on-demand release 1.9.19+

This was a regression that was fixed in the 2.x versions but not 1.9

README.txt

@@ -24,7 +24,7 @@ a few minutes:
 
 For more information, see the INSTALL DOCUMENTATION:
 
-   http://docs.moodle.org/en/Installing_Moodle 
+   http://docs.moodle.org/19/en/Installing_Moodle
 
 A local copy can also be found in 
 

admin/cron.php

@@ -241,10 +241,13 @@
 
         if ($CFG->longtimenosee) { // value in days
             $cuttime = $timenow - ($CFG->longtimenosee * 3600 * 24);
-            $rs = get_recordset_sql ("SELECT id, userid, courseid
-                                        FROM {$CFG->prefix}user_lastaccess
-                                       WHERE courseid != ".SITEID."
-                                         AND timeaccess < $cuttime ");
+            $rs = get_recordset_sql ("SELECT la.id, la.userid, la.courseid
+                                        FROM {$CFG->prefix}user_lastaccess la
+                                        JOIN {$CFG->prefix}course c
+                                          ON c.id = la.courseid
+                                       WHERE la.courseid != ".SITEID."
+                                         AND la.timeaccess < $cuttime
+                                         AND c.metacourse = 0 ");
             while ($assign = rs_fetch_next_record($rs)) {
                 if ($context = get_context_instance(CONTEXT_COURSE, $assign->courseid)) {
                     if (role_unassign(0, $assign->userid, 0, $context->id)) {
@@ -348,25 +351,24 @@
         mtrace('checking for create_password');
         if (count_records('user_preferences', 'name', 'create_password', 'value', '1')) {
             mtrace('creating passwords for new users');
-            $newusers = get_records_sql("SELECT  u.id as id, u.email, u.firstname, 
-                                                u.lastname, u.username,
-                                                p.id as prefid 
-                                        FROM {$CFG->prefix}user u 
-                                             JOIN {$CFG->prefix}user_preferences p ON u.id=p.userid
-                                        WHERE p.name='create_password' AND p.value='1' AND u.email !='' ");
-
-            foreach ($newusers as $newuserid => $newuser) {
-                $newuser->emailstop = 0; // send email regardless
-                // email user                               
-                if (setnew_password_and_mail($newuser)) {
-                    // remove user pref
-                    delete_records('user_preferences', 'id', $newuser->prefid);
-                } else {
-                    trigger_error("Could not create and mail new user password!");
+            $newuserssql = "SELECT u.id as id, u.email, u.firstname, u.lastname, u.username, p.id as prefid
+                              FROM {$CFG->prefix}user u
+                              JOIN {$CFG->prefix}user_preferences p ON u.id=p.userid
+                             WHERE p.name='create_password' AND p.value='1' AND u.email !='' ";
+            if ($newusers = get_records_sql($newuserssql)) {
+                foreach ($newusers as $newuserid => $newuser) {
+                    $newuser->emailstop = 0; // send email regardless
+                    // email user
+                    if (setnew_password_and_mail($newuser)) {
+                        // remove user pref
+                        delete_records('user_preferences', 'id', $newuser->prefid);
+                    } else {
+                        trigger_error("Could not create and mail new user password!");
+                    }
                 }
             }
         }
-        
+
         if (!empty($CFG->usetags)) {
             require_once($CFG->dirroot.'/tag/lib.php');
             tag_cron();

admin/environment.xml

@@ -442,4 +442,232 @@
       </PHP_SETTING>
     </PHP_SETTINGS>
   </MOODLE>
+  <MOODLE version="2.2" requires="1.9">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mysql" version="5.0.25">
+        <FEEDBACK>
+          <ON_ERROR message="mysql416required" />
+        </FEEDBACK>
+      </VENDOR>
+      <VENDOR name="postgres" version="8.3" />
+      <VENDOR name="mssql" version="9.0" />
+      <VENDOR name="odbc_mssql" version="9.0" />
+      <VENDOR name="mssql_n" version="9.0" />
+      <VENDOR name="oracle" version="10.2" />
+      <VENDOR name="sqlite" version="2.0" />
+    </DATABASE>
+    <PHP version="5.3.2" level="required">
+    </PHP>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opensslrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="gdrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="intlrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="40M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="safe_mode" value="0" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingsafemode" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+  </MOODLE>
+  <MOODLE version="2.3" requires="2.2">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mysql" version="5.0.25">
+        <FEEDBACK>
+          <ON_ERROR message="mysql416required" />
+        </FEEDBACK>
+      </VENDOR>
+      <VENDOR name="postgres" version="8.3" />
+      <VENDOR name="mssql" version="9.0" />
+      <VENDOR name="odbc_mssql" version="9.0" />
+      <VENDOR name="mssql_n" version="9.0" />
+      <VENDOR name="oracle" version="10.2" />
+      <VENDOR name="sqlite" version="2.0" />
+    </DATABASE>
+    <PHP version="5.3.2" level="required">
+    </PHP>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opensslrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="gdrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="intlrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="40M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="safe_mode" value="0" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingsafemode" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+  </MOODLE>
 </COMPATIBILITY_MATRIX>

admin/index.php

@@ -47,7 +47,7 @@
 
 /// Check some PHP server settings
 
-    $documentationlink = '<a href="http://docs.moodle.org/en/Installation">Installation docs</a>';
+    $documentationlink = '<a href="http://docs.moodle.org/19/en/Installation">Installation docs</a>';
 
     if (ini_get_bool('session.auto_start')) {
         error("The PHP server variable 'session.auto_start' should be Off - $documentationlink");
@@ -143,7 +143,7 @@
             print_box(text_to_html(get_string('gpl')), 'copyrightnotice');
             echo "<br />";
             notice_yesno(get_string('doyouagree'), "index.php?agreelicense=1",
-                                                   "http://docs.moodle.org/en/License");
+                                                   "http://docs.moodle.org/dev/License");
             print_footer('none');
             exit;
         }
@@ -152,7 +152,7 @@
             $navigation = build_navigation(array(array('name'=>$strcurrentrelease, 'link'=>null, 'type'=>'misc')));
             print_header($strcurrentrelease, $strcurrentrelease, $navigation, "", "", false, "&nbsp;", "&nbsp;");
             print_heading("Moodle $release");
-            print_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/en/Release_Notes'), 'generalbox boxaligncenter boxwidthwide');
+            print_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/19/en/Release_Notes'), 'generalbox boxaligncenter boxwidthwide');
             echo '<form action="index.php"><div>';
             echo '<input type="hidden" name="agreelicense" value="1" />';
             echo '<input type="hidden" name="confirmrelease" value="1" />';
@@ -286,7 +286,7 @@
                 $navigation = build_navigation(array(array('name'=>$strcurrentrelease, 'link'=>null, 'type'=>'misc')));
                 print_header($strcurrentrelease, $strcurrentrelease, $navigation, "", "", false, "&nbsp;", "&nbsp;");
                 print_heading("Moodle $release");
-                print_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/en/Release_Notes'));
+                print_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/19/en/Release_Notes'));
 
                 require_once($CFG->libdir.'/environmentlib.php');
                 print_heading(get_string('environment', 'admin'));
@@ -687,10 +687,10 @@
     //////////////////////////////////////////////////////////////////////////////////////////////////
     ////  IT IS ILLEGAL AND A VIOLATION OF THE GPL TO HIDE, REMOVE OR MODIFY THIS COPYRIGHT NOTICE ///
     $copyrighttext = '<a href="http://moodle.org/">Moodle</a> '.
-                     '<a href="http://docs.moodle.org/en/Release" title="'.$CFG->version.'">'.$CFG->release.'</a><br />'.
+                     '<a href="http://docs.moodle.org/dev/Releases" title="'.$CFG->version.'">'.$CFG->release.'</a><br />'.
                      'Copyright &copy; 1999 onwards, Martin Dougiamas<br />'.
-                     'and <a href="http://docs.moodle.org/en/Credits">many other contributors</a>.<br />'.
-                     '<a href="http://docs.moodle.org/en/License">GNU Public License</a>';
+                     'and <a href="http://docs.moodle.org/dev/Credits">many other contributors</a>.<br />'.
+                     '<a href="http://docs.moodle.org/dev/License">GNU Public License</a>';
     print_box($copyrighttext, 'copyright');
     //////////////////////////////////////////////////////////////////////////////////////////////////
 

admin/roles/assign.php

@@ -72,7 +72,7 @@
     $straction = get_string('assignroles', 'role');
     $strroletoassign = get_string('roletoassign', 'role');
     $strsearch = get_string('search');
-    $strshowall = get_string('showall');
+    $strshowall = get_string('showallusers');
     $strparticipants = get_string('participants');
     $strsearchresults = get_string('searchresults');
 

admin/settings/security.php

@@ -8,6 +8,7 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
     $temp->add(new admin_setting_configcheckbox('protectusernames', get_string('protectusernames', 'admin'), get_string('configprotectusernames', 'admin'), 1));
     $temp->add(new admin_setting_configcheckbox('forcelogin', get_string('forcelogin', 'admin'), get_string('configforcelogin', 'admin'), 0));
     $temp->add(new admin_setting_configcheckbox('forceloginforprofiles', get_string('forceloginforprofiles', 'admin'), get_string('configforceloginforprofiles', 'admin'), 1));
+    $temp->add(new admin_setting_configcheckbox('forceloginforprofileimage', get_string('forceloginforprofileimage', 'admin'), get_string('forceloginforprofileimage_help', 'admin'), 0));
     $temp->add(new admin_setting_configcheckbox('opentogoogle', get_string('opentogoogle', 'admin'), get_string('configopentogoogle', 'admin'), 0));
 
     $max_upload_choices = get_max_upload_sizes();
@@ -67,6 +68,7 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
     $temp->add(new admin_setting_configcheckbox('cookiehttponly', get_string('cookiehttponly', 'admin'), get_string('configcookiehttponly', 'admin'), 0));
     $temp->add(new admin_setting_configcheckbox('regenloginsession', get_string('regenloginsession', 'admin'), get_string('configregenloginsession', 'admin'), 1));
     $temp->add(new admin_setting_configtext('excludeoldflashclients', get_string('excludeoldflashclients', 'admin'), get_string('configexcludeoldflashclients', 'admin'), '10.0.12', PARAM_TEXT));
+    $temp->add(new admin_setting_configcheckbox('loginpasswordautocomplete', get_string('loginpasswordautocomplete', 'admin'), get_string('loginpasswordautocomplete_help', 'admin'), 0));
     $ADMIN->add('security', $temp);
 
 

admin/xmldb/README.txt

@@ -2,7 +2,7 @@ XMLDB - Base classes and edition interface.
 
 Complete Documentation:
 
-  http://docs.moodle.org/en/XMLDB_Defining_one_XML_structure
+  http://docs.moodle.org/19/en/XMLDB_Defining_one_XML_structure
 
 Ciao, Eloy Lafuente (stronk7)
 
@@ -70,7 +70,7 @@ Once the XMLDB format was approved, we'll be able to build all the
 for each RDBMS flavour.
 
 Once the interface was finished (2-3 days from now) related documentation
-will be sent to http://docs.moodle.org/en/XML_database_schema in order
+will be sent to http://docs.moodle.org/19/en/XML_database_schema in order
 to comment/modify/approve the final XML format.
 
 All the code is, obviously GPL, with its copyrights and so on...

admin/xmldb/actions/view_reserved_words/view_reserved_words.class.php

@@ -25,8 +25,8 @@
 ///////////////////////////////////////////////////////////////////////////
 
 /// This class will show all the reserved words in a format suitable to
-/// be pasted to: http://docs.moodle.org/en/XMLDB_reserved_words and
-/// http://docs.moodle.org/en/Database_reserved_words
+/// be pasted to: http://docs.moodle.org/19/en/XMLDB_reserved_words and
+/// http://docs.moodle.org/19/en/Database_reserved_words
 /// Also, it introspects te DB looking for such words and informing about
 
 class view_reserved_words extends XMLDBAction {

auth/cas/auth.php

@@ -675,7 +675,7 @@ if ( !is_object($PHPCAS_CLIENT) ) {
                 $droptablesql[] = 'DROP TEMPORARY TABLE ' . $temptable; // sql command to drop the table (because session scope could be a problem)
                 execute_sql_arr($droptablesql, true, false); /// Drop temp table to avoid persistence problems later
                 echo "Creating temp table $temptable\n";
-                execute_sql('CREATE TEMPORARY TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username)) TYPE=MyISAM', false);
+                execute_sql('CREATE TEMPORARY TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username)) ENGINE=MyISAM', false);
                 break;
             case 'postgres':
                 $temptable = $CFG->prefix . 'extuser';

auth/ldap/auth.php

@@ -563,7 +563,7 @@ class auth_plugin_ldap extends auth_plugin_base {
         switch (strtolower($CFG->dbfamily)) {
             case 'mysql':
                 $droptablesql[] = 'DROP TEMPORARY TABLE ' . $temptable; // sql command to drop the table (because session scope could be a problem)
-                $createtemptablesql = 'CREATE TEMPORARY TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username)) TYPE=MyISAM';
+                $createtemptablesql = 'CREATE TEMPORARY TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username)) ENGINE=MyISAM';
                 break;
             case 'postgres':
                 $droptablesql[] = 'DROP TABLE ' . $temptable; // sql command to drop the table (because session scope could be a problem)

auth/mnet/auth.php

@@ -170,6 +170,10 @@ class auth_plugin_mnet extends auth_plugin_base {
         global $MNET;
         require_once $CFG->dirroot . '/mnet/xmlrpc/client.php';
 
+        if (!empty($USER->realuser)) {
+            print_error('notpermittedtojumpas', 'mnet');
+        }
+
         // check remote login permissions
         if (! has_capability('moodle/site:mnetlogintoremote', get_context_instance(CONTEXT_SYSTEM))
                 or is_mnet_remote_user($USER)
@@ -306,6 +310,7 @@ class auth_plugin_mnet extends auth_plugin_base {
             }
             $remoteuser->mnethostid = $remotehost->id;
             $remoteuser->firstaccess = time(); // First time user in this server, grab it here
+            $remoteuser->confirmed = 1;
 
             if (!$remoteuser->id =  insert_record('user', addslashes_recursive($remoteuser))) {
                 print_error('databaseerror', 'mnet');

auth/shibboleth/auth.php

@@ -193,18 +193,13 @@ class auth_plugin_shibboleth extends auth_plugin_base {
      *
      */
     function logoutpage_hook() {
-        global $redirect;
+        global $SESSION, $redirect;
         
-        // Only do this if logout handler is defined
-        if (
-              isset($this->config->logout_handler) 
-              && !empty($this->config->logout_handler)
-           ){
+        // Only do this if logout handler is defined, and if the user is actually logged in via Shibboleth
+        $logouthandlervalid = isset($this->config->logout_handler) && !empty($this->config->logout_handler);
+        if (  isset($SESSION->shibboleth_session_id) && $logouthandlervalid ) {
             // Check if there is an alternative logout return url defined
-            if (
-                  isset($this->config->logout_return_url) 
-                  && !empty($this->config->logout_return_url)
-               ){
+            if (isset($this->config->logout_return_url) && !empty($this->config->logout_return_url)) {
                 // Set temp_redirect to alternative return url
                 $temp_redirect = $this->config->logout_return_url;
             } else {

backup/backup_scheduled.php

@@ -100,15 +100,22 @@ function schedule_backup_cron() {
                     $status = false;
                     continue;
                 }
+                // Skip courses that do not yet need backup
+                $skipped = !($backup_course->nextstarttime > 0 && $backup_course->nextstarttime < $now);
                 // Skip backup of unavailable courses that have remained unmodified in a month
-                $skipped = false;
-                if (!$course->visible && ($now - $course->timemodified) > 31*24*60*60) {  //Hidden + unmodified last month
-                    mtrace("            SKIPPING - hidden+unmodified");
-                    set_field("backup_courses","laststatus","3","courseid",$backup_course->courseid);
-                    $skipped = true;
+                if (!$skipped && !$course->visible && ($now - $course->timemodified) > 31*24*60*60) {  //Hidden + settings were unmodified last month
+                    //Check log if there were any modifications to the course content
+                    $sql = 'SELECT l.id FROM '.$CFG->prefix .'log l WHERE '.
+                            'l.course='. $course->id. ' AND l.time>'. ($now-31*24*60*60). " AND lower(l.action) not like '%view%'";
+                    $logexists = record_exists_sql($sql);
+                    if (!$logexists) {
+                        mtrace("            SKIPPING - hidden+unmodified");
+                        set_field("backup_courses", "laststatus", "3", "courseid", $backup_course->courseid);
+                        $skipped = true;
+                    }
                 }
-                //Now we backup every non skipped course with nextstarttime < now
-                if (!$skipped  && $backup_course->nextstarttime > 0 && $backup_course->nextstarttime < $now) {
+                //Now we backup every non-skipped course
+                if (!$skipped) {
                     //We have to send a email because we have included at least one backup
                     $emailpending = true;
                     //Only make the backup if laststatus isn't 2-UNFINISHED (uncontrolled error)

backup/db/mysql.php

@@ -66,7 +66,7 @@ function backup_upgrade($oldversion=0) {
                       `value` varchar(255) NOT NULL default '',
                       PRIMARY KEY  (`id`),
                       UNIQUE KEY `name` (`name`)
-                  ) TYPE=MyISAM COMMENT='To store backup configuration variables'");
+                  ) ENGINE=MyISAM COMMENT='To store backup configuration variables'");
     }
 
     if ($oldversion < 2003120800 and $result) {
@@ -79,7 +79,7 @@ function backup_upgrade($oldversion=0) {
                       `nextstarttime` int(10) unsigned NOT NULL default '0',
                       PRIMARY KEY  (`id`),
                       UNIQUE KEY `courseid` (`courseid`)
-                  ) TYPE=MyISAM COMMENT='To store every course backup status'");
+                  ) ENGINE=MyISAM COMMENT='To store every course backup status'");
 
         if ($result) {
             $result = execute_sql("CREATE TABLE `{$CFG->prefix}backup_log` (    
@@ -89,7 +89,7 @@ function backup_upgrade($oldversion=0) {
                           `laststarttime` int(10) unsigned NOT NULL default '0',
                           `info` varchar(255) NOT NULL default '',
                           PRIMARY KEY  (`id`)
-                      ) TYPE=MyISAM COMMENT='To store every course backup log info'");
+                      ) ENGINE=MyISAM COMMENT='To store every course backup log info'");
         }
     }
 
