Moodle release 1.9.17

This reverts commit f8adbd6a02.

README.txt

@@ -24,7 +24,7 @@ a few minutes:
 
 For more information, see the INSTALL DOCUMENTATION:
 
-   http://docs.moodle.org/en/Installing_Moodle 
+   http://docs.moodle.org/19/en/Installing_Moodle
 
 A local copy can also be found in 
 

admin/cron.php

@@ -241,10 +241,13 @@
 
         if ($CFG->longtimenosee) { // value in days
             $cuttime = $timenow - ($CFG->longtimenosee * 3600 * 24);
-            $rs = get_recordset_sql ("SELECT id, userid, courseid
-                                        FROM {$CFG->prefix}user_lastaccess
-                                       WHERE courseid != ".SITEID."
-                                         AND timeaccess < $cuttime ");
+            $rs = get_recordset_sql ("SELECT la.id, la.userid, la.courseid
+                                        FROM {$CFG->prefix}user_lastaccess la
+                                        JOIN {$CFG->prefix}course c
+                                          ON c.id = la.courseid
+                                       WHERE la.courseid != ".SITEID."
+                                         AND la.timeaccess < $cuttime
+                                         AND c.metacourse = 0 ");
             while ($assign = rs_fetch_next_record($rs)) {
                 if ($context = get_context_instance(CONTEXT_COURSE, $assign->courseid)) {
                     if (role_unassign(0, $assign->userid, 0, $context->id)) {
@@ -348,25 +351,24 @@
         mtrace('checking for create_password');
         if (count_records('user_preferences', 'name', 'create_password', 'value', '1')) {
             mtrace('creating passwords for new users');
-            $newusers = get_records_sql("SELECT  u.id as id, u.email, u.firstname, 
-                                                u.lastname, u.username,
-                                                p.id as prefid 
-                                        FROM {$CFG->prefix}user u 
-                                             JOIN {$CFG->prefix}user_preferences p ON u.id=p.userid
-                                        WHERE p.name='create_password' AND p.value='1' AND u.email !='' ");
-
-            foreach ($newusers as $newuserid => $newuser) {
-                $newuser->emailstop = 0; // send email regardless
-                // email user                               
-                if (setnew_password_and_mail($newuser)) {
-                    // remove user pref
-                    delete_records('user_preferences', 'id', $newuser->prefid);
-                } else {
-                    trigger_error("Could not create and mail new user password!");
+            $newuserssql = "SELECT u.id as id, u.email, u.firstname, u.lastname, u.username, p.id as prefid
+                              FROM {$CFG->prefix}user u
+                              JOIN {$CFG->prefix}user_preferences p ON u.id=p.userid
+                             WHERE p.name='create_password' AND p.value='1' AND u.email !='' ";
+            if ($newusers = get_records_sql($newuserssql)) {
+                foreach ($newusers as $newuserid => $newuser) {
+                    $newuser->emailstop = 0; // send email regardless
+                    // email user
+                    if (setnew_password_and_mail($newuser)) {
+                        // remove user pref
+                        delete_records('user_preferences', 'id', $newuser->prefid);
+                    } else {
+                        trigger_error("Could not create and mail new user password!");
+                    }
                 }
             }
         }
-        
+
         if (!empty($CFG->usetags)) {
             require_once($CFG->dirroot.'/tag/lib.php');
             tag_cron();

admin/environment.xml

@@ -442,4 +442,232 @@
       </PHP_SETTING>
     </PHP_SETTINGS>
   </MOODLE>
+  <MOODLE version="2.2" requires="1.9">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mysql" version="5.0.25">
+        <FEEDBACK>
+          <ON_ERROR message="mysql416required" />
+        </FEEDBACK>
+      </VENDOR>
+      <VENDOR name="postgres" version="8.3" />
+      <VENDOR name="mssql" version="9.0" />
+      <VENDOR name="odbc_mssql" version="9.0" />
+      <VENDOR name="mssql_n" version="9.0" />
+      <VENDOR name="oracle" version="10.2" />
+      <VENDOR name="sqlite" version="2.0" />
+    </DATABASE>
+    <PHP version="5.3.2" level="required">
+    </PHP>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opensslrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="gdrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="intlrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="40M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="safe_mode" value="0" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingsafemode" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+  </MOODLE>
+  <MOODLE version="2.3" requires="2.2">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mysql" version="5.0.25">
+        <FEEDBACK>
+          <ON_ERROR message="mysql416required" />
+        </FEEDBACK>
+      </VENDOR>
+      <VENDOR name="postgres" version="8.3" />
+      <VENDOR name="mssql" version="9.0" />
+      <VENDOR name="odbc_mssql" version="9.0" />
+      <VENDOR name="mssql_n" version="9.0" />
+      <VENDOR name="oracle" version="10.2" />
+      <VENDOR name="sqlite" version="2.0" />
+    </DATABASE>
+    <PHP version="5.3.2" level="required">
+    </PHP>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opensslrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="gdrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="intlrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="40M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="safe_mode" value="0" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingsafemode" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+  </MOODLE>
 </COMPATIBILITY_MATRIX>

admin/index.php

@@ -47,7 +47,7 @@
 
 /// Check some PHP server settings
 
-    $documentationlink = '<a href="http://docs.moodle.org/en/Installation">Installation docs</a>';
+    $documentationlink = '<a href="http://docs.moodle.org/19/en/Installation">Installation docs</a>';
 
     if (ini_get_bool('session.auto_start')) {
         error("The PHP server variable 'session.auto_start' should be Off - $documentationlink");
@@ -143,7 +143,7 @@
             print_box(text_to_html(get_string('gpl')), 'copyrightnotice');
             echo "<br />";
             notice_yesno(get_string('doyouagree'), "index.php?agreelicense=1",
-                                                   "http://docs.moodle.org/en/License");
+                                                   "http://docs.moodle.org/dev/License");
             print_footer('none');
             exit;
         }
@@ -152,7 +152,7 @@
             $navigation = build_navigation(array(array('name'=>$strcurrentrelease, 'link'=>null, 'type'=>'misc')));
             print_header($strcurrentrelease, $strcurrentrelease, $navigation, "", "", false, "&nbsp;", "&nbsp;");
             print_heading("Moodle $release");
-            print_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/en/Release_Notes'), 'generalbox boxaligncenter boxwidthwide');
+            print_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/19/en/Release_Notes'), 'generalbox boxaligncenter boxwidthwide');
             echo '<form action="index.php"><div>';
             echo '<input type="hidden" name="agreelicense" value="1" />';
             echo '<input type="hidden" name="confirmrelease" value="1" />';
@@ -286,7 +286,7 @@
                 $navigation = build_navigation(array(array('name'=>$strcurrentrelease, 'link'=>null, 'type'=>'misc')));
                 print_header($strcurrentrelease, $strcurrentrelease, $navigation, "", "", false, "&nbsp;", "&nbsp;");
                 print_heading("Moodle $release");
-                print_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/en/Release_Notes'));
+                print_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/19/en/Release_Notes'));
 
                 require_once($CFG->libdir.'/environmentlib.php');
                 print_heading(get_string('environment', 'admin'));
@@ -687,10 +687,10 @@
     //////////////////////////////////////////////////////////////////////////////////////////////////
     ////  IT IS ILLEGAL AND A VIOLATION OF THE GPL TO HIDE, REMOVE OR MODIFY THIS COPYRIGHT NOTICE ///
     $copyrighttext = '<a href="http://moodle.org/">Moodle</a> '.
-                     '<a href="http://docs.moodle.org/en/Release" title="'.$CFG->version.'">'.$CFG->release.'</a><br />'.
+                     '<a href="http://docs.moodle.org/dev/Releases" title="'.$CFG->version.'">'.$CFG->release.'</a><br />'.
                      'Copyright &copy; 1999 onwards, Martin Dougiamas<br />'.
-                     'and <a href="http://docs.moodle.org/en/Credits">many other contributors</a>.<br />'.
-                     '<a href="http://docs.moodle.org/en/License">GNU Public License</a>';
+                     'and <a href="http://docs.moodle.org/dev/Credits">many other contributors</a>.<br />'.
+                     '<a href="http://docs.moodle.org/dev/License">GNU Public License</a>';
     print_box($copyrighttext, 'copyright');
     //////////////////////////////////////////////////////////////////////////////////////////////////
 

admin/report/courseoverview/index.php

@@ -75,12 +75,12 @@
                 .$param->extras
                 ." ORDER BY ".$param->orderby;
         }
-        error_log($sql);
 
         $courses = get_records_sql($sql, 0, $numcourses);
 
         if (empty($courses)) {
-            notify(get_string('statsnodata'));echo '</td></tr></table>';echo '<p>after notify</p>';
+            notify(get_string('statsnodata'));
+            echo '</td></tr></table>';
 
         } else {
             if (empty($CFG->gdversion)) {

admin/roles/assign.php

@@ -72,7 +72,7 @@
     $straction = get_string('assignroles', 'role');
     $strroletoassign = get_string('roletoassign', 'role');
     $strsearch = get_string('search');
-    $strshowall = get_string('showall');
+    $strshowall = get_string('showallusers');
     $strparticipants = get_string('participants');
     $strsearchresults = get_string('searchresults');
 

admin/settings/security.php

@@ -8,6 +8,7 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
     $temp->add(new admin_setting_configcheckbox('protectusernames', get_string('protectusernames', 'admin'), get_string('configprotectusernames', 'admin'), 1));
     $temp->add(new admin_setting_configcheckbox('forcelogin', get_string('forcelogin', 'admin'), get_string('configforcelogin', 'admin'), 0));
     $temp->add(new admin_setting_configcheckbox('forceloginforprofiles', get_string('forceloginforprofiles', 'admin'), get_string('configforceloginforprofiles', 'admin'), 1));
+    $temp->add(new admin_setting_configcheckbox('forceloginforprofileimage', get_string('forceloginforprofileimage', 'admin'), get_string('forceloginforprofileimage_help', 'admin'), 0));
     $temp->add(new admin_setting_configcheckbox('opentogoogle', get_string('opentogoogle', 'admin'), get_string('configopentogoogle', 'admin'), 0));
 
     $max_upload_choices = get_max_upload_sizes();
@@ -67,6 +68,7 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
     $temp->add(new admin_setting_configcheckbox('cookiehttponly', get_string('cookiehttponly', 'admin'), get_string('configcookiehttponly', 'admin'), 0));
     $temp->add(new admin_setting_configcheckbox('regenloginsession', get_string('regenloginsession', 'admin'), get_string('configregenloginsession', 'admin'), 1));
     $temp->add(new admin_setting_configtext('excludeoldflashclients', get_string('excludeoldflashclients', 'admin'), get_string('configexcludeoldflashclients', 'admin'), '10.0.12', PARAM_TEXT));
+    $temp->add(new admin_setting_configcheckbox('loginpasswordautocomplete', get_string('loginpasswordautocomplete', 'admin'), get_string('loginpasswordautocomplete_help', 'admin'), 0));
     $ADMIN->add('security', $temp);
 
 

admin/uploaduser.php

@@ -558,7 +558,7 @@ if ($formdata = $mform->is_cancelled()) {
                 continue;
             }
             // save custom profile fields data
-            profile_save_data($user);
+            profile_save_data(addslashes_recursive($user));
 
             // make sure user context exists
             get_context_instance(CONTEXT_USER, $user->id);
@@ -665,7 +665,7 @@ if ($formdata = $mform->is_cancelled()) {
                     $newgroupdata = new object();
                     $newgroupdata->name = $addgroup;
                     $newgroupdata->courseid = $ccache[$shortname]->id;
-                    if ($ccache[$shortname]->groups[$addgroup]->id = groups_create_group($newgroupdata)){
+                    if ($ccache[$shortname]->groups[$addgroup]->id = groups_create_group(addslashes_recursive($newgroupdata))){
                         $ccache[$shortname]->groups[$addgroup]->name = $newgroupdata->name;
                     } else {
                         $upt->track('enrolments', get_string('unknowngroup', 'error', $addgroup), 'error');

admin/xmldb/README.txt

@@ -2,7 +2,7 @@ XMLDB - Base classes and edition interface.
 
 Complete Documentation:
 
-  http://docs.moodle.org/en/XMLDB_Defining_one_XML_structure
+  http://docs.moodle.org/19/en/XMLDB_Defining_one_XML_structure
 
 Ciao, Eloy Lafuente (stronk7)
 
@@ -70,7 +70,7 @@ Once the XMLDB format was approved, we'll be able to build all the
 for each RDBMS flavour.
 
 Once the interface was finished (2-3 days from now) related documentation
-will be sent to http://docs.moodle.org/en/XML_database_schema in order
+will be sent to http://docs.moodle.org/19/en/XML_database_schema in order
 to comment/modify/approve the final XML format.
 
 All the code is, obviously GPL, with its copyrights and so on...

admin/xmldb/actions/view_reserved_words/view_reserved_words.class.php

@@ -25,8 +25,8 @@
 ///////////////////////////////////////////////////////////////////////////
 
 /// This class will show all the reserved words in a format suitable to
-/// be pasted to: http://docs.moodle.org/en/XMLDB_reserved_words and
-/// http://docs.moodle.org/en/Database_reserved_words
+/// be pasted to: http://docs.moodle.org/19/en/XMLDB_reserved_words and
+/// http://docs.moodle.org/19/en/Database_reserved_words
 /// Also, it introspects te DB looking for such words and informing about
 
 class view_reserved_words extends XMLDBAction {

auth/cas/auth.php

@@ -675,7 +675,7 @@ if ( !is_object($PHPCAS_CLIENT) ) {
                 $droptablesql[] = 'DROP TEMPORARY TABLE ' . $temptable; // sql command to drop the table (because session scope could be a problem)
                 execute_sql_arr($droptablesql, true, false); /// Drop temp table to avoid persistence problems later
                 echo "Creating temp table $temptable\n";
-                execute_sql('CREATE TEMPORARY TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username)) TYPE=MyISAM', false);
+                execute_sql('CREATE TEMPORARY TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username)) ENGINE=MyISAM', false);
                 break;
             case 'postgres':
                 $temptable = $CFG->prefix . 'extuser';

auth/ldap/auth.php

@@ -563,7 +563,7 @@ class auth_plugin_ldap extends auth_plugin_base {
         switch (strtolower($CFG->dbfamily)) {
             case 'mysql':
                 $droptablesql[] = 'DROP TEMPORARY TABLE ' . $temptable; // sql command to drop the table (because session scope could be a problem)
-                $createtemptablesql = 'CREATE TEMPORARY TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username)) TYPE=MyISAM';
+                $createtemptablesql = 'CREATE TEMPORARY TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username)) ENGINE=MyISAM';
                 break;
             case 'postgres':
                 $droptablesql[] = 'DROP TABLE ' . $temptable; // sql command to drop the table (because session scope could be a problem)

auth/mnet/auth.php

@@ -170,6 +170,10 @@ class auth_plugin_mnet extends auth_plugin_base {
         global $MNET;
         require_once $CFG->dirroot . '/mnet/xmlrpc/client.php';
 
+        if (!empty($USER->realuser)) {
+            print_error('notpermittedtojumpas', 'mnet');
+        }
+
         // check remote login permissions
         if (! has_capability('moodle/site:mnetlogintoremote', get_context_instance(CONTEXT_SYSTEM))
                 or is_mnet_remote_user($USER)
@@ -306,6 +310,7 @@ class auth_plugin_mnet extends auth_plugin_base {
             }
             $remoteuser->mnethostid = $remotehost->id;
             $remoteuser->firstaccess = time(); // First time user in this server, grab it here
+            $remoteuser->confirmed = 1;
 
             if (!$remoteuser->id =  insert_record('user', addslashes_recursive($remoteuser))) {
                 print_error('databaseerror', 'mnet');

auth/shibboleth/auth.php

@@ -193,18 +193,13 @@ class auth_plugin_shibboleth extends auth_plugin_base {
      *
      */
     function logoutpage_hook() {
-        global $redirect;
+        global $SESSION, $redirect;
         
-        // Only do this if logout handler is defined
-        if (
-              isset($this->config->logout_handler) 
-              && !empty($this->config->logout_handler)
-           ){
+        // Only do this if logout handler is defined, and if the user is actually logged in via Shibboleth
+        $logouthandlervalid = isset($this->config->logout_handler) && !empty($this->config->logout_handler);
+        if (  isset($SESSION->shibboleth_session_id) && $logouthandlervalid ) {
             // Check if there is an alternative logout return url defined
-            if (
-                  isset($this->config->logout_return_url) 
-                  && !empty($this->config->logout_return_url)
-               ){
+            if (isset($this->config->logout_return_url) && !empty($this->config->logout_return_url)) {
                 // Set temp_redirect to alternative return url
                 $temp_redirect = $this->config->logout_return_url;
             } else {

backup/backup_scheduled.php

@@ -100,15 +100,22 @@ function schedule_backup_cron() {
                     $status = false;
                     continue;
                 }
+                // Skip courses that do not yet need backup
+                $skipped = !($backup_course->nextstarttime > 0 && $backup_course->nextstarttime < $now);
                 // Skip backup of unavailable courses that have remained unmodified in a month
-                $skipped = false;
-                if (!$course->visible && ($now - $course->timemodified) > 31*24*60*60) {  //Hidden + unmodified last month
-                    mtrace("            SKIPPING - hidden+unmodified");
-                    set_field("backup_courses","laststatus","3","courseid",$backup_course->courseid);
-                    $skipped = true;
+                if (!$skipped && !$course->visible && ($now - $course->timemodified) > 31*24*60*60) {  //Hidden + settings were unmodified last month
+                    //Check log if there were any modifications to the course content
+                    $sql = 'SELECT l.id FROM '.$CFG->prefix .'log l WHERE '.
+                            'l.course='. $course->id. ' AND l.time>'. ($now-31*24*60*60). " AND lower(l.action) not like '%view%'";
+                    $logexists = record_exists_sql($sql);
+                    if (!$logexists) {
+                        mtrace("            SKIPPING - hidden+unmodified");
+                        set_field("backup_courses", "laststatus", "3", "courseid", $backup_course->courseid);
+                        $skipped = true;
+                    }
                 }
-                //Now we backup every non skipped course with nextstarttime < now
-                if (!$skipped  && $backup_course->nextstarttime > 0 && $backup_course->nextstarttime < $now) {
+                //Now we backup every non-skipped course
+                if (!$skipped) {
                     //We have to send a email because we have included at least one backup
                     $emailpending = true;
                     //Only make the backup if laststatus isn't 2-UNFINISHED (uncontrolled error)

backup/db/mysql.php

@@ -66,7 +66,7 @@ function backup_upgrade($oldversion=0) {
                       `value` varchar(255) NOT NULL default '',
                       PRIMARY KEY  (`id`),
                       UNIQUE KEY `name` (`name`)
-                  ) TYPE=MyISAM COMMENT='To store backup configuration variables'");
+                  ) ENGINE=MyISAM COMMENT='To store backup configuration variables'");
     }
 
     if ($oldversion < 2003120800 and $result) {
@@ -79,7 +79,7 @@ function backup_upgrade($oldversion=0) {
                       `nextstarttime` int(10) unsigned NOT NULL default '0',
                       PRIMARY KEY  (`id`),
                       UNIQUE KEY `courseid` (`courseid`)
-                  ) TYPE=MyISAM COMMENT='To store every course backup status'");
+                  ) ENGINE=MyISAM COMMENT='To store every course backup status'");
 
         if ($result) {
             $result = execute_sql("CREATE TABLE `{$CFG->prefix}backup_log` (    
@@ -89,7 +89,7 @@ function backup_upgrade($oldversion=0) {
                           `laststarttime` int(10) unsigned NOT NULL default '0',
                           `info` varchar(255) NOT NULL default '',
                           PRIMARY KEY  (`id`)
-                      ) TYPE=MyISAM COMMENT='To store every course backup log info'");
+                      ) ENGINE=MyISAM COMMENT='To store every course backup log info'");
         }
     }
 
