Bumping to 1.9.8 release

permission overrides by observing corresponding caps. Improve role mapping a bit.
Credit goes to Daniel Neis.

admin/cron.php

@@ -223,6 +223,9 @@
     grade_cron();
     mtrace('done.');
 
+    mtrace('Starting processing the event queue...');
+    events_cron();
+    mtrace('done.');
 
 /// Run all core cron jobs, but not every time since they aren't too important.
 /// These don't have a timer to reduce load, so we'll use a random number 
@@ -350,7 +353,7 @@
                                                 p.id as prefid 
                                         FROM {$CFG->prefix}user u 
                                              JOIN {$CFG->prefix}user_preferences p ON u.id=p.userid
-                                        WHERE p.name='create_password' AND p.value=1 AND u.email !='' ");
+                                        WHERE p.name='create_password' AND p.value='1' AND u.email !='' ");
 
             foreach ($newusers as $newuserid => $newuser) {
                 $newuser->emailstop = 0; // send email regardless
@@ -481,44 +484,44 @@
 
     // run gradebook import/export/report cron
     if ($gradeimports = get_list_of_plugins('grade/import')) {
-        foreach ($gradeimports as $gradeimport) {           
+        foreach ($gradeimports as $gradeimport) {
             if (file_exists($CFG->dirroot.'/grade/import/'.$gradeimport.'/lib.php')) {
                 require_once($CFG->dirroot.'/grade/import/'.$gradeimport.'/lib.php');
-                $cron_function = 'grade_import_'.$gradeimport.'_cron';                                    
+                $cron_function = 'grade_import_'.$gradeimport.'_cron';
                 if (function_exists($cron_function)) {
                     mtrace("Processing gradebook import function $cron_function ...", '');
-                    $cron_function;  
+                    $cron_function();
                 }
             }
-        }      
+        }
     }
 
     if ($gradeexports = get_list_of_plugins('grade/export')) {
-        foreach ($gradeexports as $gradeexport) {           
+        foreach ($gradeexports as $gradeexport) {
             if (file_exists($CFG->dirroot.'/grade/export/'.$gradeexport.'/lib.php')) {
                 require_once($CFG->dirroot.'/grade/export/'.$gradeexport.'/lib.php');
-                $cron_function = 'grade_export_'.$gradeexport.'_cron';                                    
+                $cron_function = 'grade_export_'.$gradeexport.'_cron';
                 if (function_exists($cron_function)) {
                     mtrace("Processing gradebook export function $cron_function ...", '');
-                    $cron_function;  
+                    $cron_function();
                 }
             }
         }
     }
 
     if ($gradereports = get_list_of_plugins('grade/report')) {
-        foreach ($gradereports as $gradereport) {           
+        foreach ($gradereports as $gradereport) {
             if (file_exists($CFG->dirroot.'/grade/report/'.$gradereport.'/lib.php')) {
                 require_once($CFG->dirroot.'/grade/report/'.$gradereport.'/lib.php');
-                $cron_function = 'grade_report_'.$gradereport.'_cron';                                    
+                $cron_function = 'grade_report_'.$gradereport.'_cron';
                 if (function_exists($cron_function)) {
                     mtrace("Processing gradebook report function $cron_function ...", '');
-                    $cron_function;  
+                    $cron_function();
                 }
             }
         }
     }
-    
+
     // run any customized cronjobs, if any
     // looking for functions in lib/local/cron.php
     if (file_exists($CFG->dirroot.'/local/cron.php')) {

admin/environment.xml

@@ -80,7 +80,6 @@
         <FEEDBACK>
           <ON_ERROR message="mysql416required" />
         </FEEDBACK>
-        <BYPASS function="bypass_mysql416_reqs" message="mysql416bypassed" />
       </VENDOR>
       <VENDOR name="postgres" version="7.4" />
       <VENDOR name="mssql" version="9.0" />
@@ -140,7 +139,6 @@
         <FEEDBACK>
           <ON_ERROR message="mysql416required" />
         </FEEDBACK>
-        <BYPASS function="bypass_mysql416_reqs" message="mysql416bypassed" />
       </VENDOR>
       <VENDOR name="postgres" version="8.0" />
       <VENDOR name="mssql" version="9.0" />
@@ -218,21 +216,20 @@
         <FEEDBACK>
           <ON_ERROR message="mysql416required" />
         </FEEDBACK>
-        <BYPASS function="bypass_mysql416_reqs" message="mysql416bypassed" />
       </VENDOR>
       <VENDOR name="postgres" version="8.3" />
       <VENDOR name="mssql" version="9.0" />
       <VENDOR name="odbc_mssql" version="9.0" />
       <VENDOR name="mssql_n" version="9.0" />
-      <VENDOR name="oracle" version="10.0" />
+      <VENDOR name="oracle" version="10.2" />
       <VENDOR name="sqlite" version="2.0" />
     </DATABASE>
     <PHP version="5.2.8" level="required">
     </PHP>
     <PHP_EXTENSIONS>
-      <PHP_EXTENSION name="iconv" level="optional">
+      <PHP_EXTENSION name="iconv" level="required">
         <FEEDBACK>
-          <ON_CHECK message="iconvrecommended" />
+          <ON_CHECK message="iconvrequired" />
         </FEEDBACK>
       </PHP_EXTENSION>
       <PHP_EXTENSION name="mbstring" level="optional">
@@ -260,6 +257,11 @@
           <ON_CHECK message="xmlrpcrecommended" />
         </FEEDBACK>
       </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
       <PHP_EXTENSION name="ctype" level="required">
         <FEEDBACK>
           <ON_ERROR message="ctyperequired" />
@@ -275,6 +277,11 @@
           <ON_CHECK message="gdrecommended" />
         </FEEDBACK>
       </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
     </PHP_EXTENSIONS>
     <PHP_SETTINGS>
       <PHP_SETTING name="memory_limit" value="40M" level="required">

admin/index.php

@@ -635,6 +635,11 @@
         
     }
 
+    if (empty($CFG->passwordsaltmain)) {
+        $path = $CFG->docroot.'/'.str_replace('_utf8', '', current_language()).'/report/security/report_security_check_passwordsaltmain';
+        print_box(get_string('upgrade197notice', 'admin')."\n".get_string('upgrade197salt', 'admin', $path));
+    }
+
     if (defined('WARN_DISPLAY_ERRORS_ENABLED')) {
         print_box(get_string('displayerrorswarning', 'admin'), 'generalbox adminwarning');
     }

admin/lang.php

@@ -1013,6 +1013,10 @@ function lang_fix_value_before_save($value='') {
     if (ini_get_bool('magic_quotes_sybase')) {          // Unescape escaped sybase quotes
         $value = str_replace("''", "'", $value);
     }
+    // escape all embedded variables
+    $value = str_replace('$', '\$', $value);            // Add slashes for $
+    // unescape placeholders: only $a and $a->something are allowed. All other $variables are left escaped
+    $value = preg_replace('/\\\\\$a($|[^_a-zA-Z0-9\-]|\->[a-zA-Z0-9_]+)/', '$a\\1', $value);
     $value = str_replace("'", "\\'", $value);           // Add slashes for '
     $value = str_replace('"', "\\\"", $value);          // Add slashes for "
     $value = str_replace("%","%%",$value);              // Escape % characters

admin/mnet/adminlib.php

@@ -64,7 +64,7 @@ function mnet_get_functions($type, $parentname) {
         foreach($rpcrecords as $rpc) {
             if (!array_key_exists($rpc->function_name, $methodServiceArray)) {
                 $rpc->enabled = 0;
-                update_record('mnet_rpc', $rpc);
+                update_record('mnet_rpc', addslashes_recursive($rpc));
             }
         }
     }
@@ -85,7 +85,7 @@ function mnet_get_functions($type, $parentname) {
             } else {
                 array_unshift($profile, $details['returns']);
             }
-            $dataobject->profile       = serialize($profile);
+            $dataobject->profile       = addslashes(serialize($profile));
             $dataobject->help          = addslashes($details['description']);
         } else {
             $dataobject->profile       = serialize(array(array('type' => 'void', 'description' => 'No return value')));

admin/mnet/delete.php

@@ -31,6 +31,8 @@
         redirect('index.php', get_string('postrequired','mnet') ,7);
     }
 
+    require_sesskey();
+
     if ('verify' == $step) {
         $mnet_peer = new mnet_peer();
         $mnet_peer->set_id($hostid);

admin/mnet/enr_course_enrol.php

@@ -85,9 +85,21 @@
     $mnet_request->set_method('enrol/mnet/enrol.php/course_enrolments');
     $mnet_request->add_param($course->remoteid, 'int');
     $mnet_request->send($mnet_peer);
-    $all_enrolled_users = $mnet_request->response;
-
+    $raw_all_enrolled_users = $mnet_request->response;
     unset($mnet_request);
+
+    $all_enrolled_users = array();
+    if (!empty($raw_all_enrolled_users)) {
+        // Try to repair keying of remote users array, numeric usernames get lost in the fracas
+        foreach ($raw_all_enrolled_users as $username => $userdetails) {
+            if (empty($userdetails['username']) || !is_numeric($username)) {
+                //Not able to repair, or no need to repair
+                $all_enrolled_users[$username] = $userdetails;
+            } else {
+                $all_enrolled_users[$userdetails['username']] = $userdetails;
+            }
+        }
+    }
     
     $select = '';
     $all_enrolled_usernames = '';

admin/mnet/mnet_review.html

@@ -1,23 +1,9 @@
 <?php
-$logurl = $CFG->wwwroot.
-          '/course/report/log/index.php?chooselog=1&amp;showusers=1&amp;showcourses=1&amp;host_course='.$mnet_peer->id.
-          '%2F1&amp;user='.'0'.
-          '&amp;date=0'.
-          '&amp;modid=&amp;modaction=0&amp;logformat=showashtml';
 
 admin_externalpage_print_header();
 
-if (isset($mnet_peer->id) && $mnet_peer->id > 0) {
-    $tabs[] = new tabobject('mnetdetails', 'peers.php?step=update&amp;hostid='.$mnet_peer->id, $strmnetedithost, $strmnetedithost, false);
-    $tabs[] = new tabobject('mnetservices', 'mnet_services.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetservices, $strmnetservices, false);
-    $tabs[] = new tabobject('mnetthemes', 'mnet_themes.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetthemes, $strmnetthemes, false);
-    if ($mnet_peer->application->name == 'moodle') {
-        $tabs[] = new tabobject('mnetlog', $logurl, $strmnetlog, $strmnetlog, false);
-    }
-} else {
-    $tabs[] = new tabobject('mnetdetails', '#', $strmnetedithost, $strmnetedithost, false);
-}
-print_tabs(array($tabs), 'mnetdetails');
+$currenttab = 'mnetdetails';
+require_once($CFG->dirroot .'/admin/mnet/tabs.php');
 
 print_simple_box_start("center", "");
 ?>

admin/mnet/mnet_review_allhosts.html

@@ -1,10 +1,8 @@
 <?php
 admin_externalpage_print_header();
 
-$tabs[] = new tabobject('mnetdetails', 'peers.php?step=update&amp;hostid='.$mnet_peer->id, $strmnetedithost, $strmnetedithost, false);
-$tabs[] = new tabobject('mnetservices', 'mnet_services.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetservices, $strmnetservices, false);
-$tabs[] = new tabobject('mnetthemes', 'mnet_themes.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetthemes, $strmnetthemes, false);
-print_tabs(array($tabs), 'mnetdetails');
+$currenttab = 'mnetdetails';
+require_once($CFG->dirroot .'/admin/mnet/tabs.php');
 
 print_simple_box_start("center", "");
 ?>
@@ -14,7 +12,7 @@ print_simple_box_start("center", "");
     <td valign="top"><?php echo $mnet_peer->name; ?></td>
 </tr>
 <tr>
-    <td align="right" valign="top" colspan="2"><?php print_string('allhosts_no_options'); ?>:</td>
+    <td align="right" valign="top" colspan="2"><?php print_string('allhosts_no_options','mnet'); ?></td>
 </tr>
 </table>
 <?php

admin/mnet/mnet_services.html

@@ -1,19 +1,9 @@
 <?php
 admin_externalpage_print_header();
 
-$logurl = $CFG->wwwroot.
-          '/course/report/log/index.php?chooselog=1&amp;showusers=1&amp;showcourses=1&amp;host_course='.$mnet_peer->id.
-          '%2F1&amp;user='.'0'.
-          '&amp;date=0'.
-          '&amp;modid=&amp;modaction=0&amp;logformat=showashtml';
+$currenttab = 'mnetservices';
+require_once($CFG->dirroot .'/admin/mnet/tabs.php');
 
-$tabs[] = new tabobject('mnetdetails', 'peers.php?step=update&amp;hostid='.$mnet_peer->id, $strmnetedithost, $strmnetedithost, false);
-$tabs[] = new tabobject('mnetservices', 'mnet_services.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetservices, $strmnetservices, false);
-$tabs[] = new tabobject('mnetthemes', 'mnet_themes.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetthemes, $strmnetthemes, false);
-if ($mnet_peer->id != $CFG->mnet_all_hosts_id && $mnet_peer->application->name == 'moodle') {
-    $tabs[] = new tabobject('mnetlog', $logurl, $strmnetlog, $strmnetlog, false);
-}
-print_tabs(array($tabs), 'mnetservices');
 print_simple_box_start("center", "");
 
