, true); //create new submission if needed
            $updated = new object();
            $updated->id           = $submission->id;
@@ -113,17 +113,18 @@ class data_field_checkbox extends data_field_base {
        }
        return array('checked'=>$selected, 'allrequired'=>$allrequired);
    }
-    
+
    function generate_sql($tablealias, $value) {
        $allrequired = $value['allrequired'];
        $selected    = $value['checked'];
+        $varcharcontent = sql_compare_text("{$tablealias}.content", 255);

        if ($selected) {
            $conditions = array();
            foreach ($selected as $sel) {
                $likesel = str_replace('%', '\%', $sel);
                $likeselsel = str_replace('_', '\_', $likesel);
-                $conditions[] = "({$tablealias}.fieldid = {$this->field->id} AND ({$tablealias}.content = '$sel'
+                $conditions[] = "({$tablealias}.fieldid = {$this->field->id} AND ($varcharcontent = '$sel'
                                                                               OR {$tablealias}.content LIKE '$likesel##%'
                                                                               OR {$tablealias}.content LIKE '%##$likesel'
                                                                               OR {$tablealias}.content LIKE '%##$likesel##%'))";
@@ -138,7 +139,6 @@ class data_field_checkbox extends data_field_base {
        }
    }

-
    function update_content($recordid, $value, $name='') {
        $content = new object();
        $content->fieldid = $this->field->id;
@@ -111,7 +111,7 @@ class data_field_file extends data_field_base {
            $oldcontent = new object;
            $oldcontent->fieldid = $this->field->id;
            $oldcontent->recordid = $recordid;
-            if ($oldcontent->id = insert_record('data_content', $oldcontent)) {
+            if (!$oldcontent->id = insert_record('data_content', $oldcontent)) {
                error('Could not make an empty record!');
            }
        }
@@ -70,17 +70,19 @@ class data_field_latlong extends data_field_base {

    function display_search_field($value = '') {
        global $CFG;
-        $lats = get_records_sql_menu('SELECT id, content from '.$CFG->prefix.'data_content WHERE fieldid='.$this->field->id.' GROUP BY content ORDER BY content');
-        $longs = get_records_sql_menu('SELECT id, content1 from '.$CFG->prefix.'data_content WHERE fieldid='.$this->field->id.' GROUP BY content ORDER BY content');
+        $varcharlat = sql_compare_text('content');
+        $varcharlong= sql_compare_text('content1');
+        $latlongsrs = get_recordset_sql(
+            "SELECT DISTINCT $varcharlat AS la, $varcharlong AS lo
+              FROM {$CFG->prefix}data_content
+             WHERE fieldid = {$this->field->id}
+             ORDER BY $varcharlat, $varcharlong");
        $options = array();
-        if(!empty($lats) && !empty($longs)) {
-            $options[''] = '';
-            // Make first index blank.
-            foreach($lats as $key => $temp) {
-                $options[$temp.','.$longs[$key]] = $temp.','.$longs[$key];
-            }
+        while ($latlong = rs_fetch_next_record($latlongsrs)) {
+            $options[$latlong->la . ',' . $latlong->lo] = $latlong->la . ',' . $latlong->lo;
        }
-       return choose_from_menu($options, 'f_'.$this->field->id, $value, 'choose', '', 0, true);
+        rs_close($latlongsrs);
+        return choose_from_menu($options, 'f_'.$this->field->id, $value, 'choose', '', 0, true);
    }

    function parse_search_field() {
@@ -91,7 +93,9 @@ class data_field_latlong extends data_field_base {
        $latlong[0] = '';
        $latlong[1] = '';
        $latlong = explode (',', $value, 2);
-        return " ({$tablealias}.fieldid = {$this->field->id} AND {$tablealias}.content = '$latlong[0]' AND {$tablealias}.content1 = '$latlong[1]') ";
+        $varcharlat = sql_compare_text("{$tablealias}.content");
+        $varcharlong= sql_compare_text("{$tablealias}.content1");
+        return " ({$tablealias}.fieldid = {$this->field->id} AND $varcharlat = '$latlong[0]' AND $varcharlong = '$latlong[1]') ";
    }

    function display_browse_field($recordid, $template) {
@@ -29,7 +29,7 @@
            <option value="-2"<?php if($this->field->param2==-2) echo ' selected="selected"' ?>><?php echo get_string('latitude', 'data').'/'.get_string('longitude', 'data') ?></option>
            <?php
                // Fetch all "suitable" other fields that exist for this database
-                $textfields = get_records_select('data_fields', 'dataid='.$this->data->id.' AND type="text"');
+                $textfields = get_records_select('data_fields', 'dataid='.$this->data->id." AND type='text'");
                echo '<optgroup label="'.get_string('latlongotherfields', 'data').':">';
                if(sizeof($textfields)>0) {
                    foreach($textfields as $textfield) {
@@ -56,14 +56,16 @@ class data_field_menu extends data_field_base {

        return $str;
    }
-    
+
    function display_search_field($content = '') {
        global $CFG;

-        $usedoptions = array();
-        $sql = "SELECT DISTINCT content
+        $varcharcontent = sql_compare_text('content', 255);
+        $sql = "SELECT DISTINCT $varcharcontent AS content
                  FROM {$CFG->prefix}data_content
                 WHERE fieldid={$this->field->id} AND content IS NOT NULL";
+
+        $usedoptions = array();
        if ($used = get_records_sql($sql)) {
            foreach ($used as $data) {
                $value = $data->content;
@@ -87,7 +89,7 @@ class data_field_menu extends data_field_base {
            return '';
        }

-        return choose_from_menu($options, 'f_'.$this->field->id, stripslashes($content), '&nbsp;', '', 0, true);    
+        return choose_from_menu($options, 'f_'.$this->field->id, stripslashes($content), 'choose', '', 0, true);
    }

     function parse_search_field() {
@@ -95,7 +97,8 @@ class data_field_menu extends data_field_base {
     }

    function generate_sql($tablealias, $value) {
-        return " ({$tablealias}.fieldid = {$this->field->id} AND {$tablealias}.content = '$value') "; 
+        $varcharcontent = sql_compare_text("{$tablealias}.content", 255);
+        return " ({$tablealias}.fieldid = {$this->field->id} AND $varcharcontent = '$value') ";
    }

 }
@@ -78,10 +78,12 @@ class data_field_multimenu extends data_field_base {
        $str = '<select name="f_'.$this->field->id.'[]" multiple="multiple">';