@@ -105,7 +105,7 @@ function backup_upgrade($oldversion=0) {
                           `new_id` int(10) unsigned NOT NULL default '0',
                           PRIMARY KEY  (`id`),
                           UNIQUE KEY `{$CFG->prefix}backup_files_uk` (`backup_code`,`file_type`,`path`)
-                      ) TYPE=MyISAM COMMENT='To store and recode ids to user and course files.'");
+                      ) ENGINE=MyISAM COMMENT='To store and recode ids to user and course files.'");
         }
         if ($result) {
             $result = execute_sql("DROP TABLE {$CFG->prefix}backup_ids");
@@ -120,7 +120,7 @@ function backup_upgrade($oldversion=0) {
                           `info` mediumtext,
                           PRIMARY KEY  (`id`),
                           UNIQUE KEY `{$CFG->prefix}backup_ids_uk` (`backup_code` ,`table_name`,`old_id`)
-                      ) TYPE=MyISAM COMMENT='To store and convert ids in backup/restore'");
+                      ) ENGINE=MyISAM COMMENT='To store and convert ids in backup/restore'");
         }
     }
 

backup/restorelib.php

@@ -209,10 +209,29 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
 
         // Links to course
         $searchstring = '/\$@(COURSEVIEWBYID)\*([0-9]+)@\$/';
-        $replacestring= $CFG->wwwroot . '/course/view.php?id=' . $restore->course_id;
-        $result = preg_replace($searchstring, $replacestring, $content);
+        // We look for it
+        preg_match_all($searchstring, $content, $foundset);
+        // If found, then we are going to look for its new id (in backup tables)
+        if ($foundset[0]) {
+            // Iterate over foundset[2]. They are the old_ids
+            foreach ($foundset[2] as $old_id) {
+                // We get the needed variables here (course id)
+                $rec = backup_getid($restore->backup_unique_code, 'course', $old_id);
+                // Personalize the searchstring
+                $searchstring = '/\$@(COURSEVIEWBYID)\*('.$old_id.')@\$/';
+                // If it is a link to itself, replace it
+                if (!empty($rec->new_id)) {
+                    $replacestring = $CFG->wwwroot . '/course/view.php?id=' . $rec->new_id;
+                // It s a link to another course, keep it unmodified
+                } else {
+                    $replacestring = $restore->original_wwwroot . '/course/view.php?id=' . $old_id;
+                }
+                // Perform the replacement
+                $content = preg_replace($searchstring, $replacestring, $content);
+            }
+        }
 
-        return $result;
+        return $content;
     }
 
     //This function is called from all xxxx_decode_content_links_caller(),

blocks/db/mysql.php

@@ -142,7 +142,7 @@ global $CFG;
            `visible` tinyint(1) not null default '0',
            `configdata` text not null default '',
            PRIMARY KEY(`id`)
-          ) TYPE=MyISAM;");
+          ) ENGINE=MyISAM;");
     }
     
     if ($oldversion < 2005090200) {

blocks/login/block_login.php

@@ -49,7 +49,12 @@ class block_login extends block_base {
             $this->content->text .= '<input type="text" name="username" id="login_username" value="'.s($username).'" /></div>';
 
             $this->content->text .= '<div class="c1 fld password"><label for="login_password">'.get_string('password').'</label>';
-            $this->content->text .= '<input type="password" name="password" id="login_password" value="" /></div>';
+
+            if (!empty($CFG->loginpasswordautocomplete)) {
+                $this->content->text .= '<input type="password" name="password" id="login_password" value="" autocomplete="off" /></div>';
+            } else {
+                $this->content->text .= '<input type="password" name="password" id="login_password" value="" /></div>';
+            }
 
             $this->content->text .= '<div class="c1 btn"><input type="submit" value="'.get_string('login').'" /></div>';
 

blocks/mnet_hosts/block_mnet_hosts.php

@@ -32,6 +32,14 @@ class block_mnet_hosts extends block_list {
             return '';
         }
 
+        if (!empty($USER->realuser)) {
+            $this->content = new stdClass();
+            $this->content->items = array();
+            $this->content->icons = array();
+            $this->content->footer = get_string('notpermittedtojumpas', 'mnet');
+            return $this->content;
+        }
+
         // check for outgoing roaming permission first
         if (!has_capability('moodle/site:mnetlogintoremote', get_context_instance(CONTEXT_SYSTEM), NULL, false)) {
             return '';

blog/lib.php

@@ -672,7 +672,7 @@
             $querystring = '';
             foreach($_GET as $var => $val) {
                 $var = clean_param($var, PARAM_ALPHANUM);   // See MDL-22631
-                $val = clean_param($val, PARAM_CLEAN);
+                $val = urlencode(clean_param($val, PARAM_CLEAN));
                 if(!$first) {
                     $first = true;
                     if ($var != 'filterselect' && $var != 'filtertype') {
@@ -683,13 +683,13 @@
                     }
                 } else {
                     if ($var != 'filterselect' && $var != 'filtertype') {
-                        $querystring .= '&'.$var.'='.$val;
+                        $querystring .= '&'.$var.'='.$val;
                         $hasparam = true;
                     }
                 }
             }
             if (isset($hasparam)) {
-                $querystring .= '&';
+                $querystring .= '&';
             } else {
                 $querystring = '?';
             }
@@ -697,9 +697,8 @@
             $querystring = '?';
         }
 
-        return strip_querystring(qualified_me()) . $querystring. 'filtertype='.
-                $filtertype.'&filterselect='.$filterselect.'&';
-
+        return s(strip_querystring(qualified_me()) . $querystring. 'filtertype='.
+                $filtertype.'&filterselect='.$filterselect.'&', true);
     }
 
     /**

calendar/event.php

@@ -49,9 +49,9 @@
     $eventid = optional_param('id', 0, PARAM_INT);
     $eventtype = optional_param('type', 'select', PARAM_ALPHA);
     $urlcourse = optional_param('course', 0, PARAM_INT);
-    $cal_y = optional_param('cal_y');
-    $cal_m = optional_param('cal_m');
-    $cal_d = optional_param('cal_d');
+    $cal_y = optional_param('cal_y', 0, PARAM_INT);
+    $cal_m = optional_param('cal_m', 0, PARAM_INT);
+    $cal_d = optional_param('cal_d', 0, PARAM_INT);
 
     if(isguest()) {
         // Guests cannot do anything with events
@@ -103,6 +103,7 @@
     }
 
     $form = null;
+    $err = array();
 
     switch($action) {
         case 'delete':
@@ -129,23 +130,7 @@
             }
 
             if($form = data_submitted() and confirm_sesskey()) {
-
-                $form->name = clean_param(strip_tags($form->name,'<lang><span>'), PARAM_CLEAN);
-
-                $form->timestart = make_timestamp($form->startyr, $form->startmon, $form->startday, $form->starthr, $form->startmin);
-                if($form->duration == 1) {
-                    $form->timeduration = make_timestamp($form->endyr, $form->endmon, $form->endday, $form->endhr, $form->endmin) - $form->timestart;
-                    if($form->timeduration < 0) {
-                        $form->timeduration = 0;
-                    }
-                }
-                else if($form->duration == 2) {
-                    $form->timeduration = $form->minutes * MINSECS;
-                }
-                else {
-                    $form->timeduration = 0;
-                }
-
+                // validate form and set error if any.
                 validate_form($form, $err);
 
                 if (count($err) == 0) {
@@ -194,27 +179,13 @@
             $title = get_string('newevent', 'calendar');
             $form = data_submitted();
             if(!empty($form) && !empty($form->name) && confirm_sesskey()) {
-
-                $form->name = clean_text(strip_tags($form->name, '<lang><span>'));
-
-                $form->timestart = make_timestamp($form->startyr, $form->startmon, $form->startday, $form->starthr, $form->startmin);
-                if($form->duration == 1) {
-                    $form->timeduration = make_timestamp($form->endyr, $form->endmon, $form->endday, $form->endhr, $form->endmin) - $form->timestart;
-                    if($form->timeduration < 0) {
-                        $form->timeduration = 0;
-                    }
-                }
-                else if ($form->duration == 2) {
-                    $form->timeduration = $form->minutes * MINSECS;
-                }
-                else {
-                    $form->timeduration = 0;
-                }
-                if(!calendar_add_event_allowed($form)) {
-                    error('You are not authorized to do this');
-                }
+                // validate form and set error if any.
                 validate_form($form, $err);
+
                 if (count($err) == 0) {
+                    if (!calendar_add_event_allowed($form)) {
+                        error('You are not authorized to do this');
+                    }
                     $form->timemodified = time();
 
                     /// Get the event id for the log record.
@@ -568,11 +539,44 @@
 
 
 function validate_form(&$form, &$err) {
+    $cleanform = new stdClass();
+    //first clean the form values
+    $cleanform->name = clean_param(strip_tags(trim($form->name), '<lang><span>'),PARAM_CLEAN);
+    $cleanform->description = addslashes(clean_param($form->description, PARAM_CLEANHTML));
+    $cleanform->duration = clean_param($form->duration, PARAM_INT);
+    $cleanform->startmon = clean_param($form->startmon, PARAM_INT);
+    $cleanform->startday = clean_param($form->startday, PARAM_INT);
+    $cleanform->startyr = clean_param($form->startyr, PARAM_INT);
+    $cleanform->starthr = clean_param($form->starthr, PARAM_INT);
+    $cleanform->startmin = clean_param($form->startmin, PARAM_INT);
+    $cleanform->endmon = clean_param($form->endmon, PARAM_INT);
+    $cleanform->endday = clean_param($form->endday, PARAM_INT);
+    $cleanform->endyr = clean_param($form->endyr, PARAM_INT);
+    $cleanform->endhr = clean_param($form->endhr, PARAM_INT);
+    $cleanform->endmin = clean_param($form->endmin, PARAM_INT);
+    $cleanform->minutes = clean_param($form->minutes, PARAM_INT);
+    $cleanform->courseid = clean_param($form->courseid, PARAM_INT);
+    $cleanform->format = clean_param($form->format, PARAM_INT);
+    $cleanform->course = clean_param($form->course, PARAM_INT);
+    $cleanform->action = clean_param($form->action, PARAM_ALPHA);
 
-    $form->name = trim($form->name);
-    $form->description = trim($form->description);
+    // These values are only required for new event.
+    if ($cleanform->action === 'new') {
+        $cleanform->repeat = clean_param($form->repeat, PARAM_INT);
+        $cleanform->repeats = clean_param($form->repeats, PARAM_INT);
+        $cleanform->groupid = clean_param($form->groupid, PARAM_INT);
+        $cleanform->userid = clean_param($form->userid, PARAM_INT);
+        $cleanform->modulename = clean_param($form->modulename, PARAM_SAFEDIR);
+        $cleanform->eventtype = clean_param($form->eventtype, PARAM_ALPHA);
+        $cleanform->instance = clean_param($form->instance, PARAM_INT);
+        $cleanform->type = clean_param($form->type, PARAM_ALPHA);
+    } else {
+        $cleanform->id = clean_param($form->id, PARAM_INT);
+    }
+    // set form with clean and valid values only.
+    $form = $cleanform;
 
-    if(empty($form->name)) {
+    if (empty($form->name)) {
         $err['name'] = get_string('errornoeventname', 'calendar');
     }
 /* Allow events without a description
@@ -580,28 +584,53 @@ function validate_form(&$form, &$err) {
         $err['description'] = get_string('errornodescription', 'calendar');
     }
 */
-    if(!checkdate($form->startmon, $form->startday, $form->startyr)) {
+    if (!checkdate($form->startmon, $form->startday, $form->startyr)) {
         $err['timestart'] = get_string('errorinvaliddate', 'calendar');
     }
-    if($form->duration == 2 and !checkdate($form->endmon, $form->endday, $form->endyr)) {
+    if ($form->duration == 1 and !checkdate($form->endmon, $form->endday, $form->endyr)) {
         $err['timeduration'] = get_string('errorinvaliddate', 'calendar');
     }
-    if($form->duration == 2 and !($form->minutes > 0 and $form->minutes < 1000)) {
+    if ($form->duration == 2 and !($form->minutes > 0 and $form->minutes < 1000)) {
         $err['minutes'] = get_string('errorinvalidminutes', 'calendar');
     }
     if (!empty($form->repeat) and !($form->repeats > 1 and $form->repeats < 100)) {
         $err['repeats'] = get_string('errorinvalidrepeats', 'calendar');
     }
-    if(!empty($form->courseid)) {
+
+    // set start time and duration
+    $form->timestart = make_timestamp($form->startyr, $form->startmon, $form->startday, $form->starthr, $form->startmin);
+    if ($form->duration == 1) {
+        $form->timeduration = make_timestamp($form->endyr, $form->endmon, $form->endday, $form->endhr, $form->endmin) - $form->timestart;
+        // Duration should be set for time in future.
+        if ($form->timeduration <= 0) {
+            $err['timeduration'] = get_string('errorinvaliddate', 'calendar');
+            $form->timeduration = 0;
+        }
+    }
+    else if ($form->duration == 2) {
+        $form->timeduration = $form->minutes * MINSECS;
+    }
+    else {
+        $form->timeduration = 0;
+    }
+
+    if (!empty($form->courseid)) {
         // Timestamps must be >= course startdate
         $course = get_record('course', 'id', $form->courseid);
-        if($course === false) {
+        if ($course === false) {
             error('Event belongs to invalid course');
         }
         else if($form->timestart < $course->startdate) {
             $err['timestart'] = get_string('errorbeforecoursestart', 'calendar');
         }
     }
+    if (!empty($form->modulename)) {
+        // Check that passed modulename actually exists (possible SQL Injection route)
+        $module = get_record('modules', 'name', $form->modulename);
+        if ($module === false) {
+            error('Invalid module name');
+        }
+    }
 }
 
 function calendar_add_event_allowed($event) {

calendar/lib.php

@@ -1582,6 +1582,7 @@ function calendar_get_allowed_types(&$allowed) {
     if(!empty($SESSION->cal_course_referer) && $SESSION->cal_course_referer != SITEID) {
         $course = get_record('course', 'id', $SESSION->cal_course_referer);
         $coursecontext = get_context_instance(CONTEXT_COURSE, $SESSION->cal_course_referer);
+        $allowed->user = has_capability('moodle/calendar:manageownentries', $coursecontext);
 
         if(has_capability('moodle/calendar:manageentries', $coursecontext)) {
             $allowed->courses = array($course->id => 1);

calendar/set.php

@@ -41,15 +41,14 @@
     require_once('../config.php');
     require_once($CFG->dirroot.'/calendar/lib.php');
 
-    $from = required_param('from');
-    $var = required_param('var');
-    $value = optional_param('value');
-    $id = optional_param('id');
-    $cal_d = optional_param('cal_d');
-    $cal_m = optional_param('cal_m');
-    $cal_y = optional_param('cal_y');
-    $action = optional_param('action');
-    $type = optional_param('type');
+    $from = required_param('from', PARAM_ALPHA);
+    $var = required_param('var', PARAM_ALPHA);
+    $id = optional_param('id', 0, PARAM_INT);
+    $cal_d = optional_param('cal_d', 0, PARAM_INT);
+    $cal_m = optional_param('cal_m', 0, PARAM_INT);
+    $cal_y = optional_param('cal_y', 0, PARAM_INT);
+    $action = optional_param('action', '', PARAM_ALPHA);
+    $type = optional_param('type', '', PARAM_ALPHA);
 
     // Initialize the session variables
     calendar_session_vars();
@@ -107,7 +106,7 @@
 
     switch($from) {
         case 'event':
-            redirect(CALENDAR_URL.'event.php?action='.$action.'&type='.$type.'&id='.intval($id));
+            redirect(CALENDAR_URL.'event.php?action='.$action.'&type='.$type.'&id='.$id);
         break;
         case 'month':
             redirect(CALENDAR_URL.'view.php?view=month'.$courseid.'&cal_d='.$cal_d.'&cal_m='.$cal_m.'&cal_y='.$cal_y);
@@ -119,7 +118,7 @@
             redirect(CALENDAR_URL.'view.php?view=day'.$courseid.'&cal_d='.$cal_d.'&cal_m='.$cal_m.'&cal_y='.$cal_y);
         break;
         case 'course':
-            redirect($CFG->wwwroot.'/course/view.php?id='.intval($id));
+            redirect($CFG->wwwroot.'/course/view.php?id='.$id);
         break;
         default:
 

calendar/view.php

@@ -426,7 +426,7 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course
     }
 
     // Now display all the calendar
-    for($day = 1; $day <= $display->maxdays; ++$day, ++$dayweek) {
+    for($aday = 1; $aday <= $display->maxdays; ++$aday, ++$dayweek) {
         if($dayweek > $display->maxwday) {
             // We need to change week (table row)
             echo "</tr>\n<tr>";
@@ -436,7 +436,7 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course
 
         // Reset vars
         $cell = '';
-        $dayhref = calendar_get_link_href(CALENDAR_URL.'view.php?view=day&amp;course='.$courseid.'&amp;', $day, $m, $y);
+        $dayhref = calendar_get_link_href(CALENDAR_URL.'view.php?view=day&amp;course='.$courseid.'&amp;', $aday, $m, $y);
 
         if(CALENDAR_WEEKEND & (1 << ($dayweek % 7))) {
             // Weekend. This is true no matter what the exact range is.
@@ -448,35 +448,35 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course
         }
 
         // Special visual fx if an event is defined
-        if(isset($eventsbyday[$day])) {
-            if(count($eventsbyday[$day]) == 1) {
+        if(isset($eventsbyday[$aday])) {
+            if(count($eventsbyday[$aday]) == 1) {
                 $title = get_string('oneevent', 'calendar');
             }
             else {
-                $title = get_string('manyevents', 'calendar', count($eventsbyday[$day]));
+                $title = get_string('manyevents', 'calendar', count($eventsbyday[$aday]));
             }
-            $cell = '<div class="day"><a href="'.$dayhref.'" title="'.$title.'">'.$day.'</a></div>';
+            $cell = '<div class="day"><a href="'.$dayhref.'" title="'.$title.'">'.$aday.'</a></div>';
         }
         else {
-            $cell = '<div class="day">'.$day.'</div>';
+            $cell = '<div class="day">'.$aday.'</div>';
         }
 
         // Special visual fx if an event spans many days
-        if(isset($typesbyday[$day]['durationglobal'])) {
+        if(isset($typesbyday[$aday]['durationglobal'])) {
             $class .= ' duration_global';
         }
-        else if(isset($typesbyday[$day]['durationcourse'])) {
+        else if(isset($typesbyday[$aday]['durationcourse'])) {
             $class .= ' duration_course';
         }
-        else if(isset($typesbyday[$day]['durationgroup'])) {
+        else if(isset($typesbyday[$aday]['durationgroup'])) {
             $class .= ' duration_group';
         }
-        else if(isset($typesbyday[$day]['durationuser'])) {
+        else if(isset($typesbyday[$aday]['durationuser'])) {
             $class .= ' duration_user';
         }
 
         // Special visual fx for today
-        if($display->thismonth && $day == $d) {
+        if($display->thismonth && $aday == $d) {
             $class .= ' today';
         } else {
             $class .= ' nottoday';
@@ -488,9 +488,9 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course
         }
         echo '<td'.$class.'>'.$cell;
 
-        if(isset($eventsbyday[$day])) {
+        if(isset($eventsbyday[$aday])) {
             echo '<ul class="events-new">';
-            foreach($eventsbyday[$day] as $eventindex) {
+            foreach($eventsbyday[$aday] as $eventindex) {
 