@@ -105,7 +105,7 @@ function backup_upgrade($oldversion=0) {
                           `new_id` int(10) unsigned NOT NULL default '0',
                           PRIMARY KEY  (`id`),
                           UNIQUE KEY `{$CFG->prefix}backup_files_uk` (`backup_code`,`file_type`,`path`)
-                      ) TYPE=MyISAM COMMENT='To store and recode ids to user and course files.'");
+                      ) ENGINE=MyISAM COMMENT='To store and recode ids to user and course files.'");
         }
         if ($result) {
             $result = execute_sql("DROP TABLE {$CFG->prefix}backup_ids");
@@ -120,7 +120,7 @@ function backup_upgrade($oldversion=0) {
                           `info` mediumtext,
                           PRIMARY KEY  (`id`),
                           UNIQUE KEY `{$CFG->prefix}backup_ids_uk` (`backup_code` ,`table_name`,`old_id`)
-                      ) TYPE=MyISAM COMMENT='To store and convert ids in backup/restore'");
+                      ) ENGINE=MyISAM COMMENT='To store and convert ids in backup/restore'");
         }
     }
 

backup/restorelib.php

@@ -209,10 +209,29 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
 
         // Links to course
         $searchstring = '/\$@(COURSEVIEWBYID)\*([0-9]+)@\$/';
-        $replacestring= $CFG->wwwroot . '/course/view.php?id=' . $restore->course_id;
-        $result = preg_replace($searchstring, $replacestring, $content);
+        // We look for it
+        preg_match_all($searchstring, $content, $foundset);
+        // If found, then we are going to look for its new id (in backup tables)
+        if ($foundset[0]) {
+            // Iterate over foundset[2]. They are the old_ids
+            foreach ($foundset[2] as $old_id) {
+                // We get the needed variables here (course id)
+                $rec = backup_getid($restore->backup_unique_code, 'course', $old_id);
+                // Personalize the searchstring
+                $searchstring = '/\$@(COURSEVIEWBYID)\*('.$old_id.')@\$/';
+                // If it is a link to itself, replace it
+                if (!empty($rec->new_id)) {
+                    $replacestring = $CFG->wwwroot . '/course/view.php?id=' . $rec->new_id;
+                // It s a link to another course, keep it unmodified
+                } else {
+                    $replacestring = $restore->original_wwwroot . '/course/view.php?id=' . $old_id;
+                }
+                // Perform the replacement
+                $content = preg_replace($searchstring, $replacestring, $content);
+            }
+        }
 
-        return $result;
+        return $content;
     }
 
     //This function is called from all xxxx_decode_content_links_caller(),

blocks/db/mysql.php

@@ -142,7 +142,7 @@ global $CFG;
            `visible` tinyint(1) not null default '0',
            `configdata` text not null default '',
            PRIMARY KEY(`id`)
-          ) TYPE=MyISAM;");
+          ) ENGINE=MyISAM;");
     }
     
     if ($oldversion < 2005090200) {

blocks/login/block_login.php

@@ -49,7 +49,12 @@ class block_login extends block_base {
             $this->content->text .= '<input type="text" name="username" id="login_username" value="'.s($username).'" /></div>';
 
             $this->content->text .= '<div class="c1 fld password"><label for="login_password">'.get_string('password').'</label>';
-            $this->content->text .= '<input type="password" name="password" id="login_password" value="" /></div>';
+
+            if (!empty($CFG->loginpasswordautocomplete)) {
+                $this->content->text .= '<input type="password" name="password" id="login_password" value="" autocomplete="off" /></div>';
+            } else {
+                $this->content->text .= '<input type="password" name="password" id="login_password" value="" /></div>';
+            }
 
             $this->content->text .= '<div class="c1 btn"><input type="submit" value="'.get_string('login').'" /></div>';
 

blocks/mnet_hosts/block_mnet_hosts.php

@@ -32,6 +32,14 @@ class block_mnet_hosts extends block_list {
             return '';
         }
 
+        if (!empty($USER->realuser)) {
+            $this->content = new stdClass();
+            $this->content->items = array();
+            $this->content->icons = array();
+            $this->content->footer = get_string('notpermittedtojumpas', 'mnet');
+            return $this->content;
+        }
+
         // check for outgoing roaming permission first
         if (!has_capability('moodle/site:mnetlogintoremote', get_context_instance(CONTEXT_SYSTEM), NULL, false)) {
             return '';

calendar/event.php

@@ -49,9 +49,9 @@
     $eventid = optional_param('id', 0, PARAM_INT);
     $eventtype = optional_param('type', 'select', PARAM_ALPHA);
     $urlcourse = optional_param('course', 0, PARAM_INT);
-    $cal_y = optional_param('cal_y');
-    $cal_m = optional_param('cal_m');
-    $cal_d = optional_param('cal_d');
+    $cal_y = optional_param('cal_y', 0, PARAM_INT);
+    $cal_m = optional_param('cal_m', 0, PARAM_INT);
+    $cal_d = optional_param('cal_d', 0, PARAM_INT);
 
     if(isguest()) {
         // Guests cannot do anything with events

calendar/set.php

@@ -41,15 +41,14 @@
     require_once('../config.php');
     require_once($CFG->dirroot.'/calendar/lib.php');
 
-    $from = required_param('from');
-    $var = required_param('var');
-    $value = optional_param('value');
-    $id = optional_param('id');
-    $cal_d = optional_param('cal_d');
-    $cal_m = optional_param('cal_m');
-    $cal_y = optional_param('cal_y');
-    $action = optional_param('action');
-    $type = optional_param('type');
+    $from = required_param('from', PARAM_ALPHA);
+    $var = required_param('var', PARAM_ALPHA);
+    $id = optional_param('id', 0, PARAM_INT);
+    $cal_d = optional_param('cal_d', 0, PARAM_INT);
+    $cal_m = optional_param('cal_m', 0, PARAM_INT);
+    $cal_y = optional_param('cal_y', 0, PARAM_INT);
+    $action = optional_param('action', '', PARAM_ALPHA);
+    $type = optional_param('type', '', PARAM_ALPHA);
 
     // Initialize the session variables
     calendar_session_vars();
@@ -107,7 +106,7 @@
 
     switch($from) {
         case 'event':
-            redirect(CALENDAR_URL.'event.php?action='.$action.'&type='.$type.'&id='.intval($id));
+            redirect(CALENDAR_URL.'event.php?action='.$action.'&type='.$type.'&id='.$id);
         break;
         case 'month':
             redirect(CALENDAR_URL.'view.php?view=month'.$courseid.'&cal_d='.$cal_d.'&cal_m='.$cal_m.'&cal_y='.$cal_y);
@@ -119,7 +118,7 @@
             redirect(CALENDAR_URL.'view.php?view=day'.$courseid.'&cal_d='.$cal_d.'&cal_m='.$cal_m.'&cal_y='.$cal_y);
         break;
         case 'course':
-            redirect($CFG->wwwroot.'/course/view.php?id='.intval($id));
+            redirect($CFG->wwwroot.'/course/view.php?id='.$id);
         break;
         default:
 

calendar/view.php

@@ -426,7 +426,7 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course
     }
 
     // Now display all the calendar
-    for($day = 1; $day <= $display->maxdays; ++$day, ++$dayweek) {
+    for($aday = 1; $aday <= $display->maxdays; ++$aday, ++$dayweek) {
         if($dayweek > $display->maxwday) {
             // We need to change week (table row)
             echo "</tr>\n<tr>";
@@ -436,7 +436,7 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course
 
         // Reset vars
         $cell = '';
-        $dayhref = calendar_get_link_href(CALENDAR_URL.'view.php?view=day&amp;course='.$courseid.'&amp;', $day, $m, $y);
+        $dayhref = calendar_get_link_href(CALENDAR_URL.'view.php?view=day&amp;course='.$courseid.'&amp;', $aday, $m, $y);
 
         if(CALENDAR_WEEKEND & (1 << ($dayweek % 7))) {
             // Weekend. This is true no matter what the exact range is.
@@ -448,35 +448,35 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course
         }
 
         // Special visual fx if an event is defined
-        if(isset($eventsbyday[$day])) {
-            if(count($eventsbyday[$day]) == 1) {
+        if(isset($eventsbyday[$aday])) {
+            if(count($eventsbyday[$aday]) == 1) {
                 $title = get_string('oneevent', 'calendar');
             }
             else {
-                $title = get_string('manyevents', 'calendar', count($eventsbyday[$day]));
+                $title = get_string('manyevents', 'calendar', count($eventsbyday[$aday]));
             }
-            $cell = '<div class="day"><a href="'.$dayhref.'" title="'.$title.'">'.$day.'</a></div>';
+            $cell = '<div class="day"><a href="'.$dayhref.'" title="'.$title.'">'.$aday.'</a></div>';
         }
         else {
-            $cell = '<div class="day">'.$day.'</div>';
+            $cell = '<div class="day">'.$aday.'</div>';
         }
 
         // Special visual fx if an event spans many days
-        if(isset($typesbyday[$day]['durationglobal'])) {
+        if(isset($typesbyday[$aday]['durationglobal'])) {
             $class .= ' duration_global';
         }
-        else if(isset($typesbyday[$day]['durationcourse'])) {
+        else if(isset($typesbyday[$aday]['durationcourse'])) {
             $class .= ' duration_course';
         }
-        else if(isset($typesbyday[$day]['durationgroup'])) {
+        else if(isset($typesbyday[$aday]['durationgroup'])) {
             $class .= ' duration_group';
         }
-        else if(isset($typesbyday[$day]['durationuser'])) {
+        else if(isset($typesbyday[$aday]['durationuser'])) {
             $class .= ' duration_user';
         }
 
         // Special visual fx for today
-        if($display->thismonth && $day == $d) {
+        if($display->thismonth && $aday == $d) {
             $class .= ' today';
         } else {
             $class .= ' nottoday';
@@ -488,9 +488,9 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course
         }
         echo '<td'.$class.'>'.$cell;
 
-        if(isset($eventsbyday[$day])) {
+        if(isset($eventsbyday[$aday])) {
             echo '<ul class="events-new">';
-            foreach($eventsbyday[$day] as $eventindex) {
+            foreach($eventsbyday[$aday] as $eventindex) {
 
                 // If event has a class set then add it to the event <li> tag
                 $eventclass = '';
@@ -502,9 +502,9 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course
             }
             echo '</ul>';
         }
-        if(isset($durationbyday[$day])) {
+        if(isset($durationbyday[$aday])) {
             echo '<ul class="events-underway">';
-            foreach($durationbyday[$day] as $eventindex) {
+            foreach($durationbyday[$aday] as $eventindex) {
                 echo '<li>['.format_string($events[$eventindex]->name,true).']</li>';
             }
             echo '</ul>';

course/editsection.html

@@ -21,7 +21,7 @@
 </tr>
 </table>
 <div class="singlebutton">
-<input type="hidden" name="id" value="<?php echo $form->id ?>" />
+<input type="hidden" name="id" value="<?php echo $id ?>" />
 <input type="hidden" name="sesskey" value="<?php echo sesskey() ?>" />
 <input type="submit" value="<?php print_string("savechanges") ?>" />
 </div>

course/editsection.php

@@ -54,7 +54,7 @@
     } else {
         $sectionname  = get_section_name($course->format);
         $stredit      = get_string('edit', '', " $sectionname $section->section");
-        $strsummaryof = get_string('summaryof', '', " $sectionname $form->section");
+        $strsummaryof = get_string('summaryof', '', " $sectionname $section->section");
     }
 
     print_header_simple($stredit, '', build_navigation(array(array('name' => $stredit, 'link' => null, 'type' => 'misc'))), 'theform.summary' );

course/enrol.php

@@ -53,7 +53,7 @@
     }
 
 /// Check if the course is a meta course  (bug 5734)
-    if ($course->metacourse) {
+    if ($course->metacourse && !($course->guest == 2 && isguestuser())) {
         print_header_simple();
         notice(get_string('coursenotaccessible'), "$CFG->wwwroot/index.php");
     }

course/lib.php

@@ -523,7 +523,7 @@ function print_log_csv($course, $user, $date, $order='l.time DESC', $modname,
     header("Pragma: public");
 
     echo get_string('savedat').userdate(time(), $strftimedatetime)."\n";
-    echo $text;
+    echo $text."\n";
 
     if (empty($logs['logs'])) {
         return true;

enrol/authorize/enrol.php

@@ -71,7 +71,7 @@ class enrolment_plugin_authorize
             $curcost = get_course_cost($course);
             echo '<div class="mdl-align">';
             echo '<p>'.get_string('paymentrequired').'</p>';
-            echo '<p><b>'.get_string('cost').": $curcost[currency] $curcost[cost]".'</b></p>';
+            echo '<p><b>'.get_string('cost').': '. $curcost['currency'] . $curcost['localizedcost'] .'</b></p>';
             echo '<p><a href="'.$CFG->httpswwwroot.'/login/">'.get_string('loginsite').'</a></p>';
             echo '</div>';
         }
@@ -387,7 +387,7 @@ class enrolment_plugin_authorize
             }
 
             $str .= '<div class="cost" title="'.$strrequirespayment.'">'.$strcost.': ';
-            $str .= $currency . ' ' . $curcost['cost'].'</div>';
+            $str .= $currency . ' ' . $curcost['localizedcost'].'</div>';
         }
 
         return $str;

enrol/authorize/localfuncs.php

@@ -12,10 +12,11 @@ function get_course_cost($course)
     if (!empty($course->cost)) {
         $cost = (float)(((float)$course->cost) < 0) ? $CFG->enrol_cost : $course->cost;
     }
-
-    $cost = format_float($cost, 2);
+    $costlocalizeddisplay = format_float($cost, 2);
+    $cost = format_float($cost, 2, false);
     $ret = array(
         'cost' => $cost,
+        'localizedcost' => $costlocalizeddisplay,
         'currency' => $currency
     );
 

enrol/flatfile/enrol.php

@@ -157,13 +157,13 @@ function get_access_icons($course) {
                         continue;
                     }
 
-                    if (! $user = get_record("user", "idnumber", $fields[2]) ) {
+                    if (! $user = get_record("user", "idnumber", addslashes($fields[2])) ) {
                         $this->log .= "Unknown user idnumber in field 3 - ignoring line\n";
                         continue;
                     }
 
 
-                    if (! $course = get_record("course", "idnumber", $fields[3]) ) {
+                    if (! $course = get_record("course", "idnumber", addslashes($fields[3])) ) {
                         $this->log .= "Unknown course idnumber in field 4 - ignoring line\n";
                         continue;
                     }

install.php

@@ -633,7 +633,7 @@ if (isset($_GET['help'])) {
                     echo '<div id="mssql">' . get_string('databasesettingssub_mssql', 'install');
                 /// Link to mssql installation page
                     echo "<p style='text-align:right'><a href=\"javascript:void(0)\" ";
-                    echo "onclick=\"return window.open('http://docs.moodle.org/en/Installing_MSSQL_for_PHP')\"";
+                    echo "onclick=\"return window.open('http://docs.moodle.org/19/en/Installing_MSSQL_for_PHP')\"";
                     echo ">";
                     echo '<img src="pix/docs.gif' . '" alt="Docs" class="iconhelp" />';
                     echo get_string('moodledocslink', 'install') . '</a></p>';
@@ -642,7 +642,7 @@ if (isset($_GET['help'])) {
                     echo '<div id="mssql_n">' . get_string('databasesettingssub_mssql_n', 'install');
                 /// Link to mssql installation page
                     echo "<p style='text-align:right'><a href=\"javascript:void(0)\" ";
-                    echo "onclick=\"return window.open('http://docs.moodle.org/en/Installing_MSSQL_for_PHP')\"";
+                    echo "onclick=\"return window.open('http://docs.moodle.org/19/en/Installing_MSSQL_for_PHP')\"";
                     echo ">";
                     echo '<img src="pix/docs.gif' . '" alt="Docs" />';
                     echo get_string('moodledocslink', 'install') . '</a></p>';
@@ -651,7 +651,7 @@ if (isset($_GET['help'])) {
                     echo '<div id="odbc_mssql">'. get_string('databasesettingssub_odbc_mssql', 'install');
                 /// Link to mssql installation page
                     echo "<p style='text-align:right'><a href=\"javascript:void(0)\" ";
-                    echo "onclick=\"return window.open('http://docs.moodle.org/en/Installing_MSSQL_for_PHP')\"";
+                    echo "onclick=\"return window.open('http://docs.moodle.org/19/en/Installing_MSSQL_for_PHP')\"";
                     echo ">";
                     echo '<img src="pix/docs.gif' . '" alt="Docs" class="iconhelp" />';
                     echo get_string('moodledocslink', 'install') . '</a></p>';
@@ -660,7 +660,7 @@ if (isset($_GET['help'])) {
                     echo '<div id="oci8po">' . get_string('databasesettingssub_oci8po', 'install');
                 /// Link to oracle installation page
                     echo "<p style='text-align:right'><a href=\"javascript:void(0)\" ";
-                    echo "onclick=\"return window.open('http://docs.moodle.org/en/Installing_Oracle_for_PHP')\"";
+                    echo "onclick=\"return window.open('http://docs.moodle.org/19/en/Installing_Oracle_for_PHP')\"";
                     echo ">";
                     echo '<img src="pix/docs.gif' . '" alt="Docs" class="iconhelp" />';
                     echo get_string('moodledocslink', 'install') . '</a></p>';

lang/README.txt

@@ -16,7 +16,7 @@ To add more languages to Moodle, you can either:
 
 For more information, see the Moodle Documentation:
 
-   http://docs.moodle.org/en/Translation
+   http://docs.moodle.org/19/en/Translation
 
 
 Cheers,

lang/en_utf8/admin.php

@@ -114,7 +114,7 @@ $string['configdisablecourseajax'] = 'Do not use AJAX when editing main course p
 $string['configenablecalendarexport'] = 'Enable exporting or subscribing to calendars.';
 $string['configenablecourserequests'] = 'This will allow any user to request a course be created.';
 $string['configenableglobalsearch'] = 'This setting enables global text searching in resources and activities, it is not compatible with PHP 4.';
-$string['configenablegroupings'] = 'This setting enables groupings of groups.';
+$string['configenablegroupings'] = 'This setting enables the creation of groupings and the \'Available for group members only\' option. Groupings are a standard feature in Moodle 2.0 onwards whereas \'Available for group members only\' remains an experimental feature.';
 $string['configenablehtmlpurifier'] = 'Use HTML Purifier instead of KSES for cleaning of untrusted text. HTML Purifier is actively developed and is believed to be more secure, but it is more resource intensive. Expect minor visual differences in the resulting html code. Please note that embed and object tags can not be enabled, MathML tags and old lang tags are not supported. ';
 $string['configenablerssfeeds'] = 'This switch will enable RSS feeds from across the site.  To actually see any change you will need to enable RSS feeds in the individual modules too - go to the Modules settings under Admin Configuration.';
 $string['configenablerssfeedsdisabled'] = 'It is not available because RSS feeds are disabled in all the Site. To enable them, go to the Variables settings under Admin Configuration.';
@@ -209,8 +209,8 @@ $string['configcronremotepassword'] = 'This means that the cron.php script canno
 </pre>If this is left empty, no password is required.';
 $string['configrcache'] = 'Use the cache to store database records. Remember to set \'cachetype\' as well!';
 $string['configrcachettl'] = 'Time-to-live for cached records, in seconds. Use a short (&lt;15) value here.';
-$string['configrecaptchaprivatekey'] = 'String of characters used to communicate between your Moodle server and the recaptcha.net server. Obtain one for this site by visiting http://recaptcha.net';
-$string['configrecaptchapublickey'] = 'String of characters used to display the reCAPTCHA element in the signup form. Generated by http://recaptcha.net';
+$string['configrecaptchaprivatekey'] = 'String of characters used to communicate between your Moodle server and the recaptcha server. Obtain one for this site by visiting http://www.google.com/recaptcha';
+$string['configrecaptchapublickey'] = 'String of characters used to display the reCAPTCHA element in the signup form. Generated by http://www.google.com/recaptcha';
 $string['configregenloginsession'] = 'Regeneration of the session id during each login request is highly recommended for security reasons. This setting might not be compatible with some authentication plugins.';
 $string['configrequestedstudentname'] = 'Word for student used in requested courses';
 $string['configrequestedstudentsname'] = 'Word for students used in requested courses';
@@ -358,7 +358,7 @@ $string['enableajax'] = 'Enable AJAX';
 $string['enablecalendarexport'] = 'Enable calendar export';
 $string['enablecourserequests'] = 'Enable course requests';
 $string['enableglobalsearch'] = 'Enable global search';
-$string['enablegroupings'] = 'Enable groupings';
+$string['enablegroupings'] = 'Enable groupings and \'Available for group members only\'';
 $string['enablehtmlpurifier'] = 'Enable HTML Purifier';
 $string['enablerecordcache'] = 'Enable Record Cache';
 $string['enablerssfeeds'] = 'Enable RSS feeds';
@@ -396,6 +396,8 @@ $string['filtersettings'] = 'Manage filters';
 $string['filtersettingsgeneral'] = 'General filter settings';
 $string['filteruploadedfiles'] = 'Filter uploaded files';
 $string['forcelogin'] = 'Force users to login';
+$string['forceloginforprofileimage'] = 'Force users to login to view user pictures';
+$string['forceloginforprofileimage_help'] = 'If enabled, users must login in order to view user profile pictures and the default user picture will be used in all notification emails.';
 $string['forceloginforprofiles'] = 'Force users to login for profiles';
 $string['forcetimezone'] = 'Force default timezone';
 $string['framename'] = 'Frame name';
@@ -493,6 +495,8 @@ $string['location'] = 'Location';
 $string['locationsettings'] = 'Location settings';
 $string['log'] = 'Logs';
 $string['loginhttps'] = 'Use HTTPS for logins';
+$string['loginpasswordautocomplete'] = 'Prevent password autocompletion on login form.';
+$string['loginpasswordautocomplete_help'] = 'Having this off will let users save their account password in their browser. Switching this setting on will result in your site no longer following XHTML strict validation rules.';
 $string['loglifetime'] = 'Keep logs for';
 $string['longtimenosee'] = 'Unsubscribe users from courses after';
 $string['longtimewarning'] = '<b>Please note that this process can take a long time.</b>';
@@ -770,7 +774,7 @@ $string['uploadpicture_userupdated'] = 'Picture updated for user $a.';
 $string['uploadpicture_cannotsave'] = 'Cannot save picture for user $a. Check original picture file.';
 $string['updatetimezones'] = 'Update timezones';
 $string['upgrade197notice'] = '<p>Moodle 1.9.7 contains a number of security fixes to user passwords and backups to protect the user data on your site. As a result some of your settings and permissions relating to backups may have changed.<br />
-See the <a href=\"http://docs.moodle.org/en/Moodle_1.9.7_release_notes\" target=\"_blank\">Moodle 1.9.7 release notes</a> for full details.</p>';
+See the <a href=\"http://docs.moodle.org/dev/Moodle_1.9.7_release_notes\" target=\"_blank\">Moodle 1.9.7 release notes</a> for full details.</p>';
 $string['upgrade197noticesubject'] = 'Moodle 1.9.7 upgrade security notices';
 $string['upgrade197salt'] = 'To reduce the risk of password theft, you are strongly recommended to set a password salt.<br />See the <a href=\"$a\" target=\"_blank\">password salting documentation</a> for details.';
 $string['upgradeforumread'] = 'A new feature has been added in Moodle 1.5 to track read/unread forum posts.<br />To use this functionality you need to <a href=\"$a\">update your tables</a>.';