        // display only used options
-        $usedoptions = array();
-        $sql = "SELECT DISTINCT content
+        $varcharcontent = sql_compare_text('content', 255);
+        $sql = "SELECT DISTINCT $varcharcontent AS content
                  FROM {$CFG->prefix}data_content
                 WHERE fieldid={$this->field->id} AND content IS NOT NULL";
+
+        $usedoptions = array();
        if ($used = get_records_sql($sql)) {
            foreach ($used as $data) {
                $valuestr = $data->content;
@@ -138,13 +140,14 @@ class data_field_multimenu extends data_field_base {
    function generate_sql($tablealias, $value) {
        $allrequired = $value['allrequired'];
        $selected    = $value['selected'];
+        $varcharcontent = sql_compare_text("{$tablealias}.content", 255);

        if ($selected) {
            $conditions = array();
            foreach ($selected as $sel) {
                $likesel = str_replace('%', '\%', $sel);
                $likeselsel = str_replace('_', '\_', $likesel);
-                $conditions[] = "({$tablealias}.fieldid = {$this->field->id} AND ({$tablealias}.content = '$sel'
+                $conditions[] = "({$tablealias}.fieldid = {$this->field->id} AND ($varcharcontent = '$sel'
                                                                               OR {$tablealias}.content LIKE '$likesel##%'
                                                                               OR {$tablealias}.content LIKE '%##$likesel'
                                                                               OR {$tablealias}.content LIKE '%##$likesel##%'))";
@@ -76,10 +76,10 @@ class data_field_number extends data_field_base {
    function parse_search_field() {
        return optional_param('f_'.$this->field->id, '', PARAM_NOTAGS);
    }
-    
-    // need to cast?
+
    function generate_sql($tablealias, $value) {
-        return " ({$tablealias}.fieldid = {$this->field->id} AND {$tablealias}.content = '$value') ";
+        $varcharcontent = sql_compare_text("{$tablealias}.content");
+        return " ({$tablealias}.fieldid = {$this->field->id} AND $varcharcontent = '$value') ";
    }

    function get_sort_sql($fieldname) {
@@ -66,15 +66,21 @@ class data_field_radiobutton extends data_field_base {
        $str .= '</div>';
        return $str;
    }
-    
+
     function display_search_field($value = '') {
        global $CFG;
-        $temp = get_records_sql_menu('SELECT id, content from '.$CFG->prefix.'data_content WHERE fieldid='.$this->field->id.' GROUP BY content ORDER BY content');
+
+        $varcharcontent = sql_compare_text('content', 255);
+        $used = get_records_sql(
+            "SELECT DISTINCT $varcharcontent AS content
+               FROM {$CFG->prefix}data_content
+              WHERE fieldid={$this->field->id}
+             ORDER BY $varcharcontent");
+
        $options = array();
-        if(!empty($temp)) {
-            $options[''] = '';              //Make first index blank.
-            foreach ($temp as $key) {
-                $options[$key] = $key;  //Build following indicies from the sql.
+        if(!empty($used)) {
+            foreach ($used as $rec) {
+                $options[$rec->content] = $rec->content;  //Build following indicies from the sql.
            }
        }
        return choose_from_menu($options, 'f_'.$this->field->id, $value, 'choose', '', 0, true);
@@ -83,9 +89,10 @@ class data_field_radiobutton extends data_field_base {
    function parse_search_field() {
        return optional_param('f_'.$this->field->id, '', PARAM_NOTAGS);
    }
-    
+
    function generate_sql($tablealias, $value) {
-        return " ({$tablealias}.fieldid = {$this->field->id} AND {$tablealias}.content = '$value') "; 
+        $varcharcontent = sql_compare_text("{$tablealias}.content", 255);
+        return " ({$tablealias}.fieldid = {$this->field->id} AND $varcharcontent = '$value') ";
    }

 }
@@ -29,19 +29,19 @@ class data_field_text extends data_field_base {
    function data_field_text($field=0, $data=0) {
        parent::data_field_base($field, $data);
    }
-    
+
    function display_search_field($value = '') {
-        return '<input type="text" size="16" name="f_'.$this->field->id.'" value="'.$value.'" />';   
+        return '<input type="text" size="16" name="f_'.$this->field->id.'" value="'.$value.'" />';
    }
-    
+
    function parse_search_field() {
        return optional_param('f_'.$this->field->id, '', PARAM_NOTAGS);
    }
-    
+
    function generate_sql($tablealias, $value) {
-        return " ({$tablealias}.fieldid = {$this->field->id} AND {$tablealias}.content LIKE '%{$value}%') "; 
+        return " ({$tablealias}.fieldid = {$this->field->id} AND {$tablealias}.content LIKE '%{$value}%') ";
    }
-    
+
 }

 ?>
@@ -68,20 +68,20 @@ class data_field_textarea extends data_field_base {
        $str .= '</div>';
        return $str;
    }
-    
-    
+
+
    function display_search_field($value = '') {
-        return '<input type="text" size="16" name="f_'.$this->field->id.'" value="'.$value.'" />';   
+        return '<input type="text" size="16" name="f_'.$this->field->id.'" value="'.$value.'" />';
    }
-    
+
    function parse_search_field() {
        return optional_param('f_'.$this->field->id, '', PARAM_NOTAGS);
    }
-    
+
    function generate_sql($tablealias, $value) {
-        return " ({$tablealias}.fieldid = {$this->field->id} AND {$tablealias}.content LIKE '%{$value}%') "; 
+        return " ({$tablealias}.fieldid = {$this->field->id} AND {$tablealias}.content LIKE '%{$value}%') ";
    }
-    
+
    function gen_textarea($usehtmleditor, $text='') {
        // MDL-16018: Don't print htmlarea with < 7 lines height, causes visualization problem
        $text = clean_text($text);
@@ -729,7 +729,15 @@ function data_user_outline($course, $user, $mod, $data) {
    } else if ($grade) {
        $result = new object();
        $result->info = get_string('grade') . ': ' . $grade->str_long_grade;
-        $result->time = $grade->dategraded;
+
+        //datesubmitted == time created. dategraded == time modified or time overridden
+        //if grade was last modified by the user themselves use date graded. Otherwise use date submitted
+        if ($grade->usermodified == $user->id || empty($grade->datesubmitted)) {
+            $result->time = $grade->dategraded;
+        } else {
+            $result->time = $grade->datesubmitted;
+        }
+
        return $result;
    }
    return NULL;
@@ -504,10 +504,10 @@

