on-demand release 1.9.19+

Merge branch 'mdl19_MDL-35958' of git://github.com/danmarsden/moodle into MOODLE_19_STABLE
MDL-38225 - data: Database entries are now linked correctly.
2013-05-13 12:30:23 +02:00 · 2013-05-06 11:01:20 +01:00 · 2013-02-27 08:45:53 +08:00 · 2013-01-25 15:59:35 +08:00 · 2013-01-11 22:16:54 +01:00 · 2013-01-11 12:27:34 +01:00
234 changed files with 6018 additions and 3378 deletions
@@ -0,0 +1,27 @@
+# This file specifies intentionally untracked files that all Moodle git
+# repositories should ignore. It is recommended not to modify this file in your
+# local clone. Instead, use .git/info/exclude and add new records there as
+# needed.
+#
+# Example: if you deploy a contributed plugin mod/foobar into your site, put
+# the following line into .git/info/exclude file in your Moodle clone:
+# /mod/foobar/
+#
+# See gitignore(5) man page for more details
+#
+/config.php
+/lib/editor/tinymce/extra/tools/temp/
+*~
+*.swp
+/tags
+/TAGS
+/cscope.*
+/.patches/
+/.idea/
+/nbproject/
+CVS
+.DS_Store
+/.settings/
+/.project
+/.buildpath
+/.cache
@@ -24,7 +24,7 @@ a few minutes:

 For more information, see the INSTALL DOCUMENTATION:

-   http://docs.moodle.org/en/Installing_Moodle 
+   http://docs.moodle.org/19/en/Installing_Moodle

 A local copy can also be found in 

@@ -241,10 +241,13 @@

        if ($CFG->longtimenosee) { // value in days
            $cuttime = $timenow - ($CFG->longtimenosee * 3600 * 24);
-            $rs = get_recordset_sql ("SELECT id, userid, courseid
-                                        FROM {$CFG->prefix}user_lastaccess
-                                       WHERE courseid != ".SITEID."
-                                         AND timeaccess < $cuttime ");
+            $rs = get_recordset_sql ("SELECT la.id, la.userid, la.courseid
+                                        FROM {$CFG->prefix}user_lastaccess la
+                                        JOIN {$CFG->prefix}course c
+                                          ON c.id = la.courseid
+                                       WHERE la.courseid != ".SITEID."
+                                         AND la.timeaccess < $cuttime
+                                         AND c.metacourse = 0 ");
            while ($assign = rs_fetch_next_record($rs)) {
                if ($context = get_context_instance(CONTEXT_COURSE, $assign->courseid)) {
                    if (role_unassign(0, $assign->userid, 0, $context->id)) {
@@ -348,25 +351,24 @@
        mtrace('checking for create_password');
        if (count_records('user_preferences', 'name', 'create_password', 'value', '1')) {
            mtrace('creating passwords for new users');
-            $newusers = get_records_sql("SELECT  u.id as id, u.email, u.firstname, 
-                                                u.lastname, u.username,
-                                                p.id as prefid 
-                                        FROM {$CFG->prefix}user u 
-                                             JOIN {$CFG->prefix}user_preferences p ON u.id=p.userid
-                                        WHERE p.name='create_password' AND p.value='1' AND u.email !='' ");
-
-            foreach ($newusers as $newuserid => $newuser) {
-                $newuser->emailstop = 0; // send email regardless
-                // email user                               
-                if (setnew_password_and_mail($newuser)) {
-                    // remove user pref
-                    delete_records('user_preferences', 'id', $newuser->prefid);
-                } else {
-                    trigger_error("Could not create and mail new user password!");
+            $newuserssql = "SELECT u.id as id, u.email, u.firstname, u.lastname, u.username, p.id as prefid
+                              FROM {$CFG->prefix}user u
+                              JOIN {$CFG->prefix}user_preferences p ON u.id=p.userid
+                             WHERE p.name='create_password' AND p.value='1' AND u.email !='' ";
+            if ($newusers = get_records_sql($newuserssql)) {
+                foreach ($newusers as $newuserid => $newuser) {
+                    $newuser->emailstop = 0; // send email regardless
+                    // email user
+                    if (setnew_password_and_mail($newuser)) {
+                        // remove user pref
+                        delete_records('user_preferences', 'id', $newuser->prefid);
+                    } else {
+                        trigger_error("Could not create and mail new user password!");
+                    }
                }
            }
        }
-        
+
        if (!empty($CFG->usetags)) {
            require_once($CFG->dirroot.'/tag/lib.php');
            tag_cron();
@@ -321,6 +321,353 @@
      </PHP_SETTING>
    </PHP_SETTINGS>
    <CUSTOM_CHECKS>
+      <CUSTOM_CHECK file="lib/customcheckslib.php" function="php_check_php533" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="php533warning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
    </CUSTOM_CHECKS>
  </MOODLE>
+  <MOODLE version="2.1" requires="1.9">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mysql" version="5.0.25">
+        <FEEDBACK>
+          <ON_ERROR message="mysql416required" />
+        </FEEDBACK>
+      </VENDOR>
+      <VENDOR name="postgres" version="8.3" />
+      <VENDOR name="mssql" version="9.0" />
+      <VENDOR name="odbc_mssql" version="9.0" />
+      <VENDOR name="mssql_n" version="9.0" />
+      <VENDOR name="oracle" version="10.2" />
+      <VENDOR name="sqlite" version="2.0" />
+    </DATABASE>
+    <PHP version="5.3.2" level="required">
+    </PHP>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opensslrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="gdrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="intlrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="40M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="safe_mode" value="0" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingsafemode" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+  </MOODLE>
+  <MOODLE version="2.2" requires="1.9">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mysql" version="5.0.25">
+        <FEEDBACK>
+          <ON_ERROR message="mysql416required" />
+        </FEEDBACK>
+      </VENDOR>
+      <VENDOR name="postgres" version="8.3" />
+      <VENDOR name="mssql" version="9.0" />
+      <VENDOR name="odbc_mssql" version="9.0" />
+      <VENDOR name="mssql_n" version="9.0" />
+      <VENDOR name="oracle" version="10.2" />
+      <VENDOR name="sqlite" version="2.0" />
+    </DATABASE>
+    <PHP version="5.3.2" level="required">
+    </PHP>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opensslrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="gdrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="intlrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="40M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="safe_mode" value="0" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingsafemode" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+  </MOODLE>
+  <MOODLE version="2.3" requires="2.2">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mysql" version="5.0.25">
+        <FEEDBACK>
+          <ON_ERROR message="mysql416required" />
+        </FEEDBACK>
+      </VENDOR>
+      <VENDOR name="postgres" version="8.3" />
+      <VENDOR name="mssql" version="9.0" />
+      <VENDOR name="odbc_mssql" version="9.0" />
+      <VENDOR name="mssql_n" version="9.0" />
+      <VENDOR name="oracle" version="10.2" />
+      <VENDOR name="sqlite" version="2.0" />
+    </DATABASE>
+    <PHP version="5.3.2" level="required">
+    </PHP>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opensslrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="gdrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="intlrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="40M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="safe_mode" value="0" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingsafemode" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+  </MOODLE>
 </COMPATIBILITY_MATRIX>
@@ -47,7 +47,7 @@

 /// Check some PHP server settings

-    $documentationlink = '<a href="http://docs.moodle.org/en/Installation">Installation docs</a>';
+    $documentationlink = '<a href="http://docs.moodle.org/19/en/Installation">Installation docs</a>';

    if (ini_get_bool('session.auto_start')) {
        error("The PHP server variable 'session.auto_start' should be Off - $documentationlink");
@@ -143,7 +143,7 @@
            print_box(text_to_html(get_string('gpl')), 'copyrightnotice');
            echo "<br />";
            notice_yesno(get_string('doyouagree'), "index.php?agreelicense=1",
-                                                   "http://docs.moodle.org/en/License");
+                                                   "http://docs.moodle.org/dev/License");
            print_footer('none');
            exit;
        }
@@ -152,7 +152,7 @@
            $navigation = build_navigation(array(array('name'=>$strcurrentrelease, 'link'=>null, 'type'=>'misc')));
            print_header($strcurrentrelease, $strcurrentrelease, $navigation, "", "", false, "&nbsp;", "&nbsp;");
            print_heading("Moodle $release");
-            print_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/en/Release_Notes'), 'generalbox boxaligncenter boxwidthwide');
+            print_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/19/en/Release_Notes'), 'generalbox boxaligncenter boxwidthwide');
            echo '<form action="index.php"><div>';
            echo '<input type="hidden" name="agreelicense" value="1" />';
            echo '<input type="hidden" name="confirmrelease" value="1" />';
@@ -286,7 +286,7 @@
                $navigation = build_navigation(array(array('name'=>$strcurrentrelease, 'link'=>null, 'type'=>'misc')));
                print_header($strcurrentrelease, $strcurrentrelease, $navigation, "", "", false, "&nbsp;", "&nbsp;");
                print_heading("Moodle $release");
-                print_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/en/Release_Notes'));
+                print_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/19/en/Release_Notes'));

                require_once($CFG->libdir.'/environmentlib.php');
                print_heading(get_string('environment', 'admin'));
@@ -687,10 +687,10 @@
    //////////////////////////////////////////////////////////////////////////////////////////////////
    ////  IT IS ILLEGAL AND A VIOLATION OF THE GPL TO HIDE, REMOVE OR MODIFY THIS COPYRIGHT NOTICE ///
    $copyrighttext = '<a href="http://moodle.org/">Moodle</a> '.
-                     '<a href="http://docs.moodle.org/en/Release" title="'.$CFG->version.'">'.$CFG->release.'</a><br />'.
+                     '<a href="http://docs.moodle.org/dev/Releases" title="'.$CFG->version.'">'.$CFG->release.'</a><br />'.
                     'Copyright &copy; 1999 onwards, Martin Dougiamas<br />'.
-                     'and <a href="http://docs.moodle.org/en/Credits">many other contributors</a>.<br />'.
-                     '<a href="http://docs.moodle.org/en/License">GNU Public License</a>';
+                     'and <a href="http://docs.moodle.org/dev/Credits">many other contributors</a>.<br />'.
+                     '<a href="http://docs.moodle.org/dev/License">GNU Public License</a>';
    print_box($copyrighttext, 'copyright');
    //////////////////////////////////////////////////////////////////////////////////////////////////

@@ -75,12 +75,12 @@
                .$param->extras
                ." ORDER BY ".$param->orderby;
        }
-        error_log($sql);

        $courses = get_records_sql($sql, 0, $numcourses);

        if (empty($courses)) {
-            notify(get_string('statsnodata'));echo '</td></tr></table>';echo '<p>after notify</p>';
+            notify(get_string('statsnodata'));
+            echo '</td></tr></table>';

        } else {
            if (empty($CFG->gdversion)) {
@@ -1050,8 +1050,7 @@ function report_security_check_riskadmin($detailed=false) {
                     AND (sc.path = c.path OR sc.path LIKE ".sql_concat('c.path', "'/%'")." OR c.path LIKE ".sql_concat('sc.path', "'/%'").")
                     AND u.id = ra.userid AND u.deleted = 0
                     AND ra.contextid = sc.id AND ra.roleid = rc.roleid AND ra.contextid <> ".SYSCONTEXTID."
-            GROUP BY u.id, u.firstname, u.lastname, u.picture, u.imagealt, u.email, ra.contextid, ra.roleid
-            ORDER BY u.lastname, u.firstname";
+            GROUP BY u.id, u.firstname, u.lastname, u.picture, u.imagealt, u.email, ra.contextid, ra.roleid";

    $unsupcount = count_records_sql("SELECT COUNT('x') FROM ($sqlunsup) unsup");

@@ -1077,6 +1076,7 @@ function report_security_check_riskadmin($detailed=false) {
        $result->info = get_string('check_riskadmin_warning', 'report_security', $a);

        if ($detailed) {
+            $sqlunsup .= " ORDER BY u.lastname, u.firstname";
            $rs = get_recordset_sql($sqlunsup);
            $users = array();
            while ($user = rs_fetch_next_record($rs)) {
@@ -1113,13 +1113,13 @@ function report_security_check_riskbackup($detailed=false) {
    $syscontext = get_context_instance(CONTEXT_SYSTEM);

    $systemroles = get_records_sql(
-        "SELECT DISTINCT r.*
+        "SELECT DISTINCT r.id, r.name, r.shortname, r.sortorder
           FROM {$CFG->prefix}role r
           JOIN {$CFG->prefix}role_capabilities rc ON rc.roleid = r.id
          WHERE rc.capability = 'moodle/backup:userinfo' AND rc.contextid = $syscontext->id AND rc.permission = ".CAP_ALLOW."");

    $overriddenroles = get_records_sql(
-        "SELECT DISTINCT r.*, rc.contextid
+        "SELECT DISTINCT r.id, r.name, r.shortname, r.sortorder, rc.contextid
           FROM {$CFG->prefix}role r
           JOIN {$CFG->prefix}role_capabilities rc ON rc.roleid = r.id
          WHERE rc.capability = 'moodle/backup:userinfo' AND rc.contextid <> $syscontext->id AND rc.permission = ".CAP_ALLOW."");
@@ -72,7 +72,7 @@
    $straction = get_string('assignroles', 'role');
    $strroletoassign = get_string('roletoassign', 'role');
    $strsearch = get_string('search');
-    $strshowall = get_string('showall');
+    $strshowall = get_string('showallusers');
    $strparticipants = get_string('participants');
    $strsearchresults = get_string('searchresults');

@@ -8,6 +8,7 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
    $temp->add(new admin_setting_configcheckbox('protectusernames', get_string('protectusernames', 'admin'), get_string('configprotectusernames', 'admin'), 1));
    $temp->add(new admin_setting_configcheckbox('forcelogin', get_string('forcelogin', 'admin'), get_string('configforcelogin', 'admin'), 0));
    $temp->add(new admin_setting_configcheckbox('forceloginforprofiles', get_string('forceloginforprofiles', 'admin'), get_string('configforceloginforprofiles', 'admin'), 1));
+    $temp->add(new admin_setting_configcheckbox('forceloginforprofileimage', get_string('forceloginforprofileimage', 'admin'), get_string('forceloginforprofileimage_help', 'admin'), 0));
    $temp->add(new admin_setting_configcheckbox('opentogoogle', get_string('opentogoogle', 'admin'), get_string('configopentogoogle', 'admin'), 0));

    $max_upload_choices = get_max_upload_sizes();
@@ -67,6 +68,7 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
    $temp->add(new admin_setting_configcheckbox('cookiehttponly', get_string('cookiehttponly', 'admin'), get_string('configcookiehttponly', 'admin'), 0));
    $temp->add(new admin_setting_configcheckbox('regenloginsession', get_string('regenloginsession', 'admin'), get_string('configregenloginsession', 'admin'), 1));
    $temp->add(new admin_setting_configtext('excludeoldflashclients', get_string('excludeoldflashclients', 'admin'), get_string('configexcludeoldflashclients', 'admin'), '10.0.12', PARAM_TEXT));
+    $temp->add(new admin_setting_configcheckbox('loginpasswordautocomplete', get_string('loginpasswordautocomplete', 'admin'), get_string('loginpasswordautocomplete_help', 'admin'), 0));
    $ADMIN->add('security', $temp);


@@ -558,7 +558,7 @@ if ($formdata = $mform->is_cancelled()) {
                continue;
            }
            // save custom profile fields data
-            profile_save_data($user);
+            profile_save_data(addslashes_recursive($user));

            // make sure user context exists
            get_context_instance(CONTEXT_USER, $user->id);
@@ -665,7 +665,7 @@ if ($formdata = $mform->is_cancelled()) {
                    $newgroupdata = new object();
                    $newgroupdata->name = $addgroup;
                    $newgroupdata->courseid = $ccache[$shortname]->id;
-                    if ($ccache[$shortname]->groups[$addgroup]->id = groups_create_group($newgroupdata)){
+                    if ($ccache[$shortname]->groups[$addgroup]->id = groups_create_group(addslashes_recursive($newgroupdata))){
                        $ccache[$shortname]->groups[$addgroup]->name = $newgroupdata->name;
                    } else {
                        $upt->track('enrolments', get_string('unknowngroup', 'error', $addgroup), 'error');
@@ -2,7 +2,7 @@ XMLDB - Base classes and edition interface.

 Complete Documentation:

-  http://docs.moodle.org/en/XMLDB_Defining_one_XML_structure
+  http://docs.moodle.org/19/en/XMLDB_Defining_one_XML_structure

 Ciao, Eloy Lafuente (stronk7)

@@ -70,7 +70,7 @@ Once the XMLDB format was approved, we'll be able to build all the
 for each RDBMS flavour.

 Once the interface was finished (2-3 days from now) related documentation
-will be sent to http://docs.moodle.org/en/XML_database_schema in order
+will be sent to http://docs.moodle.org/19/en/XML_database_schema in order
 to comment/modify/approve the final XML format.

 All the code is, obviously GPL, with its copyrights and so on...
@@ -25,8 +25,8 @@
 ///////////////////////////////////////////////////////////////////////////

 /// This class will show all the reserved words in a format suitable to
-/// be pasted to: http://docs.moodle.org/en/XMLDB_reserved_words and
-/// http://docs.moodle.org/en/Database_reserved_words
+/// be pasted to: http://docs.moodle.org/19/en/XMLDB_reserved_words and
+/// http://docs.moodle.org/19/en/Database_reserved_words
 /// Also, it introspects te DB looking for such words and informing about

 class view_reserved_words extends XMLDBAction {
@@ -114,8 +114,12 @@ class auth_plugin_cas extends auth_plugin_base {
 // Connection to CAS server
 	 $this->connectCAS();

+     if($this->config->certificate_check && $this->config->certificate_path){
+         phpCAS::setCasServerCACert($this->config->certificate_path);
+     }else{
         // Don't try to validate the server SSL credentials
         phpCAS::setNoCasServerValidation();
+     }

 	  // Gestion de la connection CAS si acc�s direct d'un ent ou autre	
 	 if (phpCAS::checkAuthentication()) {
@@ -202,6 +206,19 @@ if ( !is_object($PHPCAS_CLIENT) ) {
    function config_form($config, $err, $user_fields) {
        include 'config.html';
    }
+
+    /**
+     * A chance to validate form data, and last chance to
+     * do stuff before it is inserted in config_plugin
+     * @param object object with submitted configuration settings (without system magic quotes)
+     * @param array $err array of error messages
+     */
+    function validate_form(&$form, &$err) {
+        $certificate_path = trim($form->certificate_path);
+        if ($form->certificate_check && empty($certificate_path)) {
+            $err['certificate_path'] = get_string('auth_cas_certificate_path_empty', 'auth');
+        }
+    }
    /**
     * Returns the URL for changing the user's pw, or empty if the default can
     * be used.
@@ -248,6 +265,10 @@ if ( !is_object($PHPCAS_CLIENT) ) {
            $config->logoutcas = '';
        if (!isset ($config->multiauth))
            $config->multiauth = '';
+        if (!isset ($config->certificate_check))
+            $config->certificate_check = '';
+        if (!isset ($config->certificate_path))
+            $config->certificate_path = '';
        // LDAP settings
        if (!isset($config->host_url))
            { $config->host_url = ''; }
@@ -290,6 +311,8 @@ if ( !is_object($PHPCAS_CLIENT) ) {
        set_config('proxycas',     $config->proxycas,     'auth/cas');
        set_config('logoutcas',     $config->logoutcas,     'auth/cas');
        set_config('multiauth',     $config->multiauth,     'auth/cas');
+        set_config('certificate_check',     $config->certificate_check,     'auth/cas');
+        set_config('certificate_path',     $config->certificate_path,     'auth/cas');
        // save LDAP settings
        set_config('host_url', $config->host_url, 'auth/cas');
        set_config('ldapencoding', $config->ldapencoding, 'auth/cas');
@@ -652,7 +675,7 @@ if ( !is_object($PHPCAS_CLIENT) ) {
                $droptablesql[] = 'DROP TEMPORARY TABLE ' . $temptable; // sql command to drop the table (because session scope could be a problem)
                execute_sql_arr($droptablesql, true, false); /// Drop temp table to avoid persistence problems later
                echo "Creating temp table $temptable\n";
-                execute_sql('CREATE TEMPORARY TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username)) TYPE=MyISAM', false);
+                execute_sql('CREATE TEMPORARY TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username)) ENGINE=MyISAM', false);
                break;
            case 'postgres':
                $temptable = $CFG->prefix . 'extuser';
@@ -48,6 +48,14 @@

        $config->multiauth = '';

+    if (!isset ($config->certificate_check)) 
+
+        $config->certificate_check = '';
+
+    if (!isset ($config->certificate_path))
+
+        $config->certificate_path = '';
+
  // set to defaults if undefined (LDAP)

    if (!isset($config->host_url))
@@ -364,6 +372,44 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?