 ?>
@@ -27,11 +17,12 @@ print_simple_box_start("center", "");
 <?php 
     foreach($myservices as $name => $versions) {
     $version = current($versions);
+    $langmodule = ($version['parent_type'] == 'mod' ? '' : ($version['parent_type'] . '_')) . $version['parent'];
 ?>
 <tr>
     <td align="left" valign="top" colspan="2">
-    <h3><?php echo get_string($name.'_name', $version['parent_type'].'_'.$version['parent'] , $mnet_peer->name); ?></h3>
-    <?php echo get_string($name.'_description', $version['parent_type'].'_'.$version['parent'], $mnet_peer->name); ?>
+    <h3><?php echo get_string($name.'_name', $langmodule , $mnet_peer->name); ?></h3>
+    <?php echo get_string($name.'_description', $langmodule, $mnet_peer->name); ?>
 <?php
         $breakstring = '';
         foreach($versions as $version){

admin/mnet/mnet_services.php

@@ -24,6 +24,10 @@
     // force   Go ahead with something we've been warned is strange
     $step   = optional_param('step', NULL, PARAM_ALPHA);
     $hostid = optional_param('hostid', NULL, PARAM_INT);
+    $publishes  = optional_param('publish', null, PARAM_BOOL); // optional_param cleans arrays too
+    $subscribes = optional_param('subscribe', null, PARAM_BOOL); // optional_param cleans arrays too
+    $exists     = optional_param('exists', null, PARAM_BOOL); // optional_param cleans arrays too
+
     $nocertstring = '';
     $nocertmatch  = '';
     $badcert = '';
@@ -43,21 +47,21 @@
     if (($form = data_submitted()) && confirm_sesskey()) {
         $mnet_peer->set_id($hostid);
         $treevals = array();
-        foreach($_POST['exists'] as $key => $value) {
-            $host2service   = get_record('mnet_host2service', 'hostid', $_POST['hostid'], 'serviceid', $key);
-            $publish        = (isset($_POST['publish'][$key]) && $_POST['publish'][$key] == 'on')? 1 : 0;
-            $subscribe      = (isset($_POST['subscribe'][$key]) && $_POST['subscribe'][$key] == 'on')? 1 : 0;
+        foreach($exists as $key => $value) {
+            $host2service   = get_record('mnet_host2service', 'hostid', $hostid, 'serviceid', $key);
+            $publish        = array_key_exists($key, $publishes) ? $publishes[$key] : 0;
+            $subscribe      = array_key_exists($key, $subscribes) ? $subscribes[$key] : 0;
 
             if ($publish != 1 && $subscribe != 1) {
                 if (false == $host2service) {
                     // We don't have or need a record - do nothing!
                 } else {
                     // We don't need the record - delete it
-                    delete_records('mnet_host2service', 'hostid', $_POST['hostid'], 'serviceid', $key);
+                    delete_records('mnet_host2service', 'hostid', $hostid, 'serviceid', $key);
                 }
             } elseif (false == $host2service && ($publish == 1 || $subscribe == 1)) {
                 $host2service = new stdClass();
-                $host2service->hostid = $_POST['hostid'];
+                $host2service->hostid = $hostid;
                 $host2service->serviceid = $key;
                 
                 $host2service->publish = $publish;
@@ -81,7 +85,7 @@
             $id_list .= ', '.$CFG->mnet_all_hosts_id;
         }
 
-        $concat = sql_concat('COALESCE(h2s.id,0) ', ' \'-\' ', ' svc.id');
+        $concat = sql_concat('COALESCE(h2s.id,0) ', ' \'-\' ', ' svc.id', '\'-\'', 'r.parent_type', '\'-\'', 'r.parent');
 
         $query = "
             SELECT DISTINCT

admin/mnet/mnet_themes.html

@@ -3,19 +3,8 @@ admin_externalpage_print_header();
 print_heading(get_string('themes'));
 $original_theme = fullclone($THEME);
 
-$logurl = $CFG->wwwroot.
-          '/course/report/log/index.php?chooselog=1&showusers=1&showcourses=1&host_course='.$mnet_peer->id.
-          '%2F1&user='.'0'.
-          '&date=0'.
-          '&modid=&modaction=0&logformat=showashtml';
-
-$tabs[] = new tabobject('mnetdetails', 'peers.php?step=update&hostid='.$mnet_peer->id, $strmnetedithost, $strmnetedithost, false);
-$tabs[] = new tabobject('mnetservices', 'mnet_services.php?step=list&hostid='.$mnet_peer->id, $strmnetservices, $strmnetservices, false);
-$tabs[] = new tabobject('mnetthemes', 'mnet_themes.php?step=list&hostid='.$mnet_peer->id, $strmnetthemes, $strmnetthemes, false);
-if ($mnet_peer->id != $CFG->mnet_all_hosts_id) {
-    $tabs[] = new tabobject('mnetlog', $logurl, $strmnetlog, $strmnetlog, false);
-}
-    print_tabs(array($tabs), 'mnetthemes');
+    $currenttab = 'mnetthemes';
+    require_once($CFG->dirroot .'/admin/mnet/tabs.php');
 
     $themes = get_list_of_plugins("theme");
     $sesskey = !empty($USER->id) ? $USER->sesskey : '';

admin/mnet/peers.html

@@ -55,6 +55,7 @@ if (empty($CFG->mnet_dispatcher_mode) || $CFG->mnet_dispatcher_mode !== 'strict'
                 <div>
                 <input type="hidden" name="hostid" value="<?php echo $host->id; ?>" />
                 <input type="hidden" name="step" value="verify" />
+                <input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
                 <input type="submit" name="submit" value="<?php print_string('delete'); ?>"/>
                 </div>
             </form>

admin/mnet/tabs.php

@@ -0,0 +1,27 @@
+<?php
+/**
+ * Handles tabs for the mnet pages.
+ * We assume that $currenttab is defined
+ *
+ */
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.'); // It must be included from a Moodle page
+}
+
+$logurl = $CFG->wwwroot.
+          '/course/report/log/index.php?chooselog=1&amp;showusers=1&amp;showcourses=1&amp;host_course='.$mnet_peer->id.
+          '%2F1&amp;user='.'0'.
+          '&amp;date=0'.
+          '&amp;modid=&amp;modaction=0&amp;logformat=showashtml';
+$tabs = array();
+if (isset($mnet_peer->id) && $mnet_peer->id > 0) {
+    $tabs[] = new tabobject('mnetdetails', 'peers.php?step=update&amp;hostid='.$mnet_peer->id, $strmnetedithost, $strmnetedithost, false);
+    $tabs[] = new tabobject('mnetservices', 'mnet_services.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetservices, $strmnetservices, false);
+    $tabs[] = new tabobject('mnetthemes', 'mnet_themes.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetthemes, $strmnetthemes, false);
+    if ($mnet_peer->application->name == 'moodle' && $mnet_peer->id != $CFG->mnet_all_hosts_id) {
+        $tabs[] = new tabobject('mnetlog', $logurl, $strmnetlog, $strmnetlog, false);
+    }
+} else {
+    $tabs[] = new tabobject('mnetdetails', '#', $strmnetedithost, $strmnetedithost, false);
+}
+print_tabs(array($tabs), $currenttab);

admin/process_email.php

@@ -72,7 +72,7 @@ while(!feof($fd)) {
 
 $function($modargs,$body); 
 
-fclose($handle);
+fclose($fd);
 
 
 

admin/register.php

@@ -42,7 +42,7 @@
 
     echo "<form id=\"mform1\" class=\"mform\" action=\"http://moodle.org/register/\" method=\"post\">\n";
     echo '<fieldset id="registration">';
-    echo '<legend>Registration Information</legend>';
+    echo '<legend>'.get_string("registrationinfotitle").'</legend>';
 
     echo "<!-- The following hidden variables are to help prevent fake entries being sent. -->\n";
     echo "<!-- Together they form a key.  If any of these change between updates then the entry  -->\n";

admin/replace.php

@@ -5,6 +5,11 @@ require_once('../config.php');
 require_once($CFG->dirroot.'/course/lib.php');
 require_once($CFG->libdir.'/adminlib.php');
 
+// workaround for problems with compression
+if (ini_get('zlib.output_compression')) {
+    @ini_set('zlib.output_compression', 'Off');
+}
+
 admin_externalpage_setup('replace');
 
 $search  = optional_param('search', '', PARAM_RAW);

admin/report/backups/index.php

@@ -38,7 +38,7 @@
     $strcourse = get_string("course");
     $strtimetaken = get_string("timetaken","quiz");
     $strstatus = get_string("status");
-    $strnext = get_string("next");
+    $strnext = get_string("backupnext");
 
 /// Decide when to show last execution logs or detailed logs
 /// Lastlog view

admin/report/security/lib.php

@@ -53,11 +53,13 @@ function report_security_get_issue_list() {
         'report_security_check_openprofiles',
         'report_security_check_google',
         'report_security_check_passwordpolicy',
+        'report_security_check_passwordsaltmain',
         'report_security_check_emailchangeconfirmation',
         'report_security_check_cookiesecure',
         'report_security_check_configrw',
         'report_security_check_riskxss',
         'report_security_check_riskadmin',
+        'report_security_check_riskbackup',
         'report_security_check_defaultuserrole',
         'report_security_check_guestrole',
         'report_security_check_frontpagerole',
@@ -485,6 +487,37 @@ function report_security_check_configrw($detailed=false) {
     return $result;
 }
 
+function report_security_check_passwordsaltmain($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_passwordsaltmain';
+    $result->name    = get_string('check_passwordsaltmain_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+    
+    if (empty($CFG->passwordsaltmain)) {
+        $result->status = REPORT_SECURITY_WARNING;
+        $result->info   = get_string('check_passwordsaltmain_warning', 'report_security');
+    } else if ($CFG->passwordsaltmain === 'some long random string here with lots of characters'
+            || trim($CFG->passwordsaltmain) === '' || preg_match('/^([a-z0-9]{0,10})$/i', $CFG->passwordsaltmain)) {
+        $result->status = REPORT_SECURITY_WARNING;
+        $result->info   = get_string('check_passwordsaltmain_weak', 'report_security');
+    } else {
+        $result->status = REPORT_SECURITY_OK;
+        $result->info   = get_string('check_passwordsaltmain_ok', 'report_security');
+    }
+
+    if ($detailed) {
+        $docspath = $CFG->docroot.'/'.str_replace('_utf8', '', current_language()).'/report/security/report_security_check_passwordsaltmain';
+        $result->details = get_string('check_passwordsaltmain_details', 'report_security', $docspath);
+    }
+
+    return $result;
+}
+
 /**
  * Lists all users with XSS risk, it would be great to combine this with risk trusts in user table,
  * unfortunately nobody implemented user trust UI yet :-(
@@ -1060,3 +1093,112 @@ function report_security_check_riskadmin($detailed=false) {
 
     return $result;
 }
+
+/**
+ * Lists all roles that have the ability to backup user data, as well as users
+ * @param bool $detailed
+ * @return object result
+ */
+function report_security_check_riskbackup($detailed=false) {
+    global $CFG;
+
+    $result = new object();
+    $result->issue   = 'report_security_check_riskbackup';
+    $result->name    = get_string('check_riskbackup_name', 'report_security');
+    $result->info    = null;
+    $result->details = null;
+    $result->status  = null;
+    $result->link    = null;
+
+    $syscontext = get_context_instance(CONTEXT_SYSTEM);
+
+    $systemroles = get_records_sql(
+        "SELECT DISTINCT r.*
+           FROM {$CFG->prefix}role r
+           JOIN {$CFG->prefix}role_capabilities rc ON rc.roleid = r.id
+          WHERE rc.capability = 'moodle/backup:userinfo' AND rc.contextid = $syscontext->id AND rc.permission = ".CAP_ALLOW."");
+
+    $overriddenroles = get_records_sql(
+        "SELECT DISTINCT r.*, rc.contextid
+           FROM {$CFG->prefix}role r
+           JOIN {$CFG->prefix}role_capabilities rc ON rc.roleid = r.id
+          WHERE rc.capability = 'moodle/backup:userinfo' AND rc.contextid <> $syscontext->id AND rc.permission = ".CAP_ALLOW."");
+
+    // list of users that are able to backup personal info
+    // note: "sc" is context where is role assigned,
+    //       "c" is context where is role overriden or system context if in role definition
+    $sqluserinfo = "
+        FROM (SELECT rcx.*
+                FROM {$CFG->prefix}role_capabilities rcx
+               WHERE rcx.permission = ".CAP_ALLOW." AND rcx.capability = 'moodle/backup:userinfo') rc,
+             {$CFG->prefix}context c,
+             {$CFG->prefix}context sc,
+             {$CFG->prefix}role_assignments ra,
+             {$CFG->prefix}user u
+       WHERE c.id = rc.contextid
+             AND (sc.path = c.path OR sc.path LIKE ".sql_concat('c.path', "'/%'")." OR c.path LIKE ".sql_concat('sc.path', "'/%'").")
+             AND u.id = ra.userid AND u.deleted = 0
+             AND ra.contextid = sc.id AND ra.roleid = rc.roleid
+             AND sc.contextlevel <= ".CONTEXT_COURSE." AND c.contextlevel <= ".CONTEXT_COURSE."";
+
+    $usercount = count_records_sql("SELECT COUNT('x') FROM (SELECT DISTINCT u.id $sqluserinfo) userinfo");
+    $systemrolecount = empty($systemroles) ? 0 : count($systemroles);
+    $overriddenrolecount = empty($overriddenroles) ? 0 : count($overriddenroles);
+
+    $result->status  = REPORT_SECURITY_WARNING; // there is always at least one admin
+    $a = (object)array('rolecount'=>$systemrolecount,'overridecount'=>$overriddenrolecount,'usercount'=>$usercount);
+    $result->info = get_string('check_riskbackup_warning', 'report_security', $a);
+
+    if ($detailed) {
+
+        $result->details = '';  // Will be added to later
+
+        // Make a list of roles
+        if ($systemroles) {
+            $links = array();
+            foreach ($systemroles as $role) {
+                $role->url = "$CFG->wwwroot/$CFG->admin/roles/manage.php?action=edit&amp;roleid=$role->id";
+                $links[] = '<li>'.get_string('check_riskbackup_editrole', 'report_security', $role).'</li>';
+            }
+            $links = '<ul>'.implode($links).'</ul>';
+            $result->details .= get_string('check_riskbackup_details_systemroles', 'report_security', $links);
+        }
+
+        // Make a list of overrides to roles
+        $rolelinks2 = array();
+        if ($overriddenroles) {
+            $links = array();
+            foreach ($overriddenroles as $role) {
+                $context = get_context_instance_by_id($role->contextid);
+                if ($context->contextlevel == CONTEXT_COURSE) {
+                    $role->name = role_get_name($role, $context);
+                }
+                $role->contextname = print_context_name($context);
+                $role->url = "$CFG->wwwroot/$CFG->admin/roles/override.php?contextid=$role->contextid&amp;roleid=$role->id";
+                $links[] = '<li>'.get_string('check_riskbackup_editoverride', 'report_security', $role).'</li>';
+            }
+            $links = '<ul>'.implode($links).'</ul>';
+            $result->details .= get_string('check_riskbackup_details_overriddenroles', 'report_security', $links);
+        }
+
+        // Get a list of affected users as well
+        $rs = get_recordset_sql("SELECT DISTINCT u.id, u.firstname, u.lastname, u.picture, u.imagealt, u.email, ra.contextid, ra.roleid
+            $sqluserinfo ORDER BY u.lastname, u.firstname");
+
+        $users = array();
+        while ($user = rs_fetch_next_record($rs)) {
+            $context = get_context_instance_by_id($user->contextid);
+            $url = "$CFG->wwwroot/$CFG->admin/roles/assign.php?contextid=$user->contextid&amp;roleid=$user->roleid";
+            $a = (object)array('fullname'=>fullname($user), 'url'=>$url, 'email'=>$user->email,
+                               'contextname'=>print_context_name($context));
+            $users[] = '<li>'.get_string('check_riskbackup_unassign', 'report_security', $a).'</li>';
+        }
+        rs_close($rs);
+        if (!empty($users)) {
+            $users = '<ul>'.implode($users).'</ul>';
+            $result->details .= get_string('check_riskbackup_details_users', 'report_security', $users);
+        }
+    }
+
+    return $result;
+}