            } else {

-                $sortcontent = $sortfield->get_sort_field();
-                $sortcontentfull = $sortfield->get_sort_sql('c.'.$sortcontent);
+                $sortcontent = sql_compare_text('c.' . $sortfield->get_sort_field());
+                $sortcontentfull = $sortfield->get_sort_sql($sortcontent);

-                $what = ' DISTINCT r.id, r.approved, r.timecreated, r.timemodified, r.userid, u.firstname, u.lastname, '.sql_compare_text($sortcontentfull).' AS _order ';
+                $what = ' DISTINCT r.id, r.approved, r.timecreated, r.timemodified, r.userid, u.firstname, u.lastname, '.$sortcontentfull.' AS _order ';
                $count = ' COUNT(DISTINCT c.recordid) ';
                $tables = $CFG->prefix.'data_content c,'.$CFG->prefix.'data_records r,'.$CFG->prefix.'data_content cs, '.$CFG->prefix.'user u ';
                $where =  'WHERE c.recordid = r.id
@@ -545,7 +545,6 @@
            $fromsql    = "FROM $tables $advtables $where $advwhere $groupselect $approveselect $searchselect $advsearchselect";
            $sqlselect  = "SELECT $what $fromsql $sortorder";
            $sqlcount   = "SELECT $count $fromsql";   // Total number of records when searching
-            $sqlrids    = "SELECT tmp.id FROM ($sqlselect) tmp";
            $sqlmax     = "SELECT $count FROM $tables $where $groupselect $approveselect"; // number of all recoirds user may see

        /// Work out the paging numbers and counts
@@ -562,8 +561,8 @@
                $mode = 'single';

                $page = 0;
-                if ($allrecordids = get_records_sql($sqlrids)) {
-                    $allrecordids = array_keys($allrecordids);
+                // TODO: Improve this because we are executing $sqlselect twice (here and some lines below)!
+                if ($allrecordids = get_fieldset_sql($sqlselect)) {
                    $page = (int)array_search($record->id, $allrecordids);
                    unset($allrecordids);
                }
@@ -119,6 +119,7 @@
                                        
    /// Do course wide subscribe/unsubscribe
    if (!is_null($subscribe) and !isguestuser() and !isguest()) {
+        require_sesskey();
        foreach ($modinfo->instances['forum'] as $forumid=>$cm) {
            $forum = $forums[$forumid];
            $modcontext = get_context_instance(CONTEXT_MODULE, $cm->id); 
@@ -387,9 +388,9 @@
    if (!isguest()) {
        print_box_start('subscription');
        echo '<span class="helplink">';
-        echo '<a href="index.php?id='.$course->id.'&amp;subscribe=1">'.get_string('allsubscribe', 'forum').'</a>';
+        echo '<a href="index.php?id='.$course->id.'&amp;subscribe=1&amp;sesskey='.sesskey().'">'.get_string('allsubscribe', 'forum').'</a>';
        echo '</span><br /><span class="helplink">';
-        echo '<a href="index.php?id='.$course->id.'&amp;subscribe=0">'.get_string('allunsubscribe', 'forum').'</a>';
+        echo '<a href="index.php?id='.$course->id.'&amp;subscribe=0&amp;sesskey='.sesskey().'">'.get_string('allunsubscribe', 'forum').'</a>';
        echo '</span>';
        print_box_end();
        print_box('&nbsp;', 'clearer');
@@ -380,6 +380,12 @@ function forum_cron() {
                    continue;
                }

+                // Don't send email if the forum is Q&A and the user has not posted
+                if ($forum->type == 'qanda' && !forum_get_user_posted_time($discussion->id, $userto->id)) {
+                    mtrace('Did not email '.$userto->id.' because user has not posted in discussion');
+                    continue;
+                }
+
                // Get info about the sending user
                if (array_key_exists($post->userid, $users)) { // we might know him/her already
                    $userfrom = $users[$post->userid];
@@ -970,7 +976,15 @@ function forum_user_outline($course, $user, $mod, $forum) {
    } else if ($grade) {
        $result = new object();
        $result->info = get_string('grade') . ': ' . $grade->str_long_grade;
-        $result->time = $grade->dategraded;
+
+        //datesubmitted == time created. dategraded == time modified or time overridden
+        //if grade was last modified by the user themselves use date graded. Otherwise use date submitted
+        if ($grade->usermodified == $user->id || empty($grade->datesubmitted)) {
+            $result->time = $grade->dategraded;
+        } else {
+            $result->time = $grade->datesubmitted;
+        }
+
        return $result;
    }
    return NULL;
@@ -4299,6 +4313,7 @@ function forum_get_subscribe_link($forum, $context, $messages = array(), $cantac
            $backtoindexlink = '';
        }
        $link = '';
+        $sesskeylink = '&amp;sesskey='.sesskey();

        if ($fakelink) {
            $link .= <<<EOD
@@ -4306,14 +4321,15 @@ function forum_get_subscribe_link($forum, $context, $messages = array(), $cantac
 //<![CDATA[
 var subs_link = document.getElementById("subscriptionlink");
 if(subs_link){
-    subs_link.innerHTML = "<a title=\"$linktitle\" href='$CFG->wwwroot/mod/forum/subscribe.php?id={$forum->id}{$backtoindexlink}'>$linktext<\/a>";
+    subs_link.innerHTML = "<a title=\"$linktitle\" href='$CFG->wwwroot/mod/forum/subscribe.php?id={$forum->id}{$backtoindexlink}{$sesskeylink}'>$linktext<\/a>";
 }
 //]]>
 </script>
 <noscript>
 EOD;
        }
-        $options ['id'] = $forum->id;
+        $options['id'] = $forum->id;
+        $options['sesskey'] = sesskey();
        $link .= print_single_button($CFG->wwwroot . '/mod/forum/subscribe.php',
                $options, $linktext, 'post', '_self', true, $linktitle);
        if ($fakelink) {
@@ -4634,7 +4650,7 @@ function forum_user_can_see_discussion($forum, $discussion, $context, $user=NULL
 *
 */
 function forum_user_can_see_post($forum, $discussion, $post, $user=NULL, $cm=NULL) {
-    global $USER;
+    global $CFG, $USER;