+<tr valign="top"  class="required">
+
+    <td align="right"><?php print_string('auth_cas_certificate_check_key', 'auth') ?>:</td>
+
+    <td>
+
+        <?php choose_from_menu ($yesno, 'certificate_check', $config->certificate_check, ''); ?>
+
+    </td>
+
+    <td><?php print_string('auth_cas_certificate_check', 'auth') ?></td>
+
+</tr>
+
+
+
+<tr valign="top" class="required">
+
+    <td align="right"><?php print_string('auth_cas_certificate_path_key', 'auth') ?>:</td>
+
+    <td>
+
+        <input name="certificate_path" type="text" size="30" value="<?php echo $config->certificate_path ?>" />
+
+        <?php if (isset($err['certificate_path'])) formerr($err['certificate_path']); ?>
+
+    </td>
+
+    <td>
+
+        <?php print_string('auth_cas_certificate_path', 'auth') ?>
+      
+    </td>
+
+</tr>
+
+
+
 <tr>

   <td colspan="2">
@@ -563,7 +563,7 @@ class auth_plugin_ldap extends auth_plugin_base {
        switch (strtolower($CFG->dbfamily)) {
            case 'mysql':
                $droptablesql[] = 'DROP TEMPORARY TABLE ' . $temptable; // sql command to drop the table (because session scope could be a problem)
-                $createtemptablesql = 'CREATE TEMPORARY TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username)) TYPE=MyISAM';
+                $createtemptablesql = 'CREATE TEMPORARY TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username)) ENGINE=MyISAM';
                break;
            case 'postgres':
                $droptablesql[] = 'DROP TABLE ' . $temptable; // sql command to drop the table (because session scope could be a problem)
@@ -170,6 +170,10 @@ class auth_plugin_mnet extends auth_plugin_base {
        global $MNET;
        require_once $CFG->dirroot . '/mnet/xmlrpc/client.php';

+        if (!empty($USER->realuser)) {
+            print_error('notpermittedtojumpas', 'mnet');
+        }
+
        // check remote login permissions
        if (! has_capability('moodle/site:mnetlogintoremote', get_context_instance(CONTEXT_SYSTEM))
                or is_mnet_remote_user($USER)
@@ -306,6 +310,7 @@ class auth_plugin_mnet extends auth_plugin_base {
            }
            $remoteuser->mnethostid = $remotehost->id;
            $remoteuser->firstaccess = time(); // First time user in this server, grab it here
+            $remoteuser->confirmed = 1;

            if (!$remoteuser->id =  insert_record('user', addslashes_recursive($remoteuser))) {
                print_error('databaseerror', 'mnet');
@@ -193,18 +193,13 @@ class auth_plugin_shibboleth extends auth_plugin_base {
     *
     */
    function logoutpage_hook() {
-        global $redirect;
+        global $SESSION, $redirect;
        
-        // Only do this if logout handler is defined
-        if (
-              isset($this->config->logout_handler) 
-              && !empty($this->config->logout_handler)
-           ){
+        // Only do this if logout handler is defined, and if the user is actually logged in via Shibboleth
+        $logouthandlervalid = isset($this->config->logout_handler) && !empty($this->config->logout_handler);
+        if (  isset($SESSION->shibboleth_session_id) && $logouthandlervalid ) {
            // Check if there is an alternative logout return url defined
-            if (
-                  isset($this->config->logout_return_url) 
-                  && !empty($this->config->logout_return_url)
-               ){
+            if (isset($this->config->logout_return_url) && !empty($this->config->logout_return_url)) {
                // Set temp_redirect to alternative return url
                $temp_redirect = $this->config->logout_return_url;
            } else {
@@ -100,15 +100,22 @@ function schedule_backup_cron() {
                    $status = false;
                    continue;
                }
+                // Skip courses that do not yet need backup
+                $skipped = !($backup_course->nextstarttime > 0 && $backup_course->nextstarttime < $now);
                // Skip backup of unavailable courses that have remained unmodified in a month
-                $skipped = false;
-                if (!$course->visible && ($now - $course->timemodified) > 31*24*60*60) {  //Hidden + unmodified last month
-                    mtrace("            SKIPPING - hidden+unmodified");
-                    set_field("backup_courses","laststatus","3","courseid",$backup_course->courseid);
-                    $skipped = true;
+                if (!$skipped && !$course->visible && ($now - $course->timemodified) > 31*24*60*60) {  //Hidden + settings were unmodified last month
+                    //Check log if there were any modifications to the course content
+                    $sql = 'SELECT l.id FROM '.$CFG->prefix .'log l WHERE '.
+                            'l.course='. $course->id. ' AND l.time>'. ($now-31*24*60*60). " AND lower(l.action) not like '%view%'";
+                    $logexists = record_exists_sql($sql);
+                    if (!$logexists) {
+                        mtrace("            SKIPPING - hidden+unmodified");
+                        set_field("backup_courses", "laststatus", "3", "courseid", $backup_course->courseid);
+                        $skipped = true;
+                    }
                }
-                //Now we backup every non skipped course with nextstarttime < now
-                if (!$skipped  && $backup_course->nextstarttime > 0 && $backup_course->nextstarttime < $now) {
+                //Now we backup every non-skipped course
+                if (!$skipped) {
                    //We have to send a email because we have included at least one backup
                    $emailpending = true;
                    //Only make the backup if laststatus isn't 2-UNFINISHED (uncontrolled error)
@@ -66,7 +66,7 @@ function backup_upgrade($oldversion=0) {
                      `value` varchar(255) NOT NULL default '',
                      PRIMARY KEY  (`id`),
                      UNIQUE KEY `name` (`name`)
-                  ) TYPE=MyISAM COMMENT='To store backup configuration variables'");
+                  ) ENGINE=MyISAM COMMENT='To store backup configuration variables'");
    }

    if ($oldversion < 2003120800 and $result) {
@@ -79,7 +79,7 @@ function backup_upgrade($oldversion=0) {
                      `nextstarttime` int(10) unsigned NOT NULL default '0',
                      PRIMARY KEY  (`id`),
                      UNIQUE KEY `courseid` (`courseid`)
-                  ) TYPE=MyISAM COMMENT='To store every course backup status'");
+                  ) ENGINE=MyISAM COMMENT='To store every course backup status'");

        if ($result) {
            $result = execute_sql("CREATE TABLE `{$CFG->prefix}backup_log` (    
@@ -89,7 +89,7 @@ function backup_upgrade($oldversion=0) {
                          `laststarttime` int(10) unsigned NOT NULL default '0',
                          `info` varchar(255) NOT NULL default '',
                          PRIMARY KEY  (`id`)
-                      ) TYPE=MyISAM COMMENT='To store every course backup log info'");
+                      ) ENGINE=MyISAM COMMENT='To store every course backup log info'");
        }
    }

@@ -105,7 +105,7 @@ function backup_upgrade($oldversion=0) {
                          `new_id` int(10) unsigned NOT NULL default '0',
                          PRIMARY KEY  (`id`),
                          UNIQUE KEY `{$CFG->prefix}backup_files_uk` (`backup_code`,`file_type`,`path`)
-                      ) TYPE=MyISAM COMMENT='To store and recode ids to user and course files.'");
+                      ) ENGINE=MyISAM COMMENT='To store and recode ids to user and course files.'");
        }
        if ($result) {
            $result = execute_sql("DROP TABLE {$CFG->prefix}backup_ids");
@@ -120,7 +120,7 @@ function backup_upgrade($oldversion=0) {
                          `info` mediumtext,
                          PRIMARY KEY  (`id`),
                          UNIQUE KEY `{$CFG->prefix}backup_ids_uk` (`backup_code` ,`table_name`,`old_id`)
-                      ) TYPE=MyISAM COMMENT='To store and convert ids in backup/restore'");
+                      ) ENGINE=MyISAM COMMENT='To store and convert ids in backup/restore'");
        }
    }

@@ -209,10 +209,29 @@ define('RESTORE_GROUPS_GROUPINGS', 3);

        // Links to course
        $searchstring = '/\$@(COURSEVIEWBYID)\*([0-9]+)@\$/';
-        $replacestring= $CFG->wwwroot . '/course/view.php?id=' . $restore->course_id;
-        $result = preg_replace($searchstring, $replacestring, $content);
+        // We look for it
+        preg_match_all($searchstring, $content, $foundset);
+        // If found, then we are going to look for its new id (in backup tables)
+        if ($foundset[0]) {
+            // Iterate over foundset[2]. They are the old_ids
+            foreach ($foundset[2] as $old_id) {
+                // We get the needed variables here (course id)
+                $rec = backup_getid($restore->backup_unique_code, 'course', $old_id);
+                // Personalize the searchstring
+                $searchstring = '/\$@(COURSEVIEWBYID)\*('.$old_id.')@\$/';
+                // If it is a link to itself, replace it
+                if (!empty($rec->new_id)) {
+                    $replacestring = $CFG->wwwroot . '/course/view.php?id=' . $rec->new_id;
+                // It s a link to another course, keep it unmodified
+                } else {
+                    $replacestring = $restore->original_wwwroot . '/course/view.php?id=' . $old_id;
+                }
+                // Perform the replacement
+                $content = preg_replace($searchstring, $replacestring, $content);
+            }
+        }

-        return $result;
+        return $content;
    }

    //This function is called from all xxxx_decode_content_links_caller(),
@@ -142,7 +142,7 @@ global $CFG;
           `visible` tinyint(1) not null default '0',
           `configdata` text not null default '',
           PRIMARY KEY(`id`)
-          ) TYPE=MyISAM;");
+          ) ENGINE=MyISAM;");
    }
    
    if ($oldversion < 2005090200) {
@@ -49,7 +49,12 @@ class block_login extends block_base {
            $this->content->text .= '<input type="text" name="username" id="login_username" value="'.s($username).'" /></div>';

            $this->content->text .= '<div class="c1 fld password"><label for="login_password">'.get_string('password').'</label>';
-            $this->content->text .= '<input type="password" name="password" id="login_password" value="" /></div>';
+
+            if (!empty($CFG->loginpasswordautocomplete)) {
+                $this->content->text .= '<input type="password" name="password" id="login_password" value="" autocomplete="off" /></div>';
+            } else {
+                $this->content->text .= '<input type="password" name="password" id="login_password" value="" /></div>';
+            }

            $this->content->text .= '<div class="c1 btn"><input type="submit" value="'.get_string('login').'" /></div>';

@@ -32,6 +32,14 @@ class block_mnet_hosts extends block_list {
            return '';
        }

+        if (!empty($USER->realuser)) {
+            $this->content = new stdClass();
+            $this->content->items = array();
+            $this->content->icons = array();
+            $this->content->footer = get_string('notpermittedtojumpas', 'mnet');
+            return $this->content;
+        }
+
        // check for outgoing roaming permission first
        if (!has_capability('moodle/site:mnetlogintoremote', get_context_instance(CONTEXT_SYSTEM), NULL, false)) {
            return '';
@@ -101,6 +101,7 @@ if (isset($rss_record)) {


 if ($act == 'updfeed') {
+    require_sesskey();

    if (!$managefeeds) {
        error(get_string('noguestpost', 'forum').
@@ -153,6 +154,7 @@ if ($act == 'updfeed') {
    redirect($referrer, $message);

 } else if ($act == 'addfeed' ) {
+    require_sesskey();

    $canaddprivfeeds = has_capability('block/rss_client:createprivatefeeds', $context);
    $canaddsharedfeeds = has_capability('block/rss_client:createsharedfeeds', $context);
@@ -225,6 +227,7 @@ if ($act == 'updfeed') {
    rss_print_form($act, $url, $rssid, $preferredtitle, $shared, $id, $context);

 } else if ($act == 'delfeed') {
+    require_sesskey();

    if (!$managefeeds) {
        error(get_string('noguestpost', 'forum').
@@ -672,7 +672,7 @@
            $querystring = '';
            foreach($_GET as $var => $val) {
                $var = clean_param($var, PARAM_ALPHANUM);   // See MDL-22631
-                $val = clean_param($val, PARAM_CLEAN);
+                $val = urlencode(clean_param($val, PARAM_CLEAN));
                if(!$first) {
                    $first = true;
                    if ($var != 'filterselect' && $var != 'filtertype') {
@@ -683,13 +683,13 @@
                    }
                } else {
                    if ($var != 'filterselect' && $var != 'filtertype') {
-                        $querystring .= '&amp;'.$var.'='.$val;
+                        $querystring .= '&'.$var.'='.$val;
                        $hasparam = true;
                    }
                }
            }
            if (isset($hasparam)) {
-                $querystring .= '&amp;';
+                $querystring .= '&';
            } else {
                $querystring = '?';
            }
@@ -697,9 +697,8 @@
            $querystring = '?';
        }

-        return strip_querystring(qualified_me()) . $querystring. 'filtertype='.
-                $filtertype.'&amp;filterselect='.$filterselect.'&amp;';
-
+        return s(strip_querystring(qualified_me()) . $querystring. 'filtertype='.
+                $filtertype.'&filterselect='.$filterselect.'&', true);
    }

    /**
@@ -49,9 +49,9 @@
    $eventid = optional_param('id', 0, PARAM_INT);
    $eventtype = optional_param('type', 'select', PARAM_ALPHA);
    $urlcourse = optional_param('course', 0, PARAM_INT);
-    $cal_y = optional_param('cal_y');
-    $cal_m = optional_param('cal_m');
-    $cal_d = optional_param('cal_d');
+    $cal_y = optional_param('cal_y', 0, PARAM_INT);
+    $cal_m = optional_param('cal_m', 0, PARAM_INT);
+    $cal_d = optional_param('cal_d', 0, PARAM_INT);

    if(isguest()) {
        // Guests cannot do anything with events
@@ -103,6 +103,7 @@
    }

    $form = null;
+    $err = array();

    switch($action) {
        case 'delete':
@@ -129,23 +130,7 @@
            }

            if($form = data_submitted() and confirm_sesskey()) {
-
-                $form->name = clean_param(strip_tags($form->name,'<lang><span>'), PARAM_CLEAN);
-
-                $form->timestart = make_timestamp($form->startyr, $form->startmon, $form->startday, $form->starthr, $form->startmin);
-                if($form->duration == 1) {
-                    $form->timeduration = make_timestamp($form->endyr, $form->endmon, $form->endday, $form->endhr, $form->endmin) - $form->timestart;
-                    if($form->timeduration < 0) {
-                        $form->timeduration = 0;
-                    }
-                }
-                else if($form->duration == 2) {
-                    $form->timeduration = $form->minutes * MINSECS;
-                }
-                else {
-                    $form->timeduration = 0;
-                }
-
+                // validate form and set error if any.
                validate_form($form, $err);

                if (count($err) == 0) {
@@ -194,27 +179,13 @@
            $title = get_string('newevent', 'calendar');
            $form = data_submitted();
            if(!empty($form) && !empty($form->name) && confirm_sesskey()) {
-
-                $form->name = clean_text(strip_tags($form->name, '<lang><span>'));
-
-                $form->timestart = make_timestamp($form->startyr, $form->startmon, $form->startday, $form->starthr, $form->startmin);
-                if($form->duration == 1) {
-                    $form->timeduration = make_timestamp($form->endyr, $form->endmon, $form->endday, $form->endhr, $form->endmin) - $form->timestart;
-                    if($form->timeduration < 0) {
-                        $form->timeduration = 0;
-                    }
-                }
-                else if ($form->duration == 2) {
-                    $form->timeduration = $form->minutes * MINSECS;
-                }
-                else {
-                    $form->timeduration = 0;
-                }
-                if(!calendar_add_event_allowed($form)) {
-                    error('You are not authorized to do this');
-                }
+                // validate form and set error if any.
                validate_form($form, $err);
+
                if (count($err) == 0) {
+                    if (!calendar_add_event_allowed($form)) {
+                        error('You are not authorized to do this');
+                    }
                    $form->timemodified = time();

                    /// Get the event id for the log record.
@@ -568,11 +539,44 @@


 function validate_form(&$form, &$err) {
+    $cleanform = new stdClass();
+    //first clean the form values
+    $cleanform->name = clean_param(strip_tags(trim($form->name), '<lang><span>'),PARAM_CLEAN);
+    $cleanform->description = addslashes(clean_param($form->description, PARAM_CLEANHTML));
+    $cleanform->duration = clean_param($form->duration, PARAM_INT);
+    $cleanform->startmon = clean_param($form->startmon, PARAM_INT);
+    $cleanform->startday = clean_param($form->startday, PARAM_INT);
+    $cleanform->startyr = clean_param($form->startyr, PARAM_INT);
+    $cleanform->starthr = clean_param($form->starthr, PARAM_INT);
+    $cleanform->startmin = clean_param($form->startmin, PARAM_INT);
+    $cleanform->endmon = clean_param($form->endmon, PARAM_INT);
+    $cleanform->endday = clean_param($form->endday, PARAM_INT);
+    $cleanform->endyr = clean_param($form->endyr, PARAM_INT);
+    $cleanform->endhr = clean_param($form->endhr, PARAM_INT);
+    $cleanform->endmin = clean_param($form->endmin, PARAM_INT);
+    $cleanform->minutes = clean_param($form->minutes, PARAM_INT);
+    $cleanform->courseid = clean_param($form->courseid, PARAM_INT);
+    $cleanform->format = clean_param($form->format, PARAM_INT);
+    $cleanform->course = clean_param($form->course, PARAM_INT);
+    $cleanform->action = clean_param($form->action, PARAM_ALPHA);

-    $form->name = trim($form->name);
-    $form->description = trim($form->description);
+    // These values are only required for new event.
+    if ($cleanform->action === 'new') {
+        $cleanform->repeat = clean_param($form->repeat, PARAM_INT);
+        $cleanform->repeats = clean_param($form->repeats, PARAM_INT);
+        $cleanform->groupid = clean_param($form->groupid, PARAM_INT);
+        $cleanform->userid = clean_param($form->userid, PARAM_INT);
+        $cleanform->modulename = clean_param($form->modulename, PARAM_SAFEDIR);
+        $cleanform->eventtype = clean_param($form->eventtype, PARAM_ALPHA);
+        $cleanform->instance = clean_param($form->instance, PARAM_INT);
+        $cleanform->type = clean_param($form->type, PARAM_ALPHA);
+    } else {
+        $cleanform->id = clean_param($form->id, PARAM_INT);
+    }
+    // set form with clean and valid values only.
+    $form = $cleanform;

-    if(empty($form->name)) {
+    if (empty($form->name)) {
        $err['name'] = get_string('errornoeventname', 'calendar');
    }
 /* Allow events without a description
@@ -580,28 +584,53 @@ function validate_form(&$form, &$err) {
        $err['description'] = get_string('errornodescription', 'calendar');
    }
 */
-    if(!checkdate($form->startmon, $form->startday, $form->startyr)) {
+    if (!checkdate($form->startmon, $form->startday, $form->startyr)) {
        $err['timestart'] = get_string('errorinvaliddate', 'calendar');
    }
-    if($form->duration == 2 and !checkdate($form->endmon, $form->endday, $form->endyr)) {
+    if ($form->duration == 1 and !checkdate($form->endmon, $form->endday, $form->endyr)) {
        $err['timeduration'] = get_string('errorinvaliddate', 'calendar');
    }
-    if($form->duration == 2 and !($form->minutes > 0 and $form->minutes < 1000)) {
+    if ($form->duration == 2 and !($form->minutes > 0 and $form->minutes < 1000)) {
        $err['minutes'] = get_string('errorinvalidminutes', 'calendar');
    }
    if (!empty($form->repeat) and !($form->repeats > 1 and $form->repeats < 100)) {
        $err['repeats'] = get_string('errorinvalidrepeats', 'calendar');
    }
-    if(!empty($form->courseid)) {
+
+    // set start time and duration
+    $form->timestart = make_timestamp($form->startyr, $form->startmon, $form->startday, $form->starthr, $form->startmin);
+    if ($form->duration == 1) {
+        $form->timeduration = make_timestamp($form->endyr, $form->endmon, $form->endday, $form->endhr, $form->endmin) - $form->timestart;
+        // Duration should be set for time in future.
+        if ($form->timeduration <= 0) {
+            $err['timeduration'] = get_string('errorinvaliddate', 'calendar');
+            $form->timeduration = 0;
+        }
+    }
+    else if ($form->duration == 2) {
+        $form->timeduration = $form->minutes * MINSECS;
+    }
+    else {
+        $form->timeduration = 0;
+    }
+
+    if (!empty($form->courseid)) {
        // Timestamps must be >= course startdate
        $course = get_record('course', 'id', $form->courseid);
-        if($course === false) {
+        if ($course === false) {
            error('Event belongs to invalid course');
        }
        else if($form->timestart < $course->startdate) {
            $err['timestart'] = get_string('errorbeforecoursestart', 'calendar');
        }
    }
+    if (!empty($form->modulename)) {
+        // Check that passed modulename actually exists (possible SQL Injection route)
+        $module = get_record('modules', 'name', $form->modulename);
+        if ($module === false) {
+            error('Invalid module name');
+        }
+    }
 }

 function calendar_add_event_allowed($event) {
@@ -1582,6 +1582,7 @@ function calendar_get_allowed_types(&$allowed) {
    if(!empty($SESSION->cal_course_referer) && $SESSION->cal_course_referer != SITEID) {
        $course = get_record('course', 'id', $SESSION->cal_course_referer);
        $coursecontext = get_context_instance(CONTEXT_COURSE, $SESSION->cal_course_referer);
+        $allowed->user = has_capability('moodle/calendar:manageownentries', $coursecontext);

        if(has_capability('moodle/calendar:manageentries', $coursecontext)) {
            $allowed->courses = array($course->id => 1);
@@ -41,15 +41,14 @@
    require_once('../config.php');
    require_once($CFG->dirroot.'/calendar/lib.php');

-    $from = required_param('from');
-    $var = required_param('var');
-    $value = optional_param('value');
-    $id = optional_param('id');
-    $cal_d = optional_param('cal_d');
-    $cal_m = optional_param('cal_m');
-    $cal_y = optional_param('cal_y');
-    $action = optional_param('action');
-    $type = optional_param('type');
+    $from = required_param('from', PARAM_ALPHA);
+    $var = required_param('var', PARAM_ALPHA);
+    $id = optional_param('id', 0, PARAM_INT);
+    $cal_d = optional_param('cal_d', 0, PARAM_INT);
+    $cal_m = optional_param('cal_m', 0, PARAM_INT);
+    $cal_y = optional_param('cal_y', 0, PARAM_INT);
+    $action = optional_param('action', '', PARAM_ALPHA);
+    $type = optional_param('type', '', PARAM_ALPHA);

    // Initialize the session variables
    calendar_session_vars();
@@ -107,7 +106,7 @@

    switch($from) {
        case 'event':
-            redirect(CALENDAR_URL.'event.php?action='.$action.'&amp;type='.$type.'&amp;id='.intval($id));
+            redirect(CALENDAR_URL.'event.php?action='.$action.'&amp;type='.$type.'&amp;id='.$id);
        break;
        case 'month':
            redirect(CALENDAR_URL.'view.php?view=month'.$courseid.'&cal_d='.$cal_d.'&cal_m='.$cal_m.'&cal_y='.$cal_y);
@@ -119,7 +118,7 @@
            redirect(CALENDAR_URL.'view.php?view=day'.$courseid.'&cal_d='.$cal_d.'&cal_m='.$cal_m.'&cal_y='.$cal_y);
        break;
        case 'course':
-            redirect($CFG->wwwroot.'/course/view.php?id='.intval($id));
+            redirect($CFG->wwwroot.'/course/view.php?id='.$id);
        break;
        default:

@@ -426,7 +426,7 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course
    }

    // Now display all the calendar
-    for($day = 1; $day <= $display->maxdays; ++$day, ++$dayweek) {
+    for($aday = 1; $aday <= $display->maxdays; ++$aday, ++$dayweek) {
        if($dayweek > $display->maxwday) {
            // We need to change week (table row)
            echo "</tr>\n<tr>";
@@ -436,7 +436,7 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course

        // Reset vars
        $cell = '';
-        $dayhref = calendar_get_link_href(CALENDAR_URL.'view.php?view=day&amp;course='.$courseid.'&amp;', $day, $m, $y);
+        $dayhref = calendar_get_link_href(CALENDAR_URL.'view.php?view=day&amp;course='.$courseid.'&amp;', $aday, $m, $y);

        if(CALENDAR_WEEKEND & (1 << ($dayweek % 7))) {
            // Weekend. This is true no matter what the exact range is.
@@ -448,35 +448,35 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course
        }