                 // If event has a class set then add it to the event <li> tag
                 $eventclass = '';
@@ -502,9 +502,9 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course
             }
             echo '</ul>';
         }
-        if(isset($durationbyday[$day])) {
+        if(isset($durationbyday[$aday])) {
             echo '<ul class="events-underway">';
-            foreach($durationbyday[$day] as $eventindex) {
+            foreach($durationbyday[$aday] as $eventindex) {
                 echo '<li>['.format_string($events[$eventindex]->name,true).']</li>';
             }
             echo '</ul>';

course/editsection.html

@@ -21,7 +21,7 @@
 </tr>
 </table>
 <div class="singlebutton">
-<input type="hidden" name="id" value="<?php echo $form->id ?>" />
+<input type="hidden" name="id" value="<?php echo $id ?>" />
 <input type="hidden" name="sesskey" value="<?php echo sesskey() ?>" />
 <input type="submit" value="<?php print_string("savechanges") ?>" />
 </div>

course/editsection.php

@@ -54,7 +54,7 @@
     } else {
         $sectionname  = get_section_name($course->format);
         $stredit      = get_string('edit', '', " $sectionname $section->section");
-        $strsummaryof = get_string('summaryof', '', " $sectionname $form->section");
+        $strsummaryof = get_string('summaryof', '', " $sectionname $section->section");
     }
 
     print_header_simple($stredit, '', build_navigation(array(array('name' => $stredit, 'link' => null, 'type' => 'misc'))), 'theform.summary' );

course/enrol.php

@@ -53,7 +53,7 @@
     }
 
 /// Check if the course is a meta course  (bug 5734)
-    if ($course->metacourse) {
+    if ($course->metacourse && !($course->guest == 2 && isguestuser())) {
         print_header_simple();
         notice(get_string('coursenotaccessible'), "$CFG->wwwroot/index.php");
     }

enrol/mnet/enrol.php

@@ -315,6 +315,7 @@ class enrolment_plugin_mnet {
             $userrecord->firstname  = addslashes($user['firstname']);
             $userrecord->lastname   = addslashes($user['lastname']);
             $userrecord->mnethostid = $MNET_REMOTE_CLIENT->id;
+            $userrecord->confirmed  = 1;
 
             if ($userrecord->id = insert_record('user', $userrecord)) {
                 $userrecord = get_record('user','id', $userrecord->id);

files/index.php

@@ -539,7 +539,7 @@
                 $file = basename($file);
 
                 if (!unzip_file("$basedir$wdir/$file")) {
-                    print_error("unzipfileserror","error");
+                    print_error("cannotunzipfile", "error");
                 }
 
                 echo "<div style=\"text-align:center\"><form action=\"index.php\" method=\"get\">";

grade/edit/outcome/edit_form.php

@@ -115,7 +115,7 @@ class edit_outcome_form extends moodleform {
             if (empty($courseid)) {
                 $mform->hardFreeze('standard');
 
-            } else if (empty($outcome->courseid) and !has_capability('moodle/grade:manage', get_context_instance(CONTEXT_SYSTEM))) {
+            } else if (!has_capability('moodle/grade:manage', get_context_instance(CONTEXT_SYSTEM))) {
                 $mform->hardFreeze('standard');
 
             } else if ($coursecount and empty($outcome->courseid)) {

install.php

@@ -633,7 +633,7 @@ if (isset($_GET['help'])) {
                     echo '<div id="mssql">' . get_string('databasesettingssub_mssql', 'install');
                 /// Link to mssql installation page
                     echo "<p style='text-align:right'><a href=\"javascript:void(0)\" ";
-                    echo "onclick=\"return window.open('http://docs.moodle.org/en/Installing_MSSQL_for_PHP')\"";
+                    echo "onclick=\"return window.open('http://docs.moodle.org/19/en/Installing_MSSQL_for_PHP')\"";
                     echo ">";
                     echo '<img src="pix/docs.gif' . '" alt="Docs" class="iconhelp" />';
                     echo get_string('moodledocslink', 'install') . '</a></p>';
@@ -642,7 +642,7 @@ if (isset($_GET['help'])) {
                     echo '<div id="mssql_n">' . get_string('databasesettingssub_mssql_n', 'install');
                 /// Link to mssql installation page
                     echo "<p style='text-align:right'><a href=\"javascript:void(0)\" ";
-                    echo "onclick=\"return window.open('http://docs.moodle.org/en/Installing_MSSQL_for_PHP')\"";
+                    echo "onclick=\"return window.open('http://docs.moodle.org/19/en/Installing_MSSQL_for_PHP')\"";
                     echo ">";
                     echo '<img src="pix/docs.gif' . '" alt="Docs" />';
                     echo get_string('moodledocslink', 'install') . '</a></p>';
@@ -651,7 +651,7 @@ if (isset($_GET['help'])) {
                     echo '<div id="odbc_mssql">'. get_string('databasesettingssub_odbc_mssql', 'install');
                 /// Link to mssql installation page
                     echo "<p style='text-align:right'><a href=\"javascript:void(0)\" ";
-                    echo "onclick=\"return window.open('http://docs.moodle.org/en/Installing_MSSQL_for_PHP')\"";
+                    echo "onclick=\"return window.open('http://docs.moodle.org/19/en/Installing_MSSQL_for_PHP')\"";
                     echo ">";
                     echo '<img src="pix/docs.gif' . '" alt="Docs" class="iconhelp" />';
                     echo get_string('moodledocslink', 'install') . '</a></p>';
@@ -660,7 +660,7 @@ if (isset($_GET['help'])) {
                     echo '<div id="oci8po">' . get_string('databasesettingssub_oci8po', 'install');
                 /// Link to oracle installation page
                     echo "<p style='text-align:right'><a href=\"javascript:void(0)\" ";
-                    echo "onclick=\"return window.open('http://docs.moodle.org/en/Installing_Oracle_for_PHP')\"";
+                    echo "onclick=\"return window.open('http://docs.moodle.org/19/en/Installing_Oracle_for_PHP')\"";
                     echo ">";
                     echo '<img src="pix/docs.gif' . '" alt="Docs" class="iconhelp" />';
                     echo get_string('moodledocslink', 'install') . '</a></p>';

lang/README.txt

@@ -16,7 +16,7 @@ To add more languages to Moodle, you can either:
 
 For more information, see the Moodle Documentation:
 
-   http://docs.moodle.org/en/Translation
+   http://docs.moodle.org/19/en/Translation
 
 
 Cheers,

lang/en_utf8/admin.php

@@ -396,6 +396,8 @@ $string['filtersettings'] = 'Manage filters';
 $string['filtersettingsgeneral'] = 'General filter settings';
 $string['filteruploadedfiles'] = 'Filter uploaded files';
 $string['forcelogin'] = 'Force users to login';
+$string['forceloginforprofileimage'] = 'Force users to login to view user pictures';
+$string['forceloginforprofileimage_help'] = 'If enabled, users must login in order to view user profile pictures and the default user picture will be used in all notification emails.';
 $string['forceloginforprofiles'] = 'Force users to login for profiles';
 $string['forcetimezone'] = 'Force default timezone';
 $string['framename'] = 'Frame name';
@@ -493,6 +495,8 @@ $string['location'] = 'Location';
 $string['locationsettings'] = 'Location settings';
 $string['log'] = 'Logs';
 $string['loginhttps'] = 'Use HTTPS for logins';
+$string['loginpasswordautocomplete'] = 'Prevent password autocompletion on login form.';
+$string['loginpasswordautocomplete_help'] = 'Having this off will let users save their account password in their browser. Switching this setting on will result in your site no longer following XHTML strict validation rules.';
 $string['loglifetime'] = 'Keep logs for';
 $string['longtimenosee'] = 'Unsubscribe users from courses after';
 $string['longtimewarning'] = '<b>Please note that this process can take a long time.</b>';
@@ -770,7 +774,7 @@ $string['uploadpicture_userupdated'] = 'Picture updated for user $a.';
 $string['uploadpicture_cannotsave'] = 'Cannot save picture for user $a. Check original picture file.';
 $string['updatetimezones'] = 'Update timezones';
 $string['upgrade197notice'] = '<p>Moodle 1.9.7 contains a number of security fixes to user passwords and backups to protect the user data on your site. As a result some of your settings and permissions relating to backups may have changed.<br />
-See the <a href=\"http://docs.moodle.org/en/Moodle_1.9.7_release_notes\" target=\"_blank\">Moodle 1.9.7 release notes</a> for full details.</p>';
+See the <a href=\"http://docs.moodle.org/dev/Moodle_1.9.7_release_notes\" target=\"_blank\">Moodle 1.9.7 release notes</a> for full details.</p>';
 $string['upgrade197noticesubject'] = 'Moodle 1.9.7 upgrade security notices';
 $string['upgrade197salt'] = 'To reduce the risk of password theft, you are strongly recommended to set a password salt.<br />See the <a href=\"$a\" target=\"_blank\">password salting documentation</a> for details.';
 $string['upgradeforumread'] = 'A new feature has been added in Moodle 1.5 to track read/unread forum posts.<br />To use this functionality you need to <a href=\"$a\">update your tables</a>.';

lang/en_utf8/auth.php

@@ -256,7 +256,7 @@ $string['auth_ldaptitle'] = 'LDAP server';
 $string['auth_ldapnotinstalled'] = 'Cannot use LDAP authentication. The PHP LDAP module is not installed.';
 $string['auth_ntlmsso'] = 'NTLM SSO';
 $string['auth_ntlmsso_enabled_key'] = 'Enable';
-$string['auth_ntlmsso_enabled'] = 'Set to yes to attempt Single Sign On with the NTLM domain. <strong>Note:</strong> this requires additional setup on the webserver to work, see <a href=\"http://docs.moodle.org/en/NTLM_authentication\">http://docs.moodle.org/en/NTLM_authentication</a>';
+$string['auth_ntlmsso_enabled'] = 'Set to yes to attempt Single Sign On with the NTLM domain. <strong>Note:</strong> this requires additional setup on the webserver to work, see <a href=\"http://docs.moodle.org/19/en/NTLM_authentication\">http://docs.moodle.org/19/en/NTLM_authentication</a>';
 $string['auth_ntlmsso_ie_fastpath'] = 'Set to yes to enable the NTLM SSO fast path (bypasses certain steps and only works if the client\'s browser is MS Internet Explorer).';
 $string['auth_ntlmsso_ie_fastpath_key'] = 'MS IE fast path?';
 $string['auth_ntlmsso_subnet_key'] = 'Subnet';

lang/en_utf8/data.php

@@ -215,7 +215,7 @@ $string['recordsnotsaved'] = 'No entry was saved. Please check the format of the
 $string['recordssaved'] = 'entries saved';
 $string['requireapproval'] = 'Require approval?';
 $string['requiredentries'] = 'Required entries';
-$string['requiredentrieschanged'] = '<p><strong>IMPORTANT - PLEASE READ </strong></p><p>Due to a bug fix, the behaviour of database activities using the \'Required entries\' and \'Required entries before viewing settings\' settings will change. A more detailed explaination of the changes can be read on <a href=\"http://moodle.org/mod/forum/discuss.php?d=110928\" target=\"_blank\">the database module forum</a>. The expected behavior of these settings can also be read on <a href=\"http://docs.moodle.org/en/Adding/editing_a_database#Required_entries\" target=\"_blank\">Moodle Docs</a>.
+$string['requiredentrieschanged'] = '<p><strong>IMPORTANT - PLEASE READ </strong></p><p>Due to a bug fix, the behaviour of database activities using the \'Required entries\' and \'Required entries before viewing settings\' settings will change. A more detailed explaination of the changes can be read on <a href=\"http://moodle.org/mod/forum/discuss.php?d=110928\" target=\"_blank\">the database module forum</a>. The expected behavior of these settings can also be read on <a href=\"http://docs.moodle.org/19/en/Adding/editing_a_database#Required_entries\" target=\"_blank\">Moodle Docs</a>.
 </p><p>This change affects the following databases in your system: (Please save this list now, and after the upgrade, check that these activities still work the way that the teacher intends.)</p><strong style=\"color:red\">$a->text</strong><br/>';
 $string['requiredentriestoview'] = 'Entries required before viewing';
 $string['resettemplate'] = 'Reset template';

lang/en_utf8/docs/README.txt

@@ -5,7 +5,7 @@ All of it has gone now because we now use the Moodle Docs wiki.
 
 To find out the new locations for all the information that was here, see:
 
-    http://docs.moodle.org/en/MoodleDocs_and_lang_packs
+    http://docs.moodle.org/19/en/MoodleDocs_and_lang_packs
 
     http://tracker.moodle.org/browse/MDL-4912
 

lang/en_utf8/docs/licence.html

@@ -11,7 +11,7 @@
 </head>
 <body>
 
-(For the most up-to-date version of this license, see <a href="http://docs.moodle.org/en/License">Moodle Docs</a>).
+(For the most up-to-date version of this license, see <a href="http://docs.moodle.org/dev/License">Moodle Docs</a>).
     
 <h1>Copyright License for Moodle</h1>
 <blockquote>

lang/en_utf8/error.php

@@ -139,5 +139,6 @@ $string['wrongdestpath'] = 'Wrong destination path';
 $string['wrongsourcebase'] = 'Wrong source URL base';
 $string['wrongzipfilename'] = 'Wrong ZIP file name';
 $string['youcannotdeletecategory'] = 'You cannot delete category \'$a\' because you can neither delete the contents, nor move them elsewhere.';
+$string['zipfileserror'] = 'Cannot create zip file';
 
 ?>

lang/en_utf8/help/install.html

@@ -48,7 +48,7 @@
     one of the few webhosts that does not support these features ask them why, 
     and consider taking your business elsewhere.</p>
   <p>If you want to run Moodle on your own computer and all this looks a bit daunting, 
-    then please take a look at <a href="http://docs.moodle.org/en/Administrator_documentation">the administrator documentation</a>.</p>
+    then please take a look at <a href="http://docs.moodle.org/19/en/Administrator_documentation">the administrator documentation</a>.</p>
   <p>&nbsp;</p>
 </div>
 
@@ -266,7 +266,7 @@ php_value post_max_size 2M</pre>
       '1', teacher varchar(100) NOT NULL default 'Teacher', startdate int(10) 
       unsigned NOT NULL default '0', enddate int(10) unsigned NOT NULL default 
       '0', timemodified int(10) unsigned NOT NULL default '0', PRIMARY KEY (id)) 
-      TYPE=MyISAM</p>
+      ENGINE=MyISAM</p>
     <p class="success">SUCCESS</p>
   </div>
   <p>...and so on, followed by: <span class="success">Main databases set up 
@@ -416,7 +416,7 @@ php_value post_max_size 2M</pre>
     for them using the &quot;Add a new user&quot; on the Admin page.</p>
   <p>Once done, the course is ready to customise, and is accessible via the &quot;Courses&quot; 
     link on the home page.</p>
-  <p>See the &quot;<a href="http://docs.moodle.org/en/Teacher_documentation">Teacher Documentation</a>&quot; for more details 
+  <p>See the &quot;<a href="http://docs.moodle.org/19/en/Teacher_documentation">Teacher Documentation</a>&quot; for more details
     on course-building.</p>
   <p>&nbsp;</p>
   <p class="center"><strong>Happy exploring and happy Moodling!</strong></p>

lang/en_utf8/help/question/categories.html

@@ -31,5 +31,5 @@ cannot delete the last category in a context.</li>
 <ul>
   <li><a href="help.php?module=question&amp;file=categorycontexts.html">Category contexts</a></li>
   <li><a href="help.php?module=question&amp;file=permissions.html">Question permissions</a></li>
-  <li><a href="http://docs.moodle.org/en/Question_categories">Question categories help on Moodle Docs</a></li>
+  <li><a href="http://docs.moodle.org/19/en/Question_categories">Question categories help on Moodle Docs</a></li>
 </ul>

lang/en_utf8/help/question/categorycontexts.html

@@ -15,5 +15,5 @@ your questions in any or all of the parent course categories).</li>
 <ul>
   <li><a href="help.php?module=question&amp;file=categories.html">Question categories</a></li>
   <li><a href="help.php?module=question&amp;file=permissions.html">Question permissions</a></li>
-  <li><a href="http://docs.moodle.org/en/Question_contexts">Question contexts documentation on Moodle Docs</a></li>
+  <li><a href="http://docs.moodle.org/19/en/Question_contexts">Question contexts documentation on Moodle Docs</a></li>
 </ul>

lang/en_utf8/install.php

@@ -258,7 +258,7 @@ $string['phpversionhelp'] = '<p>Moodle requires a PHP version of at least 4.3.0
 $string['postgres7'] = 'PostgreSQL (postgres7)';
 $string['postgresqlwarning'] = '<strong>Note:</strong> If you experience some connection problems, you can try to set Host Server field as
  host=\'postgresql_host\' port=\'5432\' dbname=\'postgresql_database_name\' user=\'postgresql_user\' password=\'postgresql_user_password\'
-and to leave empty the Database, User and Password fields. More information on <a href=\"http://docs.moodle.org/en/Installing_Postgres_for_PHP\">Moodle Docs</a>';
+and to leave empty the Database, User and Password fields. More information on <a href=\"http://docs.moodle.org/19/en/Installing_Postgres_for_PHP\">Moodle Docs</a>';
 $string['safemode'] = 'Safe Mode';
 $string['safemodeerror'] = 'Moodle may have trouble with safe mode on';
 $string['safemodehelp'] = '<p>Moodle may have a variety of problems with safe mode on, not least is that 

lang/en_utf8/mnet.php

@@ -208,6 +208,7 @@ $string['addtoacl'] = 'Add to Access Control';
 $string['accesslevel'] = 'Access Level';
 $string['ssoaccesscontrol'] = 'SSO Access Control';
 $string['notpermittedtojump'] = 'You do not have permission to begin a remote session from this Moodle hub.';
+$string['notpermittedtojumpas'] = 'You can\'t begin a remote session while you are logged in as another user.';
 $string['notpermittedtoland'] = 'You do not have permission to begin a remote session.';
 $string['authfail_nosessionexists'] = 'Authorisation failed: the mnet session does not exist.';
 $string['authfail_sessiontimedout'] = 'Authorisation failed: the mnet session has timed out.';

lang/en_utf8/moodle.org.php

@@ -49,7 +49,7 @@ $string['downloadcore'] = 'Our main method of distribution is via these standard
 $string['downloadcoretitle'] = 'Standard Moodle packages';
 $string['downloadcvs'] = 'Another way to get the core source code is by using CVS to connect directly to one of our mirrors of the code repository used by Moodle developers.  This makes upgrading very easy, even if you have made local changes to the source code.';
 $string['downloadcvstitle'] = 'Moodle via CVS';
-$string['downloadintro'] = 'Moodle is open source under the <a href=\"http://docs.moodle.org/en/License\">GPL licence</a>.  Everything we produce is available for you to download and use for free.';
+$string['downloadintro'] = 'Moodle is open source under the <a href=\"http://docs.moodle.org/dev/License\">GPL licence</a>.  Everything we produce is available for you to download and use for free.';
 $string['downloadlang'] = 'In current versions of Moodle, adding support for new languages has been automated from the administration menu within your site.  However, for some older versions of Moodle, new language packs need to be downloaded manually.';
 $string['downloadlangtitle'] = 'Language packs';
 $string['downloadlogotitle'] = 'Moodle logos';