    // retrieve objects (yuk)
    if (is_numeric($forum)) {
@@ -4695,9 +4711,10 @@ function forum_user_can_see_post($forum, $discussion, $post, $user=NULL, $cm=NUL
    if ($forum->type == 'qanda') {
        $firstpost = forum_get_firstpost_from_discussion($discussion->id);
        $modcontext = get_context_instance(CONTEXT_MODULE, $cm->id);
+        $userfirstpost = forum_get_user_posted_time($discussion->id, $user->id);

-        return (forum_user_has_posted($forum->id,$discussion->id,$user->id) ||
-                $firstpost->id == $post->id ||
+        return (($userfirstpost !== false && (time() - $userfirstpost >= $CFG->maxeditingtime)) ||
+                $firstpost->id == $post->id || $post->userid == $user->id || $firstpost->userid == $user->id ||
                has_capability('mod/forum:viewqandawithoutposting', $modcontext, $user->id, false));
    }
    return true;
@@ -6935,4 +6952,21 @@ function forum_get_extra_capabilities() {
    return array('moodle/site:accessallgroups', 'moodle/site:viewfullnames', 'moodle/site:trustcontent');
 }

+/**
+ * Returns creation time of the first user's post in given discussion
+ * @global object $DB
+ * @param int $did Discussion id
+ * @param int $userid User id
+ * @return int|bool post creation time stamp or return false
+ */
+function forum_get_user_posted_time($did, $userid) {
+    global $CFG;
+
+    $posttime = get_field('forum_posts', 'MIN(created)', 'userid', $userid, 'discussion', $did);
+    if (empty($posttime)) {
+        return false;
+    }
+    return $posttime;
+}
+
 ?>
@@ -385,15 +385,12 @@
            $read->firstread = backup_todb($rea_info['#']['FIRSTREAD']['0']['#']);
            $read->lastread = backup_todb($rea_info['#']['LASTREAD']['0']['#']);

-            //Some recoding and check are performed now
-            $toinsert = true;
-
            //We have to recode the userid field
            $user = backup_getid($restore->backup_unique_code,"user",$read->userid);
            if ($user) {
                $read->userid = $user->new_id;
            } else {
-                $toinsert = false;
+                continue; // Skip this forum_read record
            }

            //We have to recode the discussionid field
@@ -401,7 +398,7 @@
            if ($discussion) {
                $read->discussionid = $discussion->new_id;
            } else {
-                $toinsert = false;
+                continue; // Skip this forum_read record
            }

            //We have to recode the postid field
@@ -409,14 +406,12 @@
            if ($post) {
                $read->postid = $post->new_id;
            } else {
-                $toinsert = false;
+                continue; // Skip this forum_read record
            }

-            //The structure is equal to the db, so insert the forum_read
+            // Arrived here, the structure is equal to the db, so insert the forum_read
            $newid = 0;
-            if ($toinsert) {
-                $newid = insert_record ("forum_read",$read);
-            }
+            $newid = insert_record ("forum_read",$read);

            //Do some output
            if (($i+1) % 50 == 0) {
@@ -1,4 +1,4 @@
-<?php // $Id$
+<?php

 //  Subscribe to or unsubscribe from a forum.

@@ -8,6 +8,7 @@
    $id = required_param('id',PARAM_INT);      // The forum to subscribe or unsubscribe to
    $force = optional_param('force','',PARAM_ALPHA);  // Force everyone to be subscribed to this forum?
    $user = optional_param('user',0,PARAM_INT);
+    $sesskey = optional_param('sesskey', null, PARAM_RAW);

    if (! $forum = get_record("forum", "id", $id)) {
        error("Forum ID was incorrect");
@@ -25,6 +26,7 @@
    }

    if ($user) {
+        require_sesskey();
        if (!has_capability('mod/forum:managesubscriptions', $context)) {
            error('You do not have the permission to subscribe/unsubscribe other people!');
        }
@@ -65,6 +67,7 @@
        : "view.php?f=$id";

    if ($force and has_capability('mod/forum:managesubscriptions', $context)) {
+        require_sesskey();
        if (forum_is_forcesubscribed($forum)) {
            forum_forcesubscribe($forum->id, 0);
            redirect($returnto, get_string("everyonecannowchoose", "forum"), 1);
@@ -81,7 +84,20 @@
    $info->name  = fullname($user);
    $info->forum = format_string($forum->name);

+    if ($user->id == $USER->id) {
+        $selflink = 'subscribe.php?id='.$id.'&amp;sesskey='.sesskey();
+    } else {
+        $selflink = 'subscribe.php?id='.$id.'&amp;user='.$user->id.'&amp;sesskey='.sesskey();
+    }
+
    if (forum_is_subscribed($user->id, $forum->id)) {
+        if (is_null($sesskey)) {    // we came here via link in email
+            $navigation = build_navigation('', $cm);
+            print_header($course->shortname, $course->fullname, $navigation, '', '', true, '', navmenu($course, $cm));
+            notice_yesno(get_string('confirmunsubscribe', 'forum', format_string($forum->name)), $selflink, $returnto);
+            print_footer($course);
+            exit;
+        }
        if (forum_unsubscribe($user->id, $forum->id)) {
            add_to_log($course->id, "forum", "unsubscribe", "view.php?f=$forum->id", $forum->id, $cm->id);
            redirect($returnto, get_string("nownotsubscribed", "forum", $info), 1);
@@ -97,6 +113,13 @@
        if (!has_capability('mod/forum:viewdiscussion', $context)) {
            error("Could not subscribe you to that forum", $_SERVER["HTTP_REFERER"]);
        }
+        if (is_null($sesskey)) {    // we came here via link in email
+            $navigation = build_navigation('', $cm);
+            print_header($course->shortname, $course->fullname, $navigation, '', '', true, '', navmenu($course, $cm));
+            notice_yesno(get_string('confirmsubscribe', 'forum', format_string($forum->name)), $selflink, $returnto);
+            print_footer($course);
+            exit;
+        }
        if (forum_subscribe($user->id, $forum->id) ) {
            add_to_log($course->id, "forum", "subscribe", "view.php?f=$forum->id", $forum->id, $cm->id);
            redirect($returnto, get_string("nowsubscribed", "forum", $info), 1);
@@ -120,7 +120,7 @@
    }

