on-demand release 1.9.19+

Merge branch 'mdl19_MDL-35958' of git://github.com/danmarsden/moodle into MOODLE_19_STABLE
MDL-38225 - data: Database entries are now linked correctly.
2013-05-13 12:30:23 +02:00 · 2013-05-06 11:01:20 +01:00 · 2013-02-27 08:45:53 +08:00 · 2013-01-25 15:59:35 +08:00 · 2013-01-11 22:16:54 +01:00 · 2013-01-11 12:27:34 +01:00
183 changed files with 5237 additions and 2914 deletions
@@ -24,7 +24,7 @@ a few minutes:

 For more information, see the INSTALL DOCUMENTATION:

-   http://docs.moodle.org/en/Installing_Moodle 
+   http://docs.moodle.org/19/en/Installing_Moodle

 A local copy can also be found in 

@@ -241,10 +241,13 @@

        if ($CFG->longtimenosee) { // value in days
            $cuttime = $timenow - ($CFG->longtimenosee * 3600 * 24);
-            $rs = get_recordset_sql ("SELECT id, userid, courseid
-                                        FROM {$CFG->prefix}user_lastaccess
-                                       WHERE courseid != ".SITEID."
-                                         AND timeaccess < $cuttime ");
+            $rs = get_recordset_sql ("SELECT la.id, la.userid, la.courseid
+                                        FROM {$CFG->prefix}user_lastaccess la
+                                        JOIN {$CFG->prefix}course c
+                                          ON c.id = la.courseid
+                                       WHERE la.courseid != ".SITEID."
+                                         AND la.timeaccess < $cuttime
+                                         AND c.metacourse = 0 ");
            while ($assign = rs_fetch_next_record($rs)) {
                if ($context = get_context_instance(CONTEXT_COURSE, $assign->courseid)) {
                    if (role_unassign(0, $assign->userid, 0, $context->id)) {
@@ -348,25 +351,24 @@
        mtrace('checking for create_password');
        if (count_records('user_preferences', 'name', 'create_password', 'value', '1')) {
            mtrace('creating passwords for new users');
-            $newusers = get_records_sql("SELECT  u.id as id, u.email, u.firstname, 
-                                                u.lastname, u.username,
-                                                p.id as prefid 
-                                        FROM {$CFG->prefix}user u 
-                                             JOIN {$CFG->prefix}user_preferences p ON u.id=p.userid
-                                        WHERE p.name='create_password' AND p.value='1' AND u.email !='' ");
-
-            foreach ($newusers as $newuserid => $newuser) {
-                $newuser->emailstop = 0; // send email regardless
-                // email user                               
-                if (setnew_password_and_mail($newuser)) {
-                    // remove user pref
-                    delete_records('user_preferences', 'id', $newuser->prefid);
-                } else {
-                    trigger_error("Could not create and mail new user password!");
+            $newuserssql = "SELECT u.id as id, u.email, u.firstname, u.lastname, u.username, p.id as prefid
+                              FROM {$CFG->prefix}user u
+                              JOIN {$CFG->prefix}user_preferences p ON u.id=p.userid
+                             WHERE p.name='create_password' AND p.value='1' AND u.email !='' ";
+            if ($newusers = get_records_sql($newuserssql)) {
+                foreach ($newusers as $newuserid => $newuser) {
+                    $newuser->emailstop = 0; // send email regardless
+                    // email user
+                    if (setnew_password_and_mail($newuser)) {
+                        // remove user pref
+                        delete_records('user_preferences', 'id', $newuser->prefid);
+                    } else {
+                        trigger_error("Could not create and mail new user password!");
+                    }
                }
            }
        }
-        
+
        if (!empty($CFG->usetags)) {
            require_once($CFG->dirroot.'/tag/lib.php');
            tag_cron();
@@ -328,4 +328,346 @@
      </CUSTOM_CHECK>
    </CUSTOM_CHECKS>
  </MOODLE>
+  <MOODLE version="2.1" requires="1.9">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mysql" version="5.0.25">
+        <FEEDBACK>
+          <ON_ERROR message="mysql416required" />
+        </FEEDBACK>
+      </VENDOR>
+      <VENDOR name="postgres" version="8.3" />
+      <VENDOR name="mssql" version="9.0" />
+      <VENDOR name="odbc_mssql" version="9.0" />
+      <VENDOR name="mssql_n" version="9.0" />
+      <VENDOR name="oracle" version="10.2" />
+      <VENDOR name="sqlite" version="2.0" />
+    </DATABASE>
+    <PHP version="5.3.2" level="required">
+    </PHP>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opensslrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="gdrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="intlrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="40M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="safe_mode" value="0" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingsafemode" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+  </MOODLE>
+  <MOODLE version="2.2" requires="1.9">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mysql" version="5.0.25">
+        <FEEDBACK>
+          <ON_ERROR message="mysql416required" />
+        </FEEDBACK>
+      </VENDOR>
+      <VENDOR name="postgres" version="8.3" />
+      <VENDOR name="mssql" version="9.0" />
+      <VENDOR name="odbc_mssql" version="9.0" />
+      <VENDOR name="mssql_n" version="9.0" />
+      <VENDOR name="oracle" version="10.2" />
+      <VENDOR name="sqlite" version="2.0" />
+    </DATABASE>
+    <PHP version="5.3.2" level="required">
+    </PHP>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opensslrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="gdrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="intlrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="40M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="safe_mode" value="0" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingsafemode" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+  </MOODLE>
+  <MOODLE version="2.3" requires="2.2">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mysql" version="5.0.25">
+        <FEEDBACK>
+          <ON_ERROR message="mysql416required" />
+        </FEEDBACK>
+      </VENDOR>
+      <VENDOR name="postgres" version="8.3" />
+      <VENDOR name="mssql" version="9.0" />
+      <VENDOR name="odbc_mssql" version="9.0" />
+      <VENDOR name="mssql_n" version="9.0" />
+      <VENDOR name="oracle" version="10.2" />
+      <VENDOR name="sqlite" version="2.0" />
+    </DATABASE>
+    <PHP version="5.3.2" level="required">
+    </PHP>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opensslrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="gdrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="intlrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="40M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="safe_mode" value="0" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingsafemode" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+  </MOODLE>
 </COMPATIBILITY_MATRIX>
@@ -47,7 +47,7 @@

 /// Check some PHP server settings

-    $documentationlink = '<a href="http://docs.moodle.org/en/Installation">Installation docs</a>';
+    $documentationlink = '<a href="http://docs.moodle.org/19/en/Installation">Installation docs</a>';

    if (ini_get_bool('session.auto_start')) {
        error("The PHP server variable 'session.auto_start' should be Off - $documentationlink");
@@ -143,7 +143,7 @@
            print_box(text_to_html(get_string('gpl')), 'copyrightnotice');
            echo "<br />";
            notice_yesno(get_string('doyouagree'), "index.php?agreelicense=1",
-                                                   "http://docs.moodle.org/en/License");
+                                                   "http://docs.moodle.org/dev/License");
            print_footer('none');
            exit;
        }
@@ -152,7 +152,7 @@
            $navigation = build_navigation(array(array('name'=>$strcurrentrelease, 'link'=>null, 'type'=>'misc')));
            print_header($strcurrentrelease, $strcurrentrelease, $navigation, "", "", false, "&nbsp;", "&nbsp;");
            print_heading("Moodle $release");
-            print_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/en/Release_Notes'), 'generalbox boxaligncenter boxwidthwide');
+            print_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/19/en/Release_Notes'), 'generalbox boxaligncenter boxwidthwide');
            echo '<form action="index.php"><div>';
            echo '<input type="hidden" name="agreelicense" value="1" />';
            echo '<input type="hidden" name="confirmrelease" value="1" />';
@@ -286,7 +286,7 @@
                $navigation = build_navigation(array(array('name'=>$strcurrentrelease, 'link'=>null, 'type'=>'misc')));
                print_header($strcurrentrelease, $strcurrentrelease, $navigation, "", "", false, "&nbsp;", "&nbsp;");
                print_heading("Moodle $release");
-                print_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/en/Release_Notes'));
+                print_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/19/en/Release_Notes'));

                require_once($CFG->libdir.'/environmentlib.php');
                print_heading(get_string('environment', 'admin'));
@@ -687,10 +687,10 @@
    //////////////////////////////////////////////////////////////////////////////////////////////////
    ////  IT IS ILLEGAL AND A VIOLATION OF THE GPL TO HIDE, REMOVE OR MODIFY THIS COPYRIGHT NOTICE ///
    $copyrighttext = '<a href="http://moodle.org/">Moodle</a> '.
-                     '<a href="http://docs.moodle.org/en/Release" title="'.$CFG->version.'">'.$CFG->release.'</a><br />'.
+                     '<a href="http://docs.moodle.org/dev/Releases" title="'.$CFG->version.'">'.$CFG->release.'</a><br />'.
                     'Copyright &copy; 1999 onwards, Martin Dougiamas<br />'.
-                     'and <a href="http://docs.moodle.org/en/Credits">many other contributors</a>.<br />'.
-                     '<a href="http://docs.moodle.org/en/License">GNU Public License</a>';
+                     'and <a href="http://docs.moodle.org/dev/Credits">many other contributors</a>.<br />'.
+                     '<a href="http://docs.moodle.org/dev/License">GNU Public License</a>';
    print_box($copyrighttext, 'copyright');
    //////////////////////////////////////////////////////////////////////////////////////////////////

@@ -75,12 +75,12 @@
                .$param->extras
                ." ORDER BY ".$param->orderby;
        }
-        error_log($sql);

        $courses = get_records_sql($sql, 0, $numcourses);

        if (empty($courses)) {
-            notify(get_string('statsnodata'));echo '</td></tr></table>';echo '<p>after notify</p>';
+            notify(get_string('statsnodata'));
+            echo '</td></tr></table>';

        } else {
            if (empty($CFG->gdversion)) {
@@ -72,7 +72,7 @@
    $straction = get_string('assignroles', 'role');
    $strroletoassign = get_string('roletoassign', 'role');
    $strsearch = get_string('search');
-    $strshowall = get_string('showall');
+    $strshowall = get_string('showallusers');
    $strparticipants = get_string('participants');
    $strsearchresults = get_string('searchresults');

@@ -8,6 +8,7 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
    $temp->add(new admin_setting_configcheckbox('protectusernames', get_string('protectusernames', 'admin'), get_string('configprotectusernames', 'admin'), 1));
    $temp->add(new admin_setting_configcheckbox('forcelogin', get_string('forcelogin', 'admin'), get_string('configforcelogin', 'admin'), 0));
    $temp->add(new admin_setting_configcheckbox('forceloginforprofiles', get_string('forceloginforprofiles', 'admin'), get_string('configforceloginforprofiles', 'admin'), 1));
+    $temp->add(new admin_setting_configcheckbox('forceloginforprofileimage', get_string('forceloginforprofileimage', 'admin'), get_string('forceloginforprofileimage_help', 'admin'), 0));
    $temp->add(new admin_setting_configcheckbox('opentogoogle', get_string('opentogoogle', 'admin'), get_string('configopentogoogle', 'admin'), 0));

    $max_upload_choices = get_max_upload_sizes();
@@ -67,6 +68,7 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
    $temp->add(new admin_setting_configcheckbox('cookiehttponly', get_string('cookiehttponly', 'admin'), get_string('configcookiehttponly', 'admin'), 0));
    $temp->add(new admin_setting_configcheckbox('regenloginsession', get_string('regenloginsession', 'admin'), get_string('configregenloginsession', 'admin'), 1));
    $temp->add(new admin_setting_configtext('excludeoldflashclients', get_string('excludeoldflashclients', 'admin'), get_string('configexcludeoldflashclients', 'admin'), '10.0.12', PARAM_TEXT));
+    $temp->add(new admin_setting_configcheckbox('loginpasswordautocomplete', get_string('loginpasswordautocomplete', 'admin'), get_string('loginpasswordautocomplete_help', 'admin'), 0));
    $ADMIN->add('security', $temp);


@@ -558,7 +558,7 @@ if ($formdata = $mform->is_cancelled()) {
                continue;
            }
            // save custom profile fields data
-            profile_save_data($user);
+            profile_save_data(addslashes_recursive($user));

            // make sure user context exists
            get_context_instance(CONTEXT_USER, $user->id);
@@ -665,7 +665,7 @@ if ($formdata = $mform->is_cancelled()) {
                    $newgroupdata = new object();
                    $newgroupdata->name = $addgroup;
                    $newgroupdata->courseid = $ccache[$shortname]->id;
-                    if ($ccache[$shortname]->groups[$addgroup]->id = groups_create_group($newgroupdata)){
+                    if ($ccache[$shortname]->groups[$addgroup]->id = groups_create_group(addslashes_recursive($newgroupdata))){
                        $ccache[$shortname]->groups[$addgroup]->name = $newgroupdata->name;
                    } else {
                        $upt->track('enrolments', get_string('unknowngroup', 'error', $addgroup), 'error');
@@ -2,7 +2,7 @@ XMLDB - Base classes and edition interface.

 Complete Documentation:

-  http://docs.moodle.org/en/XMLDB_Defining_one_XML_structure
+  http://docs.moodle.org/19/en/XMLDB_Defining_one_XML_structure

 Ciao, Eloy Lafuente (stronk7)

@@ -70,7 +70,7 @@ Once the XMLDB format was approved, we'll be able to build all the
 for each RDBMS flavour.

 Once the interface was finished (2-3 days from now) related documentation
-will be sent to http://docs.moodle.org/en/XML_database_schema in order
+will be sent to http://docs.moodle.org/19/en/XML_database_schema in order
 to comment/modify/approve the final XML format.

 All the code is, obviously GPL, with its copyrights and so on...
@@ -25,8 +25,8 @@
 ///////////////////////////////////////////////////////////////////////////

 /// This class will show all the reserved words in a format suitable to
-/// be pasted to: http://docs.moodle.org/en/XMLDB_reserved_words and
-/// http://docs.moodle.org/en/Database_reserved_words
+/// be pasted to: http://docs.moodle.org/19/en/XMLDB_reserved_words and
+/// http://docs.moodle.org/19/en/Database_reserved_words
 /// Also, it introspects te DB looking for such words and informing about

 class view_reserved_words extends XMLDBAction {
@@ -675,7 +675,7 @@ if ( !is_object($PHPCAS_CLIENT) ) {
                $droptablesql[] = 'DROP TEMPORARY TABLE ' . $temptable; // sql command to drop the table (because session scope could be a problem)
                execute_sql_arr($droptablesql, true, false); /// Drop temp table to avoid persistence problems later
                echo "Creating temp table $temptable\n";
-                execute_sql('CREATE TEMPORARY TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username)) TYPE=MyISAM', false);
+                execute_sql('CREATE TEMPORARY TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username)) ENGINE=MyISAM', false);
                break;
            case 'postgres':
                $temptable = $CFG->prefix . 'extuser';
@@ -563,7 +563,7 @@ class auth_plugin_ldap extends auth_plugin_base {
        switch (strtolower($CFG->dbfamily)) {
            case 'mysql':
                $droptablesql[] = 'DROP TEMPORARY TABLE ' . $temptable; // sql command to drop the table (because session scope could be a problem)
-                $createtemptablesql = 'CREATE TEMPORARY TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username)) TYPE=MyISAM';
+                $createtemptablesql = 'CREATE TEMPORARY TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username)) ENGINE=MyISAM';
                break;
            case 'postgres':
                $droptablesql[] = 'DROP TABLE ' . $temptable; // sql command to drop the table (because session scope could be a problem)
@@ -170,6 +170,10 @@ class auth_plugin_mnet extends auth_plugin_base {
        global $MNET;
        require_once $CFG->dirroot . '/mnet/xmlrpc/client.php';

+        if (!empty($USER->realuser)) {
+            print_error('notpermittedtojumpas', 'mnet');
+        }
+
        // check remote login permissions
        if (! has_capability('moodle/site:mnetlogintoremote', get_context_instance(CONTEXT_SYSTEM))
                or is_mnet_remote_user($USER)
@@ -306,6 +310,7 @@ class auth_plugin_mnet extends auth_plugin_base {
            }
            $remoteuser->mnethostid = $remotehost->id;
            $remoteuser->firstaccess = time(); // First time user in this server, grab it here
+            $remoteuser->confirmed = 1;

            if (!$remoteuser->id =  insert_record('user', addslashes_recursive($remoteuser))) {
                print_error('databaseerror', 'mnet');
@@ -193,18 +193,13 @@ class auth_plugin_shibboleth extends auth_plugin_base {
     *
     */
    function logoutpage_hook() {
-        global $redirect;
+        global $SESSION, $redirect;
        
-        // Only do this if logout handler is defined
-        if (
-              isset($this->config->logout_handler) 
-              && !empty($this->config->logout_handler)
-           ){
+        // Only do this if logout handler is defined, and if the user is actually logged in via Shibboleth
+        $logouthandlervalid = isset($this->config->logout_handler) && !empty($this->config->logout_handler);
+        if (  isset($SESSION->shibboleth_session_id) && $logouthandlervalid ) {
            // Check if there is an alternative logout return url defined
-            if (
-                  isset($this->config->logout_return_url) 
-                  && !empty($this->config->logout_return_url)
-               ){
+            if (isset($this->config->logout_return_url) && !empty($this->config->logout_return_url)) {
                // Set temp_redirect to alternative return url
                $temp_redirect = $this->config->logout_return_url;
            } else {
@@ -100,15 +100,22 @@ function schedule_backup_cron() {
                    $status = false;
                    continue;
                }
+                // Skip courses that do not yet need backup
+                $skipped = !($backup_course->nextstarttime > 0 && $backup_course->nextstarttime < $now);
                // Skip backup of unavailable courses that have remained unmodified in a month
-                $skipped = false;
-                if (!$course->visible && ($now - $course->timemodified) > 31*24*60*60) {  //Hidden + unmodified last month
-                    mtrace("            SKIPPING - hidden+unmodified");
-                    set_field("backup_courses","laststatus","3","courseid",$backup_course->courseid);
-                    $skipped = true;
+                if (!$skipped && !$course->visible && ($now - $course->timemodified) > 31*24*60*60) {  //Hidden + settings were unmodified last month
+                    //Check log if there were any modifications to the course content
+                    $sql = 'SELECT l.id FROM '.$CFG->prefix .'log l WHERE '.
+                            'l.course='. $course->id. ' AND l.time>'. ($now-31*24*60*60). " AND lower(l.action) not like '%view%'";
+                    $logexists = record_exists_sql($sql);
+                    if (!$logexists) {
+                        mtrace("            SKIPPING - hidden+unmodified");
+                        set_field("backup_courses", "laststatus", "3", "courseid", $backup_course->courseid);
+                        $skipped = true;
+                    }
                }
-                //Now we backup every non skipped course with nextstarttime < now
-                if (!$skipped  && $backup_course->nextstarttime > 0 && $backup_course->nextstarttime < $now) {
+                //Now we backup every non-skipped course
+                if (!$skipped) {
                    //We have to send a email because we have included at least one backup
                    $emailpending = true;
                    //Only make the backup if laststatus isn't 2-UNFINISHED (uncontrolled error)
@@ -66,7 +66,7 @@ function backup_upgrade($oldversion=0) {
                      `value` varchar(255) NOT NULL default '',
                      PRIMARY KEY  (`id`),
                      UNIQUE KEY `name` (`name`)
-                  ) TYPE=MyISAM COMMENT='To store backup configuration variables'");
+                  ) ENGINE=MyISAM COMMENT='To store backup configuration variables'");
    }

    if ($oldversion < 2003120800 and $result) {
@@ -79,7 +79,7 @@ function backup_upgrade($oldversion=0) {
                      `nextstarttime` int(10) unsigned NOT NULL default '0',
                      PRIMARY KEY  (`id`),
                      UNIQUE KEY `courseid` (`courseid`)
-                  ) TYPE=MyISAM COMMENT='To store every course backup status'");
+                  ) ENGINE=MyISAM COMMENT='To store every course backup status'");

        if ($result) {
            $result = execute_sql("CREATE TABLE `{$CFG->prefix}backup_log` (    
@@ -89,7 +89,7 @@ function backup_upgrade($oldversion=0) {
                          `laststarttime` int(10) unsigned NOT NULL default '0',
                          `info` varchar(255) NOT NULL default '',
                          PRIMARY KEY  (`id`)
-                      ) TYPE=MyISAM COMMENT='To store every course backup log info'");
+                      ) ENGINE=MyISAM COMMENT='To store every course backup log info'");
        }
    }