        // Special visual fx if an event is defined
-        if(isset($eventsbyday[$day])) {
-            if(count($eventsbyday[$day]) == 1) {
+        if(isset($eventsbyday[$aday])) {
+            if(count($eventsbyday[$aday]) == 1) {
                $title = get_string('oneevent', 'calendar');
            }
            else {
-                $title = get_string('manyevents', 'calendar', count($eventsbyday[$day]));
+                $title = get_string('manyevents', 'calendar', count($eventsbyday[$aday]));
            }
-            $cell = '<div class="day"><a href="'.$dayhref.'" title="'.$title.'">'.$day.'</a></div>';
+            $cell = '<div class="day"><a href="'.$dayhref.'" title="'.$title.'">'.$aday.'</a></div>';
        }
        else {
-            $cell = '<div class="day">'.$day.'</div>';
+            $cell = '<div class="day">'.$aday.'</div>';
        }

        // Special visual fx if an event spans many days
-        if(isset($typesbyday[$day]['durationglobal'])) {
+        if(isset($typesbyday[$aday]['durationglobal'])) {
            $class .= ' duration_global';
        }
-        else if(isset($typesbyday[$day]['durationcourse'])) {
+        else if(isset($typesbyday[$aday]['durationcourse'])) {
            $class .= ' duration_course';
        }
-        else if(isset($typesbyday[$day]['durationgroup'])) {
+        else if(isset($typesbyday[$aday]['durationgroup'])) {
            $class .= ' duration_group';
        }
-        else if(isset($typesbyday[$day]['durationuser'])) {
+        else if(isset($typesbyday[$aday]['durationuser'])) {
            $class .= ' duration_user';
        }

        // Special visual fx for today
-        if($display->thismonth && $day == $d) {
+        if($display->thismonth && $aday == $d) {
            $class .= ' today';
        } else {
            $class .= ' nottoday';
@@ -488,9 +488,9 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course
        }
        echo '<td'.$class.'>'.$cell;

-        if(isset($eventsbyday[$day])) {
+        if(isset($eventsbyday[$aday])) {
            echo '<ul class="events-new">';
-            foreach($eventsbyday[$day] as $eventindex) {
+            foreach($eventsbyday[$aday] as $eventindex) {

                // If event has a class set then add it to the event <li> tag
                $eventclass = '';
@@ -502,9 +502,9 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course
            }
            echo '</ul>';
        }
-        if(isset($durationbyday[$day])) {
+        if(isset($durationbyday[$aday])) {
            echo '<ul class="events-underway">';
-            foreach($durationbyday[$day] as $eventindex) {
+            foreach($durationbyday[$aday] as $eventindex) {
                echo '<li>['.format_string($events[$eventindex]->name,true).']</li>';
            }
            echo '</ul>';
@@ -57,7 +57,7 @@
        if ($resort and confirm_sesskey()) {
            if ($courses = get_courses($category->id, "fullname ASC", 'c.id,c.fullname,c.sortorder')) {
                // move it off the range
-                
+
                $sortorderresult = get_record_sql('SELECT MIN(sortorder) AS min, 1
                                         FROM ' . $CFG->prefix . 'course WHERE category=' . $category->id);
                $sortordermin = $sortorderresult->min;
@@ -131,7 +131,10 @@
 /// Print current category description
    if (!$editingon && $category->description) {
        print_box_start();
-        echo format_text($category->description); // for multilang filter
+        $options = new stdClass();
+        $options->noclean = true;
+        $options->para = false;
+        echo format_text($category->description, FORMAT_MOODLE, $options); // for multilang filter
        print_box_end();
    }

@@ -61,6 +61,8 @@ if ($mform->is_cancelled()) {
        // Update an existing category.
        $newcategory->id = $category->id;
        if ($newcategory->parent != $category->parent) {
+            // check category manage capability if parent changed
+            require_capability('moodle/category:manage', get_category_or_system_context((int)$newcategory->parent));
            $parent_cat = get_record('course_categories', 'id', $newcategory->parent);
            move_category($newcategory, $parent_cat);
        }
@@ -9,11 +9,17 @@ class editcategory_form extends moodleform {
        $category = $this->_customdata;

        // get list of categories to use as parents, with site as the first one
-        $options = array(get_string('top'));
+        $options = array();
+        if (has_capability('moodle/category:manage', get_system_context()) || $category->parent == 0) {
+            $options[0] = get_string('top');
+        }
        $parents = array();
        if ($category->id) {
            // Editing an existing category.
            make_categories_list($options, $parents, 'moodle/category:manage', $category->id);
+            if (empty($options[$category->parent])) {
+               $options[$category->parent] = get_field('course_categories', 'name', 'id', $category->parent);
+            }
            $strsubmit = get_string('savechanges');
        } else {
            // Making a new category
@@ -21,7 +21,7 @@
 </tr>
 </table>
 <div class="singlebutton">
-<input type="hidden" name="id" value="<?php echo $form->id ?>" />
+<input type="hidden" name="id" value="<?php echo $id ?>" />
 <input type="hidden" name="sesskey" value="<?php echo sesskey() ?>" />
 <input type="submit" value="<?php print_string("savechanges") ?>" />
 </div>
@@ -54,7 +54,7 @@
    } else {
        $sectionname  = get_section_name($course->format);
        $stredit      = get_string('edit', '', " $sectionname $section->section");
-        $strsummaryof = get_string('summaryof', '', " $sectionname $form->section");
+        $strsummaryof = get_string('summaryof', '', " $sectionname $section->section");
    }

    print_header_simple($stredit, '', build_navigation(array(array('name' => $stredit, 'link' => null, 'type' => 'misc'))), 'theform.summary' );
@@ -53,7 +53,7 @@
    }

 /// Check if the course is a meta course  (bug 5734)
-    if ($course->metacourse) {
+    if ($course->metacourse && !($course->guest == 2 && isguestuser())) {
        print_header_simple();
        notice(get_string('coursenotaccessible'), "$CFG->wwwroot/index.php");
    }
@@ -5,6 +5,6 @@


 $CFG->ajaxcapable = true;
-$CFG->ajaxtestedbrowsers = array('MSIE' => 6.0, 'Gecko' => 20061111);
+$CFG->ajaxtestedbrowsers = array('MSIE' => 6.0, 'Gecko' => 20061111, 'Safari'=>531, 'Chrome'=>6.0);

 ?>
@@ -221,11 +221,11 @@
            echo '<td class="right side">';
            if ($displaysection == $section) {      // Show the zoom boxes
                echo '<a href="view.php?id='.$course->id.'&amp;topic=0#section-'.$section.'" title="'.$strshowalltopics.'">'.
-                     '<img src="'.$CFG->pixpath.'/i/all.gif" alt="'.$strshowalltopics.'" /></a><br />';
+                     '<img src="'.$CFG->pixpath.'/i/all.gif" class="icon topicall" alt="'.$strshowalltopics.'" /></a><br />';
            } else {
                $strshowonlytopic = get_string('showonlytopic', '', $section);
                echo '<a href="view.php?id='.$course->id.'&amp;topic='.$section.'" title="'.$strshowonlytopic.'">'.
-                     '<img src="'.$CFG->pixpath.'/i/one.gif" alt="'.$strshowonlytopic.'" /></a><br />';
+                     '<img src="'.$CFG->pixpath.'/i/one.gif" class="icon topicone" alt="'.$strshowonlytopic.'" /></a><br />';
            }

            if (isediting($course->id) && has_capability('moodle/course:update', get_context_instance(CONTEXT_COURSE, $course->id))) {
@@ -5,6 +5,6 @@


 $CFG->ajaxcapable = true;
-$CFG->ajaxtestedbrowsers = array('MSIE' => 6.0, 'Gecko' => 20061111);
+$CFG->ajaxtestedbrowsers = array('MSIE' => 6.0, 'Gecko' => 20061111, 'Safari'=>531, 'Chrome'=>6.0);

 ?>
@@ -523,7 +523,7 @@ function print_log_csv($course, $user, $date, $order='l.time DESC', $modname,
    header("Pragma: public");

    echo get_string('savedat').userdate(time(), $strftimedatetime)."\n";
-    echo $text;
+    echo $text."\n";

    if (empty($logs['logs'])) {
        return true;
@@ -186,7 +186,7 @@
                FROM (SELECT * FROM {$CFG->prefix}role_assignments WHERE contextid $relatedcontexts AND roleid = $roleid ) ra
                JOIN {$CFG->prefix}user u ON u.id = ra.userid
                LEFT JOIN (
-                    SELECT userid, COUNT(action) actioncount FROM {$CFG->prefix}log WHERE cmid = $instanceid AND time > $timefrom AND $actionsql GROUP BY userid
+                    SELECT userid, COUNT(action) AS actioncount FROM {$CFG->prefix}log WHERE cmid = $instanceid AND time > $timefrom AND $actionsql GROUP BY userid
                ) l ON (l.userid = ra.userid)";


@@ -87,7 +87,7 @@ Cron
 ====

 If your class offers a cron() method, it will be invoked by
-the standard Moodle cron every 5 minutes. Note that if the
+the standard Moodle cron every time it is called. Note that if the
 tasks are not lightweight you must control how frequently they
 execute, perhaps offering a config option.

@@ -71,7 +71,7 @@ class enrolment_plugin_authorize
            $curcost = get_course_cost($course);
            echo '<div class="mdl-align">';
            echo '<p>'.get_string('paymentrequired').'</p>';
-            echo '<p><b>'.get_string('cost').": $curcost[currency] $curcost[cost]".'</b></p>';
+            echo '<p><b>'.get_string('cost').': '. $curcost['currency'] . $curcost['localizedcost'] .'</b></p>';
            echo '<p><a href="'.$CFG->httpswwwroot.'/login/">'.get_string('loginsite').'</a></p>';
            echo '</div>';
        }
@@ -387,7 +387,7 @@ class enrolment_plugin_authorize
            }

            $str .= '<div class="cost" title="'.$strrequirespayment.'">'.$strcost.': ';
-            $str .= $currency . ' ' . $curcost['cost'].'</div>';
+            $str .= $currency . ' ' . $curcost['localizedcost'].'</div>';
        }

        return $str;
@@ -12,10 +12,11 @@ function get_course_cost($course)
    if (!empty($course->cost)) {
        $cost = (float)(((float)$course->cost) < 0) ? $CFG->enrol_cost : $course->cost;
    }
-
-    $cost = format_float($cost, 2);
+    $costlocalizeddisplay = format_float($cost, 2);
+    $cost = format_float($cost, 2, false);
    $ret = array(
        'cost' => $cost,
+        'localizedcost' => $costlocalizeddisplay,
        'currency' => $currency
    );

@@ -93,7 +93,7 @@ function setup_enrolments(&$user) {
                //error_log('[ENROL_DB] Found '.count($existing).' existing roles and '.$count.' in external database');

                foreach ($courselist as $coursefield) {   /// Check the list of courses against existing
-                    $course = get_record('course', $CFG->enrol_localcoursefield, $coursefield);
+                    $course = get_record('course', $CFG->enrol_localcoursefield, addslashes($coursefield));
                    if (!is_object($course)) {
                        if (empty($CFG->enrol_db_autocreate)) { // autocreation not allowed
                            if (debugging('',DEBUG_ALL)) {
@@ -157,13 +157,13 @@ function get_access_icons($course) {
                        continue;
                    }

-                    if (! $user = get_record("user", "idnumber", $fields[2]) ) {
+                    if (! $user = get_record("user", "idnumber", addslashes($fields[2])) ) {
                        $this->log .= "Unknown user idnumber in field 3 - ignoring line\n";
                        continue;
                    }


-                    if (! $course = get_record("course", "idnumber", $fields[3]) ) {
+                    if (! $course = get_record("course", "idnumber", addslashes($fields[3])) ) {
                        $this->log .= "Unknown course idnumber in field 4 - ignoring line\n";
                        continue;
                    }
@@ -4,8 +4,8 @@ require_once("$CFG->dirroot/enrol/enrol.class.php");

 class enrolment_plugin_ldap {

-    var $log;    
-    
+    var $log;
+
    var $enrol_localcoursefield = 'idnumber';

 /**
@@ -23,7 +23,7 @@ function setup_enrolments(&$user) {
        notify("[ENROL_LDAP] LDAP-module cannot connect to server: {$CFG->enrol_ldap_host_url}");
        return false;
    }
-    
+
    // we are connected OK, continue...

    // Get all the possible roles
@@ -37,7 +37,7 @@ function setup_enrolments(&$user) {
    if (!$roleassignments) {
        $roleassignments = array();
    }
-    
+
    // Get the ones that came from LDAP
    $ldap_assignments = array_filter($roleassignments, create_function('$x', 'return $x->enrol == \'ldap\';'));

@@ -46,20 +46,20 @@ function setup_enrolments(&$user) {
    // Get enrolments for each type of role from LDAP.
    foreach($roles as $role) {
        $enrolments = $this->find_ext_enrolments(
-            $ldap_connection, 
-            $user->idnumber , 
+            $ldap_connection,
+            $user->idnumber ,
            $role);

        //error_log('[ENROL_LDAP] LDAP reports ' . count($enrolments) . ' enrolments of type ' . $role->shortname . '.');

        foreach ($enrolments as $enrol){
-    
+
            $course_ext_id = $enrol[$CFG->enrol_ldap_course_idnumber][0];
            if(empty($course_ext_id)){
                error_log("[ENROL_LDAP] The course external id is invalid!\n");
                continue; // next; skip this one!
            }
-            
+
            // create the course  ir required
            $course_obj = get_record( 'course',
                                      $this->enrol_localcoursefield,
@@ -74,18 +74,18 @@ function setup_enrolments(&$user) {
                    error_log("[ENROL_LDAP] User $user->username enrolled to a nonexistant course $course_ext_id \n");
                }
            }
-            
+
            // deal with enrolment in the moodle db
-            if (!empty($course_obj)) { // does course exist now?     
-        
+            if (!empty($course_obj)) { // does course exist now?
+
                $context = get_context_instance(CONTEXT_COURSE, $course_obj->id);
                //$courseroles = get_user_roles($context, $user->id);
-            
+
                if (!get_record('role_assignments', 'roleid', $role->id, 'userid', $user->id, 'contextid', $context->id)) {
                    //error_log("[ENROL_LDAP] Assigning role '{$role->name}' to {$user->id} ({$user->username}) in course {$course_obj->id} ({$course_obj->shortname})");
                    if (!role_assign($role->id, $user->id, 0, $context->id, 0, 0, 0, 'ldap')){
                        error_log("[ENROL_LDAP] Failed to assign role '{$role->name}' to $user->id ($user->username) into course $course_obj->id ($course_obj->shortname)");
-                    } 
+                    }
                } else {
                    //error_log("[ENROL_LDAP] Role '{$role->name}' already assigned to {$user->id} ({$user->username}) in course {$course_obj->id} ({$course_obj->shortname})");
                }
@@ -115,7 +115,7 @@ function setup_enrolments(&$user) {
    @ldap_close($ldap_connection);

    //error_log('[ENROL_LDAP] finished with setup_enrolments');
-    
+
    return true;
 }

@@ -137,7 +137,7 @@ function sync_enrolments($type, $enrol = false) {
        notify("LDAP-module cannot connect to server: $CFG->ldap_host_url");
        return false;
    }
-    
+
    // we are connected OK, continue...
    $this->enrol_ldap_bind($ldap_connection);

@@ -145,7 +145,7 @@ function sync_enrolments($type, $enrol = false) {
    $ldap_contexts = explode(";",$CFG->{'enrol_ldap_contexts_role'.$role->id});

    // get all the fields we will want for the potential course creation
-    // as they are light. don't get membership -- potentially a lot of data. 
+    // as they are light. don't get membership -- potentially a lot of data.
    $ldap_fields_wanted = array( 'dn', $CFG->enrol_ldap_course_idnumber);
    if (!empty($CFG->enrol_ldap_course_fullname)){
        array_push($ldap_fields_wanted, $CFG->enrol_ldap_course_fullname);
@@ -161,11 +161,11 @@ function sync_enrolments($type, $enrol = false) {
    }

    // define the search pattern
-    if (!empty($CFG->enrol_ldap_objectclass)){ 
+    if (!empty($CFG->enrol_ldap_objectclass)){
        $ldap_search_pattern='(objectclass='.$CFG->enrol_ldap_objectclass.')';
    } else {
       $ldap_search_pattern="(objectclass=*)";
-        
+
    }

    // first, pack the sortorder...
@@ -176,19 +176,19 @@ function sync_enrolments($type, $enrol = false) {
        $context = trim($context);
        if ($CFG->enrol_ldap_search_sub){
            //use ldap_search to find first user from subtree
-            $ldap_result = @ldap_search($ldap_connection, 
-                                        $context, 
+            $ldap_result = @ldap_search($ldap_connection,
+                                        $context,
                                        $ldap_search_pattern,
                                        $ldap_fields_wanted);

        } else {
            //search only in this context
-            $ldap_result = @ldap_list($ldap_connection, 
-                                        $context, 
+            $ldap_result = @ldap_list($ldap_connection,
+                                        $context,
                                        $ldap_search_pattern,
                                        $ldap_fields_wanted,0,0);
        }
- 
+
        // check and push results
        $records = $ldap_result
            ? ldap_get_entries($ldap_connection,$ldap_result)
@@ -197,9 +197,9 @@ function sync_enrolments($type, $enrol = false) {
        // ldap libraries return an odd array, really. fix it:
        $flat_records=array();
        for ($c=0;$c<$records['count'];$c++) {
-            array_push($flat_records, $records["$c"]); 
+            array_push($flat_records, $records["$c"]);
        }
-        // free mem -- is there a leak? 
+        // free mem -- is there a leak?
        $records=0; $ldap_result=0;

        if (count($flat_records)) {
@@ -208,7 +208,7 @@ function sync_enrolments($type, $enrol = false) {
            foreach($flat_records as $course){
                $idnumber = $course{$CFG->enrol_ldap_course_idnumber}[0];
                print "== Synching $idnumber\n";
-                // does the course exist in moodle already? 
+                // does the course exist in moodle already?
                $course_obj = false;
                $course_obj = get_record( 'course',
                                          $this->enrol_localcoursefield,
@@ -237,22 +237,22 @@ function sync_enrolments($type, $enrol = false) {
                    $context = get_context_instance(CONTEXT_COURSE, $course_obj->id);

                    // pull the ldap membership into a nice array
-                    // this is an odd array -- mix of hash and array -- 
+                    // this is an odd array -- mix of hash and array --
                    $ldapmembers=array();

                    if(array_key_exists('enrol_ldap_memberattribute_role'.$role->id, $CFG)
                     && !empty($CFG->{'enrol_ldap_memberattribute_role'.$role->id})
                     && !empty($course[strtolower($CFG->{'enrol_ldap_memberattribute_role'.$role->id} ) ])){ // may have no membership!

-                        $ldapmembers = $course[strtolower($CFG->{'enrol_ldap_memberattribute_role'.$role->id} )]; 
+                        $ldapmembers = $course[strtolower($CFG->{'enrol_ldap_memberattribute_role'.$role->id} )];
                        unset($ldapmembers['count']); // remove oddity ;)
                        $ldapmembers = addslashes_recursive($ldapmembers);
                    }
-                    
+
                    // prune old ldap enrolments
                    // hopefully they'll fit in the max buffer size for the RDBMS
                    $sql = '
-                        SELECT enr.userid AS user, 1
+                        SELECT enr.userid
                        FROM '.$CFG->prefix.'role_assignments enr
                        JOIN '.$CFG->prefix.'user usr ON usr.id=enr.userid
                        WHERE enr.roleid = '.$role->id.'
@@ -266,7 +266,7 @@ function sync_enrolments($type, $enrol = false) {
                    $todelete = get_records_sql($sql);
                    if(!empty($todelete)){
                        foreach ($todelete as $member) {
-                            $member = $member->user;
+                            $member = $member->userid;

                            if (role_unassign($role->id, $member, 0, $context->id, 'ldap')) {
                                print "Unassigned $type from $member for course $course_obj->id ($course_obj->shortname)\n";
@@ -275,21 +275,21 @@ function sync_enrolments($type, $enrol = false) {
                            }
                        }
                    }
-                    
-                    // insert current enrolments 
+
+                    // insert current enrolments
                    // bad we can't do INSERT IGNORE with postgres...
                    foreach ($ldapmembers as $ldapmember) {
                        $sql = 'SELECT id,1 FROM '.$CFG->prefix.'user '
                                ." WHERE idnumber='$ldapmember'";
-                        $member = get_record_sql($sql); 
-//                        print "sql: $sql \nidnumber = ".stripslashes($ldapmember)." \n".var_dump($member); 
+                        $member = get_record_sql($sql);
+//                        print "sql: $sql \nidnumber = ".stripslashes($ldapmember)." \n".var_dump($member);
                        if(empty($member) || empty($member->id)){
                            print "Could not find user ".stripslashes($ldapmember).", skipping\n";
                            continue;
                        }
                        $member = $member->id;
-                        if (!get_record('role_assignments', 'roleid', $role->id, 
-                                        'contextid', $context->id, 
+                        if (!get_record('role_assignments', 'roleid', $role->id,
+                                        'contextid', $context->id,
                                        'userid', $member, 'enrol', 'ldap')){
                            if (role_assign($role->id, $member, 0, $context->id, 0, 0, 0, 'ldap')){
                                print "Assigned role $type to $member (".stripslashes($ldapmember).") for course $course_obj->id ($course_obj->shortname)\n";
@@ -302,10 +302,10 @@ function sync_enrolments($type, $enrol = false) {
            }
        }
    }
-    
+
    // we are done now, a bit of housekeeping
    fix_course_sortorder();
-    
+
    @ldap_close($ldap_connection);
    return true;
 }
@@ -321,7 +321,7 @@ function config_form($frm) {
    global $CFG;

    $this->check_legacy_config();
-    
+
    include("$CFG->dirroot/enrol/ldap/config.html");
 }