 /// Get all the potential subscribers excluding users already subscribed
-    $users = forum_get_potential_subscribers($context, $currentgroup, 'id,email,firstname,lastname', 'firstname ASC, lastname ASC');
+    $users = forum_get_potential_subscribers($context, $currentgroup, 'u.id,u.email,u.firstname,u.lastname', 'u.firstname ASC, u.lastname ASC');
    if (!$users) {
        $users = array();
    }
@@ -131,7 +131,7 @@
            helpbutton("subscription", $strallowchoice, "forum");
            echo '&nbsp;<span class="helplink">';
            if (has_capability('mod/forum:managesubscriptions', $context)) {
-                echo "<a title=\"$strallowchoice\" href=\"subscribe.php?id=$forum->id&amp;force=no\">$strallowchoice</a>";
+                echo "<a title=\"$strallowchoice\" href=\"subscribe.php?id=$forum->id&amp;force=no&amp;sesskey=".sesskey()."\">$strallowchoice</a>";
            } else {
                echo $streveryoneisnowsubscribed;
            }
@@ -150,7 +150,7 @@
            echo '&nbsp;';

            if (has_capability('mod/forum:managesubscriptions', $context)) {
-                echo "<span class=\"helplink\"><a title=\"$strforcesubscribe\" href=\"subscribe.php?id=$forum->id&amp;force=yes\">$strforcesubscribe</a></span>";
+                echo "<span class=\"helplink\"><a title=\"$strforcesubscribe\" href=\"subscribe.php?id=$forum->id&amp;force=yes&amp;sesskey=".sesskey()."\">$strforcesubscribe</a></span>";
            } else {
                echo '<span class="helplink">'.$streveryonecannowchoose.'</span>';
            }
@@ -189,7 +189,15 @@ function glossary_user_outline($course, $user, $mod, $glossary) {
    } else if ($grade) {
        $result = new object();
        $result->info = get_string('grade') . ': ' . $grade->str_long_grade;
-        $result->time = $grade->dategraded;
+
+        //datesubmitted == time created. dategraded == time modified or time overridden
+        //if grade was last modified by the user themselves use date graded. Otherwise use date submitted
+        if ($grade->usermodified == $user->id || empty($grade->datesubmitted)) {
+            $result->time = $grade->dategraded;
+        } else {
+            $result->time = $grade->datesubmitted;
+        }
+
        return $result;
    }

@@ -242,11 +250,14 @@ function glossary_print_recent_activity($course, $viewfullnames, $timestart) {
 /// Return true if there was output, or false is there was none.

    global $CFG, $USER;
-
    //TODO: use timestamp in approved field instead of changing timemodified when approving in 2.0
+    if (!defined('GLOSSARY_RECENT_ACTIVITY_LIMIT')) {
+        define('GLOSSARY_RECENT_ACTIVITY_LIMIT', 50);
+    }

    $modinfo = get_fast_modinfo($course);
    $ids = array();
+
    foreach ($modinfo->cms as $cm) {
        if ($cm->modname != 'glossary') {
            continue;
@@ -254,58 +265,66 @@ function glossary_print_recent_activity($course, $viewfullnames, $timestart) {
        if (!$cm->uservisible) {
            continue;
        }
-        $ids[$cm->instance] = $cm->instance;
+        $ids[$cm->instance] = $cm->id;
    }

    if (!$ids) {
        return false;
    }

-    $glist = implode(',', $ids); // there should not be hundreds of glossaries in one course, right?
-
-    if (!$entries = get_records_sql("SELECT ge.id, ge.concept, ge.approved, ge.timemodified, ge.glossaryid,
-                                            ge.userid, u.firstname, u.lastname, u.email, u.picture
-                                       FROM {$CFG->prefix}glossary_entries ge
-                                            JOIN {$CFG->prefix}user u ON u.id = ge.userid
-                                      WHERE ge.glossaryid IN ($glist) AND ge.timemodified > $timestart
-                                   ORDER BY ge.timemodified ASC")) {
-        return false;
-    }
-
-    $editor  = array();
-
-    foreach ($entries as $entryid=>$entry) {
-        if ($entry->approved) {
-            continue;
-        }
-
-        if (!isset($editor[$entry->glossaryid])) {
-            $editor[$entry->glossaryid] = has_capability('mod/glossary:approve', get_context_instance(CONTEXT_MODULE, $modinfo->instances['glossary'][$entry->glossaryid]->id));
-        }
-
-        if (!$editor[$entry->glossaryid]) {
-            unset($entries[$entryid]);
+    // generate list of approval capabilities for all glossaries in the course.
+    $approvals = array();
+    foreach ($ids as $glinstanceid => $glcmid) {
+        $context = get_context_instance(CONTEXT_MODULE, $glcmid);
+        // get records glossary entries that are approved if user has no capability to approve entries.
+        if (has_capability('mod/glossary:approve', $context)) {
+            $approvals[] = ' ge.glossaryid = '.$glinstanceid.' ';
+        } else {
+            $approvals[] = ' (ge.approved = 1 AND ge.glossaryid = '.$glinstanceid.') ';
        }
    }

-    if (!$entries) {
+    $selectsql = "SELECT ge.id, ge.concept, ge.approved, ge.timemodified, ge.glossaryid,
+                                                 ge.userid, u.firstname, u.lastname, u.email, u.picture ";
+    $countsql = "SELECT COUNT(*)";
+
+    $joins = array(" FROM {$CFG->prefix}glossary_entries ge ");
+    $joins[] = "JOIN {$CFG->prefix}user u ON u.id = ge.userid ";
+    $fromsql = implode($joins, "\n");
+
+    $clausesql = ' WHERE ge.timemodified > '.$timestart.' AND (';
+    $approvalsql = implode($approvals, ' OR ');
+
+    $ordersql = ') ORDER BY ge.timemodified ASC';
+    $entries = get_records_sql($selectsql.$fromsql.$clausesql.$approvalsql.$ordersql, 0, (GLOSSARY_RECENT_ACTIVITY_LIMIT+1));
+    $fromsql = implode($joins, "\n");
+    if (empty($entries)) {
        return false;
    }
    print_headline(get_string('newentries', 'glossary').':');