lang/en_utf8/moodle.php

@@ -161,7 +161,7 @@ $string['backupmetacoursehelp'] = 'If enabled, then metacourse info (inherited e
 $string['backupnameformat'] = '%%Y%%m%%d-%%H%%M';
 $string['backupmissinguserinfoperms'] = 'Note: This backup contains no user data. Exercise and Workshop activities will not be included in the backup, since these modules are not compatible with this type of backup.';
 $string['backupnoneusersinfo'] = 'Note: This backup contains no users and so all activities have been switched to \"without user data\" mode. Exercise and Workshop activities will not be included in the backup, since these modules are not compatible with this type of backup.';
-$string['backupnonisowarning'] = 'Warning: this backup is from a non-Unicode version of Moodle (pre 1.6).  If this backup contains any non-ISO-8859-1 texts then they may be CORRUPTED if you try to restore them to this Unicode version of Moodle.  See the <a href=\"http://docs.moodle.org/en/Backup_FAQ\">Backup FAQ</a> for more information about how to recover this backup correctly.';
+$string['backupnonisowarning'] = 'Warning: this backup is from a non-Unicode version of Moodle (pre 1.6).  If this backup contains any non-ISO-8859-1 texts then they may be CORRUPTED if you try to restore them to this Unicode version of Moodle.  See the <a href=\"http://docs.moodle.org/19/en/Backup_FAQ\">Backup FAQ</a> for more information about how to recover this backup correctly.';
 $string['backupnext'] = 'Next backup';
 $string['backuporiginalname'] = 'Backup Name';
 $string['backuproleassignments'] = 'Backup role assignments for these roles';
@@ -503,6 +503,7 @@ $string['emaildisable'] = 'This email address is disabled';
 $string['emaildisableclick'] = 'Click here to disable all email from being sent to this address';
 $string['emaildisplay'] = 'Email display';
 $string['emaildisplaycourse'] = 'Allow only other course members to see my email address';
+$string['emaildisplayhidden'] = 'Email hidden';
 $string['emaildisplayno'] = 'Hide my email address from everyone';
 $string['emaildisplayyes'] = 'Allow everyone to see my email address';
 $string['emailenable'] = 'This email address is enabled';
@@ -732,7 +733,7 @@ but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 
 See the Moodle License information page for full details:
-http://docs.moodle.org/en/License';
+http://docs.moodle.org/dev/License';
 $string['grade'] = 'Grade';
 $string['grades'] = 'Grades';
 $string['group'] = 'Group';

lang/en_utf8/report_spamcleaner.php

@@ -3,7 +3,7 @@ $string['spamauto'] = 'Autodetect common spam patterns';
 $string['spamcannotdelete'] = 'Cannot delete this user';
 $string['spamcannotfinduser'] = 'No users matching your search';
 $string['spamcleaner'] = 'Spam cleaner';
-$string['spamcleanerintro'] = 'This script allows you to search all user profiles for certain strings and then delete those accounts which are obviously created by spammers.  You can search for multiple keywords using commas (eg casino, porn)<br /><br />Moodle docs has more information about <a href=\"http://docs.moodle.org/en/Reducing_spam_in_Moodle\">Reducing spam in Moodle</a>.';
+$string['spamcleanerintro'] = 'This script allows you to search all user profiles for certain strings and then delete those accounts which are obviously created by spammers.  You can search for multiple keywords using commas (eg casino, porn)<br /><br />Moodle docs has more information about <a href=\"http://docs.moodle.org/19/en/Reducing_spam_in_Moodle\">Reducing spam in Moodle</a>.';
 $string['spamdesc'] = 'Description';
 $string['spamdeleteall'] = 'Delete all these user accounts';
 $string['spamdeleteconfirm'] = 'Are you sure you want to delete this entry?  You can not undo this.';

lang/en_utf8/xmldb.php

@@ -73,7 +73,7 @@ $string['indexes'] = 'Indexes';
 $string['integerincorrectlength'] = 'Incorrect length for integer field';
 $string['key'] = 'Key';
 $string['keys'] = 'Keys';
-$string['listreservedwords'] = 'List of Reserved Words<br />(used to keep <a href=\"http://docs.moodle.org/en/XMLDB_reserved_words\" target=\"_blank\">XMLDB_reserved_words</a> updated)';
+$string['listreservedwords'] = 'List of Reserved Words<br />(used to keep <a href=\"http://docs.moodle.org/19/en/XMLDB_reserved_words\" target=\"_blank\">XMLDB_reserved_words</a> updated)';
 $string['load'] = 'Load';
 $string['missing'] = 'Missing';
 $string['missingindexes'] = 'Missing Indexes Found';

lib/accesslib.php

@@ -144,7 +144,7 @@ define('CONTEXT_COURSE', 50);
 define('CONTEXT_MODULE', 70);
 define('CONTEXT_BLOCK', 80);
 
-// capability risks - see http://docs.moodle.org/en/Development:Hardening_new_Roles_system
+// capability risks - see http://docs.moodle.org/dev/Hardening_new_Roles_system
 define('RISK_MANAGETRUST', 0x0001);
 define('RISK_CONFIG',      0x0002);
 define('RISK_XSS',         0x0004);

lib/adminlib.php

@@ -4942,14 +4942,18 @@ function print_plugin_tables() {
     $installed_mods = get_records_list('modules', '', '', '', 'name');
     $installed_blocks = get_records_list('block', '', '', '', 'name');
 
+    $plugins_installed['mod'] = array();
     foreach($installed_mods as $mod) {
         $plugins_installed['mod'][] = $mod->name;
     }
 
+    $plugins_installed['blocks'] = array();
     foreach($installed_blocks as $block) {
         $plugins_installed['blocks'][] = $block->name;
     }
 
+    $plugins_installed['filter'] = array();
+
     $plugins_ondisk = array();
     $plugins_ondisk['mod'] = get_list_of_plugins('mod', 'db');
     $plugins_ondisk['blocks'] = get_list_of_plugins('blocks', 'db');

lib/datalib.php

@@ -1238,7 +1238,7 @@ function get_categories($parent='none', $sort=NULL, $shallow=true) {
                 JOIN {$CFG->prefix}context ctx
                   ON cc.id=ctx.instanceid AND ctx.contextlevel=".CONTEXT_COURSECAT."
                 JOIN {$CFG->prefix}course_categories ccp
-                     ON (cc.path LIKE ".sql_concat('ccp.path',"'%'").")
+                     ON ((cc.parent=ccp.id) OR (cc.path LIKE ".sql_concat('ccp.path',"'/%'")."))
                 WHERE ccp.id=$parent
                 $sort";
     }

lib/db/mysql.php

@@ -254,7 +254,7 @@ function main_upgrade($oldversion=0) {
                              `userid` int(10) unsigned NOT NULL default '0',
                              PRIMARY KEY  (`id`),
                              UNIQUE KEY `id` (`id`)
-                             ) TYPE=MyISAM COMMENT='One record per course creator';");
+                             ) ENGINE=MyISAM COMMENT='One record per course creator';");
     }
     if ($oldversion < 2003032602) {
         // Redoing it because of no prefix last time
@@ -362,7 +362,7 @@ function main_upgrade($oldversion=0) {
                         PRIMARY KEY  (`id`),
                         UNIQUE KEY `id` (`id`),
                         KEY `courseuserid` (course,userid)
-                     ) TYPE=MyISAM COMMENT='Stores info about how to display the course'");
+                     ) ENGINE=MyISAM COMMENT='Stores info about how to display the course'");
     }
 
     if ($oldversion < 2003050400) {
@@ -458,7 +458,7 @@ function main_upgrade($oldversion=0) {
                          `description` text NOT NULL,
                          `timemodified` int(10) unsigned NOT NULL default '0',
                          PRIMARY KEY  (id)
-                       ) TYPE=MyISAM COMMENT='Defines grading scales'");
+                       ) ENGINE=MyISAM COMMENT='Defines grading scales'");
 
     }
 
@@ -558,7 +558,7 @@ function main_upgrade($oldversion=0) {
                                 `timemodified` int(10) unsigned NOT NULL default '0',
                                 PRIMARY KEY  (`id`),
                                 KEY `courseid` (`courseid`)
-                              ) TYPE=MyISAM COMMENT='Each record is a group in a course.'; ");
+                              ) ENGINE=MyISAM COMMENT='Each record is a group in a course.'; ");
 
         modify_database("", "CREATE TABLE `prefix_groups_members` (
                                 `id` int(10) unsigned NOT NULL auto_increment,
@@ -567,7 +567,7 @@ function main_upgrade($oldversion=0) {
                                 `timeadded` int(10) unsigned NOT NULL default '0',
                                 PRIMARY KEY  (`id`),
                                 KEY `groupid` (`groupid`)
-                              ) TYPE=MyISAM COMMENT='Lists memberships of users in groups'; ");
+                              ) ENGINE=MyISAM COMMENT='Lists memberships of users in groups'; ");
     }
 
     if ($oldversion < 2003121800) {
@@ -601,7 +601,7 @@ function main_upgrade($oldversion=0) {
                               UNIQUE KEY `id` (`id`),
                               KEY `courseid` (`courseid`),
                               KEY `userid` (`userid`)
-                            ) TYPE=MyISAM COMMENT='For everything with a time associated to it'; ");
+                            ) ENGINE=MyISAM COMMENT='For everything with a time associated to it'; ");
     }
 
     if ($oldversion < 2004012800) {
@@ -613,7 +613,7 @@ function main_upgrade($oldversion=0) {
                               PRIMARY KEY  (`id`),
                               UNIQUE KEY `id` (`id`),
                               KEY `useridname` (userid,name)
-                            ) TYPE=MyISAM COMMENT='Allows modules to store arbitrary user preferences'; ");
+                            ) ENGINE=MyISAM COMMENT='Allows modules to store arbitrary user preferences'; ");
     }
 
     if ($oldversion < 2004012900) {
@@ -637,7 +637,7 @@ function main_upgrade($oldversion=0) {
                                 `timemodified` int(10) unsigned NOT NULL default '0',
                                 PRIMARY KEY  (`id`),
                                 KEY `md5key` (`md5key`)
-                             ) TYPE=MyISAM COMMENT='For storing temporary copies of processed texts';");
+                             ) ENGINE=MyISAM COMMENT='For storing temporary copies of processed texts';");
     }
 
     if ($oldversion < 2004021000) {
@@ -667,7 +667,7 @@ function main_upgrade($oldversion=0) {
                                 `timemodified` int(10) unsigned NOT NULL default '0',
                                 PRIMARY KEY  (`id`),
                                 KEY `filtermd5key` (filter,md5key)
-                              ) TYPE=MyISAM COMMENT='For keeping information about cached data';");
+                              ) ENGINE=MyISAM COMMENT='For keeping information about cached data';");
     }
 
     if ($oldversion < 2004021500) {
@@ -865,7 +865,7 @@ function main_upgrade($oldversion=0) {
                           `data` text NOT null,
                           PRIMARY KEY (`sesskey`), 
                           KEY (`expiry`) 
-                      ) TYPE=MyISAM COMMENT='Optional database session storage, not used by default';");
+                      ) ENGINE=MyISAM COMMENT='Optional database session storage, not used by default';");
     }
 
     if ($oldversion < 2004111500) {  // Update any users/courses using wrongly-named lang pack
@@ -1043,7 +1043,7 @@ function main_upgrade($oldversion=0) {
                                PRIMARY KEY  (`id`),
                                KEY `useridfrom` (`useridfrom`),
                                KEY `useridto` (`useridto`)
-                             ) TYPE=MyISAM COMMENT='Stores all unread messages';");
+                             ) ENGINE=MyISAM COMMENT='Stores all unread messages';");
 
         modify_database('',"CREATE TABLE `prefix_message_read` (
                                `id` int(10) unsigned NOT NULL auto_increment,
@@ -1057,7 +1057,7 @@ function main_upgrade($oldversion=0) {
                                PRIMARY KEY  (`id`),
                                KEY `useridfrom` (`useridfrom`),
                                KEY `useridto` (`useridto`)
-                             ) TYPE=MyISAM COMMENT='Stores all messages that have been read';");
+                             ) ENGINE=MyISAM COMMENT='Stores all messages that have been read';");
 
         modify_database('',"CREATE TABLE `prefix_message_contacts` (
                                `id` int(10) unsigned NOT NULL auto_increment,
@@ -1066,7 +1066,7 @@ function main_upgrade($oldversion=0) {
                                `blocked` tinyint(1) unsigned NOT NULL default '0',
                                PRIMARY KEY  (`id`),
                                UNIQUE KEY `usercontact` (`userid`,`contactid`)
-                             ) TYPE=MyISAM COMMENT='Maintains lists of relationships between users';");
+                             ) ENGINE=MyISAM COMMENT='Maintains lists of relationships between users';");
 
         modify_database('', "INSERT INTO prefix_log_display (module, action, mtable, field) VALUES ('message', 'write', 'user', 'CONCAT(firstname,\" \",lastname)'); ");
         modify_database('', "INSERT INTO prefix_log_display (module, action, mtable, field) VALUES ('message', 'read', 'user', 'CONCAT(firstname,\" \",lastname)'); ");
@@ -1243,7 +1243,7 @@ function main_upgrade($oldversion=0) {
                               `std_skipweeks` tinyint(3) NOT NULL default '0',
                               `std_time` varchar(5) NOT NULL default '00:00',
                               PRIMARY KEY (`id`)
-                            ) TYPE=MyISAM COMMENT='Rules for calculating local wall clock time for users';");
+                            ) ENGINE=MyISAM COMMENT='Rules for calculating local wall clock time for users';");
     }
 
     if ($oldversion < 2005032800) {
@@ -1257,7 +1257,7 @@ function main_upgrade($oldversion=0) {
             `weight` decimal(4,2) NOT NULL default '0.00',
             PRIMARY KEY  (`id`),
             KEY `courseid` (`courseid`)
-          ) TYPE=MyISAM ;");
+          ) ENGINE=MyISAM ;");
 
         execute_sql("CREATE TABLE `{$CFG->prefix}grade_exceptions` (
             `id` int(10) unsigned NOT NULL auto_increment,
@@ -1266,7 +1266,7 @@ function main_upgrade($oldversion=0) {
             `userid` int(10) unsigned NOT NULL default '0',
             PRIMARY KEY  (`id`),
             KEY `courseid` (`courseid`)
-          ) TYPE=MyISAM ;");
+          ) ENGINE=MyISAM ;");
 
 
         execute_sql("CREATE TABLE `{$CFG->prefix}grade_item` (
@@ -1280,7 +1280,7 @@ function main_upgrade($oldversion=0) {
             `sort_order` int(10) unsigned NOT NULL default '0',
             PRIMARY KEY  (`id`),
             KEY `courseid` (`courseid`)
-          ) TYPE=MyISAM ;");
+          ) ENGINE=MyISAM ;");
 
 
         execute_sql("CREATE TABLE `{$CFG->prefix}grade_letter` (
@@ -1291,7 +1291,7 @@ function main_upgrade($oldversion=0) {
             `grade_low` decimal(4,2) NOT NULL default '0.00',
             PRIMARY KEY  (`id`),
             KEY `courseid` (`courseid`)
-          ) TYPE=MyISAM ;");
+          ) ENGINE=MyISAM ;");
           
 
         execute_sql("CREATE TABLE `{$CFG->prefix}grade_preferences` (
@@ -1301,7 +1301,7 @@ function main_upgrade($oldversion=0) {
             `value` int(10) NOT NULL default '0',
             PRIMARY KEY  (`id`),
             UNIQUE KEY `courseidpreference` (`courseid`,`preference`)
-          ) TYPE=MyISAM ;");
+          ) ENGINE=MyISAM ;");
           
     }
 
@@ -1372,7 +1372,7 @@ function main_upgrade($oldversion=0) {
                                   `value`      text NOT NULL default '',
                                   PRIMARY KEY  (`id`),
                                            UNIQUE KEY `plugin_name` (`plugin`, `name`)
-                                  ) TYPE=MyISAM 
+                                  ) ENGINE=MyISAM
                                   COMMENT='Moodle modules and plugins configuration variables';");
     }
 
@@ -1493,7 +1493,7 @@ function main_upgrade($oldversion=0) {
           `requester` int(10) NOT NULL default 0,
           PRIMARY KEY (`id`),
           KEY `shortname` (`shortname`)
-        ) TYPE=MyISAM;");
+        ) ENGINE=MyISAM;");
         
         table_column('course','','requested');
     }
@@ -1506,7 +1506,7 @@ function main_upgrade($oldversion=0) {
          PRIMARY KEY (`id`),
          KEY `course` (`course`),
          KEY `module` (`module`)
-      ) TYPE=MyISAM;");
+      ) ENGINE=MyISAM;");
         
         table_column('course','','restrictmodules','int','1','','0','not null');
     }
@@ -1692,7 +1692,7 @@ function main_upgrade($oldversion=0) {
           UNIQUE KEY `id_user_idx` (`id`, `userid`),
           KEY `post_lastmodified_idx` (`lastmodified`),
           KEY `post_subject_idx` (`subject`)
-        ) TYPE=MyISAM  COMMENT='New moodle post table. Holds data posts such as forum entries or blog entries.';");
+        ) ENGINE=MyISAM  COMMENT='New moodle post table. Holds data posts such as forum entries or blog entries.';");
 
         modify_database("","CREATE TABLE prefix_tags (
           `id` int(10) unsigned NOT NULL auto_increment,
@@ -1700,7 +1700,7 @@ function main_upgrade($oldversion=0) {
           `userid` int(10) unsigned NOT NULL default'0',
           `text` varchar(255) NOT NULL default '',
           PRIMARY KEY  (`id`)
-        ) TYPE=MyISAM COMMENT ='tags structure for moodle.';");
+        ) ENGINE=MyISAM COMMENT ='tags structure for moodle.';");
 
         modify_database("","CREATE TABLE prefix_blog_tag_instance (
           `id` int(10) unsigned NOT NULL auto_increment,
@@ -1710,7 +1710,7 @@ function main_upgrade($oldversion=0) {
           `courseid` int(10) unsigned NOT NULL default'0',
           `userid` int(10) unsigned NOT NULL default'0',
           PRIMARY KEY  (`id`)
-          ) TYPE=MyISAM COMMENT ='tag instance for blogs.';");
+          ) ENGINE=MyISAM COMMENT ='tag instance for blogs.';");
     }
 
     if ($oldversion < 2006031400) {
@@ -1799,7 +1799,7 @@ function main_upgrade($oldversion=0) {
                                `mtable` varchar(30),
                                `field` varchar(50),
                                PRIMARY KEY (`id`)
-                               ) TYPE=MyISAM");
+                               ) ENGINE=MyISAM");
         