@@ -105,7 +105,7 @@ function backup_upgrade($oldversion=0) {
                          `new_id` int(10) unsigned NOT NULL default '0',
                          PRIMARY KEY  (`id`),
                          UNIQUE KEY `{$CFG->prefix}backup_files_uk` (`backup_code`,`file_type`,`path`)
-                      ) TYPE=MyISAM COMMENT='To store and recode ids to user and course files.'");
+                      ) ENGINE=MyISAM COMMENT='To store and recode ids to user and course files.'");
        }
        if ($result) {
            $result = execute_sql("DROP TABLE {$CFG->prefix}backup_ids");
@@ -120,7 +120,7 @@ function backup_upgrade($oldversion=0) {
                          `info` mediumtext,
                          PRIMARY KEY  (`id`),
                          UNIQUE KEY `{$CFG->prefix}backup_ids_uk` (`backup_code` ,`table_name`,`old_id`)
-                      ) TYPE=MyISAM COMMENT='To store and convert ids in backup/restore'");
+                      ) ENGINE=MyISAM COMMENT='To store and convert ids in backup/restore'");
        }
    }

@@ -209,10 +209,29 @@ define('RESTORE_GROUPS_GROUPINGS', 3);

        // Links to course
        $searchstring = '/\$@(COURSEVIEWBYID)\*([0-9]+)@\$/';
-        $replacestring= $CFG->wwwroot . '/course/view.php?id=' . $restore->course_id;
-        $result = preg_replace($searchstring, $replacestring, $content);
+        // We look for it
+        preg_match_all($searchstring, $content, $foundset);
+        // If found, then we are going to look for its new id (in backup tables)
+        if ($foundset[0]) {
+            // Iterate over foundset[2]. They are the old_ids
+            foreach ($foundset[2] as $old_id) {
+                // We get the needed variables here (course id)
+                $rec = backup_getid($restore->backup_unique_code, 'course', $old_id);
+                // Personalize the searchstring
+                $searchstring = '/\$@(COURSEVIEWBYID)\*('.$old_id.')@\$/';
+                // If it is a link to itself, replace it
+                if (!empty($rec->new_id)) {
+                    $replacestring = $CFG->wwwroot . '/course/view.php?id=' . $rec->new_id;
+                // It s a link to another course, keep it unmodified
+                } else {
+                    $replacestring = $restore->original_wwwroot . '/course/view.php?id=' . $old_id;
+                }
+                // Perform the replacement
+                $content = preg_replace($searchstring, $replacestring, $content);
+            }
+        }

-        return $result;
+        return $content;
    }

    //This function is called from all xxxx_decode_content_links_caller(),
@@ -142,7 +142,7 @@ global $CFG;
           `visible` tinyint(1) not null default '0',
           `configdata` text not null default '',
           PRIMARY KEY(`id`)
-          ) TYPE=MyISAM;");
+          ) ENGINE=MyISAM;");
    }
    
    if ($oldversion < 2005090200) {
@@ -49,7 +49,12 @@ class block_login extends block_base {
            $this->content->text .= '<input type="text" name="username" id="login_username" value="'.s($username).'" /></div>';

            $this->content->text .= '<div class="c1 fld password"><label for="login_password">'.get_string('password').'</label>';
-            $this->content->text .= '<input type="password" name="password" id="login_password" value="" /></div>';
+
+            if (!empty($CFG->loginpasswordautocomplete)) {
+                $this->content->text .= '<input type="password" name="password" id="login_password" value="" autocomplete="off" /></div>';
+            } else {
+                $this->content->text .= '<input type="password" name="password" id="login_password" value="" /></div>';
+            }

            $this->content->text .= '<div class="c1 btn"><input type="submit" value="'.get_string('login').'" /></div>';

@@ -32,6 +32,14 @@ class block_mnet_hosts extends block_list {
            return '';
        }

+        if (!empty($USER->realuser)) {
+            $this->content = new stdClass();
+            $this->content->items = array();
+            $this->content->icons = array();
+            $this->content->footer = get_string('notpermittedtojumpas', 'mnet');
+            return $this->content;
+        }
+
        // check for outgoing roaming permission first
        if (!has_capability('moodle/site:mnetlogintoremote', get_context_instance(CONTEXT_SYSTEM), NULL, false)) {
            return '';
@@ -672,7 +672,7 @@
            $querystring = '';
            foreach($_GET as $var => $val) {
                $var = clean_param($var, PARAM_ALPHANUM);   // See MDL-22631
-                $val = clean_param($val, PARAM_CLEAN);
+                $val = urlencode(clean_param($val, PARAM_CLEAN));
                if(!$first) {
                    $first = true;
                    if ($var != 'filterselect' && $var != 'filtertype') {
@@ -683,13 +683,13 @@
                    }
                } else {
                    if ($var != 'filterselect' && $var != 'filtertype') {
-                        $querystring .= '&amp;'.$var.'='.$val;
+                        $querystring .= '&'.$var.'='.$val;
                        $hasparam = true;
                    }
                }
            }
            if (isset($hasparam)) {
-                $querystring .= '&amp;';
+                $querystring .= '&';
            } else {
                $querystring = '?';
            }
@@ -697,9 +697,8 @@
            $querystring = '?';
        }

-        return strip_querystring(qualified_me()) . $querystring. 'filtertype='.
-                $filtertype.'&amp;filterselect='.$filterselect.'&amp;';
-
+        return s(strip_querystring(qualified_me()) . $querystring. 'filtertype='.
+                $filtertype.'&filterselect='.$filterselect.'&', true);
    }

    /**
@@ -49,9 +49,9 @@
    $eventid = optional_param('id', 0, PARAM_INT);
    $eventtype = optional_param('type', 'select', PARAM_ALPHA);
    $urlcourse = optional_param('course', 0, PARAM_INT);
-    $cal_y = optional_param('cal_y');
-    $cal_m = optional_param('cal_m');
-    $cal_d = optional_param('cal_d');
+    $cal_y = optional_param('cal_y', 0, PARAM_INT);
+    $cal_m = optional_param('cal_m', 0, PARAM_INT);
+    $cal_d = optional_param('cal_d', 0, PARAM_INT);

    if(isguest()) {
        // Guests cannot do anything with events
@@ -103,6 +103,7 @@
    }

    $form = null;
+    $err = array();

    switch($action) {
        case 'delete':
@@ -129,23 +130,7 @@
            }

            if($form = data_submitted() and confirm_sesskey()) {
-
-                $form->name = clean_param(strip_tags($form->name,'<lang><span>'), PARAM_CLEAN);
-
-                $form->timestart = make_timestamp($form->startyr, $form->startmon, $form->startday, $form->starthr, $form->startmin);
-                if($form->duration == 1) {
-                    $form->timeduration = make_timestamp($form->endyr, $form->endmon, $form->endday, $form->endhr, $form->endmin) - $form->timestart;
-                    if($form->timeduration < 0) {
-                        $form->timeduration = 0;
-                    }
-                }
-                else if($form->duration == 2) {
-                    $form->timeduration = $form->minutes * MINSECS;
-                }
-                else {
-                    $form->timeduration = 0;
-                }
-
+                // validate form and set error if any.
                validate_form($form, $err);

                if (count($err) == 0) {
@@ -194,27 +179,13 @@
            $title = get_string('newevent', 'calendar');
            $form = data_submitted();
            if(!empty($form) && !empty($form->name) && confirm_sesskey()) {
-
-                $form->name = clean_text(strip_tags($form->name, '<lang><span>'));
-
-                $form->timestart = make_timestamp($form->startyr, $form->startmon, $form->startday, $form->starthr, $form->startmin);
-                if($form->duration == 1) {
-                    $form->timeduration = make_timestamp($form->endyr, $form->endmon, $form->endday, $form->endhr, $form->endmin) - $form->timestart;
-                    if($form->timeduration < 0) {
-                        $form->timeduration = 0;
-                    }
-                }
-                else if ($form->duration == 2) {
-                    $form->timeduration = $form->minutes * MINSECS;
-                }
-                else {
-                    $form->timeduration = 0;
-                }
-                if(!calendar_add_event_allowed($form)) {
-                    error('You are not authorized to do this');
-                }
+                // validate form and set error if any.
                validate_form($form, $err);
+
                if (count($err) == 0) {
+                    if (!calendar_add_event_allowed($form)) {
+                        error('You are not authorized to do this');
+                    }
                    $form->timemodified = time();

                    /// Get the event id for the log record.
@@ -568,11 +539,44 @@


 function validate_form(&$form, &$err) {
+    $cleanform = new stdClass();
+    //first clean the form values
+    $cleanform->name = clean_param(strip_tags(trim($form->name), '<lang><span>'),PARAM_CLEAN);
+    $cleanform->description = addslashes(clean_param($form->description, PARAM_CLEANHTML));
+    $cleanform->duration = clean_param($form->duration, PARAM_INT);
+    $cleanform->startmon = clean_param($form->startmon, PARAM_INT);
+    $cleanform->startday = clean_param($form->startday, PARAM_INT);
+    $cleanform->startyr = clean_param($form->startyr, PARAM_INT);
+    $cleanform->starthr = clean_param($form->starthr, PARAM_INT);
+    $cleanform->startmin = clean_param($form->startmin, PARAM_INT);
+    $cleanform->endmon = clean_param($form->endmon, PARAM_INT);
+    $cleanform->endday = clean_param($form->endday, PARAM_INT);
+    $cleanform->endyr = clean_param($form->endyr, PARAM_INT);
+    $cleanform->endhr = clean_param($form->endhr, PARAM_INT);
+    $cleanform->endmin = clean_param($form->endmin, PARAM_INT);
+    $cleanform->minutes = clean_param($form->minutes, PARAM_INT);
+    $cleanform->courseid = clean_param($form->courseid, PARAM_INT);
+    $cleanform->format = clean_param($form->format, PARAM_INT);
+    $cleanform->course = clean_param($form->course, PARAM_INT);
+    $cleanform->action = clean_param($form->action, PARAM_ALPHA);

-    $form->name = trim($form->name);
-    $form->description = trim($form->description);
+    // These values are only required for new event.
+    if ($cleanform->action === 'new') {
+        $cleanform->repeat = clean_param($form->repeat, PARAM_INT);
+        $cleanform->repeats = clean_param($form->repeats, PARAM_INT);
+        $cleanform->groupid = clean_param($form->groupid, PARAM_INT);
+        $cleanform->userid = clean_param($form->userid, PARAM_INT);
+        $cleanform->modulename = clean_param($form->modulename, PARAM_SAFEDIR);
+        $cleanform->eventtype = clean_param($form->eventtype, PARAM_ALPHA);
+        $cleanform->instance = clean_param($form->instance, PARAM_INT);
+        $cleanform->type = clean_param($form->type, PARAM_ALPHA);
+    } else {
+        $cleanform->id = clean_param($form->id, PARAM_INT);
+    }
+    // set form with clean and valid values only.
+    $form = $cleanform;

-    if(empty($form->name)) {
+    if (empty($form->name)) {
        $err['name'] = get_string('errornoeventname', 'calendar');
    }
 /* Allow events without a description
@@ -580,28 +584,53 @@ function validate_form(&$form, &$err) {
        $err['description'] = get_string('errornodescription', 'calendar');
    }
 */
-    if(!checkdate($form->startmon, $form->startday, $form->startyr)) {
+    if (!checkdate($form->startmon, $form->startday, $form->startyr)) {
        $err['timestart'] = get_string('errorinvaliddate', 'calendar');
    }
-    if($form->duration == 2 and !checkdate($form->endmon, $form->endday, $form->endyr)) {
+    if ($form->duration == 1 and !checkdate($form->endmon, $form->endday, $form->endyr)) {
        $err['timeduration'] = get_string('errorinvaliddate', 'calendar');
    }
-    if($form->duration == 2 and !($form->minutes > 0 and $form->minutes < 1000)) {
+    if ($form->duration == 2 and !($form->minutes > 0 and $form->minutes < 1000)) {
        $err['minutes'] = get_string('errorinvalidminutes', 'calendar');
    }
    if (!empty($form->repeat) and !($form->repeats > 1 and $form->repeats < 100)) {
        $err['repeats'] = get_string('errorinvalidrepeats', 'calendar');
    }
-    if(!empty($form->courseid)) {
+
+    // set start time and duration
+    $form->timestart = make_timestamp($form->startyr, $form->startmon, $form->startday, $form->starthr, $form->startmin);
+    if ($form->duration == 1) {
+        $form->timeduration = make_timestamp($form->endyr, $form->endmon, $form->endday, $form->endhr, $form->endmin) - $form->timestart;
+        // Duration should be set for time in future.
+        if ($form->timeduration <= 0) {
+            $err['timeduration'] = get_string('errorinvaliddate', 'calendar');
+            $form->timeduration = 0;
+        }
+    }
+    else if ($form->duration == 2) {
+        $form->timeduration = $form->minutes * MINSECS;
+    }
+    else {
+        $form->timeduration = 0;
+    }
+
+    if (!empty($form->courseid)) {
        // Timestamps must be >= course startdate
        $course = get_record('course', 'id', $form->courseid);
-        if($course === false) {
+        if ($course === false) {
            error('Event belongs to invalid course');
        }
        else if($form->timestart < $course->startdate) {
            $err['timestart'] = get_string('errorbeforecoursestart', 'calendar');
        }
    }
+    if (!empty($form->modulename)) {
+        // Check that passed modulename actually exists (possible SQL Injection route)
+        $module = get_record('modules', 'name', $form->modulename);
+        if ($module === false) {
+            error('Invalid module name');
+        }
+    }
 }

 function calendar_add_event_allowed($event) {
@@ -1582,6 +1582,7 @@ function calendar_get_allowed_types(&$allowed) {
    if(!empty($SESSION->cal_course_referer) && $SESSION->cal_course_referer != SITEID) {
        $course = get_record('course', 'id', $SESSION->cal_course_referer);
        $coursecontext = get_context_instance(CONTEXT_COURSE, $SESSION->cal_course_referer);
+        $allowed->user = has_capability('moodle/calendar:manageownentries', $coursecontext);

        if(has_capability('moodle/calendar:manageentries', $coursecontext)) {
            $allowed->courses = array($course->id => 1);
@@ -41,15 +41,14 @@
    require_once('../config.php');
    require_once($CFG->dirroot.'/calendar/lib.php');

-    $from = required_param('from');
-    $var = required_param('var');
-    $value = optional_param('value');
-    $id = optional_param('id');
-    $cal_d = optional_param('cal_d');
-    $cal_m = optional_param('cal_m');
-    $cal_y = optional_param('cal_y');
-    $action = optional_param('action');
-    $type = optional_param('type');
+    $from = required_param('from', PARAM_ALPHA);
+    $var = required_param('var', PARAM_ALPHA);
+    $id = optional_param('id', 0, PARAM_INT);
+    $cal_d = optional_param('cal_d', 0, PARAM_INT);
+    $cal_m = optional_param('cal_m', 0, PARAM_INT);
+    $cal_y = optional_param('cal_y', 0, PARAM_INT);
+    $action = optional_param('action', '', PARAM_ALPHA);
+    $type = optional_param('type', '', PARAM_ALPHA);

    // Initialize the session variables
    calendar_session_vars();
@@ -107,7 +106,7 @@

    switch($from) {
        case 'event':
-            redirect(CALENDAR_URL.'event.php?action='.$action.'&amp;type='.$type.'&amp;id='.intval($id));
+            redirect(CALENDAR_URL.'event.php?action='.$action.'&amp;type='.$type.'&amp;id='.$id);
        break;
        case 'month':
            redirect(CALENDAR_URL.'view.php?view=month'.$courseid.'&cal_d='.$cal_d.'&cal_m='.$cal_m.'&cal_y='.$cal_y);
@@ -119,7 +118,7 @@
            redirect(CALENDAR_URL.'view.php?view=day'.$courseid.'&cal_d='.$cal_d.'&cal_m='.$cal_m.'&cal_y='.$cal_y);
        break;
        case 'course':
-            redirect($CFG->wwwroot.'/course/view.php?id='.intval($id));
+            redirect($CFG->wwwroot.'/course/view.php?id='.$id);
        break;
        default:

@@ -426,7 +426,7 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course
    }

    // Now display all the calendar
-    for($day = 1; $day <= $display->maxdays; ++$day, ++$dayweek) {
+    for($aday = 1; $aday <= $display->maxdays; ++$aday, ++$dayweek) {
        if($dayweek > $display->maxwday) {
            // We need to change week (table row)
            echo "</tr>\n<tr>";
@@ -436,7 +436,7 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course

        // Reset vars
        $cell = '';
-        $dayhref = calendar_get_link_href(CALENDAR_URL.'view.php?view=day&amp;course='.$courseid.'&amp;', $day, $m, $y);
+        $dayhref = calendar_get_link_href(CALENDAR_URL.'view.php?view=day&amp;course='.$courseid.'&amp;', $aday, $m, $y);

        if(CALENDAR_WEEKEND & (1 << ($dayweek % 7))) {
            // Weekend. This is true no matter what the exact range is.
@@ -448,35 +448,35 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course
        }

        // Special visual fx if an event is defined
-        if(isset($eventsbyday[$day])) {
-            if(count($eventsbyday[$day]) == 1) {
+        if(isset($eventsbyday[$aday])) {
+            if(count($eventsbyday[$aday]) == 1) {
                $title = get_string('oneevent', 'calendar');
            }
            else {
-                $title = get_string('manyevents', 'calendar', count($eventsbyday[$day]));
+                $title = get_string('manyevents', 'calendar', count($eventsbyday[$aday]));
            }
-            $cell = '<div class="day"><a href="'.$dayhref.'" title="'.$title.'">'.$day.'</a></div>';
+            $cell = '<div class="day"><a href="'.$dayhref.'" title="'.$title.'">'.$aday.'</a></div>';
        }
        else {
-            $cell = '<div class="day">'.$day.'</div>';
+            $cell = '<div class="day">'.$aday.'</div>';
        }

        // Special visual fx if an event spans many days
-        if(isset($typesbyday[$day]['durationglobal'])) {
+        if(isset($typesbyday[$aday]['durationglobal'])) {
            $class .= ' duration_global';
        }
-        else if(isset($typesbyday[$day]['durationcourse'])) {
+        else if(isset($typesbyday[$aday]['durationcourse'])) {
            $class .= ' duration_course';
        }
-        else if(isset($typesbyday[$day]['durationgroup'])) {
+        else if(isset($typesbyday[$aday]['durationgroup'])) {
            $class .= ' duration_group';
        }
-        else if(isset($typesbyday[$day]['durationuser'])) {
+        else if(isset($typesbyday[$aday]['durationuser'])) {
            $class .= ' duration_user';
        }

        // Special visual fx for today
-        if($display->thismonth && $day == $d) {
+        if($display->thismonth && $aday == $d) {
            $class .= ' today';
        } else {
            $class .= ' nottoday';
@@ -488,9 +488,9 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course
        }
        echo '<td'.$class.'>'.$cell;

-        if(isset($eventsbyday[$day])) {
+        if(isset($eventsbyday[$aday])) {
            echo '<ul class="events-new">';
-            foreach($eventsbyday[$day] as $eventindex) {
+            foreach($eventsbyday[$aday] as $eventindex) {

                // If event has a class set then add it to the event <li> tag
                $eventclass = '';
@@ -502,9 +502,9 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course
            }
            echo '</ul>';
        }
-        if(isset($durationbyday[$day])) {
+        if(isset($durationbyday[$aday])) {
            echo '<ul class="events-underway">';
-            foreach($durationbyday[$day] as $eventindex) {
+            foreach($durationbyday[$aday] as $eventindex) {
                echo '<li>['.format_string($events[$eventindex]->name,true).']</li>';
            }
            echo '</ul>';
@@ -57,7 +57,7 @@
        if ($resort and confirm_sesskey()) {
            if ($courses = get_courses($category->id, "fullname ASC", 'c.id,c.fullname,c.sortorder')) {
                // move it off the range
-                
+
                $sortorderresult = get_record_sql('SELECT MIN(sortorder) AS min, 1
                                         FROM ' . $CFG->prefix . 'course WHERE category=' . $category->id);
                $sortordermin = $sortorderresult->min;
@@ -131,7 +131,10 @@
 /// Print current category description
    if (!$editingon && $category->description) {
        print_box_start();
-        echo format_text($category->description); // for multilang filter
+        $options = new stdClass();
+        $options->noclean = true;
+        $options->para = false;
+        echo format_text($category->description, FORMAT_MOODLE, $options); // for multilang filter
        print_box_end();
    }

@@ -21,7 +21,7 @@
 </tr>
 </table>
 <div class="singlebutton">
-<input type="hidden" name="id" value="<?php echo $form->id ?>" />
+<input type="hidden" name="id" value="<?php echo $id ?>" />
 <input type="hidden" name="sesskey" value="<?php echo sesskey() ?>" />
 <input type="submit" value="<?php print_string("savechanges") ?>" />
 </div>
@@ -54,7 +54,7 @@
    } else {
        $sectionname  = get_section_name($course->format);
        $stredit      = get_string('edit', '', " $sectionname $section->section");
-        $strsummaryof = get_string('summaryof', '', " $sectionname $form->section");
+        $strsummaryof = get_string('summaryof', '', " $sectionname $section->section");
    }

    print_header_simple($stredit, '', build_navigation(array(array('name' => $stredit, 'link' => null, 'type' => 'misc'))), 'theform.summary' );
@@ -53,7 +53,7 @@
    }