    $strftimerecent = get_string('strftimerecent');
+    $entrycount = 0;
    foreach ($entries as $entry) {
-        $link = $CFG->wwwroot.'/mod/glossary/view.php?g='.$entry->glossaryid.'&amp;mode=entry&amp;hook='.$entry->id;
-        if ($entry->approved) {
-            $dimmed = '';
+        if ($entrycount < GLOSSARY_RECENT_ACTIVITY_LIMIT) {
+            if ($entry->approved) {
+                $dimmed = '';
+                $link = $CFG->wwwroot.'/mod/glossary/view.php?g='.$entry->glossaryid.'&amp;mode=entry&amp;hook='.$entry->id;
+            } else {
+                $dimmed = ' dimmed_text';
+                $link = $CFG->wwwroot.'/mod/glossary/view.php?id='.$ids[$entry->glossaryid].'&amp;mode=approval&amp;hook='.format_text($entry->concept, true);
+            }
+            echo '<div class="head'.$dimmed.'">';
+            echo '<div class="date">'.userdate($entry->timemodified, $strftimerecent).'</div>';
+            echo '<div class="name">'.fullname($entry, $viewfullnames).'</div>';
+            echo '</div>';
+            echo '<div class="info"><a href="'.$link.'">'.format_text($entry->concept, true).'</a></div>';
+            $entrycount += 1;
        } else {
-            $dimmed = ' dimmed_text';
+            $numnewentries = count_records_sql($countsql.$joins[0].$clausesql.$approvalsql.')');
+            echo '<div class="head"><div class="activityhead">'.get_string('andmorenewentries', 'glossary', $numnewentries - GLOSSARY_RECENT_ACTIVITY_LIMIT).'</div></div>';
+            break;
        }
-        echo '<div class="head'.$dimmed.'">';
-        echo '<div class="date">'.userdate($entry->timemodified, $strftimerecent).'</div>';
-        echo '<div class="name">'.fullname($entry, $viewfullnames).'</div>';
-        echo '</div>';
-        echo '<div class="info"><a href="'.$link.'">'.format_text($entry->concept, true).'</a></div>';
    }

    return true;
@@ -329,12 +329,12 @@

 /// Search box
    if ($showcommonelements ) {
-        echo '<form method="post" action="view.php">';
+        echo '<form method="get" action="view.php">';

        echo '<table class="boxaligncenter" width="70%" border="0">';
        echo '<tr><td align="center" class="glossarysearchbox">';

-        echo '<input type="submit" value="'.$strsearch.'" name="searchbutton" /> ';
+        echo '<input type="submit" value="'.$strsearch.'" /> ';
        if ($mode == 'search') {
            echo '<input type="text" name="hook" size="20" value="'.s($hook).'" alt="'.$strsearch.'" /> ';
        } else {
@@ -1089,13 +1089,13 @@ class hotpot_xml_quiz_template extends hotpot_xml_template_default {
    // JCross quiztype

    function v6_expand_CluesAcrossLabel() {
-        $this->parent->xml_value('hotpot-config-file,'.$this->parent->quiztype.',clues-across');
+        return $this->parent->xml_value('hotpot-config-file,'.$this->parent->quiztype.',clues-across');
    }
    function v6_expand_CluesDownLabel() {
-        $this->parent->xml_value('hotpot-config-file,'.$this->parent->quiztype.',clues-down');
+        return $this->parent->xml_value('hotpot-config-file,'.$this->parent->quiztype.',clues-down');
    }
    function v6_expand_EnterCaption() {
-        $this->parent->xml_value('hotpot-config-file,'.$this->parent->quiztype.',enter-caption');
+        return $this->parent->xml_value('hotpot-config-file,'.$this->parent->quiztype.',enter-caption');
    }
    function v6_expand_ShowHideClueList() {
        $value = $this->int_value('hotpot-config-file,'.$this->parent->quiztype.',include-clue-list');
@@ -415,12 +415,7 @@

            $response = '';
            if ($ncorrect == count($answers)-2) {  // dont count correct/wrong responses in the total.
-                foreach ($answers as $answer) {
-                    if ($answer->response == NULL && $answer->answer != NULL) {
-                        $response = $answer->answer;
-                        break;
-                    }
-                }
+                $response = reset($answers)->answer;
                if (isset($correctpageid)) {
                    $newpageid = $correctpageid;
                }
@@ -429,16 +424,8 @@
                }
                $correctanswer = true;
            } else {
-                $t = 0;
-                foreach ($answers as $answer) {
-                    if ($answer->response == NULL && $answer->answer != NULL) {
-                        if ($t == 1) {
-                            $response = $answer->answer;
-                            break;
-                        }
-                        $t++;
-                    }
-                }
+                reset($answers);
+                $response = next($answers)->answer;
                $newpageid = $wrongpageid;
                $answerid = $wronganswerid;
            }
@@ -31,12 +31,15 @@
                if ($essayattempts = get_records_select('lesson_attempts', 'pageid IN('.implode(',', array_keys($pages)).')')) {
                    // Get all the users who have taken this lesson, order by their last name
                    if (!empty($CFG->enablegroupings) && !empty($cm->groupingid)) {
-                        $sql = "SELECT DISTINCT u.*
-                                FROM {$CFG->prefix}lesson_attempts a 
-                                    INNER JOIN {$CFG->prefix}user u ON u.id = a.userid
-                                    INNER JOIN {$CFG->prefix}groups_members gm ON gm.userid = u.id
-                                    INNER JOIN {$CFG->prefix}groupings_groups gg ON gm.groupid = {$cm->groupingid}
-                                WHERE a.lessonid = '$lesson->id'
+                        $sql = "SELECT u.*
+                                  FROM {$CFG->prefix}user u
+                                  JOIN (
+                                    SELECT DISTINCT u.id
+                                      FROM {$CFG->prefix}lesson_attempts a
+                                      JOIN {$CFG->prefix}user u ON u.id = a.userid
+                                      JOIN {$CFG->prefix}groups_members gm ON gm.userid = u.id
+                                      JOIN {$CFG->prefix}groupings_groups gg ON gm.groupid = {$cm->groupingid}
+                                     WHERE a.lessonid = '$lesson->id') ui ON u.id = ui.id
                                ORDER BY u.lastname";
                    } else {
                        $sql = "SELECT u.*
@@ -367,4 +370,4 @@
    }
    