lang/en_utf8/auth.php

@@ -125,7 +125,7 @@ $string['auth_emailnowexists'] = 'The email address you tried to assign to your
 $string['auth_emailtitle'] = 'Email-based self-registration';
 $string['auth_emailnoinsert'] = 'Could not add your record to the database!';
 $string['auth_emailnoemail'] = 'Tried to send you an email but failed!';
-$string['auth_emailrecaptcha'] = 'Adds a visual/audio confirmation form element to the signup page for email self-registering users. This protects your site against spammers and contributes to a worthwhile cause. See http://recaptcha.net/learnmore.html for more details. <br /><em>PHP cURL extension is required.</em>';
+$string['auth_emailrecaptcha'] = 'Adds a visual/audio confirmation form element to the signup page for email self-registering users. This protects your site against spammers and contributes to a worthwhile cause. See http://www.google.com/recaptcha/learnmore for more details. <br /><em>PHP cURL extension is required.</em>';
 $string['auth_emailrecaptcha_key'] = 'Enable reCAPTCHA element';
 $string['auth_emailsettings'] = 'Settings';
 $string['auth_emailupdatemessage'] = 'Dear $a->fullname,
@@ -256,7 +256,7 @@ $string['auth_ldaptitle'] = 'LDAP server';
 $string['auth_ldapnotinstalled'] = 'Cannot use LDAP authentication. The PHP LDAP module is not installed.';
 $string['auth_ntlmsso'] = 'NTLM SSO';
 $string['auth_ntlmsso_enabled_key'] = 'Enable';
-$string['auth_ntlmsso_enabled'] = 'Set to yes to attempt Single Sign On with the NTLM domain. <strong>Note:</strong> this requires additional setup on the webserver to work, see <a href=\"http://docs.moodle.org/en/NTLM_authentication\">http://docs.moodle.org/en/NTLM_authentication</a>';
+$string['auth_ntlmsso_enabled'] = 'Set to yes to attempt Single Sign On with the NTLM domain. <strong>Note:</strong> this requires additional setup on the webserver to work, see <a href=\"http://docs.moodle.org/19/en/NTLM_authentication\">http://docs.moodle.org/19/en/NTLM_authentication</a>';
 $string['auth_ntlmsso_ie_fastpath'] = 'Set to yes to enable the NTLM SSO fast path (bypasses certain steps and only works if the client\'s browser is MS Internet Explorer).';
 $string['auth_ntlmsso_ie_fastpath_key'] = 'MS IE fast path?';
 $string['auth_ntlmsso_subnet_key'] = 'Subnet';

lang/en_utf8/data.php

@@ -215,7 +215,7 @@ $string['recordsnotsaved'] = 'No entry was saved. Please check the format of the
 $string['recordssaved'] = 'entries saved';
 $string['requireapproval'] = 'Require approval?';
 $string['requiredentries'] = 'Required entries';
-$string['requiredentrieschanged'] = '<p><strong>IMPORTANT - PLEASE READ </strong></p><p>Due to a bug fix, the behaviour of database activities using the \'Required entries\' and \'Required entries before viewing settings\' settings will change. A more detailed explaination of the changes can be read on <a href=\"http://moodle.org/mod/forum/discuss.php?d=110928\" target=\"_blank\">the database module forum</a>. The expected behavior of these settings can also be read on <a href=\"http://docs.moodle.org/en/Adding/editing_a_database#Required_entries\" target=\"_blank\">Moodle Docs</a>.
+$string['requiredentrieschanged'] = '<p><strong>IMPORTANT - PLEASE READ </strong></p><p>Due to a bug fix, the behaviour of database activities using the \'Required entries\' and \'Required entries before viewing settings\' settings will change. A more detailed explaination of the changes can be read on <a href=\"http://moodle.org/mod/forum/discuss.php?d=110928\" target=\"_blank\">the database module forum</a>. The expected behavior of these settings can also be read on <a href=\"http://docs.moodle.org/19/en/Adding/editing_a_database#Required_entries\" target=\"_blank\">Moodle Docs</a>.
 </p><p>This change affects the following databases in your system: (Please save this list now, and after the upgrade, check that these activities still work the way that the teacher intends.)</p><strong style=\"color:red\">$a->text</strong><br/>';
 $string['requiredentriestoview'] = 'Entries required before viewing';
 $string['resettemplate'] = 'Reset template';

lang/en_utf8/docs/README.txt

@@ -5,7 +5,7 @@ All of it has gone now because we now use the Moodle Docs wiki.
 
 To find out the new locations for all the information that was here, see:
 
-    http://docs.moodle.org/en/MoodleDocs_and_lang_packs
+    http://docs.moodle.org/19/en/MoodleDocs_and_lang_packs
 
     http://tracker.moodle.org/browse/MDL-4912
 

lang/en_utf8/docs/licence.html

@@ -11,7 +11,7 @@
 </head>
 <body>
 
-(For the most up-to-date version of this license, see <a href="http://docs.moodle.org/en/License">Moodle Docs</a>).
+(For the most up-to-date version of this license, see <a href="http://docs.moodle.org/dev/License">Moodle Docs</a>).
     
 <h1>Copyright License for Moodle</h1>
 <blockquote>

lang/en_utf8/help/install.html

@@ -48,7 +48,7 @@
     one of the few webhosts that does not support these features ask them why, 
     and consider taking your business elsewhere.</p>
   <p>If you want to run Moodle on your own computer and all this looks a bit daunting, 
-    then please take a look at <a href="http://docs.moodle.org/en/Administrator_documentation">the administrator documentation</a>.</p>
+    then please take a look at <a href="http://docs.moodle.org/19/en/Administrator_documentation">the administrator documentation</a>.</p>
   <p>&nbsp;</p>
 </div>
 
@@ -266,7 +266,7 @@ php_value post_max_size 2M</pre>
       '1', teacher varchar(100) NOT NULL default 'Teacher', startdate int(10) 
       unsigned NOT NULL default '0', enddate int(10) unsigned NOT NULL default 
       '0', timemodified int(10) unsigned NOT NULL default '0', PRIMARY KEY (id)) 
-      TYPE=MyISAM</p>
+      ENGINE=MyISAM</p>
     <p class="success">SUCCESS</p>
   </div>
   <p>...and so on, followed by: <span class="success">Main databases set up 
@@ -416,7 +416,7 @@ php_value post_max_size 2M</pre>
     for them using the &quot;Add a new user&quot; on the Admin page.</p>
   <p>Once done, the course is ready to customise, and is accessible via the &quot;Courses&quot; 
     link on the home page.</p>
-  <p>See the &quot;<a href="http://docs.moodle.org/en/Teacher_documentation">Teacher Documentation</a>&quot; for more details 
+  <p>See the &quot;<a href="http://docs.moodle.org/19/en/Teacher_documentation">Teacher Documentation</a>&quot; for more details
     on course-building.</p>
   <p>&nbsp;</p>
   <p class="center"><strong>Happy exploring and happy Moodling!</strong></p>

lang/en_utf8/help/question/categories.html

@@ -31,5 +31,5 @@ cannot delete the last category in a context.</li>
 <ul>
   <li><a href="help.php?module=question&amp;file=categorycontexts.html">Category contexts</a></li>
   <li><a href="help.php?module=question&amp;file=permissions.html">Question permissions</a></li>
-  <li><a href="http://docs.moodle.org/en/Question_categories">Question categories help on Moodle Docs</a></li>
+  <li><a href="http://docs.moodle.org/19/en/Question_categories">Question categories help on Moodle Docs</a></li>
 </ul>

lang/en_utf8/help/question/categorycontexts.html

@@ -15,5 +15,5 @@ your questions in any or all of the parent course categories).</li>
 <ul>
   <li><a href="help.php?module=question&amp;file=categories.html">Question categories</a></li>
   <li><a href="help.php?module=question&amp;file=permissions.html">Question permissions</a></li>
-  <li><a href="http://docs.moodle.org/en/Question_contexts">Question contexts documentation on Moodle Docs</a></li>
+  <li><a href="http://docs.moodle.org/19/en/Question_contexts">Question contexts documentation on Moodle Docs</a></li>
 </ul>

lang/en_utf8/install.php

@@ -258,7 +258,7 @@ $string['phpversionhelp'] = '<p>Moodle requires a PHP version of at least 4.3.0
 $string['postgres7'] = 'PostgreSQL (postgres7)';
 $string['postgresqlwarning'] = '<strong>Note:</strong> If you experience some connection problems, you can try to set Host Server field as
  host=\'postgresql_host\' port=\'5432\' dbname=\'postgresql_database_name\' user=\'postgresql_user\' password=\'postgresql_user_password\'
-and to leave empty the Database, User and Password fields. More information on <a href=\"http://docs.moodle.org/en/Installing_Postgres_for_PHP\">Moodle Docs</a>';
+and to leave empty the Database, User and Password fields. More information on <a href=\"http://docs.moodle.org/19/en/Installing_Postgres_for_PHP\">Moodle Docs</a>';
 $string['safemode'] = 'Safe Mode';
 $string['safemodeerror'] = 'Moodle may have trouble with safe mode on';
 $string['safemodehelp'] = '<p>Moodle may have a variety of problems with safe mode on, not least is that 

lang/en_utf8/mnet.php

@@ -208,6 +208,7 @@ $string['addtoacl'] = 'Add to Access Control';
 $string['accesslevel'] = 'Access Level';
 $string['ssoaccesscontrol'] = 'SSO Access Control';
 $string['notpermittedtojump'] = 'You do not have permission to begin a remote session from this Moodle hub.';
+$string['notpermittedtojumpas'] = 'You can\'t begin a remote session while you are logged in as another user.';
 $string['notpermittedtoland'] = 'You do not have permission to begin a remote session.';
 $string['authfail_nosessionexists'] = 'Authorisation failed: the mnet session does not exist.';
 $string['authfail_sessiontimedout'] = 'Authorisation failed: the mnet session has timed out.';

lang/en_utf8/moodle.org.php

@@ -49,7 +49,7 @@ $string['downloadcore'] = 'Our main method of distribution is via these standard
 $string['downloadcoretitle'] = 'Standard Moodle packages';
 $string['downloadcvs'] = 'Another way to get the core source code is by using CVS to connect directly to one of our mirrors of the code repository used by Moodle developers.  This makes upgrading very easy, even if you have made local changes to the source code.';
 $string['downloadcvstitle'] = 'Moodle via CVS';
-$string['downloadintro'] = 'Moodle is open source under the <a href=\"http://docs.moodle.org/en/License\">GPL licence</a>.  Everything we produce is available for you to download and use for free.';
+$string['downloadintro'] = 'Moodle is open source under the <a href=\"http://docs.moodle.org/dev/License\">GPL licence</a>.  Everything we produce is available for you to download and use for free.';
 $string['downloadlang'] = 'In current versions of Moodle, adding support for new languages has been automated from the administration menu within your site.  However, for some older versions of Moodle, new language packs need to be downloaded manually.';
 $string['downloadlangtitle'] = 'Language packs';
 $string['downloadlogotitle'] = 'Moodle logos';

lang/en_utf8/moodle.php

@@ -161,7 +161,7 @@ $string['backupmetacoursehelp'] = 'If enabled, then metacourse info (inherited e
 $string['backupnameformat'] = '%%Y%%m%%d-%%H%%M';
 $string['backupmissinguserinfoperms'] = 'Note: This backup contains no user data. Exercise and Workshop activities will not be included in the backup, since these modules are not compatible with this type of backup.';
 $string['backupnoneusersinfo'] = 'Note: This backup contains no users and so all activities have been switched to \"without user data\" mode. Exercise and Workshop activities will not be included in the backup, since these modules are not compatible with this type of backup.';
-$string['backupnonisowarning'] = 'Warning: this backup is from a non-Unicode version of Moodle (pre 1.6).  If this backup contains any non-ISO-8859-1 texts then they may be CORRUPTED if you try to restore them to this Unicode version of Moodle.  See the <a href=\"http://docs.moodle.org/en/Backup_FAQ\">Backup FAQ</a> for more information about how to recover this backup correctly.';
+$string['backupnonisowarning'] = 'Warning: this backup is from a non-Unicode version of Moodle (pre 1.6).  If this backup contains any non-ISO-8859-1 texts then they may be CORRUPTED if you try to restore them to this Unicode version of Moodle.  See the <a href=\"http://docs.moodle.org/19/en/Backup_FAQ\">Backup FAQ</a> for more information about how to recover this backup correctly.';
 $string['backupnext'] = 'Next backup';
 $string['backuporiginalname'] = 'Backup Name';
 $string['backuproleassignments'] = 'Backup role assignments for these roles';
@@ -503,6 +503,7 @@ $string['emaildisable'] = 'This email address is disabled';
 $string['emaildisableclick'] = 'Click here to disable all email from being sent to this address';
 $string['emaildisplay'] = 'Email display';
 $string['emaildisplaycourse'] = 'Allow only other course members to see my email address';
+$string['emaildisplayhidden'] = 'Email hidden';
 $string['emaildisplayno'] = 'Hide my email address from everyone';
 $string['emaildisplayyes'] = 'Allow everyone to see my email address';
 $string['emailenable'] = 'This email address is enabled';
@@ -732,7 +733,7 @@ but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 
 See the Moodle License information page for full details:
-http://docs.moodle.org/en/License';
+http://docs.moodle.org/dev/License';
 $string['grade'] = 'Grade';
 $string['grades'] = 'Grades';
 $string['group'] = 'Group';

lang/en_utf8/report_spamcleaner.php

@@ -3,7 +3,7 @@ $string['spamauto'] = 'Autodetect common spam patterns';
 $string['spamcannotdelete'] = 'Cannot delete this user';
 $string['spamcannotfinduser'] = 'No users matching your search';
 $string['spamcleaner'] = 'Spam cleaner';
-$string['spamcleanerintro'] = 'This script allows you to search all user profiles for certain strings and then delete those accounts which are obviously created by spammers.  You can search for multiple keywords using commas (eg casino, porn)<br /><br />Moodle docs has more information about <a href=\"http://docs.moodle.org/en/Reducing_spam_in_Moodle\">Reducing spam in Moodle</a>.';
+$string['spamcleanerintro'] = 'This script allows you to search all user profiles for certain strings and then delete those accounts which are obviously created by spammers.  You can search for multiple keywords using commas (eg casino, porn)<br /><br />Moodle docs has more information about <a href=\"http://docs.moodle.org/19/en/Reducing_spam_in_Moodle\">Reducing spam in Moodle</a>.';
 $string['spamdesc'] = 'Description';
 $string['spamdeleteall'] = 'Delete all these user accounts';
 $string['spamdeleteconfirm'] = 'Are you sure you want to delete this entry?  You can not undo this.';

lang/en_utf8/xmldb.php

@@ -73,7 +73,7 @@ $string['indexes'] = 'Indexes';
 $string['integerincorrectlength'] = 'Incorrect length for integer field';
 $string['key'] = 'Key';
 $string['keys'] = 'Keys';
-$string['listreservedwords'] = 'List of Reserved Words<br />(used to keep <a href=\"http://docs.moodle.org/en/XMLDB_reserved_words\" target=\"_blank\">XMLDB_reserved_words</a> updated)';
+$string['listreservedwords'] = 'List of Reserved Words<br />(used to keep <a href=\"http://docs.moodle.org/19/en/XMLDB_reserved_words\" target=\"_blank\">XMLDB_reserved_words</a> updated)';
 $string['load'] = 'Load';
 $string['missing'] = 'Missing';
 $string['missingindexes'] = 'Missing Indexes Found';

lib/accesslib.php

@@ -144,7 +144,7 @@ define('CONTEXT_COURSE', 50);
 define('CONTEXT_MODULE', 70);
 define('CONTEXT_BLOCK', 80);
 
-// capability risks - see http://docs.moodle.org/en/Development:Hardening_new_Roles_system
+// capability risks - see http://docs.moodle.org/dev/Hardening_new_Roles_system
 define('RISK_MANAGETRUST', 0x0001);
 define('RISK_CONFIG',      0x0002);
 define('RISK_XSS',         0x0004);

lib/adminlib.php

@@ -4942,14 +4942,18 @@ function print_plugin_tables() {
     $installed_mods = get_records_list('modules', '', '', '', 'name');
     $installed_blocks = get_records_list('block', '', '', '', 'name');
 
+    $plugins_installed['mod'] = array();
     foreach($installed_mods as $mod) {
         $plugins_installed['mod'][] = $mod->name;
     }
 
+    $plugins_installed['blocks'] = array();
     foreach($installed_blocks as $block) {
         $plugins_installed['blocks'][] = $block->name;
     }
 
+    $plugins_installed['filter'] = array();
+
     $plugins_ondisk = array();
     $plugins_ondisk['mod'] = get_list_of_plugins('mod', 'db');
     $plugins_ondisk['blocks'] = get_list_of_plugins('blocks', 'db');

lib/datalib.php

@@ -1238,7 +1238,7 @@ function get_categories($parent='none', $sort=NULL, $shallow=true) {
                 JOIN {$CFG->prefix}context ctx
                   ON cc.id=ctx.instanceid AND ctx.contextlevel=".CONTEXT_COURSECAT."
                 JOIN {$CFG->prefix}course_categories ccp
-                     ON (cc.path LIKE ".sql_concat('ccp.path',"'%'").")
+                     ON ((cc.parent=ccp.id) OR (cc.path LIKE ".sql_concat('ccp.path',"'/%'")."))
                 WHERE ccp.id=$parent
                 $sort";
     }

lib/db/mysql.php

@@ -254,7 +254,7 @@ function main_upgrade($oldversion=0) {
                              `userid` int(10) unsigned NOT NULL default '0',
                              PRIMARY KEY  (`id`),
                              UNIQUE KEY `id` (`id`)
-                             ) TYPE=MyISAM COMMENT='One record per course creator';");
+                             ) ENGINE=MyISAM COMMENT='One record per course creator';");
     }
     if ($oldversion < 2003032602) {
         // Redoing it because of no prefix last time
@@ -362,7 +362,7 @@ function main_upgrade($oldversion=0) {
                         PRIMARY KEY  (`id`),
                         UNIQUE KEY `id` (`id`),
                         KEY `courseuserid` (course,userid)
-                     ) TYPE=MyISAM COMMENT='Stores info about how to display the course'");
+                     ) ENGINE=MyISAM COMMENT='Stores info about how to display the course'");
     }
 
     if ($oldversion < 2003050400) {
@@ -458,7 +458,7 @@ function main_upgrade($oldversion=0) {
                          `description` text NOT NULL,
                          `timemodified` int(10) unsigned NOT NULL default '0',
                          PRIMARY KEY  (id)
-                       ) TYPE=MyISAM COMMENT='Defines grading scales'");
+                       ) ENGINE=MyISAM COMMENT='Defines grading scales'");
 