 /// Check if the course is a meta course  (bug 5734)
-    if ($course->metacourse) {
+    if ($course->metacourse && !($course->guest == 2 && isguestuser())) {
        print_header_simple();
        notice(get_string('coursenotaccessible'), "$CFG->wwwroot/index.php");
    }
@@ -523,7 +523,7 @@ function print_log_csv($course, $user, $date, $order='l.time DESC', $modname,
    header("Pragma: public");

    echo get_string('savedat').userdate(time(), $strftimedatetime)."\n";
-    echo $text;
+    echo $text."\n";

    if (empty($logs['logs'])) {
        return true;
@@ -71,7 +71,7 @@ class enrolment_plugin_authorize
            $curcost = get_course_cost($course);
            echo '<div class="mdl-align">';
            echo '<p>'.get_string('paymentrequired').'</p>';
-            echo '<p><b>'.get_string('cost').": $curcost[currency] $curcost[cost]".'</b></p>';
+            echo '<p><b>'.get_string('cost').': '. $curcost['currency'] . $curcost['localizedcost'] .'</b></p>';
            echo '<p><a href="'.$CFG->httpswwwroot.'/login/">'.get_string('loginsite').'</a></p>';
            echo '</div>';
        }
@@ -387,7 +387,7 @@ class enrolment_plugin_authorize
            }

            $str .= '<div class="cost" title="'.$strrequirespayment.'">'.$strcost.': ';
-            $str .= $currency . ' ' . $curcost['cost'].'</div>';
+            $str .= $currency . ' ' . $curcost['localizedcost'].'</div>';
        }

        return $str;
@@ -12,10 +12,11 @@ function get_course_cost($course)
    if (!empty($course->cost)) {
        $cost = (float)(((float)$course->cost) < 0) ? $CFG->enrol_cost : $course->cost;
    }
-
-    $cost = format_float($cost, 2);
+    $costlocalizeddisplay = format_float($cost, 2);
+    $cost = format_float($cost, 2, false);
    $ret = array(
        'cost' => $cost,
+        'localizedcost' => $costlocalizeddisplay,
        'currency' => $currency
    );

@@ -157,13 +157,13 @@ function get_access_icons($course) {
                        continue;
                    }

-                    if (! $user = get_record("user", "idnumber", $fields[2]) ) {
+                    if (! $user = get_record("user", "idnumber", addslashes($fields[2])) ) {
                        $this->log .= "Unknown user idnumber in field 3 - ignoring line\n";
                        continue;
                    }


-                    if (! $course = get_record("course", "idnumber", $fields[3]) ) {
+                    if (! $course = get_record("course", "idnumber", addslashes($fields[3])) ) {
                        $this->log .= "Unknown course idnumber in field 4 - ignoring line\n";
                        continue;
                    }
@@ -315,6 +315,7 @@ class enrolment_plugin_mnet {
            $userrecord->firstname  = addslashes($user['firstname']);
            $userrecord->lastname   = addslashes($user['lastname']);
            $userrecord->mnethostid = $MNET_REMOTE_CLIENT->id;
+            $userrecord->confirmed  = 1;

            if ($userrecord->id = insert_record('user', $userrecord)) {
                $userrecord = get_record('user','id', $userrecord->id);
@@ -539,7 +539,7 @@
                $file = basename($file);

                if (!unzip_file("$basedir$wdir/$file")) {
-                    print_error("unzipfileserror","error");
+                    print_error("cannotunzipfile", "error");
                }

                echo "<div style=\"text-align:center\"><form action=\"index.php\" method=\"get\">";
@@ -36,80 +36,80 @@ function mediaplugin_filter($courseid, $text) {
    $newtext = $text; // fullclone is slow and not needed here

    if ($CFG->filter_mediaplugin_enable_mp3) {
-        $search = '/<a.*?href="([^"]+\.mp3)"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.mp3)"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_mp3_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_ogg) {
-        $search =   '/<a[^>]*?href="([^"]+\.ogg)"[^>]*>.*?<\/a>/is';
+        $search =   '/<a\s[^>]*href="([^"]+\.ogg)"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'filter_mediaplugin_ogg_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_ogv) {
-        $search =   '/<a[^>]*?href="([^"]+\.ogv)"[^>]*>.*?<\/a>/is';
+        $search =   '/<a\s[^>]*href="([^"]+\.ogv)"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'filter_mediaplugin_ogv_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_swf) {
-        $search = '/<a.*?href="([^"]+\.swf)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.swf)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_swf_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_flv) {
-        $search = '/<a.*?href="([^"]+\.flv)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.flv)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_flv_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_mov) {
-        $search = '/<a.*?href="([^"]+\.mov)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.mov)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);

        // MDL-18658
-        $search = '/<a.*?href="([^"]+\.mp4)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.mp4)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);

-        $search = '/<a.*?href="([^"]+\.m4v)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.m4v)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);

-        $search = '/<a.*?href="([^<]+\.m4a)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^<]+\.m4a)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_wmv) {
-        $search = '/<a.*?href="([^"]+\.wmv)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.wmv)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_wmp_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_mpg) {
-        $search = '/<a.*?href="([^"]+\.mpe?g)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.mpe?g)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_avi) {
-        $search = '/<a.*?href="([^"]+\.avi)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.avi)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_wmp_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_ram) {
-        $search = '/<a.*?href="([^"]+\.ram)"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.ram)"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_real_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_rpm) {
-        $search = '/<a.*?href="([^"]+\.rpm)"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.rpm)"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_real_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_rm) {
-        $search = '/<a.*?href="([^"]+\.rm)"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.rm)"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_real_callback', $newtext);
    }

    if (!empty($CFG->filter_mediaplugin_enable_youtube)) {
-        $search = '/<a[^>]*?href="([^"]*)youtube.com\/watch\?v=([^"]*)"[^>]*>(.*?)<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]*)youtube.com\/watch\?v=([^"]*)"[^>]*>(.*?)<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_youtube_callback', $newtext);

-        $search = '/<a[^>]*?href="([^"]*)youtube.com\/v\/([^"]*)"[^>]*>(.*?)<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]*)youtube.com\/v\/([^"]*)"[^>]*>(.*?)<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_youtube_callback', $newtext);
    }

@@ -115,7 +115,7 @@ class edit_outcome_form extends moodleform {
            if (empty($courseid)) {
                $mform->hardFreeze('standard');

-            } else if (empty($outcome->courseid) and !has_capability('moodle/grade:manage', get_context_instance(CONTEXT_SYSTEM))) {
+            } else if (!has_capability('moodle/grade:manage', get_context_instance(CONTEXT_SYSTEM))) {
                $mform->hardFreeze('standard');

            } else if ($coursecount and empty($outcome->courseid)) {
@@ -108,10 +108,14 @@ class graded_users_iterator {

        $users_sql = "SELECT u.* $ofields
                        FROM {$CFG->prefix}user u
-                             INNER JOIN {$CFG->prefix}role_assignments ra ON u.id = ra.userid
                             $groupsql
-                       WHERE ra.roleid $gradebookroles
-                             AND ra.contextid $relatedcontexts
+                        JOIN (
+                                 SELECT DISTINCT ra.userid
+                                   FROM {$CFG->prefix}role_assignments ra
+                                  WHERE ra.roleid $gradebookroles
+                                    AND ra.contextid $relatedcontexts
+                             ) rainner ON rainner.userid = u.id
+                       WHERE u.deleted = 0
                             $groupwheresql
                    ORDER BY $order";

@@ -123,13 +127,17 @@ class graded_users_iterator {

            $grades_sql = "SELECT g.* $ofields
                             FROM {$CFG->prefix}grade_grades g
-                                  INNER JOIN {$CFG->prefix}user u ON g.userid = u.id
-                                  INNER JOIN {$CFG->prefix}role_assignments ra ON u.id = ra.userid
+                             JOIN {$CFG->prefix}user u ON g.userid = u.id
                                  $groupsql
-                            WHERE ra.roleid $gradebookroles
-                                  AND ra.contextid $relatedcontexts
-                                  AND g.itemid IN ($itemids)
-                                  $groupwheresql
+                             JOIN (
+                                      SELECT DISTINCT ra.userid
+                                        FROM {$CFG->prefix}role_assignments ra
+                                       WHERE ra.roleid $gradebookroles
+                                         AND ra.contextid $relatedcontexts
+                                  ) rainner ON rainner.userid = u.id
+                            WHERE u.deleted = 0
+                              AND g.itemid IN ($itemids)
+                              $groupwheresql
                         ORDER BY $order, g.itemid ASC";
            $this->grades_rs = get_recordset_sql($grades_sql);
        } else {
@@ -327,41 +327,38 @@ class grade_report_grader extends grade_report {
        global $CFG;

        if (is_numeric($this->sortitemid)) {
-            // the MAX() magic is required in order to please PG
-            $sort = "MAX(g.finalgrade) $this->sortorder";
-
-            $sql = "SELECT u.id, u.firstname, u.lastname, u.imagealt, u.picture, u.idnumber
-                      FROM {$CFG->prefix}user u
-                           JOIN {$CFG->prefix}role_assignments ra ON ra.userid = u.id
-                           $this->groupsql
-                           LEFT JOIN {$CFG->prefix}grade_grades g ON (g.userid = u.id AND g.itemid = $this->sortitemid)
-                     WHERE ra.roleid in ($this->gradebookroles) AND u.deleted = 0
-                           $this->groupwheresql
-                           AND ra.contextid ".get_related_contexts_string($this->context)."
-                  GROUP BY u.id, u.firstname, u.lastname, u.imagealt, u.picture, u.idnumber
-                  ORDER BY $sort";
-
+            $sortjoin = "LEFT JOIN {$CFG->prefix}grade_grades g ON " .
+                    "g.userid = u.id AND g.itemid = $this->sortitemid";
+            $sort = "g.finalgrade $this->sortorder";
        } else {
+            $sortjoin = '';
            switch($this->sortitemid) {
                case 'lastname':
-                    $sort = "u.lastname $this->sortorder, u.firstname $this->sortorder"; break;
+                    $sort = "u.lastname $this->sortorder, u.firstname $this->sortorder";
+                    break;
                case 'firstname':
-                    $sort = "u.firstname $this->sortorder, u.lastname $this->sortorder"; break;
+                    $sort = "u.firstname $this->sortorder, u.lastname $this->sortorder";
+                    break;
                case 'idnumber':
                default:
-                    $sort = "u.idnumber $this->sortorder"; break;
+                    $sort = "u.idnumber $this->sortorder";
+                    break;
            }
-
-            $sql = "SELECT DISTINCT u.id, u.firstname, u.lastname, u.imagealt, u.picture, u.idnumber
-                      FROM {$CFG->prefix}user u
-                           JOIN {$CFG->prefix}role_assignments ra ON u.id = ra.userid
-                           $this->groupsql
-                     WHERE ra.roleid in ($this->gradebookroles)
-                           $this->groupwheresql
-                           AND ra.contextid ".get_related_contexts_string($this->context)."
-                  ORDER BY $sort";
        }

+        $sql = "SELECT u.id, u.firstname, u.lastname, u.imagealt, u.picture, u.idnumber
+                  FROM {$CFG->prefix}user u
+                       $this->groupsql
+                       $sortjoin
+                  JOIN (
+                           SELECT DISTINCT ra.userid
+                             FROM {$CFG->prefix}role_assignments ra
+                            WHERE ra.roleid IN ($this->gradebookroles)
+                              AND ra.contextid " . get_related_contexts_string($this->context) . "
+                       ) rainner ON rainner.userid = u.id
+                 WHERE u.deleted = 0
+                   $this->groupwheresql
+              ORDER BY $sort";

        $this->users = get_records_sql($sql, $this->get_pref('studentsperpage') * $this->page,
                            $this->get_pref('studentsperpage'));
@@ -1152,20 +1149,24 @@ class grade_report_grader extends grade_report {
        if ($showaverages) {

            // find sums of all grade items in course
-            $SQL = "SELECT g.itemid, SUM(g.finalgrade) AS sum
+            $sql = "SELECT g.itemid, SUM(g.finalgrade) AS sum
                      FROM {$CFG->prefix}grade_items gi
-                           JOIN {$CFG->prefix}grade_grades g      ON g.itemid = gi.id
-                           JOIN {$CFG->prefix}user u              ON u.id = g.userid
-                           JOIN {$CFG->prefix}role_assignments ra ON ra.userid = u.id
+                           JOIN {$CFG->prefix}grade_grades g ON g.itemid = gi.id
+                           JOIN {$CFG->prefix}user u ON u.id = g.userid
                           $groupsql
-                     WHERE gi.courseid = $this->courseid
-                           AND ra.roleid in ($this->gradebookroles)
-                           AND ra.contextid ".get_related_contexts_string($this->context)."
-                           AND g.finalgrade IS NOT NULL
-                           $groupwheresql
+                           JOIN (
+                               SELECT DISTINCT ra.userid
+                                 FROM {$CFG->prefix}role_assignments ra
+                                WHERE ra.roleid IN ($this->gradebookroles)
+                                  AND ra.contextid " . get_related_contexts_string($this->context) . "
+                           ) rainner ON rainner.userid = u.id
+                       WHERE gi.courseid = $this->courseid
+                       AND u.deleted = 0
+                       AND g.finalgrade IS NOT NULL
+                       $groupwheresql
                  GROUP BY g.itemid";
            $sum_array = array();
-            if ($sums = get_records_sql($SQL)) {
+            if ($sums = get_records_sql($sql)) {
                foreach ($sums as $itemid => $csum) {
                    $sum_array[$itemid] = $csum->sum;
                }
@@ -1177,20 +1178,21 @@ class grade_report_grader extends grade_report {

            // MDL-10875 Empty grades must be evaluated as grademin, NOT always 0
            // This query returns a count of ungraded grades (NULL finalgrade OR no matching record in grade_grades table)
-            $SQL = "SELECT gi.id, COUNT(u.id) AS count
+            $sql = "SELECT gi.id, COUNT(DISTINCT u.id) AS count
                      FROM {$CFG->prefix}grade_items gi
                           CROSS JOIN {$CFG->prefix}user u
-                           JOIN {$CFG->prefix}role_assignments ra        ON ra.userid = u.id
-                           LEFT OUTER JOIN  {$CFG->prefix}grade_grades g ON (g.itemid = gi.id AND g.userid = u.id AND g.finalgrade IS NOT NULL)
+                           JOIN {$CFG->prefix}role_assignments ra       ON ra.userid = u.id
+                           LEFT OUTER JOIN {$CFG->prefix}grade_grades g ON g.itemid = gi.id AND g.userid = u.id AND g.finalgrade IS NOT NULL
                           $groupsql
                     WHERE gi.courseid = $this->courseid
-                           AND ra.roleid in ($this->gradebookroles)
-                           AND ra.contextid ".get_related_contexts_string($this->context)."
+                           AND ra.roleid IN ($this->gradebookroles)
+                           AND u.deleted = 0
+                           AND ra.contextid " . get_related_contexts_string($this->context) . "
                           AND g.id IS NULL
                           $groupwheresql
                  GROUP BY gi.id";

-            $ungraded_counts = get_records_sql($SQL);
+            $ungraded_counts = get_records_sql($sql);

            $fixedstudents = $this->is_fixed_students();
            if (!$fixedstudents) {
@@ -633,7 +633,7 @@ if (isset($_GET['help'])) {
                    echo '<div id="mssql">' . get_string('databasesettingssub_mssql', 'install');
                /// Link to mssql installation page
                    echo "<p style='text-align:right'><a href=\"javascript:void(0)\" ";
-                    echo "onclick=\"return window.open('http://docs.moodle.org/en/Installing_MSSQL_for_PHP')\"";
+                    echo "onclick=\"return window.open('http://docs.moodle.org/19/en/Installing_MSSQL_for_PHP')\"";
                    echo ">";
                    echo '<img src="pix/docs.gif' . '" alt="Docs" class="iconhelp" />';
                    echo get_string('moodledocslink', 'install') . '</a></p>';
@@ -642,7 +642,7 @@ if (isset($_GET['help'])) {
                    echo '<div id="mssql_n">' . get_string('databasesettingssub_mssql_n', 'install');
                /// Link to mssql installation page
                    echo "<p style='text-align:right'><a href=\"javascript:void(0)\" ";
-                    echo "onclick=\"return window.open('http://docs.moodle.org/en/Installing_MSSQL_for_PHP')\"";
+                    echo "onclick=\"return window.open('http://docs.moodle.org/19/en/Installing_MSSQL_for_PHP')\"";
                    echo ">";
                    echo '<img src="pix/docs.gif' . '" alt="Docs" />';
                    echo get_string('moodledocslink', 'install') . '</a></p>';
@@ -651,7 +651,7 @@ if (isset($_GET['help'])) {
                    echo '<div id="odbc_mssql">'. get_string('databasesettingssub_odbc_mssql', 'install');
                /// Link to mssql installation page
                    echo "<p style='text-align:right'><a href=\"javascript:void(0)\" ";
-                    echo "onclick=\"return window.open('http://docs.moodle.org/en/Installing_MSSQL_for_PHP')\"";
+                    echo "onclick=\"return window.open('http://docs.moodle.org/19/en/Installing_MSSQL_for_PHP')\"";
                    echo ">";
                    echo '<img src="pix/docs.gif' . '" alt="Docs" class="iconhelp" />';
                    echo get_string('moodledocslink', 'install') . '</a></p>';
@@ -660,7 +660,7 @@ if (isset($_GET['help'])) {
                    echo '<div id="oci8po">' . get_string('databasesettingssub_oci8po', 'install');
                /// Link to oracle installation page
                    echo "<p style='text-align:right'><a href=\"javascript:void(0)\" ";
-                    echo "onclick=\"return window.open('http://docs.moodle.org/en/Installing_Oracle_for_PHP')\"";
+                    echo "onclick=\"return window.open('http://docs.moodle.org/19/en/Installing_Oracle_for_PHP')\"";
                    echo ">";
                    echo '<img src="pix/docs.gif' . '" alt="Docs" class="iconhelp" />';
                    echo get_string('moodledocslink', 'install') . '</a></p>';
@@ -16,7 +16,7 @@ To add more languages to Moodle, you can either:

 For more information, see the Moodle Documentation:

-   http://docs.moodle.org/en/Translation
+   http://docs.moodle.org/19/en/Translation