    print_footer($course);
-?>
+?>
@@ -155,7 +155,14 @@ function lesson_user_outline($course, $user, $mod, $lesson) {
    } else {
        $grade = reset($grades->items[0]->grades);
        $return->info = get_string("grade") . ': ' . $grade->str_long_grade;
-        $return->time = $grade->dategraded;
+
+        //datesubmitted == time created. dategraded == time modified or time overridden
+        //if grade was last modified by the user themselves use date graded. Otherwise use date submitted
+        if ($grade->usermodified == $user->id || empty($grade->datesubmitted)) {
+            $result->time = $grade->dategraded;
+        } else {
+            $result->time = $grade->datesubmitted;
+        }
    }
    return $return;
 }
@@ -17,14 +17,17 @@
    $nothingtodisplay = false;

    list($cm, $course, $lesson) = lesson_get_basics($id);
-    
+
    if (!empty($CFG->enablegroupings) && !empty($cm->groupingid)) {
-        $sql = "SELECT DISTINCT u.*
-                FROM {$CFG->prefix}lesson_attempts a 
-                    INNER JOIN {$CFG->prefix}user u ON u.id = a.userid
-                    INNER JOIN {$CFG->prefix}groups_members gm ON gm.userid = u.id
-                    INNER JOIN {$CFG->prefix}groupings_groups gg ON gm.groupid = {$cm->groupingid}
-                WHERE a.lessonid = '$lesson->id'
+        $sql = "SELECT u.*
+                  FROM {$CFG->prefix}user u
+                  JOIN (
+                    SELECT DISTINCT u.id
+                      FROM {$CFG->prefix}lesson_attempts a
+                      JOIN {$CFG->prefix}user u ON u.id = a.userid
+                      JOIN {$CFG->prefix}groups_members gm ON gm.userid = u.id
+                      JOIN {$CFG->prefix}groupings_groups gg ON gm.groupid = {$cm->groupingid}
+                WHERE a.lessonid = '$lesson->id') ui ON u.id = ui.id
                ORDER BY u.lastname";
    } else {
        $sql = "SELECT u.*
@@ -147,7 +147,7 @@
            $feedback = '';
            if ($quiz->grade && !is_null($bestgrade)) {
                if ($alloptions->scores) {
-                    $grade = "$bestgrade / $quiz->grade";
+                    $grade = round($bestgrade, $quiz->decimalpoints) . ' / ' . $quiz->grade;
                }
                if ($alloptions->overallfeedback) {
                    $feedback = quiz_feedback_for_grade($bestgrade, $quiz->id);
@@ -186,7 +186,7 @@ function quiz_get_best_grade($quiz, $userid) {

    // Need to detect errors/no result, without catching 0 scores.
    if (is_numeric($grade)) {
-        return round($grade, $quiz->decimalpoints);
+        return $grade + 0;
    } else {
        return NULL;
    }
@@ -209,7 +209,15 @@ function quiz_user_outline($course, $user, $mod, $quiz) {

    $result = new stdClass;
    $result->info = get_string('grade') . ': ' . $grade->str_long_grade;
-    $result->time = $grade->dategraded;
+
+    //datesubmitted == time created. dategraded == time modified or time overridden
+    //if grade was last modified by the user themselves use date graded. Otherwise use date submitted
+    if ($grade->usermodified == $user->id || empty($grade->datesubmitted)) {
+        $result->time = $grade->dategraded;
+    } else {
+        $result->time = $grade->datesubmitted;
+    }
+
    return $result;
 }

@@ -429,7 +429,7 @@ function quiz_save_best_grade($quiz, $userid = null) {

    // Calculate the best grade
    $bestgrade = quiz_calculate_best_grade($quiz, $attempts);
-    $bestgrade = quiz_rescale_grade($bestgrade, $quiz);
+    $bestgrade = quiz_rescale_grade($bestgrade, $quiz, false);

    // Save the best grade in the database
    if ($grade = get_record('quiz_grades', 'quiz', $quiz->id, 'userid', $userid)) {
@@ -282,6 +282,14 @@ class mod_quiz_mod_form extends moodleform_mod {
            $key = 0;
            foreach ($this->_feedbacks as $feedback){
                $default_values['feedbacktext['.$key.']'] = $feedback->feedbacktext;
+                if ($default_values['grade'] == 0) {
+                    // When a quiz is un-graded, there can only be one lot of
+                    // feedback. If the quiz previously had a maximum grade and
+                    // several lots of feedback, we must now avoid putting text
+                    // into input boxes that are disabled, but which the
+                    // validation will insist are blank.
+                    break;
+                }
                if ($feedback->mingrade > 0) {
                    $default_values['feedbackboundaries['.$key.']'] = (100.0 * $feedback->mingrade / $default_values['grade']) . '%';
                }
@@ -348,9 +348,22 @@ class quiz_report extends quiz_default_report {
                    "END) AS gradedattempt, ";
            }

-            $select .= 'qa.uniqueid AS attemptuniqueid, qa.id AS attempt, ' .
-                    'u.id AS userid, u.idnumber, u.firstname, u.lastname, u.picture, u.imagealt, ' .
-                    'qa.sumgrades, qa.timefinish, qa.timestart, qa.timefinish - qa.timestart AS duration ';
+            $select .= '
+                    qa.uniqueid AS attemptuniqueid,
+                    qa.id AS attempt,
+                    u.id AS userid,
+                    u.idnumber,
+                    u.firstname,
+                    u.lastname,
+                    u.picture,
+                    u.imagealt,
+                    u.email,
+                    qa.sumgrades,
+                    qa.timefinish,
+                    qa.timestart,
+                    CASE WHEN qa.timefinish = 0 THEN null
+                         WHEN qa.timefinish > qa.timestart THEN qa.timefinish - qa.timestart
+                         ELSE 0 END AS duration ';

            // This part is the same for all cases - join users and quiz_attempts tables
            $from = 'FROM '.$CFG->prefix.'user u ';
@@ -559,7 +572,7 @@ class quiz_report extends quiz_default_report {
                    // Feedback column.
                    if ($hasfeedback) {
                        if ($attempt->timefinish) {
-                            $row[] = quiz_report_feedback_for_grade(quiz_rescale_grade($attempt->sumgrades, $quiz), $quiz->id);
+                            $row[] = quiz_report_feedback_for_grade(quiz_rescale_grade($attempt->sumgrades, $quiz, false), $quiz->id);
                        } else {
                            $row[] = '-';
                        }
@@ -78,6 +78,16 @@
                redirect('view.php?q=' . $quiz->id, $message);
            } 
        }
+
+    } else if (!has_capability('moodle/site:accessallgroups', $context) &&
+            groups_get_activity_groupmode($cm) == SEPARATEGROUPS) {
+        // Check the users have at least one group in common.
+        $teachersgroups = groups_get_activity_allowed_groups($cm);
+        $studentsgroups = groups_get_all_groups($cm->course, $attempt->userid, $cm->groupingid);
+        if (!($teachersgroups && $studentsgroups &&
+                array_intersect(array_keys($teachersgroups), array_keys($studentsgroups)))) {
+            print_error('noreview', 'quiz', 'view.php?q=' . $quiz->id);
+        }
    }