     }
 
@@ -558,7 +558,7 @@ function main_upgrade($oldversion=0) {
                                 `timemodified` int(10) unsigned NOT NULL default '0',
                                 PRIMARY KEY  (`id`),
                                 KEY `courseid` (`courseid`)
-                              ) TYPE=MyISAM COMMENT='Each record is a group in a course.'; ");
+                              ) ENGINE=MyISAM COMMENT='Each record is a group in a course.'; ");
 
         modify_database("", "CREATE TABLE `prefix_groups_members` (
                                 `id` int(10) unsigned NOT NULL auto_increment,
@@ -567,7 +567,7 @@ function main_upgrade($oldversion=0) {
                                 `timeadded` int(10) unsigned NOT NULL default '0',
                                 PRIMARY KEY  (`id`),
                                 KEY `groupid` (`groupid`)
-                              ) TYPE=MyISAM COMMENT='Lists memberships of users in groups'; ");
+                              ) ENGINE=MyISAM COMMENT='Lists memberships of users in groups'; ");
     }
 
     if ($oldversion < 2003121800) {
@@ -601,7 +601,7 @@ function main_upgrade($oldversion=0) {
                               UNIQUE KEY `id` (`id`),
                               KEY `courseid` (`courseid`),
                               KEY `userid` (`userid`)
-                            ) TYPE=MyISAM COMMENT='For everything with a time associated to it'; ");
+                            ) ENGINE=MyISAM COMMENT='For everything with a time associated to it'; ");
     }
 
     if ($oldversion < 2004012800) {
@@ -613,7 +613,7 @@ function main_upgrade($oldversion=0) {
                               PRIMARY KEY  (`id`),
                               UNIQUE KEY `id` (`id`),
                               KEY `useridname` (userid,name)
-                            ) TYPE=MyISAM COMMENT='Allows modules to store arbitrary user preferences'; ");
+                            ) ENGINE=MyISAM COMMENT='Allows modules to store arbitrary user preferences'; ");
     }
 
     if ($oldversion < 2004012900) {
@@ -637,7 +637,7 @@ function main_upgrade($oldversion=0) {
                                 `timemodified` int(10) unsigned NOT NULL default '0',
                                 PRIMARY KEY  (`id`),
                                 KEY `md5key` (`md5key`)
-                             ) TYPE=MyISAM COMMENT='For storing temporary copies of processed texts';");
+                             ) ENGINE=MyISAM COMMENT='For storing temporary copies of processed texts';");
     }
 
     if ($oldversion < 2004021000) {
@@ -667,7 +667,7 @@ function main_upgrade($oldversion=0) {
                                 `timemodified` int(10) unsigned NOT NULL default '0',
                                 PRIMARY KEY  (`id`),
                                 KEY `filtermd5key` (filter,md5key)
-                              ) TYPE=MyISAM COMMENT='For keeping information about cached data';");
+                              ) ENGINE=MyISAM COMMENT='For keeping information about cached data';");
     }
 
     if ($oldversion < 2004021500) {
@@ -865,7 +865,7 @@ function main_upgrade($oldversion=0) {
                           `data` text NOT null,
                           PRIMARY KEY (`sesskey`), 
                           KEY (`expiry`) 
-                      ) TYPE=MyISAM COMMENT='Optional database session storage, not used by default';");
+                      ) ENGINE=MyISAM COMMENT='Optional database session storage, not used by default';");
     }
 
     if ($oldversion < 2004111500) {  // Update any users/courses using wrongly-named lang pack
@@ -1043,7 +1043,7 @@ function main_upgrade($oldversion=0) {
                                PRIMARY KEY  (`id`),
                                KEY `useridfrom` (`useridfrom`),
                                KEY `useridto` (`useridto`)
-                             ) TYPE=MyISAM COMMENT='Stores all unread messages';");
+                             ) ENGINE=MyISAM COMMENT='Stores all unread messages';");
 
         modify_database('',"CREATE TABLE `prefix_message_read` (
                                `id` int(10) unsigned NOT NULL auto_increment,
@@ -1057,7 +1057,7 @@ function main_upgrade($oldversion=0) {
                                PRIMARY KEY  (`id`),
                                KEY `useridfrom` (`useridfrom`),
                                KEY `useridto` (`useridto`)
-                             ) TYPE=MyISAM COMMENT='Stores all messages that have been read';");
+                             ) ENGINE=MyISAM COMMENT='Stores all messages that have been read';");
 
         modify_database('',"CREATE TABLE `prefix_message_contacts` (
                                `id` int(10) unsigned NOT NULL auto_increment,
@@ -1066,7 +1066,7 @@ function main_upgrade($oldversion=0) {
                                `blocked` tinyint(1) unsigned NOT NULL default '0',
                                PRIMARY KEY  (`id`),
                                UNIQUE KEY `usercontact` (`userid`,`contactid`)
-                             ) TYPE=MyISAM COMMENT='Maintains lists of relationships between users';");
+                             ) ENGINE=MyISAM COMMENT='Maintains lists of relationships between users';");
 
         modify_database('', "INSERT INTO prefix_log_display (module, action, mtable, field) VALUES ('message', 'write', 'user', 'CONCAT(firstname,\" \",lastname)'); ");
         modify_database('', "INSERT INTO prefix_log_display (module, action, mtable, field) VALUES ('message', 'read', 'user', 'CONCAT(firstname,\" \",lastname)'); ");
@@ -1243,7 +1243,7 @@ function main_upgrade($oldversion=0) {
                               `std_skipweeks` tinyint(3) NOT NULL default '0',
                               `std_time` varchar(5) NOT NULL default '00:00',
                               PRIMARY KEY (`id`)
-                            ) TYPE=MyISAM COMMENT='Rules for calculating local wall clock time for users';");
+                            ) ENGINE=MyISAM COMMENT='Rules for calculating local wall clock time for users';");
     }
 
     if ($oldversion < 2005032800) {
@@ -1257,7 +1257,7 @@ function main_upgrade($oldversion=0) {
             `weight` decimal(4,2) NOT NULL default '0.00',
             PRIMARY KEY  (`id`),
             KEY `courseid` (`courseid`)
-          ) TYPE=MyISAM ;");
+          ) ENGINE=MyISAM ;");
 
         execute_sql("CREATE TABLE `{$CFG->prefix}grade_exceptions` (
             `id` int(10) unsigned NOT NULL auto_increment,
@@ -1266,7 +1266,7 @@ function main_upgrade($oldversion=0) {
             `userid` int(10) unsigned NOT NULL default '0',
             PRIMARY KEY  (`id`),
             KEY `courseid` (`courseid`)
-          ) TYPE=MyISAM ;");
+          ) ENGINE=MyISAM ;");
 
 
         execute_sql("CREATE TABLE `{$CFG->prefix}grade_item` (
@@ -1280,7 +1280,7 @@ function main_upgrade($oldversion=0) {
             `sort_order` int(10) unsigned NOT NULL default '0',
             PRIMARY KEY  (`id`),
             KEY `courseid` (`courseid`)
-          ) TYPE=MyISAM ;");
+          ) ENGINE=MyISAM ;");
 
 
         execute_sql("CREATE TABLE `{$CFG->prefix}grade_letter` (
@@ -1291,7 +1291,7 @@ function main_upgrade($oldversion=0) {
             `grade_low` decimal(4,2) NOT NULL default '0.00',
             PRIMARY KEY  (`id`),
             KEY `courseid` (`courseid`)
-          ) TYPE=MyISAM ;");
+          ) ENGINE=MyISAM ;");
           
 
         execute_sql("CREATE TABLE `{$CFG->prefix}grade_preferences` (
@@ -1301,7 +1301,7 @@ function main_upgrade($oldversion=0) {
             `value` int(10) NOT NULL default '0',
             PRIMARY KEY  (`id`),
             UNIQUE KEY `courseidpreference` (`courseid`,`preference`)
-          ) TYPE=MyISAM ;");
+          ) ENGINE=MyISAM ;");
           
     }
 
@@ -1372,7 +1372,7 @@ function main_upgrade($oldversion=0) {
                                   `value`      text NOT NULL default '',
                                   PRIMARY KEY  (`id`),
                                            UNIQUE KEY `plugin_name` (`plugin`, `name`)
-                                  ) TYPE=MyISAM 
+                                  ) ENGINE=MyISAM
                                   COMMENT='Moodle modules and plugins configuration variables';");
     }
 
@@ -1493,7 +1493,7 @@ function main_upgrade($oldversion=0) {
           `requester` int(10) NOT NULL default 0,
           PRIMARY KEY (`id`),
           KEY `shortname` (`shortname`)
-        ) TYPE=MyISAM;");
+        ) ENGINE=MyISAM;");
         
         table_column('course','','requested');
     }
@@ -1506,7 +1506,7 @@ function main_upgrade($oldversion=0) {
          PRIMARY KEY (`id`),
          KEY `course` (`course`),
          KEY `module` (`module`)
-      ) TYPE=MyISAM;");
+      ) ENGINE=MyISAM;");
         
         table_column('course','','restrictmodules','int','1','','0','not null');
     }
@@ -1692,7 +1692,7 @@ function main_upgrade($oldversion=0) {
           UNIQUE KEY `id_user_idx` (`id`, `userid`),
           KEY `post_lastmodified_idx` (`lastmodified`),
           KEY `post_subject_idx` (`subject`)
-        ) TYPE=MyISAM  COMMENT='New moodle post table. Holds data posts such as forum entries or blog entries.';");
+        ) ENGINE=MyISAM  COMMENT='New moodle post table. Holds data posts such as forum entries or blog entries.';");
 
         modify_database("","CREATE TABLE prefix_tags (
           `id` int(10) unsigned NOT NULL auto_increment,
@@ -1700,7 +1700,7 @@ function main_upgrade($oldversion=0) {
           `userid` int(10) unsigned NOT NULL default'0',
           `text` varchar(255) NOT NULL default '',
           PRIMARY KEY  (`id`)
-        ) TYPE=MyISAM COMMENT ='tags structure for moodle.';");
+        ) ENGINE=MyISAM COMMENT ='tags structure for moodle.';");
 
         modify_database("","CREATE TABLE prefix_blog_tag_instance (
           `id` int(10) unsigned NOT NULL auto_increment,
@@ -1710,7 +1710,7 @@ function main_upgrade($oldversion=0) {
           `courseid` int(10) unsigned NOT NULL default'0',
           `userid` int(10) unsigned NOT NULL default'0',
           PRIMARY KEY  (`id`)
-          ) TYPE=MyISAM COMMENT ='tag instance for blogs.';");
+          ) ENGINE=MyISAM COMMENT ='tag instance for blogs.';");
     }
 
     if ($oldversion < 2006031400) {
@@ -1799,7 +1799,7 @@ function main_upgrade($oldversion=0) {
                                `mtable` varchar(30),
                                `field` varchar(50),
                                PRIMARY KEY (`id`)
-                               ) TYPE=MyISAM");
+                               ) ENGINE=MyISAM");
         
         // Add index to ensure that module and action combination is unique.
         modify_database('', "ALTER TABLE prefix_log_display ADD UNIQUE `moduleaction`(`module` , `action`)");
@@ -2193,7 +2193,7 @@ function main_upgrade($oldversion=0) {
                     KEY `courseid` (`courseid`),
                     UNIQUE KEY `userid-courseid` (`userid`, `courseid`),
                     PRIMARY KEY (`id`) 
-                    )TYPE=MYISAM COMMENT ='time user last accessed any page in a course';", true);
+                    )ENGINE=MyISAM COMMENT ='time user last accessed any page in a course';", true);
     }
 
     if (!empty($CFG->rolesactive) and $oldversion < 2006091212) {   // Reload the guest roles completely with new defaults

lib/db/upgrade.php

@@ -370,7 +370,7 @@ function xmldb_main_upgrade($oldversion=0) {
         drop_index($table, $index);
         $index->setFields(array('mnethostid', 'username'));
         if (!add_index($table, $index)) {
-            notify(get_string('duplicate_usernames', 'mnet', 'http://docs.moodle.org/en/DuplicateUsernames'));
+            notify(get_string('duplicate_usernames', 'mnet', 'http://docs.moodle.org/19/en/DuplicateUsernames'));
         }
 
         unset($table, $field, $index);
@@ -3292,6 +3292,15 @@ function xmldb_main_upgrade($oldversion=0) {
     }
 
     if ($result && $oldversion < 2007101571.01) {
+        // Remove category_sortorder index that was supposed to be removed long time ago
+        $table = new XMLDBTable('course');
+        $index = new XMLDBIndex('category_sortorder');
+        $index->setAttributes(XMLDB_INDEX_UNIQUE, array('category', 'sortorder'));
+
+        if (index_exists($table, $index)) {
+            drop_index($table, $index);
+        }
+
         // MDL-21011 bring down course sort orders away from maximum values
         $sql = "SELECT id, category, sortorder from {$CFG->prefix}course
                 ORDER BY sortorder ASC;";
@@ -3368,6 +3377,19 @@ function xmldb_main_upgrade($oldversion=0) {
         upgrade_main_savepoint($result, 2007101591.01);
     }
 
+    if ($result && $oldversion < 2007101591.05) {
+        // Remove category_sortorder index that was supposed to be removed long time ago
+        $table = new XMLDBTable('course');
+        $index = new XMLDBIndex('category_sortorder');
+        $index->setAttributes(XMLDB_INDEX_UNIQUE, array('category', 'sortorder'));
+
+        if (index_exists($table, $index)) {
+            drop_index($table, $index);
+        }
+        upgrade_main_savepoint($result, 2007101591.05);
+    }
+
+
     return $result;
 }
 

lib/ddllib.php

@@ -36,7 +36,7 @@
 // This library should be used, exclusively, by the installation and
 // upgrade process of Moodle.
 //
-// For further documentation, visit http://docs.moodle.org/en/DDL_functions
+// For further documentation, visit http://docs.moodle.org/19/en/DDL_functions
 
 /// Add required XMLDB constants
     require_once($CFG->libdir . '/xmldb/classes/XMLDBConstants.php');
@@ -67,7 +67,7 @@
  * Add a new field to a table, or modify an existing one (if oldfield is defined).
  *
  * WARNING: This function is deprecated and will be removed in future versions.
- * Please use XMLDB (see http://docs.moodle.org/en/Development:DDL_functions ).
+ * Please use XMLDB (see http://docs.moodle.org/dev/DDL_functions ).
  *
  * Warning: Please be careful on primary keys, as this function will eat auto_increments
  *

lib/deprecatedlib.php

@@ -1677,6 +1677,12 @@ function error ($message, $link='') {
         }
     }
 
+    // when printing an error the continue button should never link offsite
+    if (stripos($link, $CFG->wwwroot) === false &&
+        stripos($link, $CFG->httpswwwroot) === false) {
+        $link = $CFG->wwwroot.'/';
+    }
+
     if (!empty($link)) {
         print_continue($link);
     }

lib/dmllib.php

@@ -32,7 +32,7 @@
 /// include it yourself.
 
 /// For more info about the functions available in this library, please visit:
-///     http://docs.moodle.org/en/DML_functions
+///     http://docs.moodle.org/19/en/DML_functions
 /// (feel free to modify, improve and document such page, thanks!)
 
 /// GLOBAL CONSTANTS /////////////////////////////////////////////////////////
@@ -569,6 +569,7 @@ function get_record_select($table, $select='', $fields='*') {
 function get_recordset($table, $field='', $value='', $sort='', $fields='*', $limitfrom='', $limitnum='') {
 
     if ($field) {
+        $value = sql_magic_quotes_hack($value);
         $select = "$field = '$value'";
     } else {
         $select = '';
@@ -710,7 +711,7 @@ function recordset_to_array($rs) {
         $objects = array();
     /// First of all, we are going to get the name of the first column
     /// to introduce it back after transforming the recordset to assoc array
-    /// See http://docs.moodle.org/en/XMLDB_Problems, fetch mode problem.
+    /// See http://docs.moodle.org/19/en/XMLDB_Problems, fetch mode problem.
         $firstcolumn = $rs->FetchField(0);
     /// Get the whole associative array
         if ($records = $rs->GetAssoc(true)) {
@@ -1433,7 +1434,7 @@ function delete_records_select($table, $select='') {
  * @param string $table The database table to be checked against.
  * @param object $dataobject A data object with values for one or more fields in the record
  * @param bool $returnid Should the id of the newly created record entry be returned? If this option is not requested then true/false is returned.
- * @param string $primarykey (obsolete) This is now forced to be 'id'. 
+ * @param string $primarykey (obsolete) This is now forced to be 'id'.
  */
 function insert_record($table, $dataobject, $returnid=true, $primarykey='id') {
 
@@ -1447,6 +1448,14 @@ function insert_record($table, $dataobject, $returnid=true, $primarykey='id') {
     if (is_array($dataobject)) {
         debugging('Warning. Wrong call to insert_record(). $dataobject must be an object. array found instead', DEBUG_DEVELOPER);
         $dataobject = (object)$dataobject;
+    } else if (is_object($dataobject)) {
+        // make sure there are no properties or private methods because we cast to array later,
+        // at the same time this undos the object references so that PHP 5 works the same as PHP 4,
+        // the main reason for this is BC after the dirty magic hack introduction
+        if ($properties = get_object_vars($dataobject)) {
+            $dataobject = (object)$properties;
+        }
+        unset($properties);
     }
 
 /// Temporary hack as part of phasing out all access to obsolete user tables  XXX
@@ -1463,6 +1472,11 @@ function insert_record($table, $dataobject, $returnid=true, $primarykey='id') {
 /// so let's unset it now before it causes any trouble later
     unset($dataobject->{$primarykey});
 
+/// Extra protection against SQL injections
+    foreach((array)$dataobject as $k=>$v) {
+        $dataobject->$k = sql_magic_quotes_hack($v);
+    }
+
 /// Get an empty recordset. Cache for multiple inserts.
     if (empty($empty_rs_cache[$table])) {
         /// Execute a dummy query to get an empty recordset
@@ -1637,6 +1651,19 @@ function update_record($table, $dataobject) {
     if (is_array($dataobject)) {
         debugging('Warning. Wrong call to update_record(). $dataobject must be an object. array found instead', DEBUG_DEVELOPER);
         $dataobject = (object)$dataobject;
+    } else if (is_object($dataobject)) {
+        // make sure there are no properties or private methods because we cast to array later,
+        // at the same time this undos the object references so that PHP 5 works the same as PHP 4,
+        // the main reason for this is BC after the dirty magic hack introduction
+        if ($properties = get_object_vars($dataobject)) {
+            $dataobject = (object)$properties;
+        }
+        unset($properties);
+    }
+
+/// Extra protection against SQL injections
+    foreach((array)$dataobject as $k=>$v) {
+        $dataobject->$k = sql_magic_quotes_hack($v);
     }
 
     // Remove this record from record cache since it will change
@@ -1755,7 +1782,7 @@ function sql_paging_limit($page, $recordsperpage) {
  *
  * Note the LIKE are case sensitive for Oracle. Oracle 10g is required to use
  * the caseinsensitive search using regexp_like() or NLS_COMP=LINGUISTIC :-(
- * See http://docs.moodle.org/en/XMLDB_Problems#Case-insensitive_searches
+ * See http://docs.moodle.org/19/en/XMLDB_Problems#Case-insensitive_searches
  *
  * @uses $CFG
  * @return string
@@ -2223,6 +2250,38 @@ function sql_ceil($fieldname) {
     }
 }
 