@@ -339,7 +339,7 @@ function process_config($config) {
        $config->enrol_ldap_version = '';
    }
    set_config('enrol_ldap_version', $config->enrol_ldap_version);
-    
+
    if (!isset ($config->enrol_ldap_bind_dn)) {
        $config->enrol_ldap_bind_dn = '';
    }
@@ -348,58 +348,58 @@ function process_config($config) {
    if (!isset ($config->enrol_ldap_bind_pw)) {
        $config->enrol_ldap_bind_pw = '';
    }
-    set_config('enrol_ldap_bind_pw', $config->enrol_ldap_bind_pw);    
-    
+    set_config('enrol_ldap_bind_pw', $config->enrol_ldap_bind_pw);
+
    if (!isset ($config->enrol_ldap_objectclass)) {
        $config->enrol_ldap_objectclass = '';
    }
-    set_config('enrol_ldap_objectclass', $config->enrol_ldap_objectclass);    
-    
+    set_config('enrol_ldap_objectclass', $config->enrol_ldap_objectclass);
+
    if (!isset ($config->enrol_ldap_category)) {
        $config->enrol_ldap_category  = '';
    }
-    set_config('enrol_ldap_category', $config->enrol_ldap_category);    
-    
+    set_config('enrol_ldap_category', $config->enrol_ldap_category);
+
    if (!isset ($config->enrol_ldap_template)) {
        $config->enrol_ldap_template = '';
    }
-    set_config('enrol_ldap_template', $config->enrol_ldap_template);    
-    
+    set_config('enrol_ldap_template', $config->enrol_ldap_template);
+
    if (!isset ($config->enrol_ldap_course_fullname)) {
        $config->enrol_ldap_course_fullname = '';
    }
-    set_config('enrol_ldap_course_fullname', $config->enrol_ldap_course_fullname);    
+    set_config('enrol_ldap_course_fullname', $config->enrol_ldap_course_fullname);

    if (!isset ($config->enrol_ldap_course_shortname)) {
        $config->enrol_ldap_course_shortname = '';
    }
-    set_config('enrol_ldap_course_shortname', $config->enrol_ldap_course_shortname);    
-    
+    set_config('enrol_ldap_course_shortname', $config->enrol_ldap_course_shortname);
+
    if (!isset ($config->enrol_ldap_course_summary)) {
        $config->enrol_ldap_course_summary = '';
    }
-    set_config('enrol_ldap_course_summary', $config->enrol_ldap_course_summary);    
-    
+    set_config('enrol_ldap_course_summary', $config->enrol_ldap_course_summary);
+
    if (!isset ($config->enrol_ldap_course_idnumber)) {
        $config->enrol_ldap_course_idnumber = '';
    }
-    set_config('enrol_ldap_course_idnumber', $config->enrol_ldap_course_idnumber); 
-    
+    set_config('enrol_ldap_course_idnumber', $config->enrol_ldap_course_idnumber);
+
    if (!isset ($config->enrol_localcoursefield)) {
        $config->enrol_localcoursefield = '';
    }
    set_config('enrol_localcoursefield', $config->enrol_localcoursefield);
-    
+
    if (!isset ($config->enrol_ldap_user_memberfield)) {
        $config->enrol_ldap_user_memberfield = '';
    }
-    set_config('enrol_ldap_user_memberfield', $config->enrol_ldap_user_memberfield); 
-    
+    set_config('enrol_ldap_user_memberfield', $config->enrol_ldap_user_memberfield);
+
    if (!isset ($config->enrol_ldap_search_sub)) {
        $config->enrol_ldap_search_sub = '0';
    }
-    set_config('enrol_ldap_search_sub', $config->enrol_ldap_search_sub); 
-    
+    set_config('enrol_ldap_search_sub', $config->enrol_ldap_search_sub);
+
    if (!isset ($config->enrol_ldap_autocreate)) {
        $config->enrol_ldap_autocreate = '0';
    }
@@ -410,11 +410,11 @@ function process_config($config) {
        if (!isset($config->{'enrol_ldap_contexts_role'.$role->id})) {
            $config->{'enrol_ldap_contexts_role'.$role->id} = '';
        }
-        
+
        if (!isset($config->{'enrol_ldap_memberattribute_role'.$role->id})) {
            $config->{'enrol_ldap_memberattribute_role'.$role->id} = '';
        }
-        
+
        set_config('enrol_ldap_contexts_role'.$role->id, $config->{'enrol_ldap_contexts_role'.$role->id});
        set_config('enrol_ldap_memberattribute_role'.$role->id, $config->{'enrol_ldap_memberattribute_role'.$role->id});
    }
@@ -435,7 +435,7 @@ function enrol_ldap_connect(){

        if (!empty($CFG->enrol_ldap_bind_dn)) {
            $bind = ldap_bind( $result,
-                                 $CFG->enrol_ldap_bind_dn, 
+                                 $CFG->enrol_ldap_bind_dn,
                                 $CFG->enrol_ldap_bind_pw );
            if (!$bind) {
                notify("Error in binding to LDAP server");
@@ -464,11 +464,11 @@ function enrol_ldap_bind($ldap_connection){
        }

    } else {
-        //bind anonymously 
+        //bind anonymously
        if ( !ldap_bind($ldap_connection)){
            notify("Error: could not bind ldap anonymously");
            return false;
-        }  
+        }
    }

    return true;
@@ -477,13 +477,13 @@ function enrol_ldap_bind($ldap_connection){
 function find_ext_enrolments ($ldap_connection, $memberuid, $role){
 /// role is a record from the mdl_role table
 /// return multidimentional array array with of courses (at least dn and idnumber)
-/// 
+///

    global $CFG;

    if(empty($memberuid)) { // No "idnumber" stored for this user, so no LDAP enrolments
        return array();
-    } 
+    }

    //default return value
    $courses = array();
@@ -493,7 +493,7 @@ function find_ext_enrolments ($ldap_connection, $memberuid, $role){
    $ldap_contexts = explode(";",$CFG->{'enrol_ldap_contexts_role'.$role->id});

    // get all the fields we will want for the potential course creation
-    // as they are light. don't get membership -- potentially a lot of data. 
+    // as they are light. don't get membership -- potentially a lot of data.
    $ldap_fields_wanted = array( 'dn', $CFG->enrol_ldap_course_idnumber);
    if (!empty($CFG->enrol_ldap_course_fullname)){
        array_push($ldap_fields_wanted, $CFG->enrol_ldap_course_fullname);
@@ -507,7 +507,7 @@ function find_ext_enrolments ($ldap_connection, $memberuid, $role){

    // define the search pattern
    $ldap_search_pattern = "(".$CFG->{'enrol_ldap_memberattribute_role'.$role->id}."=".$this->filter_addslashes($memberuid).")";
-    if (!empty($CFG->enrol_ldap_objectclass)){ 
+    if (!empty($CFG->enrol_ldap_objectclass)){
        $ldap_search_pattern='(&(objectclass='.$CFG->enrol_ldap_objectclass.')'.$ldap_search_pattern.')';
    }

@@ -516,31 +516,31 @@ function find_ext_enrolments ($ldap_connection, $memberuid, $role){
        if (empty($context)) {
            continue; // next;
        }
-        
+
        if ($CFG->enrol_ldap_search_sub){
            //use ldap_search to find first user from subtree
-            $ldap_result = ldap_search($ldap_connection, 
-                                        $context, 
+            $ldap_result = ldap_search($ldap_connection,
+                                        $context,
                                        $ldap_search_pattern,
                                        $ldap_fields_wanted);

        } else {
            //search only in this context
-            $ldap_result = ldap_list($ldap_connection, 
-                                        $context, 
+            $ldap_result = ldap_list($ldap_connection,
+                                        $context,
                                        $ldap_search_pattern,
                                        $ldap_fields_wanted);
        }
- 
+
        // check and push results
-        $records = ldap_get_entries($ldap_connection,$ldap_result);        
+        $records = ldap_get_entries($ldap_connection,$ldap_result);

        // ldap libraries return an odd array, really. fix it:
        $flat_records=array();
        for ($c=0;$c<$records['count'];$c++) {
-            array_push($flat_records, $records["$c"]); 
+            array_push($flat_records, $records["$c"]);
        }
-        
+
        if (count($flat_records)) {
            $courses = array_merge($courses, $flat_records);
        }
@@ -551,7 +551,7 @@ function find_ext_enrolments ($ldap_connection, $memberuid, $role){

 // will create the moodle course from the template
 // course_ext is an array as obtained from ldap -- flattened somewhat
-// NOTE: if you pass true for $skip_fix_course_sortorder 
+// NOTE: if you pass true for $skip_fix_course_sortorder
 // you will want to call fix_course_sortorder() after your are done
 // with course creation
 function create_course ($course_ext,$skip_fix_course_sortorder=0){
@@ -578,7 +578,7 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
    $course->shortname = $course_ext[$CFG->enrol_ldap_course_shortname][0];
    if (   empty($course->idnumber)
        || empty($course->fullname)
-        || empty($course->shortname) ) { 
+        || empty($course->shortname) ) {
        // we are in trouble!
        error_log("Cannot create course: missing required data from the LDAP record!");
         error_log(var_export($course, true));
@@ -588,10 +588,10 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
    $course->summary = empty($CFG->enrol_ldap_course_summary) || empty($course_ext[$CFG->enrol_ldap_course_summary][0])
        ? ''
        : $course_ext[$CFG->enrol_ldap_course_summary][0];
-    
+
    if(!empty($CFG->enrol_ldap_category)){ // optional ... but ensure it is set!
        $course->category = $CFG->enrol_ldap_category;
-    } 
+    }
    if ($course->category == 0){ // must be avoided as it'll break moodle
        $course->category = 1; // the misc 'catch-all' category
    }
@@ -600,13 +600,13 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
    $sort = get_record_sql('SELECT MAX(sortorder) AS max, 1 FROM ' . $CFG->prefix . 'course WHERE category=' . $course->category);
    $sort = $sort->max;
    $sort++;
-    $course->sortorder = $sort; 
+    $course->sortorder = $sort;

    // override with local data
    $course->startdate = time();
    $course->timecreated = time();
    $course->visible     = 1;
-    
+
    $course = addslashes_recursive($course);

    // store it and log
@@ -619,8 +619,8 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
        blocks_repopulate_page($page); // Return value no


-        if(!$skip_fix_course_sortorder){ 
-            fix_course_sortorder(); 
+        if(!$skip_fix_course_sortorder){
+            fix_course_sortorder();
        }
        add_to_log($newcourseid, "course", "new", "view.php?id=$newcourseid", "enrol/ldap auto-creation");
    } else {
@@ -628,7 +628,7 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
        notify("Serious Error! Could not create the new course!");
        return false;
    }
-    
+
    return $newcourseid;
 }

@@ -665,7 +665,7 @@ function check_legacy_config () {

        unset_config('enrol_ldap_teacher_contexts');
    }
-    
+
    if (isset($CFG->enrol_ldap_teacher_memberattribute)) {
        if (isset($teacher_role)
         or $teacher_role = get_record('role', 'shortname', 'teacher')) {
@@ -315,6 +315,7 @@ class enrolment_plugin_mnet {
            $userrecord->firstname  = addslashes($user['firstname']);
            $userrecord->lastname   = addslashes($user['lastname']);
            $userrecord->mnethostid = $MNET_REMOTE_CLIENT->id;
+            $userrecord->confirmed  = 1;

            if ($userrecord->id = insert_record('user', $userrecord)) {
                $userrecord = get_record('user','id', $userrecord->id);
@@ -13,7 +13,7 @@

      //TODO: Blog attachments do not have access control implemented - anybody can read them!
      //      It might be better to move the code to separate file because the access
-      //      control is quite complex - see bolg/index.php 
+      //      control is quite complex - see bolg/index.php

    require_once('config.php');
    require_once('lib/filelib.php');
@@ -29,7 +29,7 @@

    $relativepath = get_file_argument('file.php');
    $forcedownload = optional_param('forcedownload', 0, PARAM_BOOL);
-    
+
    // relative path must start with '/', because of backup/restore!!!
    if (!$relativepath) {
        error('No valid arguments supplied or incorrect server configuration');
@@ -39,12 +39,20 @@

    $pathname = $CFG->dataroot.$relativepath;

+    // protect imsenterprise plugin data
+    if (strtolower("$CFG->dataroot/1/imsenterprise-enrol.xml") === strtolower(realpath($pathname))
+        or (!empty($CFG->enrol_imsfilelocation) and strtolower($CFG->enrol_imsfilelocation) === strtolower(realpath($pathname)))) {
+        require_login();
+        require_capability('moodle/site:config', get_context_instance(CONTEXT_SYSTEM));
+        $forcedownload = 1;
+    }
+
    // extract relative path components
    $args = explode('/', trim($relativepath, '/'));
    if (count($args) == 0) { // always at least courseid, may search for index.html in course root
        error('No valid arguments supplied');
    }
-  
+
    // security: limit access to existing course subdirectories
    if (($args[0]!='blog') and (!$course = get_record_sql("SELECT * FROM {$CFG->prefix}course WHERE id='".(int)$args[0]."'"))) {
        error('Invalid course ID');
@@ -84,7 +92,7 @@
        if (!has_capability('moodle/site:backup', get_context_instance(CONTEXT_COURSE, $course->id))) {
            error('Access not allowed');
        } else {
-            $lifetime = 0; //disable browser caching for backups 
+            $lifetime = 0; //disable browser caching for backups
        }
    }

@@ -120,7 +128,7 @@
            if (!has_capability('mod/assignment:grade', get_context_instance(CONTEXT_MODULE, $cm->id))) {
                error('Access not allowed');
            }
-        } 
+        }
    }

    // security: force download of all attachments submitted by students
@@ -144,11 +152,11 @@
    }
    if ($args[0] == 'blog') {
        $forcedownload  = 1; // force download of all attachments
-    }    
+    }

    // security: some protection of hidden resource files
    // warning: it may break backwards compatibility
-    if ((!empty($CFG->preventaccesstohiddenfiles)) 
+    if ((!empty($CFG->preventaccesstohiddenfiles))
        and (count($args) >= 2)
        and (!(strtolower($args[1]) == 'moddata' and strtolower($args[2]) != 'resource')) // do not block files from other modules!
        and (!has_capability('moodle/course:viewhiddenactivities', get_context_instance(CONTEXT_COURSE, $course->id)))) {
@@ -8,8 +8,8 @@
 //  USER is a persistent variable using sessions

    require('../config.php');
-    require($CFG->libdir.'/filelib.php');
-    require($CFG->libdir.'/adminlib.php');
+    require_once($CFG->libdir . '/filelib.php');
+    require_once($CFG->libdir . '/adminlib.php');

    $id      = required_param('id', PARAM_INT);
    $file    = optional_param('file', '', PARAM_PATH);
@@ -539,7 +539,7 @@
                $file = basename($file);

                if (!unzip_file("$basedir$wdir/$file")) {
-                    print_error("unzipfileserror","error");
+                    print_error("cannotunzipfile", "error");
                }

                echo "<div style=\"text-align:center\"><form action=\"index.php\" method=\"get\">";
@@ -36,80 +36,80 @@ function mediaplugin_filter($courseid, $text) {
    $newtext = $text; // fullclone is slow and not needed here

    if ($CFG->filter_mediaplugin_enable_mp3) {
-        $search = '/<a.*?href="([^<]+\.mp3)"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.mp3)"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_mp3_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_ogg) {
-        $search =   '/<a[^>]*?href="([^<]+\.ogg)"[^>]*>.*?<\/a>/is';
+        $search =   '/<a\s[^>]*href="([^"]+\.ogg)"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'filter_mediaplugin_ogg_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_ogv) {
-        $search =   '/<a[^>]*?href="([^<]+\.ogv)"[^>]*>.*?<\/a>/is';
+        $search =   '/<a\s[^>]*href="([^"]+\.ogv)"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'filter_mediaplugin_ogv_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_swf) {
-        $search = '/<a.*?href="([^<]+\.swf)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.swf)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_swf_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_flv) {
-        $search = '/<a.*?href="([^<]+\.flv)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.flv)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_flv_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_mov) {
-        $search = '/<a.*?href="([^<]+\.mov)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.mov)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);

        // MDL-18658
-        $search = '/<a.*?href="([^<]+\.mp4)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.mp4)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);

-        $search = '/<a.*?href="([^<]+\.m4v)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.m4v)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);

-        $search = '/<a.*?href="([^<]+\.m4a)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^<]+\.m4a)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_wmv) {
-        $search = '/<a.*?href="([^<]+\.wmv)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.wmv)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_wmp_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_mpg) {
-        $search = '/<a.*?href="([^<]+\.mpe?g)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.mpe?g)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_avi) {
-        $search = '/<a.*?href="([^<]+\.avi)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.avi)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_wmp_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_ram) {
-        $search = '/<a.*?href="([^<]+\.ram)"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.ram)"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_real_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_rpm) {
-        $search = '/<a.*?href="([^<]+\.rpm)"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.rpm)"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_real_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_rm) {
-        $search = '/<a.*?href="([^<]+\.rm)"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.rm)"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_real_callback', $newtext);
    }

    if (!empty($CFG->filter_mediaplugin_enable_youtube)) {
-        $search = '/<a[^>]*?href="([^<]*)youtube.com\/watch\?v=([^"]*)"[^>]*>(.*?)<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]*)youtube.com\/watch\?v=([^"]*)"[^>]*>(.*?)<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_youtube_callback', $newtext);

-        $search = '/<a[^>]*?href="([^<]*)youtube.com\/v\/([^"]*)"[^>]*>(.*?)<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]*)youtube.com\/v\/([^"]*)"[^>]*>(.*?)<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_youtube_callback', $newtext);
    }

@@ -143,14 +143,15 @@ function mediaplugin_filter_mp3_callback($link) {
    static $count = 0;
    $count++;
    $id = 'filter_mp3_'.time().$count; //we need something unique because it might be stored in text cache
+    $url = $link[1];
+    $jsurl = addslashes_js($link[1]);

-    $url = addslashes_js($link[1]);
-
-    return $link[0].
+    $printlink = '<a href="'.$url.'">'.get_string('mp3audio', 'mediaplugin').'</a>';
+    return $printlink.
 '<span class="mediaplugin mediaplugin_mp3" id="'.$id.'">('.get_string('mp3audio', 'mediaplugin').')</span>
 <script type="text/javascript">
 //<![CDATA[
-  var FO = { movie:"'.$CFG->wwwroot.'/filter/mediaplugin/mp3player.swf?src='.$url.'",
+  var FO = { movie:"'.$CFG->wwwroot.'/filter/mediaplugin/mp3player.swf?src='.$jsurl.'",
    width:"90", height:"15", majorversion:"6", build:"40", flashvars:"'.$c.'", quality: "high" };
  UFO.create(FO, "'.$id.'");
 //]]>
@@ -158,38 +159,44 @@ function mediaplugin_filter_mp3_callback($link) {
 }

 function filter_mediaplugin_ogg_callback($link) {
-    global $CFG, $OUTPUT, $PAGE;
+    global $CFG;

    static $count = 0;
    $count++;
    $id = 'filter_ogg_'.time().$count; //we need something unique because it might be stored in text cache

-    $url = addslashes_js($link[1]);
-    $printlink = html_writer::link($url, get_string('oggaudio', 'filter_mediaplugin'));
-    $unsupportedplugins = get_string('unsupportedplugins', 'filter_mediaplugin', $printlink);
+    $url = $link[1];
+    $printlink = '<a href="'.$url.'">'.get_string('oggaudio', 'mediaplugin').'</a>';
+
+    $unsupportedplugins = get_string('unsupportedplugins', 'mediaplugin', $printlink);
    $output = <<<OET
+    <span class="mediaplugin mediaplugin_ogg" id="$id">
    <audio id="$id" src="$url" controls="true" width="100">
        $unsupportedplugins
    </audio>
+    </span>
 OET;

    return $output;
 }

 function filter_mediaplugin_ogv_callback($link) {
-    global $CFG, $OUTPUT, $PAGE;
+    global $CFG;

    static $count = 0;
    $count++;
    $id = 'filter_ogv_'.time().$count; //we need something unique because it might be stored in text cache

-    $url = addslashes_js($link[1]);
-    $printlink = html_writer::link($url, get_string('ogvvideo', 'filter_mediaplugin'));
-    $unsupportedplugins = get_string('unsupportedplugins', 'filter_mediaplugin', $printlink);
+    $url = $link[1];
+    $printlink = '<a href="'.$url.'">'.get_string('ogvvideo', 'mediaplugin').'</a>';
+
+    $unsupportedplugins = get_string('unsupportedplugins', 'mediaplugin', $printlink);
    $output = <<<OET
+    <span class="mediaplugin mediaplugin_ogv" id="$id">
    <video id="$id" src="$url" controls="true" width="600" >
        $unsupportedplugins
    </video>
+    </span>
 OET;

    return $output;
@@ -202,13 +209,15 @@ function mediaplugin_filter_swf_callback($link) {

    $width  = empty($link[3]) ? '400' : $link[3];
    $height = empty($link[4]) ? '300' : $link[4];
-    $url = addslashes_js($link[1]);
+    $url = $link[1];
+    $jsurl = addslashes_js($link[1]);
+    $printlink = '<a href="'.$url.'">'.get_string('flashvideo', 'mediaplugin').'</a>';

-    return $link[0].
+    return $printlink.
 '<span class="mediaplugin mediaplugin_swf" id="'.$id.'">('.get_string('flashanimation', 'mediaplugin').')</span>
 <script type="text/javascript">
 //<![CDATA[
-  var FO = { movie:"'.$url.'", width:"'.$width.'", height:"'.$height.'", majorversion:"6", build:"40",
+  var FO = { movie:"'.$jsurl.'", width:"'.$width.'", height:"'.$height.'", majorversion:"6", build:"40",
    allowscriptaccess:"never", quality: "high" };
  UFO.create(FO, "'.$id.'");
 //]]>
@@ -224,13 +233,15 @@ function mediaplugin_filter_flv_callback($link) {

    $width  = empty($link[3]) ? '480' : $link[3];
    $height = empty($link[4]) ? '360' : $link[4];
-    $url = addslashes_js($link[1]);
+    $url = $link[1];
+    $jsurl = addslashes_js($link[1]);
+    $printlink = '<a href="'.$url.'">'.get_string('flashvideo', 'mediaplugin').'</a>';

-    return $link[0].
+    return $printlink.
 '<span class="mediaplugin mediaplugin_flv" id="'.$id.'">('.get_string('flashvideo', 'mediaplugin').')</span>
 <script type="text/javascript">
 //<![CDATA[
-  var FO = { movie:"'.$CFG->wwwroot.'/filter/mediaplugin/flvplayer.swf?file='.$url.'",
+  var FO = { movie:"'.$CFG->wwwroot.'/filter/mediaplugin/flvplayer.swf?file='.$jsurl.'",
    width:"'.$width.'", height:"'.$height.'", majorversion:"6", build:"40",
    allowscriptaccess:"never", quality: "high", allowfullscreen: "true" };
  UFO.create(FO, "'.$id.'");
@@ -239,29 +250,31 @@ function mediaplugin_filter_flv_callback($link) {
 }

 function mediaplugin_filter_real_callback($link, $autostart=false) {
-    $url = addslashes_js($link[1]);
+    $url = $link[1];
+    $jsurl = addslashes_js($link[1]);
    $mimetype = mimeinfo('type', $url);
    $autostart = $autostart ? 'true' : 'false';
+    $printlink = '<a href="'.$url.'">'.get_string('realaudio', 'mediaplugin').'</a>';