 Cheers,
@@ -114,7 +114,7 @@ $string['configdisablecourseajax'] = 'Do not use AJAX when editing main course p
 $string['configenablecalendarexport'] = 'Enable exporting or subscribing to calendars.';
 $string['configenablecourserequests'] = 'This will allow any user to request a course be created.';
 $string['configenableglobalsearch'] = 'This setting enables global text searching in resources and activities, it is not compatible with PHP 4.';
-$string['configenablegroupings'] = 'This setting enables groupings of groups.';
+$string['configenablegroupings'] = 'This setting enables the creation of groupings and the \'Available for group members only\' option. Groupings are a standard feature in Moodle 2.0 onwards whereas \'Available for group members only\' remains an experimental feature.';
 $string['configenablehtmlpurifier'] = 'Use HTML Purifier instead of KSES for cleaning of untrusted text. HTML Purifier is actively developed and is believed to be more secure, but it is more resource intensive. Expect minor visual differences in the resulting html code. Please note that embed and object tags can not be enabled, MathML tags and old lang tags are not supported. ';
 $string['configenablerssfeeds'] = 'This switch will enable RSS feeds from across the site.  To actually see any change you will need to enable RSS feeds in the individual modules too - go to the Modules settings under Admin Configuration.';
 $string['configenablerssfeedsdisabled'] = 'It is not available because RSS feeds are disabled in all the Site. To enable them, go to the Variables settings under Admin Configuration.';
@@ -209,8 +209,8 @@ $string['configcronremotepassword'] = 'This means that the cron.php script canno
 </pre>If this is left empty, no password is required.';
 $string['configrcache'] = 'Use the cache to store database records. Remember to set \'cachetype\' as well!';
 $string['configrcachettl'] = 'Time-to-live for cached records, in seconds. Use a short (&lt;15) value here.';
-$string['configrecaptchaprivatekey'] = 'String of characters used to communicate between your Moodle server and the recaptcha.net server. Obtain one for this site by visiting http://recaptcha.net';
-$string['configrecaptchapublickey'] = 'String of characters used to display the reCAPTCHA element in the signup form. Generated by http://recaptcha.net';
+$string['configrecaptchaprivatekey'] = 'String of characters used to communicate between your Moodle server and the recaptcha server. Obtain one for this site by visiting http://www.google.com/recaptcha';
+$string['configrecaptchapublickey'] = 'String of characters used to display the reCAPTCHA element in the signup form. Generated by http://www.google.com/recaptcha';
 $string['configregenloginsession'] = 'Regeneration of the session id during each login request is highly recommended for security reasons. This setting might not be compatible with some authentication plugins.';
 $string['configrequestedstudentname'] = 'Word for student used in requested courses';
 $string['configrequestedstudentsname'] = 'Word for students used in requested courses';
@@ -358,7 +358,7 @@ $string['enableajax'] = 'Enable AJAX';
 $string['enablecalendarexport'] = 'Enable calendar export';
 $string['enablecourserequests'] = 'Enable course requests';
 $string['enableglobalsearch'] = 'Enable global search';
-$string['enablegroupings'] = 'Enable groupings';
+$string['enablegroupings'] = 'Enable groupings and \'Available for group members only\'';
 $string['enablehtmlpurifier'] = 'Enable HTML Purifier';
 $string['enablerecordcache'] = 'Enable Record Cache';
 $string['enablerssfeeds'] = 'Enable RSS feeds';
@@ -396,6 +396,8 @@ $string['filtersettings'] = 'Manage filters';
 $string['filtersettingsgeneral'] = 'General filter settings';
 $string['filteruploadedfiles'] = 'Filter uploaded files';
 $string['forcelogin'] = 'Force users to login';
+$string['forceloginforprofileimage'] = 'Force users to login to view user pictures';
+$string['forceloginforprofileimage_help'] = 'If enabled, users must login in order to view user profile pictures and the default user picture will be used in all notification emails.';
 $string['forceloginforprofiles'] = 'Force users to login for profiles';
 $string['forcetimezone'] = 'Force default timezone';
 $string['framename'] = 'Frame name';
@@ -493,6 +495,8 @@ $string['location'] = 'Location';
 $string['locationsettings'] = 'Location settings';
 $string['log'] = 'Logs';
 $string['loginhttps'] = 'Use HTTPS for logins';
+$string['loginpasswordautocomplete'] = 'Prevent password autocompletion on login form.';
+$string['loginpasswordautocomplete_help'] = 'Having this off will let users save their account password in their browser. Switching this setting on will result in your site no longer following XHTML strict validation rules.';
 $string['loglifetime'] = 'Keep logs for';
 $string['longtimenosee'] = 'Unsubscribe users from courses after';
 $string['longtimewarning'] = '<b>Please note that this process can take a long time.</b>';
@@ -770,7 +774,7 @@ $string['uploadpicture_userupdated'] = 'Picture updated for user $a.';
 $string['uploadpicture_cannotsave'] = 'Cannot save picture for user $a. Check original picture file.';
 $string['updatetimezones'] = 'Update timezones';
 $string['upgrade197notice'] = '<p>Moodle 1.9.7 contains a number of security fixes to user passwords and backups to protect the user data on your site. As a result some of your settings and permissions relating to backups may have changed.<br />
-See the <a href=\"http://docs.moodle.org/en/Moodle_1.9.7_release_notes\" target=\"_blank\">Moodle 1.9.7 release notes</a> for full details.</p>';
+See the <a href=\"http://docs.moodle.org/dev/Moodle_1.9.7_release_notes\" target=\"_blank\">Moodle 1.9.7 release notes</a> for full details.</p>';
 $string['upgrade197noticesubject'] = 'Moodle 1.9.7 upgrade security notices';
 $string['upgrade197salt'] = 'To reduce the risk of password theft, you are strongly recommended to set a password salt.<br />See the <a href=\"$a\" target=\"_blank\">password salting documentation</a> for details.';
 $string['upgradeforumread'] = 'A new feature has been added in Moodle 1.5 to track read/unread forum posts.<br />To use this functionality you need to <a href=\"$a\">update your tables</a>.';
@@ -125,7 +125,7 @@ $string['auth_emailnowexists'] = 'The email address you tried to assign to your
 $string['auth_emailtitle'] = 'Email-based self-registration';
 $string['auth_emailnoinsert'] = 'Could not add your record to the database!';
 $string['auth_emailnoemail'] = 'Tried to send you an email but failed!';
-$string['auth_emailrecaptcha'] = 'Adds a visual/audio confirmation form element to the signup page for email self-registering users. This protects your site against spammers and contributes to a worthwhile cause. See http://recaptcha.net/learnmore.html for more details. <br /><em>PHP cURL extension is required.</em>';
+$string['auth_emailrecaptcha'] = 'Adds a visual/audio confirmation form element to the signup page for email self-registering users. This protects your site against spammers and contributes to a worthwhile cause. See http://www.google.com/recaptcha/learnmore for more details. <br /><em>PHP cURL extension is required.</em>';
 $string['auth_emailrecaptcha_key'] = 'Enable reCAPTCHA element';
 $string['auth_emailsettings'] = 'Settings';
 $string['auth_emailupdatemessage'] = 'Dear $a->fullname,
@@ -256,11 +256,11 @@ $string['auth_ldaptitle'] = 'LDAP server';
 $string['auth_ldapnotinstalled'] = 'Cannot use LDAP authentication. The PHP LDAP module is not installed.';
 $string['auth_ntlmsso'] = 'NTLM SSO';
 $string['auth_ntlmsso_enabled_key'] = 'Enable';
-$string['auth_ntlmsso_enabled'] = 'Set to yes to attempt Single Sign On with the NTLM domain. <strong>Note:</strong> this requires additional setup on the webserver to work, see <a href=\"http://docs.moodle.org/en/NTLM_authentication\">http://docs.moodle.org/en/NTLM_authentication</a>';
+$string['auth_ntlmsso_enabled'] = 'Set to yes to attempt Single Sign On with the NTLM domain. <strong>Note:</strong> this requires additional setup on the webserver to work, see <a href=\"http://docs.moodle.org/19/en/NTLM_authentication\">http://docs.moodle.org/19/en/NTLM_authentication</a>';
 $string['auth_ntlmsso_ie_fastpath'] = 'Set to yes to enable the NTLM SSO fast path (bypasses certain steps and only works if the client\'s browser is MS Internet Explorer).';
 $string['auth_ntlmsso_ie_fastpath_key'] = 'MS IE fast path?';
 $string['auth_ntlmsso_subnet_key'] = 'Subnet';
-$string['auth_ntlmsso_subnet'] = 'If set, it will only attempt SSO with clients in this subnet. Format: xxx.xxx.xxx.xxx/bitmask';
+$string['auth_ntlmsso_subnet'] = 'If set, it will only attempt SSO with clients in this subnet. Format: xxx.xxx.xxx.xxx/bitmask. Separate multiple subnets with \',\' (comma).';
 $string['ntlmsso_attempting'] = 'Attempting Single Sign On via NTLM...';
 $string['ntlmsso_failed'] = 'Auto-login failed, try the normal login page...';
 $string['ntlmsso_isdisabled'] = 'NTLM SSO is disabled.';
@@ -215,7 +215,7 @@ $string['recordsnotsaved'] = 'No entry was saved. Please check the format of the
 $string['recordssaved'] = 'entries saved';
 $string['requireapproval'] = 'Require approval?';
 $string['requiredentries'] = 'Required entries';
-$string['requiredentrieschanged'] = '<p><strong>IMPORTANT - PLEASE READ </strong></p><p>Due to a bug fix, the behaviour of database activities using the \'Required entries\' and \'Required entries before viewing settings\' settings will change. A more detailed explaination of the changes can be read on <a href=\"http://moodle.org/mod/forum/discuss.php?d=110928\" target=\"_blank\">the database module forum</a>. The expected behavior of these settings can also be read on <a href=\"http://docs.moodle.org/en/Adding/editing_a_database#Required_entries\" target=\"_blank\">Moodle Docs</a>.
+$string['requiredentrieschanged'] = '<p><strong>IMPORTANT - PLEASE READ </strong></p><p>Due to a bug fix, the behaviour of database activities using the \'Required entries\' and \'Required entries before viewing settings\' settings will change. A more detailed explaination of the changes can be read on <a href=\"http://moodle.org/mod/forum/discuss.php?d=110928\" target=\"_blank\">the database module forum</a>. The expected behavior of these settings can also be read on <a href=\"http://docs.moodle.org/19/en/Adding/editing_a_database#Required_entries\" target=\"_blank\">Moodle Docs</a>.
 </p><p>This change affects the following databases in your system: (Please save this list now, and after the upgrade, check that these activities still work the way that the teacher intends.)</p><strong style=\"color:red\">$a->text</strong><br/>';
 $string['requiredentriestoview'] = 'Entries required before viewing';
 $string['resettemplate'] = 'Reset template';
@@ -5,7 +5,7 @@ All of it has gone now because we now use the Moodle Docs wiki.

 To find out the new locations for all the information that was here, see:

-    http://docs.moodle.org/en/MoodleDocs_and_lang_packs
+    http://docs.moodle.org/19/en/MoodleDocs_and_lang_packs

    http://tracker.moodle.org/browse/MDL-4912

@@ -11,7 +11,7 @@
 </head>
 <body>

-(For the most up-to-date version of this license, see <a href="http://docs.moodle.org/en/License">Moodle Docs</a>).
+(For the most up-to-date version of this license, see <a href="http://docs.moodle.org/dev/License">Moodle Docs</a>).
    
 <h1>Copyright License for Moodle</h1>
 <blockquote>
@@ -139,5 +139,6 @@ $string['wrongdestpath'] = 'Wrong destination path';
 $string['wrongsourcebase'] = 'Wrong source URL base';
 $string['wrongzipfilename'] = 'Wrong ZIP file name';
 $string['youcannotdeletecategory'] = 'You cannot delete category \'$a\' because you can neither delete the contents, nor move them elsewhere.';
+$string['zipfileserror'] = 'Cannot create zip file';

 ?>
@@ -94,7 +94,7 @@ $string['forum'] = 'Forum';
 $string['forum:addnews'] = 'Add news';
 $string['forumauthorhidden'] = 'Author (hidden)';
 $string['forumblockingalmosttoomanyposts'] = 'You are approaching the posting threshold. You have posted $a->numposts times in the last $a->blockperiod and the limit is $a->blockafter posts.';
-$string['forumbodyhidden'] = 'This post cannot be viewed by you, probably because you have not posted in the discussion yet.';
+$string['forumbodyhidden'] = 'This post cannot be viewed by you, probably because you have not posted in the discussion or the maximum editing time hasn\'t passed yet.';
 $string['forum:createattachment'] = 'Create attachments';
 $string['forum:deleteanypost'] = 'Delete any posts (anytime)';
 $string['forum:deleteownpost'] = 'Delete own posts (within deadline)';
@@ -48,7 +48,7 @@
    one of the few webhosts that does not support these features ask them why, 
    and consider taking your business elsewhere.</p>
  <p>If you want to run Moodle on your own computer and all this looks a bit daunting, 
-    then please take a look at <a href="http://docs.moodle.org/en/Administrator_documentation">the administrator documentation</a>.</p>
+    then please take a look at <a href="http://docs.moodle.org/19/en/Administrator_documentation">the administrator documentation</a>.</p>
  <p>&nbsp;</p>
 </div>

@@ -266,7 +266,7 @@ php_value post_max_size 2M</pre>
      '1', teacher varchar(100) NOT NULL default 'Teacher', startdate int(10) 
      unsigned NOT NULL default '0', enddate int(10) unsigned NOT NULL default 
      '0', timemodified int(10) unsigned NOT NULL default '0', PRIMARY KEY (id)) 
-      TYPE=MyISAM</p>
+      ENGINE=MyISAM</p>
    <p class="success">SUCCESS</p>
  </div>
  <p>...and so on, followed by: <span class="success">Main databases set up 
@@ -416,7 +416,7 @@ php_value post_max_size 2M</pre>
    for them using the &quot;Add a new user&quot; on the Admin page.</p>
  <p>Once done, the course is ready to customise, and is accessible via the &quot;Courses&quot; 
    link on the home page.</p>
-  <p>See the &quot;<a href="http://docs.moodle.org/en/Teacher_documentation">Teacher Documentation</a>&quot; for more details 
+  <p>See the &quot;<a href="http://docs.moodle.org/19/en/Teacher_documentation">Teacher Documentation</a>&quot; for more details
    on course-building.</p>
  <p>&nbsp;</p>
  <p class="center"><strong>Happy exploring and happy Moodling!</strong></p>
@@ -31,5 +31,5 @@ cannot delete the last category in a context.</li>
 <ul>
  <li><a href="help.php?module=question&amp;file=categorycontexts.html">Category contexts</a></li>
  <li><a href="help.php?module=question&amp;file=permissions.html">Question permissions</a></li>
-  <li><a href="http://docs.moodle.org/en/Question_categories">Question categories help on Moodle Docs</a></li>
+  <li><a href="http://docs.moodle.org/19/en/Question_categories">Question categories help on Moodle Docs</a></li>
 </ul>
@@ -15,5 +15,5 @@ your questions in any or all of the parent course categories).</li>
 <ul>
  <li><a href="help.php?module=question&amp;file=categories.html">Question categories</a></li>
  <li><a href="help.php?module=question&amp;file=permissions.html">Question permissions</a></li>
-  <li><a href="http://docs.moodle.org/en/Question_contexts">Question contexts documentation on Moodle Docs</a></li>
+  <li><a href="http://docs.moodle.org/19/en/Question_contexts">Question contexts documentation on Moodle Docs</a></li>
 </ul>
@@ -258,7 +258,7 @@ $string['phpversionhelp'] = '<p>Moodle requires a PHP version of at least 4.3.0
 $string['postgres7'] = 'PostgreSQL (postgres7)';
 $string['postgresqlwarning'] = '<strong>Note:</strong> If you experience some connection problems, you can try to set Host Server field as
 host=\'postgresql_host\' port=\'5432\' dbname=\'postgresql_database_name\' user=\'postgresql_user\' password=\'postgresql_user_password\'
-and to leave empty the Database, User and Password fields. More information on <a href=\"http://docs.moodle.org/en/Installing_Postgres_for_PHP\">Moodle Docs</a>';
+and to leave empty the Database, User and Password fields. More information on <a href=\"http://docs.moodle.org/19/en/Installing_Postgres_for_PHP\">Moodle Docs</a>';
 $string['safemode'] = 'Safe Mode';
 $string['safemodeerror'] = 'Moodle may have trouble with safe mode on';
 $string['safemodehelp'] = '<p>Moodle may have a variety of problems with safe mode on, not least is that 
@@ -208,6 +208,7 @@ $string['addtoacl'] = 'Add to Access Control';
 $string['accesslevel'] = 'Access Level';
 $string['ssoaccesscontrol'] = 'SSO Access Control';
 $string['notpermittedtojump'] = 'You do not have permission to begin a remote session from this Moodle hub.';
+$string['notpermittedtojumpas'] = 'You can\'t begin a remote session while you are logged in as another user.';
 $string['notpermittedtoland'] = 'You do not have permission to begin a remote session.';
 $string['authfail_nosessionexists'] = 'Authorisation failed: the mnet session does not exist.';
 $string['authfail_sessiontimedout'] = 'Authorisation failed: the mnet session has timed out.';
@@ -49,7 +49,7 @@ $string['downloadcore'] = 'Our main method of distribution is via these standard
 $string['downloadcoretitle'] = 'Standard Moodle packages';
 $string['downloadcvs'] = 'Another way to get the core source code is by using CVS to connect directly to one of our mirrors of the code repository used by Moodle developers.  This makes upgrading very easy, even if you have made local changes to the source code.';
 $string['downloadcvstitle'] = 'Moodle via CVS';
-$string['downloadintro'] = 'Moodle is open source under the <a href=\"http://docs.moodle.org/en/License\">GPL licence</a>.  Everything we produce is available for you to download and use for free.';
+$string['downloadintro'] = 'Moodle is open source under the <a href=\"http://docs.moodle.org/dev/License\">GPL licence</a>.  Everything we produce is available for you to download and use for free.';
 $string['downloadlang'] = 'In current versions of Moodle, adding support for new languages has been automated from the administration menu within your site.  However, for some older versions of Moodle, new language packs need to be downloaded manually.';
 $string['downloadlangtitle'] = 'Language packs';
 $string['downloadlogotitle'] = 'Moodle logos';
@@ -161,7 +161,7 @@ $string['backupmetacoursehelp'] = 'If enabled, then metacourse info (inherited e
 $string['backupnameformat'] = '%%Y%%m%%d-%%H%%M';
 $string['backupmissinguserinfoperms'] = 'Note: This backup contains no user data. Exercise and Workshop activities will not be included in the backup, since these modules are not compatible with this type of backup.';
 $string['backupnoneusersinfo'] = 'Note: This backup contains no users and so all activities have been switched to \"without user data\" mode. Exercise and Workshop activities will not be included in the backup, since these modules are not compatible with this type of backup.';
-$string['backupnonisowarning'] = 'Warning: this backup is from a non-Unicode version of Moodle (pre 1.6).  If this backup contains any non-ISO-8859-1 texts then they may be CORRUPTED if you try to restore them to this Unicode version of Moodle.  See the <a href=\"http://docs.moodle.org/en/Backup_FAQ\">Backup FAQ</a> for more information about how to recover this backup correctly.';
+$string['backupnonisowarning'] = 'Warning: this backup is from a non-Unicode version of Moodle (pre 1.6).  If this backup contains any non-ISO-8859-1 texts then they may be CORRUPTED if you try to restore them to this Unicode version of Moodle.  See the <a href=\"http://docs.moodle.org/19/en/Backup_FAQ\">Backup FAQ</a> for more information about how to recover this backup correctly.';
 $string['backupnext'] = 'Next backup';
 $string['backuporiginalname'] = 'Backup Name';
 $string['backuproleassignments'] = 'Backup role assignments for these roles';
@@ -503,6 +503,7 @@ $string['emaildisable'] = 'This email address is disabled';
 $string['emaildisableclick'] = 'Click here to disable all email from being sent to this address';
 $string['emaildisplay'] = 'Email display';
 $string['emaildisplaycourse'] = 'Allow only other course members to see my email address';
+$string['emaildisplayhidden'] = 'Email hidden';
 $string['emaildisplayno'] = 'Hide my email address from everyone';
 $string['emaildisplayyes'] = 'Allow everyone to see my email address';
 $string['emailenable'] = 'This email address is enabled';
@@ -732,7 +733,7 @@ but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

 See the Moodle License information page for full details:
-http://docs.moodle.org/en/License';
+http://docs.moodle.org/dev/License';
 $string['grade'] = 'Grade';
 $string['grades'] = 'Grades';
 $string['group'] = 'Group';
@@ -3,7 +3,7 @@ $string['spamauto'] = 'Autodetect common spam patterns';
 $string['spamcannotdelete'] = 'Cannot delete this user';
 $string['spamcannotfinduser'] = 'No users matching your search';
 $string['spamcleaner'] = 'Spam cleaner';
-$string['spamcleanerintro'] = 'This script allows you to search all user profiles for certain strings and then delete those accounts which are obviously created by spammers.  You can search for multiple keywords using commas (eg casino, porn)<br /><br />Moodle docs has more information about <a href=\"http://docs.moodle.org/en/Reducing_spam_in_Moodle\">Reducing spam in Moodle</a>.';
+$string['spamcleanerintro'] = 'This script allows you to search all user profiles for certain strings and then delete those accounts which are obviously created by spammers.  You can search for multiple keywords using commas (eg casino, porn)<br /><br />Moodle docs has more information about <a href=\"http://docs.moodle.org/19/en/Reducing_spam_in_Moodle\">Reducing spam in Moodle</a>.';
 $string['spamdesc'] = 'Description';
 $string['spamdeleteall'] = 'Delete all these user accounts';
 $string['spamdeleteconfirm'] = 'Are you sure you want to delete this entry?  You can not undo this.';
@@ -73,7 +73,7 @@ $string['indexes'] = 'Indexes';
 $string['integerincorrectlength'] = 'Incorrect length for integer field';
 $string['key'] = 'Key';
 $string['keys'] = 'Keys';
-$string['listreservedwords'] = 'List of Reserved Words<br />(used to keep <a href=\"http://docs.moodle.org/en/XMLDB_reserved_words\" target=\"_blank\">XMLDB_reserved_words</a> updated)';
+$string['listreservedwords'] = 'List of Reserved Words<br />(used to keep <a href=\"http://docs.moodle.org/19/en/XMLDB_reserved_words\" target=\"_blank\">XMLDB_reserved_words</a> updated)';
 $string['load'] = 'Load';
 $string['missing'] = 'Missing';
 $string['missingindexes'] = 'Missing Indexes Found';
@@ -144,7 +144,7 @@ define('CONTEXT_COURSE', 50);
 define('CONTEXT_MODULE', 70);
 define('CONTEXT_BLOCK', 80);

-// capability risks - see http://docs.moodle.org/en/Development:Hardening_new_Roles_system
+// capability risks - see http://docs.moodle.org/dev/Hardening_new_Roles_system
 define('RISK_MANAGETRUST', 0x0001);
 define('RISK_CONFIG',      0x0002);
 define('RISK_XSS',         0x0004);
@@ -4942,14 +4942,18 @@ function print_plugin_tables() {
    $installed_mods = get_records_list('modules', '', '', '', 'name');
    $installed_blocks = get_records_list('block', '', '', '', 'name');

+    $plugins_installed['mod'] = array();
    foreach($installed_mods as $mod) {
        $plugins_installed['mod'][] = $mod->name;
    }

+    $plugins_installed['blocks'] = array();
    foreach($installed_blocks as $block) {
        $plugins_installed['blocks'][] = $block->name;
    }