+/**
+ * This hack prevents some types of SQL injections, no code should rely on this,
+ * do not forget to use addslashes() and addslashes_recursive() properly!
+ *
+ * The performance cost is negligible considering the security benefits and DB requests cost.
+ *
+ * @param mixed $value sql parameter value (hopefully with magic quotes)
+ * @return mixed sanitised value - added magic quotes if accidentally missing
+ */
+function sql_magic_quotes_hack($value) {
+    if ($value === null or $value === '') {
+        // performance shortcut
+        return $value;
+    }
+
+    // ignore stuff that can not be converted to string, catchable fatal error will be displayed elsewhere,
+    // this is intentional because we want to get the same errors as before this magic hack
+    if (is_object($value)) {
+        if (!method_exists($value, '__toString')) {
+            // ignore - we can not cast object to string, error will be triggered elsewhere
+            return $value;
+        }
+    } else if (!is_string($value)) {
+        // no sql injection possible in other non-string values
+        return $value;
+    }
+
+    // note: this does not change content if the content is properly escaped,
+    // the result is different only for strings with missing magic quotes!
+    return addslashes(stripslashes($value));
+}
+
 /**
  * Prepare a SQL WHERE clause to select records where the given fields match the given values.
  *
@@ -2238,6 +2297,9 @@ function sql_ceil($fieldname) {
  * @param string $value3 the value field3 must have (requred if field3 is given, else optional).
  */
 function where_clause($field1='', $value1='', $field2='', $value2='', $field3='', $value3='') {
+    $value1 = sql_magic_quotes_hack($value1);
+    $value2 = sql_magic_quotes_hack($value2);
+    $value3 = sql_magic_quotes_hack($value3);
     if ($field1) {
         $select = is_null($value1) ? "WHERE $field1 IS NULL" : "WHERE $field1 = '$value1'";
         if ($field2) {

lib/form/password.php

@@ -15,6 +15,21 @@ class MoodleQuickForm_password extends HTML_QuickForm_password{
      */
     var $_helpbutton='';
     function MoodleQuickForm_password($elementName=null, $elementLabel=null, $attributes=null) {
+        global $CFG;
+        if (empty($CFG->xmlstrictheaders)) {
+            // no standard mform in moodle should allow autocomplete of passwords
+            // this is valid attribute in html5, sorry, we have to ignore validation errors in legacy xhtml 1.0
+            if (empty($attributes)) {
+                $attributes = array('autocomplete'=>'off');
+            } else if (is_array($attributes)) {
+                $attributes['autocomplete'] = 'off';
+            } else {
+                if (strpos($attributes, 'autocomplete') === false) {
+                    $attributes .= ' autocomplete="off" ';
+                }
+            }
+        }
+
         parent::HTML_QuickForm_password($elementName, $elementLabel, $attributes);
     }
     /**
@@ -48,4 +63,4 @@ class MoodleQuickForm_password extends HTML_QuickForm_password{
         return $this->_helpbutton;
     }
 }
-?>
+?>

lib/form/passwordunmask.php

@@ -15,6 +15,21 @@ require_once($CFG->libdir.'/form/password.php');
 class MoodleQuickForm_passwordunmask extends MoodleQuickForm_password {
 
     function MoodleQuickForm_passwordunmask($elementName=null, $elementLabel=null, $attributes=null) {
+        global $CFG;
+        if (empty($CFG->xmlstrictheaders)) {
+            // no standard mform in moodle should allow autocomplete of passwords
+            // this is valid attribute in html5, sorry, we have to ignore validation errors in legacy xhtml 1.0
+            if (empty($attributes)) {
+                $attributes = array('autocomplete'=>'off');
+            } else if (is_array($attributes)) {
+                $attributes['autocomplete'] = 'off';
+            } else {
+                if (strpos($attributes, 'autocomplete') === false) {
+                    $attributes .= ' autocomplete="off" ';
+                }
+            }
+        }
+
         parent::MoodleQuickForm_password($elementName, $elementLabel, $attributes);
     }
 

lib/form/recaptcha.php

@@ -33,10 +33,13 @@ class MoodleQuickForm_recaptcha extends HTML_QuickForm_input {
      * </code>
      */
     function MoodleQuickForm_recaptcha($elementName = null, $elementLabel = null, $attributes = null) {
+        global $CFG;
         parent::HTML_QuickForm_input($elementName, $elementLabel, $attributes);
         $this->_type = 'recaptcha';
-        if (!empty($attributes['https'])) {
-            $this->_https = $attributes['https'];
+        if (!empty($attributes['https']) or strpos($CFG->httpswwwroot, 'https:') === 0) {
+            $this->_https = true;
+        } else {
+            $this->_https = false;
         }
     }
 

lib/formslib.php

@@ -106,6 +106,21 @@ class moodleform {
      * @return moodleform
      */
     function moodleform($action=null, $customdata=null, $method='post', $target='', $attributes=null, $editable=true) {
+        global $CFG;
+        if (empty($CFG->xmlstrictheaders)) {
+            // no standard mform in moodle should allow autocomplete with the exception of user signup
+            // this is valid attribute in html5, sorry, we have to ignore validation errors in legacy xhtml 1.0
+            if (empty($attributes)) {
+                $attributes = array('autocomplete'=>'off');
+            } else if (is_array($attributes)) {
+                $attributes['autocomplete'] = 'off';
+            } else {
+                if (strpos($attributes, 'autocomplete') === false) {
+                    $attributes .= ' autocomplete="off" ';
+                }
+            }
+        }
+
         if (empty($action)){
             $action = strip_querystring(qualified_me());
         }
@@ -1145,6 +1160,10 @@ class MoodleQuickForm extends HTML_QuickForm_DHTMLRulesTableless {
             }
         }
 
+        if (is_array($this->_constantValues)) {
+            $unfiltered = HTML_QuickForm::arrayMerge($unfiltered, $this->_constantValues);
+        }
+
         if ($addslashes){
             return $this->_recursiveFilter('addslashes', $unfiltered);
         } else {
@@ -1482,7 +1501,7 @@ function validate_' . $this->_formName . '(frm) {
         } else if (is_a($element, 'HTML_QuickForm_hidden')) {
             return array();
 
-        } else if (method_exists($element, 'getPrivateName')) {
+        } else if (method_exists($element, 'getPrivateName') && !($element instanceof HTML_QuickForm_advcheckbox)) {
             return array($element->getPrivateName());
 
         } else {

lib/html2text.php

@@ -341,7 +341,7 @@ class html2text
      */
     function html2text( $source = '', $from_file = false, $do_links = true, $width = 75 )
     {
-        if ( !empty($source) ) {
+        if ($source !== '') {
             $this->set_html($source, $from_file);
         }
 

lib/html2text_readme.txt

@@ -82,3 +82,18 @@ Index: lib/html2text.php
  }
 
 -- Tim Hunt 2010-11-02
+
+4 - Make sure html2text does not destroy '0'.
+
+index e2d0dff..9cc213d 100644
+--- a/lib/html2text.php
++++ b/lib/html2text.php
+@@ -335,7 +335,7 @@ class html2text
+      */
+     function html2text( $source = '', $from_file = false, $do_links = true, $wi     {
+-        if ( !empty($source) ) {
++        if ($source !== '') {
+             $this->set_html($source, $from_file);
+         }
+
+-- Tim Hunt 2011-09-21

lib/javascript-static.js

@@ -427,13 +427,14 @@ function unmaskPassword(id) {
   try {
     // first try IE way - it can not set name attribute later
     if (chb.checked) {
-      var newpw = document.createElement('<input type="text" name="'+pw.name+'">');
+      var newpw = document.createElement('<input type="text" autocomplete="off" name="'+pw.name+'">');
     } else {
-      var newpw = document.createElement('<input type="password" name="'+pw.name+'">');
+      var newpw = document.createElement('<input type="password" autocomplete="off" name="'+pw.name+'">');
     }
     newpw.attributes['class'].nodeValue = pw.attributes['class'].nodeValue;
   } catch (e) {
     var newpw = document.createElement('input');
+    newpw.setAttribute('autocomplete', 'off');
     newpw.setAttribute('name', pw.name);
     if (chb.checked) {
       newpw.setAttribute('type', 'text');

lib/locallib.php

@@ -27,7 +27,7 @@
  *
  * These are similar to the module interface, however, not all the the
  * facilities that are available to modules are available to local code (yet).
- * See also http://docs.moodle.org/en/Development:Local_customisation for more
+ * See also http://docs.moodle.org/dev/Local_customisation for more
  * information.
  *
  *
@@ -81,7 +81,7 @@
  * lang/en_utf8_local/moodle.php containing
  *   $strings['login'] = 'Sign in';
  * and that will change the string 'Login' to 'Sign in'. (See also
- * http://docs.moodle.org/en/Language_editing for another way to achieve this.)
+ * http://docs.moodle.org/19/en/Language_editing for another way to achieve this.)
  *
  * This mechanism can also be used to create completely new language files. For
  * example, suppose you have created some code in local/myfeature.php that needs

lib/moodlelib.php

@@ -1115,27 +1115,28 @@ function get_user_preferences($name=NULL, $default=NULL, $otheruserid=NULL) {
  * @param int $hour The hour part to create timestamp of
  * @param int $minute The minute part to create timestamp of
  * @param int $second The second part to create timestamp of
- * @param float $timezone ?
- * @param bool $applydst ?
+ * @param mixed $timezone Timezone modifier, if 99 then use default user's timezone
+ * @param bool $applydst Toggle Daylight Saving Time, default true, will be 
+ *             applied only if timezone is 99 or string.
  * @return int timestamp
  * @todo Finish documenting this function
  */
 function make_timestamp($year, $month=1, $day=1, $hour=0, $minute=0, $second=0, $timezone=99, $applydst=true) {
 
-    $strtimezone = NULL;
-    if (!is_numeric($timezone)) {
-        $strtimezone = $timezone;
-    }
+    //save input timezone, required for dst offset check.
+    $passedtimezone = $timezone;
 
     $timezone = get_user_timezone_offset($timezone);
 
-    if (abs($timezone) > 13) {
+    if (abs($timezone) > 13) {  //server time
         $time = mktime((int)$hour, (int)$minute, (int)$second, (int)$month, (int)$day, (int)$year);
     } else {
         $time = gmmktime((int)$hour, (int)$minute, (int)$second, (int)$month, (int)$day, (int)$year);
         $time = usertime($time, $timezone);
-        if($applydst) {
-            $time -= dst_offset_on($time, $strtimezone);
+
+        //Apply dst for string timezones or if 99 then try dst offset with user's default timezone
+        if ($applydst && ((99 == $passedtimezone) || !is_numeric($passedtimezone))) {
+            $time -= dst_offset_on($time, $passedtimezone);
         }
     }
 
@@ -1222,7 +1223,8 @@ function make_timestamp($year, $month=1, $day=1, $hour=0, $minute=0, $second=0,
  * @uses HOURSECS
  * @param  int $date timestamp in GMT
  * @param string $format strftime format
- * @param float $timezone
+ * @param mixed $timezone by default, uses the user's time zone. if numeric and
+ *      not 99 then daylight saving will not be added.
  * @param bool $fixday If true (default) then the leading
  * zero from %d is removed. If false then the leading zero is mantained.
  * @return string
@@ -1231,11 +1233,6 @@ function userdate($date, $format='', $timezone=99, $fixday = true) {
 
     global $CFG;
 
-    $strtimezone = NULL;
-    if (!is_numeric($timezone)) {
-        $strtimezone = $timezone;
-    }
-
     if (empty($format)) {
         $format = get_string('strftimedaydatetime');
     }
@@ -1247,7 +1244,11 @@ function userdate($date, $format='', $timezone=99, $fixday = true) {
         $fixday = ($formatnoday != $format);
     }
 
-    $date += dst_offset_on($date, $strtimezone);
+    //add daylight saving offset for string timezones only, as we can't get dst for
+    //float values. if timezone is 99 (user default timezone), then try update dst.
+    if ((99 == $timezone) || !is_numeric($timezone)) {
+        $date += dst_offset_on($date, $timezone);
+    }
 
     $timezone = get_user_timezone_offset($timezone);
 
@@ -1289,16 +1290,15 @@ function userdate($date, $format='', $timezone=99, $fixday = true) {
  *
  * @uses HOURSECS
  * @param int $time Timestamp in GMT
- * @param float $timezone ?
+ * @param mixed $timezone offset time with timezone, if float and not 99, then no
+ *        dst offset is applyed
  * @return array An array that represents the date in user time
  * @todo Finish documenting this function
  */
 function usergetdate($time, $timezone=99) {
 
-    $strtimezone = NULL;
-    if (!is_numeric($timezone)) {
-        $strtimezone = $timezone;
-    }
+    //save input timezone, required for dst offset check.
+    $passedtimezone = $timezone;
 
     $timezone = get_user_timezone_offset($timezone);
 
@@ -1306,8 +1306,12 @@ function usergetdate($time, $timezone=99) {
         return getdate($time);
     }
 
-    // There is no gmgetdate so we use gmdate instead
-    $time += dst_offset_on($time, $strtimezone);
+    //add daylight saving offset for string timezones only, as we can't get dst for
+    //float values. if timezone is 99 (user default timezone), then try update dst.
+    if ($passedtimezone == 99 || !is_numeric($passedtimezone)) {
+        $time += dst_offset_on($time, $passedtimezone);
+    }
+
     $time += intval((float)$timezone * HOURSECS);
 
     $datestring = gmstrftime('%B_%A_%j_%Y_%m_%w_%d_%H_%M_%S', $time);
@@ -1456,7 +1460,7 @@ function get_timezone_offset($tz) {
  *
  * @uses $USER
  * @uses $CFG
- * @param float $tz If this value is provided and not equal to 99, it will be returned as is and no other settings will be checked
+ * @param mixed $tz If this value is provided and not equal to 99, it will be returned as is and no other settings will be checked
  * @return mixed
  */
 function get_user_timezone($tz = 99) {
@@ -2737,13 +2741,13 @@ function set_moodle_cookie($thing) {
         return;
     }
 
-    $cookiename = 'MOODLEID_'.$CFG->sessioncookie;
+    $cookiename = 'MOODLEID1_'.$CFG->sessioncookie;
 
     $days = 60;
     $seconds = DAYSECS*$days;
 
     setCookie($cookiename, '', time() - HOURSECS, $CFG->sessioncookiepath, $CFG->sessioncookiedomain, $CFG->cookiesecure);
-    setCookie($cookiename, rc4encrypt($thing), time()+$seconds, $CFG->sessioncookiepath, $CFG->sessioncookiedomain, $CFG->cookiesecure);
+    setCookie($cookiename, rc4encrypt($thing, true), time()+$seconds, $CFG->sessioncookiepath, $CFG->sessioncookiedomain, $CFG->cookiesecure);
 }
 
 /**
@@ -2755,12 +2759,12 @@ function set_moodle_cookie($thing) {
 function get_moodle_cookie() {
     global $CFG;
 
-    $cookiename = 'MOODLEID_'.$CFG->sessioncookie;
+    $cookiename = 'MOODLEID1_'.$CFG->sessioncookie;
 
     if (empty($_COOKIE[$cookiename])) {
         return '';
     } else {
-        $thing = rc4decrypt($_COOKIE[$cookiename]);
+        $thing = rc4decrypt($_COOKIE[$cookiename], true);
         return ($thing == 'guest') ? '': $thing;  // Ignore guest account
     }
 }
@@ -6020,25 +6024,33 @@ function get_list_of_currencies() {
 /**
  * rc4encrypt
  *
- * @param string $data ?
- * @return string
- * @todo Finish documenting this function
+ * @param string $data        Data to encrypt.
+ * @param bool $usesecurekey  Lets us know if we are using the old or new password.
+ * @return string             The now encrypted data.
  */
-function rc4encrypt($data) {
-    $password = 'nfgjeingjk';
-    return endecrypt($password, $data, '');
+function rc4encrypt($data, $usesecurekey = false) {
+    if (!$usesecurekey) {
+        $passwordkey = 'nfgjeingjk';
+    } else {
+        $passwordkey = get_site_identifier();
+    }
+    return endecrypt($passwordkey, $data, '');
 }
 
 /**
  * rc4decrypt
  *
- * @param string $data ?
- * @return string
- * @todo Finish documenting this function
+ * @param string $data        Data to decrypt.
+ * @param bool $usesecurekey  Lets us know if we are using the old or new password.
+ * @return string             The now decrypted data.
  */
-function rc4decrypt($data) {
-    $password = 'nfgjeingjk';
-    return endecrypt($password, $data, 'de');
+function rc4decrypt($data, $usesecurekey = false) {
+    if (!$usesecurekey) {
+        $passwordkey = 'nfgjeingjk';
+    } else {
+        $passwordkey = get_site_identifier();
+    }
+    return endecrypt($passwordkey, $data, 'de');
 }
 
 /**
@@ -7079,12 +7091,17 @@ function generate_password($maxlen=10) {
         $filler1 = $fillers[rand(0, strlen($fillers) - 1)];
         $password = $word1 . $filler1 . $word2;
     } else {
-        $maxlen = !empty($CFG->minpasswordlength) ? $CFG->minpasswordlength : 0;
+        $minlen = !empty($CFG->minpasswordlength) ? $CFG->minpasswordlength : 0;
         $digits = $CFG->minpassworddigits;
         $lower = $CFG->minpasswordlower;
         $upper = $CFG->minpasswordupper;
         $nonalphanum = $CFG->minpasswordnonalphanum;
-        $additional = $maxlen - ($lower + $upper + $digits + $nonalphanum);
+        $total = $lower + $upper + $digits + $nonalphanum;
+        // minlength should be the greater one of the two ( $minlen and $total )
+        $minlen = $minlen < $total ? $total : $minlen;
+        // maxlen can never be smaller than minlen
+        $maxlen = $minlen > $maxlen ? $minlen : $maxlen;
+        $additional = $maxlen - $total;
 
         // Make sure we have enough characters to fulfill
         // complexity requirements

lib/olson.php

@@ -664,6 +664,7 @@ function olson_parse_at ($at, $set = 'set', $gmtoffset) {
         $at  = substr($at, 0, strlen($at)-1); // chop
     }
 
+    $at = (strpos($at, ':') === false) ? $at . ':0' : $at;
     list($hours, $mins) = explode(':', $at);
 
     // GMT -- return as is!

lib/phpmailer/class.phpmailer.php

@@ -653,11 +653,11 @@ class PHPMailer
      */
     function AddrFormat($addr) {
         if(empty($addr[1]))
-            $formatted = $addr[0];
+            $formatted = preg_replace('/[\r\n]+/', '', $addr[0]); // Moodle modification
         else
         {
-            $formatted = $this->EncodeHeader($addr[1], 'phrase') . " <" . 
-                         $addr[0] . ">";
+            $formatted = $this->EncodeHeader($addr[1], 'phrase') . " <" .
+                         preg_replace('/[\r\n]+/', '', $addr[0]) . ">"; // Moodle modification
         }
 
         return $formatted;
@@ -780,9 +780,9 @@ class PHPMailer
 
         $result .= $this->HeaderLine("Date", $this->RFCDate());
         if($this->Sender == "")
-            $result .= $this->HeaderLine("Return-Path", trim($this->From));
+            $result .= $this->HeaderLine("Return-Path", trim(preg_replace('/[\r\n]+/', '', $this->From))); // Moodle modification
         else
-            $result .= $this->HeaderLine("Return-Path", trim($this->Sender));
+            $result .= $this->HeaderLine("Return-Path", trim(preg_replace('/[\r\n]+/', '', $this->Sender))); // Moodle modification
         
         // To be created automatically by mail()
         if($this->Mailer != "mail")
@@ -1190,7 +1190,10 @@ class PHPMailer
      */
     function EncodeHeader ($str, $position = 'text') {
 
-    /// Start Moodle Hack - do our own multibyte-safe header encoding
+    /// Start Moodle Hack - do our own multibyte-safe header encoding and cleanup
+        $str = str_replace("\r", '', $str);
+        $str = str_replace("\n", '', $str);
+
         $textlib = textlib_get_instance();
         $encoded = $textlib->encode_mimeheader($str, $this->CharSet);
         if ($encoded !== false) {

lib/recaptchalib.php

@@ -2,13 +2,13 @@
 /*
  * This is a PHP library that handles calling reCAPTCHA.
  *    - Documentation and latest version
- *          http://recaptcha.net/plugins/php/
+ *          {@link http://code.google.com/apis/recaptcha/docs/php.html}
  *    - Get a reCAPTCHA API Key
- *          http://recaptcha.net/api/getkey
+ *          {@link https://www.google.com/recaptcha/admin/create}
  *    - Discussion group
  *          http://groups.google.com/group/recaptcha
  *
- * Copyright (c) 2007 reCAPTCHA -- http://recaptcha.net
+ * Copyright (c) 2007 reCAPTCHA -- {@link http://www.google.com/recaptcha}
  * AUTHORS:
  *   Mike Crawford
  *   Ben Maurer
@@ -30,14 +30,17 @@
  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
+ *
+ * @package moodlecore
+ * @copyright (c) 2007 reCAPTCHA -- {@link http://www.google.com/recaptcha}
  */
 