         // Add index to ensure that module and action combination is unique.
         modify_database('', "ALTER TABLE prefix_log_display ADD UNIQUE `moduleaction`(`module` , `action`)");
@@ -2193,7 +2193,7 @@ function main_upgrade($oldversion=0) {
                     KEY `courseid` (`courseid`),
                     UNIQUE KEY `userid-courseid` (`userid`, `courseid`),
                     PRIMARY KEY (`id`) 
-                    )TYPE=MYISAM COMMENT ='time user last accessed any page in a course';", true);
+                    )ENGINE=MyISAM COMMENT ='time user last accessed any page in a course';", true);
     }
 
     if (!empty($CFG->rolesactive) and $oldversion < 2006091212) {   // Reload the guest roles completely with new defaults

lib/db/upgrade.php

@@ -370,7 +370,7 @@ function xmldb_main_upgrade($oldversion=0) {
         drop_index($table, $index);
         $index->setFields(array('mnethostid', 'username'));
         if (!add_index($table, $index)) {
-            notify(get_string('duplicate_usernames', 'mnet', 'http://docs.moodle.org/en/DuplicateUsernames'));
+            notify(get_string('duplicate_usernames', 'mnet', 'http://docs.moodle.org/19/en/DuplicateUsernames'));
         }
 
         unset($table, $field, $index);
@@ -3292,6 +3292,15 @@ function xmldb_main_upgrade($oldversion=0) {
     }
 
     if ($result && $oldversion < 2007101571.01) {
+        // Remove category_sortorder index that was supposed to be removed long time ago
+        $table = new XMLDBTable('course');
+        $index = new XMLDBIndex('category_sortorder');
+        $index->setAttributes(XMLDB_INDEX_UNIQUE, array('category', 'sortorder'));
+
+        if (index_exists($table, $index)) {
+            drop_index($table, $index);
+        }
+
         // MDL-21011 bring down course sort orders away from maximum values
         $sql = "SELECT id, category, sortorder from {$CFG->prefix}course
                 ORDER BY sortorder ASC;";
@@ -3368,6 +3377,19 @@ function xmldb_main_upgrade($oldversion=0) {
         upgrade_main_savepoint($result, 2007101591.01);
     }
 
+    if ($result && $oldversion < 2007101591.05) {
+        // Remove category_sortorder index that was supposed to be removed long time ago
+        $table = new XMLDBTable('course');
+        $index = new XMLDBIndex('category_sortorder');
+        $index->setAttributes(XMLDB_INDEX_UNIQUE, array('category', 'sortorder'));
+
+        if (index_exists($table, $index)) {
+            drop_index($table, $index);
+        }
+        upgrade_main_savepoint($result, 2007101591.05);
+    }
+
+
     return $result;
 }
 

lib/ddllib.php

@@ -36,7 +36,7 @@
 // This library should be used, exclusively, by the installation and
 // upgrade process of Moodle.
 //
-// For further documentation, visit http://docs.moodle.org/en/DDL_functions
+// For further documentation, visit http://docs.moodle.org/19/en/DDL_functions
 
 /// Add required XMLDB constants
     require_once($CFG->libdir . '/xmldb/classes/XMLDBConstants.php');
@@ -67,7 +67,7 @@
  * Add a new field to a table, or modify an existing one (if oldfield is defined).
  *
  * WARNING: This function is deprecated and will be removed in future versions.
- * Please use XMLDB (see http://docs.moodle.org/en/Development:DDL_functions ).
+ * Please use XMLDB (see http://docs.moodle.org/dev/DDL_functions ).
  *
  * Warning: Please be careful on primary keys, as this function will eat auto_increments
  *

lib/dmllib.php

@@ -32,7 +32,7 @@
 /// include it yourself.
 
 /// For more info about the functions available in this library, please visit:
-///     http://docs.moodle.org/en/DML_functions
+///     http://docs.moodle.org/19/en/DML_functions
 /// (feel free to modify, improve and document such page, thanks!)
 
 /// GLOBAL CONSTANTS /////////////////////////////////////////////////////////
@@ -569,6 +569,7 @@ function get_record_select($table, $select='', $fields='*') {
 function get_recordset($table, $field='', $value='', $sort='', $fields='*', $limitfrom='', $limitnum='') {
 
     if ($field) {
+        $value = sql_magic_quotes_hack($value);
         $select = "$field = '$value'";
     } else {
         $select = '';
@@ -710,7 +711,7 @@ function recordset_to_array($rs) {
         $objects = array();
     /// First of all, we are going to get the name of the first column
     /// to introduce it back after transforming the recordset to assoc array
-    /// See http://docs.moodle.org/en/XMLDB_Problems, fetch mode problem.
+    /// See http://docs.moodle.org/19/en/XMLDB_Problems, fetch mode problem.
         $firstcolumn = $rs->FetchField(0);
     /// Get the whole associative array
         if ($records = $rs->GetAssoc(true)) {
@@ -1433,7 +1434,7 @@ function delete_records_select($table, $select='') {
  * @param string $table The database table to be checked against.
  * @param object $dataobject A data object with values for one or more fields in the record
  * @param bool $returnid Should the id of the newly created record entry be returned? If this option is not requested then true/false is returned.
- * @param string $primarykey (obsolete) This is now forced to be 'id'. 
+ * @param string $primarykey (obsolete) This is now forced to be 'id'.
  */
 function insert_record($table, $dataobject, $returnid=true, $primarykey='id') {
 
@@ -1447,6 +1448,14 @@ function insert_record($table, $dataobject, $returnid=true, $primarykey='id') {
     if (is_array($dataobject)) {
         debugging('Warning. Wrong call to insert_record(). $dataobject must be an object. array found instead', DEBUG_DEVELOPER);
         $dataobject = (object)$dataobject;
+    } else if (is_object($dataobject)) {
+        // make sure there are no properties or private methods because we cast to array later,
+        // at the same time this undos the object references so that PHP 5 works the same as PHP 4,
+        // the main reason for this is BC after the dirty magic hack introduction
+        if ($properties = get_object_vars($dataobject)) {
+            $dataobject = (object)$properties;
+        }
+        unset($properties);
     }
 
 /// Temporary hack as part of phasing out all access to obsolete user tables  XXX
@@ -1463,6 +1472,11 @@ function insert_record($table, $dataobject, $returnid=true, $primarykey='id') {
 /// so let's unset it now before it causes any trouble later
     unset($dataobject->{$primarykey});
 
+/// Extra protection against SQL injections
+    foreach((array)$dataobject as $k=>$v) {
+        $dataobject->$k = sql_magic_quotes_hack($v);
+    }
+
 /// Get an empty recordset. Cache for multiple inserts.
     if (empty($empty_rs_cache[$table])) {
         /// Execute a dummy query to get an empty recordset
@@ -1637,6 +1651,19 @@ function update_record($table, $dataobject) {
     if (is_array($dataobject)) {
         debugging('Warning. Wrong call to update_record(). $dataobject must be an object. array found instead', DEBUG_DEVELOPER);
         $dataobject = (object)$dataobject;
+    } else if (is_object($dataobject)) {
+        // make sure there are no properties or private methods because we cast to array later,
+        // at the same time this undos the object references so that PHP 5 works the same as PHP 4,
+        // the main reason for this is BC after the dirty magic hack introduction
+        if ($properties = get_object_vars($dataobject)) {
+            $dataobject = (object)$properties;
+        }
+        unset($properties);
+    }
+
+/// Extra protection against SQL injections
+    foreach((array)$dataobject as $k=>$v) {
+        $dataobject->$k = sql_magic_quotes_hack($v);
     }
 
     // Remove this record from record cache since it will change
@@ -1755,7 +1782,7 @@ function sql_paging_limit($page, $recordsperpage) {
  *
  * Note the LIKE are case sensitive for Oracle. Oracle 10g is required to use
  * the caseinsensitive search using regexp_like() or NLS_COMP=LINGUISTIC :-(
- * See http://docs.moodle.org/en/XMLDB_Problems#Case-insensitive_searches
+ * See http://docs.moodle.org/19/en/XMLDB_Problems#Case-insensitive_searches
  *
  * @uses $CFG
  * @return string
@@ -2223,6 +2250,38 @@ function sql_ceil($fieldname) {
     }
 }
 
+/**
+ * This hack prevents some types of SQL injections, no code should rely on this,
+ * do not forget to use addslashes() and addslashes_recursive() properly!
+ *
+ * The performance cost is negligible considering the security benefits and DB requests cost.
+ *
+ * @param mixed $value sql parameter value (hopefully with magic quotes)
+ * @return mixed sanitised value - added magic quotes if accidentally missing
+ */
+function sql_magic_quotes_hack($value) {
+    if ($value === null or $value === '') {
+        // performance shortcut
+        return $value;
+    }
+
+    // ignore stuff that can not be converted to string, catchable fatal error will be displayed elsewhere,
+    // this is intentional because we want to get the same errors as before this magic hack
+    if (is_object($value)) {
+        if (!method_exists($value, '__toString')) {
+            // ignore - we can not cast object to string, error will be triggered elsewhere
+            return $value;
+        }
+    } else if (!is_string($value)) {
+        // no sql injection possible in other non-string values
+        return $value;
+    }
+
+    // note: this does not change content if the content is properly escaped,
+    // the result is different only for strings with missing magic quotes!
+    return addslashes(stripslashes($value));
+}
+
 /**
  * Prepare a SQL WHERE clause to select records where the given fields match the given values.
  *
@@ -2238,6 +2297,9 @@ function sql_ceil($fieldname) {
  * @param string $value3 the value field3 must have (requred if field3 is given, else optional).
  */
 function where_clause($field1='', $value1='', $field2='', $value2='', $field3='', $value3='') {
+    $value1 = sql_magic_quotes_hack($value1);
+    $value2 = sql_magic_quotes_hack($value2);
+    $value3 = sql_magic_quotes_hack($value3);
     if ($field1) {
         $select = is_null($value1) ? "WHERE $field1 IS NULL" : "WHERE $field1 = '$value1'";
         if ($field2) {

lib/editor/htmlarea/coursefiles.php

@@ -495,7 +495,7 @@
                 $file = basename($file);
 
                 if (!unzip_file("$basedir/$wdir/$file")) {
-                    print_error("unzipfileserror","error");
+                    print_error("cannotunzipfile", "error");
                 }
 
                 echo "<center><form action=\"coursefiles.php\" method=\"get\">\n";

lib/environmentlib.php

@@ -482,6 +482,17 @@ function environment_check_php_extensions($version) {
         $result->setErrorCode(NO_PHP_EXTENSIONS_SECTION_FOUND);
         return array($result);
     }
+
+/// Hack alert: inject extra mysqli dependency, mysql PHP extension is not supported in Moodle 2.x, warn only ppl using MySQL.
+    global $CFG;
+    set_dbfamily();
+    if ($CFG->dbfamily === 'mysql') {
+        $mver = normalize_version($version);
+        if (version_compare($mver, '2.0', 'ge')) {
+            $data['#']['PHP_EXTENSIONS']['0']['#']['PHP_EXTENSION'][] = array('#' => '', '@' => array('name' => 'mysqli', 'level' => 'required'));
+        }
+    }
+
 /// Iterate over extensions checking them and creating the needed environment_results
     foreach($data['#']['PHP_EXTENSIONS']['0']['#']['PHP_EXTENSION'] as $extension) {
         $result = new environment_results('php_extension');

lib/form/password.php

@@ -15,6 +15,21 @@ class MoodleQuickForm_password extends HTML_QuickForm_password{
      */
     var $_helpbutton='';
     function MoodleQuickForm_password($elementName=null, $elementLabel=null, $attributes=null) {
+        global $CFG;
+        if (empty($CFG->xmlstrictheaders)) {
+            // no standard mform in moodle should allow autocomplete of passwords
+            // this is valid attribute in html5, sorry, we have to ignore validation errors in legacy xhtml 1.0
+            if (empty($attributes)) {
+                $attributes = array('autocomplete'=>'off');
+            } else if (is_array($attributes)) {
+                $attributes['autocomplete'] = 'off';
+            } else {
+                if (strpos($attributes, 'autocomplete') === false) {
+                    $attributes .= ' autocomplete="off" ';
+                }
+            }
+        }
+
         parent::HTML_QuickForm_password($elementName, $elementLabel, $attributes);
     }
     /**
@@ -48,4 +63,4 @@ class MoodleQuickForm_password extends HTML_QuickForm_password{
         return $this->_helpbutton;
     }
 }
-?>
+?>

lib/form/passwordunmask.php

@@ -15,6 +15,21 @@ require_once($CFG->libdir.'/form/password.php');
 class MoodleQuickForm_passwordunmask extends MoodleQuickForm_password {
 
     function MoodleQuickForm_passwordunmask($elementName=null, $elementLabel=null, $attributes=null) {
+        global $CFG;
+        if (empty($CFG->xmlstrictheaders)) {
+            // no standard mform in moodle should allow autocomplete of passwords
+            // this is valid attribute in html5, sorry, we have to ignore validation errors in legacy xhtml 1.0
+            if (empty($attributes)) {
+                $attributes = array('autocomplete'=>'off');
+            } else if (is_array($attributes)) {
+                $attributes['autocomplete'] = 'off';
+            } else {
+                if (strpos($attributes, 'autocomplete') === false) {
+                    $attributes .= ' autocomplete="off" ';
+                }
+            }
+        }
+
         parent::MoodleQuickForm_password($elementName, $elementLabel, $attributes);
     }
 

lib/form/recaptcha.php

@@ -33,10 +33,13 @@ class MoodleQuickForm_recaptcha extends HTML_QuickForm_input {
      * </code>
      */
     function MoodleQuickForm_recaptcha($elementName = null, $elementLabel = null, $attributes = null) {
+        global $CFG;
         parent::HTML_QuickForm_input($elementName, $elementLabel, $attributes);
         $this->_type = 'recaptcha';
-        if (!empty($attributes['https'])) {
-            $this->_https = $attributes['https'];
+        if (!empty($attributes['https']) or strpos($CFG->httpswwwroot, 'https:') === 0) {
+            $this->_https = true;
+        } else {
+            $this->_https = false;
         }
     }
 

lib/formslib.php

@@ -106,6 +106,21 @@ class moodleform {
      * @return moodleform
      */
     function moodleform($action=null, $customdata=null, $method='post', $target='', $attributes=null, $editable=true) {
+        global $CFG;
+        if (empty($CFG->xmlstrictheaders)) {
+            // no standard mform in moodle should allow autocomplete with the exception of user signup
+            // this is valid attribute in html5, sorry, we have to ignore validation errors in legacy xhtml 1.0
+            if (empty($attributes)) {
+                $attributes = array('autocomplete'=>'off');
+            } else if (is_array($attributes)) {
+                $attributes['autocomplete'] = 'off';
+            } else {
+                if (strpos($attributes, 'autocomplete') === false) {
+                    $attributes .= ' autocomplete="off" ';
+                }
+            }
+        }
+
         if (empty($action)){
             $action = strip_querystring(qualified_me());
         }
@@ -1145,6 +1160,10 @@ class MoodleQuickForm extends HTML_QuickForm_DHTMLRulesTableless {
             }
         }
 
+        if (is_array($this->_constantValues)) {
+            $unfiltered = HTML_QuickForm::arrayMerge($unfiltered, $this->_constantValues);
+        }
+
         if ($addslashes){
             return $this->_recursiveFilter('addslashes', $unfiltered);
         } else {
@@ -1482,7 +1501,7 @@ function validate_' . $this->_formName . '(frm) {
         } else if (is_a($element, 'HTML_QuickForm_hidden')) {
             return array();
 
-        } else if (method_exists($element, 'getPrivateName')) {
+        } else if (method_exists($element, 'getPrivateName') && !($element instanceof HTML_QuickForm_advcheckbox)) {
             return array($element->getPrivateName());
 
         } else {

lib/html2text.php

@@ -341,7 +341,7 @@ class html2text
      */
     function html2text( $source = '', $from_file = false, $do_links = true, $width = 75 )
     {
-        if ( !empty($source) ) {
+        if ($source !== '') {
             $this->set_html($source, $from_file);
         }
 

lib/html2text_readme.txt

@@ -82,3 +82,18 @@ Index: lib/html2text.php
  }
 
 -- Tim Hunt 2010-11-02
+
+4 - Make sure html2text does not destroy '0'.
+
+index e2d0dff..9cc213d 100644
+--- a/lib/html2text.php
++++ b/lib/html2text.php
+@@ -335,7 +335,7 @@ class html2text
+      */
+     function html2text( $source = '', $from_file = false, $do_links = true, $wi     {
+-        if ( !empty($source) ) {
++        if ($source !== '') {
+             $this->set_html($source, $from_file);
+         }
+
+-- Tim Hunt 2011-09-21

lib/javascript-static.js

@@ -427,13 +427,14 @@ function unmaskPassword(id) {
   try {
     // first try IE way - it can not set name attribute later
     if (chb.checked) {
-      var newpw = document.createElement('<input type="text" name="'+pw.name+'">');
+      var newpw = document.createElement('<input type="text" autocomplete="off" name="'+pw.name+'">');
     } else {
-      var newpw = document.createElement('<input type="password" name="'+pw.name+'">');
+      var newpw = document.createElement('<input type="password" autocomplete="off" name="'+pw.name+'">');
     }
     newpw.attributes['class'].nodeValue = pw.attributes['class'].nodeValue;
   } catch (e) {
     var newpw = document.createElement('input');
+    newpw.setAttribute('autocomplete', 'off');
     newpw.setAttribute('name', pw.name);
     if (chb.checked) {
       newpw.setAttribute('type', 'text');

lib/locallib.php

@@ -27,7 +27,7 @@
  *
  * These are similar to the module interface, however, not all the the
  * facilities that are available to modules are available to local code (yet).
- * See also http://docs.moodle.org/en/Development:Local_customisation for more
+ * See also http://docs.moodle.org/dev/Local_customisation for more
  * information.
  *
  *
@@ -81,7 +81,7 @@
  * lang/en_utf8_local/moodle.php containing
  *   $strings['login'] = 'Sign in';
  * and that will change the string 'Login' to 'Sign in'. (See also
- * http://docs.moodle.org/en/Language_editing for another way to achieve this.)
+ * http://docs.moodle.org/19/en/Language_editing for another way to achieve this.)
  *
  * This mechanism can also be used to create completely new language files. For
  * example, suppose you have created some code in local/myfeature.php that needs

lib/moodlelib.php

@@ -2741,13 +2741,13 @@ function set_moodle_cookie($thing) {
         return;
     }
 
-    $cookiename = 'MOODLEID_'.$CFG->sessioncookie;
+    $cookiename = 'MOODLEID1_'.$CFG->sessioncookie;
 
     $days = 60;
     $seconds = DAYSECS*$days;
 
     setCookie($cookiename, '', time() - HOURSECS, $CFG->sessioncookiepath, $CFG->sessioncookiedomain, $CFG->cookiesecure);
-    setCookie($cookiename, rc4encrypt($thing), time()+$seconds, $CFG->sessioncookiepath, $CFG->sessioncookiedomain, $CFG->cookiesecure);
+    setCookie($cookiename, rc4encrypt($thing, true), time()+$seconds, $CFG->sessioncookiepath, $CFG->sessioncookiedomain, $CFG->cookiesecure);
 }
 
 /**
@@ -2759,12 +2759,12 @@ function set_moodle_cookie($thing) {
 function get_moodle_cookie() {
     global $CFG;
 