admin/report/spamcleaner/index.php

@@ -147,7 +147,7 @@ echo '</div>';
 
 function search_spammers($keywords) {
 
-    global $CFG, $USER, $DB; 
+    global $CFG, $USER; 
 
     if (!is_array($keywords)) {
         $keywords = array($keywords);    // Make it into an array

admin/report/unittest/ex_simple_test.php

@@ -22,13 +22,13 @@ require_once($CFG->libdir . '/simpletestlib/test_case.php');
  * them into a group test.
  * @package SimpleTestEx
  */
-class AutoGroupTest extends GroupTest {
+class AutoGroupTest extends TestSuite {
 
     var $thorough;
     var $showsearch;
 
     function AutoGroupTest($showsearch, $thorough, $test_name = null) {
-        $this->GroupTest($test_name);
+        $this->TestSuite($test_name);
         $this->showsearch = $showsearch;
         $this->thorough = $thorough;
     }
@@ -56,7 +56,7 @@ class AutoGroupTest extends GroupTest {
             }
             $file_path = $path . '/' . $file;
             if (is_dir($file_path)) {
-                if ($file != 'CVS' && !in_array($file_path, $this->ignorefolders)) {
+                if ($file != 'CVS' && $file != '.git' && !in_array($file_path, $this->ignorefolders)) {
                     $this->_recurseFolders($file_path);
                 }
             } elseif (preg_match('/simpletest(\/|\\\\)test.*\.php$/', $file_path) ||

admin/roles/allowassign.php

@@ -21,10 +21,10 @@
 
     $roles = get_all_roles();
 
-    if ($grant = data_submitted()) {
+    if ($grant = data_submitted() and confirm_sesskey()) {
 
         foreach ($grant as $grole => $val) {
-            if ($grole == 'dummy') {
+            if ($grole == 'dummy' or !strpos($grole, '_')) {
                 continue;
             }
 
@@ -81,6 +81,7 @@
     print_table($table);
     echo '<div class="buttons"><input type="submit" value="'.get_string('savechanges').'"/>';
     echo '<input type="hidden" name="dummy" value="1" />'; // this is needed otherwise we do not know a form has been submitted
+    echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
     echo '</div></form>';
 
     admin_externalpage_print_footer();

admin/roles/allowoverride.php

@@ -19,10 +19,10 @@
 
     $roles = get_all_roles();
 
-    if ($grant = data_submitted()) {
+    if ($grant = data_submitted() and confirm_sesskey()) {
 
         foreach ($grant as $grole => $val) {
-            if ($grole == 'dummy') {
+            if ($grole == 'dummy' or !strpos($grole, '_')) {
                 continue;
             }
 
@@ -79,6 +79,7 @@
     print_table($table);
     echo '<div class="buttons"><input type="submit" value="'.get_string('savechanges').'"/>';
     echo '<input type="hidden" name="dummy" value="1" />'; // this is needed otherwise we do not know a form has been submitted
+    echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
     echo '</div></form>';
 
     admin_externalpage_print_footer();

admin/roles/assign.php

@@ -325,7 +325,7 @@
                 if ($validroleids) {
                     $roleids =  '('.implode(',', $validroleids).')';
 
-                    $select = " SELECT u.id, u.firstname, u.lastname, u.email";
+                    $select = " SELECT DISTINCT u.id, u.firstname, u.lastname, u.email";
                     $countselect = "SELECT COUNT(u.id)";
                     $from   = " FROM {$CFG->prefix}user u
                                 INNER JOIN {$CFG->prefix}role_assignments ra ON ra.userid = u.id

admin/roles/tabs.php

@@ -35,6 +35,9 @@ if ($currenttab != 'update') {
             $navlinks[] = array('name' => $category->name,
                                 'link' => "$CFG->wwwroot/course/category.php?id=$category->id",
                                 'type' => 'misc');
+            $navlinks[] = array('name' => get_string("roles"),
+                                'link' => null,
+                                'type' => 'misc');
             $navigation = build_navigation($navlinks);
 
             print_header("$SITE->shortname: $category->name", "$SITE->fullname: $strcourses", $navigation, "", "", true);

admin/settings/misc.php

@@ -16,6 +16,8 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
     $rqsetting->plugin = 'qtype_random';
     $temp->add($rqsetting);
     $temp->add(new admin_setting_configcheckbox('experimentalsplitrestore', get_string('experimentalsplitrestore', 'admin'), get_string('configexperimentalsplitrestore', 'admin'), 0));
+    $temp->add(new admin_setting_configcheckbox('enableimsccimport', get_string('enable_cc_import', 'imscc'), get_string('enable_cc_import_description', 'imscc'), 0));
+    $temp->add(new admin_setting_configcheckbox('enablesafebrowserintegration', get_string('enablesafebrowserintegration', 'admin'), get_string('configenablesafebrowserintegration', 'admin'), 0));
 
     $ADMIN->add('misc', $temp);
 

admin/settings/security.php

@@ -26,7 +26,7 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
                        2700 => get_string('numminutes', '', 45),
                        3600 => get_string('numminutes', '', 60))));
     $temp->add(new admin_setting_configselect('fullnamedisplay', get_string('fullnamedisplay', 'admin'), get_string('configfullnamedisplay', 'admin'),
-                  'firstname lastname', array('language' => get_string('language'),
+                  'language', array('language' => get_string('language'),
                                               'firstname lastname' => get_string('firstname').' + '.get_string('lastname'),
                                               'lastname firstname' => get_string('lastname').' + '.get_string('firstname'),
                                               'firstname' => get_string('firstname'))));
@@ -46,7 +46,7 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
     $temp->add(new admin_setting_configcheckbox('cronclionly', get_string('cronclionly', 'admin'), get_string('configcronclionly', 'admin'), 0));
     $temp->add(new admin_setting_configpasswordunmask('cronremotepassword', get_string('cronremotepassword', 'admin'), get_string('configcronremotepassword', 'admin'), ''));
 
-    $temp->add(new admin_setting_configcheckbox('passwordpolicy', get_string('passwordpolicy', 'admin'), get_string('configpasswordpolicy', 'admin'), 0));
+    $temp->add(new admin_setting_configcheckbox('passwordpolicy', get_string('passwordpolicy', 'admin'), get_string('configpasswordpolicy', 'admin'), 1));
     $temp->add(new admin_setting_configtext('minpasswordlength', get_string('minpasswordlength', 'admin'), get_string('configminpasswordlength', 'admin'), 8, PARAM_INT));
     $temp->add(new admin_setting_configtext('minpassworddigits', get_string('minpassworddigits', 'admin'), get_string('configminpassworddigits', 'admin'), 1, PARAM_INT));
     $temp->add(new admin_setting_configtext('minpasswordlower', get_string('minpasswordlower', 'admin'), get_string('configminpasswordlower', 'admin'), 1, PARAM_INT));
@@ -65,14 +65,16 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
     $temp->add(new admin_setting_configcheckbox('loginhttps', get_string('loginhttps', 'admin'), get_string('configloginhttps', 'admin'), 0));
     $temp->add(new admin_setting_configcheckbox('cookiesecure', get_string('cookiesecure', 'admin'), get_string('configcookiesecure', 'admin'), 0));
     $temp->add(new admin_setting_configcheckbox('cookiehttponly', get_string('cookiehttponly', 'admin'), get_string('configcookiehttponly', 'admin'), 0));
+    $temp->add(new admin_setting_configcheckbox('regenloginsession', get_string('regenloginsession', 'admin'), get_string('configregenloginsession', 'admin'), 1));
+    $temp->add(new admin_setting_configtext('excludeoldflashclients', get_string('excludeoldflashclients', 'admin'), get_string('configexcludeoldflashclients', 'admin'), '10.0.12', PARAM_TEXT));
     $ADMIN->add('security', $temp);
 
 
     // "modulesecurity" settingpage
     $temp = new admin_settingpage('modulesecurity', get_string('modulesecurity', 'admin'));
-    $temp->add(new admin_setting_configselect('restrictmodulesfor', get_string('restrictmodulesfor', 'admin'), get_string('configrestrictmodulesfor', 'admin'), 'none', array('none' => 'No courses',
-                                                                                                                                                                              'all' => 'All courses',
-                                                                                                                                                                              'requested' => 'Requested courses')));
+    $temp->add(new admin_setting_configselect('restrictmodulesfor', get_string('restrictmodulesfor', 'admin'), get_string('configrestrictmodulesfor', 'admin'), 'none', array('none' => get_string('nocourses'),
+                                                                                                                                                                              'all' => get_string('fulllistofcourses'),
+                                                                                                                                                                              'requested' => get_string('requestedcourses'))));
     $temp->add(new admin_setting_configcheckbox('restrictbydefault', get_string('restrictbydefault', 'admin'), get_string('configrestrictbydefault', 'admin'), 0));
     if (!$options = get_records("modules")) {
         $options = array();

admin/uploadpicture.php

@@ -61,7 +61,7 @@ $overwritepicture = optional_param('overwritepicture', 0, PARAM_BOOL);
 admin_externalpage_print_header();
 print_heading_with_help($struploadpictures, 'uploadpictures');
 
-$mform = new admin_uploadpicture_form();
+$mform = new admin_uploadpicture_form(null, $userfields);
 if ($formdata = $mform->get_data()) {
     if (!array_key_exists($userfield, $userfields)) {
         notify(get_string('uploadpicture_baduserfield','admin'));
@@ -191,25 +191,19 @@ function process_directory ($dir, $userfield, $overwrite, &$results) {
  */
 function process_file ($file, $userfield, $overwrite) {
     // Add additional checks on the filenames, as they are user
-    // controlled and we don't want to open any security holes.
+    // controlled and we don't want to open any security holes.    
     $path_parts = pathinfo(cleardoubleslashes($file));
     $basename  = $path_parts['basename'];
     $extension = $path_parts['extension'];
-    if ($basename != clean_param($basename, PARAM_CLEANFILE)) {
-        // The original picture file name has invalid characters
-        notify(get_string('uploadpicture_invalidfilename', 'admin',
-                          clean_param($basename, PARAM_CLEANHTML)));
-        return PIX_FILE_ERROR;
-    }
-
+    
     // The picture file name (without extension) must match the
     // userfield attribute.
     $uservalue = substr($basename, 0,
                         strlen($basename) -
                         strlen($extension) - 1);
 
-    // userfield names are safe, so don't quote them.
-    if (!($user = get_record('user', $userfield, addslashes($uservalue)))) {
+    // userfield names are safe, so don't quote them.    
+    if (!($user = get_record('user', $userfield, addslashes($uservalue),'deleted',0))) {
         $a = new Object();
         $a->userfield = clean_param($userfield, PARAM_CLEANHTML);
         $a->uservalue = clean_param($uservalue, PARAM_CLEANHTML);

admin/uploadpicture_form.php

@@ -4,7 +4,6 @@
     class admin_uploadpicture_form extends moodleform {
         function definition (){
             global $CFG, $USER;
-            global $userfields;
     
             $mform =& $this->_form;
     
@@ -14,11 +13,11 @@
     
             $mform->addElement('file', 'userpicturesfile', get_string('file'), 'size="40"');
             $mform->addRule('userpicturesfile', null, 'required');
-    
-            $choices = $userfields;
+
+            $choices =& $this->_customdata;
             $mform->addElement('select', 'userfield', get_string('uploadpicture_userfield', 'admin'), $choices);
             $mform->setType('userfield', PARAM_INT);
-    
+
             $choices = array( 0 => get_string('no'), 1 => get_string('yes') );
             $mform->addElement('select', 'overwritepicture', get_string('uploadpicture_overwrite', 'admin'), $choices);
             $mform->setType('overwritepicture', PARAM_INT);

admin/uploaduser.php

@@ -149,8 +149,7 @@ if ($formdata = $mform->is_cancelled()) {
     $renames      = 0;
     $renameerrors = 0;
     $usersskipped = 0;
-
-    $forcechangepassword = 0;
+    $weakpasswords = 0;
 