+    $plugins_installed['filter'] = array();
+
    $plugins_ondisk = array();
    $plugins_ondisk['mod'] = get_list_of_plugins('mod', 'db');
    $plugins_ondisk['blocks'] = get_list_of_plugins('blocks', 'db');
@@ -1238,7 +1238,7 @@ function get_categories($parent='none', $sort=NULL, $shallow=true) {
                JOIN {$CFG->prefix}context ctx
                  ON cc.id=ctx.instanceid AND ctx.contextlevel=".CONTEXT_COURSECAT."
                JOIN {$CFG->prefix}course_categories ccp
-                     ON (cc.path LIKE ".sql_concat('ccp.path',"'%'").")
+                     ON ((cc.parent=ccp.id) OR (cc.path LIKE ".sql_concat('ccp.path',"'/%'")."))
                WHERE ccp.id=$parent
                $sort";
    }
@@ -254,7 +254,7 @@ function main_upgrade($oldversion=0) {
                             `userid` int(10) unsigned NOT NULL default '0',
                             PRIMARY KEY  (`id`),
                             UNIQUE KEY `id` (`id`)
-                             ) TYPE=MyISAM COMMENT='One record per course creator';");
+                             ) ENGINE=MyISAM COMMENT='One record per course creator';");
    }
    if ($oldversion < 2003032602) {
        // Redoing it because of no prefix last time
@@ -362,7 +362,7 @@ function main_upgrade($oldversion=0) {
                        PRIMARY KEY  (`id`),
                        UNIQUE KEY `id` (`id`),
                        KEY `courseuserid` (course,userid)
-                     ) TYPE=MyISAM COMMENT='Stores info about how to display the course'");
+                     ) ENGINE=MyISAM COMMENT='Stores info about how to display the course'");
    }

    if ($oldversion < 2003050400) {
@@ -458,7 +458,7 @@ function main_upgrade($oldversion=0) {
                         `description` text NOT NULL,
                         `timemodified` int(10) unsigned NOT NULL default '0',
                         PRIMARY KEY  (id)
-                       ) TYPE=MyISAM COMMENT='Defines grading scales'");
+                       ) ENGINE=MyISAM COMMENT='Defines grading scales'");

    }

@@ -558,7 +558,7 @@ function main_upgrade($oldversion=0) {
                                `timemodified` int(10) unsigned NOT NULL default '0',
                                PRIMARY KEY  (`id`),
                                KEY `courseid` (`courseid`)
-                              ) TYPE=MyISAM COMMENT='Each record is a group in a course.'; ");
+                              ) ENGINE=MyISAM COMMENT='Each record is a group in a course.'; ");

        modify_database("", "CREATE TABLE `prefix_groups_members` (
                                `id` int(10) unsigned NOT NULL auto_increment,
@@ -567,7 +567,7 @@ function main_upgrade($oldversion=0) {
                                `timeadded` int(10) unsigned NOT NULL default '0',
                                PRIMARY KEY  (`id`),
                                KEY `groupid` (`groupid`)
-                              ) TYPE=MyISAM COMMENT='Lists memberships of users in groups'; ");
+                              ) ENGINE=MyISAM COMMENT='Lists memberships of users in groups'; ");
    }

    if ($oldversion < 2003121800) {
@@ -601,7 +601,7 @@ function main_upgrade($oldversion=0) {
                              UNIQUE KEY `id` (`id`),
                              KEY `courseid` (`courseid`),
                              KEY `userid` (`userid`)
-                            ) TYPE=MyISAM COMMENT='For everything with a time associated to it'; ");
+                            ) ENGINE=MyISAM COMMENT='For everything with a time associated to it'; ");
    }

    if ($oldversion < 2004012800) {
@@ -613,7 +613,7 @@ function main_upgrade($oldversion=0) {
                              PRIMARY KEY  (`id`),
                              UNIQUE KEY `id` (`id`),
                              KEY `useridname` (userid,name)
-                            ) TYPE=MyISAM COMMENT='Allows modules to store arbitrary user preferences'; ");
+                            ) ENGINE=MyISAM COMMENT='Allows modules to store arbitrary user preferences'; ");
    }

    if ($oldversion < 2004012900) {
@@ -637,7 +637,7 @@ function main_upgrade($oldversion=0) {
                                `timemodified` int(10) unsigned NOT NULL default '0',
                                PRIMARY KEY  (`id`),
                                KEY `md5key` (`md5key`)
-                             ) TYPE=MyISAM COMMENT='For storing temporary copies of processed texts';");
+                             ) ENGINE=MyISAM COMMENT='For storing temporary copies of processed texts';");
    }

    if ($oldversion < 2004021000) {
@@ -667,7 +667,7 @@ function main_upgrade($oldversion=0) {
                                `timemodified` int(10) unsigned NOT NULL default '0',
                                PRIMARY KEY  (`id`),
                                KEY `filtermd5key` (filter,md5key)
-                              ) TYPE=MyISAM COMMENT='For keeping information about cached data';");
+                              ) ENGINE=MyISAM COMMENT='For keeping information about cached data';");
    }

    if ($oldversion < 2004021500) {
@@ -865,7 +865,7 @@ function main_upgrade($oldversion=0) {
                          `data` text NOT null,
                          PRIMARY KEY (`sesskey`), 
                          KEY (`expiry`) 
-                      ) TYPE=MyISAM COMMENT='Optional database session storage, not used by default';");
+                      ) ENGINE=MyISAM COMMENT='Optional database session storage, not used by default';");
    }

    if ($oldversion < 2004111500) {  // Update any users/courses using wrongly-named lang pack
@@ -1043,7 +1043,7 @@ function main_upgrade($oldversion=0) {
                               PRIMARY KEY  (`id`),
                               KEY `useridfrom` (`useridfrom`),
                               KEY `useridto` (`useridto`)
-                             ) TYPE=MyISAM COMMENT='Stores all unread messages';");
+                             ) ENGINE=MyISAM COMMENT='Stores all unread messages';");

        modify_database('',"CREATE TABLE `prefix_message_read` (
                               `id` int(10) unsigned NOT NULL auto_increment,
@@ -1057,7 +1057,7 @@ function main_upgrade($oldversion=0) {
                               PRIMARY KEY  (`id`),
                               KEY `useridfrom` (`useridfrom`),
                               KEY `useridto` (`useridto`)
-                             ) TYPE=MyISAM COMMENT='Stores all messages that have been read';");
+                             ) ENGINE=MyISAM COMMENT='Stores all messages that have been read';");

        modify_database('',"CREATE TABLE `prefix_message_contacts` (
                               `id` int(10) unsigned NOT NULL auto_increment,
@@ -1066,7 +1066,7 @@ function main_upgrade($oldversion=0) {
                               `blocked` tinyint(1) unsigned NOT NULL default '0',
                               PRIMARY KEY  (`id`),
                               UNIQUE KEY `usercontact` (`userid`,`contactid`)
-                             ) TYPE=MyISAM COMMENT='Maintains lists of relationships between users';");
+                             ) ENGINE=MyISAM COMMENT='Maintains lists of relationships between users';");

        modify_database('', "INSERT INTO prefix_log_display (module, action, mtable, field) VALUES ('message', 'write', 'user', 'CONCAT(firstname,\" \",lastname)'); ");
        modify_database('', "INSERT INTO prefix_log_display (module, action, mtable, field) VALUES ('message', 'read', 'user', 'CONCAT(firstname,\" \",lastname)'); ");
@@ -1243,7 +1243,7 @@ function main_upgrade($oldversion=0) {
                              `std_skipweeks` tinyint(3) NOT NULL default '0',
                              `std_time` varchar(5) NOT NULL default '00:00',
                              PRIMARY KEY (`id`)
-                            ) TYPE=MyISAM COMMENT='Rules for calculating local wall clock time for users';");
+                            ) ENGINE=MyISAM COMMENT='Rules for calculating local wall clock time for users';");
    }

    if ($oldversion < 2005032800) {
@@ -1257,7 +1257,7 @@ function main_upgrade($oldversion=0) {
            `weight` decimal(4,2) NOT NULL default '0.00',
            PRIMARY KEY  (`id`),
            KEY `courseid` (`courseid`)
-          ) TYPE=MyISAM ;");
+          ) ENGINE=MyISAM ;");

        execute_sql("CREATE TABLE `{$CFG->prefix}grade_exceptions` (
            `id` int(10) unsigned NOT NULL auto_increment,
@@ -1266,7 +1266,7 @@ function main_upgrade($oldversion=0) {
            `userid` int(10) unsigned NOT NULL default '0',
            PRIMARY KEY  (`id`),
            KEY `courseid` (`courseid`)
-          ) TYPE=MyISAM ;");
+          ) ENGINE=MyISAM ;");


        execute_sql("CREATE TABLE `{$CFG->prefix}grade_item` (
@@ -1280,7 +1280,7 @@ function main_upgrade($oldversion=0) {
            `sort_order` int(10) unsigned NOT NULL default '0',
            PRIMARY KEY  (`id`),
            KEY `courseid` (`courseid`)
-          ) TYPE=MyISAM ;");
+          ) ENGINE=MyISAM ;");


        execute_sql("CREATE TABLE `{$CFG->prefix}grade_letter` (
@@ -1291,7 +1291,7 @@ function main_upgrade($oldversion=0) {
            `grade_low` decimal(4,2) NOT NULL default '0.00',
            PRIMARY KEY  (`id`),
            KEY `courseid` (`courseid`)
-          ) TYPE=MyISAM ;");
+          ) ENGINE=MyISAM ;");
          

        execute_sql("CREATE TABLE `{$CFG->prefix}grade_preferences` (
@@ -1301,7 +1301,7 @@ function main_upgrade($oldversion=0) {
            `value` int(10) NOT NULL default '0',
            PRIMARY KEY  (`id`),
            UNIQUE KEY `courseidpreference` (`courseid`,`preference`)
-          ) TYPE=MyISAM ;");
+          ) ENGINE=MyISAM ;");
          
    }

@@ -1372,7 +1372,7 @@ function main_upgrade($oldversion=0) {
                                  `value`      text NOT NULL default '',
                                  PRIMARY KEY  (`id`),
                                           UNIQUE KEY `plugin_name` (`plugin`, `name`)
-                                  ) TYPE=MyISAM 
+                                  ) ENGINE=MyISAM
                                  COMMENT='Moodle modules and plugins configuration variables';");
    }

@@ -1493,7 +1493,7 @@ function main_upgrade($oldversion=0) {
          `requester` int(10) NOT NULL default 0,
          PRIMARY KEY (`id`),
          KEY `shortname` (`shortname`)
-        ) TYPE=MyISAM;");
+        ) ENGINE=MyISAM;");
        
        table_column('course','','requested');
    }
@@ -1506,7 +1506,7 @@ function main_upgrade($oldversion=0) {
         PRIMARY KEY (`id`),
         KEY `course` (`course`),
         KEY `module` (`module`)
-      ) TYPE=MyISAM;");
+      ) ENGINE=MyISAM;");
        
        table_column('course','','restrictmodules','int','1','','0','not null');
    }
@@ -1692,7 +1692,7 @@ function main_upgrade($oldversion=0) {
          UNIQUE KEY `id_user_idx` (`id`, `userid`),
          KEY `post_lastmodified_idx` (`lastmodified`),
          KEY `post_subject_idx` (`subject`)
-        ) TYPE=MyISAM  COMMENT='New moodle post table. Holds data posts such as forum entries or blog entries.';");
+        ) ENGINE=MyISAM  COMMENT='New moodle post table. Holds data posts such as forum entries or blog entries.';");

        modify_database("","CREATE TABLE prefix_tags (
          `id` int(10) unsigned NOT NULL auto_increment,
@@ -1700,7 +1700,7 @@ function main_upgrade($oldversion=0) {
          `userid` int(10) unsigned NOT NULL default'0',
          `text` varchar(255) NOT NULL default '',
          PRIMARY KEY  (`id`)
-        ) TYPE=MyISAM COMMENT ='tags structure for moodle.';");
+        ) ENGINE=MyISAM COMMENT ='tags structure for moodle.';");

        modify_database("","CREATE TABLE prefix_blog_tag_instance (
          `id` int(10) unsigned NOT NULL auto_increment,
@@ -1710,7 +1710,7 @@ function main_upgrade($oldversion=0) {
          `courseid` int(10) unsigned NOT NULL default'0',
          `userid` int(10) unsigned NOT NULL default'0',
          PRIMARY KEY  (`id`)
-          ) TYPE=MyISAM COMMENT ='tag instance for blogs.';");
+          ) ENGINE=MyISAM COMMENT ='tag instance for blogs.';");
    }

    if ($oldversion < 2006031400) {
@@ -1799,7 +1799,7 @@ function main_upgrade($oldversion=0) {
                               `mtable` varchar(30),
                               `field` varchar(50),
                               PRIMARY KEY (`id`)
-                               ) TYPE=MyISAM");
+                               ) ENGINE=MyISAM");
        
        // Add index to ensure that module and action combination is unique.
        modify_database('', "ALTER TABLE prefix_log_display ADD UNIQUE `moduleaction`(`module` , `action`)");
@@ -2193,7 +2193,7 @@ function main_upgrade($oldversion=0) {
                    KEY `courseid` (`courseid`),
                    UNIQUE KEY `userid-courseid` (`userid`, `courseid`),
                    PRIMARY KEY (`id`) 
-                    )TYPE=MYISAM COMMENT ='time user last accessed any page in a course';", true);
+                    )ENGINE=MyISAM COMMENT ='time user last accessed any page in a course';", true);
    }

    if (!empty($CFG->rolesactive) and $oldversion < 2006091212) {   // Reload the guest roles completely with new defaults
@@ -370,7 +370,7 @@ function xmldb_main_upgrade($oldversion=0) {
        drop_index($table, $index);
        $index->setFields(array('mnethostid', 'username'));
        if (!add_index($table, $index)) {
-            notify(get_string('duplicate_usernames', 'mnet', 'http://docs.moodle.org/en/DuplicateUsernames'));
+            notify(get_string('duplicate_usernames', 'mnet', 'http://docs.moodle.org/19/en/DuplicateUsernames'));
        }

        unset($table, $field, $index);
@@ -3292,6 +3292,15 @@ function xmldb_main_upgrade($oldversion=0) {
    }

    if ($result && $oldversion < 2007101571.01) {
+        // Remove category_sortorder index that was supposed to be removed long time ago
+        $table = new XMLDBTable('course');
+        $index = new XMLDBIndex('category_sortorder');
+        $index->setAttributes(XMLDB_INDEX_UNIQUE, array('category', 'sortorder'));
+
+        if (index_exists($table, $index)) {
+            drop_index($table, $index);
+        }
+
        // MDL-21011 bring down course sort orders away from maximum values
        $sql = "SELECT id, category, sortorder from {$CFG->prefix}course
                ORDER BY sortorder ASC;";
@@ -3368,6 +3377,19 @@ function xmldb_main_upgrade($oldversion=0) {
        upgrade_main_savepoint($result, 2007101591.01);
    }

+    if ($result && $oldversion < 2007101591.05) {
+        // Remove category_sortorder index that was supposed to be removed long time ago
+        $table = new XMLDBTable('course');
+        $index = new XMLDBIndex('category_sortorder');
+        $index->setAttributes(XMLDB_INDEX_UNIQUE, array('category', 'sortorder'));
+
+        if (index_exists($table, $index)) {
+            drop_index($table, $index);
+        }
+        upgrade_main_savepoint($result, 2007101591.05);
+    }
+
+
    return $result;
 }

@@ -36,7 +36,7 @@
 // This library should be used, exclusively, by the installation and
 // upgrade process of Moodle.
 //
-// For further documentation, visit http://docs.moodle.org/en/DDL_functions
+// For further documentation, visit http://docs.moodle.org/19/en/DDL_functions

 /// Add required XMLDB constants
    require_once($CFG->libdir . '/xmldb/classes/XMLDBConstants.php');
@@ -67,7 +67,7 @@
 * Add a new field to a table, or modify an existing one (if oldfield is defined).
 *
 * WARNING: This function is deprecated and will be removed in future versions.
- * Please use XMLDB (see http://docs.moodle.org/en/Development:DDL_functions ).
+ * Please use XMLDB (see http://docs.moodle.org/dev/DDL_functions ).
 *
 * Warning: Please be careful on primary keys, as this function will eat auto_increments
 *
@@ -1677,6 +1677,12 @@ function error ($message, $link='') {
        }
    }

+    // when printing an error the continue button should never link offsite
+    if (stripos($link, $CFG->wwwroot) === false &&
+        stripos($link, $CFG->httpswwwroot) === false) {
+        $link = $CFG->wwwroot.'/';
+    }
+
    if (!empty($link)) {
        print_continue($link);
    }
@@ -32,7 +32,7 @@
 /// include it yourself.

 /// For more info about the functions available in this library, please visit:
-///     http://docs.moodle.org/en/DML_functions
+///     http://docs.moodle.org/19/en/DML_functions
 /// (feel free to modify, improve and document such page, thanks!)

 /// GLOBAL CONSTANTS /////////////////////////////////////////////////////////
@@ -569,6 +569,7 @@ function get_record_select($table, $select='', $fields='*') {
 function get_recordset($table, $field='', $value='', $sort='', $fields='*', $limitfrom='', $limitnum='') {

    if ($field) {
+        $value = sql_magic_quotes_hack($value);
        $select = "$field = '$value'";
    } else {
        $select = '';
@@ -710,7 +711,7 @@ function recordset_to_array($rs) {
        $objects = array();
    /// First of all, we are going to get the name of the first column
    /// to introduce it back after transforming the recordset to assoc array
-    /// See http://docs.moodle.org/en/XMLDB_Problems, fetch mode problem.
+    /// See http://docs.moodle.org/19/en/XMLDB_Problems, fetch mode problem.
        $firstcolumn = $rs->FetchField(0);
    /// Get the whole associative array
        if ($records = $rs->GetAssoc(true)) {
@@ -1433,7 +1434,7 @@ function delete_records_select($table, $select='') {
 * @param string $table The database table to be checked against.
 * @param object $dataobject A data object with values for one or more fields in the record
 * @param bool $returnid Should the id of the newly created record entry be returned? If this option is not requested then true/false is returned.
- * @param string $primarykey (obsolete) This is now forced to be 'id'. 
+ * @param string $primarykey (obsolete) This is now forced to be 'id'.
 */
 function insert_record($table, $dataobject, $returnid=true, $primarykey='id') {

@@ -1447,6 +1448,14 @@ function insert_record($table, $dataobject, $returnid=true, $primarykey='id') {
    if (is_array($dataobject)) {
        debugging('Warning. Wrong call to insert_record(). $dataobject must be an object. array found instead', DEBUG_DEVELOPER);
        $dataobject = (object)$dataobject;
+    } else if (is_object($dataobject)) {
+        // make sure there are no properties or private methods because we cast to array later,
+        // at the same time this undos the object references so that PHP 5 works the same as PHP 4,
+        // the main reason for this is BC after the dirty magic hack introduction
+        if ($properties = get_object_vars($dataobject)) {
+            $dataobject = (object)$properties;
+        }
+        unset($properties);
    }

 /// Temporary hack as part of phasing out all access to obsolete user tables  XXX
@@ -1463,6 +1472,11 @@ function insert_record($table, $dataobject, $returnid=true, $primarykey='id') {
 /// so let's unset it now before it causes any trouble later
    unset($dataobject->{$primarykey});

+/// Extra protection against SQL injections
+    foreach((array)$dataobject as $k=>$v) {
+        $dataobject->$k = sql_magic_quotes_hack($v);
+    }
+
 /// Get an empty recordset. Cache for multiple inserts.
    if (empty($empty_rs_cache[$table])) {
        /// Execute a dummy query to get an empty recordset
@@ -1637,6 +1651,19 @@ function update_record($table, $dataobject) {
    if (is_array($dataobject)) {
        debugging('Warning. Wrong call to update_record(). $dataobject must be an object. array found instead', DEBUG_DEVELOPER);
        $dataobject = (object)$dataobject;
+    } else if (is_object($dataobject)) {
+        // make sure there are no properties or private methods because we cast to array later,
+        // at the same time this undos the object references so that PHP 5 works the same as PHP 4,
+        // the main reason for this is BC after the dirty magic hack introduction
+        if ($properties = get_object_vars($dataobject)) {
+            $dataobject = (object)$properties;
+        }
+        unset($properties);
+    }
+
+/// Extra protection against SQL injections
+    foreach((array)$dataobject as $k=>$v) {
+        $dataobject->$k = sql_magic_quotes_hack($v);
    }

    // Remove this record from record cache since it will change
@@ -1755,7 +1782,7 @@ function sql_paging_limit($page, $recordsperpage) {
 *
 * Note the LIKE are case sensitive for Oracle. Oracle 10g is required to use
 * the caseinsensitive search using regexp_like() or NLS_COMP=LINGUISTIC :-(
- * See http://docs.moodle.org/en/XMLDB_Problems#Case-insensitive_searches
+ * See http://docs.moodle.org/19/en/XMLDB_Problems#Case-insensitive_searches
 *
 * @uses $CFG
 * @return string
@@ -2223,6 +2250,38 @@ function sql_ceil($fieldname) {
    }
 }