 // embed kept for now see MDL-8674
-    return $link[0].
+    return $printlink.
 '<span class="mediaplugin mediaplugin_real">
 <script type="text/javascript">
 //<![CDATA[
 document.write(\'<object classid="clsid:CFCDAA03-8BE4-11cf-B84B-0020AFBBCCFA" width="240" height="180">\\
-  <param name="src" value="'.$url.'" />\\
+  <param name="src" value="'.$jsurl.'" />\\
  <param name="autostart" value="'.$autostart.'" />\\
  <param name="controls" value="imagewindow" />\\
  <param name="console" value="video" />\\
  <param name="loop" value="true" />\\
-  <embed src="'.$url.'" width="240" height="180" loop="true" type="'.$mimetype.'" controls="imagewindow" console="video" autostart="'.$autostart.'" />\\
+  <embed src="'.$jsurl.'" width="240" height="180" loop="true" type="'.$mimetype.'" controls="imagewindow" console="video" autostart="'.$autostart.'" />\\
  </object><br />\\
  <object classid="clsid:CFCDAA03-8BE4-11cf-B84B-0020AFBBCCFA" width="240" height="30">\\
-  <param name="src" value="'.$url.'" />\\
+  <param name="src" value="'.$jsurl.'" />\\
  <param name="autostart" value="'.$autostart.'" />\\
  <param name="controls" value="ControlPanel" />\\
  <param name="console" value="video" />\\
-  <embed src="'.$url.'" width="240" height="30" controls="ControlPanel" type="'.$mimetype.'" console="video" autostart="'.$autostart.'" />\\
+  <embed src="'.$jsurl.'" width="240" height="30" controls="ControlPanel" type="'.$mimetype.'" console="video" autostart="'.$autostart.'" />\\
  </object>\');
 //]]>
 </script></span>';
@@ -272,18 +285,20 @@ document.write(\'<object classid="clsid:CFCDAA03-8BE4-11cf-B84B-0020AFBBCCFA" wi
 */
 function mediaplugin_filter_youtube_callback($link, $autostart=false) {

-    $site = addslashes_js($link[1]);
-    $url = addslashes_js($link[2]);
-    $info = addslashes_js($link[3]);
+    $site = s($link[1]);
+    $url = $link[2];
+    $info = s($link[3]);

-    return '<object title="'.$info.'"
+    return '<span class="mediaplugin mediaplugin_youtube">'.
+           '<object title="'.$info.'"
                    class="mediaplugin mediaplugin_youtube" type="application/x-shockwave-flash"
                    data="'.$site.'youtube.com/v/'.$url.'&amp;fs=1&amp;rel=0" width="425" height="344">'.
           '<param name="movie" value="'.$site.'youtube.com/v/'.$url.'&amp;fs=1&amp;rel=0" />'.
           '<param name="FlashVars" value="playerMode=embedded" />'.
           '<param name="wmode" value="transparent" />'.
           '<param name="allowFullScreen" value="true" />'.
-           '</object>';
+           '</object>'.
+           '</span>';
 }

 /**
@@ -302,8 +317,9 @@ function mediaplugin_filter_wmp_callback($link, $autostart=false) {
    }
    $mimetype = mimeinfo('type', $url);
    $autostart = $autostart ? 'true' : 'false';
+    $printlink = '<a href="'.$url.'">'.get_string('wmpvideo', 'mediaplugin').'</a>';

-    return $link[0].
+    return $printlink.
 '<span class="mediaplugin mediaplugin_wmp">
 <object classid="CLSID:6BF52A52-394A-11d3-B153-00C04F79FAA6" '.$mpsize.'
  standby="Loading Microsoft(R) Windows(R) Media Player components..."
@@ -341,8 +357,9 @@ function mediaplugin_filter_qt_callback($link, $autostart=false) {
    }
    $mimetype = mimeinfo('type', $url);
    $autostart = $autostart ? 'true' : 'false';
+    $printlink = '<a href="'.$url.'">'.get_string('quicktime', 'mediaplugin').'</a>';

-    return $link[0].
+    return $printlink.
 '<span class="mediaplugin mediaplugin_qt">
 <object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"
  codebase="http://www.apple.com/qtactivex/qtplugin.cab" '.$size.'>
@@ -115,7 +115,7 @@ class edit_outcome_form extends moodleform {
            if (empty($courseid)) {
                $mform->hardFreeze('standard');

-            } else if (empty($outcome->courseid) and !has_capability('moodle/grade:manage', get_context_instance(CONTEXT_SYSTEM))) {
+            } else if (!has_capability('moodle/grade:manage', get_context_instance(CONTEXT_SYSTEM))) {
                $mform->hardFreeze('standard');

            } else if ($coursecount and empty($outcome->courseid)) {
@@ -54,13 +54,20 @@ class grade_export {
        $this->groupid = $groupid;
        $this->grade_items = grade_item::fetch_all(array('courseid'=>$this->course->id));

+        //Populating the columns here is required by /grade/export/(whatever)/export.php
+        //however index.php, when the form is submitted, will construct the collection here
+        //with an empty $itemlist then reconstruct it in process_form() using $formdata
        $this->columns = array();
        if (!empty($itemlist)) {
-            $itemids = explode(',', $itemlist);
-            // remove items that are not requested
-            foreach ($itemids as $itemid) {
-                if (array_key_exists($itemid, $this->grade_items)) {
-                    $this->columns[$itemid] =& $this->grade_items[$itemid];
+            if ($itemlist=='-1') {
+            //user deselected all items
+            } else {
+                $itemids = explode(',', $itemlist);
+                // remove items that are not requested
+                foreach ($itemids as $itemid) {
+                    if (array_key_exists($itemid, $this->grade_items)) {
+                        $this->columns[$itemid] =& $this->grade_items[$itemid];
+                    }
                }
            }
        } else {
@@ -87,9 +94,13 @@ class grade_export {

        $this->columns = array();
        if (!empty($formdata->itemids)) {
-            foreach ($formdata->itemids as $itemid=>$selected) {
-                if ($selected and array_key_exists($itemid, $this->grade_items)) {
-                    $this->columns[$itemid] =& $this->grade_items[$itemid];
+            if ($formdata->itemids=='-1') {
+                //user deselected all items
+            } else {
+                foreach ($formdata->itemids as $itemid=>$selected) {
+                    if ($selected and array_key_exists($itemid, $this->grade_items)) {
+                        $this->columns[$itemid] =& $this->grade_items[$itemid];
+                    }
                }
            }
        } else {
@@ -267,10 +278,14 @@ class grade_export {
     */
    function get_export_params() {
        $itemids = array_keys($this->columns);
+        $itemidsparam = implode(',', $itemids);
+        if (empty($itemidsparam)) {
+            $itemidsparam = '-1';
+        }

        $params = array('id'                =>$this->course->id,
                        'groupid'           =>$this->groupid,
-                        'itemids'           =>implode(',', $itemids),
+                        'itemids'           =>$itemidsparam,
                        'export_letters'    =>$this->export_letters,
                        'export_feedback'   =>$this->export_feedback,
                        'updatedgradesonly' =>$this->updatedgradesonly,
@@ -108,10 +108,14 @@ class graded_users_iterator {

        $users_sql = "SELECT u.* $ofields
                        FROM {$CFG->prefix}user u
-                             INNER JOIN {$CFG->prefix}role_assignments ra ON u.id = ra.userid
                             $groupsql
-                       WHERE ra.roleid $gradebookroles
-                             AND ra.contextid $relatedcontexts
+                        JOIN (
+                                 SELECT DISTINCT ra.userid
+                                   FROM {$CFG->prefix}role_assignments ra
+                                  WHERE ra.roleid $gradebookroles
+                                    AND ra.contextid $relatedcontexts
+                             ) rainner ON rainner.userid = u.id
+                       WHERE u.deleted = 0
                             $groupwheresql
                    ORDER BY $order";

@@ -123,13 +127,17 @@ class graded_users_iterator {

            $grades_sql = "SELECT g.* $ofields
                             FROM {$CFG->prefix}grade_grades g
-                                  INNER JOIN {$CFG->prefix}user u ON g.userid = u.id
-                                  INNER JOIN {$CFG->prefix}role_assignments ra ON u.id = ra.userid
+                             JOIN {$CFG->prefix}user u ON g.userid = u.id
                                  $groupsql
-                            WHERE ra.roleid $gradebookroles
-                                  AND ra.contextid $relatedcontexts
-                                  AND g.itemid IN ($itemids)
-                                  $groupwheresql
+                             JOIN (
+                                      SELECT DISTINCT ra.userid
+                                        FROM {$CFG->prefix}role_assignments ra
+                                       WHERE ra.roleid $gradebookroles
+                                         AND ra.contextid $relatedcontexts
+                                  ) rainner ON rainner.userid = u.id
+                            WHERE u.deleted = 0
+                              AND g.itemid IN ($itemids)
+                              $groupwheresql
                         ORDER BY $order, g.itemid ASC";
            $this->grades_rs = get_recordset_sql($grades_sql);
        } else {
@@ -14,15 +14,15 @@ function set_row(idx) {
 }

 /** highlight/unset the column of a table **/
-function set_col(col,gradecelloffset) {
+function set_col(col,gradecelloffset,lastheaderrow) {
    var table = document.getElementById('user-grades');

    //highlight the column header
-    flip_vmarked(table,2,col);
+    flip_vmarked(table,lastheaderrow,col);

    //add any grade cell offset (due to colspans) then iterate down the table
    col += gradecelloffset;
-    for (var row = 3; row < table.rows.length; row++) {
+    for (var row = lastheaderrow + 1; row < table.rows.length; row++) {
        flip_vmarked(table,row,col);
    }
 }
@@ -35,4 +35,4 @@ function flip_vmarked(table,row,col) {
            table.rows[row].cells[col].className += ' vmarked';
        }
    }
-}
+}
@@ -78,6 +78,10 @@ class grade_report_grader extends grade_report {
     * */
    var $canviewhidden;

+    /** @var boolean, whether the current user is allowed to see the user report.
+     * This affects the table layout. */
+    var $canviewuserreport;
+
    var $preferences_page=false;

    /**
@@ -93,6 +97,7 @@ class grade_report_grader extends grade_report {
        parent::grade_report($courseid, $gpr, $context, $page);

        $this->canviewhidden = has_capability('moodle/grade:viewhidden', get_context_instance(CONTEXT_COURSE, $this->course->id));
+        $this->canviewuserreport = has_capability('gradereport/'.$CFG->grade_profilereport.':view', $this->context);

        // load collapsed settings for this report
        if ($collapsed = get_user_preferences('grade_report_grader_collapsed_categories')) {
@@ -322,41 +327,38 @@ class grade_report_grader extends grade_report {
        global $CFG;

        if (is_numeric($this->sortitemid)) {
-            // the MAX() magic is required in order to please PG
-            $sort = "MAX(g.finalgrade) $this->sortorder";
-
-            $sql = "SELECT u.id, u.firstname, u.lastname, u.imagealt, u.picture, u.idnumber
-                      FROM {$CFG->prefix}user u
-                           JOIN {$CFG->prefix}role_assignments ra ON ra.userid = u.id
-                           $this->groupsql
-                           LEFT JOIN {$CFG->prefix}grade_grades g ON (g.userid = u.id AND g.itemid = $this->sortitemid)
-                     WHERE ra.roleid in ($this->gradebookroles) AND u.deleted = 0
-                           $this->groupwheresql
-                           AND ra.contextid ".get_related_contexts_string($this->context)."
-                  GROUP BY u.id, u.firstname, u.lastname, u.imagealt, u.picture, u.idnumber
-                  ORDER BY $sort";
-
+            $sortjoin = "LEFT JOIN {$CFG->prefix}grade_grades g ON " .
+                    "g.userid = u.id AND g.itemid = $this->sortitemid";
+            $sort = "g.finalgrade $this->sortorder";
        } else {
+            $sortjoin = '';
            switch($this->sortitemid) {
                case 'lastname':
-                    $sort = "u.lastname $this->sortorder, u.firstname $this->sortorder"; break;
+                    $sort = "u.lastname $this->sortorder, u.firstname $this->sortorder";
+                    break;
                case 'firstname':
-                    $sort = "u.firstname $this->sortorder, u.lastname $this->sortorder"; break;
+                    $sort = "u.firstname $this->sortorder, u.lastname $this->sortorder";
+                    break;
                case 'idnumber':
                default:
-                    $sort = "u.idnumber $this->sortorder"; break;
+                    $sort = "u.idnumber $this->sortorder";
+                    break;
            }
-
-            $sql = "SELECT DISTINCT u.id, u.firstname, u.lastname, u.imagealt, u.picture, u.idnumber
-                      FROM {$CFG->prefix}user u
-                           JOIN {$CFG->prefix}role_assignments ra ON u.id = ra.userid
-                           $this->groupsql
-                     WHERE ra.roleid in ($this->gradebookroles)
-                           $this->groupwheresql
-                           AND ra.contextid ".get_related_contexts_string($this->context)."
-                  ORDER BY $sort";
        }

+        $sql = "SELECT u.id, u.firstname, u.lastname, u.imagealt, u.picture, u.idnumber
+                  FROM {$CFG->prefix}user u
+                       $this->groupsql
+                       $sortjoin
+                  JOIN (
+                           SELECT DISTINCT ra.userid
+                             FROM {$CFG->prefix}role_assignments ra
+                            WHERE ra.roleid IN ($this->gradebookroles)
+                              AND ra.contextid " . get_related_contexts_string($this->context) . "
+                       ) rainner ON rainner.userid = u.id
+                 WHERE u.deleted = 0
+                   $this->groupwheresql
+              ORDER BY $sort";

        $this->users = get_records_sql($sql, $this->get_pref('studentsperpage') * $this->page,
                            $this->get_pref('studentsperpage'));
@@ -662,14 +664,15 @@ class grade_report_grader extends grade_report {
                    //The width of the table varies depending on fixedstudents.
                    // $fixedstudents == 0, students and grades display in the same table.
                    // $fixedstudents == 1, students and grades are display in separate table.
-                    if ($fixedstudents) {
+                    if ($fixedstudents || !$this->canviewuserreport) {
                        $incrementcellindex = '0';
                    } else {
                        $incrementcellindex = '1';
                    }
                    //MDL-21088 - IE 7 ignores nowraps on tds or ths so we this in a span with a nowrap on it.
-                    $headerhtml .= '<th class=" '.$columnclass.' '.$type.$catlevel.$hidden.'" scope="col" onclick="set_col(this.cellIndex,' . $incrementcellindex . ')"><span>'
-                                .shorten_text($headerlink) . $arrow;
+                    $headerhtml .= '<th class=" '.$columnclass.' '.$type.$catlevel.$hidden.
+                            '" scope="col" onclick="set_col(this.cellIndex,' . $incrementcellindex . ',' . (count($this->gtree->levels) - 1) .
+                            ')"><span>' . shorten_text($headerlink) . $arrow;
                    $headerhtml .= '</span></th>';
                }

@@ -745,7 +748,7 @@ class grade_report_grader extends grade_report {
                //we're either going to add a th or a colspan to keep things aligned
                $userreportcell = '';
                $userreportcellcolspan = '';
-                if (has_capability('gradereport/'.$CFG->grade_profilereport.':view', $this->context)) {
+                if ($this->canviewuserreport) {
                    $a->user = fullname($user, $canviewfullname);
                    $strgradesforuser = get_string('gradesforuser', 'grades', $a);
                    $userreportcell = '<th class="header userreport"><a href="'.$CFG->wwwroot.'/grade/report/'.$CFG->grade_profilereport.'/index.php?id='.$this->courseid.'&amp;userid='.$user->id.'">'
@@ -1032,7 +1035,7 @@ class grade_report_grader extends grade_report {
                //either add a th or a colspan to keep things aligned
                $userreportcell = '';
                $userreportcellcolspan = '';
-                if (has_capability('gradereport/'.$CFG->grade_profilereport.':view', $this->context)) {
+                if ($this->canviewuserreport) {
                    $a->user = fullname($user, $canviewfullname);
                    $strgradesforuser = get_string('gradesforuser', 'grades', $a);
                    $userreportcell = '<th class="userreport"><a href="'.$CFG->wwwroot.'/grade/report/'.$CFG->grade_profilereport.'/index.php?id='.$this->courseid.'&amp;userid='.$user->id.'">'
@@ -1146,20 +1149,24 @@ class grade_report_grader extends grade_report {
        if ($showaverages) {

            // find sums of all grade items in course
-            $SQL = "SELECT g.itemid, SUM(g.finalgrade) AS sum
+            $sql = "SELECT g.itemid, SUM(g.finalgrade) AS sum
                      FROM {$CFG->prefix}grade_items gi
-                           JOIN {$CFG->prefix}grade_grades g      ON g.itemid = gi.id
-                           JOIN {$CFG->prefix}user u              ON u.id = g.userid
-                           JOIN {$CFG->prefix}role_assignments ra ON ra.userid = u.id
+                           JOIN {$CFG->prefix}grade_grades g ON g.itemid = gi.id
+                           JOIN {$CFG->prefix}user u ON u.id = g.userid
                           $groupsql
-                     WHERE gi.courseid = $this->courseid
-                           AND ra.roleid in ($this->gradebookroles)
-                           AND ra.contextid ".get_related_contexts_string($this->context)."
-                           AND g.finalgrade IS NOT NULL
-                           $groupwheresql
+                           JOIN (
+                               SELECT DISTINCT ra.userid
+                                 FROM {$CFG->prefix}role_assignments ra
+                                WHERE ra.roleid IN ($this->gradebookroles)
+                                  AND ra.contextid " . get_related_contexts_string($this->context) . "
+                           ) rainner ON rainner.userid = u.id
+                       WHERE gi.courseid = $this->courseid
+                       AND u.deleted = 0
+                       AND g.finalgrade IS NOT NULL
+                       $groupwheresql
                  GROUP BY g.itemid";
            $sum_array = array();
-            if ($sums = get_records_sql($SQL)) {
+            if ($sums = get_records_sql($sql)) {
                foreach ($sums as $itemid => $csum) {
                    $sum_array[$itemid] = $csum->sum;
                }
@@ -1171,20 +1178,21 @@ class grade_report_grader extends grade_report {

            // MDL-10875 Empty grades must be evaluated as grademin, NOT always 0
            // This query returns a count of ungraded grades (NULL finalgrade OR no matching record in grade_grades table)
-            $SQL = "SELECT gi.id, COUNT(u.id) AS count
+            $sql = "SELECT gi.id, COUNT(DISTINCT u.id) AS count
                      FROM {$CFG->prefix}grade_items gi
                           CROSS JOIN {$CFG->prefix}user u
-                           JOIN {$CFG->prefix}role_assignments ra        ON ra.userid = u.id
-                           LEFT OUTER JOIN  {$CFG->prefix}grade_grades g ON (g.itemid = gi.id AND g.userid = u.id AND g.finalgrade IS NOT NULL)
+                           JOIN {$CFG->prefix}role_assignments ra       ON ra.userid = u.id
+                           LEFT OUTER JOIN {$CFG->prefix}grade_grades g ON g.itemid = gi.id AND g.userid = u.id AND g.finalgrade IS NOT NULL
                           $groupsql
                     WHERE gi.courseid = $this->courseid
-                           AND ra.roleid in ($this->gradebookroles)
-                           AND ra.contextid ".get_related_contexts_string($this->context)."
+                           AND ra.roleid IN ($this->gradebookroles)
+                           AND u.deleted = 0
+                           AND ra.contextid " . get_related_contexts_string($this->context) . "
                           AND g.id IS NULL
                           $groupwheresql
                  GROUP BY gi.id";

-            $ungraded_counts = get_records_sql($SQL);
+            $ungraded_counts = get_records_sql($sql);

            $fixedstudents = $this->is_fixed_students();
            if (!$fixedstudents) {
@@ -100,7 +100,8 @@ class grade_report_user extends grade_report {
        $this->showpercentage  = grade_get_setting($this->courseid, 'report_user_showpercentage', $CFG->grade_report_user_showpercentage);
        $this->showhiddenitems = grade_get_setting($this->courseid, 'report_user_showhiddenitems', $CFG->grade_report_user_showhiddenitems);
        $this->showtotalsifcontainhidden = grade_get_setting($this->courseid, 'report_user_showtotalsifcontainhidden', $CFG->grade_report_user_showtotalsifcontainhidden);
-
+        
+        //comment this out to hide the range column on the user report. Control of this via a setting was added to 2.0 (MDL-20617)
        $this->showrange = true;

        $this->switch = grade_get_setting($this->courseid, 'aggregationposition', $CFG->grade_aggregationposition);
@@ -208,7 +208,7 @@
                            $subtext = get_string('subscribe', 'forum');
                        }
                        print_heading_block($newsforum->name);
-                        echo '<div class="subscribelink"><a href="mod/forum/subscribe.php?id='.$newsforum->id.'">'.$subtext.'</a></div>';
+                        echo '<div class="subscribelink"><a href="mod/forum/subscribe.php?id='.$newsforum->id.'&amp;sesskey='.sesskey().'">'.$subtext.'</a></div>';
                    } else {
                        print_heading_block($newsforum->name);
                    }
@@ -633,7 +633,7 @@ if (isset($_GET['help'])) {
                    echo '<div id="mssql">' . get_string('databasesettingssub_mssql', 'install');
                /// Link to mssql installation page
                    echo "<p style='text-align:right'><a href=\"javascript:void(0)\" ";
-                    echo "onclick=\"return window.open('http://docs.moodle.org/en/Installing_MSSQL_for_PHP')\"";
+                    echo "onclick=\"return window.open('http://docs.moodle.org/19/en/Installing_MSSQL_for_PHP')\"";
                    echo ">";
                    echo '<img src="pix/docs.gif' . '" alt="Docs" class="iconhelp" />';
                    echo get_string('moodledocslink', 'install') . '</a></p>';
@@ -642,7 +642,7 @@ if (isset($_GET['help'])) {
                    echo '<div id="mssql_n">' . get_string('databasesettingssub_mssql_n', 'install');
                /// Link to mssql installation page
                    echo "<p style='text-align:right'><a href=\"javascript:void(0)\" ";
-                    echo "onclick=\"return window.open('http://docs.moodle.org/en/Installing_MSSQL_for_PHP')\"";
+                    echo "onclick=\"return window.open('http://docs.moodle.org/19/en/Installing_MSSQL_for_PHP')\"";
                    echo ">";
                    echo '<img src="pix/docs.gif' . '" alt="Docs" />';
                    echo get_string('moodledocslink', 'install') . '</a></p>';
@@ -651,7 +651,7 @@ if (isset($_GET['help'])) {
                    echo '<div id="odbc_mssql">'. get_string('databasesettingssub_odbc_mssql', 'install');
                /// Link to mssql installation page
                    echo "<p style='text-align:right'><a href=\"javascript:void(0)\" ";
-                    echo "onclick=\"return window.open('http://docs.moodle.org/en/Installing_MSSQL_for_PHP')\"";
+                    echo "onclick=\"return window.open('http://docs.moodle.org/19/en/Installing_MSSQL_for_PHP')\"";
                    echo ">";
                    echo '<img src="pix/docs.gif' . '" alt="Docs" class="iconhelp" />';
                    echo get_string('moodledocslink', 'install') . '</a></p>';
@@ -660,7 +660,7 @@ if (isset($_GET['help'])) {
                    echo '<div id="oci8po">' . get_string('databasesettingssub_oci8po', 'install');
                /// Link to oracle installation page
                    echo "<p style='text-align:right'><a href=\"javascript:void(0)\" ";
-                    echo "onclick=\"return window.open('http://docs.moodle.org/en/Installing_Oracle_for_PHP')\"";
+                    echo "onclick=\"return window.open('http://docs.moodle.org/19/en/Installing_Oracle_for_PHP')\"";
                    echo ">";
                    echo '<img src="pix/docs.gif' . '" alt="Docs" class="iconhelp" />';
                    echo get_string('moodledocslink', 'install') . '</a></p>';
@@ -16,7 +16,7 @@ To add more languages to Moodle, you can either:

 For more information, see the Moodle Documentation:

-   http://docs.moodle.org/en/Translation
+   http://docs.moodle.org/19/en/Translation


 Cheers,
@@ -114,7 +114,7 @@ $string['configdisablecourseajax'] = 'Do not use AJAX when editing main course p
 $string['configenablecalendarexport'] = 'Enable exporting or subscribing to calendars.';
 $string['configenablecourserequests'] = 'This will allow any user to request a course be created.';
 $string['configenableglobalsearch'] = 'This setting enables global text searching in resources and activities, it is not compatible with PHP 4.';
-$string['configenablegroupings'] = 'This setting enables groupings of groups.';
+$string['configenablegroupings'] = 'This setting enables the creation of groupings and the \'Available for group members only\' option. Groupings are a standard feature in Moodle 2.0 onwards whereas \'Available for group members only\' remains an experimental feature.';
 $string['configenablehtmlpurifier'] = 'Use HTML Purifier instead of KSES for cleaning of untrusted text. HTML Purifier is actively developed and is believed to be more secure, but it is more resource intensive. Expect minor visual differences in the resulting html code. Please note that embed and object tags can not be enabled, MathML tags and old lang tags are not supported. ';
 $string['configenablerssfeeds'] = 'This switch will enable RSS feeds from across the site.  To actually see any change you will need to enable RSS feeds in the individual modules too - go to the Modules settings under Admin Configuration.';
 $string['configenablerssfeedsdisabled'] = 'It is not available because RSS feeds are disabled in all the Site. To enable them, go to the Variables settings under Admin Configuration.';
@@ -209,8 +209,8 @@ $string['configcronremotepassword'] = 'This means that the cron.php script canno
 </pre>If this is left empty, no password is required.';
 $string['configrcache'] = 'Use the cache to store database records. Remember to set \'cachetype\' as well!';
 $string['configrcachettl'] = 'Time-to-live for cached records, in seconds. Use a short (&lt;15) value here.';
-$string['configrecaptchaprivatekey'] = 'String of characters used to communicate between your Moodle server and the recaptcha.net server. Obtain one for this site by visiting http://recaptcha.net';
-$string['configrecaptchapublickey'] = 'String of characters used to display the reCAPTCHA element in the signup form. Generated by http://recaptcha.net';
+$string['configrecaptchaprivatekey'] = 'String of characters used to communicate between your Moodle server and the recaptcha server. Obtain one for this site by visiting http://www.google.com/recaptcha';
+$string['configrecaptchapublickey'] = 'String of characters used to display the reCAPTCHA element in the signup form. Generated by http://www.google.com/recaptcha';
 $string['configregenloginsession'] = 'Regeneration of the session id during each login request is highly recommended for security reasons. This setting might not be compatible with some authentication plugins.';
 $string['configrequestedstudentname'] = 'Word for student used in requested courses';
 $string['configrequestedstudentsname'] = 'Word for students used in requested courses';
@@ -358,7 +358,7 @@ $string['enableajax'] = 'Enable AJAX';
 $string['enablecalendarexport'] = 'Enable calendar export';
 $string['enablecourserequests'] = 'Enable course requests';
 $string['enableglobalsearch'] = 'Enable global search';
-$string['enablegroupings'] = 'Enable groupings';
+$string['enablegroupings'] = 'Enable groupings and \'Available for group members only\'';
 $string['enablehtmlpurifier'] = 'Enable HTML Purifier';
 $string['enablerecordcache'] = 'Enable Record Cache';
 $string['enablerssfeeds'] = 'Enable RSS feeds';
@@ -396,6 +396,8 @@ $string['filtersettings'] = 'Manage filters';
 $string['filtersettingsgeneral'] = 'General filter settings';
 $string['filteruploadedfiles'] = 'Filter uploaded files';
 $string['forcelogin'] = 'Force users to login';
+$string['forceloginforprofileimage'] = 'Force users to login to view user pictures';
+$string['forceloginforprofileimage_help'] = 'If enabled, users must login in order to view user profile pictures and the default user picture will be used in all notification emails.';
 $string['forceloginforprofiles'] = 'Force users to login for profiles';
 $string['forcetimezone'] = 'Force default timezone';
 $string['framename'] = 'Frame name';
@@ -493,6 +495,8 @@ $string['location'] = 'Location';
 $string['locationsettings'] = 'Location settings';
 $string['log'] = 'Logs';
 $string['loginhttps'] = 'Use HTTPS for logins';
+$string['loginpasswordautocomplete'] = 'Prevent password autocompletion on login form.';
+$string['loginpasswordautocomplete_help'] = 'Having this off will let users save their account password in their browser. Switching this setting on will result in your site no longer following XHTML strict validation rules.';
 $string['loglifetime'] = 'Keep logs for';
 $string['longtimenosee'] = 'Unsubscribe users from courses after';
 $string['longtimewarning'] = '<b>Please note that this process can take a long time.</b>';
@@ -588,6 +592,7 @@ $string['performance'] = 'Performance';
 $string['pgcluster'] = 'PostgreSQL Cluster';
 $string['pgclusterdescription'] = 'PostgreSQL version/cluster parameter for command line operations. If you only have one postgresql on your system or you are not sure what this is, leave this blank.';
 $string['php50restricted'] = 'PHP 5.0.x has a number of known problems, please upgrade to 5.1.x or downgrade to 4.3.x or 4.4.x';
+$string['php533warning'] = 'PHP 5.3.3 and upwards is recommended';
 $string['phpfloatproblem'] = 'Detected unexpected problem in handling of PHP float numbers - $a';
 $string['pleaseregister'] = 'Please register your site to remove this button';
 $string['pleaserefreshregistration'] = 'Your site has been registered with moodle.org, please consider updating the registration if significant changes happened since your last update, on $a';
@@ -769,7 +774,7 @@ $string['uploadpicture_userupdated'] = 'Picture updated for user $a.';
 $string['uploadpicture_cannotsave'] = 'Cannot save picture for user $a. Check original picture file.';
 $string['updatetimezones'] = 'Update timezones';
 $string['upgrade197notice'] = '<p>Moodle 1.9.7 contains a number of security fixes to user passwords and backups to protect the user data on your site. As a result some of your settings and permissions relating to backups may have changed.<br />
-See the <a href=\"http://docs.moodle.org/en/Moodle_1.9.7_release_notes\" target=\"_blank\">Moodle 1.9.7 release notes</a> for full details.</p>';
+See the <a href=\"http://docs.moodle.org/dev/Moodle_1.9.7_release_notes\" target=\"_blank\">Moodle 1.9.7 release notes</a> for full details.</p>';
 $string['upgrade197noticesubject'] = 'Moodle 1.9.7 upgrade security notices';
 $string['upgrade197salt'] = 'To reduce the risk of password theft, you are strongly recommended to set a password salt.<br />See the <a href=\"$a\" target=\"_blank\">password salting documentation</a> for details.';
 $string['upgradeforumread'] = 'A new feature has been added in Moodle 1.5 to track read/unread forum posts.<br />To use this functionality you need to <a href=\"$a\">update your tables</a>.';
@@ -36,9 +36,14 @@ $string['auth_nologintitle'] = 'No login';
 $string['auth_cas_proxycas_key'] = "Proxy mode";
 $string['auth_cas_logoutcas_key'] = "Logout CAS";
 $string['auth_cas_multiauth_key'] = "Multi-authentication";
-$string['auth_cas_proxycas'] = "Turn this to 'yes'' if you use CASin proxy-mode";
-$string['auth_cas_logoutcas'] = "Turn this to 'yes'' if tou want to logout from CAS when you deconnect from Moodle";
-$string['auth_cas_multiauth'] = "Turn this to 'yes'' if you want to have multi-authentication (CAS + other authentication)";
+$string['auth_cas_certificate_check_key'] = "Server validation";
+$string['auth_cas_certificate_path_key'] = "Certificate path";
+$string['auth_cas_proxycas'] = "Turn this to ''yes'' if you use CASin proxy-mode";
+$string['auth_cas_logoutcas'] = "Turn this to ''yes'' if tou want to logout from CAS when you deconnect from Moodle";
+$string['auth_cas_multiauth'] = "Turn this to ''yes'' if you want to have multi-authentication (CAS + other authentication)";
+$string['auth_cas_certificate_check'] = "Turn this to ''yes'' if you want to validate the server certificate";
+$string['auth_cas_certificate_path'] = "Path of the CA chain file (PEM Format) to validate the server certificate";
+$string['auth_cas_certificate_path_empty'] = "If you turn on Server validation, you need to specify a certificate path";
 $string['accesCAS'] = "CAS users";
 $string['accesNOCAS'] = "other users";
 $string['CASform'] = "Authentication choice";
@@ -120,7 +125,7 @@ $string['auth_emailnowexists'] = 'The email address you tried to assign to your
 $string['auth_emailtitle'] = 'Email-based self-registration';
 $string['auth_emailnoinsert'] = 'Could not add your record to the database!';
 $string['auth_emailnoemail'] = 'Tried to send you an email but failed!';
-$string['auth_emailrecaptcha'] = 'Adds a visual/audio confirmation form element to the signup page for email self-registering users. This protects your site against spammers and contributes to a worthwhile cause. See http://recaptcha.net/learnmore.html for more details. <br /><em>PHP cURL extension is required.</em>';
+$string['auth_emailrecaptcha'] = 'Adds a visual/audio confirmation form element to the signup page for email self-registering users. This protects your site against spammers and contributes to a worthwhile cause. See http://www.google.com/recaptcha/learnmore for more details. <br /><em>PHP cURL extension is required.</em>';
 $string['auth_emailrecaptcha_key'] = 'Enable reCAPTCHA element';
 $string['auth_emailsettings'] = 'Settings';
 $string['auth_emailupdatemessage'] = 'Dear $a->fullname,
@@ -251,11 +256,11 @@ $string['auth_ldaptitle'] = 'LDAP server';
 $string['auth_ldapnotinstalled'] = 'Cannot use LDAP authentication. The PHP LDAP module is not installed.';
 $string['auth_ntlmsso'] = 'NTLM SSO';
 $string['auth_ntlmsso_enabled_key'] = 'Enable';
-$string['auth_ntlmsso_enabled'] = 'Set to yes to attempt Single Sign On with the NTLM domain. <strong>Note:</strong> this requires additional setup on the webserver to work, see <a href=\"http://docs.moodle.org/en/NTLM_authentication\">http://docs.moodle.org/en/NTLM_authentication</a>';
+$string['auth_ntlmsso_enabled'] = 'Set to yes to attempt Single Sign On with the NTLM domain. <strong>Note:</strong> this requires additional setup on the webserver to work, see <a href=\"http://docs.moodle.org/19/en/NTLM_authentication\">http://docs.moodle.org/19/en/NTLM_authentication</a>';
 $string['auth_ntlmsso_ie_fastpath'] = 'Set to yes to enable the NTLM SSO fast path (bypasses certain steps and only works if the client\'s browser is MS Internet Explorer).';
 $string['auth_ntlmsso_ie_fastpath_key'] = 'MS IE fast path?';
 $string['auth_ntlmsso_subnet_key'] = 'Subnet';
-$string['auth_ntlmsso_subnet'] = 'If set, it will only attempt SSO with clients in this subnet. Format: xxx.xxx.xxx.xxx/bitmask';
+$string['auth_ntlmsso_subnet'] = 'If set, it will only attempt SSO with clients in this subnet. Format: xxx.xxx.xxx.xxx/bitmask. Separate multiple subnets with \',\' (comma).';
 $string['ntlmsso_attempting'] = 'Attempting Single Sign On via NTLM...';
 $string['ntlmsso_failed'] = 'Auto-login failed, try the normal login page...';
 $string['ntlmsso_isdisabled'] = 'NTLM SSO is disabled.';
@@ -215,7 +215,7 @@ $string['recordsnotsaved'] = 'No entry was saved. Please check the format of the
 $string['recordssaved'] = 'entries saved';
 $string['requireapproval'] = 'Require approval?';
 $string['requiredentries'] = 'Required entries';
-$string['requiredentrieschanged'] = '<p><strong>IMPORTANT - PLEASE READ </strong></p><p>Due to a bug fix, the behaviour of database activities using the \'Required entries\' and \'Required entries before viewing settings\' settings will change. A more detailed explaination of the changes can be read on <a href=\"http://moodle.org/mod/forum/discuss.php?d=110928\" target=\"_blank\">the database module forum</a>. The expected behavior of these settings can also be read on <a href=\"http://docs.moodle.org/en/Adding/editing_a_database#Required_entries\" target=\"_blank\">Moodle Docs</a>.
+$string['requiredentrieschanged'] = '<p><strong>IMPORTANT - PLEASE READ </strong></p><p>Due to a bug fix, the behaviour of database activities using the \'Required entries\' and \'Required entries before viewing settings\' settings will change. A more detailed explaination of the changes can be read on <a href=\"http://moodle.org/mod/forum/discuss.php?d=110928\" target=\"_blank\">the database module forum</a>. The expected behavior of these settings can also be read on <a href=\"http://docs.moodle.org/19/en/Adding/editing_a_database#Required_entries\" target=\"_blank\">Moodle Docs</a>.
 </p><p>This change affects the following databases in your system: (Please save this list now, and after the upgrade, check that these activities still work the way that the teacher intends.)</p><strong style=\"color:red\">$a->text</strong><br/>';
 $string['requiredentriestoview'] = 'Entries required before viewing';
 $string['resettemplate'] = 'Reset template';
@@ -5,7 +5,7 @@ All of it has gone now because we now use the Moodle Docs wiki.

 To find out the new locations for all the information that was here, see:

-    http://docs.moodle.org/en/MoodleDocs_and_lang_packs
+    http://docs.moodle.org/19/en/MoodleDocs_and_lang_packs

    http://tracker.moodle.org/browse/MDL-4912

@@ -11,7 +11,7 @@
 </head>
 <body>

-(For the most up-to-date version of this license, see <a href="http://docs.moodle.org/en/License">Moodle Docs</a>).
+(For the most up-to-date version of this license, see <a href="http://docs.moodle.org/dev/License">Moodle Docs</a>).
    
 <h1>Copyright License for Moodle</h1>
 <blockquote>
@@ -139,5 +139,6 @@ $string['wrongdestpath'] = 'Wrong destination path';
 $string['wrongsourcebase'] = 'Wrong source URL base';
 $string['wrongzipfilename'] = 'Wrong ZIP file name';
 $string['youcannotdeletecategory'] = 'You cannot delete category \'$a\' because you can neither delete the contents, nor move them elsewhere.';
+$string['zipfileserror'] = 'Cannot create zip file';

 ?>
@@ -47,6 +47,8 @@ $string['configreplytouser'] = 'When a forum post is mailed out, should it conta
 $string['configshortpost'] = 'Any post under this length (in characters not including HTML) is considered short (see below).';
 $string['configtrackreadposts'] = 'Set to \'yes\' if you want to track read/unread for each user.';
 $string['configusermarksread'] = 'If \'yes\', the user must manually mark a post as read. If \'no\', when the post is viewed it is marked as read.';
+$string['confirmsubscribe'] = 'Do you really want to subscribe to forum \'{$a}\'?';
+$string['confirmunsubscribe'] = 'Do you really want to unsubscribe from forum \'{$a}\'?';
 $string['couldnotadd'] = 'Could not add your post due to an unknown error';
 $string['couldnotdeleteratings'] = 'Sorry, that cannot be deleted as people have already rated it';
 $string['couldnotdeletereplies'] = 'Sorry, that cannot be deleted as people have already responded to it';
@@ -92,7 +94,7 @@ $string['forum'] = 'Forum';
 $string['forum:addnews'] = 'Add news';
 $string['forumauthorhidden'] = 'Author (hidden)';
 $string['forumblockingalmosttoomanyposts'] = 'You are approaching the posting threshold. You have posted $a->numposts times in the last $a->blockperiod and the limit is $a->blockafter posts.';
-$string['forumbodyhidden'] = 'This post cannot be viewed by you, probably because you have not posted in the discussion yet.';
+$string['forumbodyhidden'] = 'This post cannot be viewed by you, probably because you have not posted in the discussion or the maximum editing time hasn\'t passed yet.';
 $string['forum:createattachment'] = 'Create attachments';
 $string['forum:deleteanypost'] = 'Delete any posts (anytime)';
 $string['forum:deleteownpost'] = 'Delete own posts (within deadline)';
@@ -12,6 +12,7 @@ $string['allowcomments'] = 'Allow comments on entries';
 $string['allowduplicatedentries'] = 'Duplicated entries allowed';
 $string['allowprintview'] = 'Allow print view';
 $string['allowratings'] = 'Allow entries to be rated?';
+$string['andmorenewentries'] = 'and {$a} more new entries.';
 $string['answer'] = 'Answer';
 $string['approve'] = 'Approve';
 $string['areyousuredelete'] = 'Are you sure you want to delete this entry?';
@@ -48,7 +48,7 @@
    one of the few webhosts that does not support these features ask them why, 
    and consider taking your business elsewhere.</p>
  <p>If you want to run Moodle on your own computer and all this looks a bit daunting, 
-    then please take a look at <a href="http://docs.moodle.org/en/Administrator_documentation">the administrator documentation</a>.</p>
+    then please take a look at <a href="http://docs.moodle.org/19/en/Administrator_documentation">the administrator documentation</a>.</p>
  <p>&nbsp;</p>
 </div>