 /**
  * The reCAPTCHA server URL's
  */
-define("RECAPTCHA_API_SERVER", "http://api.recaptcha.net");
-define("RECAPTCHA_API_SECURE_SERVER", "https://api-secure.recaptcha.net");
-define("RECAPTCHA_VERIFY_SERVER", "api-verify.recaptcha.net");
+define("RECAPTCHA_API_SERVER", "http://www.google.com/recaptcha/api");
+define("RECAPTCHA_API_SECURE_SERVER", "https://www.google.com/recaptcha/api");
+define("RECAPTCHA_VERIFY_SERVER", "www.google.com");
 
 /**
  * Encodes the given data into a query string format
@@ -107,15 +110,15 @@ function recaptcha_get_html ($pubkey, $error = null, $use_ssl = false) {
 
     $recaptchatype = optional_param('recaptcha', 'image', PARAM_TEXT);
 
-	if ($pubkey == null || $pubkey == '') {
-		die ("To use reCAPTCHA you must get an API key from <a href='http://recaptcha.net/api/getkey'>http://recaptcha.net/api/getkey</a>");
-	}
-	
-	if ($use_ssl) {
-                $server = RECAPTCHA_API_SECURE_SERVER;
-        } else {
-                $server = RECAPTCHA_API_SERVER;
-        }
+    if ($pubkey == null || $pubkey == '') {
+		die ("To use reCAPTCHA you must get an API key from <a href='https://www.google.com/recaptcha/admin/create'>https://www.google.com/recaptcha/admin/create</a>");
+    }
+
+    if ($use_ssl) {
+        $server = RECAPTCHA_API_SECURE_SERVER;
+    } else {
+        $server = RECAPTCHA_API_SERVER;
+    }
 
         $errorpart = "";
         if ($error) {
@@ -175,6 +178,9 @@ function recaptcha_get_html ($pubkey, $error = null, $use_ssl = false) {
 
 /**
  * A ReCaptchaResponse is returned from recaptcha_check_answer()
+ *
+ * @package moodlecore
+ * @copyright (c) 2007 reCAPTCHA -- {@link http://www.google.com/recaptcha}
  */
 class ReCaptchaResponse {
         var $is_valid;
@@ -192,9 +198,9 @@ class ReCaptchaResponse {
   */
 function recaptcha_check_answer ($privkey, $remoteip, $challenge, $response, $https=false)
 {
-	if ($privkey == null || $privkey == '') {
-		die ("To use reCAPTCHA you must get an API key from <a href='http://recaptcha.net/api/getkey'>http://recaptcha.net/api/getkey</a>");
-	}
+    if ($privkey == null || $privkey == '') {
+		die ("To use reCAPTCHA you must get an API key from <a href='https://www.google.com/recaptcha/admin/create'>https://www.google.com/recaptcha/admin/create</a>");
+    }
 
 	if ($remoteip == null || $remoteip == '') {
 		die ("For security reasons, you must pass the remote ip to reCAPTCHA");
@@ -210,12 +216,12 @@ function recaptcha_check_answer ($privkey, $remoteip, $challenge, $response, $ht
                 return $recaptcha_response;
         }
 
-        $response = _recaptcha_http_post (RECAPTCHA_VERIFY_SERVER, "/verify",
-                                          array (
-                                                 'privatekey' => $privkey,
-                                                 'remoteip' => $remoteip,
-                                                 'challenge' => $challenge,
-                                                 'response' => $response
+        $response = _recaptcha_http_post(RECAPTCHA_VERIFY_SERVER, "/recaptcha/api/verify",
+                                         array (
+                                                'privatekey' => $privkey,
+                                                'remoteip' => $remoteip,
+                                                'challenge' => $challenge,
+                                                'response' => $response
                                                 ),
                                          $https        
                                           );
@@ -242,7 +248,7 @@ function recaptcha_check_answer ($privkey, $remoteip, $challenge, $response, $ht
  * @param string $appname The name of your application
  */
 function recaptcha_get_signup_url ($domain = null, $appname = null) {
-	return "http://recaptcha.net/api/getkey?" .  _recaptcha_qsencode (array ('domain' => $domain, 'app' => $appname));
+	return "https://www.google.com/recaptcha/admin/create?" .  _recaptcha_qsencode (array ('domains' => $domain, 'app' => $appname));
 }
 
 function _recaptcha_aes_pad($val) {
@@ -270,16 +276,16 @@ function _recaptcha_mailhide_urlbase64 ($x) {
 
 /* gets the reCAPTCHA Mailhide url for a given email, public key and private key */
 function recaptcha_mailhide_url($pubkey, $privkey, $email) {
-	if ($pubkey == '' || $pubkey == null || $privkey == "" || $privkey == null) {
-		die ("To use reCAPTCHA Mailhide, you have to sign up for a public and private key, " .
-		     "you can do so at <a href='http://mailhide.recaptcha.net/apikey'>http://mailhide.recaptcha.net/apikey</a>");
-	}
-	
+    if ($pubkey == '' || $pubkey == null || $privkey == "" || $privkey == null) {
+        die ("To use reCAPTCHA Mailhide, you have to sign up for a public and private key, " .
+		     "you can do so at <a href='http://www.google.com/recaptcha/mailhide/apikey'>http://www.google.com/recaptcha/mailhide/apikey</a>");
+    }
 
-	$ky = pack('H*', $privkey);
-	$cryptmail = _recaptcha_aes_encrypt ($email, $ky);
-	
-	return "http://mailhide.recaptcha.net/d?k=" . $pubkey . "&c=" . _recaptcha_mailhide_urlbase64 ($cryptmail);
+
+    $ky = pack('H*', $privkey);
+    $cryptmail = _recaptcha_aes_encrypt ($email, $ky);
+
+	return "http://www.google.com/recaptcha/mailhide/d?k=" . $pubkey . "&c=" . _recaptcha_mailhide_urlbase64 ($cryptmail);
 }
 
 /**
@@ -304,7 +310,7 @@ function _recaptcha_mailhide_email_parts ($email) {
  * Gets html to display an email address given a public an private key.
  * to get a key, go to:
  *
- * http://mailhide.recaptcha.net/apikey
+ * http://www.google.com/recaptcha/mailhide/apikey
  */
 function recaptcha_mailhide_html($pubkey, $privkey, $email) {
 	$emailparts = _recaptcha_mailhide_email_parts ($email);

lib/rsslib.php

@@ -521,7 +521,7 @@ function rss_get_form($act='none', $url='', $rssid='', $preferredtitle='', $shar
     $returnstring .= '<input type="hidden" name="user" value="'. $USER->id .'" />'."\n";
     $returnstring .= '<input type="hidden" name="sesskey" value="'. sesskey() .'" />'."\n";
     $returnstring .= '<br /><input type="submit" value="';
-    $validatestring = "<a href=\"#\" onclick=\"window.open('http://feedvalidator.org/check.cgi?url='+getElementById('block_rss').elements['url'].value,'validate','width=640,height=480,scrollbars=yes,status=yes,resizable=yes');return true;\">". get_string('validatefeed', 'block_rss_client')."</a>";
+    $validatestring = "<a href=\"#\" onclick=\"window.open('http://feedvalidator.org/check.cgi?url='+escape(getElementById('block_rss').elements['url'].value),'validate','width=640,height=480,scrollbars=yes,status=yes,resizable=yes');return true;\">". get_string('validatefeed', 'block_rss_client')."</a>";
 
     if ($act == 'rssedit') {
         $returnstring .= $stredit;

lib/simpletest/testdmllib.php

@@ -356,6 +356,23 @@ class dmllib_test extends prefix_changing_test_case {
 
 
     }
+
+    function test_magic_hack() {
+        // test hacky sql injection protection - the resulting DB data is not really important,
+        // we only want to prevent SQL injections/DB errors
+
+        $obj = new stdClass();
+        $obj->textfield = 'lala\'';
+        $obj->id = insert_record($this->table, $obj);
+        $this->assertFalse(empty($obj->id));
+
+        $obj->textfield = 'lala\\';
+        $res = update_record($this->table, $obj);
+        $this->assertTrue($res);
+
+        $obj = get_record($this->table, 'textfield', 'lala\\');
+        $this->assertFalse(empty($obj));
+    }
 }
 
 ?>

lib/simpletest/testmoodlelib.php

@@ -255,7 +255,14 @@ class moodlelib_test extends UnitTestCase {
     }
     
     function test_usergetdate() {
-        global $USER;
+        global $USER, $CFG;
+
+        //Check if forcetimezone is set then save it and set it to use user timezone
+        $cfgforcetimezone = null;
+        if (isset($CFG->forcetimezone)) {
+            $cfgforcetimezone = $CFG->forcetimezone;
+            $CFG->forcetimezone = 99; //get user default timezone.
+        }
 
         $userstimezone = $USER->timezone;
         $USER->timezone = 2;//set the timezone to a known state
@@ -292,9 +299,214 @@ class moodlelib_test extends UnitTestCase {
         $this->assertEqual($weekday,'Wednesday');
         $this->assertEqual($month,'December');
 
+        //restore forcetimezone if changed.
+        if (!is_null($cfgforcetimezone)) {
+            $CFG->forcetimezone = $cfgforcetimezone;
+        }
+
         //set the timezone back to what it was
         $USER->timezone = $userstimezone;
     }
 
+    public function test_userdate() {
+        global $USER, $CFG;
+
+        $testvalues = array(
+            array(
+                'time' => '1309514400',
+                'usertimezone' => 'America/Moncton',
+                'timezone' => '0.0', //no dst offset
+                'expectedoutput' => 'Friday, 1 July 2011, 10:00 AM'
+            ),
+            array(
+                'time' => '1293876000 ',
+                'usertimezone' => 'America/Moncton',
+                'timezone' => '0.0', //no dst offset
+                'expectedoutput' => 'Saturday, 1 January 2011, 10:00 AM'
+            ),
+            array(
+                'time' => '1293876000 ',
+                'usertimezone' => 'America/Moncton',
+                'timezone' => '99', //no dst offset in jan, so just timezone offset.
+                'expectedoutput' => 'Saturday, 1 January 2011, 06:00 AM'
+            ),
+            array(
+                'time' => '1293876000 ',
+                'usertimezone' => 'America/Moncton',
+                'timezone' => 'America/Moncton', //no dst offset in jan
+                'expectedoutput' => 'Saturday, 1 January 2011, 06:00 AM'
+            ),
+            array(
+                'time' => '1293876000 ',
+                'usertimezone' => '2',
+                'timezone' => '99', //take user timezone
+                'expectedoutput' => 'Saturday, 1 January 2011, 12:00 PM'
+            ),
+            array(
+                'time' => '1293876000 ',
+                'usertimezone' => '-2',
+                'timezone' => '99', //take user timezone
+                'expectedoutput' => 'Saturday, 1 January 2011, 08:00 AM'
+            ),
+            array(
+                'time' => '1293876000 ',
+                'usertimezone' => '-10',
+                'timezone' => '2', //take this timezone
+                'expectedoutput' => 'Saturday, 1 January 2011, 12:00 PM'
+            ),
+            array(
+                'time' => '1293876000 ',
+                'usertimezone' => '-10',
+                'timezone' => '-2', //take this timezone
+                'expectedoutput' => 'Saturday, 1 January 2011, 08:00 AM'
+            )
+        );
+
+        //Check if forcetimezone is set then save it and set it to use user timezone
+        $cfgforcetimezone = null;
+        if (isset($CFG->forcetimezone)) {
+            $cfgforcetimezone = $CFG->forcetimezone;
+            $CFG->forcetimezone = 99; //get user default timezone.
+        }
+        //store user default timezone to restore later
+        $userstimezone = $USER->timezone;
+
+        // The string version of date comes from server locale setting and does
+        // not respect user language, so it is necessary to reset that.
+        $oldlocale = setlocale(LC_TIME, '0');
+        setlocale(LC_TIME, 'en_AU.UTF-8');
+
+        //get instance of textlib for strtolower
+        $textlib = textlib_get_instance();
+        foreach ($testvalues as $vals) {
+            $USER->timezone = $vals['usertimezone'];
+            $actualoutput = userdate($vals['time'], '%A, %d %B %Y, %I:%M %p', $vals['timezone']);
+
+            //On different systems case of AM PM changes so compare case insenitive
+            $vals['expectedoutput'] = $textlib->strtolower($vals['expectedoutput']);
+            $actualoutput = $textlib->strtolower($actualoutput);
+
+            $this->assertEqual($vals['expectedoutput'], $actualoutput,
+                "Expected: {$vals['expectedoutput']} => Actual: {$actualoutput},
+                Please check if timezones are updated (Site adminstration -> location -> update timezone)");
+        }
+
+        //restore user timezone back to what it was
+        $USER->timezone = $userstimezone;
+
+        //restore forcetimezone
+        if (!is_null($cfgforcetimezone)) {
+            $CFG->forcetimezone = $cfgforcetimezone;
+        }
+
+        //restore system default values.
+        setlocale(LC_TIME, $oldlocale);
+    }
+
+    public function test_make_timestamp() {
+        global $USER, $CFG;
+
+        $testvalues = array(
+            array(
+                'usertimezone' => '2',//no dst applyed
+                'year' => '2011',
+                'month' => '7',
+                'day' => '1',
+                'hour' => '10',
+                'minutes' => '00',
+                'seconds' => '00',
+                'timezone' => '99', //take user timezone
+                'applydst' => true, //apply dst
+                'expectedoutput' => '1309507200'
+            ),
+            array(
+                'usertimezone' => '-2',//no dst applyed
+                'year' => '2011',
+                'month' => '7',
+                'day' => '1',
+                'hour' => '10',
+                'minutes' => '00',
+                'seconds' => '00',
+                'timezone' => '99', //take usertimezone
+                'applydst' => true, //apply dst
+                'expectedoutput' => '1309521600'
+            ),
+            array(
+                'usertimezone' => '-10',//no dst applyed
+                'year' => '2011',
+                'month' => '7',
+                'day' => '1',
+                'hour' => '10',
+                'minutes' => '00',
+                'seconds' => '00',
+                'timezone' => '2', //take this timezone
+                'applydst' => true, //apply dst
+                'expectedoutput' => '1309507200'
+            ),
+            array(
+                'usertimezone' => '-10',//no dst applyed
+                'year' => '2011',
+                'month' => '7',
+                'day' => '1',
+                'hour' => '10',
+                'minutes' => '00',
+                'seconds' => '00',
+                'timezone' => '-2', //take this timezone
+                'applydst' => true, //apply dst,
+                'expectedoutput' => '1309521600'
+            )
+        );
+
+        //Check if forcetimezone is set then save it and set it to use user timezone
+        $cfgforcetimezone = null;
+        if (isset($CFG->forcetimezone)) {
+            $cfgforcetimezone = $CFG->forcetimezone;
+            $CFG->forcetimezone = 99; //get user default timezone.
+        }
+
+        //store user default timezone to restore later
+        $userstimezone = $USER->timezone;
+
+        // The string version of date comes from server locale setting and does
+        // not respect user language, so it is necessary to reset that.
+        $oldlocale = setlocale(LC_TIME, '0');
+        setlocale(LC_TIME, 'en_AU.UTF-8');
+
+        //get instance of textlib for strtolower
+        $textlib = textlib_get_instance();
+        //Test make_timestamp with all testvals and assert if anything wrong.
+        foreach ($testvalues as $vals) {
+            $USER->timezone = $vals['usertimezone'];
+            $actualoutput = make_timestamp(
+                    $vals['year'],
+                    $vals['month'],
+                    $vals['day'],
+                    $vals['hour'],
+                    $vals['minutes'],
+                    $vals['seconds'],
+                    $vals['timezone'],
+                    $vals['applydst']
+                    );
+
+            //On different systems case of AM PM changes so compare case insenitive
+            $vals['expectedoutput'] = $textlib->strtolower($vals['expectedoutput']);
+            $actualoutput = $textlib->strtolower($actualoutput);
+
+            $this->assertEqual($vals['expectedoutput'], $actualoutput,
+                "Expected: {$vals['expectedoutput']} => Actual: {$actualoutput},
+                Please check if timezones are updated (Site adminstration -> location -> update timezone)");
+        }
+
+        //restore user timezone back to what it was
+        $USER->timezone = $userstimezone;
+
+        //restore forcetimezone
+        if (!is_null($cfgforcetimezone)) {
+            $CFG->forcetimezone = $cfgforcetimezone;
+        }
+
+        //restore system default values.
+        setlocale(LC_TIME, $oldlocale);
+    }
 }
-?>
+?>

lib/simpletest/testweblib.php

@@ -255,5 +255,13 @@ END;
     public function test_html_to_text_dont_screw_up_utf8() {
         $this->assertEqual("\n\nAll the WORLD’S a stage.", html_to_text('<p>All the <strong>world’s</strong> a stage.</p>'));
     }
+
+    public function test_html_to_text_trailing_whitespace() {
+        $this->assertEqual('With trailing whitespace and some more text', html_to_text("With trailing whitespace   \nand some   more text", 0));
+    }
+
+    public function test_html_to_text_0() {
+        $this->assertIdentical('0', html_to_text('0'));
+    }
 }
 ?>

lib/weblib.php

@@ -308,7 +308,7 @@ function qualified_me() {
 /**
  * Class for creating and manipulating urls.
  *
- * See short write up here http://docs.moodle.org/en/Development:lib/weblib.php_moodle_url
+ * See short write up here http://docs.moodle.org/dev/lib/weblib.php_moodle_url
  */
 class moodle_url {
     var $scheme = '';// e.g. http
@@ -5841,12 +5841,20 @@ function print_error($errorcode, $module='error', $link='', $a=NULL, $extralocat
         }
     }
 
+    // when printing an error the continue button should never link offsite
+    if (stripos($link, $CFG->wwwroot) === false &&
+        stripos($link, $CFG->httpswwwroot) === false) {
+        $link = $CFG->wwwroot.'/';
+    }
+
     if (!empty($CFG->errordocroot)) {
-        $errordocroot = $CFG->errordocroot;
-    } else if (!empty($CFG->docroot)) {
-        $errordocroot = $CFG->docroot;
+        $errordoclink = $CFG->errordocroot.'/en';
     } else {
-        $errordocroot = 'http://docs.moodle.org';
+        $errordoclink = get_doc_root();
+        if (is_null($errordoclink)) {
+            $lang = current_language();
+            $errordoclink = 'http://docs.moodle.org/19/'.$lang; //no doc links set. point to default.
+        }
     }
 
     if (defined('FULLME') && FULLME == 'cron') {
@@ -5863,7 +5871,7 @@ function print_error($errorcode, $module='error', $link='', $a=NULL, $extralocat
 
     $message = clean_text('<p class="errormessage">'.$message.'</p>'.
                '<p class="errorcode">'.
-               '<a href="'.$errordocroot.'/en/error/'.$modulelink.'/'.$errorcode.'">'.
+               '<a href="'.$errordoclink.'/error/'.$modulelink.'/'.$errorcode.'">'.
                  get_string('moreinformation').'</a></p>');
 
     if (! defined('HEADER_PRINTED')) {
@@ -6195,8 +6203,35 @@ function redirect($url, $message='', $delay=-1) {
 
     $message = clean_text($message);
 