+/**
+ * This hack prevents some types of SQL injections, no code should rely on this,
+ * do not forget to use addslashes() and addslashes_recursive() properly!
+ *
+ * The performance cost is negligible considering the security benefits and DB requests cost.
+ *
+ * @param mixed $value sql parameter value (hopefully with magic quotes)
+ * @return mixed sanitised value - added magic quotes if accidentally missing
+ */
+function sql_magic_quotes_hack($value) {
+    if ($value === null or $value === '') {
+        // performance shortcut
+        return $value;
+    }
+
+    // ignore stuff that can not be converted to string, catchable fatal error will be displayed elsewhere,
+    // this is intentional because we want to get the same errors as before this magic hack
+    if (is_object($value)) {
+        if (!method_exists($value, '__toString')) {
+            // ignore - we can not cast object to string, error will be triggered elsewhere
+            return $value;
+        }
+    } else if (!is_string($value)) {
+        // no sql injection possible in other non-string values
+        return $value;
+    }
+
+    // note: this does not change content if the content is properly escaped,
+    // the result is different only for strings with missing magic quotes!
+    return addslashes(stripslashes($value));
+}
+
 /**
 * Prepare a SQL WHERE clause to select records where the given fields match the given values.
 *
@@ -2238,6 +2297,9 @@ function sql_ceil($fieldname) {
 * @param string $value3 the value field3 must have (requred if field3 is given, else optional).
 */
 function where_clause($field1='', $value1='', $field2='', $value2='', $field3='', $value3='') {
+    $value1 = sql_magic_quotes_hack($value1);
+    $value2 = sql_magic_quotes_hack($value2);
+    $value3 = sql_magic_quotes_hack($value3);
    if ($field1) {
        $select = is_null($value1) ? "WHERE $field1 IS NULL" : "WHERE $field1 = '$value1'";
        if ($field2) {
@@ -495,7 +495,7 @@
                $file = basename($file);

                if (!unzip_file("$basedir/$wdir/$file")) {
-                    print_error("unzipfileserror","error");
+                    print_error("cannotunzipfile", "error");
                }

                echo "<center><form action=\"coursefiles.php\" method=\"get\">\n";
@@ -3,6 +3,7 @@
    require("../../../../config.php");

    $id = optional_param('id', SITEID, PARAM_INT);
+    $httpsrequired = optional_param('httpsrequired', 0, PARAM_BOOL);

    require_login($id);
    require_capability('moodle/course:managefiles', get_context_instance(CONTEXT_COURSE, $id));
@@ -2,8 +2,10 @@
    require("../../../../config.php");

    $id = optional_param('id', SITEID, PARAM_INT);
+    $httpsrequired = optional_param('httpsrequired', 0, PARAM_BOOL);

    require_course_login($id);
+
    @header('Content-Type: text/html; charset=utf-8');

    if ($httpsrequired or (!empty($_SERVER['HTTPS']) and $_SERVER['HTTPS'] != 'off')) {
@@ -482,6 +482,17 @@ function environment_check_php_extensions($version) {
        $result->setErrorCode(NO_PHP_EXTENSIONS_SECTION_FOUND);
        return array($result);
    }
+
+/// Hack alert: inject extra mysqli dependency, mysql PHP extension is not supported in Moodle 2.x, warn only ppl using MySQL.
+    global $CFG;
+    set_dbfamily();
+    if ($CFG->dbfamily === 'mysql') {
+        $mver = normalize_version($version);
+        if (version_compare($mver, '2.0', 'ge')) {
+            $data['#']['PHP_EXTENSIONS']['0']['#']['PHP_EXTENSION'][] = array('#' => '', '@' => array('name' => 'mysqli', 'level' => 'required'));
+        }
+    }
+
 /// Iterate over extensions checking them and creating the needed environment_results
    foreach($data['#']['PHP_EXTENSIONS']['0']['#']['PHP_EXTENSION'] as $extension) {
        $result = new environment_results('php_extension');
@@ -122,7 +122,16 @@ class MoodleExcelWorksheet {
     */
    function MoodleExcelWorksheet($name, &$workbook, $latin_output=false) {

-    /// Internally, add one sheet to the workbook    
+        if (strlen($name) > 31) {
+            // Excel does not seem able to cope with sheet names > 31 chars.
+            // With $latin_output = false, it does not cope at all.
+            // With $latin_output = true it is supposed to work, but in our experience,
+            // it doesn't. Therefore, truncate in all circumstances.
+            $textlib = textlib_get_instance();
+            $name = $textlib->substr($name, 0, 31);
+        }
+
+    /// Internally, add one sheet to the workbook
        $this->pear_excel_worksheet =& $workbook->addWorksheet($name);
        $this->latin_output = $latin_output;
    /// Set encoding to UTF-16LE 
@@ -15,6 +15,21 @@ class MoodleQuickForm_password extends HTML_QuickForm_password{
     */
    var $_helpbutton='';
    function MoodleQuickForm_password($elementName=null, $elementLabel=null, $attributes=null) {
+        global $CFG;
+        if (empty($CFG->xmlstrictheaders)) {
+            // no standard mform in moodle should allow autocomplete of passwords
+            // this is valid attribute in html5, sorry, we have to ignore validation errors in legacy xhtml 1.0
+            if (empty($attributes)) {
+                $attributes = array('autocomplete'=>'off');
+            } else if (is_array($attributes)) {
+                $attributes['autocomplete'] = 'off';
+            } else {
+                if (strpos($attributes, 'autocomplete') === false) {
+                    $attributes .= ' autocomplete="off" ';
+                }
+            }
+        }
+
        parent::HTML_QuickForm_password($elementName, $elementLabel, $attributes);
    }
    /**
@@ -48,4 +63,4 @@ class MoodleQuickForm_password extends HTML_QuickForm_password{
        return $this->_helpbutton;
    }
 }
-?>
+?>
@@ -15,6 +15,21 @@ require_once($CFG->libdir.'/form/password.php');
 class MoodleQuickForm_passwordunmask extends MoodleQuickForm_password {

    function MoodleQuickForm_passwordunmask($elementName=null, $elementLabel=null, $attributes=null) {
+        global $CFG;
+        if (empty($CFG->xmlstrictheaders)) {
+            // no standard mform in moodle should allow autocomplete of passwords
+            // this is valid attribute in html5, sorry, we have to ignore validation errors in legacy xhtml 1.0
+            if (empty($attributes)) {
+                $attributes = array('autocomplete'=>'off');
+            } else if (is_array($attributes)) {
+                $attributes['autocomplete'] = 'off';
+            } else {
+                if (strpos($attributes, 'autocomplete') === false) {
+                    $attributes .= ' autocomplete="off" ';
+                }
+            }
+        }
+
        parent::MoodleQuickForm_password($elementName, $elementLabel, $attributes);
    }

@@ -33,10 +33,13 @@ class MoodleQuickForm_recaptcha extends HTML_QuickForm_input {
     * </code>
     */
    function MoodleQuickForm_recaptcha($elementName = null, $elementLabel = null, $attributes = null) {
+        global $CFG;
        parent::HTML_QuickForm_input($elementName, $elementLabel, $attributes);
        $this->_type = 'recaptcha';
-        if (!empty($attributes['https'])) {
-            $this->_https = $attributes['https'];
+        if (!empty($attributes['https']) or strpos($CFG->httpswwwroot, 'https:') === 0) {
+            $this->_https = true;
+        } else {
+            $this->_https = false;
        }
    }

@@ -106,6 +106,21 @@ class moodleform {
     * @return moodleform
     */
    function moodleform($action=null, $customdata=null, $method='post', $target='', $attributes=null, $editable=true) {
+        global $CFG;
+        if (empty($CFG->xmlstrictheaders)) {
+            // no standard mform in moodle should allow autocomplete with the exception of user signup
+            // this is valid attribute in html5, sorry, we have to ignore validation errors in legacy xhtml 1.0
+            if (empty($attributes)) {
+                $attributes = array('autocomplete'=>'off');
+            } else if (is_array($attributes)) {
+                $attributes['autocomplete'] = 'off';
+            } else {
+                if (strpos($attributes, 'autocomplete') === false) {
+                    $attributes .= ' autocomplete="off" ';
+                }
+            }
+        }
+
        if (empty($action)){
            $action = strip_querystring(qualified_me());
        }
@@ -656,12 +671,14 @@ class moodleform {
    /**
     * Adds a link/button that controls the checked state of a group of checkboxes.
     * @param int    $groupid The id of the group of advcheckboxes this element controls
-     * @param string $text The text of the link. Defaults to "select all/none"
+     * @param string $text The text of the link. Defaults to selectallornone ("select all/none")
     * @param array  $attributes associative array of HTML attributes
     * @param int    $originalValue The original general state of the checkboxes before the user first clicks this element
     */
-    function add_checkbox_controller($groupid, $buttontext, $attributes, $originalValue = 0) {
+    function add_checkbox_controller($groupid, $text = null, $attributes = null, $originalValue = 0) {
        global $CFG;
+
+        // Set the default text if none was specified
        if (empty($text)) {
            $text = get_string('selectallornone', 'form');
        }
@@ -1143,6 +1160,10 @@ class MoodleQuickForm extends HTML_QuickForm_DHTMLRulesTableless {
            }
        }

+        if (is_array($this->_constantValues)) {
+            $unfiltered = HTML_QuickForm::arrayMerge($unfiltered, $this->_constantValues);
+        }
+
        if ($addslashes){
            return $this->_recursiveFilter('addslashes', $unfiltered);
        } else {
@@ -1480,7 +1501,7 @@ function validate_' . $this->_formName . '(frm) {
        } else if (is_a($element, 'HTML_QuickForm_hidden')) {
            return array();

-        } else if (method_exists($element, 'getPrivateName')) {
+        } else if (method_exists($element, 'getPrivateName') && !($element instanceof HTML_QuickForm_advcheckbox)) {
            return array($element->getPrivateName());

        } else {
@@ -341,7 +341,7 @@ class html2text
     */
    function html2text( $source = '', $from_file = false, $do_links = true, $width = 75 )
    {
-        if ( !empty($source) ) {
+        if ($source !== '') {
            $this->set_html($source, $from_file);
        }

@@ -82,3 +82,18 @@ Index: lib/html2text.php
 }

 -- Tim Hunt 2010-11-02
+
+4 - Make sure html2text does not destroy '0'.
+
+index e2d0dff..9cc213d 100644
+--- a/lib/html2text.php
+++ b/lib/html2text.php
+@@ -335,7 +335,7 @@ class html2text
+      */
+     function html2text( $source = '', $from_file = false, $do_links = true, $wi     {
+-        if ( !empty($source) ) {
+        if ($source !== '') {
+             $this->set_html($source, $from_file);
+         }
+
+-- Tim Hunt 2011-09-21
@@ -427,13 +427,14 @@ function unmaskPassword(id) {
  try {
    // first try IE way - it can not set name attribute later
    if (chb.checked) {
-      var newpw = document.createElement('<input type="text" name="'+pw.name+'">');
+      var newpw = document.createElement('<input type="text" autocomplete="off" name="'+pw.name+'">');
    } else {
-      var newpw = document.createElement('<input type="password" name="'+pw.name+'">');
+      var newpw = document.createElement('<input type="password" autocomplete="off" name="'+pw.name+'">');
    }
    newpw.attributes['class'].nodeValue = pw.attributes['class'].nodeValue;
  } catch (e) {
    var newpw = document.createElement('input');
+    newpw.setAttribute('autocomplete', 'off');
    newpw.setAttribute('name', pw.name);
    if (chb.checked) {
      newpw.setAttribute('type', 'text');
@@ -27,7 +27,7 @@
 *
 * These are similar to the module interface, however, not all the the
 * facilities that are available to modules are available to local code (yet).
- * See also http://docs.moodle.org/en/Development:Local_customisation for more
+ * See also http://docs.moodle.org/dev/Local_customisation for more
 * information.
 *
 *
@@ -81,7 +81,7 @@
 * lang/en_utf8_local/moodle.php containing
 *   $strings['login'] = 'Sign in';
 * and that will change the string 'Login' to 'Sign in'. (See also
- * http://docs.moodle.org/en/Language_editing for another way to achieve this.)
+ * http://docs.moodle.org/19/en/Language_editing for another way to achieve this.)
 *
 * This mechanism can also be used to create completely new language files. For
 * example, suppose you have created some code in local/myfeature.php that needs
@@ -1115,27 +1115,28 @@ function get_user_preferences($name=NULL, $default=NULL, $otheruserid=NULL) {
 * @param int $hour The hour part to create timestamp of
 * @param int $minute The minute part to create timestamp of
 * @param int $second The second part to create timestamp of
- * @param float $timezone ?
- * @param bool $applydst ?
+ * @param mixed $timezone Timezone modifier, if 99 then use default user's timezone
+ * @param bool $applydst Toggle Daylight Saving Time, default true, will be 
+ *             applied only if timezone is 99 or string.
 * @return int timestamp
 * @todo Finish documenting this function
 */
 function make_timestamp($year, $month=1, $day=1, $hour=0, $minute=0, $second=0, $timezone=99, $applydst=true) {

-    $strtimezone = NULL;
-    if (!is_numeric($timezone)) {
-        $strtimezone = $timezone;
-    }
+    //save input timezone, required for dst offset check.
+    $passedtimezone = $timezone;

    $timezone = get_user_timezone_offset($timezone);

-    if (abs($timezone) > 13) {
+    if (abs($timezone) > 13) {  //server time
        $time = mktime((int)$hour, (int)$minute, (int)$second, (int)$month, (int)$day, (int)$year);
    } else {
        $time = gmmktime((int)$hour, (int)$minute, (int)$second, (int)$month, (int)$day, (int)$year);
        $time = usertime($time, $timezone);
-        if($applydst) {
-            $time -= dst_offset_on($time, $strtimezone);
+
+        //Apply dst for string timezones or if 99 then try dst offset with user's default timezone
+        if ($applydst && ((99 == $passedtimezone) || !is_numeric($passedtimezone))) {
+            $time -= dst_offset_on($time, $passedtimezone);
        }
    }

@@ -1222,7 +1223,8 @@ function make_timestamp($year, $month=1, $day=1, $hour=0, $minute=0, $second=0,
 * @uses HOURSECS
 * @param  int $date timestamp in GMT
 * @param string $format strftime format
- * @param float $timezone
+ * @param mixed $timezone by default, uses the user's time zone. if numeric and
+ *      not 99 then daylight saving will not be added.
 * @param bool $fixday If true (default) then the leading
 * zero from %d is removed. If false then the leading zero is mantained.
 * @return string
@@ -1231,11 +1233,6 @@ function userdate($date, $format='', $timezone=99, $fixday = true) {

    global $CFG;

-    $strtimezone = NULL;
-    if (!is_numeric($timezone)) {
-        $strtimezone = $timezone;
-    }
-
    if (empty($format)) {
        $format = get_string('strftimedaydatetime');
    }
@@ -1247,7 +1244,11 @@ function userdate($date, $format='', $timezone=99, $fixday = true) {
        $fixday = ($formatnoday != $format);
    }

-    $date += dst_offset_on($date, $strtimezone);
+    //add daylight saving offset for string timezones only, as we can't get dst for
+    //float values. if timezone is 99 (user default timezone), then try update dst.
+    if ((99 == $timezone) || !is_numeric($timezone)) {
+        $date += dst_offset_on($date, $timezone);
+    }

    $timezone = get_user_timezone_offset($timezone);

@@ -1289,16 +1290,15 @@ function userdate($date, $format='', $timezone=99, $fixday = true) {
 *
 * @uses HOURSECS
 * @param int $time Timestamp in GMT
- * @param float $timezone ?
+ * @param mixed $timezone offset time with timezone, if float and not 99, then no
+ *        dst offset is applyed
 * @return array An array that represents the date in user time
 * @todo Finish documenting this function
 */
 function usergetdate($time, $timezone=99) {

-    $strtimezone = NULL;
-    if (!is_numeric($timezone)) {
-        $strtimezone = $timezone;
-    }
+    //save input timezone, required for dst offset check.
+    $passedtimezone = $timezone;

    $timezone = get_user_timezone_offset($timezone);

@@ -1306,8 +1306,12 @@ function usergetdate($time, $timezone=99) {
        return getdate($time);
    }

-    // There is no gmgetdate so we use gmdate instead
-    $time += dst_offset_on($time, $strtimezone);
+    //add daylight saving offset for string timezones only, as we can't get dst for
+    //float values. if timezone is 99 (user default timezone), then try update dst.
+    if ($passedtimezone == 99 || !is_numeric($passedtimezone)) {
+        $time += dst_offset_on($time, $passedtimezone);
+    }
+
    $time += intval((float)$timezone * HOURSECS);

    $datestring = gmstrftime('%B_%A_%j_%Y_%m_%w_%d_%H_%M_%S', $time);
@@ -1456,7 +1460,7 @@ function get_timezone_offset($tz) {
 *
 * @uses $USER
 * @uses $CFG
- * @param float $tz If this value is provided and not equal to 99, it will be returned as is and no other settings will be checked
+ * @param mixed $tz If this value is provided and not equal to 99, it will be returned as is and no other settings will be checked
 * @return mixed
 */
 function get_user_timezone($tz = 99) {
@@ -2737,13 +2741,13 @@ function set_moodle_cookie($thing) {
        return;
    }

-    $cookiename = 'MOODLEID_'.$CFG->sessioncookie;
+    $cookiename = 'MOODLEID1_'.$CFG->sessioncookie;

    $days = 60;
    $seconds = DAYSECS*$days;

    setCookie($cookiename, '', time() - HOURSECS, $CFG->sessioncookiepath, $CFG->sessioncookiedomain, $CFG->cookiesecure);
-    setCookie($cookiename, rc4encrypt($thing), time()+$seconds, $CFG->sessioncookiepath, $CFG->sessioncookiedomain, $CFG->cookiesecure);
+    setCookie($cookiename, rc4encrypt($thing, true), time()+$seconds, $CFG->sessioncookiepath, $CFG->sessioncookiedomain, $CFG->cookiesecure);
 }

 /**
@@ -2755,12 +2759,12 @@ function set_moodle_cookie($thing) {
 function get_moodle_cookie() {
    global $CFG;

-    $cookiename = 'MOODLEID_'.$CFG->sessioncookie;
+    $cookiename = 'MOODLEID1_'.$CFG->sessioncookie;

    if (empty($_COOKIE[$cookiename])) {
        return '';
    } else {
-        $thing = rc4decrypt($_COOKIE[$cookiename]);
+        $thing = rc4decrypt($_COOKIE[$cookiename], true);
        return ($thing == 'guest') ? '': $thing;  // Ignore guest account
    }
 }
@@ -6020,25 +6024,33 @@ function get_list_of_currencies() {
 /**
 * rc4encrypt
 *
- * @param string $data ?
- * @return string
- * @todo Finish documenting this function
+ * @param string $data        Data to encrypt.
+ * @param bool $usesecurekey  Lets us know if we are using the old or new password.
+ * @return string             The now encrypted data.
 */
-function rc4encrypt($data) {
-    $password = 'nfgjeingjk';
-    return endecrypt($password, $data, '');
+function rc4encrypt($data, $usesecurekey = false) {
+    if (!$usesecurekey) {
+        $passwordkey = 'nfgjeingjk';
+    } else {
+        $passwordkey = get_site_identifier();
+    }
+    return endecrypt($passwordkey, $data, '');
 }

 /**
 * rc4decrypt
 *
- * @param string $data ?
- * @return string
- * @todo Finish documenting this function
+ * @param string $data        Data to decrypt.
+ * @param bool $usesecurekey  Lets us know if we are using the old or new password.
+ * @return string             The now decrypted data.
 */
-function rc4decrypt($data) {
-    $password = 'nfgjeingjk';
-    return endecrypt($password, $data, 'de');
+function rc4decrypt($data, $usesecurekey = false) {
+    if (!$usesecurekey) {
+        $passwordkey = 'nfgjeingjk';
+    } else {
+        $passwordkey = get_site_identifier();
+    }
+    return endecrypt($passwordkey, $data, 'de');
 }