     // caches
     $ccache    = array(); // course cache - do not fetch all courses here, we  will not probably use them all anyway!
@@ -192,6 +191,8 @@ if ($formdata = $mform->is_cancelled()) {
 
         $upt->track('line', $linenum);
 
+        $forcechangepassword = false;
+
         $user = new object();
         // by default, use the local mnet id (this may be changed in the file)
         $user->mnethostid = $CFG->mnet_localhost_id;
@@ -204,7 +205,8 @@ if ($formdata = $mform->is_cancelled()) {
                     if ($value !== '') {
                         $user->password = hash_internal_user_password($value);
                         if (!empty($CFG->passwordpolicy) and !check_password_policy($value, $errmsg)) {
-                            $forcechangepassword++;
+                            $forcechangepassword = true;
+                            $weakpasswords++;
                         }
                     }
                 } else {
@@ -707,7 +709,7 @@ if ($formdata = $mform->is_cancelled()) {
     if ($usersskipped) {
         echo get_string('usersskipped', 'admin').': '.$usersskipped.'<br />';
     }
-    echo get_string('usersweakpassword', 'admin').': '.$forcechangepassword.'<br />';
+    echo get_string('usersweakpassword', 'admin').': '.$weakpasswords.'<br />';
     echo get_string('errors', 'admin').': '.$userserrors.'</p>';
     print_box_end();
 

admin/user/user_bulk.php

@@ -24,6 +24,7 @@ if ($data = $action_form->get_data(false)) {
         case 3: redirect($CFG->wwwroot.'/'.$CFG->admin.'/user/user_bulk_delete.php');
         case 4: redirect($CFG->wwwroot.'/'.$CFG->admin.'/user/user_bulk_display.php');
         case 5: redirect($CFG->wwwroot.'/'.$CFG->admin.'/user/user_bulk_download.php');
+        case 6: redirect($CFG->wwwroot.'/'.$CFG->admin.'/user/user_bulk_forcepasswordchange.php');
     }
 }
 

admin/user/user_bulk_forcepasswordchange.php

@@ -0,0 +1,70 @@
+<?php //$Id$
+/**
+* script for bulk user force password change
+*/
+
+require_once('../../config.php');
+require_once('lib.php');
+require_once($CFG->libdir.'/adminlib.php');
+
+$confirm = optional_param('confirm', 0, PARAM_BOOL);
+
+require_login();
+admin_externalpage_setup('userbulk');
+require_capability('moodle/user:update', get_context_instance(CONTEXT_SYSTEM));
+
+$return = $CFG->wwwroot.'/'.$CFG->admin.'/user/user_bulk.php';
+
+if (empty($SESSION->bulk_users)) {
+    redirect($return);
+}
+
+admin_externalpage_print_header();
+
+if ($confirm and confirm_sesskey()) {
+    // only force password change if user may actually change the password
+    $authsavailable = get_list_of_plugins('auth');
+    $changeable = array();
+    foreach($authsavailable as $authname) {
+        if (!$auth = get_auth_plugin($authname)) {
+            continue;
+        }
+        if (@$auth->is_internal() and @$auth->can_change_password()) { // plugins may not be configured yet, not nice :-(
+            $changeable[$authname] = true;
+        }
+    }
+
+    $parts = array_chunk($SESSION->bulk_users, 300);
+    foreach ($parts as $users) {
+        $in = implode(',', $users);
+        if ($rs = get_recordset_select('user', "id IN ($in)")) {
+            while ($user = rs_fetch_next_record($rs)) {
+                if (!empty($changeable[$user->auth])) {
+                    set_user_preference('auth_forcepasswordchange', 1, $user->id);
+                    unset($SESSION->bulk_users[$user->id]);
+                } else {
+                    notify(get_string('forcepasswordchangenot', '', fullname($user, true)));
+                }
+            }
+            rs_close($rs);
+        }
+    }
+    notify(get_string('changessaved'), 'notifysuccess');
+    print_continue($return);
+
+} else {
+    $in = implode(',', $SESSION->bulk_users);
+    $userlist = get_records_select_menu('user', "id IN ($in)", 'fullname', 'id,'.sql_fullname().' AS fullname', 0, MAX_BULK_USERS);
+    $usernames = implode(', ', $userlist);
+    if (count($SESSION->bulk_users) > MAX_BULK_USERS) {
+        $usernames .= ', ...';
+    }
+    $optionsyes = array();
+    $optionsyes['confirm'] = 1;
+    $optionsyes['sesskey'] = sesskey();
+    print_heading(get_string('confirmation', 'admin'));
+    notice_yesno(get_string('forcepasswordchangecheckfull', '', $usernames), 'user_bulk_forcepasswordchange.php', 'user_bulk.php', $optionsyes, NULL, 'post', 'get');
+}
+
+admin_externalpage_print_footer();
+?>

admin/user/user_bulk_forms.php

@@ -24,6 +24,9 @@ class user_bulk_action_form extends moodleform {
         if (has_capability('moodle/user:update', $syscontext)) {
             $actions[5] = get_string('download', 'admin');
         }
+        if (has_capability('moodle/user:update', $syscontext)) {
+            $actions[6] = get_string('forcepasswordchange');
+        }
 
         $objs = array();
         $objs[] =& $mform->createElement('select', 'action', null, $actions);

admin/user/user_message_form.php

@@ -9,7 +9,7 @@ class user_message_form extends moodleform {
         $mform->addElement('header', 'general', get_string('message', 'message'));
 
 
-        $mform->addElement('textarea', 'messagebody', get_string('messagebody'), array('rows'=>15, 'cols'=>60));
+        $mform->addElement('htmleditor', 'messagebody', get_string('messagebody'), array('rows'=>15, 'cols'=>60));
         $mform->addRule('messagebody', '', 'required', null, 'client');
         $mform->setHelpButton('messagebody', array('writing', 'reading', 'questions', 'richtext'), false, 'editorhelpbutton');
         $mform->addElement('format', 'format', get_string('format'));

admin/xmldb/actions/XMLDBAction.class.php

@@ -47,6 +47,8 @@ class XMLDBAction {
 
     var $postaction;     //Action to execute at the end of the invoke script
 
+    var $sesskey_protected; // Actions must be protected by sesskey mechanishm
+
     /**
      * Constructor
      */
@@ -72,6 +74,7 @@ class XMLDBAction {
         $this->output    = NULL;
         $this->errormsg  = NULL;
         $this->subaction = NULL;
+        $this->sesskey_protected = true;
     }
 
     /**
@@ -130,13 +133,18 @@ class XMLDBAction {
     }
 
     /**
-     * main invoke method, it simply sets the postaction attribute
-     * if possible
+     * main invoke method, it sets the postaction attribute
+     * if possible and checks sesskey_protected if needed
      */
     function invoke() {
 
         global $SESSION;
 
+    /// Sesskey protection
+        if ($this->sesskey_protected) {
+            require_sesskey();
+        }
+
     /// If we are used any dir, save it in the lastused session object
     /// Some actions can use it to perform positioning
         if ($lastused = optional_param ('dir', NULL, PARAM_PATH)) {

admin/xmldb/actions/check_bigints/check_bigints.class.php

@@ -111,7 +111,7 @@ class check_bigints extends XMLDBAction {
             }
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=check_bigints&amp;confirmed=yes" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=check_bigints&amp;sesskey=' . sesskey() . '&amp;confirmed=yes" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';
@@ -208,6 +208,10 @@ class check_bigints extends XMLDBAction {
                                 $o.='        </ul>';
                             }
                             $o.='    </li>';
+                        /// Give the script some more time (resetting to current if exists)
+                            if ($currenttl = @ini_get('max_execution_time')) {
+                                @ini_set('max_execution_time',$currenttl);
+                            }
                         }
                         $o.='        </ul>';
                     }

admin/xmldb/actions/check_indexes/check_indexes.class.php

@@ -94,7 +94,7 @@ class check_indexes extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmcheckindexes'] . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=check_indexes&amp;confirmed=yes" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=check_indexes&amp;sesskey=' . sesskey() . '&amp;confirmed=yes" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';
@@ -213,6 +213,10 @@ class check_indexes extends XMLDBAction {
                                 $o.='        </ul>';
                             }
                             $o.='    </li>';
+                        /// Give the script some more time (resetting to current if exists)
+                            if ($currenttl = @ini_get('max_execution_time')) {
+                                @ini_set('max_execution_time',$currenttl);
+                            }
                         }
                         $o.='        </ul>';
                     }

admin/xmldb/actions/delete_field/delete_field.class.php

@@ -77,7 +77,7 @@ class delete_field extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletefield'] . '<br /><br />' . $fieldparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_field&amp;confirmed=yes&amp;postaction=edit_table&amp;field=' . $fieldparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_field&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_table&amp;field=' . $fieldparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_index/delete_index.class.php

@@ -77,7 +77,7 @@ class delete_index extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeleteindex'] . '<br /><br />' . $indexparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_index&amp;confirmed=yes&amp;postaction=edit_table&amp;index=' . $indexparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_index&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_table&amp;index=' . $indexparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_key/delete_key.class.php

@@ -77,7 +77,7 @@ class delete_key extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletekey'] . '<br /><br />' . $keyparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_key&amp;confirmed=yes&amp;postaction=edit_table&amp;key=' . $keyparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_key&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_table&amp;key=' . $keyparam . '&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_sentence/delete_sentence.class.php

@@ -77,7 +77,7 @@ class delete_sentence extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletesentence'] . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_sentence&amp;confirmed=yes&amp;postaction=edit_statement&amp;sentence=' . $sentenceparam . '&amp;statement=' . urlencode($statementparam) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_sentence&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_statement&amp;sentence=' . $sentenceparam . '&amp;statement=' . urlencode($statementparam) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_statement/delete_statement.class.php

@@ -76,7 +76,7 @@ class delete_statement extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletestatement'] . '<br /><br />' . $statementparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_statement&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_statement&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_table/delete_table.class.php

@@ -76,7 +76,7 @@ class delete_table extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletetable'] . '<br /><br />' . $tableparam . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_table&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_table&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;postaction=edit_xml_file&amp;table=' . $tableparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/delete_xml_file/delete_xml_file.class.php

@@ -75,7 +75,7 @@ class delete_xml_file extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmdeletexmlfile'] . '<br /><br />' . $dirpath . '/install.php</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=delete_xml_file&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=delete_xml_file&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/edit_field/edit_field.class.php

@@ -35,6 +35,7 @@ class edit_field extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -103,6 +104,7 @@ class edit_field extends XMLDBAction {
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
         $o.= '    <input type="hidden" name ="field" value="' . $fieldparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_field_save" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';

admin/xmldb/actions/edit_index/edit_index.class.php

@@ -35,6 +35,7 @@ class edit_index extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -103,6 +104,7 @@ class edit_index extends XMLDBAction {
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
         $o.= '    <input type="hidden" name ="index" value="' . $indexparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_index_save" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';

admin/xmldb/actions/edit_key/edit_key.class.php

@@ -35,6 +35,7 @@ class edit_key extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -103,6 +104,7 @@ class edit_key extends XMLDBAction {
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
         $o.= '    <input type="hidden" name ="key" value="' . $keyparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_key_save" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';

admin/xmldb/actions/edit_sentence/edit_sentence.class.php

@@ -35,6 +35,7 @@ class edit_sentence extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -119,6 +120,7 @@ class edit_sentence extends XMLDBAction {
             $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
             $o.= '    <input type="hidden" name ="statement" value="' . $statementparam .'" />';
             $o.= '    <input type="hidden" name ="sentence" value="' . $sentenceparam .'" />';
+            $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
             $o.= '    <input type="hidden" name ="action" value="edit_sentence_save" />';
             $o.= '    <input type="hidden" name ="postaction" value="edit_statement" />';
             $o.= '    <table id="formelements" class="boxaligncenter">';

admin/xmldb/actions/edit_statement/edit_statement.class.php

@@ -35,6 +35,7 @@ class edit_statement extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -106,6 +107,7 @@ class edit_statement extends XMLDBAction {
         $o.= '<div>';        
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="statement" value="' . $statementparam .'" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_statement_save" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_statement" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';
@@ -129,7 +131,7 @@ class edit_statement extends XMLDBAction {
             $b .= '&nbsp;[' . $this->str['viewedited'] . ']';
         }
     /// The new sentence button
-        $b .= '&nbsp;<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newsentence'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;sesskey=' . sesskey() . '&amp;statement=' . $statementparam . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newsentence'] . ']</a>';
     /// The back to edit xml file button
         $b .= '&nbsp;<a href="index.php?action=edit_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['back'] . ']</a>';
         $b .= '</p>';
@@ -157,10 +159,10 @@ class edit_statement extends XMLDBAction {
                 $b .= '<a href="index.php?action=edit_sentence&amp;sentence=' .$key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['edit'] . ']</a>';
                 $b .= '</td><td class="button cell">';
             /// The duplicate button
-                $b .= '<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;basesentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['duplicate'] . ']</a>';
+                $b .= '<a href="index.php?action=new_sentence&amp;postaction=edit_sentence&amp;sesskey=' . sesskey() . '&amp;basesentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['duplicate'] . ']</a>';
                 $b .= '</td><td class="button cell">';
             /// The delete button
-                $b .= '<a href="index.php?action=delete_sentence&amp;sentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                $b .= '<a href="index.php?action=delete_sentence&amp;sesskey=' . sesskey() . '&amp;sentence=' . $key . '&amp;statement=' . urlencode($statement->getName()) . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                 $b .= '</td>';
             /// Print table row
             $o .= '<tr class="r' . $row . '"><td class="table cell">' . $p . $sentence . $b . '</tr>';