-    $cookiename = 'MOODLEID_'.$CFG->sessioncookie;
+    $cookiename = 'MOODLEID1_'.$CFG->sessioncookie;
 
     if (empty($_COOKIE[$cookiename])) {
         return '';
     } else {
-        $thing = rc4decrypt($_COOKIE[$cookiename]);
+        $thing = rc4decrypt($_COOKIE[$cookiename], true);
         return ($thing == 'guest') ? '': $thing;  // Ignore guest account
     }
 }
@@ -6024,25 +6024,33 @@ function get_list_of_currencies() {
 /**
  * rc4encrypt
  *
- * @param string $data ?
- * @return string
- * @todo Finish documenting this function
+ * @param string $data        Data to encrypt.
+ * @param bool $usesecurekey  Lets us know if we are using the old or new password.
+ * @return string             The now encrypted data.
  */
-function rc4encrypt($data) {
-    $password = 'nfgjeingjk';
-    return endecrypt($password, $data, '');
+function rc4encrypt($data, $usesecurekey = false) {
+    if (!$usesecurekey) {
+        $passwordkey = 'nfgjeingjk';
+    } else {
+        $passwordkey = get_site_identifier();
+    }
+    return endecrypt($passwordkey, $data, '');
 }
 
 /**
  * rc4decrypt
  *
- * @param string $data ?
- * @return string
- * @todo Finish documenting this function
+ * @param string $data        Data to decrypt.
+ * @param bool $usesecurekey  Lets us know if we are using the old or new password.
+ * @return string             The now decrypted data.
  */
-function rc4decrypt($data) {
-    $password = 'nfgjeingjk';
-    return endecrypt($password, $data, 'de');
+function rc4decrypt($data, $usesecurekey = false) {
+    if (!$usesecurekey) {
+        $passwordkey = 'nfgjeingjk';
+    } else {
+        $passwordkey = get_site_identifier();
+    }
+    return endecrypt($passwordkey, $data, 'de');
 }
 
 /**
@@ -6373,9 +6381,14 @@ function check_php_version($version='4.1.0') {
 
 
       case 'Firefox':   /// Mozilla Firefox browsers
-
-          if (preg_match("/Firefox\/([0-9\.]+)/i", $agent, $match)) {
-              if (version_compare($match[1], $version) >= 0) {
+          if (strpos($agent, 'Iceweasel') === false and strpos($agent, 'Firefox') === false) {
+              return false;
+          }
+          if (empty($version)) {
+              return true; // no version specified
+          }
+          if (preg_match("/(Iceweasel|Firefox)\/([0-9\.]+)/i", $agent, $match)) {
+              if (version_compare($match[2], $version) >= 0) {
                   return true;
               }
           }
@@ -6383,19 +6396,45 @@ function check_php_version($version='4.1.0') {
 
 
       case 'Gecko':   /// Gecko based browsers
-
-          if (substr_count($agent, 'Camino')) {
-              // MacOS X Camino support
-              $version = 20041110;
+          // Do not look for dates any more, we expect real Firefox version here.
+          if (empty($version)) {
+              $version = 1;
+          } else if ($version > 20000000) {
+              // This is just a guess, it is not supposed to be 100% accurate!
+              if (preg_match('/^201/', $version)) {
+                  $version = 3.6;
+              } else if (preg_match('/^200[7-9]/', $version)) {
+                  $version = 3;
+              } else if (preg_match('/^2006/', $version)) {
+                  $version = 2;
+              } else {
+                  $version = 1.5;
+              }
           }
-
-          // the proper string - Gecko/CCYYMMDD Vendor/Version
-          // Faster version and work-a-round No IDN problem.
-          if (preg_match("/Gecko\/([0-9]+)/i", $agent, $match)) {
-              if ($match[1] > $version) {
-                      return true;
+          if (preg_match("/(Iceweasel|Firefox)\/([0-9\.]+)/i", $agent, $match)) {
+              // Use real Firefox version if specified in user agent string.
+              if (version_compare($match[2], $version) >= 0) {
+                  return true;
+              }
+          } else if (preg_match("/Gecko\/([0-9\.]+)/i", $agent, $match)) {
+              // Gecko might contain date or Firefox revision, let's just guess the Firefox version from the date.
+              $browserver = $match[1];
+              if ($browserver > 20000000) {
+                  // This is just a guess, it is not supposed to be 100% accurate!
+                  if (preg_match('/^201/', $browserver)) {
+                      $browserver = 3.6;
+                  } else if (preg_match('/^200[7-9]/', $browserver)) {
+                      $browserver = 3;
+                  } else if (preg_match('/^2006/', $version)) {
+                      $browserver = 2;
+                  } else {
+                      $browserver = 1.5;
                   }
               }
+              if (version_compare($browserver, $version) >= 0) {
+                  return true;
+              }
+          }
           break;
 
 
@@ -7083,12 +7122,17 @@ function generate_password($maxlen=10) {
         $filler1 = $fillers[rand(0, strlen($fillers) - 1)];
         $password = $word1 . $filler1 . $word2;
     } else {
-        $maxlen = !empty($CFG->minpasswordlength) ? $CFG->minpasswordlength : 0;
+        $minlen = !empty($CFG->minpasswordlength) ? $CFG->minpasswordlength : 0;
         $digits = $CFG->minpassworddigits;
         $lower = $CFG->minpasswordlower;
         $upper = $CFG->minpasswordupper;
         $nonalphanum = $CFG->minpasswordnonalphanum;
-        $additional = $maxlen - ($lower + $upper + $digits + $nonalphanum);
+        $total = $lower + $upper + $digits + $nonalphanum;
+        // minlength should be the greater one of the two ( $minlen and $total )
+        $minlen = $minlen < $total ? $total : $minlen;
+        // maxlen can never be smaller than minlen
+        $maxlen = $minlen > $maxlen ? $minlen : $maxlen;
+        $additional = $maxlen - $total;
 
         // Make sure we have enough characters to fulfill
         // complexity requirements

lib/phpmailer/class.phpmailer.php

@@ -653,11 +653,11 @@ class PHPMailer
      */
     function AddrFormat($addr) {
         if(empty($addr[1]))
-            $formatted = $addr[0];
+            $formatted = preg_replace('/[\r\n]+/', '', $addr[0]); // Moodle modification
         else
         {
-            $formatted = $this->EncodeHeader($addr[1], 'phrase') . " <" . 
-                         $addr[0] . ">";
+            $formatted = $this->EncodeHeader($addr[1], 'phrase') . " <" .
+                         preg_replace('/[\r\n]+/', '', $addr[0]) . ">"; // Moodle modification
         }
 
         return $formatted;
@@ -780,9 +780,9 @@ class PHPMailer
 
         $result .= $this->HeaderLine("Date", $this->RFCDate());
         if($this->Sender == "")
-            $result .= $this->HeaderLine("Return-Path", trim($this->From));
+            $result .= $this->HeaderLine("Return-Path", trim(preg_replace('/[\r\n]+/', '', $this->From))); // Moodle modification
         else
-            $result .= $this->HeaderLine("Return-Path", trim($this->Sender));
+            $result .= $this->HeaderLine("Return-Path", trim(preg_replace('/[\r\n]+/', '', $this->Sender))); // Moodle modification
         
         // To be created automatically by mail()
         if($this->Mailer != "mail")
@@ -1190,7 +1190,10 @@ class PHPMailer
      */
     function EncodeHeader ($str, $position = 'text') {
 
-    /// Start Moodle Hack - do our own multibyte-safe header encoding
+    /// Start Moodle Hack - do our own multibyte-safe header encoding and cleanup
+        $str = str_replace("\r", '', $str);
+        $str = str_replace("\n", '', $str);
+
         $textlib = textlib_get_instance();
         $encoded = $textlib->encode_mimeheader($str, $this->CharSet);
         if ($encoded !== false) {

lib/rsslib.php

@@ -521,7 +521,7 @@ function rss_get_form($act='none', $url='', $rssid='', $preferredtitle='', $shar
     $returnstring .= '<input type="hidden" name="user" value="'. $USER->id .'" />'."\n";
     $returnstring .= '<input type="hidden" name="sesskey" value="'. sesskey() .'" />'."\n";
     $returnstring .= '<br /><input type="submit" value="';
-    $validatestring = "<a href=\"#\" onclick=\"window.open('http://feedvalidator.org/check.cgi?url='+getElementById('block_rss').elements['url'].value,'validate','width=640,height=480,scrollbars=yes,status=yes,resizable=yes');return true;\">". get_string('validatefeed', 'block_rss_client')."</a>";
+    $validatestring = "<a href=\"#\" onclick=\"window.open('http://feedvalidator.org/check.cgi?url='+escape(getElementById('block_rss').elements['url'].value),'validate','width=640,height=480,scrollbars=yes,status=yes,resizable=yes');return true;\">". get_string('validatefeed', 'block_rss_client')."</a>";
 
     if ($act == 'rssedit') {
         $returnstring .= $stredit;

lib/simpletest/testdmllib.php

@@ -356,6 +356,23 @@ class dmllib_test extends prefix_changing_test_case {
 
 
     }
+
+    function test_magic_hack() {
+        // test hacky sql injection protection - the resulting DB data is not really important,
+        // we only want to prevent SQL injections/DB errors
+
+        $obj = new stdClass();
+        $obj->textfield = 'lala\'';
+        $obj->id = insert_record($this->table, $obj);
+        $this->assertFalse(empty($obj->id));
+
+        $obj->textfield = 'lala\\';
+        $res = update_record($this->table, $obj);
+        $this->assertTrue($res);
+
+        $obj = get_record($this->table, 'textfield', 'lala\\');
+        $this->assertFalse(empty($obj));
+    }
 }
 
 ?>

lib/simpletest/testmoodlelib.php

@@ -318,18 +318,6 @@ class moodlelib_test extends UnitTestCase {
                 'timezone' => '0.0', //no dst offset
                 'expectedoutput' => 'Friday, 1 July 2011, 10:00 AM'
             ),
-            array(
-                'time' => '1309514400',
-                'usertimezone' => 'America/Moncton',
-                'timezone' => '99', //dst offset and timezone offset.
-                'expectedoutput' => 'Friday, 1 July 2011, 07:00 AM'
-            ),
-            array(
-                'time' => '1309514400',
-                'usertimezone' => 'America/Moncton',
-                'timezone' => 'America/Moncton', //dst offset and timezone offset.
-                'expectedoutput' => 'Friday, 1 July 2011, 07:00 AM'
-            ),
             array(
                 'time' => '1293876000 ',
                 'usertimezone' => 'America/Moncton',
@@ -419,54 +407,6 @@ class moodlelib_test extends UnitTestCase {
         global $USER, $CFG;
 
         $testvalues = array(
-            array(
-                'usertimezone' => 'America/Moncton',
-                'year' => '2011',
-                'month' => '7',
-                'day' => '1',
-                'hour' => '10',
-                'minutes' => '00',
-                'seconds' => '00',
-                'timezone' => '0.0', //no dst offset
-                'applydst' => false,
-                'expectedoutput' => '1309528800'
-            ),
-            array(
-                'usertimezone' => 'America/Moncton',
-                'year' => '2011',
-                'month' => '7',
-                'day' => '1',
-                'hour' => '10',
-                'minutes' => '00',
-                'seconds' => '00',
-                'timezone' => '99', //user default timezone
-                'applydst' => false, //don't apply dst
-                'expectedoutput' => '1309528800'
-            ),
-            array(
-                'usertimezone' => 'America/Moncton',
-                'year' => '2011',
-                'month' => '7',
-                'day' => '1',
-                'hour' => '10',
-                'minutes' => '00',
-                'seconds' => '00',
-                'timezone' => '99', //user default timezone
-                'applydst' => true, //apply dst
-                'expectedoutput' => '1309525200'
-            ),
-            array(
-                'usertimezone' => 'America/Moncton',
-                'year' => '2011',
-                'month' => '7',
-                'day' => '1',
-                'hour' => '10',
-                'minutes' => '00',
-                'seconds' => '00',
-                'timezone' => 'America/Moncton', //string timezone
-                'applydst' => true, //apply dst
-                'expectedoutput' => '1309525200'
-            ),
             array(
                 'usertimezone' => '2',//no dst applyed
                 'year' => '2011',

lib/simpletest/testweblib.php

@@ -255,5 +255,13 @@ END;
     public function test_html_to_text_dont_screw_up_utf8() {
         $this->assertEqual("\n\nAll the WORLD’S a stage.", html_to_text('<p>All the <strong>world’s</strong> a stage.</p>'));
     }
+
+    public function test_html_to_text_trailing_whitespace() {
+        $this->assertEqual('With trailing whitespace and some more text', html_to_text("With trailing whitespace   \nand some   more text", 0));
+    }
+
+    public function test_html_to_text_0() {
+        $this->assertIdentical('0', html_to_text('0'));
+    }
 }
 ?>

lib/weblib.php

@@ -308,7 +308,7 @@ function qualified_me() {
 /**
  * Class for creating and manipulating urls.
  *
- * See short write up here http://docs.moodle.org/en/Development:lib/weblib.php_moodle_url
+ * See short write up here http://docs.moodle.org/dev/lib/weblib.php_moodle_url
  */
 class moodle_url {
     var $scheme = '';// e.g. http
@@ -6203,8 +6203,35 @@ function redirect($url, $message='', $delay=-1) {
 
     $message = clean_text($message);
 
+    // Technically, HTTP/1.1 requires Location: header to contain the absolute path.
+    // (In practice browsers accept relative paths - but still, might as well do it properly.)
+    // This code turns relative into absolute.
+    if (!preg_match('|^[a-z]+:|', $url)) {
+        // Get host name http://www.wherever.com
+        $hostpart = preg_replace('|^(.*?[^:/])/.*$|', '$1', $CFG->wwwroot);
+        if (preg_match('|^/|', $url)) {
+            // URLs beginning with / are relative to web server root so we just add them in
+            $url = $hostpart.$url;
+        } else {
+            // URLs not beginning with / are relative to path of current script, so add that on.
+            $url = $hostpart.preg_replace('|\?.*$|','',me()).'/../'.$url;
+        }
+        // Replace all ..s
+        while (true) {
+            $newurl = preg_replace('|/(?!\.\.)[^/]*/\.\./|', '/', $url);
+            if ($newurl == $url) {
+                break;
+            }
+            $url = $newurl;
+        }
+    }
+
+    // Sanitise url - we can not rely on our URL cleaning
+    // because it does not support all valid external URLs
+    $url = preg_replace('/[\x00-\x1F\x7F]/', '', $url);
+    $url = str_replace('"', '%22', $url);
     $encodedurl = preg_replace("/\&(?![a-zA-Z0-9#]{1,8};)/", "&", $url);
-    $encodedurl = preg_replace('/^.*href="([^"]*)".*$/', "\\1", clean_text('<a href="'.$encodedurl.'" />'));
+    $encodedurl = preg_replace('/^.*href="([^"]*)".*$/', "\\1", clean_text('<a href="'.$encodedurl.'" />', FORMAT_HTML));
     $url = str_replace('&amp;', '&', $encodedurl);
 
 /// At developer debug level. Don't redirect if errors have been printed on screen.
@@ -6226,31 +6253,6 @@ function redirect($url, $message='', $delay=-1) {
 
 /// when no message and header printed yet, try to redirect
     if (empty($message) and !defined('HEADER_PRINTED')) {
-
-        // Technically, HTTP/1.1 requires Location: header to contain
-        // the absolute path. (In practice browsers accept relative
-        // paths - but still, might as well do it properly.)
-        // This code turns relative into absolute.
-        if (!preg_match('|^[a-z]+:|', $url)) {
-            // Get host name http://www.wherever.com
-            $hostpart = preg_replace('|^(.*?[^:/])/.*$|', '$1', $CFG->wwwroot);
-            if (preg_match('|^/|', $url)) {
-                // URLs beginning with / are relative to web server root so we just add them in
-                $url = $hostpart.$url;
-            } else {
-                // URLs not beginning with / are relative to path of current script, so add that on.
-                $url = $hostpart.preg_replace('|\?.*$|','',me()).'/../'.$url;
-            }
-            // Replace all ..s
-            while (true) {
-                $newurl = preg_replace('|/(?!\.\.)[^/]*/\.\./|', '/', $url);
-                if ($newurl == $url) {
-                    break;
-                }
-                $url = $newurl;
-            }
-        }
-
         $delay = 0;
         //try header redirection first
         @header($_SERVER['SERVER_PROTOCOL'] . ' 303 See Other'); //302 might not work for POST requests, 303 is ignored by obsolete clients

lib/xmldb/classes/generators/XMLDBGenerator.class.php

@@ -909,7 +909,7 @@ class XMLDBgenerator {
             return $used_names[$tablename.'-'.$fields.'-'.$suffix];
         }
 
-    /// Use standard naming. See http://docs.moodle.org/en/XMLDB_key_and_index_naming
+    /// Use standard naming. See http://docs.moodle.org/19/en/XMLDB_key_and_index_naming
         $tablearr = explode ('_', $tablename);
         foreach ($tablearr as $table) {
             $name .= substr(trim($table),0,4);

login/change_password.php

@@ -4,6 +4,7 @@
     require_once('change_password_form.php');
 
     $id = optional_param('id', SITEID, PARAM_INT); // current course
+    $return = optional_param('return', 0, PARAM_BOOL); // redirect after password change
 
     $strparticipants = get_string('participants');
 
@@ -12,6 +13,19 @@
 
     $systemcontext = get_context_instance(CONTEXT_SYSTEM);
 
+    if ($return) {
+        // this redirect prevents security warning because https can not POST to http pages
+        if (empty($SESSION->wantsurl)
+                or stripos(str_replace('https://', 'http://', $SESSION->wantsurl), str_replace('https://', 'http://', $CFG->wwwroot.'/login/change_password.php') === 0)) {
+            $returnto = "$CFG->wwwroot/user/view.php?id=$USER->id&course=$id";
+        } else {
+            $returnto = $SESSION->wantsurl;
+        }
+        unset($SESSION->wantsurl);
+
+        redirect($returnto);
+    }
+
     if (!$course = get_record('course', 'id', $id)) {
         error('No such course!');
     }
@@ -19,7 +33,7 @@
     // require proper login; guest user can not change password
     if (empty($USER->id) or isguestuser()) {
         if (empty($SESSION->wantsurl)) {
-            $SESSION->wantsurl = $CFG->httpswwwroot.'/login/change_password.php';
+            $SESSION->wantsurl = $CFG->httpswwwroot.'/login/change_password.php?id=' . $id;
         }
         redirect($CFG->httpswwwroot.'/login/index.php');
     }
@@ -54,7 +68,7 @@
         redirect($changeurl);
     }
 
-    $mform = new login_change_password_form();
+    $mform = new login_change_password_form($CFG->httpswwwroot . '/login/change_password.php');
     $mform->set_data(array('id'=>$course->id));
 
     $navlinks = array();

login/index_form.html

@@ -35,7 +35,7 @@ if ($show_instructions) {
             <div class="clearer"><!-- --></div>
             <div class="form-label"><label for="password"><?php print_string("password") ?></label></div>
             <div class="form-input">
-              <input type="password" name="password" id="password" size="15" value="" />
+              <input type="password" name="password" id="password" size="15" value="" <?php if (!empty($CFG->loginpasswordautocomplete)) {echo 'autocomplete="off"';} ?> />
               <input type="submit" value="<?php print_string("login") ?>" />
               <input type="hidden" name="testcookies" value="1" />
             </div>

login/signup.php

@@ -26,7 +26,7 @@
     //HTTPS is potentially required in this page
     httpsrequired();
 