+    // Technically, HTTP/1.1 requires Location: header to contain the absolute path.
+    // (In practice browsers accept relative paths - but still, might as well do it properly.)
+    // This code turns relative into absolute.
+    if (!preg_match('|^[a-z]+:|', $url)) {
+        // Get host name http://www.wherever.com
+        $hostpart = preg_replace('|^(.*?[^:/])/.*$|', '$1', $CFG->wwwroot);
+        if (preg_match('|^/|', $url)) {
+            // URLs beginning with / are relative to web server root so we just add them in
+            $url = $hostpart.$url;
+        } else {
+            // URLs not beginning with / are relative to path of current script, so add that on.
+            $url = $hostpart.preg_replace('|\?.*$|','',me()).'/../'.$url;
+        }
+        // Replace all ..s
+        while (true) {
+            $newurl = preg_replace('|/(?!\.\.)[^/]*/\.\./|', '/', $url);
+            if ($newurl == $url) {
+                break;
+            }
+            $url = $newurl;
+        }
+    }
+
+    // Sanitise url - we can not rely on our URL cleaning
+    // because it does not support all valid external URLs
+    $url = preg_replace('/[\x00-\x1F\x7F]/', '', $url);
+    $url = str_replace('"', '%22', $url);
     $encodedurl = preg_replace("/\&(?![a-zA-Z0-9#]{1,8};)/", "&amp;", $url);
-    $encodedurl = preg_replace('/^.*href="([^"]*)".*$/', "\\1", clean_text('<a href="'.$encodedurl.'" />'));
+    $encodedurl = preg_replace('/^.*href="([^"]*)".*$/', "\\1", clean_text('<a href="'.$encodedurl.'" />', FORMAT_HTML));
     $url = str_replace('&amp;', '&', $encodedurl);
 
 /// At developer debug level. Don't redirect if errors have been printed on screen.
@@ -6218,31 +6253,6 @@ function redirect($url, $message='', $delay=-1) {
 
 /// when no message and header printed yet, try to redirect
     if (empty($message) and !defined('HEADER_PRINTED')) {
-
-        // Technically, HTTP/1.1 requires Location: header to contain
-        // the absolute path. (In practice browsers accept relative
-        // paths - but still, might as well do it properly.)
-        // This code turns relative into absolute.
-        if (!preg_match('|^[a-z]+:|', $url)) {
-            // Get host name http://www.wherever.com
-            $hostpart = preg_replace('|^(.*?[^:/])/.*$|', '$1', $CFG->wwwroot);
-            if (preg_match('|^/|', $url)) {
-                // URLs beginning with / are relative to web server root so we just add them in
-                $url = $hostpart.$url;
-            } else {
-                // URLs not beginning with / are relative to path of current script, so add that on.
-                $url = $hostpart.preg_replace('|\?.*$|','',me()).'/../'.$url;
-            }
-            // Replace all ..s
-            while (true) {
-                $newurl = preg_replace('|/(?!\.\.)[^/]*/\.\./|', '/', $url);
-                if ($newurl == $url) {
-                    break;
-                }
-                $url = $newurl;
-            }
-        }
-
         $delay = 0;
         //try header redirection first
         @header($_SERVER['SERVER_PROTOCOL'] . ' 303 See Other'); //302 might not work for POST requests, 303 is ignored by obsolete clients
@@ -6957,18 +6967,16 @@ function page_doc_link($text='', $iconpath='') {
 function doc_link($path='', $text='', $iconpath='') {
     global $CFG;
 
-    if (empty($CFG->docroot)) {
-        return '';
-    }
-
     $target = '';
     if (!empty($CFG->doctonewwindow)) {
         $target = ' target="_blank"';
     }
 
-    $lang = str_replace('_utf8', '', current_language());
+    if (is_null($docroot = get_doc_root())) {
+        return '';
+    }
 
-    $str = '<a href="' .$CFG->docroot. '/' .$lang. '/' .$path. '"' .$target. '>';
+    $str = '<a href="' .$docroot. '/' .$path. '"' .$target. '>';
 
     if (empty($iconpath)) {
         $iconpath = $CFG->httpswwwroot . '/pix/docs.gif';
@@ -6980,6 +6988,32 @@ function doc_link($path='', $text='', $iconpath='') {
     return $str;
 }
 
+/**
+ * A function that checks if docroot is set, builds and returns the docs root url according to version release.
+ * @return string documentation url, null if doc root isn't set (ie:during installation perhaps).
+ */
+function get_doc_root() {
+    global $CFG;
+
+    if (empty($CFG->docroot)) {
+        return null;
+    }
+
+    $lang = str_replace('_utf8', '', current_language());
+    if (!empty($CFG->release)) {
+        $release = $CFG->release;
+    } else {
+        //derive branch from the first three letters of version.php's $release with the period taken out.($CFG->release isn't populated yet during upgrade)
+        include($CFG->dirroot.'/version.php');
+    }
+    if (preg_match('/^(.)\.(.)/', $release, $matches)) {
+        $branch = $matches[1].$matches[2];
+    } else {
+        $branch = '.';
+    }
+
+    return $CFG->docroot. '/' .$branch. '/' .$lang;
+}
 
 /**
  * Returns true if the current site debugging settings are equal or above specified level.

lib/xmldb/classes/generators/XMLDBGenerator.class.php

@@ -909,7 +909,7 @@ class XMLDBgenerator {
             return $used_names[$tablename.'-'.$fields.'-'.$suffix];
         }
 
-    /// Use standard naming. See http://docs.moodle.org/en/XMLDB_key_and_index_naming
+    /// Use standard naming. See http://docs.moodle.org/19/en/XMLDB_key_and_index_naming
         $tablearr = explode ('_', $tablename);
         foreach ($tablearr as $table) {
             $name .= substr(trim($table),0,4);

login/change_password.php

@@ -4,6 +4,7 @@
     require_once('change_password_form.php');
 
     $id = optional_param('id', SITEID, PARAM_INT); // current course
+    $return = optional_param('return', 0, PARAM_BOOL); // redirect after password change
 
     $strparticipants = get_string('participants');
 
@@ -12,6 +13,19 @@
 
     $systemcontext = get_context_instance(CONTEXT_SYSTEM);
 
+    if ($return) {
+        // this redirect prevents security warning because https can not POST to http pages
+        if (empty($SESSION->wantsurl)
+                or stripos(str_replace('https://', 'http://', $SESSION->wantsurl), str_replace('https://', 'http://', $CFG->wwwroot.'/login/change_password.php') === 0)) {
+            $returnto = "$CFG->wwwroot/user/view.php?id=$USER->id&course=$id";
+        } else {
+            $returnto = $SESSION->wantsurl;
+        }
+        unset($SESSION->wantsurl);
+
+        redirect($returnto);
+    }
+
     if (!$course = get_record('course', 'id', $id)) {
         error('No such course!');
     }
@@ -19,7 +33,7 @@
     // require proper login; guest user can not change password
     if (empty($USER->id) or isguestuser()) {
         if (empty($SESSION->wantsurl)) {
-            $SESSION->wantsurl = $CFG->httpswwwroot.'/login/change_password.php';
+            $SESSION->wantsurl = $CFG->httpswwwroot.'/login/change_password.php?id=' . $id;
         }
         redirect($CFG->httpswwwroot.'/login/index.php');
     }
@@ -54,7 +68,7 @@
         redirect($changeurl);
     }
 
-    $mform = new login_change_password_form();
+    $mform = new login_change_password_form($CFG->httpswwwroot . '/login/change_password.php');
     $mform->set_data(array('id'=>$course->id));
 
     $navlinks = array();

login/index_form.html

@@ -35,7 +35,7 @@ if ($show_instructions) {
             <div class="clearer"><!-- --></div>
             <div class="form-label"><label for="password"><?php print_string("password") ?></label></div>
             <div class="form-input">
-              <input type="password" name="password" id="password" size="15" value="" />
+              <input type="password" name="password" id="password" size="15" value="" <?php if (!empty($CFG->loginpasswordautocomplete)) {echo 'autocomplete="off"';} ?> />
               <input type="submit" value="<?php print_string("login") ?>" />
               <input type="hidden" name="testcookies" value="1" />
             </div>

login/signup.php

@@ -26,7 +26,7 @@
     //HTTPS is potentially required in this page
     httpsrequired();
 
-    $mform_signup = new login_signup_form();
+    $mform_signup = new login_signup_form(null, null, 'post', '', array('autocomplete'=>'on'));
 
     if ($mform_signup->is_cancelled()) {
         redirect($CFG->httpswwwroot.'/login/index.php');

message/lib.php

@@ -996,7 +996,7 @@ function message_post_message($userfrom, $userto, $message, $format, $messagetyp
                 $messagehtml = NULL;
             }
 
-            if (!empty($preference->message_emailaddress)) {
+            if (!empty($preference->message_emailaddress) and validate_email($preference->message_emailaddress)) {
                 $userto->email = $preference->message_emailaddress;   // Use custom messaging address
             }
 

message/refresh.php

@@ -19,6 +19,12 @@
     $userfullname = strip_tags(required_param('name', PARAM_RAW));
     $wait         = optional_param('wait', MESSAGE_DEFAULT_REFRESH, PARAM_INT);
 
+    if ($wait < 1) {
+        //this should not happen unless someone is manually constructing URLs
+        //allowing a wait of 0 causes continuous GET requests
+        $wait = MESSAGE_DEFAULT_REFRESH;
+    }
+
     $stylesheetshtml = '';
     foreach ($CFG->stylesheets as $stylesheet) {
         $stylesheetshtml .= '<link rel="stylesheet" type="text/css" href="'.$stylesheet.'" />';

mnet/lib.php

@@ -412,10 +412,10 @@ function ip_in_range($address, $network, $mask) {
    $lnetwork  = ip2long($network);
    $laddress  = ip2long($address);
 
-   $binnet    = str_pad( decbin($lnetwork),32,"0","STR_PAD_LEFT" );
+   $binnet    = str_pad( decbin($lnetwork), 32, "0", STR_PAD_LEFT );
    $firstpart = substr($binnet,0,$mask);
 
-   $binip     = str_pad( decbin($laddress),32,"0","STR_PAD_LEFT" );
+   $binip     = str_pad( decbin($laddress), 32, "0", STR_PAD_LEFT );
    $firstip   = substr($binip,0,$mask);
    return(strcmp($firstpart,$firstip)==0);
 }

mnet/xmlrpc/client.php

@@ -335,8 +335,8 @@ class mnet_xmlrpc_client {
 
         // ok, it's signed, but is it signed with the right certificate ?
         // do this *after* we check for an out of date key
-        if (!openssl_verify($this->xmlrpcresponse, base64_decode($sig_parser->signature), 
-                $mnet_peer->public_key)) {
+        $verified = openssl_verify($this->xmlrpcresponse, base64_decode($sig_parser->signature), $mnet_peer->public_key);
+        if ($verified != 1) {
             $this->error[] = 'Invalid signature';
         }
 

mod/assignment/backuplib.php

@@ -44,11 +44,22 @@
     function assignment_backup_one_mod($bf,$preferences,$assignment) {
         
         global $CFG;
-    
+
+        if ($assignment === 0) { //no active instances of assignment to be backed up - skip backup
+            return false;
+        }
+
         if (is_numeric($assignment)) {
             $assignment = get_record('assignment','id',$assignment);
         }
-    
+
+        if (empty($assignment->assignmenttype)) {
+            // No assignment type will cause fatal error below in require_once so bail out now
+            // Probably ended up here by restoring a course into
+            // a moodle without this assignmenttype
+            return false;
+        }
+
         $status = true;
 
         //Start mod

mod/assignment/lib.php

@@ -839,7 +839,9 @@ class assignment_base {
             $select = 'SELECT u.id, u.firstname, u.lastname, u.picture, u.imagealt,
                               s.id AS submissionid, s.grade, s.submissioncomment,
                               s.timemodified, s.timemarked,
-                              COALESCE(SIGN(SIGN(s.timemarked) + SIGN(s.timemarked - s.timemodified)), 0) AS status ';
+                              CASE WHEN s.timemarked > 0 AND s.timemarked >= s.timemodified THEN 1
+                                   ELSE 0 END AS status ';
+
             $sql = 'FROM '.$CFG->prefix.'user u '.
                    'LEFT JOIN '.$CFG->prefix.'assignment_submissions s ON u.id = s.userid
                                                                       AND s.assignment = '.$this->assignment->id.' '.
@@ -851,8 +853,6 @@ class assignment_base {
 
             if (($auser = get_records_sql($select.$sql.$sort, $offset+1, 1)) !== false) {
                 $nextuser = array_shift($auser);
-            /// Calculate user status
-                $nextuser->status = ($nextuser->timemarked > 0) && ($nextuser->timemarked >= $nextuser->timemodified);
                 $nextid = $nextuser->id;
             }
         }
@@ -1168,7 +1168,9 @@ class assignment_base {
         $select = 'SELECT u.id, u.firstname, u.lastname, u.picture, u.imagealt,
                           s.id AS submissionid, s.grade, s.submissioncomment,
                           s.timemodified, s.timemarked,
-                          COALESCE(SIGN(SIGN(s.timemarked) + SIGN(s.timemarked - s.timemodified)), 0) AS status ';
+                          CASE WHEN s.timemarked > 0 AND s.timemarked >= s.timemodified THEN 1
+                               ELSE 0 END AS status ';
+
         $sql = 'FROM '.$CFG->prefix.'user u '.
                'LEFT JOIN '.$CFG->prefix.'assignment_submissions s ON u.id = s.userid
                                                                   AND s.assignment = '.$this->assignment->id.' '.
@@ -1194,8 +1196,6 @@ class assignment_base {
                     $locked_overridden = 'overridden';
                 }
 
-            /// Calculate user status
-                $auser->status = ($auser->timemarked > 0) && ($auser->timemarked >= $auser->timemodified);
                 $picture = print_user_picture($auser, $course->id, $auser->picture, false, true);
 
                 if (empty($auser->submissionid)) {

mod/assignment/type/upload/assignment.class.php

@@ -80,11 +80,6 @@ class assignment_upload extends assignment_base {
         }
 
         if (empty($submission->timemarked)) {   /// Nothing to show, so print nothing
-            if ($this->count_responsefiles($USER->id)) {
-                print_heading(get_string('responsefiles', 'assignment', $this->course->teacher), '', 3);
-                $responsefiles = $this->print_responsefiles($USER->id, true);
-                print_simple_box($responsefiles, 'center');
-            }
             return;
         }
 
@@ -96,7 +91,12 @@ class assignment_upload extends assignment_base {
             return;
         }
 
-        if ($grade->grade === null and empty($grade->str_feedback)) {   /// Nothing to show yet
+        if ($grade->grade === null and empty($grade->str_feedback)) {   // No grades to show yet
+            if ($this->count_responsefiles($USER->id)) {   // but possibly response files to show
+                print_heading(get_string('responsefiles', 'assignment', $this->course->teacher), '', 3);
+                $responsefiles = $this->print_responsefiles($USER->id, true);
+                print_simple_box($responsefiles, 'center');
+            }
             return;
         }
 

mod/choice/db/mysql.php

@@ -70,7 +70,7 @@ function choice_upgrade($oldversion) {
                              PRIMARY KEY  (id), 
                              UNIQUE KEY id (id), 
                              KEY choiceid (choiceid)
-                         ) TYPE=MyISAM;")) {
+                         ) ENGINE=MyISAM;")) {
     
             table_column('choice_answers', 'choice', 'choiceid', 'integer', '10', 'unsigned', 0, 'not null');
             table_column('choice_answers', 'answer', 'optionid', 'integer', '10', 'unsigned', 0, 'not null');

mod/data/export.php

@@ -60,6 +60,7 @@ if($mform->is_cancelled()) {
     print_header_simple($data->name, '', $nav,
         '', '', true, update_module_button($cm->id, $course->id, get_string('modulename', 'data')),
         navmenu($course, $cm), '', '');
+    groups_print_activity_menu($cm, "$CFG->wwwroot/mod/data/export.php?d=$d");
     print_heading(format_string($data->name));
 
     // these are for the tab display
@@ -83,13 +84,25 @@ foreach($fields as $key => $field) {
         $exportdata[0][] = $field->field->name;
     }
 }
+$groupid = groups_get_activity_group($cm);
 
 $datarecords = get_records('data_records', 'dataid', $data->id);
 ksort($datarecords);
 $line = 1;
 foreach($datarecords as $record) {
     // get content indexed by fieldid
-    if( $content = get_records('data_content', 'recordid', $record->id, 'fieldid', 'fieldid, content, content1, content2, content3, content4') ) {
+    if($groupid) {
+        $select = "SELECT c.fieldid, c.content, c.content1, c.content2, c.content3, c.content4
+            FROM {$CFG->prefix}data_content c, {$CFG->prefix}data_records r
+            WHERE c.recordid = $record->id
+            AND r.id = c.recordid
+            AND r.groupid = $groupid";
+    } else {
+        $select = "SELECT fieldid, content, content1, content2, content3, content4
+            FROM {$CFG->prefix}data_content
+            WHERE recordid = $record->id";
+    }
+    if( $content = get_records_sql($select) ) {
         foreach($fields as $field) {
             $contents = '';
             if(isset($content[$field->field->id])) {

mod/data/lib.php

@@ -729,7 +729,15 @@ function data_user_outline($course, $user, $mod, $data) {
     } else if ($grade) {
         $result = new object();
         $result->info = get_string('grade') . ': ' . $grade->str_long_grade;
-        $result->time = $grade->dategraded;
+
+        //datesubmitted == time created. dategraded == time modified or time overridden
+        //if grade was last modified by the user themselves use date graded. Otherwise use date submitted
+        if ($grade->usermodified == $user->id || empty($grade->datesubmitted)) {
+            $result->time = $grade->dategraded;
+        } else {
+            $result->time = $grade->datesubmitted;
+        }
+
         return $result;
     }
     return NULL;

mod/forum/db/mysql.php

@@ -129,7 +129,7 @@ function forum_upgrade($oldversion) {
                                 PRIMARY KEY  (`id`),
                                 KEY `user` (userid),
                                 KEY `post` (postid)
-                              ) TYPE=MyISAM COMMENT='For keeping track of posts that will be mailed in digest form';");
+                              ) ENGINE=MyISAM COMMENT='For keeping track of posts that will be mailed in digest form';");
   }
 
   if ($oldversion < 2004070700) {    // This may be redoing it from STABLE but that's OK

mod/forum/discuss.php

@@ -62,6 +62,10 @@
             error('You can\'t move to that forum - it doesn\'t exist!', $return);
         }
 
+        if ($forumto->type == 'single') {
+            error('Cannot move discussion to a simple single discussion forum.', $return);
+        }
+
         if (!$cmto = get_coursemodule_from_instance('forum', $forumto->id, $course->id)) {
             error('Target forum not found in this course.', $return);
         }
@@ -187,6 +191,8 @@
             }
             $section = -1;
             $forummenu = array();
+            // Check forum types and eliminate simple discussions.
+            $forumcheck = get_records('forum', 'course', $course->id, '', 'id, type');
             foreach ($modinfo->instances['forum'] as $forumcm) {
                 if (!$forumcm->uservisible || !has_capability('mod/forum:startdiscussion',
                     get_context_instance(CONTEXT_MODULE,$forumcm->id))) {
@@ -197,7 +203,9 @@
                     $forummenu[] = "-------------- $strsection $forumcm->sectionnum --------------";
                 }
                 $section = $forumcm->sectionnum;
-                if ($forumcm->instance != $forum->id) {
+                $forumidcompare = $forumcm->instance != $forum->id;
+                $forumtypecheck = $forumcheck[$forumcm->instance]->type !== 'single';
+                if ($forumidcompare and $forumtypecheck) {
                     $url = "discuss.php?d=$discussion->id&move=$forumcm->instance&sesskey=".sesskey();
                     $forummenu[$url] = format_string($forumcm->name);
                 }

mod/forum/lib.php

@@ -976,7 +976,15 @@ function forum_user_outline($course, $user, $mod, $forum) {
     } else if ($grade) {
         $result = new object();
         $result->info = get_string('grade') . ': ' . $grade->str_long_grade;
-        $result->time = $grade->dategraded;
+
+        //datesubmitted == time created. dategraded == time modified or time overridden
+        //if grade was last modified by the user themselves use date graded. Otherwise use date submitted
+        if ($grade->usermodified == $user->id || empty($grade->datesubmitted)) {
+            $result->time = $grade->dategraded;
+        } else {
+            $result->time = $grade->datesubmitted;
+        }
+
         return $result;
     }
     return NULL;
@@ -4476,6 +4484,10 @@ function forum_user_can_post_discussion($forum, $currentgroup=null, $unused=-1,
         return false;
     }
 