admin/xmldb/actions/edit_table/edit_table.class.php

@@ -35,6 +35,7 @@ class edit_table extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -107,6 +108,7 @@ class edit_table extends XMLDBAction {
         $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
         $o.= '    <input type="hidden" name ="table" value="' . $tableparam .'" />';
         $o.= '    <input type="hidden" name ="action" value="edit_table_save" />';
+        $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
         $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
         $o.= '    <table id="formelements" class="boxaligncenter">';
     /// If the table is being used, we cannot rename it
@@ -134,11 +136,11 @@ class edit_table extends XMLDBAction {
             $b .= '&nbsp;[' . $this->str['viewedited'] . ']';
         }
     /// The new field button
-        $b .= '&nbsp;<a href="index.php?action=new_field&amp;postaction=edit_field&amp;table=' . $tableparam . '&amp;field=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newfield'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_field&amp;sesskey=' . sesskey() . '&amp;postaction=edit_field&amp;table=' . $tableparam . '&amp;field=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newfield'] . ']</a>';
     /// The new key button
-        $b .= '&nbsp;<a href="index.php?action=new_key&amp;postaction=edit_key&amp;table=' . $tableparam . '&amp;key=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newkey'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_key&amp;sesskey=' . sesskey() . '&amp;postaction=edit_key&amp;table=' . $tableparam . '&amp;key=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newkey'] . ']</a>';
     /// The new index button
-        $b .= '&nbsp;<a href="index.php?action=new_index&amp;postaction=edit_index&amp;table=' . $tableparam . '&amp;index=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newindex'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=new_index&amp;sesskey=' . sesskey() . '&amp;postaction=edit_index&amp;table=' . $tableparam . '&amp;index=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newindex'] . ']</a>';
     /// The back to edit xml file button
         $b .= '&nbsp;<a href="index.php?action=edit_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['back'] . ']</a>';
         $b .= '</p>';
@@ -185,14 +187,14 @@ class edit_table extends XMLDBAction {
                 $b .= '</td><td class="button cell">';
             /// The up button
                 if ($field->getPrevious()) {
-                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=up&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['up'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The down button
                 if ($field->getNext()) {
-                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=down&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_field&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['down'] . ']';
                 }
@@ -200,7 +202,7 @@ class edit_table extends XMLDBAction {
             /// The delete button (if we have more than one and it isn't used
                 if (count($fields) > 1 &&
                 !$structure->getFieldUses($table->getName(), $field->getName())) {
-                    $b .= '<a href="index.php?action=delete_field&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_field&amp;sesskey=' . sesskey() . '&amp;field=' . $field->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['delete'] . ']';
                 }
@@ -234,21 +236,21 @@ class edit_table extends XMLDBAction {
                 $b .= '</td><td class="button cell">';
             /// The up button
                 if ($key->getPrevious()) {
-                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=up&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['up'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The down button
                 if ($key->getNext()) {
-                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=down&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_key&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['down'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The delete button (if the key hasn't uses)
                 if (!$structure->getKeyUses($table->getName(), $key->getName())) {
-                    $b .= '<a href="index.php?action=delete_key&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_key&amp;sesskey=' . sesskey() . '&amp;key=' . $key->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['delete'] . ']';
                 }
@@ -274,20 +276,20 @@ class edit_table extends XMLDBAction {
                 $b .= '</td><td class="button cell">';
             /// The up button
                 if ($index->getPrevious()) {
-                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=up&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['up'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The down button
                 if ($index->getNext()) {
-                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=down&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                    $b .= '<a href="index.php?action=move_updown_index&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_table' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['down'] . ']';
                 }
                 $b .= '</td><td class="button cell">';
             /// The delete button
-                    $b .= '<a href="index.php?action=delete_index&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_index&amp;sesskey=' . sesskey() . '&amp;index=' . $index->getName() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
             /// The readable info
                 $r = '</td><td class="readableinfo cell">' . $index->readableInfo() . '</td>';
             /// Print table row

admin/xmldb/actions/edit_xml_file/edit_xml_file.class.php

@@ -35,6 +35,7 @@ class edit_xml_file extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -107,6 +108,7 @@ class edit_xml_file extends XMLDBAction {
                 $o.= '    <input type="hidden" name ="postaction" value="edit_xml_file" />';
                 $o.= '    <input type="hidden" name ="path" value="' . s($structure->getPath()) .'" />';
                 $o.= '    <input type="hidden" name ="version" value="' . s($structure->getVersion()) .'" />';
+                $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() .'" />';
                 $o.= '    <table id="formelements" class="boxaligncenter">';
                 $o.= '      <tr valign="top"><td>Path:</td><td>' . s($structure->getPath()) . '</td></tr>';
                 $o.= '      <tr valign="top"><td>Version:</td><td>' . s($structure->getVersion()) . '</td></tr>';
@@ -125,15 +127,15 @@ class edit_xml_file extends XMLDBAction {
                     $b .= '&nbsp;[' . $this->str['viewedited'] . ']';
                 }
             /// The new table button
-                $b .= '&nbsp;<a href="index.php?action=new_table&amp;postaction=edit_table&amp;table=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtable'] . ']</a>';
+                $b .= '&nbsp;<a href="index.php?action=new_table&amp;sesskey=' . sesskey() . '&amp;postaction=edit_table&amp;table=changeme&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtable'] . ']</a>';
             /// The new from MySQL button
                 if ($CFG->dbfamily == 'mysql') {
-                    $b .= '&nbsp;<a href="index.php?action=new_table_from_mysql&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtablefrommysql'] . ']</a>';
+                    $b .= '&nbsp;<a href="index.php?action=new_table_from_mysql&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newtablefrommysql'] . ']</a>';
                 } else {
                     $b .= '&nbsp;[' . $this->str['newtablefrommysql'] . ']';
                 }
             /// The new statement button
-                $b .= '&nbsp;<a href="index.php?action=new_statement&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newstatement'] . ']</a>';
+                $b .= '&nbsp;<a href="index.php?action=new_statement&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['newstatement'] . ']</a>';
             /// The back to main menu button
                 $b .= '&nbsp;<a href="index.php?action=main_view#lastused">[' . $this->str['backtomainview'] . ']</a>';
                 $b .= '</p>';
@@ -169,14 +171,14 @@ class edit_xml_file extends XMLDBAction {
                         $b .= '</td><td class="button cell">';
                     /// The up button
                         if ($table->getPrevious()) {
-                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=up&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['up'] . ']';
                         }
                         $b .= '</td><td class="button cell">';
                     /// The down button
                         if ($table->getNext()) {
-                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=down&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_table&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;table=' . $table->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['down'] . ']';
                         }
@@ -185,7 +187,7 @@ class edit_xml_file extends XMLDBAction {
                         if (count($tables) > 1 &&
                             !$structure->getTableUses($table->getName())) {
                             ///!$structure->getTableUses($table->getName())) {
-                            $b .= '<a href="index.php?action=delete_table&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                            $b .= '<a href="index.php?action=delete_table&amp;sesskey=' . sesskey() . '&amp;table=' . $table->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['delete'] . ']';
                         }
@@ -214,20 +216,20 @@ class edit_xml_file extends XMLDBAction {
                         $b .= '</td><td class="button cell">';
                     /// The up button
                         if ($statement->getPrevious()) {
-                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=up&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=up&amp;sesskey=' . sesskey() . '&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['up'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['up'] . ']';
                         }
                         $b .= '</td><td class="button cell">';
                     /// The down button
                         if ($statement->getNext()) {
-                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=down&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
+                            $b .= '<a href="index.php?action=move_updown_statement&amp;direction=down&amp;sesskey=' . sesskey() . '&amp;statement=' . $statement->getName() . '&amp;postaction=edit_xml_file' . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['down'] . ']</a>';
                         } else {
                             $b .= '[' . $this->str['down'] . ']';
                         }
                         $b .= '</td><td class="button cell">';
                     /// The delete button
-                        $b .= '<a href="index.php?action=delete_statement&amp;statement=' . $statement->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
+                        $b .= '<a href="index.php?action=delete_statement&amp;sesskey=' . sesskey() . '&amp;statement=' . $statement->getName() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '">[' . $this->str['delete'] . ']</a>';
                         $b .= '</td>';
                     /// Print statement row
                         $o .= '<tr class="r' . $row . '"><td class="statement cell"><a href="index.php?action=view_statement_xml&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;statement=' . $statement->getName() . '&amp;select=edited">' . $statement->getName() . '</a>' . $b . '</tr>';

admin/xmldb/actions/get_db_directories/get_db_directories.class.php

@@ -39,6 +39,7 @@ class get_db_directories extends XMLDBAction {
         //$this->can_subaction = ACTION_HAVE_SUBACTIONS;
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/load_xml_file/load_xml_file.class.php

@@ -38,6 +38,7 @@ class load_xml_file extends XMLDBAction {
         //$this->can_subaction = ACTION_HAVE_SUBACTIONS;
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/main_view/main_view.class.php

@@ -35,6 +35,7 @@ class main_view extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(
@@ -85,12 +86,12 @@ class main_view extends XMLDBAction {
     /// The reserved_words button
         $b .= '&nbsp;<a href="index.php?action=view_reserved_words">[' . $this->str['reservedwords'] . ']</a>';
     /// The test button
-        $b .= '&nbsp;<a href="index.php?action=test">[' . $this->str['test'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=test&amp;sesskey=' . sesskey() . '">[' . $this->str['test'] . ']</a>';
     /// The check indexes button
-        $b .= '&nbsp;<a href="index.php?action=check_indexes">[' . $this->str['checkindexes'] . ']</a>';
+        $b .= '&nbsp;<a href="index.php?action=check_indexes&amp;sesskey=' . sesskey() . '">[' . $this->str['checkindexes'] . ']</a>';
     /// The check bigints button (only for MySQL and PostgreSQL) MDL-11038a
         if ($CFG->dbfamily == 'mysql' || $CFG->dbfamily == 'postgres') {
-            $b .= '&nbsp;<a href="index.php?action=check_bigints">[' . $this->str['checkbigints'] . ']</a>';
+            $b .= '&nbsp;<a href="index.php?action=check_bigints&amp;sesskey=' . sesskey() . '">[' . $this->str['checkbigints'] . ']</a>';
         }
         $b .= '</p>';
     /// Send buttons to output
@@ -131,7 +132,7 @@ class main_view extends XMLDBAction {
                 if ($dbdir->path_exists &&
                     !file_exists($key . '/install.xml') &&
                     is_writeable($key)) {
-                    $b .= '<a href="index.php?action=create_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['create'] . ']</a>';
+                    $b .= '<a href="index.php?action=create_xml_file&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['create'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['create'] . ']';
                 }
@@ -164,7 +165,7 @@ class main_view extends XMLDBAction {
                     is_writeable($key) &&
                     !empty($dbdir->xml_loaded) &&
                     !empty($dbdir->xml_changed)) {
-                    $b .= '<a href="index.php?action=save_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['save'] . ']</a>';
+                    $b .= '<a href="index.php?action=save_xml_file&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '&amp;time=' . time() . '&amp;postaction=main_view#lastused">[' . $this->str['save'] . ']</a>';
                 /// Check if the file has been manually edited while being modified in the editor
                     if ($dbdir->filemtime != filemtime($key . '/install.xml')) {
                     /// File manually modified. Add to errors.
@@ -183,7 +184,7 @@ class main_view extends XMLDBAction {
                     is_writeable($key) &&
                     !empty($dbdir->xml_loaded) &&
                     !empty($dbdir->xml_changed)) {
-                    $b .= '<a href="index.php?action=revert_changes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['revert'] . ']</a>';
+                    $b .= '<a href="index.php?action=revert_changes&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['revert'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['revert'] . ']';
                 }
@@ -205,7 +206,7 @@ class main_view extends XMLDBAction {
                     is_readable($key . '/install.xml') &&
                     is_writeable($key) &&
                     empty($dbdir->xml_loaded)) {
-                    $b .= '<a href="index.php?action=delete_xml_file&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['delete'] . ']</a>';
+                    $b .= '<a href="index.php?action=delete_xml_file&amp;sesskey=' . sesskey() . '&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $key)) . '">[' . $this->str['delete'] . ']</a>';
                 } else {
                     $b .= '[' . $this->str['delete'] . ']';
                 }

admin/xmldb/actions/new_statement/new_statement.class.php

@@ -107,6 +107,7 @@ class new_statement extends XMLDBAction {
             $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
             $o.= '    <input type="hidden" name ="action" value="new_statement" />';
             $o.= '    <input type="hidden" name ="postaction" value="edit_statement" />';
+            $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() . '" />';
             $o.= '    <table id="formelements" class="boxaligncenter" cellpadding="5">';
             $o.= '      <tr><td><label for="type" accesskey="t">' . $this->str['statementtype'] .' </label>' . choose_from_menu($typeoptions, 'type', '', 'choose', '', 0, true) . '<label for="table" accesskey="a">' . $this->str['statementtable'] . ' </label>' .choose_from_menu($selecttables, 'table', '', 'choose', '', 0, true) . '</td></tr>';
             $o.= '      <tr><td colspan="2" align="center"><input type="submit" value="' .$this->str['create'] . '" /></td></tr>';

admin/xmldb/actions/new_table_from_mysql/new_table_from_mysql.class.php

@@ -111,6 +111,7 @@ class new_table_from_mysql extends XMLDBAction {
             $o.= '    <input type="hidden" name ="dir" value="' . str_replace($CFG->dirroot, '', $dirpath) . '" />';
             $o.= '    <input type="hidden" name ="action" value="new_table_from_mysql" />';
             $o.= '    <input type="hidden" name ="postaction" value="edit_table" />';
+            $o.= '    <input type="hidden" name ="sesskey" value="' . sesskey() . '" />';
             $o.= '    <table id="formelements" class="boxaligncenter" cellpadding="5">';
             $o.= '      <tr><td><label for="table" accesskey="t">' . $this->str['createtable'] .' </label>' . choose_from_menu($selecttables, 'table', '', 'choose', '', 0, true) . '<label for="after" accesskey="a">' . $this->str['aftertable'] . ' </label>' .choose_from_menu($aftertables, 'after', '', 'choose', '', 0, true) . '</td></tr>';
             $o.= '      <tr><td colspan="2" align="center"><input type="submit" value="' .$this->str['create'] . '" /></td></tr>';

admin/xmldb/actions/revert_changes/revert_changes.class.php

@@ -75,7 +75,7 @@ class revert_changes extends XMLDBAction {
             $o.= '    <p class="centerpara">' . $this->str['confirmrevertchanges'] . '<br /><br />' . $dirpath . '</p>';
             $o.= '    <table class="boxaligncenter" cellpadding="20"><tr><td>';
             $o.= '      <div class="singlebutton">';
-            $o.= '        <form action="index.php?action=revert_changes&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
+            $o.= '        <form action="index.php?action=revert_changes&amp;sesskey=' . sesskey() . '&amp;confirmed=yes&amp;dir=' . urlencode(str_replace($CFG->dirroot, '', $dirpath)) . '&amp;postaction=main_view#lastused" method="post"><fieldset class="invisiblefieldset">';
             $o.= '          <input type="submit" value="'. $this->str['yes'] .'" /></fieldset></form></div>';
             $o.= '      </td><td>';
             $o.= '      <div class="singlebutton">';

admin/xmldb/actions/test/test.class.php

@@ -1014,6 +1014,20 @@ class test extends XMLDBAction {
 
         $this->output = $o;
 