-    $mform_signup = new login_signup_form();
+    $mform_signup = new login_signup_form(null, null, 'post', '', array('autocomplete'=>'on'));
 
     if ($mform_signup->is_cancelled()) {
         redirect($CFG->httpswwwroot.'/login/index.php');

message/lib.php

@@ -996,7 +996,7 @@ function message_post_message($userfrom, $userto, $message, $format, $messagetyp
                 $messagehtml = NULL;
             }
 
-            if (!empty($preference->message_emailaddress)) {
+            if (!empty($preference->message_emailaddress) and validate_email($preference->message_emailaddress)) {
                 $userto->email = $preference->message_emailaddress;   // Use custom messaging address
             }
 

message/refresh.php

@@ -19,6 +19,12 @@
     $userfullname = strip_tags(required_param('name', PARAM_RAW));
     $wait         = optional_param('wait', MESSAGE_DEFAULT_REFRESH, PARAM_INT);
 
+    if ($wait < 1) {
+        //this should not happen unless someone is manually constructing URLs
+        //allowing a wait of 0 causes continuous GET requests
+        $wait = MESSAGE_DEFAULT_REFRESH;
+    }
+
     $stylesheetshtml = '';
     foreach ($CFG->stylesheets as $stylesheet) {
         $stylesheetshtml .= '<link rel="stylesheet" type="text/css" href="'.$stylesheet.'" />';

mnet/lib.php

@@ -412,10 +412,10 @@ function ip_in_range($address, $network, $mask) {
    $lnetwork  = ip2long($network);
    $laddress  = ip2long($address);
 
-   $binnet    = str_pad( decbin($lnetwork),32,"0","STR_PAD_LEFT" );
+   $binnet    = str_pad( decbin($lnetwork), 32, "0", STR_PAD_LEFT );
    $firstpart = substr($binnet,0,$mask);
 
-   $binip     = str_pad( decbin($laddress),32,"0","STR_PAD_LEFT" );
+   $binip     = str_pad( decbin($laddress), 32, "0", STR_PAD_LEFT );
    $firstip   = substr($binip,0,$mask);
    return(strcmp($firstpart,$firstip)==0);
 }

mnet/xmlrpc/client.php

@@ -335,8 +335,8 @@ class mnet_xmlrpc_client {
 
         // ok, it's signed, but is it signed with the right certificate ?
         // do this *after* we check for an out of date key
-        if (!openssl_verify($this->xmlrpcresponse, base64_decode($sig_parser->signature), 
-                $mnet_peer->public_key)) {
+        $verified = openssl_verify($this->xmlrpcresponse, base64_decode($sig_parser->signature), $mnet_peer->public_key);
+        if ($verified != 1) {
             $this->error[] = 'Invalid signature';
         }
 

mod/assignment/backuplib.php

@@ -44,11 +44,22 @@
     function assignment_backup_one_mod($bf,$preferences,$assignment) {
         
         global $CFG;
-    
+
+        if ($assignment === 0) { //no active instances of assignment to be backed up - skip backup
+            return false;
+        }
+
         if (is_numeric($assignment)) {
             $assignment = get_record('assignment','id',$assignment);
         }
-    
+
+        if (empty($assignment->assignmenttype)) {
+            // No assignment type will cause fatal error below in require_once so bail out now
+            // Probably ended up here by restoring a course into
+            // a moodle without this assignmenttype
+            return false;
+        }
+
         $status = true;
 
         //Start mod

mod/assignment/lib.php

@@ -838,7 +838,10 @@ class assignment_base {
         if ($users) {
             $select = 'SELECT u.id, u.firstname, u.lastname, u.picture, u.imagealt,
                               s.id AS submissionid, s.grade, s.submissioncomment,
-                              s.timemodified, s.timemarked ';
+                              s.timemodified, s.timemarked,
+                              CASE WHEN s.timemarked > 0 AND s.timemarked >= s.timemodified THEN 1
+                                   ELSE 0 END AS status ';
+
             $sql = 'FROM '.$CFG->prefix.'user u '.
                    'LEFT JOIN '.$CFG->prefix.'assignment_submissions s ON u.id = s.userid
                                                                       AND s.assignment = '.$this->assignment->id.' '.
@@ -850,8 +853,6 @@ class assignment_base {
 
             if (($auser = get_records_sql($select.$sql.$sort, $offset+1, 1)) !== false) {
                 $nextuser = array_shift($auser);
-            /// Calculate user status
-                $nextuser->status = ($nextuser->timemarked > 0) && ($nextuser->timemarked >= $nextuser->timemodified);
                 $nextid = $nextuser->id;
             }
         }
@@ -1166,7 +1167,10 @@ class assignment_base {
 
         $select = 'SELECT u.id, u.firstname, u.lastname, u.picture, u.imagealt,
                           s.id AS submissionid, s.grade, s.submissioncomment,
-                          s.timemodified, s.timemarked ';
+                          s.timemodified, s.timemarked,
+                          CASE WHEN s.timemarked > 0 AND s.timemarked >= s.timemodified THEN 1
+                               ELSE 0 END AS status ';
+
         $sql = 'FROM '.$CFG->prefix.'user u '.
                'LEFT JOIN '.$CFG->prefix.'assignment_submissions s ON u.id = s.userid
                                                                   AND s.assignment = '.$this->assignment->id.' '.
@@ -1192,8 +1196,6 @@ class assignment_base {
                     $locked_overridden = 'overridden';
                 }
 
-            /// Calculate user status
-                $auser->status = ($auser->timemarked > 0) && ($auser->timemarked >= $auser->timemodified);
                 $picture = print_user_picture($auser, $course->id, $auser->picture, false, true);
 
                 if (empty($auser->submissionid)) {

mod/assignment/type/upload/assignment.class.php

@@ -80,11 +80,6 @@ class assignment_upload extends assignment_base {
         }
 
         if (empty($submission->timemarked)) {   /// Nothing to show, so print nothing
-            if ($this->count_responsefiles($USER->id)) {
-                print_heading(get_string('responsefiles', 'assignment', $this->course->teacher), '', 3);
-                $responsefiles = $this->print_responsefiles($USER->id, true);
-                print_simple_box($responsefiles, 'center');
-            }
             return;
         }
 
@@ -96,7 +91,12 @@ class assignment_upload extends assignment_base {
             return;
         }
 
-        if ($grade->grade === null and empty($grade->str_feedback)) {   /// Nothing to show yet
+        if ($grade->grade === null and empty($grade->str_feedback)) {   // No grades to show yet
+            if ($this->count_responsefiles($USER->id)) {   // but possibly response files to show
+                print_heading(get_string('responsefiles', 'assignment', $this->course->teacher), '', 3);
+                $responsefiles = $this->print_responsefiles($USER->id, true);
+                print_simple_box($responsefiles, 'center');
+            }
             return;
         }
 

mod/choice/db/mysql.php

@@ -70,7 +70,7 @@ function choice_upgrade($oldversion) {
                              PRIMARY KEY  (id), 
                              UNIQUE KEY id (id), 
                              KEY choiceid (choiceid)
-                         ) TYPE=MyISAM;")) {
+                         ) ENGINE=MyISAM;")) {
     
             table_column('choice_answers', 'choice', 'choiceid', 'integer', '10', 'unsigned', 0, 'not null');
             table_column('choice_answers', 'answer', 'optionid', 'integer', '10', 'unsigned', 0, 'not null');

mod/data/export.php

@@ -60,6 +60,7 @@ if($mform->is_cancelled()) {
     print_header_simple($data->name, '', $nav,
         '', '', true, update_module_button($cm->id, $course->id, get_string('modulename', 'data')),
         navmenu($course, $cm), '', '');
+    groups_print_activity_menu($cm, "$CFG->wwwroot/mod/data/export.php?d=$d");
     print_heading(format_string($data->name));
 
     // these are for the tab display
@@ -83,13 +84,25 @@ foreach($fields as $key => $field) {
         $exportdata[0][] = $field->field->name;
     }
 }
+$groupid = groups_get_activity_group($cm);
 
 $datarecords = get_records('data_records', 'dataid', $data->id);
 ksort($datarecords);
 $line = 1;
 foreach($datarecords as $record) {
     // get content indexed by fieldid
-    if( $content = get_records('data_content', 'recordid', $record->id, 'fieldid', 'fieldid, content, content1, content2, content3, content4') ) {
+    if($groupid) {
+        $select = "SELECT c.fieldid, c.content, c.content1, c.content2, c.content3, c.content4
+            FROM {$CFG->prefix}data_content c, {$CFG->prefix}data_records r
+            WHERE c.recordid = $record->id
+            AND r.id = c.recordid
+            AND r.groupid = $groupid";
+    } else {
+        $select = "SELECT fieldid, content, content1, content2, content3, content4
+            FROM {$CFG->prefix}data_content
+            WHERE recordid = $record->id";
+    }
+    if( $content = get_records_sql($select) ) {
         foreach($fields as $field) {
             $contents = '';
             if(isset($content[$field->field->id])) {

mod/data/lib.php

@@ -2152,5 +2152,171 @@ function data_get_extra_capabilities() {
     return array('moodle/site:accessallgroups', 'moodle/site:viewfullnames');
 }
 
+/**
+ * Get all of the record ids from a database activity.
+ *
+ * @param int $dataid      The dataid of the database module.
+ * @return array $idarray  An array of record ids
+ */
+function data_get_all_recordids($dataid, $selectdata = '') {
+    global $CFG;
 
+    $initsql = "SELECT r.id
+                  FROM {$CFG->prefix}data_records r
+                 WHERE r.dataid = {$dataid}";
+    if ($selectdata != '') {
+        $initsql .= $selectdata;
+    }
+    $initsql .= ' GROUP BY r.id';
+    $initrecord = get_recordset_sql($initsql);
+    $idarray = array();
+    foreach ($initrecord as $data) {
+        $idarray[] = $data['id'];
+    }
+    $initrecord->close();
+    return $idarray;
+}
+
+/**
+ * Get the ids of all the records that match that advanced search criteria.
+ * This goes and loops through each criterion one at a time until it either
+ * runs out of records or returns a subset of records.
+ *
+ * @param array $recordids    An array of record ids.
+ * @param array $searcharray  Contains information for the advanced search criteria
+ * @param int $dataid         The data id of the database.
+ * @return array $recordids   An array of record ids.
+ */
+function data_get_advance_search_ids($recordids, $searcharray, $dataid) {
+    $searchcriteria = array_keys($searcharray);
+    // Loop through and reduce the IDs one search criteria at a time.
+    foreach ($searchcriteria as $key) {
+        $recordids = data_get_recordids($key, $searcharray, $dataid, $recordids);
+        // If we don't have anymore IDs then stop.
+        if (!$recordids) {
+            break;
+        }
+    }
+    return $recordids;
+}
+
+/**
+ * Gets the record IDs given the search criteria
+ *
+ * @param string $alias       Record alias.
+ * @param array $searcharray  Criteria for the search.
+ * @param int $dataid         Data ID for the database
+ * @param array $recordids    An array of record IDs.
+ * @return array $nestarray   An arry of record IDs
+ */
+function data_get_recordids($alias, $searcharray, $dataid, $recordids) {
+    global $CFG;
+
+    $nestsearch = $searcharray[$alias];
+    // searching for content outside of mdl_data_content
+    if ($alias < 0) {
+        $alias = '';
+    }
+    $recordidsstring = implode(',', $recordids);
+    $nestselect = "SELECT c$alias.recordid
+                     FROM {$CFG->prefix}data_content c$alias,
+                          {$CFG->prefix}data_fields f,
+                          {$CFG->prefix}data_records r,
+                          {$CFG->prefix}user u ";
+    $nestwhere = "WHERE u.id = r.userid
+                    AND f.id = c$alias.fieldid
+                    AND r.id = c$alias.recordid
+                    AND r.dataid = $dataid
+                    AND c$alias.recordid IN ($recordidsstring)
+                    AND ";
+
+    $params['dataid'] = $dataid;
+    if (!empty($nestsearch->sql)) {
+        $nestsql = $nestselect . $nestwhere . $nestsearch->sql;
+    } else {
+        $sql = $nestsearch->field . ' ' . sql_ilike() . " '%$nestsearch->data%'";
+        $nestsql = $nestselect . $nestwhere . $sql . ' GROUP BY c' . $alias . '.recordid';
+    }
+    $nestrecords = get_recordset_sql($nestsql);
+    $nestarray = array();
+    foreach ($nestrecords as $data) {
+        $nestarray[] = $data['recordid'];
+    }
+    // Close the record set and free up resources.
+    $nestrecords->close();
+    return $nestarray;
+}
+
+/**
+ * Returns an array with an sql string for advanced searches and the parameters that go with them.
+ *
+ * @param int $sort            DATA_*
+ * @param stdClass $data       Data module object
+ * @param array $recordids     An array of record IDs.
+ * @param string $selectdata   Information for the select part of the sql statement.
+ * @param string $sortorder    Additional sort parameters
+ * @return string              An sql string.
+ */
+function data_get_advanced_search_sql($sort, $data, $recordids, $selectdata, $sortorder) {
+    global $CFG;
+    // Sorting by time created.
+    if ($sort == 0) {
+        $nestselectsql = "SELECT r.id, r.approved, r.timecreated, r.timemodified, r.userid, u.firstname, u.lastname
+                        FROM {$CFG->prefix}data_content c,
+                             {$CFG->prefix}data_records r,
+                             {$CFG->prefix}user u ";
+        $groupsql = ' GROUP BY r.id, r.approved, r.timecreated, r.timemodified, r.userid, u.firstname, u.lastname ';
+    } else {
+        // Sorting through 'Other' criteria
+        if ($sort <= 0) {
+            switch ($sort) {
+                case DATA_LASTNAME:
+                    $sortcontentfull = "u.lastname";
+                    break;
+                case DATA_FIRSTNAME:
+                    $sortcontentfull = "u.firstname";
+                    break;
+                case DATA_APPROVED:
+                    $sortcontentfull = "r.approved";
+                    break;
+                case DATA_TIMEMODIFIED:
+                    $sortcontentfull = "r.timemodified";
+                    break;
+                case DATA_TIMEADDED:
+                default:
+                    $sortcontentfull = "r.timecreated";
+            }
+        } else {
+            // Sorting with user entered data fields.
+            $sortfield = data_get_field_from_id($sort, $data);
+            $sortcontent = sql_compare_text('c.' . $sortfield->get_sort_field());
+            $sortcontentfull = $sortfield->get_sort_sql($sortcontent);
+        }
+
+        $nestselectsql = "SELECT r.id, r.approved, r.timecreated, r.timemodified, r.userid, u.firstname, u.lastname, $sortcontentfull
+                              AS sortorder
+                            FROM {$CFG->prefix}data_content c,
+                                 {$CFG->prefix}data_records r,
+                                 {$CFG->prefix}user u ";
+        $groupsql = ' GROUP BY r.id, r.approved, r.timecreated, r.timemodified, r.userid, u.firstname, u.lastname, ' .$sortcontentfull;
+    }
+    $nestfromsql = 'WHERE c.recordid = r.id
+                      AND r.dataid = ' . $data->id . '
+                      AND r.userid = u.id';
+
+    // Find the field we are sorting on
+    if ($sort > 0 or data_get_field_from_id($sort, $data)) {
+        $nestfromsql .= " AND c.fieldid = $sort";
+    }
+    // If there are no record IDs then return an sql statment that will return no rows.
+    if (count($recordids) != 0) {
+        $recordidsstring = implode(',', $recordids);
+        $insql = " IN ($recordidsstring) ";
+    } else {
+        $insql = " = -1";
+    }
+    $nestfromsql .= ' AND c.recordid ' . $insql . $selectdata . $groupsql;
+    $nestfromsql = "$nestfromsql $selectdata";
+    return "$nestselectsql $nestfromsql $sortorder";
+}
 ?>

mod/data/view.php

@@ -300,6 +300,14 @@
     groups_print_activity_menu($cm, $returnurl);
     $currentgroup = groups_get_activity_group($cm);
     $groupmode = groups_get_activity_groupmode($cm);
+    // If a student is not part of a group and seperate groups is enabled, we don't
+    // want them seeing all records.
+    if ($currentgroup == 0 && $groupmode == 1 && !has_capability('mod/data:manageentries', $context)) {
+        $canviewallrecords = false;
+    } else {
+        $canviewallrecords = true;
+    }
+
 
     // deletect entries not approved yet and show hint instead of not found error
     if ($record and $data->approval and !$record->approved and $record->userid != $USER->id and !has_capability('mod/data:manageentries', $context)) {
@@ -439,7 +447,13 @@
             if ($currentgroup) {
                 $groupselect = " AND (r.groupid = '$currentgroup' OR r.groupid = 0)";
             } else {
-                $groupselect = ' ';
+                if ($canviewallrecords) {
+                    $groupselect = ' ';
+                } else {
+                    // If separate groups are enabled and the user isn't in a group or
+                    // a teacher, manager, admin etc, then just show them entries for 'All participants'.
+                    $groupselect = " AND r.groupid = 0";
+                }
             }
 
             $ilike = sql_ilike(); //Be case-insensitive
@@ -507,7 +521,7 @@
                 $sortcontent = sql_compare_text('c.' . $sortfield->get_sort_field());
                 $sortcontentfull = $sortfield->get_sort_sql($sortcontent);
 
-                $what = ' DISTINCT r.id, r.approved, r.timecreated, r.timemodified, r.userid, u.firstname, u.lastname, '.$sortcontentfull.' AS _order ';
+                $what = ' DISTINCT r.id, r.approved, r.timecreated, r.timemodified, r.userid, u.firstname, u.lastname, '.$sortcontentfull.' AS sortorder ';
                 $count = ' COUNT(DISTINCT c.recordid) ';
                 $tables = $CFG->prefix.'data_content c,'.$CFG->prefix.'data_records r,'.$CFG->prefix.'data_content cs, '.$CFG->prefix.'user u ';
                 $where =  'WHERE c.recordid = r.id
@@ -515,7 +529,7 @@
                              AND r.dataid = '.$data->id.'
                              AND r.userid = u.id
                              AND cs.recordid = r.id ';
-                $sortorder = ' ORDER BY _order '.$order.' , r.id ASC ';
+                $sortorder = ' ORDER BY sortorder '.$order.' , r.id ASC ';
                 $searchselect = '';
 
                 // If requiredentries is not reached, only show current user's entries
@@ -543,13 +557,21 @@
         /// To actually fetch the records
 
             $fromsql    = "FROM $tables $advtables $where $advwhere $groupselect $approveselect $searchselect $advsearchselect";
-            $sqlselect  = "SELECT $what $fromsql $sortorder";
-            $sqlcount   = "SELECT $count $fromsql";   // Total number of records when searching
             $sqlmax     = "SELECT $count FROM $tables $where $groupselect $approveselect"; // number of all recoirds user may see
 
         /// Work out the paging numbers and counts
+            $selectdata = $groupselect . $approveselect;
+            $recordids = data_get_all_recordids($data->id, $selectdata);
+
+            $newrecordids = data_get_advance_search_ids($recordids, $search_array, $data->id);
+            $totalcount = count($newrecordids);
+
+            if (!empty($advanced)) {
+                $sqlselect = data_get_advanced_search_sql($sort, $data, $newrecordids, $selectdata, $sortorder);
+            } else {
+                $sqlselect  = "SELECT $what $fromsql $sortorder";
+            }
 