 /// Bits needed to print a good URL for this page.
@@ -255,7 +265,8 @@
    }

 /// Feedback if there is any, and the user is allowed to see it now.
-    $feedback = quiz_feedback_for_grade($grade, $attempt->quiz);
+    $feedback = quiz_feedback_for_grade(quiz_rescale_grade(
+            $attempt->sumgrades, $quiz, false), $attempt->quiz);
    if ($options->overallfeedback && $feedback) {
        $rows[] = '<tr><th scope="row" class="cell">' . get_string('feedback', 'quiz') .
                '</th><td class="cell">' . $feedback . '</td></tr>';
@@ -80,6 +80,16 @@
        if ($attempt->userid != $USER->id) {
            error('This is not your attempt!');
        }
+
+    } else if (!has_capability('moodle/site:accessallgroups', $context) &&
+            groups_get_activity_groupmode($cm) == SEPARATEGROUPS) {
+        // Check the users have at least one group in common.
+        $teachersgroups = groups_get_activity_allowed_groups($cm);
+        $studentsgroups = groups_get_all_groups($cm->course, $attempt->userid, $cm->groupingid);
+        if (!($teachersgroups && $studentsgroups &&
+                array_intersect(array_keys($teachersgroups), array_keys($studentsgroups)))) {
+            print_error('noreview', 'quiz', 'view.php?q=' . $quiz->id);
+        }
    }

    //add_to_log($course->id, 'quiz', 'review', "review.php?id=$cm->id&amp;attempt=$attempt->id", "$quiz->id", "$cm->id");
@@ -267,11 +267,11 @@
            }

            // Ouside the if because we may be showing feedback but not grades.
-            $attemptgrade = quiz_rescale_grade($attempt->sumgrades, $quiz);
+            $attemptgrade = quiz_rescale_grade($attempt->sumgrades, $quiz, false);

            if ($gradecolumn) {
                if ($attemptoptions->scores && $attempt->timefinish > 0) {
-                    $formattedgrade = $attemptgrade;
+                    $formattedgrade = round($attemptgrade, $quiz->decimalpoints);
                    // highlight the highest grade if appropriate
                    if ($overallstats && $numattempts > 1 && !is_null($mygrade) && $attemptgrade == $mygrade && $quiz->grademethod == QUIZ_GRADEHIGHEST) {
                        $table->rowclass[$attempt->attempt] = 'bestrow';
@@ -313,7 +313,7 @@
            if ($available && $moreattempts) {
                $a = new stdClass;
                $a->method = quiz_get_grading_option_name($quiz->grademethod);
-                $a->mygrade = $mygrade;
+                $a->mygrade = round($mygrade, $quiz->decimalpoints);
                $a->quizgrade = $quiz->grade;
                $resultinfo .= print_heading(get_string('gradesofar', 'quiz', $a), '', 2, 'main', true);
            } else {
@@ -22,7 +22,7 @@ class mod_resource_mod_form extends moodleform_mod {
        $mform->setType('type', PARAM_ALPHA);
        $mform->setDefault('type', $type);

-        require($CFG->dirroot.'/mod/resource/type/'.$type.'/resource.class.php');
+        require_once($CFG->dirroot.'/mod/resource/type/'.$type.'/resource.class.php');
        $resclass = 'resource_'.$type;
        $this->_resinstance = new $resclass();

@@ -77,7 +77,7 @@
                        if ($sco = scorm_get_sco($scoid)) {
                            $userdata->course_id = $sco->identifier;
                            $userdata->datafromlms = isset($sco->datafromlms)?$sco->datafromlms:'';
-							$userdata->mastery_score = isset($sco->mastery_score)?$sco->mastery_score:'';
+                            $userdata->mastery_score = isset($sco->mastery_score) && is_numeric($sco->mastery_score)?trim($sco->mastery_score):'';
                            $userdata->max_time_allowed = isset($sco->max_time_allowed)?$sco->max_time_allowed:'';
                            $userdata->time_limit_action = isset($sco->time_limit_action)?$sco->time_limit_action:'';
                            echo "error=0\r\nerror_text=Successful\r\naicc_data=";
@@ -135,7 +135,7 @@
                            echo "[Core_Vendor]\r\n".$userdata->datafromlms."\r\n";
                            echo "[Evaluation]\r\nCourse_ID = {".$userdata->course_id."}\r\n";
                            echo "[Student_Data]\r\n";
-							echo 'Mastery_Score='.$userdata->mastery_score."\r\n";
+                            echo 'Mastery_Score='.$userdata->mastery_score."\r\n";
                            echo 'Max_Time_Allowed='.$userdata->max_time_allowed."\r\n";
                            echo 'Time_Limit_Action='.$userdata->time_limit_action."\r\n";
                        } else {
@@ -250,7 +250,7 @@
                                            $value .= $datarow."\r\n";
                                            next($datarows);
                                        }
-										$value = rawurlencode(stripslashes($value));
+                                        $value = rawurlencode(stripslashes($value));
                                        $id = scorm_insert_track($USER->id, $scorm->id, $sco->id, $attempt, $element, $value);
                                    }
                                }
@@ -260,11 +260,10 @@
                                $id = scorm_insert_track($USER->id, $scorm->id, $sco->id, $attempt, 'cmi.core.lesson_status', 'browsed');
                            }
                            if ($mode == 'normal') {
-
                                if ($sco = scorm_get_sco($scoid)) {
-                                    if (!empty($sco->mastery_score)) {
-                                        if (!empty($score)) {
-                                            if ($score >= $sco->mastery_score) {
+                                    if (isset($sco->mastery_score) && is_numeric($sco->mastery_score)) {
+                                        if ($score != '') { // $score is correctly initialized w/ an empty string, see above
+                                            if ($score >= trim($sco->mastery_score)) {
                                                $lessonstatus = 'passed';
                                            } else {
                                                $lessonstatus = 'failed';
--- a/Show More
+++ b/Show More