+    /// Finally drop all the potentially existing test tables
+        $table = new XMLDBTable('testtable');
+        if (table_exists($table)) {
+            $status = drop_table($table, true, false);
+        }
+        $table = new XMLDBTable ('anothertest');
+        if (table_exists($table)) {
+            $status = drop_table($table, true, false);
+        }
+        $table = new XMLDBTable ('newnameforthetable');
+        if (table_exists($table)) {
+            $status = drop_table($table, true, false);
+        }
+
     /// Launch postaction if exists (leave this here!)
         if ($this->getPostAction() && $result) {
             return $this->launch($this->getPostAction());

admin/xmldb/actions/unload_xml_file/unload_xml_file.class.php

@@ -35,6 +35,7 @@ class unload_xml_file extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_field_xml/view_field_xml.class.php

@@ -35,6 +35,7 @@ class view_field_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_index_xml/view_index_xml.class.php

@@ -35,6 +35,7 @@ class view_index_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_key_xml/view_key_xml.class.php

@@ -35,6 +35,7 @@ class view_key_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_reserved_words/view_reserved_words.class.php

@@ -38,6 +38,7 @@ class view_reserved_words extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+    $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_statement_xml/view_statement_xml.class.php

@@ -35,6 +35,7 @@ class view_statement_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_structure_php/view_structure_php.class.php

@@ -36,6 +36,7 @@ class view_structure_php extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_structure_sql/view_structure_sql.class.php

@@ -36,6 +36,7 @@ class view_structure_sql extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_structure_xml/view_structure_xml.class.php

@@ -35,6 +35,7 @@ class view_structure_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_table_php/view_table_php.class.php

@@ -36,6 +36,7 @@ class view_table_php extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_table_sql/view_table_sql.class.php

@@ -36,6 +36,7 @@ class view_table_sql extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_table_xml/view_table_xml.class.php

@@ -35,6 +35,7 @@ class view_table_xml extends XMLDBAction {
         parent::init();
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

admin/xmldb/actions/view_xml/view_xml.class.php

@@ -38,6 +38,7 @@ class view_xml extends XMLDBAction {
         //$this->can_subaction = ACTION_HAVE_SUBACTIONS;
 
     /// Set own custom attributes
+        $this->sesskey_protected = false; // This action doesn't need sesskey protection
 
     /// Get needed strings
         $this->loadStrings(array(

auth/cas/CAS/client.php

@@ -1994,15 +1994,22 @@ class CASClient
 	    }
       }
 
-	  $final_uri .= strtok($_SERVER['REQUEST_URI'],"?");
-	  $cgi_params = '?'.strtok("?");
-	  // remove the ticket if present in the CGI parameters
-	  $cgi_params = preg_replace('/&ticket=[^&]*/','',$cgi_params);
-	  $cgi_params = preg_replace('/\?ticket=[^&;]*/','?',$cgi_params);
-	  $cgi_params = preg_replace('/\?%26/','?',$cgi_params);
-	  $cgi_params = preg_replace('/\?&/','?',$cgi_params);
-	  $cgi_params = preg_replace('/\?$/','',$cgi_params);
-	  $final_uri .= $cgi_params;
+      $baseurl = split("\?", $_SERVER['REQUEST_URI'], 2);
+      $final_uri .= $baseurl[0];
+      $query_string = '';
+      if ($_GET) {
+          $kv = array();
+          foreach ($_GET as $key => $value) {
+              if($key !== "ticket"){
+                  $kv[] = urlencode($key). "=" . urlencode($value);
+              }
+          }
+          $query_string = join("&", $kv);
+      }
+      if($query_string){
+          $final_uri .= "?" . $query_string;
+      }
+
 	  $this->setURL($final_uri);
     }
     phpCAS::traceEnd($this->_url);

auth/cas/CAS/readme_moodle.txt

@@ -0,0 +1,7 @@
+PHP CAS library import
+
+List of changes:
+1/ backported fix for: http://www.ja-sig.org/issues/browse/PHPCAS-52 (MDL-21802) 
+
+
+skodak

auth/cas/auth.php

@@ -58,8 +58,13 @@ class auth_plugin_cas extends auth_plugin_base {
      */
     function user_login ($username, $password) {
 		$this->connectCAS();
-		return phpCAS::isAuthenticated() && (phpCAS::getUser() == $username);
+		return phpCAS::isAuthenticated() && (trim(moodle_strtolower(phpCAS::getUser())) == $username);
     }
+
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/cas/config.html

@@ -602,7 +602,7 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
 
        $opt_deref[LDAP_DEREF_ALWAYS] = get_string('yes');
 
-       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, LDAP_DEREF_NEVER, '');
+       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, '');
 
        if (isset($err['opt_deref'])) formerr($err['opt_deref']);
 

auth/db/auth.php

@@ -564,6 +564,13 @@ class auth_plugin_db extends auth_plugin_base {
         }
     }
 
+    function prevent_local_passwords() {
+        if (!isset($this->config->passtype)) {
+            return false;
+        }
+        return ($this->config->passtype != 'internal');
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/email/auth.php

@@ -146,6 +146,10 @@ class auth_plugin_email extends auth_plugin_base {
         }
     }
 
+    function prevent_local_passwords() {
+        return false;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/fc/auth.php

@@ -144,6 +144,10 @@ class auth_plugin_fc extends auth_plugin_base {
         return false;
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/imap/auth.php

@@ -81,6 +81,10 @@ class auth_plugin_imap extends auth_plugin_base {
         return false;  // No match
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/ldap/auth.php

@@ -222,7 +222,7 @@ class auth_plugin_ldap extends auth_plugin_base {
             }
             $ldapval = NULL;
             foreach ($values as $value) {
-                if ($value == 'dn') {
+                if ((moodle_strtolower($value) == 'dn') || (moodle_strtolower($value) == 'distinguishedname')) {
                     $result[$key] = $user_dn;
                 }
                 if (!array_key_exists($value, $user_entry[0])) {
@@ -1803,6 +1803,10 @@ class auth_plugin_ldap extends auth_plugin_base {
         return ($fresult);
     }
 
+    function prevent_local_passwords() {
+        return !empty($this->config->preventpassindb);
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *
@@ -1844,6 +1848,9 @@ class auth_plugin_ldap extends auth_plugin_base {
      */
     function loginpage_hook() {
         global $CFG, $SESSION;
+
+        // HTTPS is potentially required
+        httpsrequired();
  
         if (($_SERVER['REQUEST_METHOD'] === 'GET'         // Only on initial GET of loginpage
                 || ($_SERVER['REQUEST_METHOD'] === 'POST'
@@ -2118,7 +2125,7 @@ class auth_plugin_ldap extends auth_plugin_base {
     }
 
     /**
-     * Quote control characters in texts used in ldap filters - see rfc2254.txt
+     * Quote control characters in texts used in ldap filters - see RFC 4515/2254
      *
      * @param string
      */
@@ -2130,14 +2137,23 @@ class auth_plugin_ldap extends auth_plugin_base {
     }
 
     /**
-     * Quote control characters in quoted "texts" used in ldap
+     * The order of the special characters in these arrays _IS IMPORTANT_.
+     * Make sure '\\5C' (and '\\') are the first elements of the arrays.
+     * Otherwise we'll double replace '\' with '\5C' which is Bad(tm)
+     */ 
+    var $LDAP_DN_QUOTED_SPECIAL_CHARS = array('\\5c','\\20','\\22','\\23','\\2b','\\2c','\\3b','\\3c','\\3d','\\3e','\\00');
+    var $LDAP_DN_SPECIAL_CHARS        = array('\\',  ' ',   '"',   '#',   '+',   ',',   ';',   '<',   '=',   '>',   "\0");
+
+    /**
+     * Quote control characters in distinguished names used in ldap - See RFC 4514/2253
      *
      * @param string
+     * @return string
      */
     function ldap_addslashes($text) {
-        $text = str_replace('\\', '\\\\', $text);
-        $text = str_replace(array('"',   "\0"),
-                            array('\\"', '\\00'), $text);
+        $text = str_replace ($this->LDAP_DN_SPECIAL_CHARS,
+                             $this->LDAP_DN_QUOTED_SPECIAL_CHARS,
+                             $text);
         return $text;
     }
 

auth/ldap/config.html

@@ -16,7 +16,7 @@
     if (!isset($config->opt_deref))
         { $config->opt_deref = LDAP_DEREF_NEVER; }
     if (!isset($config->preventpassindb))
-        { $config->preventpassindb = 0; }
+        { $config->preventpassindb = 1; }
     if (!isset($config->bind_dn))
         {$config->bind_dn = ''; }
     if (!isset($config->bind_pw))
@@ -92,7 +92,7 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
     <td align="right"><label for="menuversion"><?php print_string('auth_ldap_version_key','auth') ?></label></td>
     <td>
     <?php
-       $varsions = array();
+       $versions = array();
        $versions[2] = '2';
        $versions[3] = '3';
        choose_from_menu($versions, 'version', $config->version, '');
@@ -199,7 +199,7 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
        $opt_deref = array();
        $opt_deref[LDAP_DEREF_NEVER] = get_string('no');
        $opt_deref[LDAP_DEREF_ALWAYS] = get_string('yes');
-       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, LDAP_DEREF_NEVER, '');
+       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, '');
        if (isset($err['opt_deref'])) formerr($err['opt_deref']);
     ?>
     </td>

auth/manual/auth.php

@@ -62,6 +62,10 @@ class auth_plugin_manual extends auth_plugin_base {
         return update_internal_user_password($user, $newpassword);
     }
 
+    function prevent_local_passwords() {
+        return false;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/mnet/auth.php

@@ -230,6 +230,17 @@ class auth_plugin_mnet extends auth_plugin_base {
         return $url;
     }
 
+    /**
+     * after a successful login, land.php will call complete_user_login
+     * which will in turn regenerate the session id.
+     * this means that what is stored in mnet_session table needs updating.
+     *
+     */
+    function update_session_id() {
+        global $USER;
+        return set_field('mnet_session', 'session_id', session_id(), 'username', $USER->username, 'mnethostid', $USER->mnethostid, 'useragent', sha1($_SERVER['HTTP_USER_AGENT']));
+    }
+
     /**
      * This function confirms the remote (ID provider) host's mnet session
      * by communicating the token and UA over the XMLRPC transport layer, and
@@ -291,16 +302,16 @@ class auth_plugin_mnet extends auth_plugin_base {
         // TODO: refactor into a separate function
         if (empty($localuser) || ! $localuser->id) {
             if (empty($this->config->auto_add_remote_users)) {
-                print_error('nolocaluser', 'mnet');
+                print_error('nolocaluser2', 'mnet');
             }
             $remoteuser->mnethostid = $remotehost->id;
-            if (! insert_record('user', addslashes_recursive($remoteuser))) {
+            $remoteuser->firstaccess = time(); // First time user in this server, grab it here
+
+            if (!$remoteuser->id =  insert_record('user', addslashes_recursive($remoteuser))) {
                 print_error('databaseerror', 'mnet');
             }
             $firsttime = true;
-            if (! $localuser = get_record('user', 'username', addslashes($remoteuser->username), 'mnethostid', $remotehost->id)) {
-                print_error('nolocaluser', 'mnet');
-            }
+            $localuser = $remoteuser;
         }
 
         // check sso access control list for permission first
@@ -367,6 +378,9 @@ class auth_plugin_mnet extends auth_plugin_base {
         }
 
         $localuser->mnethostid = $remotepeer->id;
+        if (empty($localuser->firstaccess)) { // Now firstaccess, grab it here
+            $localuser->firstaccess = time();
+        }
 