-            $totalcount = count_records_sql($sqlcount);
             if (empty($searchselect) && empty($advsearchselect)) {
                 $maxcount = $totalcount;
             } else {
@@ -559,14 +581,11 @@
             if ($record) {     // We need to just show one, so where is it in context?
                 $nowperpage = 1;
                 $mode = 'single';
-
                 $page = 0;
-                // TODO: Improve this because we are executing $sqlselect twice (here and some lines below)!
                 if ($allrecordids = get_fieldset_sql($sqlselect)) {
                     $page = (int)array_search($record->id, $allrecordids);
                     unset($allrecordids);
                 }
-
             } else if ($mode == 'single') {  // We rely on ambient $page settings
                 $nowperpage = 1;
 

mod/forum/db/mysql.php

@@ -129,7 +129,7 @@ function forum_upgrade($oldversion) {
                                 PRIMARY KEY  (`id`),
                                 KEY `user` (userid),
                                 KEY `post` (postid)
-                              ) TYPE=MyISAM COMMENT='For keeping track of posts that will be mailed in digest form';");
+                              ) ENGINE=MyISAM COMMENT='For keeping track of posts that will be mailed in digest form';");
   }
 
   if ($oldversion < 2004070700) {    // This may be redoing it from STABLE but that's OK

mod/forum/discuss.php

@@ -62,6 +62,10 @@
             error('You can\'t move to that forum - it doesn\'t exist!', $return);
         }
 
+        if ($forumto->type == 'single') {
+            error('Cannot move discussion to a simple single discussion forum.', $return);
+        }
+
         if (!$cmto = get_coursemodule_from_instance('forum', $forumto->id, $course->id)) {
             error('Target forum not found in this course.', $return);
         }
@@ -187,6 +191,8 @@
             }
             $section = -1;
             $forummenu = array();
+            // Check forum types and eliminate simple discussions.
+            $forumcheck = get_records('forum', 'course', $course->id, '', 'id, type');
             foreach ($modinfo->instances['forum'] as $forumcm) {
                 if (!$forumcm->uservisible || !has_capability('mod/forum:startdiscussion',
                     get_context_instance(CONTEXT_MODULE,$forumcm->id))) {
@@ -197,7 +203,9 @@
                     $forummenu[] = "-------------- $strsection $forumcm->sectionnum --------------";
                 }
                 $section = $forumcm->sectionnum;
-                if ($forumcm->instance != $forum->id) {
+                $forumidcompare = $forumcm->instance != $forum->id;
+                $forumtypecheck = $forumcheck[$forumcm->instance]->type !== 'single';
+                if ($forumidcompare and $forumtypecheck) {
                     $url = "discuss.php?d=$discussion->id&move=$forumcm->instance&sesskey=".sesskey();
                     $forummenu[$url] = format_string($forumcm->name);
                 }

mod/forum/lib.php

@@ -4484,6 +4484,10 @@ function forum_user_can_post_discussion($forum, $currentgroup=null, $unused=-1,
         return false;
     }
 
+    if ($forum->type == 'single') {
+        return false;
+    }
+
     if ($forum->type == 'eachuser') {
         if (forum_user_has_posted_discussion($forum->id, $USER->id)) {
             return false;

mod/forum/user.php

@@ -40,6 +40,50 @@
         die;
     }
 
+    switch ($mode) {
+        case 'posts' :
+            $searchterms = array('userid:'.$user->id);
+            $extrasql = '';
+            break;
+
+        default:
+            $searchterms = array('userid:'.$user->id);
+            $extrasql = 'AND p.parent = 0';
+            break;
+    }
+    if ($course->id == SITEID) {
+        if (empty($CFG->forceloginforprofiles) || isloggedin()) {
+            // Search throughout the whole site.
+            $searchcourse = 0;
+        } else {
+            $searchcourse = SITEID;
+        }
+    } else {
+        // Search only for posts the user made in this course.
+        $searchcourse = $course->id;
+    }
+
+    $posts = forum_search_posts($searchterms, $searchcourse, $page*$perpage, $perpage, $totalcount, $extrasql);
+
+    $hasposts = !empty($posts);
+    $iscurrentuser = $user->id == $USER->id;
+    $specificcourseprovided = !empty($searchcourse) && $searchcourse != SITEID;
+    if (!$hasposts && !$iscurrentuser && !$specificcourseprovided) {
+        $mustlogin = (!isloggedin() && $CFG->forceloginforprofiles);
+        $canviewtheuser = (isloggedin() && has_capability('moodle/user:viewdetails', $usercontext));
+        if ($mustlogin || (!isteacherinanycourse() && !isteacherinanycourse($user->id) && !$canviewtheuser)) {
+            // Best to assume that the current user cannot view the requested user
+            // so we are careful not to give out any information.
+            print_header();
+            print_heading(get_string('noposts', 'forum'));
+            print_footer();
+            exit;
+        } else {
+            // Nothing to check here. If a course has been specified then require_course_login
+            // has been called OR the current user is a parent of the requested user.
+        }
+    }
+
     add_to_log($course->id, "forum", "user report",
             "user.php?course=$course->id&id=$user->id&mode=$mode", "$user->id"); 
 
@@ -65,36 +109,10 @@
     $showroles = 1;
     include($CFG->dirroot.'/user/tabs.php');   /// Prints out tabs as part of user page
 
-
-    switch ($mode) {
-        case 'posts' :
-            $searchterms = array('userid:'.$user->id);
-            $extrasql = '';
-            break;
-
-        default:
-            $searchterms = array('userid:'.$user->id);
-            $extrasql = 'AND p.parent = 0';
-            break;
-    }
-
     echo '<div class="user-content">';
 
-    if ($course->id == SITEID) {
-        if (empty($CFG->forceloginforprofiles) || isloggedin()) {
-            // Search throughout the whole site.
-            $searchcourse = 0;
-        } else {
-            $searchcourse = SITEID;
-        }
-    } else {
-        // Search only for posts the user made in this course.
-        $searchcourse = $course->id;
-    }
-
     // Get the posts.
-    if ($posts = forum_search_posts($searchterms, $searchcourse, $page*$perpage, $perpage,
-                                    $totalcount, $extrasql)) {
+    if ($posts) {
 
         print_paging_bar($totalcount, $page, $perpage,
                          "user.php?id=$user->id&amp;course=$course->id&amp;mode=$mode&amp;perpage=$perpage&amp;");

mod/glossary/db/mysql.php

@@ -45,13 +45,13 @@ function glossary_upgrade($oldversion) {
                     `glossaryid` INT(10) UNSIGNED NOT NULL default '0',
                     `name` VARCHAR(255) NOT NULL default '',
                     PRIMARY KEY  (`id`)
-                    ) TYPE=MyISAM COMMENT='all categories for glossary entries'");
+                    ) ENGINE=MyISAM COMMENT='all categories for glossary entries'");
 
         execute_sql("CREATE TABLE `{$CFG->prefix}glossary_entries_categories` (
                     `categoryid` INT(10) UNSIGNED NOT NULL default '1',
                     `entryid` INT(10) UNSIGNED NOT NULL default '0',
                     PRIMARY KEY  (`categoryid`, `entryid`)
-                    ) TYPE=MyISAM COMMENT='categories of each glossary entry'");
+                    ) ENGINE=MyISAM COMMENT='categories of each glossary entry'");
      }
      
      if ( $oldversion < 2003092100 ) {
@@ -87,7 +87,7 @@ function glossary_upgrade($oldversion) {
                     `timemodified` INT(10) UNSIGNED NOT NULL default '0',
                     `format` TINYINT(2) UNSIGNED NOT NULL default '0',
                     PRIMARY KEY  (`id`)
-                    ) TYPE=MyISAM COMMENT='comments on glossary entries'");
+                    ) ENGINE=MyISAM COMMENT='comments on glossary entries'");
 
         execute_sql(" INSERT INTO {$CFG->prefix}log_display (module, action, mtable, field) VALUES ('glossary', 'add comment', 'glossary', 'name') ");
         execute_sql(" INSERT INTO {$CFG->prefix}log_display (module, action, mtable, field) VALUES ('glossary', 'update comment', 'glossary', 'name') ");
@@ -166,7 +166,7 @@ function glossary_upgrade($oldversion) {
                     `entryid` INT(10) UNSIGNED NOT NULL default '0',
                     `alias` TEXT NOT NULL default '',
                     PRIMARY KEY  (`id`)
-                    ) TYPE=MyISAM COMMENT='entries alias'");
+                    ) ENGINE=MyISAM COMMENT='entries alias'");
     }
     
     if ( $oldversion < 2003111500 ) {
@@ -190,7 +190,7 @@ function glossary_upgrade($oldversion) {
                     `sortkey` VARCHAR(50) NOT NULL default '',
                     `sortorder` VARCHAR(50) NOT NULL default '',
                     PRIMARY KEY  (`id`)
-                    ) TYPE=MyISAM COMMENT='Setting of the display formats'");
+                    ) ENGINE=MyISAM COMMENT='Setting of the display formats'");
 
         // Default format
         execute_sql(" INSERT INTO {$CFG->prefix}glossary_displayformats 
@@ -292,7 +292,7 @@ function glossary_upgrade($oldversion) {
                        `sortkey` VARCHAR(50) NOT NULL default '',
                        `sortorder` VARCHAR(50) NOT NULL default '',
                    PRIMARY KEY  (`id`)                    
-                   ) TYPE=MyISAM COMMENT='Setting of the display formats'");
+                   ) ENGINE=MyISAM COMMENT='Setting of the display formats'");
 
       //Define current 0-6 format names
       $formatnames = array('dictionary','continuous','fullwithauthor','encyclopedia',

mod/hotpot/lang/en_utf8/help/hotpot/addquizchain.html

@@ -0,0 +1,17 @@
+<h1>Add quiz chain</h1>
+
+<div class="indent">
+    <p>
+        <b>No</b><br />
+        Only one quiz will be added to the course
+    </p>
+    <p>
+        <b>Yes</b><br />
+        If the &quot;File name&quot; is a file, it is treated as the start of a chain
+        of Hot Potatoes quizzes and all quizzes in the chain will be added to the course
+        with identical settings.<br />
+        <br />
+        If the &quot;File name&quot; is a folder, all Hot Potatoes quizzes in the folder
+        will be added to the course as a chain of quizzes with identical settings.
+    </p>
+</div>

mod/hotpot/lang/en_utf8/help/hotpot/analysistable.html

@@ -0,0 +1,8 @@
+<h1>Item Response Analysis</h1>
+<p>This table lists the responses to each question and the frequency of each response.</p>
+<ul>
+    <li>The frequencies of <b>correct answers</b> are shown in <font color="red"><b>red text</b></font>.</li>
+    <li>The frequencies of <b>wrong answers</b> are shown in <font color="blue"><b>blue text</b></font>.</li>
+    <li>The frequencies of <b>ignored answers</b> are shown in <font color="brown"><b>brown text</b></font>.</li>
+    <li>The frequencies of <b>numeric data</b> are shown in <font color="green"><b>green text</b></font>.</li>
+</ul>

mod/hotpot/lang/en_utf8/help/hotpot/clickreporting.html

@@ -0,0 +1,19 @@
+<h1>Enable click reporting</h1>
+
+<div class="indent">
+    <p>
+        <b>Yes</b><br />
+        A separate record is stored in the database each time a
+        &quot;hint&quot;, &quot;clue&quot; or &quot;check&quot;
+        button is clicked. This allows the teacher to see a very
+        detailed report showing the state of the quiz at each click.
+        However, it may also mean that the size of the database grows
+        very quickly, because several &quot;click&quot; records may
+        be stored for each attempt at a quiz.
+    </p>
+    <p>
+        <b>No</b><br />
+        Only one record per attempt at a quiz is stored in the Moodle database.
+    </p>
+</div>
+<p>By the default this option is disabled.</p>

mod/hotpot/lang/en_utf8/help/hotpot/clickreporttable.html

@@ -0,0 +1,74 @@
+<h1>Click Trail</h1>
+<p>
+    This table shows details of every click by every student
+    during completed attempts at a particular Hot Potatoes quiz.
+</p>
+<p>
+    Please note that this report is very wide and can be very
+    long, so it is intended to be downloaded and viewed using
+    a spreadsheet program, such as Microsoft Excel.
+</p>
+<p>
+    Each row in the table contains the following information:
+</p>
+
+<p>
+    <b>Which click?</b><br />
+    The following details identify to which click in which attempt
+    by which student at which quiz in which section of which course
+    this row refers:
+</p>
+<ul>
+    <li>Course name, Section number, Exercise number, Exercise name, Exercise type, Number of questions</li>
+    <li>Student's full name, Login date, Login time, Logoff time</li>
+    <li>Attempt number, Attempt start time, Attempt finish time</li>
+    <li>Click number, Click time, Click type</li>
+</ul>
+
+<p>
+    <b>Which questions were affected?</b><br />
+    The following details are shown of which questions,
+    if any, were affected by the current click:
+</p>
+<ul>
+    <li>questions which were checked, or given a hint or clue on the current click</li>
+    <li>the status of each question after the current click
+        <ul>
+            <li><b>0</b> means &quot;correct&quot;</li>
+            <li><b>X</b> means &quot;wrong&quot;</li>
+            <li><b>-</b> means &quot;not attempted&quot;</li>
+        </ul>
+    </li>
+    <li>new answers which were received on the current click (answers that did not change are not shown)</li>
+    <li>questions for which new answers were received on the current click</li>
+    <li>questions for which new answers were received, or for which a hint or clue was given, on the current click</li>
+</ul>
+
+<p>
+    <b>How many questions were affected?</b><br />
+    The following details are shown of the total number
+    of questions, if any, affected by the current click
+    and the total number of questions affected so far
+    in the quiz:
+</p>
+<ul>
+    <li>the number of questions attempted</li>
+    <li>the number of questions not attempted</li>
+    <li>the number of questions whose status is &quot;right&quot;</li>
+    <li>the number of questions whose status is &quot;wrong&quot;</li>
+    <li>the number of questions for which hints have been given</li>
+    <li>the number of questions for which clues have been given</li>
+    <li>the number of questions for which new answers have been received</li>
+    <li>the number of questions for which new answers have been received, or for which a hint or clue has been given</li>
+</ul>
+
+<p>
+    <b>Scores</b><br />
+    The following details are shown about scores for this click
+    and for the quiz so far:
+</p>
+<ul>
+    <li>the raw score</li>
+    <li>the maximum score</li>
+    <li>the score as a percentage</li>
+</ul>

mod/hotpot/lang/en_utf8/help/hotpot/forceplugins.html

@@ -0,0 +1,17 @@
+<h1>Force Moodle to use Moodle-compatible media players</h1>
+
+<div class="indent">
+    <p>
+        <b>No</b><br />
+        Moodle will not change the settings of any media players in the quiz
+    </p>
+    <p>
+        <b>Yes</b><br />
+        Moodle will force the quiz to use Moodle-compatible media players to play files like:
+        <ul><li>avi</li><li>mpeg</li><li>mpg</li><li>mp3</li><li>mov</li><li>wmv</li></ul>
+    </p>
+</div>
+<p>
+    More information:
+    <a href="help.php?module=hotpot&amp;file=mediaplayers.html">Relative URLs, media players and Hot Potatoes</a>
+</p>

mod/hotpot/lang/en_utf8/help/hotpot/index.html

@@ -0,0 +1,16 @@
+<h2>Hot Potatoes</h2>
+<ul>
+    <li><a href="help.php?module=hotpot&amp;file=addquizchain.html">Add quiz chain</a></li>
+    <li><a href="help.php?module=hotpot&amp;file=analysistable.html">Analysis table</a></li>
+    <li><a href="help.php?module=hotpot&amp;file=clickreporting.html">Click trail report</a></li>
+    <li><a href="help.php?module=hotpot&amp;file=forceplugins.html">Force media plugins</a></li>
+    <li><a href="help.php?module=hotpot&amp;file=mediaplayers.html">Media players, relative URLs and Hot Potatoes</a></li>
+    <li><a href="help.php?module=hotpot&amp;file=navigation.html">Navigation</a></li>
+    <li><a href="help.php?module=hotpot&amp;file=outputformat.html">Output format</a></li>
+    <li><a href="help.php?module=hotpot&amp;file=reportcontent.html">Report content</a></li>
+    <li><a href="help.php?module=hotpot&amp;file=reportformat.html">Report format</a></li>
+    <li><a href="help.php?module=hotpot&amp;file=responsestable.html">Responses table</a></li>
+    <li><a href="help.php?module=hotpot&amp;file=shownextquiz.html">Show next quiz</a></li>
+    <li><a href="help.php?module=hotpot&amp;file=studentfeedback.html">Student feedback</a></li>
+    <li><a href="help.php?module=hotpot&amp;file=updatequizchain.html">Update quiz chain</a></li>
+</ul>

mod/hotpot/lang/en_utf8/help/hotpot/mediaplayers.html

@@ -0,0 +1,28 @@
+<h1>Relative URLs, media players and Hot Potatoes</h1>
+
+<h2>Definitions</h2>
+
+<div class="indent">
+    <p><i>URL</i><br />
+        the address of an internet resource, such as a webpage, image or sound file.
+    </p>
+    <p>
+        <i>absolute URL</i><br />
+        a URL that begins with &quot;http://&quot; is called an absolute URL.
+        Wherever it is used, it always refers to the same target resource.
+    </p>
+    <p>
+        <i>relative URL</i><br />
+        a URL that does not begin with &quot;http://&quot; is called a relative URL.
+        It can be combined with the absolute URL of a &quot;base&quot; page, to get
+        the absolute URL of the target resource.
+    </p>
+</div>
+
+<h2>Relative URLs in Hot Potatoes quizzes</h2>
+<p>Relative URLs are a convenient way to specify images, sounds and videos in a Hot Potatoes quiz, because they allow the quiz to be viewed and tested on a local PC, before being uploaded to a Moodle site. When the quiz is uploaded to the Moodle site, the multimedia files must also be uploaded, so that they are available when the quiz is administered via Moodle.</p>
+<p>For security reasons, Moodle does not allow direct access to course files. All requests for files in a given course go through a guardian script which verfies that the person requesting the file is enrolled in the course. However, this mechanism can break  relative links used in the quiz, because the normal rules for deriving an absolute URL from a relative URL do not work.</p>
+<p>The solution is simple enough: <font color="red"><b>all relative URLs must be converted to absolute URLs </b></font> by the time the quiz reaches the browser. In the case of Hot Potatoes quizzes, the URLs will be converted by Moodle, so content creators do not have to bother with this tedious and error-prone task. </p>
+
+<h2>Media players in Hot Potatoes quizzes </h2>
+<p>Some media players will not accept the media file if it comes via the script which guards the course files. In this situation, it is necessary to replace the media player with one that is known to be compatible with Moodle. You can do this yourself by modifying the reference to the media player in the quiz, or you can force Moodle to do it by setting the &quot;Force media plugins&quot; option on the quiz's settings page to &quot;Yes&quot;.</p>