 /**
@@ -6369,9 +6381,14 @@ function check_php_version($version='4.1.0') {


      case 'Firefox':   /// Mozilla Firefox browsers
-
-          if (preg_match("/Firefox\/([0-9\.]+)/i", $agent, $match)) {
-              if (version_compare($match[1], $version) >= 0) {
+          if (strpos($agent, 'Iceweasel') === false and strpos($agent, 'Firefox') === false) {
+              return false;
+          }
+          if (empty($version)) {
+              return true; // no version specified
+          }
+          if (preg_match("/(Iceweasel|Firefox)\/([0-9\.]+)/i", $agent, $match)) {
+              if (version_compare($match[2], $version) >= 0) {
                  return true;
              }
          }
@@ -6379,19 +6396,45 @@ function check_php_version($version='4.1.0') {


      case 'Gecko':   /// Gecko based browsers
-
-          if (substr_count($agent, 'Camino')) {
-              // MacOS X Camino support
-              $version = 20041110;
+          // Do not look for dates any more, we expect real Firefox version here.
+          if (empty($version)) {
+              $version = 1;
+          } else if ($version > 20000000) {
+              // This is just a guess, it is not supposed to be 100% accurate!
+              if (preg_match('/^201/', $version)) {
+                  $version = 3.6;
+              } else if (preg_match('/^200[7-9]/', $version)) {
+                  $version = 3;
+              } else if (preg_match('/^2006/', $version)) {
+                  $version = 2;
+              } else {
+                  $version = 1.5;
+              }
          }
-
-          // the proper string - Gecko/CCYYMMDD Vendor/Version
-          // Faster version and work-a-round No IDN problem.
-          if (preg_match("/Gecko\/([0-9]+)/i", $agent, $match)) {
-              if ($match[1] > $version) {
-                      return true;
+          if (preg_match("/(Iceweasel|Firefox)\/([0-9\.]+)/i", $agent, $match)) {
+              // Use real Firefox version if specified in user agent string.
+              if (version_compare($match[2], $version) >= 0) {
+                  return true;
+              }
+          } else if (preg_match("/Gecko\/([0-9\.]+)/i", $agent, $match)) {
+              // Gecko might contain date or Firefox revision, let's just guess the Firefox version from the date.
+              $browserver = $match[1];
+              if ($browserver > 20000000) {
+                  // This is just a guess, it is not supposed to be 100% accurate!
+                  if (preg_match('/^201/', $browserver)) {
+                      $browserver = 3.6;
+                  } else if (preg_match('/^200[7-9]/', $browserver)) {
+                      $browserver = 3;
+                  } else if (preg_match('/^2006/', $version)) {
+                      $browserver = 2;
+                  } else {
+                      $browserver = 1.5;
                  }
              }
+              if (version_compare($browserver, $version) >= 0) {
+                  return true;
+              }
+          }
          break;


@@ -6431,12 +6474,12 @@ function check_php_version($version='4.1.0') {
          break;

      case 'Safari':  /// Safari
-          // Look for AppleWebKit, excluding strings with OmniWeb, Shiira and SimbianOS
+          // Look for AppleWebKit, excluding strings with OmniWeb, Shiira and SymbianOS
          if (strpos($agent, 'OmniWeb')) { // Reject OmniWeb
              return false;
          } elseif (strpos($agent, 'Shiira')) { // Reject Shiira
              return false;
-          } elseif (strpos($agent, 'SimbianOS')) { // Reject SimbianOS
+          } elseif (strpos($agent, 'SymbianOS')) { // Reject SymbianOS
              return false;
          }
          if (strpos($agent, 'iPhone') or strpos($agent, 'iPad') or strpos($agent, 'iPod')) {
@@ -7079,12 +7122,17 @@ function generate_password($maxlen=10) {
        $filler1 = $fillers[rand(0, strlen($fillers) - 1)];
        $password = $word1 . $filler1 . $word2;
    } else {
-        $maxlen = !empty($CFG->minpasswordlength) ? $CFG->minpasswordlength : 0;
+        $minlen = !empty($CFG->minpasswordlength) ? $CFG->minpasswordlength : 0;
        $digits = $CFG->minpassworddigits;
        $lower = $CFG->minpasswordlower;
        $upper = $CFG->minpasswordupper;
        $nonalphanum = $CFG->minpasswordnonalphanum;
-        $additional = $maxlen - ($lower + $upper + $digits + $nonalphanum);
+        $total = $lower + $upper + $digits + $nonalphanum;
+        // minlength should be the greater one of the two ( $minlen and $total )
+        $minlen = $minlen < $total ? $total : $minlen;
+        // maxlen can never be smaller than minlen
+        $maxlen = $minlen > $maxlen ? $minlen : $maxlen;
+        $additional = $maxlen - $total;

        // Make sure we have enough characters to fulfill
        // complexity requirements
@@ -664,6 +664,7 @@ function olson_parse_at ($at, $set = 'set', $gmtoffset) {
        $at  = substr($at, 0, strlen($at)-1); // chop
    }

+    $at = (strpos($at, ':') === false) ? $at . ':0' : $at;
    list($hours, $mins) = explode(':', $at);

    // GMT -- return as is!
@@ -653,11 +653,11 @@ class PHPMailer
     */
    function AddrFormat($addr) {
        if(empty($addr[1]))
-            $formatted = $addr[0];
+            $formatted = preg_replace('/[\r\n]+/', '', $addr[0]); // Moodle modification
        else
        {
-            $formatted = $this->EncodeHeader($addr[1], 'phrase') . " <" . 
-                         $addr[0] . ">";
+            $formatted = $this->EncodeHeader($addr[1], 'phrase') . " <" .
+                         preg_replace('/[\r\n]+/', '', $addr[0]) . ">"; // Moodle modification
        }

        return $formatted;
@@ -780,9 +780,9 @@ class PHPMailer

        $result .= $this->HeaderLine("Date", $this->RFCDate());
        if($this->Sender == "")
-            $result .= $this->HeaderLine("Return-Path", trim($this->From));
+            $result .= $this->HeaderLine("Return-Path", trim(preg_replace('/[\r\n]+/', '', $this->From))); // Moodle modification
        else
-            $result .= $this->HeaderLine("Return-Path", trim($this->Sender));
+            $result .= $this->HeaderLine("Return-Path", trim(preg_replace('/[\r\n]+/', '', $this->Sender))); // Moodle modification
        
        // To be created automatically by mail()
        if($this->Mailer != "mail")
@@ -1190,7 +1190,10 @@ class PHPMailer
     */
    function EncodeHeader ($str, $position = 'text') {

-    /// Start Moodle Hack - do our own multibyte-safe header encoding
+    /// Start Moodle Hack - do our own multibyte-safe header encoding and cleanup
+        $str = str_replace("\r", '', $str);
+        $str = str_replace("\n", '', $str);
+
        $textlib = textlib_get_instance();
        $encoded = $textlib->encode_mimeheader($str, $this->CharSet);
        if ($encoded !== false) {
@@ -2,13 +2,13 @@
 /*
 * This is a PHP library that handles calling reCAPTCHA.
 *    - Documentation and latest version
- *          http://recaptcha.net/plugins/php/
+ *          {@link http://code.google.com/apis/recaptcha/docs/php.html}
 *    - Get a reCAPTCHA API Key
- *          http://recaptcha.net/api/getkey
+ *          {@link https://www.google.com/recaptcha/admin/create}
 *    - Discussion group
 *          http://groups.google.com/group/recaptcha
 *
- * Copyright (c) 2007 reCAPTCHA -- http://recaptcha.net
+ * Copyright (c) 2007 reCAPTCHA -- {@link http://www.google.com/recaptcha}
 * AUTHORS:
 *   Mike Crawford
 *   Ben Maurer
@@ -30,14 +30,17 @@
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
+ *
+ * @package moodlecore
+ * @copyright (c) 2007 reCAPTCHA -- {@link http://www.google.com/recaptcha}
 */

 /**
 * The reCAPTCHA server URL's
 */
-define("RECAPTCHA_API_SERVER", "http://api.recaptcha.net");
-define("RECAPTCHA_API_SECURE_SERVER", "https://api-secure.recaptcha.net");
-define("RECAPTCHA_VERIFY_SERVER", "api-verify.recaptcha.net");
+define("RECAPTCHA_API_SERVER", "http://www.google.com/recaptcha/api");
+define("RECAPTCHA_API_SECURE_SERVER", "https://www.google.com/recaptcha/api");
+define("RECAPTCHA_VERIFY_SERVER", "www.google.com");

 /**
 * Encodes the given data into a query string format
@@ -107,15 +110,15 @@ function recaptcha_get_html ($pubkey, $error = null, $use_ssl = false) {

    $recaptchatype = optional_param('recaptcha', 'image', PARAM_TEXT);

-	if ($pubkey == null || $pubkey == '') {
-		die ("To use reCAPTCHA you must get an API key from <a href='http://recaptcha.net/api/getkey'>http://recaptcha.net/api/getkey</a>");
-	}
-	
-	if ($use_ssl) {
-                $server = RECAPTCHA_API_SECURE_SERVER;
-        } else {
-                $server = RECAPTCHA_API_SERVER;
-        }
+    if ($pubkey == null || $pubkey == '') {
+		die ("To use reCAPTCHA you must get an API key from <a href='https://www.google.com/recaptcha/admin/create'>https://www.google.com/recaptcha/admin/create</a>");
+    }
+
+    if ($use_ssl) {
+        $server = RECAPTCHA_API_SECURE_SERVER;
+    } else {
+        $server = RECAPTCHA_API_SERVER;
+    }

        $errorpart = "";
        if ($error) {
@@ -175,6 +178,9 @@ function recaptcha_get_html ($pubkey, $error = null, $use_ssl = false) {

 /**
 * A ReCaptchaResponse is returned from recaptcha_check_answer()
+ *
+ * @package moodlecore
+ * @copyright (c) 2007 reCAPTCHA -- {@link http://www.google.com/recaptcha}
 */
 class ReCaptchaResponse {
        var $is_valid;
@@ -192,9 +198,9 @@ class ReCaptchaResponse {
  */
 function recaptcha_check_answer ($privkey, $remoteip, $challenge, $response, $https=false)
 {
-	if ($privkey == null || $privkey == '') {
-		die ("To use reCAPTCHA you must get an API key from <a href='http://recaptcha.net/api/getkey'>http://recaptcha.net/api/getkey</a>");
-	}
+    if ($privkey == null || $privkey == '') {
+		die ("To use reCAPTCHA you must get an API key from <a href='https://www.google.com/recaptcha/admin/create'>https://www.google.com/recaptcha/admin/create</a>");
+    }

 	if ($remoteip == null || $remoteip == '') {
 		die ("For security reasons, you must pass the remote ip to reCAPTCHA");
@@ -210,12 +216,12 @@ function recaptcha_check_answer ($privkey, $remoteip, $challenge, $response, $ht
                return $recaptcha_response;
        }

-        $response = _recaptcha_http_post (RECAPTCHA_VERIFY_SERVER, "/verify",
-                                          array (
-                                                 'privatekey' => $privkey,
-                                                 'remoteip' => $remoteip,
-                                                 'challenge' => $challenge,
-                                                 'response' => $response
+        $response = _recaptcha_http_post(RECAPTCHA_VERIFY_SERVER, "/recaptcha/api/verify",
+                                         array (
+                                                'privatekey' => $privkey,
+                                                'remoteip' => $remoteip,
+                                                'challenge' => $challenge,
+                                                'response' => $response
                                                ),
                                         $https        
                                          );
@@ -242,7 +248,7 @@ function recaptcha_check_answer ($privkey, $remoteip, $challenge, $response, $ht
 * @param string $appname The name of your application
 */
 function recaptcha_get_signup_url ($domain = null, $appname = null) {
-	return "http://recaptcha.net/api/getkey?" .  _recaptcha_qsencode (array ('domain' => $domain, 'app' => $appname));
+	return "https://www.google.com/recaptcha/admin/create?" .  _recaptcha_qsencode (array ('domains' => $domain, 'app' => $appname));
 }

 function _recaptcha_aes_pad($val) {
@@ -270,16 +276,16 @@ function _recaptcha_mailhide_urlbase64 ($x) {

 /* gets the reCAPTCHA Mailhide url for a given email, public key and private key */
 function recaptcha_mailhide_url($pubkey, $privkey, $email) {
-	if ($pubkey == '' || $pubkey == null || $privkey == "" || $privkey == null) {
-		die ("To use reCAPTCHA Mailhide, you have to sign up for a public and private key, " .
-		     "you can do so at <a href='http://mailhide.recaptcha.net/apikey'>http://mailhide.recaptcha.net/apikey</a>");
-	}
-	
+    if ($pubkey == '' || $pubkey == null || $privkey == "" || $privkey == null) {
+        die ("To use reCAPTCHA Mailhide, you have to sign up for a public and private key, " .
+		     "you can do so at <a href='http://www.google.com/recaptcha/mailhide/apikey'>http://www.google.com/recaptcha/mailhide/apikey</a>");
+    }

-	$ky = pack('H*', $privkey);
-	$cryptmail = _recaptcha_aes_encrypt ($email, $ky);
-	
-	return "http://mailhide.recaptcha.net/d?k=" . $pubkey . "&c=" . _recaptcha_mailhide_urlbase64 ($cryptmail);
+
+    $ky = pack('H*', $privkey);
+    $cryptmail = _recaptcha_aes_encrypt ($email, $ky);
+
+	return "http://www.google.com/recaptcha/mailhide/d?k=" . $pubkey . "&c=" . _recaptcha_mailhide_urlbase64 ($cryptmail);
 }

 /**
@@ -304,7 +310,7 @@ function _recaptcha_mailhide_email_parts ($email) {
 * Gets html to display an email address given a public an private key.
 * to get a key, go to:
 *
- * http://mailhide.recaptcha.net/apikey
+ * http://www.google.com/recaptcha/mailhide/apikey
 */
 function recaptcha_mailhide_html($pubkey, $privkey, $email) {
 	$emailparts = _recaptcha_mailhide_email_parts ($email);
@@ -521,7 +521,7 @@ function rss_get_form($act='none', $url='', $rssid='', $preferredtitle='', $shar
    $returnstring .= '<input type="hidden" name="user" value="'. $USER->id .'" />'."\n";
    $returnstring .= '<input type="hidden" name="sesskey" value="'. sesskey() .'" />'."\n";
    $returnstring .= '<br /><input type="submit" value="';
-    $validatestring = "<a href=\"#\" onclick=\"window.open('http://feedvalidator.org/check.cgi?url='+getElementById('block_rss').elements['url'].value,'validate','width=640,height=480,scrollbars=yes,status=yes,resizable=yes');return true;\">". get_string('validatefeed', 'block_rss_client')."</a>";
+    $validatestring = "<a href=\"#\" onclick=\"window.open('http://feedvalidator.org/check.cgi?url='+escape(getElementById('block_rss').elements['url'].value),'validate','width=640,height=480,scrollbars=yes,status=yes,resizable=yes');return true;\">". get_string('validatefeed', 'block_rss_client')."</a>";

    if ($act == 'rssedit') {
        $returnstring .= $stredit;
@@ -356,6 +356,23 @@ class dmllib_test extends prefix_changing_test_case {


    }
+
+    function test_magic_hack() {
+        // test hacky sql injection protection - the resulting DB data is not really important,
+        // we only want to prevent SQL injections/DB errors
+
+        $obj = new stdClass();
+        $obj->textfield = 'lala\'';
+        $obj->id = insert_record($this->table, $obj);
+        $this->assertFalse(empty($obj->id));
+
+        $obj->textfield = 'lala\\';
+        $res = update_record($this->table, $obj);
+        $this->assertTrue($res);
+
+        $obj = get_record($this->table, 'textfield', 'lala\\');
+        $this->assertFalse(empty($obj));
+    }
 }

 ?>
@@ -255,7 +255,14 @@ class moodlelib_test extends UnitTestCase {
    }
    
    function test_usergetdate() {
-        global $USER;
+        global $USER, $CFG;
+
+        //Check if forcetimezone is set then save it and set it to use user timezone
+        $cfgforcetimezone = null;
+        if (isset($CFG->forcetimezone)) {
+            $cfgforcetimezone = $CFG->forcetimezone;
+            $CFG->forcetimezone = 99; //get user default timezone.
+        }

        $userstimezone = $USER->timezone;
        $USER->timezone = 2;//set the timezone to a known state
@@ -292,9 +299,214 @@ class moodlelib_test extends UnitTestCase {
        $this->assertEqual($weekday,'Wednesday');
        $this->assertEqual($month,'December');

+        //restore forcetimezone if changed.
+        if (!is_null($cfgforcetimezone)) {
+            $CFG->forcetimezone = $cfgforcetimezone;
+        }
+
        //set the timezone back to what it was
        $USER->timezone = $userstimezone;
    }

+    public function test_userdate() {
+        global $USER, $CFG;
+
+        $testvalues = array(
+            array(
+                'time' => '1309514400',
+                'usertimezone' => 'America/Moncton',
+                'timezone' => '0.0', //no dst offset
+                'expectedoutput' => 'Friday, 1 July 2011, 10:00 AM'
+            ),
+            array(
+                'time' => '1293876000 ',
+                'usertimezone' => 'America/Moncton',
+                'timezone' => '0.0', //no dst offset
+                'expectedoutput' => 'Saturday, 1 January 2011, 10:00 AM'
+            ),
+            array(
+                'time' => '1293876000 ',
+                'usertimezone' => 'America/Moncton',
+                'timezone' => '99', //no dst offset in jan, so just timezone offset.
+                'expectedoutput' => 'Saturday, 1 January 2011, 06:00 AM'
+            ),
+            array(
+                'time' => '1293876000 ',
+                'usertimezone' => 'America/Moncton',
+                'timezone' => 'America/Moncton', //no dst offset in jan
+                'expectedoutput' => 'Saturday, 1 January 2011, 06:00 AM'
+            ),
+            array(
+                'time' => '1293876000 ',
+                'usertimezone' => '2',
+                'timezone' => '99', //take user timezone
+                'expectedoutput' => 'Saturday, 1 January 2011, 12:00 PM'
+            ),
+            array(
+                'time' => '1293876000 ',
+                'usertimezone' => '-2',
+                'timezone' => '99', //take user timezone
+                'expectedoutput' => 'Saturday, 1 January 2011, 08:00 AM'
+            ),
+            array(
+                'time' => '1293876000 ',
+                'usertimezone' => '-10',
+                'timezone' => '2', //take this timezone
+                'expectedoutput' => 'Saturday, 1 January 2011, 12:00 PM'
+            ),
+            array(
+                'time' => '1293876000 ',
+                'usertimezone' => '-10',
+                'timezone' => '-2', //take this timezone
+                'expectedoutput' => 'Saturday, 1 January 2011, 08:00 AM'
+            )
+        );
+
+        //Check if forcetimezone is set then save it and set it to use user timezone
+        $cfgforcetimezone = null;
+        if (isset($CFG->forcetimezone)) {
+            $cfgforcetimezone = $CFG->forcetimezone;
+            $CFG->forcetimezone = 99; //get user default timezone.
+        }
+        //store user default timezone to restore later
+        $userstimezone = $USER->timezone;
+
+        // The string version of date comes from server locale setting and does
+        // not respect user language, so it is necessary to reset that.
+        $oldlocale = setlocale(LC_TIME, '0');
+        setlocale(LC_TIME, 'en_AU.UTF-8');
+
+        //get instance of textlib for strtolower
+        $textlib = textlib_get_instance();
+        foreach ($testvalues as $vals) {
+            $USER->timezone = $vals['usertimezone'];
+            $actualoutput = userdate($vals['time'], '%A, %d %B %Y, %I:%M %p', $vals['timezone']);
+
+            //On different systems case of AM PM changes so compare case insenitive
+            $vals['expectedoutput'] = $textlib->strtolower($vals['expectedoutput']);
+            $actualoutput = $textlib->strtolower($actualoutput);
+
+            $this->assertEqual($vals['expectedoutput'], $actualoutput,
+                "Expected: {$vals['expectedoutput']} => Actual: {$actualoutput},
+                Please check if timezones are updated (Site adminstration -> location -> update timezone)");
+        }
+
+        //restore user timezone back to what it was
+        $USER->timezone = $userstimezone;
+
+        //restore forcetimezone
+        if (!is_null($cfgforcetimezone)) {
+            $CFG->forcetimezone = $cfgforcetimezone;
+        }
+
+        //restore system default values.
+        setlocale(LC_TIME, $oldlocale);
+    }
+
+    public function test_make_timestamp() {
+        global $USER, $CFG;
+
+        $testvalues = array(
+            array(
+                'usertimezone' => '2',//no dst applyed
+                'year' => '2011',
+                'month' => '7',
+                'day' => '1',
+                'hour' => '10',
+                'minutes' => '00',
+                'seconds' => '00',
+                'timezone' => '99', //take user timezone
+                'applydst' => true, //apply dst
+                'expectedoutput' => '1309507200'
+            ),
+            array(
+                'usertimezone' => '-2',//no dst applyed
+                'year' => '2011',
+                'month' => '7',
+                'day' => '1',
+                'hour' => '10',
+                'minutes' => '00',
+                'seconds' => '00',
+                'timezone' => '99', //take usertimezone
+                'applydst' => true, //apply dst
+                'expectedoutput' => '1309521600'
+            ),
+            array(
+                'usertimezone' => '-10',//no dst applyed
+                'year' => '2011',
+                'month' => '7',
+                'day' => '1',
+                'hour' => '10',
+                'minutes' => '00',
+                'seconds' => '00',
+                'timezone' => '2', //take this timezone
+                'applydst' => true, //apply dst
+                'expectedoutput' => '1309507200'
+            ),
+            array(
+                'usertimezone' => '-10',//no dst applyed
+                'year' => '2011',
+                'month' => '7',
+                'day' => '1',
+                'hour' => '10',
+                'minutes' => '00',
+                'seconds' => '00',
+                'timezone' => '-2', //take this timezone
+                'applydst' => true, //apply dst,
+                'expectedoutput' => '1309521600'
+            )
+        );
+
+        //Check if forcetimezone is set then save it and set it to use user timezone
+        $cfgforcetimezone = null;
+        if (isset($CFG->forcetimezone)) {
+            $cfgforcetimezone = $CFG->forcetimezone;
+            $CFG->forcetimezone = 99; //get user default timezone.
+        }
+
+        //store user default timezone to restore later
+        $userstimezone = $USER->timezone;
+
+        // The string version of date comes from server locale setting and does
+        // not respect user language, so it is necessary to reset that.
+        $oldlocale = setlocale(LC_TIME, '0');
+        setlocale(LC_TIME, 'en_AU.UTF-8');
+
+        //get instance of textlib for strtolower
+        $textlib = textlib_get_instance();
+        //Test make_timestamp with all testvals and assert if anything wrong.
+        foreach ($testvalues as $vals) {
+            $USER->timezone = $vals['usertimezone'];
+            $actualoutput = make_timestamp(
+                    $vals['year'],
+                    $vals['month'],
+                    $vals['day'],
+                    $vals['hour'],
+                    $vals['minutes'],
+                    $vals['seconds'],
+                    $vals['timezone'],
+                    $vals['applydst']
+                    );
+
+            //On different systems case of AM PM changes so compare case insenitive
+            $vals['expectedoutput'] = $textlib->strtolower($vals['expectedoutput']);
+            $actualoutput = $textlib->strtolower($actualoutput);
+
+            $this->assertEqual($vals['expectedoutput'], $actualoutput,
+                "Expected: {$vals['expectedoutput']} => Actual: {$actualoutput},
+                Please check if timezones are updated (Site adminstration -> location -> update timezone)");
+        }
+
+        //restore user timezone back to what it was
+        $USER->timezone = $userstimezone;
+
+        //restore forcetimezone
+        if (!is_null($cfgforcetimezone)) {
+            $CFG->forcetimezone = $cfgforcetimezone;
+        }
+
+        //restore system default values.
+        setlocale(LC_TIME, $oldlocale);
+    }
 }
-?>
+?>
@@ -255,5 +255,13 @@ END;
    public function test_html_to_text_dont_screw_up_utf8() {
        $this->assertEqual("\n\nAll the WORLD’S a stage.", html_to_text('<p>All the <strong>world’s</strong> a stage.</p>'));
    }
+
+    public function test_html_to_text_trailing_whitespace() {
+        $this->assertEqual('With trailing whitespace and some more text', html_to_text("With trailing whitespace   \nand some   more text", 0));
+    }
+
+    public function test_html_to_text_0() {
+        $this->assertIdentical('0', html_to_text('0'));
+    }
 }
 ?>
@@ -216,33 +216,41 @@ function get_referer($stripquery=true) {
 *
 * @return string
 */
- function me() {
-
+function me() {
    if (!empty($_SERVER['REQUEST_URI'])) {
-        return $_SERVER['REQUEST_URI'];
+        $return = $_SERVER['REQUEST_URI'];