         $bool = update_record('user', addslashes_recursive($localuser));
         if (!$bool) {
@@ -591,6 +605,10 @@ class auth_plugin_mnet extends auth_plugin_base {
         delete_records_select('mnet_enrol_assignments', $whereclause);
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *
@@ -950,7 +968,7 @@ class auth_plugin_mnet extends auth_plugin_base {
                 // There is no way to capture what the custom session handler
                 // is and then reset it on each pass - I checked that out
                 // already.
-                $sesscache = clone($_SESSION);
+                $sesscache = $_SESSION;
                 $sessidcache = session_id();
                 session_write_close();
                 unset($_SESSION);
@@ -970,7 +988,7 @@ class auth_plugin_mnet extends auth_plugin_base {
                 session_name('MoodleSession'.$CFG->sessioncookie);
                 session_id($sessidcache);
                 session_start();
-                $_SESSION = clone($sesscache);
+                $_SESSION = $sesscache;
                 session_write_close();
             }
         }
@@ -1140,7 +1158,7 @@ class auth_plugin_mnet extends auth_plugin_base {
 
             $uc = ini_get('session.use_cookies');
             ini_set('session.use_cookies', false);
-            $sesscache = clone($_SESSION);
+            $sesscache = $_SESSION;
             $sessidcache = session_id();
             session_write_close();
             unset($_SESSION);
@@ -1159,7 +1177,7 @@ class auth_plugin_mnet extends auth_plugin_base {
             session_name('MoodleSession'.$CFG->sessioncookie);
             session_id($sessidcache);
             session_start();
-            $_SESSION = clone($sesscache);
+            $_SESSION = $sesscache;
             session_write_close();
 
             $end = ob_end_clean();
@@ -1186,7 +1204,7 @@ class auth_plugin_mnet extends auth_plugin_base {
 
             $uc = ini_get('session.use_cookies');
             ini_set('session.use_cookies', false);
-            $sesscache = clone($_SESSION);
+            $sesscache = $_SESSION;
             $sessidcache = session_id();
             session_write_close();
             unset($_SESSION);
@@ -1205,7 +1223,7 @@ class auth_plugin_mnet extends auth_plugin_base {
             session_name('MoodleSession'.$CFG->sessioncookie);
             session_id($sessidcache);
             session_start();
-            $_SESSION = clone($sesscache);
+            $_SESSION = $sesscache;
             session_write_close();
 
             $end = ob_end_clean();
@@ -1228,7 +1246,7 @@ class auth_plugin_mnet extends auth_plugin_base {
 
             $uc = ini_get('session.use_cookies');
             ini_set('session.use_cookies', false);
-            $sesscache = clone($_SESSION);
+            $sesscache = $_SESSION;
             $sessidcache = session_id();
             session_write_close();
             unset($_SESSION);
@@ -1247,7 +1265,7 @@ class auth_plugin_mnet extends auth_plugin_base {
             session_name('MoodleSession'.$CFG->sessioncookie);
             session_id($sessidcache);
             session_start();
-            $_SESSION = clone($sesscache);
+            $_SESSION = $sesscache;
 
             $end = ob_end_clean();
             return true;

auth/mnet/land.php

@@ -34,6 +34,7 @@ $localuser = $mnetauth->confirm_mnet_session($token, $remotewwwroot);
 // log in
 $USER = get_complete_user_data('id', $localuser->id, $localuser->mnethostid);
 complete_user_login($USER);
+$mnetauth->update_session_id();
 
 if (!empty($localuser->mnet_foreign_host_array)) {
     $USER->mnet_foreign_host_array = $localuser->mnet_foreign_host_array;

auth/nntp/auth.php

@@ -64,6 +64,10 @@ class auth_plugin_nntp extends auth_plugin_base {
         return false;
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/nologin/auth.php

@@ -46,6 +46,11 @@ class auth_plugin_nologin extends auth_plugin_base {
         return false;
     }
 
+    function prevent_local_passwords() {
+        // just in case, we do not want to loose the passwords
+        return false;
+    }
+
     /**
      * No external data sync.
      *

auth/none/auth.php

@@ -62,6 +62,10 @@ class auth_plugin_none extends auth_plugin_base {
         return update_internal_user_password($user, $newpassword);
     }
 
+    function prevent_local_passwords() {
+        return false;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/pam/auth.php

@@ -77,6 +77,10 @@ class auth_plugin_pam extends auth_plugin_base {
         }
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/pop3/auth.php

@@ -81,6 +81,10 @@ class auth_plugin_pop3 extends auth_plugin_base {
         return false;  // No matches found
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/radius/auth.php

@@ -126,6 +126,10 @@ class auth_plugin_radius extends auth_plugin_base {
         $rauth->close();
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/shibboleth/README.txt

@@ -25,6 +25,9 @@ Changes:
             language files.
 - 3.  2009: Added various improvements and bug fixes reported by Ina Müller from
             university Tuebingen and Peter Ellis of University of Washington
+- 4.  2009: Added another requirement for logout regarding the call back script
+- 6.  2009: Changed handler URL when integrated Discovery Service is used
+- 10. 2009: Fixed HTML entity preservation in Shibboleth settings
 
 Moodle Configuration with Dual login
 -------------------------------------------------------------------------------
@@ -33,11 +36,11 @@ Moodle Configuration with Dual login
    For Apache you have to define a rule like the following in the Apache config:
 
 --
-<Location ~  "/auth/shibboleth/index.php">
+<Directory  /path/to/moodle/auth/shibboleth/index.php>
         AuthType shibboleth
         ShibRequireSession On
         require valid-user
-</Location>
+</Directory>
 --
 
    To restrict access to Moodle, replace the access rule 'require valid-user'
@@ -106,6 +109,14 @@ Moodle Configuration with Dual login
                     in step 1 only the index.php script in 
                     moodle/auth/shibboleth/ is protected but *not* the other 
                     scripts and especially not the login.php script.
+    
+    If you were using the integrated WAYF alread with Shibboleth 1.3, it could
+    be that the integrated WAYF is not working anymore after you updated Moodle.
+    The reason is that the implicitly set default SessionInitiator changed in
+    Moodle as well as in Shibboleth. For Shibboleth 1.3 one therefore has to
+    add /Shibboleth.sso as third parameter whereas this is /Shibboleth.sso/DS
+    for Shibboleth 2.x.
+
 
 5.  Save the changes for the 'Shibboleth settings'.
 
@@ -257,7 +268,6 @@ recommended to use the following approach when upgrading the Service Provider:
 
 How to add logout support
 --------------------------------------------------------------------------------
-
 In order make Moodle support Shibboleth logout, one has to make the Shibboleth 
 Service Provider (SP) aware of the Moodle logout capability. Only then the SP 
 can trigger Moodle's front or back channel logout handler.
@@ -270,15 +280,6 @@ just before the <MetadataProvider> element.
 <Notify 
 	Channel="back"
 	Location="https://#YOUR_MOODLE_HOSTNAME#/moodle/auth/shibboleth/logout.php" />
-
-<!-- 
-If possible, you should use only the back channel logout once it is working.
--->
-<!--
-<Notify 
-	Channel="front"
-	Location="https://#YOUR_MOODLE_HOSTNAME#/moodle/auth/shibboleth/logout.php" />
--->
 --
 
 Then restart the Shibboleth daemon and check the log file for errors. If there 
@@ -293,15 +294,35 @@ Requirements:
 - PHP needs the Soap Extension, which maybe must installed manually:
   More information is available here http://ch.php.net/soap
 - Logout only works with Shibboleth Service Provider 2.1 or higher
+- /moodle/auth/shibboleth/logout.php *must not* be protected by Shibboleth!
+  In case all of Moodle is protected with Shibboleth, you have to add something
+  like this to your Apache configuration after all the other require rules
+
+--
+<Directory /path/to/moodle/auth/shibboleth/logout.php>
+	AuthType shibboleth
+	ShibRequireSession Off
+	require shibboleth
+</Directory>
+--
+  When using IIS, the same can be achieved by something like:
+--
+<Path name="auth/shibboleth/logout.php" requireSession="false" >
+--
+  in the shibboleth2.xml RequestMap.
+
 
 Limitations:
 Single Logout is only supported when SAML2 is used at the SP and the IdP.
-As of December 2008, the Shibboleth Identity Provider 2.1.1 does not yet support
-Single Logout (SLO). Therefore, the single logout feature cannot be used yet. 
+As of October 2009, the Shibboleth Identity Provider 2.1.4 does not yet support
+Single Logout (SLO). Therefore, the single logout feature cannot be used yet
+in a Shibboleth only setup but there may be other SAML2 products that could
+be used as Identity Provider, e.g. SimpleSAML PHP.
 One of the reasons why SLO isn't supported yet is because there aren't many 
 applications yet that were adapted to support front and back channel 
 logout. Hopefully, the Moodle logout helps to motivate the developers to 
-implement SLO :)
+implement SLO. On the other hand, the easiest and safest way to log out
+still is to tell users to quit their web browsers :)
 
 Also see https://spaces.internet2.edu/display/SHIB2/SLOIssues and 
 https://spaces.internet2.edu/display/SHIB2/NativeSPLogoutInitiator for some 

auth/shibboleth/auth.php

@@ -152,6 +152,10 @@ class auth_plugin_shibboleth extends auth_plugin_base {
         return $moodleattributes;
     }
 
+    function prevent_local_passwords() {
+        return true;
+    }
+
     /**
      * Returns true if this authentication plugin is 'internal'.
      *

auth/shibboleth/config.html

@@ -66,7 +66,7 @@
 https://another.idp-id.com/shibboleth, Other Example Organization, /Shibboleth.sso/DS/SWITCHaai
 urn:mace:organization2:providerID, Example Organization 2, /Shibboleth.sso/WAYF/SWITCHaai';
         } else {
-            echo $config->organization_selection;
+            echo htmlentities($config->organization_selection);
         }
         ?>
 </textarea>
@@ -110,7 +110,7 @@ urn:mace:organization2:providerID, Example Organization 2, /Shibboleth.sso/WAYF/
     <td>
         <input name="login_name" type="text" size="30" value="<?php 
         if ( isset($config->login_name) and !empty($config->login_name)){
-            echo $config->login_name;
+            echo htmlentities($config->login_name);
         } else {
             echo 'Shibboleth Login';
         }

auth/shibboleth/index.php

@@ -14,6 +14,7 @@
         }
 
         redirect($urltogo);
+        
     }
 
     $pluginconfig   = get_config('auth/shibboleth');

auth/shibboleth/login.php

@@ -56,13 +56,20 @@ httpsrequired();
         $selectedIdP = $_POST['idp'];
         set_saml_cookie($selectedIdP);
         
-        // Redirect to SessionInitiator with providerId as argument
+        // Redirect to SessionInitiator with entityID as argument
         if (isset($IdPs[$selectedIdP][1]) && !empty($IdPs[$selectedIdP][1])){
-            header('Location: '.$IdPs[$selectedIdP][1].'?providerId='. urlencode($selectedIdP) .'&target='. urlencode($CFG->wwwroot.'/auth/shibboleth/index.php'));
+            // For Shibbolet 1.x Service Providers
+	    header('Location: '.$IdPs[$selectedIdP][1].'?providerId='. urlencode($selectedIdP) .'&target='. urlencode($CFG->wwwroot.'/auth/shibboleth/index.php'));
+
+	    // For Shibbolet 2.x Service Providers
+	    // header('Location: '.$IdPs[$selectedIdP][1].'?entityID='. urlencode($selectedIdP) .'&target='. urlencode($CFG->wwwroot.'/auth/shibboleth/index.php'));
+
         } else {
-            // TODO: This has to be changed to /Shibboleth.sso/DS?entityId= for 
-            // Shibbolet 2.x sometime...
+            // For Shibbolet 1.x Service Providers
             header('Location: /Shibboleth.sso?providerId='. urlencode($selectedIdP) .'&target='. urlencode($CFG->wwwroot.'/auth/shibboleth/index.php'));
+
+            // For Shibboleth 2.x Service Providers
+            // header('Location: /Shibboleth.sso/DS?entityID='. urlencode($selectedIdP) .'&target='. urlencode($CFG->wwwroot.'/auth/shibboleth/index.php'));
         }
     } elseif (isset($_POST['idp']) && !isset($IdPs[$_POST['idp']]))  {
         $errormsg = get_string('auth_shibboleth_errormsg', 'auth');

backup/backup.php

@@ -123,7 +123,7 @@
     raise_memory_limit("192M");
 
     //Call the form, depending the step we are
-    if (!$launch) {
+    if (!$launch or !data_submitted() or !confirm_sesskey()) {
         // if we're at the start, clear the cache of prefs
         if (isset($SESSION->backupprefs[$course->id])) {
             unset($SESSION->backupprefs[$course->id]);

backup/backup_check.html

@@ -4,6 +4,9 @@
     //Check login
     require_login();
 
+    // Init backupuserinfo
+    $backupuserinfo = false;
+
     if (!empty($course->id)) {
         if (!has_capability('moodle/site:backup', get_context_instance(CONTEXT_COURSE, $course->id))) {
             if (empty($to)) {
@@ -14,10 +17,12 @@
                 }
             }
         }
+        $backupuserinfo = has_capability('moodle/backup:userinfo', get_context_instance(CONTEXT_COURSE, $course->id));
     } else {
         if (!has_capability('moodle/site:backup', get_context_instance(CONTEXT_SYSTEM))) {
             error("You need to be an admin user to use this page.", "$CFG->wwwroot/login/index.php");
         }
+        $backupuserinfo = has_capability('moodle/backup:userinfo', get_context_instance(CONTEXT_SYSTEM));
     }
 