@@ -266,7 +266,7 @@ php_value post_max_size 2M</pre>
      '1', teacher varchar(100) NOT NULL default 'Teacher', startdate int(10) 
      unsigned NOT NULL default '0', enddate int(10) unsigned NOT NULL default 
      '0', timemodified int(10) unsigned NOT NULL default '0', PRIMARY KEY (id)) 
-      TYPE=MyISAM</p>
+      ENGINE=MyISAM</p>
    <p class="success">SUCCESS</p>
  </div>
  <p>...and so on, followed by: <span class="success">Main databases set up 
@@ -416,7 +416,7 @@ php_value post_max_size 2M</pre>
    for them using the &quot;Add a new user&quot; on the Admin page.</p>
  <p>Once done, the course is ready to customise, and is accessible via the &quot;Courses&quot; 
    link on the home page.</p>
-  <p>See the &quot;<a href="http://docs.moodle.org/en/Teacher_documentation">Teacher Documentation</a>&quot; for more details 
+  <p>See the &quot;<a href="http://docs.moodle.org/19/en/Teacher_documentation">Teacher Documentation</a>&quot; for more details
    on course-building.</p>
  <p>&nbsp;</p>
  <p class="center"><strong>Happy exploring and happy Moodling!</strong></p>
@@ -31,5 +31,5 @@ cannot delete the last category in a context.</li>
 <ul>
  <li><a href="help.php?module=question&amp;file=categorycontexts.html">Category contexts</a></li>
  <li><a href="help.php?module=question&amp;file=permissions.html">Question permissions</a></li>
-  <li><a href="http://docs.moodle.org/en/Question_categories">Question categories help on Moodle Docs</a></li>
+  <li><a href="http://docs.moodle.org/19/en/Question_categories">Question categories help on Moodle Docs</a></li>
 </ul>
@@ -15,5 +15,5 @@ your questions in any or all of the parent course categories).</li>
 <ul>
  <li><a href="help.php?module=question&amp;file=categories.html">Question categories</a></li>
  <li><a href="help.php?module=question&amp;file=permissions.html">Question permissions</a></li>
-  <li><a href="http://docs.moodle.org/en/Question_contexts">Question contexts documentation on Moodle Docs</a></li>
+  <li><a href="http://docs.moodle.org/19/en/Question_contexts">Question contexts documentation on Moodle Docs</a></li>
 </ul>
@@ -258,7 +258,7 @@ $string['phpversionhelp'] = '<p>Moodle requires a PHP version of at least 4.3.0
 $string['postgres7'] = 'PostgreSQL (postgres7)';
 $string['postgresqlwarning'] = '<strong>Note:</strong> If you experience some connection problems, you can try to set Host Server field as
 host=\'postgresql_host\' port=\'5432\' dbname=\'postgresql_database_name\' user=\'postgresql_user\' password=\'postgresql_user_password\'
-and to leave empty the Database, User and Password fields. More information on <a href=\"http://docs.moodle.org/en/Installing_Postgres_for_PHP\">Moodle Docs</a>';
+and to leave empty the Database, User and Password fields. More information on <a href=\"http://docs.moodle.org/19/en/Installing_Postgres_for_PHP\">Moodle Docs</a>';
 $string['safemode'] = 'Safe Mode';
 $string['safemodeerror'] = 'Moodle may have trouble with safe mode on';
 $string['safemodehelp'] = '<p>Moodle may have a variety of problems with safe mode on, not least is that 
@@ -9,5 +9,8 @@ $string['flashvideo'] = 'Flash video';
 $string['mp3audio'] = 'MP3 audio';
 $string['oggaudio'] = 'OGG audio';
 $string['ogvvideo'] = 'OGV video';
+$string['quicktime'] = 'Quicktime';
+$string['realaudio'] = 'Real audio';
+$string['wmpvideo'] = 'WMP video';
 $string['unsupportedplugins'] = '(The browser does not support this type of file. {$a})';
 ?>
@@ -208,6 +208,7 @@ $string['addtoacl'] = 'Add to Access Control';
 $string['accesslevel'] = 'Access Level';
 $string['ssoaccesscontrol'] = 'SSO Access Control';
 $string['notpermittedtojump'] = 'You do not have permission to begin a remote session from this Moodle hub.';
+$string['notpermittedtojumpas'] = 'You can\'t begin a remote session while you are logged in as another user.';
 $string['notpermittedtoland'] = 'You do not have permission to begin a remote session.';
 $string['authfail_nosessionexists'] = 'Authorisation failed: the mnet session does not exist.';
 $string['authfail_sessiontimedout'] = 'Authorisation failed: the mnet session has timed out.';
@@ -49,7 +49,7 @@ $string['downloadcore'] = 'Our main method of distribution is via these standard
 $string['downloadcoretitle'] = 'Standard Moodle packages';
 $string['downloadcvs'] = 'Another way to get the core source code is by using CVS to connect directly to one of our mirrors of the code repository used by Moodle developers.  This makes upgrading very easy, even if you have made local changes to the source code.';
 $string['downloadcvstitle'] = 'Moodle via CVS';
-$string['downloadintro'] = 'Moodle is open source under the <a href=\"http://docs.moodle.org/en/License\">GPL licence</a>.  Everything we produce is available for you to download and use for free.';
+$string['downloadintro'] = 'Moodle is open source under the <a href=\"http://docs.moodle.org/dev/License\">GPL licence</a>.  Everything we produce is available for you to download and use for free.';
 $string['downloadlang'] = 'In current versions of Moodle, adding support for new languages has been automated from the administration menu within your site.  However, for some older versions of Moodle, new language packs need to be downloaded manually.';
 $string['downloadlangtitle'] = 'Language packs';
 $string['downloadlogotitle'] = 'Moodle logos';
@@ -161,7 +161,7 @@ $string['backupmetacoursehelp'] = 'If enabled, then metacourse info (inherited e
 $string['backupnameformat'] = '%%Y%%m%%d-%%H%%M';
 $string['backupmissinguserinfoperms'] = 'Note: This backup contains no user data. Exercise and Workshop activities will not be included in the backup, since these modules are not compatible with this type of backup.';
 $string['backupnoneusersinfo'] = 'Note: This backup contains no users and so all activities have been switched to \"without user data\" mode. Exercise and Workshop activities will not be included in the backup, since these modules are not compatible with this type of backup.';
-$string['backupnonisowarning'] = 'Warning: this backup is from a non-Unicode version of Moodle (pre 1.6).  If this backup contains any non-ISO-8859-1 texts then they may be CORRUPTED if you try to restore them to this Unicode version of Moodle.  See the <a href=\"http://docs.moodle.org/en/Backup_FAQ\">Backup FAQ</a> for more information about how to recover this backup correctly.';
+$string['backupnonisowarning'] = 'Warning: this backup is from a non-Unicode version of Moodle (pre 1.6).  If this backup contains any non-ISO-8859-1 texts then they may be CORRUPTED if you try to restore them to this Unicode version of Moodle.  See the <a href=\"http://docs.moodle.org/19/en/Backup_FAQ\">Backup FAQ</a> for more information about how to recover this backup correctly.';
 $string['backupnext'] = 'Next backup';
 $string['backuporiginalname'] = 'Backup Name';
 $string['backuproleassignments'] = 'Backup role assignments for these roles';
@@ -503,6 +503,7 @@ $string['emaildisable'] = 'This email address is disabled';
 $string['emaildisableclick'] = 'Click here to disable all email from being sent to this address';
 $string['emaildisplay'] = 'Email display';
 $string['emaildisplaycourse'] = 'Allow only other course members to see my email address';
+$string['emaildisplayhidden'] = 'Email hidden';
 $string['emaildisplayno'] = 'Hide my email address from everyone';
 $string['emaildisplayyes'] = 'Allow everyone to see my email address';
 $string['emailenable'] = 'This email address is enabled';
@@ -732,7 +733,7 @@ but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

 See the Moodle License information page for full details:
-http://docs.moodle.org/en/License';
+http://docs.moodle.org/dev/License';
 $string['grade'] = 'Grade';
 $string['grades'] = 'Grades';
 $string['group'] = 'Group';
@@ -3,7 +3,7 @@ $string['spamauto'] = 'Autodetect common spam patterns';
 $string['spamcannotdelete'] = 'Cannot delete this user';
 $string['spamcannotfinduser'] = 'No users matching your search';
 $string['spamcleaner'] = 'Spam cleaner';
-$string['spamcleanerintro'] = 'This script allows you to search all user profiles for certain strings and then delete those accounts which are obviously created by spammers.  You can search for multiple keywords using commas (eg casino, porn)<br /><br />Moodle docs has more information about <a href=\"http://docs.moodle.org/en/Reducing_spam_in_Moodle\">Reducing spam in Moodle</a>.';
+$string['spamcleanerintro'] = 'This script allows you to search all user profiles for certain strings and then delete those accounts which are obviously created by spammers.  You can search for multiple keywords using commas (eg casino, porn)<br /><br />Moodle docs has more information about <a href=\"http://docs.moodle.org/19/en/Reducing_spam_in_Moodle\">Reducing spam in Moodle</a>.';
 $string['spamdesc'] = 'Description';
 $string['spamdeleteall'] = 'Delete all these user accounts';
 $string['spamdeleteconfirm'] = 'Are you sure you want to delete this entry?  You can not undo this.';
@@ -73,7 +73,7 @@ $string['indexes'] = 'Indexes';
 $string['integerincorrectlength'] = 'Incorrect length for integer field';
 $string['key'] = 'Key';
 $string['keys'] = 'Keys';
-$string['listreservedwords'] = 'List of Reserved Words<br />(used to keep <a href=\"http://docs.moodle.org/en/XMLDB_reserved_words\" target=\"_blank\">XMLDB_reserved_words</a> updated)';
+$string['listreservedwords'] = 'List of Reserved Words<br />(used to keep <a href=\"http://docs.moodle.org/19/en/XMLDB_reserved_words\" target=\"_blank\">XMLDB_reserved_words</a> updated)';
 $string['load'] = 'Load';
 $string['missing'] = 'Missing';
 $string['missingindexes'] = 'Missing Indexes Found';
@@ -144,7 +144,7 @@ define('CONTEXT_COURSE', 50);
 define('CONTEXT_MODULE', 70);
 define('CONTEXT_BLOCK', 80);

-// capability risks - see http://docs.moodle.org/en/Development:Hardening_new_Roles_system
+// capability risks - see http://docs.moodle.org/dev/Hardening_new_Roles_system
 define('RISK_MANAGETRUST', 0x0001);
 define('RISK_CONFIG',      0x0002);
 define('RISK_XSS',         0x0004);
@@ -5011,7 +5011,7 @@ function sort_by_roleassignment_authority($users, $context, $roles=array(), $sor
 * @param bool gethidden - whether to fetch hidden enrolments too
 * @return array()
 */
-function get_role_users($roleid, $context, $parent=false, $fields='', $sort='u.lastname ASC', $gethidden=true, $group='', $limitfrom='', $limitnum='') {
+function get_role_users($roleid, $context, $parent=false, $fields='', $sort='u.lastname ASC, u.firstname ASC', $gethidden=true, $group='', $limitfrom='', $limitnum='') {
    global $CFG;

    if (empty($fields)) {
@@ -4942,14 +4942,18 @@ function print_plugin_tables() {
    $installed_mods = get_records_list('modules', '', '', '', 'name');
    $installed_blocks = get_records_list('block', '', '', '', 'name');

+    $plugins_installed['mod'] = array();
    foreach($installed_mods as $mod) {
        $plugins_installed['mod'][] = $mod->name;
    }

+    $plugins_installed['blocks'] = array();
    foreach($installed_blocks as $block) {
        $plugins_installed['blocks'][] = $block->name;
    }

+    $plugins_installed['filter'] = array();
+
    $plugins_ondisk = array();
    $plugins_ondisk['mod'] = get_list_of_plugins('mod', 'db');
    $plugins_ondisk['blocks'] = get_list_of_plugins('blocks', 'db');
@@ -1,4 +1,4 @@
-<?php
+<?php
 /*
 	Bulgarian language, v1.0, 25.03.2004, encoding by UTF-8 charset
 	contributed by Valentin Sheiretsky <valio#valio.eu.org>
@@ -34,4 +34,4 @@ $ADODB_LANG_ARRAY = array (
            DB_ERROR_NOSUCHDB           => 'несъществуваща база данни',
            DB_ERROR_ACCESS_VIOLATION   => 'нямате достатъчно права'
 );
-?>
+?>
@@ -94,8 +94,8 @@ section_class.prototype.init_buttons = function() {
        commandContainer.appendChild(highlightbutton);
        this.highlightButton = highlightbutton;
    }
-    
-    if (this.sectionId > 0 ) {        
+
+    if (this.sectionId > 0 ) {
        var viewbutton = main.mk_button('div', '/i/hide.gif', main.getString('hidesection', this.sectionId), [['title', main.portal.strings['hide'] ]]);
    YAHOO.util.Event.addListener(viewbutton, 'click', this.toggle_hide, this,true);
    commandContainer.appendChild(viewbutton);
@@ -141,12 +141,12 @@ section_class.prototype.process_section = function() {

    // Find/edit resources
    this.resources_ul = this.content_td.getElementsByTagName('ul')[0];
-    var i=0;    
-    while (this.resources_ul && this.resources_ul.className != 'section img-text') {        
+    var i=0;
+    while (this.resources_ul && this.resources_ul.className != 'section img-text') {
        this.resources_ul = this.content_td.getElementsByTagName('ul')[i];
        i++;
    }
-    
+
    if (!this.resources_ul) {
        this.resources_ul = document.createElement('ul');
        this.resources_ul.className='section';
@@ -158,10 +158,12 @@ section_class.prototype.process_section = function() {
        var resource = this.resources_ul.getElementsByTagName('li')[i];
        this.resources[this.resources.length] = new resource_class(resource.id, 'resources', null, this);
    }
-    this.summary = YAHOO.util.Dom.getElementsByClassName('summary', null, this.getEl())[0].firstChild.data || '';
+    var summarysection = YAHOO.util.Dom.getElementsByClassName('summary', null, this.getEl())[0].firstChild;
+    if (summarysection != null) {
+        this.summary = summarysection.data || '';
+    }
 }

-
 section_class.prototype.startDrag = function(x, y) {
    //operates in point mode
    YAHOO.util.DDM.mode = YAHOO.util.DDM.POINT;
@@ -54,4 +54,12 @@ function php_check_register_globals($result) {
    return $result;
 }

+function php_check_php533($result) {
+    if (version_compare(phpversion(), '5.3.3') < 0) {
+        $result->status = false;
+    } else {
+        $result = null;
+    }
+    return $result;
+}
 ?>
@@ -1238,7 +1238,7 @@ function get_categories($parent='none', $sort=NULL, $shallow=true) {
                JOIN {$CFG->prefix}context ctx
                  ON cc.id=ctx.instanceid AND ctx.contextlevel=".CONTEXT_COURSECAT."
                JOIN {$CFG->prefix}course_categories ccp
-                     ON (cc.path LIKE ".sql_concat('ccp.path',"'%'").")
+                     ON ((cc.parent=ccp.id) OR (cc.path LIKE ".sql_concat('ccp.path',"'/%'")."))
                WHERE ccp.id=$parent
                $sort";
    }
@@ -933,6 +933,9 @@
      <KEYS>
        <KEY NAME="primary" TYPE="primary" FIELDS="id"/>
      </KEYS>
+      <INDEXES>
+        <INDEX NAME="userfieldidx" UNIQUE="false" FIELDS="userid, fieldid"/>
+      </INDEXES>
    </TABLE>
    <TABLE NAME="mnet_enrol_course" COMMENT="Information about courses on remote hosts" PREVIOUS="user_info_data" NEXT="mnet_enrol_assignments">
      <FIELDS>
@@ -254,7 +254,7 @@ function main_upgrade($oldversion=0) {
                             `userid` int(10) unsigned NOT NULL default '0',
                             PRIMARY KEY  (`id`),
                             UNIQUE KEY `id` (`id`)
-                             ) TYPE=MyISAM COMMENT='One record per course creator';");
+                             ) ENGINE=MyISAM COMMENT='One record per course creator';");
    }
    if ($oldversion < 2003032602) {
        // Redoing it because of no prefix last time
@@ -362,7 +362,7 @@ function main_upgrade($oldversion=0) {
                        PRIMARY KEY  (`id`),
                        UNIQUE KEY `id` (`id`),
                        KEY `courseuserid` (course,userid)
-                     ) TYPE=MyISAM COMMENT='Stores info about how to display the course'");
+                     ) ENGINE=MyISAM COMMENT='Stores info about how to display the course'");
    }

    if ($oldversion < 2003050400) {
@@ -458,7 +458,7 @@ function main_upgrade($oldversion=0) {
                         `description` text NOT NULL,
                         `timemodified` int(10) unsigned NOT NULL default '0',
                         PRIMARY KEY  (id)
-                       ) TYPE=MyISAM COMMENT='Defines grading scales'");
+                       ) ENGINE=MyISAM COMMENT='Defines grading scales'");

    }

@@ -558,7 +558,7 @@ function main_upgrade($oldversion=0) {
                                `timemodified` int(10) unsigned NOT NULL default '0',
                                PRIMARY KEY  (`id`),
                                KEY `courseid` (`courseid`)
-                              ) TYPE=MyISAM COMMENT='Each record is a group in a course.'; ");
+                              ) ENGINE=MyISAM COMMENT='Each record is a group in a course.'; ");

        modify_database("", "CREATE TABLE `prefix_groups_members` (
                                `id` int(10) unsigned NOT NULL auto_increment,
@@ -567,7 +567,7 @@ function main_upgrade($oldversion=0) {
                                `timeadded` int(10) unsigned NOT NULL default '0',
                                PRIMARY KEY  (`id`),
                                KEY `groupid` (`groupid`)
-                              ) TYPE=MyISAM COMMENT='Lists memberships of users in groups'; ");
+                              ) ENGINE=MyISAM COMMENT='Lists memberships of users in groups'; ");
    }

    if ($oldversion < 2003121800) {
@@ -601,7 +601,7 @@ function main_upgrade($oldversion=0) {
                              UNIQUE KEY `id` (`id`),
                              KEY `courseid` (`courseid`),
                              KEY `userid` (`userid`)
-                            ) TYPE=MyISAM COMMENT='For everything with a time associated to it'; ");
+                            ) ENGINE=MyISAM COMMENT='For everything with a time associated to it'; ");
    }

    if ($oldversion < 2004012800) {
@@ -613,7 +613,7 @@ function main_upgrade($oldversion=0) {
                              PRIMARY KEY  (`id`),
                              UNIQUE KEY `id` (`id`),
                              KEY `useridname` (userid,name)
-                            ) TYPE=MyISAM COMMENT='Allows modules to store arbitrary user preferences'; ");
+                            ) ENGINE=MyISAM COMMENT='Allows modules to store arbitrary user preferences'; ");
    }

    if ($oldversion < 2004012900) {
@@ -637,7 +637,7 @@ function main_upgrade($oldversion=0) {
                                `timemodified` int(10) unsigned NOT NULL default '0',
                                PRIMARY KEY  (`id`),
                                KEY `md5key` (`md5key`)
-                             ) TYPE=MyISAM COMMENT='For storing temporary copies of processed texts';");
+                             ) ENGINE=MyISAM COMMENT='For storing temporary copies of processed texts';");
    }

    if ($oldversion < 2004021000) {
@@ -667,7 +667,7 @@ function main_upgrade($oldversion=0) {
                                `timemodified` int(10) unsigned NOT NULL default '0',
                                PRIMARY KEY  (`id`),
                                KEY `filtermd5key` (filter,md5key)
-                              ) TYPE=MyISAM COMMENT='For keeping information about cached data';");
+                              ) ENGINE=MyISAM COMMENT='For keeping information about cached data';");
    }

    if ($oldversion < 2004021500) {
@@ -865,7 +865,7 @@ function main_upgrade($oldversion=0) {
                          `data` text NOT null,
                          PRIMARY KEY (`sesskey`), 
                          KEY (`expiry`) 
-                      ) TYPE=MyISAM COMMENT='Optional database session storage, not used by default';");
+                      ) ENGINE=MyISAM COMMENT='Optional database session storage, not used by default';");
    }

    if ($oldversion < 2004111500) {  // Update any users/courses using wrongly-named lang pack
@@ -1043,7 +1043,7 @@ function main_upgrade($oldversion=0) {
                               PRIMARY KEY  (`id`),
                               KEY `useridfrom` (`useridfrom`),
                               KEY `useridto` (`useridto`)
-                             ) TYPE=MyISAM COMMENT='Stores all unread messages';");
+                             ) ENGINE=MyISAM COMMENT='Stores all unread messages';");

        modify_database('',"CREATE TABLE `prefix_message_read` (
                               `id` int(10) unsigned NOT NULL auto_increment,
@@ -1057,7 +1057,7 @@ function main_upgrade($oldversion=0) {
                               PRIMARY KEY  (`id`),
                               KEY `useridfrom` (`useridfrom`),
                               KEY `useridto` (`useridto`)
-                             ) TYPE=MyISAM COMMENT='Stores all messages that have been read';");
+                             ) ENGINE=MyISAM COMMENT='Stores all messages that have been read';");

        modify_database('',"CREATE TABLE `prefix_message_contacts` (
                               `id` int(10) unsigned NOT NULL auto_increment,
@@ -1066,7 +1066,7 @@ function main_upgrade($oldversion=0) {
                               `blocked` tinyint(1) unsigned NOT NULL default '0',
                               PRIMARY KEY  (`id`),
                               UNIQUE KEY `usercontact` (`userid`,`contactid`)
-                             ) TYPE=MyISAM COMMENT='Maintains lists of relationships between users';");
+                             ) ENGINE=MyISAM COMMENT='Maintains lists of relationships between users';");

        modify_database('', "INSERT INTO prefix_log_display (module, action, mtable, field) VALUES ('message', 'write', 'user', 'CONCAT(firstname,\" \",lastname)'); ");
        modify_database('', "INSERT INTO prefix_log_display (module, action, mtable, field) VALUES ('message', 'read', 'user', 'CONCAT(firstname,\" \",lastname)'); ");
@@ -1243,7 +1243,7 @@ function main_upgrade($oldversion=0) {
                              `std_skipweeks` tinyint(3) NOT NULL default '0',
                              `std_time` varchar(5) NOT NULL default '00:00',
                              PRIMARY KEY (`id`)
-                            ) TYPE=MyISAM COMMENT='Rules for calculating local wall clock time for users';");
+                            ) ENGINE=MyISAM COMMENT='Rules for calculating local wall clock time for users';");
    }

    if ($oldversion < 2005032800) {
@@ -1257,7 +1257,7 @@ function main_upgrade($oldversion=0) {
            `weight` decimal(4,2) NOT NULL default '0.00',
            PRIMARY KEY  (`id`),
            KEY `courseid` (`courseid`)
-          ) TYPE=MyISAM ;");
+          ) ENGINE=MyISAM ;");

        execute_sql("CREATE TABLE `{$CFG->prefix}grade_exceptions` (
            `id` int(10) unsigned NOT NULL auto_increment,
@@ -1266,7 +1266,7 @@ function main_upgrade($oldversion=0) {
            `userid` int(10) unsigned NOT NULL default '0',
            PRIMARY KEY  (`id`),
            KEY `courseid` (`courseid`)
-          ) TYPE=MyISAM ;");
+          ) ENGINE=MyISAM ;");


        execute_sql("CREATE TABLE `{$CFG->prefix}grade_item` (
@@ -1280,7 +1280,7 @@ function main_upgrade($oldversion=0) {
            `sort_order` int(10) unsigned NOT NULL default '0',
            PRIMARY KEY  (`id`),
            KEY `courseid` (`courseid`)
-          ) TYPE=MyISAM ;");
+          ) ENGINE=MyISAM ;");


        execute_sql("CREATE TABLE `{$CFG->prefix}grade_letter` (
@@ -1291,7 +1291,7 @@ function main_upgrade($oldversion=0) {
            `grade_low` decimal(4,2) NOT NULL default '0.00',
            PRIMARY KEY  (`id`),
            KEY `courseid` (`courseid`)
-          ) TYPE=MyISAM ;");
+          ) ENGINE=MyISAM ;");
          

        execute_sql("CREATE TABLE `{$CFG->prefix}grade_preferences` (
@@ -1301,7 +1301,7 @@ function main_upgrade($oldversion=0) {
            `value` int(10) NOT NULL default '0',
            PRIMARY KEY  (`id`),
            UNIQUE KEY `courseidpreference` (`courseid`,`preference`)
-          ) TYPE=MyISAM ;");
+          ) ENGINE=MyISAM ;");
          
    }

@@ -1372,7 +1372,7 @@ function main_upgrade($oldversion=0) {
                                  `value`      text NOT NULL default '',
                                  PRIMARY KEY  (`id`),
                                           UNIQUE KEY `plugin_name` (`plugin`, `name`)
-                                  ) TYPE=MyISAM 
+                                  ) ENGINE=MyISAM
                                  COMMENT='Moodle modules and plugins configuration variables';");
    }