    } else if (!empty($_SERVER['PHP_SELF'])) {
        if (!empty($_SERVER['QUERY_STRING'])) {
-            return $_SERVER['PHP_SELF'] .'?'. $_SERVER['QUERY_STRING'];
+            $return = $_SERVER['PHP_SELF'] .'?'. $_SERVER['QUERY_STRING'];
+        } else {
+            $return = $_SERVER['PHP_SELF'];
        }
-        return $_SERVER['PHP_SELF'];

    } else if (!empty($_SERVER['SCRIPT_NAME'])) {
        if (!empty($_SERVER['QUERY_STRING'])) {
-            return $_SERVER['SCRIPT_NAME'] .'?'. $_SERVER['QUERY_STRING'];
+            $return = $_SERVER['SCRIPT_NAME'] .'?'. $_SERVER['QUERY_STRING'];
+        } else {
+            $return = $_SERVER['SCRIPT_NAME'];
        }
-        return $_SERVER['SCRIPT_NAME'];

    } else if (!empty($_SERVER['URL'])) {     // May help IIS (not well tested)
        if (!empty($_SERVER['QUERY_STRING'])) {
-            return $_SERVER['URL'] .'?'. $_SERVER['QUERY_STRING'];
+            $return = $_SERVER['URL'] .'?'. $_SERVER['QUERY_STRING'];
+        } else {
+            $return = $_SERVER['URL'];
        }
-        return $_SERVER['URL'];

    } else {
        notify('Warning: Could not find any of these web server variables: $REQUEST_URI, $PHP_SELF, $SCRIPT_NAME or $URL');
        return false;
    }
+
+    // sanitize the url a bit more, the encoding style may be different in vars above
+    $return = str_replace('"', '%22', $return);
+    $return = str_replace('\'', '%27', $return);
+
+    return $return;
 }

 /**
@@ -300,7 +308,7 @@ function qualified_me() {
 /**
 * Class for creating and manipulating urls.
 *
- * See short write up here http://docs.moodle.org/en/Development:lib/weblib.php_moodle_url
+ * See short write up here http://docs.moodle.org/dev/lib/weblib.php_moodle_url
 */
 class moodle_url {
    var $scheme = '';// e.g. http
@@ -1502,7 +1510,7 @@ function format_text($text, $format=FORMAT_MOODLE, $options=NULL, $courseid=NULL

    static $croncache = array();

-    if ($text === '') {
+    if ($text === '' || is_null($text)) {
        return ''; // no need to do any filters and cleaning
    }

@@ -2757,9 +2765,9 @@ function print_header ($title='', $heading='', $navigation='', $focus='',

    $pageclass .= ' dir-'.get_string('thisdirection');

-    $pageclass .= ' lang-'.$currentlanguage;
+    $pageclass .= ' lang-'.s($currentlanguage);

-    $bodytags .= ' class="'.$pageclass.'" id="'.$pageid.'"';
+    $bodytags .= ' class="'.s($pageclass).'" id="'.s($pageid).'"';

    ob_start();
    include($CFG->header);
@@ -5833,12 +5841,20 @@ function print_error($errorcode, $module='error', $link='', $a=NULL, $extralocat
        }
    }

+    // when printing an error the continue button should never link offsite
+    if (stripos($link, $CFG->wwwroot) === false &&
+        stripos($link, $CFG->httpswwwroot) === false) {
+        $link = $CFG->wwwroot.'/';
+    }
+
    if (!empty($CFG->errordocroot)) {
-        $errordocroot = $CFG->errordocroot;
-    } else if (!empty($CFG->docroot)) {
-        $errordocroot = $CFG->docroot;
+        $errordoclink = $CFG->errordocroot.'/en';
    } else {
-        $errordocroot = 'http://docs.moodle.org';
+        $errordoclink = get_doc_root();
+        if (is_null($errordoclink)) {
+            $lang = current_language();
+            $errordoclink = 'http://docs.moodle.org/19/'.$lang; //no doc links set. point to default.
+        }
    }

    if (defined('FULLME') && FULLME == 'cron') {
@@ -5855,7 +5871,7 @@ function print_error($errorcode, $module='error', $link='', $a=NULL, $extralocat

    $message = clean_text('<p class="errormessage">'.$message.'</p>'.
               '<p class="errorcode">'.
-               '<a href="'.$errordocroot.'/en/error/'.$modulelink.'/'.$errorcode.'">'.
+               '<a href="'.$errordoclink.'/error/'.$modulelink.'/'.$errorcode.'">'.
                 get_string('moreinformation').'</a></p>');

    if (! defined('HEADER_PRINTED')) {
@@ -6187,8 +6203,35 @@ function redirect($url, $message='', $delay=-1) {

    $message = clean_text($message);

+    // Technically, HTTP/1.1 requires Location: header to contain the absolute path.
+    // (In practice browsers accept relative paths - but still, might as well do it properly.)
+    // This code turns relative into absolute.
+    if (!preg_match('|^[a-z]+:|', $url)) {
+        // Get host name http://www.wherever.com
+        $hostpart = preg_replace('|^(.*?[^:/])/.*$|', '$1', $CFG->wwwroot);
+        if (preg_match('|^/|', $url)) {
+            // URLs beginning with / are relative to web server root so we just add them in
+            $url = $hostpart.$url;
+        } else {
+            // URLs not beginning with / are relative to path of current script, so add that on.
+            $url = $hostpart.preg_replace('|\?.*$|','',me()).'/../'.$url;
+        }
+        // Replace all ..s
+        while (true) {
+            $newurl = preg_replace('|/(?!\.\.)[^/]*/\.\./|', '/', $url);
+            if ($newurl == $url) {
+                break;
+            }
+            $url = $newurl;
+        }
+    }
+
+    // Sanitise url - we can not rely on our URL cleaning
+    // because it does not support all valid external URLs
+    $url = preg_replace('/[\x00-\x1F\x7F]/', '', $url);
+    $url = str_replace('"', '%22', $url);
    $encodedurl = preg_replace("/\&(?![a-zA-Z0-9#]{1,8};)/", "&amp;", $url);
-    $encodedurl = preg_replace('/^.*href="([^"]*)".*$/', "\\1", clean_text('<a href="'.$encodedurl.'" />'));
+    $encodedurl = preg_replace('/^.*href="([^"]*)".*$/', "\\1", clean_text('<a href="'.$encodedurl.'" />', FORMAT_HTML));
    $url = str_replace('&amp;', '&', $encodedurl);

 /// At developer debug level. Don't redirect if errors have been printed on screen.
@@ -6210,31 +6253,6 @@ function redirect($url, $message='', $delay=-1) {

 /// when no message and header printed yet, try to redirect
    if (empty($message) and !defined('HEADER_PRINTED')) {
-
-        // Technically, HTTP/1.1 requires Location: header to contain
-        // the absolute path. (In practice browsers accept relative
-        // paths - but still, might as well do it properly.)
-        // This code turns relative into absolute.
-        if (!preg_match('|^[a-z]+:|', $url)) {
-            // Get host name http://www.wherever.com
-            $hostpart = preg_replace('|^(.*?[^:/])/.*$|', '$1', $CFG->wwwroot);
-            if (preg_match('|^/|', $url)) {
-                // URLs beginning with / are relative to web server root so we just add them in
-                $url = $hostpart.$url;
-            } else {
-                // URLs not beginning with / are relative to path of current script, so add that on.
-                $url = $hostpart.preg_replace('|\?.*$|','',me()).'/../'.$url;
-            }
-            // Replace all ..s
-            while (true) {
-                $newurl = preg_replace('|/(?!\.\.)[^/]*/\.\./|', '/', $url);
-                if ($newurl == $url) {
-                    break;
-                }
-                $url = $newurl;
-            }
-        }
-
        $delay = 0;
        //try header redirection first
        @header($_SERVER['SERVER_PROTOCOL'] . ' 303 See Other'); //302 might not work for POST requests, 303 is ignored by obsolete clients
@@ -6949,18 +6967,16 @@ function page_doc_link($text='', $iconpath='') {
 function doc_link($path='', $text='', $iconpath='') {
    global $CFG;

-    if (empty($CFG->docroot)) {
-        return '';
-    }
-
    $target = '';
    if (!empty($CFG->doctonewwindow)) {
        $target = ' target="_blank"';
    }

-    $lang = str_replace('_utf8', '', current_language());
+    if (is_null($docroot = get_doc_root())) {
+        return '';
+    }

-    $str = '<a href="' .$CFG->docroot. '/' .$lang. '/' .$path. '"' .$target. '>';
+    $str = '<a href="' .$docroot. '/' .$path. '"' .$target. '>';

    if (empty($iconpath)) {
        $iconpath = $CFG->httpswwwroot . '/pix/docs.gif';
@@ -6972,6 +6988,32 @@ function doc_link($path='', $text='', $iconpath='') {
    return $str;
 }

+/**
+ * A function that checks if docroot is set, builds and returns the docs root url according to version release.
+ * @return string documentation url, null if doc root isn't set (ie:during installation perhaps).
+ */
+function get_doc_root() {
+    global $CFG;
+
+    if (empty($CFG->docroot)) {
+        return null;
+    }
+
+    $lang = str_replace('_utf8', '', current_language());
+    if (!empty($CFG->release)) {
+        $release = $CFG->release;
+    } else {
+        //derive branch from the first three letters of version.php's $release with the period taken out.($CFG->release isn't populated yet during upgrade)
+        include($CFG->dirroot.'/version.php');
+    }
+    if (preg_match('/^(.)\.(.)/', $release, $matches)) {
+        $branch = $matches[1].$matches[2];
+    } else {
+        $branch = '.';
+    }
+
+    return $CFG->docroot. '/' .$branch. '/' .$lang;
+}

 /**
 * Returns true if the current site debugging settings are equal or above specified level.
@@ -909,7 +909,7 @@ class XMLDBgenerator {
            return $used_names[$tablename.'-'.$fields.'-'.$suffix];
        }

-    /// Use standard naming. See http://docs.moodle.org/en/XMLDB_key_and_index_naming
+    /// Use standard naming. See http://docs.moodle.org/19/en/XMLDB_key_and_index_naming
        $tablearr = explode ('_', $tablename);
        foreach ($tablearr as $table) {
            $name .= substr(trim($table),0,4);
@@ -4,6 +4,7 @@
    require_once('change_password_form.php');

    $id = optional_param('id', SITEID, PARAM_INT); // current course
+    $return = optional_param('return', 0, PARAM_BOOL); // redirect after password change

    $strparticipants = get_string('participants');

@@ -12,6 +13,19 @@

    $systemcontext = get_context_instance(CONTEXT_SYSTEM);

+    if ($return) {
+        // this redirect prevents security warning because https can not POST to http pages
+        if (empty($SESSION->wantsurl)
+                or stripos(str_replace('https://', 'http://', $SESSION->wantsurl), str_replace('https://', 'http://', $CFG->wwwroot.'/login/change_password.php') === 0)) {
+            $returnto = "$CFG->wwwroot/user/view.php?id=$USER->id&course=$id";
+        } else {
+            $returnto = $SESSION->wantsurl;
+        }
+        unset($SESSION->wantsurl);
+
+        redirect($returnto);
+    }
+
    if (!$course = get_record('course', 'id', $id)) {
        error('No such course!');
    }
@@ -19,7 +33,7 @@
    // require proper login; guest user can not change password
    if (empty($USER->id) or isguestuser()) {
        if (empty($SESSION->wantsurl)) {
-            $SESSION->wantsurl = $CFG->httpswwwroot.'/login/change_password.php';
+            $SESSION->wantsurl = $CFG->httpswwwroot.'/login/change_password.php?id=' . $id;
        }
        redirect($CFG->httpswwwroot.'/login/index.php');
    }
@@ -54,7 +68,7 @@
        redirect($changeurl);
    }

-    $mform = new login_change_password_form();
+    $mform = new login_change_password_form($CFG->httpswwwroot . '/login/change_password.php');
    $mform->set_data(array('id'=>$course->id));

    $navlinks = array();
@@ -35,7 +35,7 @@ if ($show_instructions) {
            <div class="clearer"><!-- --></div>
            <div class="form-label"><label for="password"><?php print_string("password") ?></label></div>
            <div class="form-input">
-              <input type="password" name="password" id="password" size="15" value="" />
+              <input type="password" name="password" id="password" size="15" value="" <?php if (!empty($CFG->loginpasswordautocomplete)) {echo 'autocomplete="off"';} ?> />
              <input type="submit" value="<?php print_string("login") ?>" />
              <input type="hidden" name="testcookies" value="1" />
            </div>
@@ -26,7 +26,7 @@
    //HTTPS is potentially required in this page
    httpsrequired();

-    $mform_signup = new login_signup_form();
+    $mform_signup = new login_signup_form(null, null, 'post', '', array('autocomplete'=>'on'));

    if ($mform_signup->is_cancelled()) {
        redirect($CFG->httpswwwroot.'/login/index.php');
@@ -996,7 +996,7 @@ function message_post_message($userfrom, $userto, $message, $format, $messagetyp
                $messagehtml = NULL;
            }

-            if (!empty($preference->message_emailaddress)) {
+            if (!empty($preference->message_emailaddress) and validate_email($preference->message_emailaddress)) {
                $userto->email = $preference->message_emailaddress;   // Use custom messaging address
            }

@@ -19,6 +19,12 @@
    $userfullname = strip_tags(required_param('name', PARAM_RAW));
    $wait         = optional_param('wait', MESSAGE_DEFAULT_REFRESH, PARAM_INT);

+    if ($wait < 1) {
+        //this should not happen unless someone is manually constructing URLs
+        //allowing a wait of 0 causes continuous GET requests
+        $wait = MESSAGE_DEFAULT_REFRESH;
+    }
+
    $stylesheetshtml = '';
    foreach ($CFG->stylesheets as $stylesheet) {
        $stylesheetshtml .= '<link rel="stylesheet" type="text/css" href="'.$stylesheet.'" />';
@@ -412,10 +412,10 @@ function ip_in_range($address, $network, $mask) {
   $lnetwork  = ip2long($network);
   $laddress  = ip2long($address);

-   $binnet    = str_pad( decbin($lnetwork),32,"0","STR_PAD_LEFT" );
+   $binnet    = str_pad( decbin($lnetwork), 32, "0", STR_PAD_LEFT );
   $firstpart = substr($binnet,0,$mask);

-   $binip     = str_pad( decbin($laddress),32,"0","STR_PAD_LEFT" );
+   $binip     = str_pad( decbin($laddress), 32, "0", STR_PAD_LEFT );
   $firstip   = substr($binip,0,$mask);
   return(strcmp($firstpart,$firstip)==0);
 }
@@ -335,8 +335,8 @@ class mnet_xmlrpc_client {

        // ok, it's signed, but is it signed with the right certificate ?
        // do this *after* we check for an out of date key
-        if (!openssl_verify($this->xmlrpcresponse, base64_decode($sig_parser->signature), 
-                $mnet_peer->public_key)) {
+        $verified = openssl_verify($this->xmlrpcresponse, base64_decode($sig_parser->signature), $mnet_peer->public_key);
+        if ($verified != 1) {
            $this->error[] = 'Invalid signature';
        }

@@ -44,11 +44,22 @@
    function assignment_backup_one_mod($bf,$preferences,$assignment) {
        
        global $CFG;
-    
+
+        if ($assignment === 0) { //no active instances of assignment to be backed up - skip backup
+            return false;
+        }
+
        if (is_numeric($assignment)) {
            $assignment = get_record('assignment','id',$assignment);
        }
-    
+
+        if (empty($assignment->assignmenttype)) {
+            // No assignment type will cause fatal error below in require_once so bail out now
+            // Probably ended up here by restoring a course into
+            // a moodle without this assignmenttype
+            return false;
+        }
+
        $status = true;

        //Start mod
@@ -839,7 +839,9 @@ class assignment_base {
            $select = 'SELECT u.id, u.firstname, u.lastname, u.picture, u.imagealt,
                              s.id AS submissionid, s.grade, s.submissioncomment,
                              s.timemodified, s.timemarked,
-                              COALESCE(SIGN(SIGN(s.timemarked) + SIGN(s.timemarked - s.timemodified)), 0) AS status ';
+                              CASE WHEN s.timemarked > 0 AND s.timemarked >= s.timemodified THEN 1
+                                   ELSE 0 END AS status ';
+
            $sql = 'FROM '.$CFG->prefix.'user u '.
                   'LEFT JOIN '.$CFG->prefix.'assignment_submissions s ON u.id = s.userid
                                                                      AND s.assignment = '.$this->assignment->id.' '.
@@ -851,8 +853,6 @@ class assignment_base {

            if (($auser = get_records_sql($select.$sql.$sort, $offset+1, 1)) !== false) {
                $nextuser = array_shift($auser);
-            /// Calculate user status
-                $nextuser->status = ($nextuser->timemarked > 0) && ($nextuser->timemarked >= $nextuser->timemodified);
                $nextid = $nextuser->id;
            }
        }
@@ -1168,7 +1168,9 @@ class assignment_base {
        $select = 'SELECT u.id, u.firstname, u.lastname, u.picture, u.imagealt,
                          s.id AS submissionid, s.grade, s.submissioncomment,
                          s.timemodified, s.timemarked,
-                          COALESCE(SIGN(SIGN(s.timemarked) + SIGN(s.timemarked - s.timemodified)), 0) AS status ';
+                          CASE WHEN s.timemarked > 0 AND s.timemarked >= s.timemodified THEN 1
+                               ELSE 0 END AS status ';
+
        $sql = 'FROM '.$CFG->prefix.'user u '.
               'LEFT JOIN '.$CFG->prefix.'assignment_submissions s ON u.id = s.userid
                                                                  AND s.assignment = '.$this->assignment->id.' '.
@@ -1194,8 +1196,6 @@ class assignment_base {
                    $locked_overridden = 'overridden';
                }

-            /// Calculate user status
-                $auser->status = ($auser->timemarked > 0) && ($auser->timemarked >= $auser->timemodified);
                $picture = print_user_picture($auser, $course->id, $auser->picture, false, true);

                if (empty($auser->submissionid)) {
--- a/Show More
+++ b/Show More