 
@@ -45,6 +50,7 @@
 <form id="form" method="post" action="backup.php">
 <table cellpadding="5" style="text-align:center;margin-left:auto;margin-right:auto">
 <?php
+    echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
 
     if (empty($to)) {
         //Now print the Backup Name tr
@@ -65,6 +71,16 @@
 
     }
 
+    // Re-enforce 'moodle/site:backup' at system context to be able to backup all users
+    if ($backupprefs->backup_users == 0 and !has_capability('moodle/site:backup', get_context_instance(CONTEXT_SYSTEM))) {
+        $backupprefs->backup_users = 1; // users => course
+    }
+
+    // Re-enforce moodle/backup:userinfo capability
+    if (!$backupuserinfo) {
+        $backupprefs->backup_users = 2; // users => none
+    }
+
     //Here we check if backup_users = None. Then, we switch off every module
     //user info, user_files, logs and exercises, workshop and messages & blogs backups. A Warning is showed to
     //inform the user.
@@ -117,7 +133,12 @@
         $backupprefs->backup_blogs = 0;
         $backupprefs->backuproleassignments = array();
 
-        print_simple_box("<font color=\"red\">".get_string("backupnoneusersinfo")."</font>","center", "70%", '', "20", "noticebox");
+        if ($backupuserinfo) { // Based on perms, decide the msg to show
+            $nousersmsgtoshow = 'backupnoneusersinfo';
+        } else {
+            $nousersmsgtoshow = 'backupmissinguserinfoperms';
+        }
+        print_simple_box("<font color=\"red\">".get_string($nousersmsgtoshow)."</font>","center", "70%", '', "20", "noticebox");
         echo "<hr />";
     }
 

backup/backup_form.html

@@ -4,6 +4,9 @@
     //Check login
     require_login();
 
+    //Init backupuserinfo
+    $backupuserinfo = false;
+
     if (!empty($course->id)) {
         if (!has_capability('moodle/site:backup', get_context_instance(CONTEXT_COURSE, $course->id))) {
             if (empty($to)) {
@@ -14,10 +17,12 @@
                 }
             }
         }
+        $backupuserinfo = has_capability('moodle/backup:userinfo', get_context_instance(CONTEXT_COURSE, $course->id));
     } else {
         if (!has_capability('moodle/site:backup', get_context_instance(CONTEXT_SYSTEM))) {
             error("You need to be an admin user to use this page.", "$CFG->wwwroot/login/index.php");
         }
+        $backupuserinfo = has_capability('moodle/backup:userinfo', get_context_instance(CONTEXT_SYSTEM));
     }
 
     //Check site
@@ -118,6 +123,8 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
 <form id="form1" method="post" action="backup.php">
 <table cellpadding="5" style="margin-left:auto;margin-right:auto;">
 <?php
+    echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
+
 /// Acummulator for hidden options and proper XHTML output
     $hidden_options = '';
     //Now, check modules and info and show posibilities
@@ -130,12 +137,16 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_', true);\">". get_string("all")."</a>/";
         echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_', false);\">".  get_string("none")."</a>";
         echo "</td>";
-        echo "<td align=\"right\">";
-        echo '<b>&nbsp;</b>';
-        echo "</td><td>";
-        echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_user_info_', true);\">". get_string("all")."</a>/";
-        echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_user_info_', false);\">". get_string("none")."</a>";
-        echo "</td>";
+        if (empty($to) and $backupuserinfo) {
+            echo "<td align=\"right\">";
+            echo '<b>&nbsp;</b>';
+            echo "</td><td>";
+            echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_user_info_', true);\">". get_string("all")."</a>/";
+            echo "<a href=\"javascript:void(0);\" onclick=\"selectItemInCheckboxByName('form1', 'backup_user_info_', false);\">". get_string("none")."</a>";
+            echo "</td>";
+        } else {
+            echo "<td colspan=\"2\">&nbsp;</td>";
+        }
         echo "</tr>";
         echo "<tr><td colspan=\"4\"><hr /></td></tr>";
         $currentrow = 0;
@@ -159,7 +170,7 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
                 echo "</td><td align=\"right\">&nbsp;";
                 echo "</td><td>";
                 $var = "backup_user_info_".$modname;
-                if (empty($to)) {
+                if (empty($to) and $backupuserinfo) {
                     $backup_user_options[0] = get_string("withoutuserdata");
                     $backup_user_options[1] = get_string("withuserdata");
                     //choose_from_menu($backup_user_options, $var, $$var, "");
@@ -179,7 +190,7 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
                     echo '</td><td align="right">&nbsp;';
                     $var = 'backup_user_info_'.$modname.'_instance_'.$instance->id;
                     $$var = optional_param($var,1);
-                    if (empty($to)) {
+                    if (empty($to) and $backupuserinfo) {
                         print_checkbox($var,$$var,$$var,get_string('userdata'),'','this.form.elements[\'backup_user_info_'.$modname.'\'].checked=1;');
                     } else {
                         echo '<input type="hidden" name="'.$var.'" value="0" />';
@@ -207,23 +218,25 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
             $hidden_options .= '<input type="hidden" name="backup_metacourse" value="0" />';
         }
 
-        if (empty($to)) {
+        if (empty($to) and $backupuserinfo) {
             //Now print the Users tr
             echo "<tr>";
             echo "<td align=\"right\" colspan=\"2\"><b>";
             echo '<label for="menubackup_users">'.get_string ("users").'</label>';
             echo "</b></td><td colspan=\"2\">";
-            $user_options[0] = get_string("all");
+            if (has_capability('moodle/site:backup', get_context_instance(CONTEXT_SYSTEM))) {
+                $user_options[0] = get_string("all");
+            }
             $user_options[1] = get_string("course");
             $user_options[2] = get_string("none");
             choose_from_menu($user_options, "backup_users", $backup_users, "");
             echo "</td></tr>";
         }
         else {
-            $hidden_options .= '<input type="hidden" name="backup_users" value="0" />';
+            $hidden_options .= '<input type="hidden" name="backup_users" value="2" />';
         }
 
-        if (empty($to)) {
+        if (empty($to) and $backupuserinfo) {
             //Now print the Logs tr
             echo "<tr>";
             echo "<td align=\"right\" colspan=\"2\"><b>";
@@ -238,7 +251,7 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
             $hidden_options .= '<input type="hidden" name="backup_logs" value="0" />';
         }
 
-        if (empty($to)) {
+        if (empty($to) and $backupuserinfo) {
             //Now print the User Files tr
             echo "<tr>";
             echo "<td align=\"right\" colspan=\"2\"><b>";
@@ -278,7 +291,7 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
         }
 
         // do you want grade histories to be backed up?
-        if (empty($CFG->disablegradehistory)) {
+        if (empty($to) and $backupuserinfo and empty($CFG->disablegradehistory)) {
             echo "<tr>";
             echo "<td align=\"right\" colspan=\"2\"><b>";
             echo '<label for="menubackup_gradebook_history">'.get_string ('gradebookhistories', 'grades').'</label>';
@@ -291,7 +304,7 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
             $hidden_options .= '<input type="hidden" name="backup_gradebook_history" value="0" />';
         }
 
-        if (empty($to) && $course->id == SITEID) {
+        if (empty($to) and $backupuserinfo and $course->id == SITEID) {
             //If we are in a SITEID backup print the Messages tr
             echo "<tr>";
             echo "<td align=\"right\" colspan=\"2\"><b>";
@@ -306,7 +319,7 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
             $hidden_options .= '<input type="hidden" name="backup_messages" value="0" />';
         }
 
-        if (empty($to) && $course->id == SITEID && !empty($CFG->bloglevel)) {
+        if (empty($to) and $backupuserinfo and $course->id == SITEID and !empty($CFG->bloglevel)) {
             //If we are in a SITEID backup and blogs are enabled print the Blogs tr
             echo "<tr>";
             echo "<td align=\"right\" colspan=\"2\"><b>";
@@ -323,7 +336,7 @@ function selectItemInCheckboxByName(formId, checkName, checked ) {
     }
 
     //Now print a place to select which role assignments to back up.
-    if (empty($to)) {
+    if (empty($to) and $backupuserinfo) {
         //Line
         echo "<tr><td colspan=\"4\"><hr /></td></tr>\n";
 

backup/backuplib.php

@@ -85,7 +85,6 @@
 
     //Returns every needed user (participant) in a course
     //It uses the xxxx_get_participants() function
-    //plus users needed to backup scales.
     //Also it search for users having messages and
     //users having blogs
     //WARNING: It returns only NEEDED users, not every
@@ -124,21 +123,6 @@
             }
         }
 
-        //Now, add scale users (from site and course scales)
-        //Get users
-        $scaleusers = get_records_sql("SELECT DISTINCT userid,userid
-                                       FROM {$CFG->prefix}scale
-                                       WHERE courseid = '0' or courseid = '$courseid'");
-        //Add scale users to results
-        if ($scaleusers) {
-            foreach ($scaleusers as $scaleuser) {
-                //If userid != 0
-                if ($scaleuser->userid != 0) {
-                    $result[$scaleuser->userid]->id = $scaleuser->userid;
-                }
-            }
-        }
-
         //Now, add message users if necessary
         if ($includemessages) {
             include_once("$CFG->dirroot/message/lib.php");
@@ -184,7 +168,7 @@
         // get all users with moodle/course:view capability, this will include people
         // assigned at cat level, or site level
         // but it should be ok if they have no direct assignment at course, mod, block level
-        return get_users_by_capability(get_context_instance(CONTEXT_COURSE, $courseid), 'moodle/course:view');
+        return get_users_by_capability(get_context_instance(CONTEXT_COURSE, $courseid), 'moodle/course:view', '', '', '', '', '', '', false);
     }
 
     //Returns all users ids (every record in users table)
@@ -1303,7 +1287,11 @@
                 fwrite ($bf,full_tag("POLICYAGREED",4,false,$user->policyagreed));
                 fwrite ($bf,full_tag("DELETED",4,false,$user->deleted));
                 fwrite ($bf,full_tag("USERNAME",4,false,$user->username));
-                fwrite ($bf,full_tag("PASSWORD",4,false,$user->password));
+                // Prevent user passwords in backup files unless
+                // $CFG->includeuserpasswordsinbackup is defined. MDL-20838
+                if (!empty($CFG->includeuserpasswordsinbackup)) {
+                    fwrite ($bf,full_tag("PASSWORD",4,false,$user->password));
+                }
                 fwrite ($bf,full_tag("IDNUMBER",4,false,$user->idnumber));
                 fwrite ($bf,full_tag("FIRSTNAME",4,false,$user->firstname));
                 fwrite ($bf,full_tag("LASTNAME",4,false,$user->lastname));
@@ -1329,7 +1317,6 @@
                 fwrite ($bf,full_tag("LASTLOGIN",4,false,$user->lastlogin));
                 fwrite ($bf,full_tag("CURRENTLOGIN",4,false,$user->currentlogin));
                 fwrite ($bf,full_tag("LASTIP",4,false,$user->lastip));
-                fwrite ($bf,full_tag("SECRET",4,false,$user->secret));
                 fwrite ($bf,full_tag("PICTURE",4,false,$user->picture));
                 fwrite ($bf,full_tag("URL",4,false,$user->url));
                 fwrite ($bf,full_tag("DESCRIPTION",4,false,$user->description));
@@ -2354,7 +2341,7 @@
         // This way, backup contents will be neutral and independent of slasharguments configuration. MDL-18799
         // Based in $unicoderegexp, decide the regular expression to use
         if ($unicoderegexp) { //We can use unicode modifiers
-            $search = '/(\$@FILEPHP@\$)((?:(?:\/|%2f|%2F))(?:(?:\([-;:@#&=\pL0-9\$~_.+!*\',]*?\))|[-;:@#&=\pL0-9\$~_.+!*\',]|%[a-fA-F0-9]{2}|\/)*)?(\?(?:(?:(?:\([-;:@#&=\pL0-9\$~_.+!*\',]*?\))|[-;:@#&=?\pL0-9\$~_.+!*\',]|%[a-fA-F0-9]{2}|\/)*))?(?<![,.;])/';
+            $search = '/(\$@FILEPHP@\$)((?:(?:\/|%2f|%2F))(?:(?:\([-;:@#&=\pL0-9\$~_.+!*\',]*?\))|[-;:@#&=\pL0-9\$~_.+!*\',]|%[a-fA-F0-9]{2}|\/)*)?(\?(?:(?:(?:\([-;:@#&=\pL0-9\$~_.+!*\',]*?\))|[-;:@#&=?\pL0-9\$~_.+!*\',]|%[a-fA-F0-9]{2}|\/)*))?(?<![,.;])/u';
         } else { //We cannot ue unicode modifiers
             $search = '/(\$@FILEPHP@\$)((?:(?:\/|%2f|%2F))(?:(?:\([-;:@#&=a-zA-Z0-9\$~_.+!*\',]*?\))|[-;:@#&=a-zA-Z0-9\$~_.+!*\',]|%[a-fA-F0-9]{2}|\/)*)?(\?(?:(?:(?:\([-;:@#&=a-zA-Z0-9\$~_.+!*\',]*?\))|[-;:@#&=?a-zA-Z0-9\$~_.+!*\',]|%[a-fA-F0-9]{2}|\/)*))?(?<![,.;])/';
         }

backup/bb/bb5.5_to_moodle.xsl

@@ -427,7 +427,7 @@
     </SUMMARY>
     <ALLTEXT></ALLTEXT>
     <POPUP></POPUP>
-    <OPTIONS>frame</OPTIONS>
+    <OPTIONS></OPTIONS>
     <TIMEMODIFIED>1094240775</TIMEMODIFIED>
   </MOD>
 </xsl:template>
@@ -512,7 +512,7 @@
       <xsl:value-of select="DESCRIPTION/TEXT"/>
     </ALLTEXT>
     <POPUP></POPUP>
-    <OPTIONS>frame</OPTIONS>
+    <OPTIONS></OPTIONS>
     <TIMEMODIFIED>1094240775</TIMEMODIFIED>
   </MOD>
 </xsl:template>