@@ -1493,7 +1493,7 @@ function main_upgrade($oldversion=0) {
          `requester` int(10) NOT NULL default 0,
          PRIMARY KEY (`id`),
          KEY `shortname` (`shortname`)
-        ) TYPE=MyISAM;");
+        ) ENGINE=MyISAM;");
        
        table_column('course','','requested');
    }
@@ -1506,7 +1506,7 @@ function main_upgrade($oldversion=0) {
         PRIMARY KEY (`id`),
         KEY `course` (`course`),
         KEY `module` (`module`)
-      ) TYPE=MyISAM;");
+      ) ENGINE=MyISAM;");
        
        table_column('course','','restrictmodules','int','1','','0','not null');
    }
@@ -1692,7 +1692,7 @@ function main_upgrade($oldversion=0) {
          UNIQUE KEY `id_user_idx` (`id`, `userid`),
          KEY `post_lastmodified_idx` (`lastmodified`),
          KEY `post_subject_idx` (`subject`)
-        ) TYPE=MyISAM  COMMENT='New moodle post table. Holds data posts such as forum entries or blog entries.';");
+        ) ENGINE=MyISAM  COMMENT='New moodle post table. Holds data posts such as forum entries or blog entries.';");

        modify_database("","CREATE TABLE prefix_tags (
          `id` int(10) unsigned NOT NULL auto_increment,
@@ -1700,7 +1700,7 @@ function main_upgrade($oldversion=0) {
          `userid` int(10) unsigned NOT NULL default'0',
          `text` varchar(255) NOT NULL default '',
          PRIMARY KEY  (`id`)
-        ) TYPE=MyISAM COMMENT ='tags structure for moodle.';");
+        ) ENGINE=MyISAM COMMENT ='tags structure for moodle.';");

        modify_database("","CREATE TABLE prefix_blog_tag_instance (
          `id` int(10) unsigned NOT NULL auto_increment,
@@ -1710,7 +1710,7 @@ function main_upgrade($oldversion=0) {
          `courseid` int(10) unsigned NOT NULL default'0',
          `userid` int(10) unsigned NOT NULL default'0',
          PRIMARY KEY  (`id`)
-          ) TYPE=MyISAM COMMENT ='tag instance for blogs.';");
+          ) ENGINE=MyISAM COMMENT ='tag instance for blogs.';");
    }

    if ($oldversion < 2006031400) {
@@ -1799,7 +1799,7 @@ function main_upgrade($oldversion=0) {
                               `mtable` varchar(30),
                               `field` varchar(50),
                               PRIMARY KEY (`id`)
-                               ) TYPE=MyISAM");
+                               ) ENGINE=MyISAM");
        
        // Add index to ensure that module and action combination is unique.
        modify_database('', "ALTER TABLE prefix_log_display ADD UNIQUE `moduleaction`(`module` , `action`)");
@@ -2193,7 +2193,7 @@ function main_upgrade($oldversion=0) {
                    KEY `courseid` (`courseid`),
                    UNIQUE KEY `userid-courseid` (`userid`, `courseid`),
                    PRIMARY KEY (`id`) 
-                    )TYPE=MYISAM COMMENT ='time user last accessed any page in a course';", true);
+                    )ENGINE=MyISAM COMMENT ='time user last accessed any page in a course';", true);
    }

    if (!empty($CFG->rolesactive) and $oldversion < 2006091212) {   // Reload the guest roles completely with new defaults
@@ -370,7 +370,7 @@ function xmldb_main_upgrade($oldversion=0) {
        drop_index($table, $index);
        $index->setFields(array('mnethostid', 'username'));
        if (!add_index($table, $index)) {
-            notify(get_string('duplicate_usernames', 'mnet', 'http://docs.moodle.org/en/DuplicateUsernames'));
+            notify(get_string('duplicate_usernames', 'mnet', 'http://docs.moodle.org/19/en/DuplicateUsernames'));
        }

        unset($table, $field, $index);
@@ -3292,6 +3292,15 @@ function xmldb_main_upgrade($oldversion=0) {
    }

    if ($result && $oldversion < 2007101571.01) {
+        // Remove category_sortorder index that was supposed to be removed long time ago
+        $table = new XMLDBTable('course');
+        $index = new XMLDBIndex('category_sortorder');
+        $index->setAttributes(XMLDB_INDEX_UNIQUE, array('category', 'sortorder'));
+
+        if (index_exists($table, $index)) {
+            drop_index($table, $index);
+        }
+
        // MDL-21011 bring down course sort orders away from maximum values
        $sql = "SELECT id, category, sortorder from {$CFG->prefix}course
                ORDER BY sortorder ASC;";
@@ -3351,6 +3360,36 @@ function xmldb_main_upgrade($oldversion=0) {
        set_config('filter_mediaplugin_enable_ogg', 1);
        upgrade_main_savepoint($result, 2007101590.01);
    }
+
+    if ($result && $oldversion < 2007101591.01) {
+
+    /// Define index userfieldidx (not unique) to be added to user_info_data
+        $table = new XMLDBTable('user_info_data');
+        $index = new XMLDBIndex('userfieldidx');
+        $index->setAttributes(XMLDB_INDEX_NOTUNIQUE, array('userid', 'fieldid'));
+
+    /// Launch add index userfieldidx
+        if (!index_exists($table, $index)) {
+            $result = $result && add_index($table, $index);
+        }
+
+    /// Main savepoint reached
+        upgrade_main_savepoint($result, 2007101591.01);
+    }
+
+    if ($result && $oldversion < 2007101591.05) {
+        // Remove category_sortorder index that was supposed to be removed long time ago
+        $table = new XMLDBTable('course');
+        $index = new XMLDBIndex('category_sortorder');
+        $index->setAttributes(XMLDB_INDEX_UNIQUE, array('category', 'sortorder'));
+
+        if (index_exists($table, $index)) {
+            drop_index($table, $index);
+        }
+        upgrade_main_savepoint($result, 2007101591.05);
+    }
+
+
    return $result;
 }

@@ -36,7 +36,7 @@
 // This library should be used, exclusively, by the installation and
 // upgrade process of Moodle.
 //
-// For further documentation, visit http://docs.moodle.org/en/DDL_functions
+// For further documentation, visit http://docs.moodle.org/19/en/DDL_functions

 /// Add required XMLDB constants
    require_once($CFG->libdir . '/xmldb/classes/XMLDBConstants.php');
@@ -67,7 +67,7 @@
 * Add a new field to a table, or modify an existing one (if oldfield is defined).
 *
 * WARNING: This function is deprecated and will be removed in future versions.
- * Please use XMLDB (see http://docs.moodle.org/en/Development:DDL_functions ).
+ * Please use XMLDB (see http://docs.moodle.org/dev/DDL_functions ).
 *
 * Warning: Please be careful on primary keys, as this function will eat auto_increments
 *
@@ -1677,6 +1677,12 @@ function error ($message, $link='') {
        }
    }

+    // when printing an error the continue button should never link offsite
+    if (stripos($link, $CFG->wwwroot) === false &&
+        stripos($link, $CFG->httpswwwroot) === false) {
+        $link = $CFG->wwwroot.'/';
+    }
+
    if (!empty($link)) {
        print_continue($link);
    }
@@ -32,7 +32,7 @@
 /// include it yourself.

 /// For more info about the functions available in this library, please visit:
-///     http://docs.moodle.org/en/DML_functions
+///     http://docs.moodle.org/19/en/DML_functions
 /// (feel free to modify, improve and document such page, thanks!)

 /// GLOBAL CONSTANTS /////////////////////////////////////////////////////////
@@ -569,6 +569,7 @@ function get_record_select($table, $select='', $fields='*') {
 function get_recordset($table, $field='', $value='', $sort='', $fields='*', $limitfrom='', $limitnum='') {

    if ($field) {
+        $value = sql_magic_quotes_hack($value);
        $select = "$field = '$value'";
    } else {
        $select = '';
@@ -710,7 +711,7 @@ function recordset_to_array($rs) {
        $objects = array();
    /// First of all, we are going to get the name of the first column
    /// to introduce it back after transforming the recordset to assoc array
-    /// See http://docs.moodle.org/en/XMLDB_Problems, fetch mode problem.
+    /// See http://docs.moodle.org/19/en/XMLDB_Problems, fetch mode problem.
        $firstcolumn = $rs->FetchField(0);
    /// Get the whole associative array
        if ($records = $rs->GetAssoc(true)) {
@@ -1433,7 +1434,7 @@ function delete_records_select($table, $select='') {
 * @param string $table The database table to be checked against.
 * @param object $dataobject A data object with values for one or more fields in the record
 * @param bool $returnid Should the id of the newly created record entry be returned? If this option is not requested then true/false is returned.
- * @param string $primarykey (obsolete) This is now forced to be 'id'. 
+ * @param string $primarykey (obsolete) This is now forced to be 'id'.
 */
 function insert_record($table, $dataobject, $returnid=true, $primarykey='id') {

@@ -1447,6 +1448,14 @@ function insert_record($table, $dataobject, $returnid=true, $primarykey='id') {
    if (is_array($dataobject)) {
        debugging('Warning. Wrong call to insert_record(). $dataobject must be an object. array found instead', DEBUG_DEVELOPER);
        $dataobject = (object)$dataobject;
+    } else if (is_object($dataobject)) {
+        // make sure there are no properties or private methods because we cast to array later,
+        // at the same time this undos the object references so that PHP 5 works the same as PHP 4,
+        // the main reason for this is BC after the dirty magic hack introduction
+        if ($properties = get_object_vars($dataobject)) {
+            $dataobject = (object)$properties;
+        }
+        unset($properties);
    }

 /// Temporary hack as part of phasing out all access to obsolete user tables  XXX
@@ -1463,6 +1472,11 @@ function insert_record($table, $dataobject, $returnid=true, $primarykey='id') {
 /// so let's unset it now before it causes any trouble later
    unset($dataobject->{$primarykey});

+/// Extra protection against SQL injections
+    foreach((array)$dataobject as $k=>$v) {
+        $dataobject->$k = sql_magic_quotes_hack($v);
+    }
+
 /// Get an empty recordset. Cache for multiple inserts.
    if (empty($empty_rs_cache[$table])) {
        /// Execute a dummy query to get an empty recordset
@@ -1637,6 +1651,19 @@ function update_record($table, $dataobject) {
    if (is_array($dataobject)) {
        debugging('Warning. Wrong call to update_record(). $dataobject must be an object. array found instead', DEBUG_DEVELOPER);
        $dataobject = (object)$dataobject;
+    } else if (is_object($dataobject)) {
+        // make sure there are no properties or private methods because we cast to array later,
+        // at the same time this undos the object references so that PHP 5 works the same as PHP 4,
+        // the main reason for this is BC after the dirty magic hack introduction
+        if ($properties = get_object_vars($dataobject)) {
+            $dataobject = (object)$properties;
+        }
+        unset($properties);
+    }
+
+/// Extra protection against SQL injections
+    foreach((array)$dataobject as $k=>$v) {
+        $dataobject->$k = sql_magic_quotes_hack($v);
    }

    // Remove this record from record cache since it will change
@@ -1755,7 +1782,7 @@ function sql_paging_limit($page, $recordsperpage) {
 *
 * Note the LIKE are case sensitive for Oracle. Oracle 10g is required to use
 * the caseinsensitive search using regexp_like() or NLS_COMP=LINGUISTIC :-(
- * See http://docs.moodle.org/en/XMLDB_Problems#Case-insensitive_searches
+ * See http://docs.moodle.org/19/en/XMLDB_Problems#Case-insensitive_searches
 *
 * @uses $CFG
 * @return string
@@ -2223,6 +2250,38 @@ function sql_ceil($fieldname) {
    }
 }

+/**
+ * This hack prevents some types of SQL injections, no code should rely on this,
+ * do not forget to use addslashes() and addslashes_recursive() properly!
+ *
+ * The performance cost is negligible considering the security benefits and DB requests cost.
+ *
+ * @param mixed $value sql parameter value (hopefully with magic quotes)
+ * @return mixed sanitised value - added magic quotes if accidentally missing
+ */
+function sql_magic_quotes_hack($value) {
+    if ($value === null or $value === '') {
+        // performance shortcut
+        return $value;
+    }
+
+    // ignore stuff that can not be converted to string, catchable fatal error will be displayed elsewhere,
+    // this is intentional because we want to get the same errors as before this magic hack
+    if (is_object($value)) {
+        if (!method_exists($value, '__toString')) {
+            // ignore - we can not cast object to string, error will be triggered elsewhere
+            return $value;
+        }
+    } else if (!is_string($value)) {
+        // no sql injection possible in other non-string values
+        return $value;
+    }
+
+    // note: this does not change content if the content is properly escaped,
+    // the result is different only for strings with missing magic quotes!
+    return addslashes(stripslashes($value));
+}
+
 /**
 * Prepare a SQL WHERE clause to select records where the given fields match the given values.
 *
@@ -2238,6 +2297,9 @@ function sql_ceil($fieldname) {
 * @param string $value3 the value field3 must have (requred if field3 is given, else optional).
 */
 function where_clause($field1='', $value1='', $field2='', $value2='', $field3='', $value3='') {
+    $value1 = sql_magic_quotes_hack($value1);
+    $value2 = sql_magic_quotes_hack($value2);
+    $value3 = sql_magic_quotes_hack($value3);
    if ($field1) {
        $select = is_null($value1) ? "WHERE $field1 IS NULL" : "WHERE $field1 = '$value1'";
        if ($field2) {
@@ -495,7 +495,7 @@
                $file = basename($file);

                if (!unzip_file("$basedir/$wdir/$file")) {
-                    print_error("unzipfileserror","error");
+                    print_error("cannotunzipfile", "error");
                }

                echo "<center><form action=\"coursefiles.php\" method=\"get\">\n";
@@ -2371,6 +2371,7 @@ HTMLArea.is_mac_ie = (HTMLArea.is_ie && HTMLArea.is_mac);
 HTMLArea.is_win_ie = (HTMLArea.is_ie && !HTMLArea.is_mac);
 HTMLArea.is_gecko  = (navigator.product == "Gecko");
 HTMLArea.is_safari = (HTMLArea.agt.indexOf("safari") != -1);
+HTMLArea.is_webkit = (HTMLArea.agt.indexOf("applewebkit") != -1); // eg: chrome

 // variable used to pass the object to the popup editor window.
 HTMLArea._object = null;
@@ -2398,6 +2399,9 @@ HTMLArea.cloneObject = function(obj) {

 // FIXME!!! this should return false for IE < 5.5
 HTMLArea.checkSupportedBrowser = function() {
+    if (HTMLArea.is_webkit) {
+        return true;
+    }
    if (HTMLArea.is_gecko) {
        if (navigator.productSub < 20021201) {
            alert("You need at least Mozilla-1.3 Alpha.\n" +
@@ -3,6 +3,7 @@
    require("../../../../config.php");

    $id = optional_param('id', SITEID, PARAM_INT);
+    $httpsrequired = optional_param('httpsrequired', 0, PARAM_BOOL);

    require_login($id);
    require_capability('moodle/course:managefiles', get_context_instance(CONTEXT_COURSE, $id));
@@ -2,8 +2,10 @@
    require("../../../../config.php");

    $id = optional_param('id', SITEID, PARAM_INT);
+    $httpsrequired = optional_param('httpsrequired', 0, PARAM_BOOL);

    require_course_login($id);
+
    @header('Content-Type: text/html; charset=utf-8');

    if ($httpsrequired or (!empty($_SERVER['HTTPS']) and $_SERVER['HTTPS'] != 'off')) {
@@ -482,6 +482,17 @@ function environment_check_php_extensions($version) {
        $result->setErrorCode(NO_PHP_EXTENSIONS_SECTION_FOUND);
        return array($result);
    }
+
+/// Hack alert: inject extra mysqli dependency, mysql PHP extension is not supported in Moodle 2.x, warn only ppl using MySQL.
+    global $CFG;
+    set_dbfamily();
+    if ($CFG->dbfamily === 'mysql') {
+        $mver = normalize_version($version);
+        if (version_compare($mver, '2.0', 'ge')) {
+            $data['#']['PHP_EXTENSIONS']['0']['#']['PHP_EXTENSION'][] = array('#' => '', '@' => array('name' => 'mysqli', 'level' => 'required'));
+        }
+    }
+
 /// Iterate over extensions checking them and creating the needed environment_results
    foreach($data['#']['PHP_EXTENSIONS']['0']['#']['PHP_EXTENSION'] as $extension) {
        $result = new environment_results('php_extension');
@@ -122,7 +122,16 @@ class MoodleExcelWorksheet {
     */
    function MoodleExcelWorksheet($name, &$workbook, $latin_output=false) {

-    /// Internally, add one sheet to the workbook    
+        if (strlen($name) > 31) {
+            // Excel does not seem able to cope with sheet names > 31 chars.
+            // With $latin_output = false, it does not cope at all.
+            // With $latin_output = true it is supposed to work, but in our experience,
+            // it doesn't. Therefore, truncate in all circumstances.
+            $textlib = textlib_get_instance();
+            $name = $textlib->substr($name, 0, 31);
+        }
+
+    /// Internally, add one sheet to the workbook
        $this->pear_excel_worksheet =& $workbook->addWorksheet($name);
        $this->latin_output = $latin_output;
    /// Set encoding to UTF-16LE 
@@ -196,7 +205,13 @@ class MoodleExcelWorksheet {
        $format = $this->MoodleExcelFormat2PearExcelFormat($format);
    /// Convert the date to Excel format
        $timezone = get_user_timezone_offset();
-        $value =  ((usertime($date) + (int)($timezone * HOURSECS * 2)) / 86400) + 25569;
+        if ($timezone == 99) {
+            // system timezone offset in seconds
+            $offset = (int)date('Z');
+        } else {
+            $offset = (int)($timezone * HOURSECS * 2);
+        }
+        $value = ((usertime($date) + $offset) / 86400) + 25569;
    /// Add  the date safely to the PEAR Worksheet
        $this->pear_excel_worksheet->writeNumber($row, $col, $value, $format);
    }
@@ -15,6 +15,21 @@ class MoodleQuickForm_password extends HTML_QuickForm_password{
     */
    var $_helpbutton='';
    function MoodleQuickForm_password($elementName=null, $elementLabel=null, $attributes=null) {
+        global $CFG;
+        if (empty($CFG->xmlstrictheaders)) {
+            // no standard mform in moodle should allow autocomplete of passwords
+            // this is valid attribute in html5, sorry, we have to ignore validation errors in legacy xhtml 1.0
+            if (empty($attributes)) {
+                $attributes = array('autocomplete'=>'off');
+            } else if (is_array($attributes)) {
+                $attributes['autocomplete'] = 'off';
+            } else {
+                if (strpos($attributes, 'autocomplete') === false) {
+                    $attributes .= ' autocomplete="off" ';
+                }
+            }
+        }
+
        parent::HTML_QuickForm_password($elementName, $elementLabel, $attributes);
    }
    /**
@@ -48,4 +63,4 @@ class MoodleQuickForm_password extends HTML_QuickForm_password{
        return $this->_helpbutton;
    }
 }
-?>
+?>
@@ -15,6 +15,21 @@ require_once($CFG->libdir.'/form/password.php');
 class MoodleQuickForm_passwordunmask extends MoodleQuickForm_password {

    function MoodleQuickForm_passwordunmask($elementName=null, $elementLabel=null, $attributes=null) {
+        global $CFG;
+        if (empty($CFG->xmlstrictheaders)) {
+            // no standard mform in moodle should allow autocomplete of passwords
+            // this is valid attribute in html5, sorry, we have to ignore validation errors in legacy xhtml 1.0
+            if (empty($attributes)) {
+                $attributes = array('autocomplete'=>'off');
+            } else if (is_array($attributes)) {
+                $attributes['autocomplete'] = 'off';
+            } else {
+                if (strpos($attributes, 'autocomplete') === false) {
+                    $attributes .= ' autocomplete="off" ';
+                }
+            }
+        }
+
        parent::MoodleQuickForm_password($elementName, $elementLabel, $attributes);
    }

@@ -33,10 +33,13 @@ class MoodleQuickForm_recaptcha extends HTML_QuickForm_input {
     * </code>
     */
    function MoodleQuickForm_recaptcha($elementName = null, $elementLabel = null, $attributes = null) {
+        global $CFG;
        parent::HTML_QuickForm_input($elementName, $elementLabel, $attributes);
        $this->_type = 'recaptcha';
-        if (!empty($attributes['https'])) {
-            $this->_https = $attributes['https'];
+        if (!empty($attributes['https']) or strpos($CFG->httpswwwroot, 'https:') === 0) {
+            $this->_https = true;
+        } else {
+            $this->_https = false;
        }
    }

@@ -106,6 +106,21 @@ class moodleform {
     * @return moodleform
     */
    function moodleform($action=null, $customdata=null, $method='post', $target='', $attributes=null, $editable=true) {
+        global $CFG;
+        if (empty($CFG->xmlstrictheaders)) {
+            // no standard mform in moodle should allow autocomplete with the exception of user signup
+            // this is valid attribute in html5, sorry, we have to ignore validation errors in legacy xhtml 1.0
+            if (empty($attributes)) {
+                $attributes = array('autocomplete'=>'off');
+            } else if (is_array($attributes)) {
+                $attributes['autocomplete'] = 'off';
+            } else {
+                if (strpos($attributes, 'autocomplete') === false) {
+                    $attributes .= ' autocomplete="off" ';
+                }
+            }
+        }
+
        if (empty($action)){
            $action = strip_querystring(qualified_me());
        }
@@ -656,12 +671,14 @@ class moodleform {
    /**
     * Adds a link/button that controls the checked state of a group of checkboxes.
     * @param int    $groupid The id of the group of advcheckboxes this element controls
-     * @param string $text The text of the link. Defaults to "select all/none"
+     * @param string $text The text of the link. Defaults to selectallornone ("select all/none")
     * @param array  $attributes associative array of HTML attributes
     * @param int    $originalValue The original general state of the checkboxes before the user first clicks this element
     */
-    function add_checkbox_controller($groupid, $buttontext, $attributes, $originalValue = 0) {
+    function add_checkbox_controller($groupid, $text = null, $attributes = null, $originalValue = 0) {
        global $CFG;
+
+        // Set the default text if none was specified
        if (empty($text)) {
            $text = get_string('selectallornone', 'form');
        }
@@ -1143,6 +1160,10 @@ class MoodleQuickForm extends HTML_QuickForm_DHTMLRulesTableless {
            }
        }

+        if (is_array($this->_constantValues)) {
+            $unfiltered = HTML_QuickForm::arrayMerge($unfiltered, $this->_constantValues);
+        }
+
        if ($addslashes){
            return $this->_recursiveFilter('addslashes', $unfiltered);
        } else {
@@ -1480,7 +1501,7 @@ function validate_' . $this->_formName . '(frm) {
        } else if (is_a($element, 'HTML_QuickForm_hidden')) {
            return array();

-        } else if (method_exists($element, 'getPrivateName')) {
+        } else if (method_exists($element, 'getPrivateName') && !($element instanceof HTML_QuickForm_advcheckbox)) {
            return array($element->getPrivateName());

        } else {
@@ -173,13 +173,14 @@ class grade_object {
            $wheresql = implode("AND", $wheresql);
        }

-        if ($datas = get_records_select($table, $wheresql, 'id')) {
+        if ($rs = get_recordset_select($table, $wheresql, 'id')) {
            $result = array();
-            foreach($datas as $data) {
+            while ($data = rs_fetch_next_record($rs)) {
                $instance = new $classname();
                grade_object::set_properties($instance, $data);
                $result[$instance->id] = $instance;
            }
+            rs_close($rs);
            return $result;

        } else {
--- a/Show More
+++ b/Show More