+    if ($forum->type == 'single') {
+        return false;
+    }
+
     if ($forum->type == 'eachuser') {
         if (forum_user_has_posted_discussion($forum->id, $USER->id)) {
             return false;

mod/forum/user.php

@@ -40,6 +40,50 @@
         die;
     }
 
+    switch ($mode) {
+        case 'posts' :
+            $searchterms = array('userid:'.$user->id);
+            $extrasql = '';
+            break;
+
+        default:
+            $searchterms = array('userid:'.$user->id);
+            $extrasql = 'AND p.parent = 0';
+            break;
+    }
+    if ($course->id == SITEID) {
+        if (empty($CFG->forceloginforprofiles) || isloggedin()) {
+            // Search throughout the whole site.
+            $searchcourse = 0;
+        } else {
+            $searchcourse = SITEID;
+        }
+    } else {
+        // Search only for posts the user made in this course.
+        $searchcourse = $course->id;
+    }
+
+    $posts = forum_search_posts($searchterms, $searchcourse, $page*$perpage, $perpage, $totalcount, $extrasql);
+
+    $hasposts = !empty($posts);
+    $iscurrentuser = $user->id == $USER->id;
+    $specificcourseprovided = !empty($searchcourse) && $searchcourse != SITEID;
+    if (!$hasposts && !$iscurrentuser && !$specificcourseprovided) {
+        $mustlogin = (!isloggedin() && $CFG->forceloginforprofiles);
+        $canviewtheuser = (isloggedin() && has_capability('moodle/user:viewdetails', $usercontext));
+        if ($mustlogin || (!isteacherinanycourse() && !isteacherinanycourse($user->id) && !$canviewtheuser)) {
+            // Best to assume that the current user cannot view the requested user
+            // so we are careful not to give out any information.
+            print_header();
+            print_heading(get_string('noposts', 'forum'));
+            print_footer();
+            exit;
+        } else {
+            // Nothing to check here. If a course has been specified then require_course_login
+            // has been called OR the current user is a parent of the requested user.
+        }
+    }
+
     add_to_log($course->id, "forum", "user report",
             "user.php?course=$course->id&id=$user->id&mode=$mode", "$user->id"); 
 
@@ -65,36 +109,10 @@
     $showroles = 1;
     include($CFG->dirroot.'/user/tabs.php');   /// Prints out tabs as part of user page
 
-
-    switch ($mode) {
-        case 'posts' :
-            $searchterms = array('userid:'.$user->id);
-            $extrasql = '';
-            break;
-
-        default:
-            $searchterms = array('userid:'.$user->id);
-            $extrasql = 'AND p.parent = 0';
-            break;
-    }
-
     echo '<div class="user-content">';
 
-    if ($course->id == SITEID) {
-        if (empty($CFG->forceloginforprofiles) || isloggedin()) {
-            // Search throughout the whole site.
-            $searchcourse = 0;
-        } else {
-            $searchcourse = SITEID;
-        }
-    } else {
-        // Search only for posts the user made in this course.
-        $searchcourse = $course->id;
-    }
-
     // Get the posts.
-    if ($posts = forum_search_posts($searchterms, $searchcourse, $page*$perpage, $perpage,
-                                    $totalcount, $extrasql)) {
+    if ($posts) {
 
         print_paging_bar($totalcount, $page, $perpage,
                          "user.php?id=$user->id&amp;course=$course->id&amp;mode=$mode&amp;perpage=$perpage&amp;");

mod/glossary/db/mysql.php

@@ -45,13 +45,13 @@ function glossary_upgrade($oldversion) {
                     `glossaryid` INT(10) UNSIGNED NOT NULL default '0',
                     `name` VARCHAR(255) NOT NULL default '',
                     PRIMARY KEY  (`id`)
-                    ) TYPE=MyISAM COMMENT='all categories for glossary entries'");
+                    ) ENGINE=MyISAM COMMENT='all categories for glossary entries'");
 
         execute_sql("CREATE TABLE `{$CFG->prefix}glossary_entries_categories` (
                     `categoryid` INT(10) UNSIGNED NOT NULL default '1',
                     `entryid` INT(10) UNSIGNED NOT NULL default '0',
                     PRIMARY KEY  (`categoryid`, `entryid`)
-                    ) TYPE=MyISAM COMMENT='categories of each glossary entry'");
+                    ) ENGINE=MyISAM COMMENT='categories of each glossary entry'");
      }
      
      if ( $oldversion < 2003092100 ) {
@@ -87,7 +87,7 @@ function glossary_upgrade($oldversion) {
                     `timemodified` INT(10) UNSIGNED NOT NULL default '0',
                     `format` TINYINT(2) UNSIGNED NOT NULL default '0',
                     PRIMARY KEY  (`id`)
-                    ) TYPE=MyISAM COMMENT='comments on glossary entries'");
+                    ) ENGINE=MyISAM COMMENT='comments on glossary entries'");
 
         execute_sql(" INSERT INTO {$CFG->prefix}log_display (module, action, mtable, field) VALUES ('glossary', 'add comment', 'glossary', 'name') ");
         execute_sql(" INSERT INTO {$CFG->prefix}log_display (module, action, mtable, field) VALUES ('glossary', 'update comment', 'glossary', 'name') ");
@@ -166,7 +166,7 @@ function glossary_upgrade($oldversion) {
                     `entryid` INT(10) UNSIGNED NOT NULL default '0',
                     `alias` TEXT NOT NULL default '',
                     PRIMARY KEY  (`id`)
-                    ) TYPE=MyISAM COMMENT='entries alias'");
+                    ) ENGINE=MyISAM COMMENT='entries alias'");
     }
     
     if ( $oldversion < 2003111500 ) {
@@ -190,7 +190,7 @@ function glossary_upgrade($oldversion) {
                     `sortkey` VARCHAR(50) NOT NULL default '',
                     `sortorder` VARCHAR(50) NOT NULL default '',
                     PRIMARY KEY  (`id`)
-                    ) TYPE=MyISAM COMMENT='Setting of the display formats'");
+                    ) ENGINE=MyISAM COMMENT='Setting of the display formats'");
 
         // Default format
         execute_sql(" INSERT INTO {$CFG->prefix}glossary_displayformats 
@@ -292,7 +292,7 @@ function glossary_upgrade($oldversion) {
                        `sortkey` VARCHAR(50) NOT NULL default '',
                        `sortorder` VARCHAR(50) NOT NULL default '',
                    PRIMARY KEY  (`id`)                    
-                   ) TYPE=MyISAM COMMENT='Setting of the display formats'");
+                   ) ENGINE=MyISAM COMMENT='Setting of the display formats'");
 
       //Define current 0-6 format names
       $formatnames = array('dictionary','continuous','fullwithauthor','encyclopedia',

mod/glossary/lib.php

@@ -189,7 +189,15 @@ function glossary_user_outline($course, $user, $mod, $glossary) {
     } else if ($grade) {
         $result = new object();
         $result->info = get_string('grade') . ': ' . $grade->str_long_grade;
-        $result->time = $grade->dategraded;
+
+        //datesubmitted == time created. dategraded == time modified or time overridden
+        //if grade was last modified by the user themselves use date graded. Otherwise use date submitted
+        if ($grade->usermodified == $user->id || empty($grade->datesubmitted)) {
+            $result->time = $grade->dategraded;
+        } else {
+            $result->time = $grade->datesubmitted;
+        }
+
         return $result;
     }
 

mod/glossary/view.php

@@ -329,12 +329,12 @@
 
 /// Search box
     if ($showcommonelements ) {
-        echo '<form method="post" action="view.php">';
+        echo '<form method="get" action="view.php">';
 
         echo '<table class="boxaligncenter" width="70%" border="0">';
         echo '<tr><td align="center" class="glossarysearchbox">';
 
-        echo '<input type="submit" value="'.$strsearch.'" name="searchbutton" /> ';
+        echo '<input type="submit" value="'.$strsearch.'" /> ';
         if ($mode == 'search') {
             echo '<input type="text" name="hook" size="20" value="'.s($hook).'" alt="'.$strsearch.'" /> ';
         } else {

mod/hotpot/mod_form.php

@@ -11,7 +11,7 @@ $HOTPOT_TEXTSOURCE = array(
 
 class mod_hotpot_mod_form extends moodleform_mod {
     // documentation on formslib.php here:
-    // http://docs.moodle.org/en/Development:lib/formslib.php_Form_Definition
+    // http://docs.moodle.org/dev/lib/formslib.php_Form_Definition
 
     function definition() {
         // TO DO
@@ -286,7 +286,7 @@ class mod_hotpot_mod_form extends moodleform_mod {
     }
 
     function validation(&$data) {
-        // http://docs.moodle.org/en/Development:lib/formslib.php_Validation
+        // http://docs.moodle.org/dev/lib/formslib.php_Validation
         global $CFG, $COURSE;
         $errors = array();
 

mod/label/db/upgrade.php

@@ -33,7 +33,7 @@ function xmldb_label_upgrade($oldversion=0) {
 /// }
 
 //===== 1.9.0 upgrade line ======//
-    if ($oldversion < 2007101510) {
+    if ($result && $oldversion < 2007101510) {
         execute_sql("UPDATE {$CFG->prefix}log_display SET mtable = 'label' WHERE module = 'label'", 'false');
     }
 

mod/lesson/action/continue.php

@@ -414,8 +414,9 @@
             $userresponse = implode(",", $userresponse);
 
             $response = '';
-            if ($ncorrect == count($answers)-2) {  // dont count correct/wrong responses in the total.
-                $response = reset($answers)->answer;
+            if ($ncorrect == count($answers) - 2) {  // dont count correct/wrong responses in the total.
+                $answer = reset($answers);
+                $response = $answer->answer;
                 if (isset($correctpageid)) {
                     $newpageid = $correctpageid;
                 }
@@ -425,7 +426,8 @@
                 $correctanswer = true;
             } else {
                 reset($answers);
-                $response = next($answers)->answer;
+                $answer = next($answers);
+                $response = $answer->answer;
                 $newpageid = $wrongpageid;
                 $answerid = $wronganswerid;
             }

mod/lesson/action/updatepage.php

@@ -71,7 +71,8 @@
                 }
             }
         }        
-        if (!update_record("lesson_answers", $oldanswer)) {
+        // Don't return the error if it wasn't updated because original question type had no answers
+        if (!empty($oldanswer->id) && !update_record("lesson_answers", $oldanswer)) {
             error("Update page: EOB not updated");
         }
     } else {

mod/lesson/lib.php

@@ -155,7 +155,14 @@ function lesson_user_outline($course, $user, $mod, $lesson) {
     } else {
         $grade = reset($grades->items[0]->grades);
         $return->info = get_string("grade") . ': ' . $grade->str_long_grade;
-        $return->time = $grade->dategraded;
+
+        //datesubmitted == time created. dategraded == time modified or time overridden
+        //if grade was last modified by the user themselves use date graded. Otherwise use date submitted
+        if ($grade->usermodified == $user->id || empty($grade->datesubmitted)) {
+            $result->time = $grade->dategraded;
+        } else {
+            $result->time = $grade->datesubmitted;
+        }
     }
     return $return;
 }

mod/lesson/view.php

@@ -563,7 +563,7 @@
                 echo "<input type=\"hidden\" name=\"pageid\" value=\"$pageid\" />";
                 echo "<input type=\"hidden\" name=\"sesskey\" value=\"".sesskey()."\" />";
                 print_simple_box_start("center");
-                echo '<table width="100%">';
+                echo '<table>';
             }
             // default format text options
             $options = new stdClass;

mod/quiz/db/mysql.php

@@ -110,7 +110,7 @@ function quiz_upgrade($oldversion) {
                                `max` varchar(255) NOT NULL default '',
                                PRIMARY KEY  (`id`),
                                KEY `answer` (`answer`)
-                             ) TYPE=MyISAM COMMENT='Options for numerical questions'; ");
+                             ) ENGINE=MyISAM COMMENT='Options for numerical questions'; ");
     }
 
     if ($success && $oldversion < 2003072400) {
@@ -127,7 +127,7 @@ function quiz_upgrade($oldversion) {
                                 `norm` int(10) unsigned NOT NULL default '1',
                                 PRIMARY KEY  (`id`),
                                 KEY `question` (`question`)
-                              ) TYPE=MyISAM COMMENT='Options for multianswer questions'; ");
+                              ) ENGINE=MyISAM COMMENT='Options for multianswer questions'; ");
     }
 
     if ($success && $oldversion < 2003080301) {
@@ -224,7 +224,7 @@ function quiz_upgrade($oldversion) {
                                `multiplier` decimal(40,20) NOT NULL default '1.00000000000000000000',
                                `unit` varchar(50) NOT NULL default '',
                                PRIMARY KEY  (`id`)
-                ) TYPE=MyISAM COMMENT='Optional unit options for numerical questions'; ");
+                ) ENGINE=MyISAM COMMENT='Optional unit options for numerical questions'; ");
 
         // Four tables for handling distribution and storage of
         // individual data for dataset dependent question types
@@ -235,7 +235,7 @@ function quiz_upgrade($oldversion) {
                                `datasetnumber` int(10) unsigned NOT NULL default '0',
                                PRIMARY KEY  (`id`),
                                UNIQUE KEY `category` (`category`,`userid`)
-            ) TYPE=MyISAM COMMENT='Dataset number for attemptonlast attempts per user'; ");
+            ) ENGINE=MyISAM COMMENT='Dataset number for attemptonlast attempts per user'; ");
         $success = $success && modify_database ("", " CREATE TABLE `prefix_quiz_dataset_definitions` (
                                `id` int(10) unsigned NOT NULL auto_increment,
                                `category` int(10) unsigned NOT NULL default '0',
@@ -244,7 +244,7 @@ function quiz_upgrade($oldversion) {
                                `options` varchar(255) NOT NULL default '',
                                `itemcount` int(10) unsigned NOT NULL default '0',
                                PRIMARY KEY  (`id`)
-            ) TYPE=MyISAM COMMENT='Organises and stores properties for dataset items'; ");
+            ) ENGINE=MyISAM COMMENT='Organises and stores properties for dataset items'; ");
         $success = $success && modify_database ("", " CREATE TABLE `prefix_quiz_dataset_items` (
                                `id` int(10) unsigned NOT NULL auto_increment,
                                `definition` int(10) unsigned NOT NULL default '0',
@@ -252,14 +252,14 @@ function quiz_upgrade($oldversion) {
                                `value` varchar(255) NOT NULL default '',
                                PRIMARY KEY  (`id`),
                                KEY `definition` (`definition`)
-                             ) TYPE=MyISAM COMMENT='Individual dataset items'; ");
+                             ) ENGINE=MyISAM COMMENT='Individual dataset items'; ");
         $success = $success && modify_database ("", " CREATE TABLE `prefix_quiz_question_datasets` (
                                `id` int(10) unsigned NOT NULL auto_increment,
                                `question` int(10) unsigned NOT NULL default '0',
                                `datasetdefinition` int(10) unsigned NOT NULL default '0',
                                PRIMARY KEY  (`id`),
                                KEY `question` (`question`,`datasetdefinition`)
-            ) TYPE=MyISAM COMMENT='Many-many relation between questions and dataset definitions'; ");
+            ) ENGINE=MyISAM COMMENT='Many-many relation between questions and dataset definitions'; ");
 
         // One table for new question type calculated
         //  - the first dataset dependent question type
@@ -272,7 +272,7 @@ function quiz_upgrade($oldversion) {
                                `correctanswerlength` int(10) NOT NULL default '2',
                                PRIMARY KEY  (`id`),
                                KEY `question` (`question`)
-                ) TYPE=MyISAM COMMENT='Options for questions of type calculated'; ");
+                ) ENGINE=MyISAM COMMENT='Options for questions of type calculated'; ");
     }
 
     if ($success && $oldversion < 2004111400) {
@@ -333,7 +333,7 @@ function quiz_upgrade($oldversion) {
                               `userid` int(10) unsigned NOT NULL default '0',
                               `timestamp` int(10) unsigned NOT NULL default '0',
                               PRIMARY KEY  (`id`)
-                            ) TYPE=MyISAM COMMENT='The mapping between old and new versions of a question';");
+                            ) ENGINE=MyISAM COMMENT='The mapping between old and new versions of a question';");
     }
 
     if ($success && $oldversion < 2005032000) {
@@ -471,7 +471,7 @@ function quiz_upgrade($oldversion) {
                              `sumpenalty` varchar(10) NOT NULL default '0.0',
                              PRIMARY KEY  (`id`),
                              UNIQUE KEY `attemptid` (`attemptid`,`questionid`)
-                           ) TYPE=MyISAM COMMENT='Gives ids of the newest open and newest graded states';");
+                           ) ENGINE=MyISAM COMMENT='Gives ids of the newest open and newest graded states';");
 
     /// Now upgrade some fields in states and newest_states tables where necessary
         // to save time on large sites only do this for attempts that have not yet been finished.
@@ -525,7 +525,7 @@ function quiz_upgrade($oldversion) {
                               `maxscore` int(10) unsigned NOT NULL default '1',
                               PRIMARY KEY  (`id`),
                               KEY `question` (`question`)
-                              ) TYPE=MyISAM COMMENT='Options for RQP questions';");
+                              ) ENGINE=MyISAM COMMENT='Options for RQP questions';");
 
         $success = $success && modify_database ('', "CREATE TABLE `prefix_quiz_rqp_type` (
                               `id` int(10) unsigned NOT NULL auto_increment,
@@ -535,7 +535,7 @@ function quiz_upgrade($oldversion) {
                               `flags` tinyint(3) NOT NULL default '0',
                               PRIMARY KEY  (`id`),
                               UNIQUE KEY `name` (`name`)
-                              ) TYPE=MyISAM COMMENT='RQP question types and the servers to be used to process them';");
+                              ) ENGINE=MyISAM COMMENT='RQP question types and the servers to be used to process them';");
 
         $success = $success && modify_database ('', "CREATE TABLE `prefix_quiz_rqp_states` (
                               `id` int(10) unsigned NOT NULL auto_increment,
@@ -544,7 +544,7 @@ function quiz_upgrade($oldversion) {
                               `persistent_data` text NOT NULL default '',
                               `template_vars` text NOT NULL default '',
                               PRIMARY KEY  (`id`)
-                              ) TYPE=MyISAM COMMENT='RQP question type specific state information';");
+                              ) ENGINE=MyISAM COMMENT='RQP question type specific state information';");
     }
 
     if ($success && $oldversion < 2005050300) {
@@ -568,7 +568,7 @@ function quiz_upgrade($oldversion) {
                       can_render tinyint(2) unsigned NOT NULL default '0',
                       can_author tinyint(2) unsigned NOT NULL default '0',
                       PRIMARY KEY  (id)
-                    ) TYPE=MyISAM COMMENT='Information about RQP servers';");
+                    ) ENGINE=MyISAM COMMENT='Information about RQP servers';");
         if ($types = get_records('quiz_rqp_types')) {
             foreach($types as $type) {
                 $server = new stdClass;
@@ -859,7 +859,7 @@ function quiz_upgrade($oldversion) {
                 `answer` varchar(255) NOT NULL default '',
                 PRIMARY KEY  (`id`),
                 KEY `question` (`question`)
-           ) TYPE=MyISAM COMMENT='Options for essay questions'");
+           ) ENGINE=MyISAM COMMENT='Options for essay questions'");
     
         $success = $success && modify_database ('', "
             CREATE TABLE `prefix_quiz_essay_states` (
@@ -869,7 +869,7 @@ function quiz_upgrade($oldversion) {
               `fraction` varchar(10) NOT NULL default '0.0',
               `response` text NOT NULL,
               PRIMARY KEY  (`id`)
-            ) TYPE=MyISAM COMMENT='essay question type specific state information'");
+            ) ENGINE=MyISAM COMMENT='essay question type specific state information'");
     }
 
     if ($success && $oldversion < 2005070202) {
@@ -1058,7 +1058,7 @@ function quiz_upgrade($oldversion) {
                                       id int(10) unsigned NOT NULL auto_increment,
                                       modulename varchar(20) NOT NULL default 'quiz',
                                       PRIMARY KEY  (id)
-                                    ) TYPE=MyISAM COMMENT='Student attempts. This table gets extended by the modules';");
+                                    ) ENGINE=MyISAM COMMENT='Student attempts. This table gets extended by the modules';");
             // create one entry for all the existing quiz attempts
             $success = $success && modify_database ("", "INSERT INTO prefix_question_attempts (id)
                                        SELECT uniqueid
@@ -1134,7 +1134,7 @@ function quiz_upgrade($oldversion) {
                 maxgrade double NOT NULL default '0',
                 PRIMARY KEY (id),
                 KEY quizid (quizid)
-            ) TYPE=MyISAM COMMENT='Feedback given to students based on their overall score on the test';
+            ) ENGINE=MyISAM COMMENT='Feedback given to students based on their overall score on the test';
         ");
     
         $success = $success && execute_sql("