Moodle 1.9.11 release

This fixes problems for sites that use loginhtts where the redirection after login did not work for pages that require https such as the forgotten passowrds page.

.gitignore

@@ -0,0 +1,27 @@
+# This file specifies intentionally untracked files that all Moodle git
+# repositories should ignore. It is recommended not to modify this file in your
+# local clone. Instead, use .git/info/exclude and add new records there as
+# needed.
+#
+# Example: if you deploy a contributed plugin mod/foobar into your site, put
+# the following line into .git/info/exclude file in your Moodle clone:
+# /mod/foobar/
+#
+# See gitignore(5) man page for more details
+#
+/config.php
+/lib/editor/tinymce/extra/tools/temp/
+*~
+*.swp
+/tags
+/TAGS
+/cscope.*
+/.patches/
+/.idea/
+/nbproject/
+CVS
+.DS_Store
+/.settings/
+/.project
+/.buildpath
+/.cache

admin/cron.php

@@ -223,6 +223,9 @@
     grade_cron();
     mtrace('done.');
 
+    mtrace('Starting processing the event queue...');
+    events_cron();
+    mtrace('done.');
 
 /// Run all core cron jobs, but not every time since they aren't too important.
 /// These don't have a timer to reduce load, so we'll use a random number 

admin/environment.xml

@@ -185,6 +185,8 @@
           <ON_CHECK message="ctyperecommended" />
         </FEEDBACK>
       </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
     </PHP_EXTENSIONS>
     <CUSTOM_CHECKS>
       <CUSTOM_CHECK file="question/upgrade.php" function="question_check_no_rqp_questions" level="optional">
@@ -282,6 +284,24 @@
           <ON_CHECK message="simplexmlrequired" />
         </FEEDBACK>
       </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="intlrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
     </PHP_EXTENSIONS>
     <PHP_SETTINGS>
       <PHP_SETTING name="memory_limit" value="40M" level="required">
@@ -301,6 +321,11 @@
       </PHP_SETTING>
     </PHP_SETTINGS>
     <CUSTOM_CHECKS>
+      <CUSTOM_CHECK file="lib/customcheckslib.php" function="php_check_php533" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="php533warning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
     </CUSTOM_CHECKS>
   </MOODLE>
 </COMPATIBILITY_MATRIX>

admin/lang.php

@@ -1013,6 +1013,10 @@ function lang_fix_value_before_save($value='') {
     if (ini_get_bool('magic_quotes_sybase')) {          // Unescape escaped sybase quotes
         $value = str_replace("''", "'", $value);
     }
+    // escape all embedded variables
+    $value = str_replace('$', '\$', $value);            // Add slashes for $
+    // unescape placeholders: only $a and $a->something are allowed. All other $variables are left escaped
+    $value = preg_replace('/\\\\\$a($|[^_a-zA-Z0-9\-]|\->[a-zA-Z0-9_]+)/', '$a\\1', $value);
     $value = str_replace("'", "\\'", $value);           // Add slashes for '
     $value = str_replace('"', "\\\"", $value);          // Add slashes for "
     $value = str_replace("%","%%",$value);              // Escape % characters

admin/langimport.php

@@ -248,7 +248,7 @@
         if ($parent == 'en_utf8') {
             continue;
         }
-        if (strpos($parent, '[[') !== false) {
+        if (empty($parent) || strpos($parent, '[[') !== false) {
             continue; // no parent
         }
         if (!isset($installedlangs[$parent])) {

admin/mnet/access_control.php

@@ -178,7 +178,7 @@ if (!$acl) {
         }
         $deletecolumn = "<a href=\"?id={$aclrecord->id}&amp;action=delete&amp;sesskey={$USER->sesskey}\">"
                 . get_string('delete') . "</a>";
-        $table->data[] = array ($aclrecord->username, $aclrecord->mnet_host_id, $accesscolumn, $deletecolumn);
+        $table->data[] = array (s($aclrecord->username), $aclrecord->mnet_host_id, $accesscolumn, $deletecolumn);
     }
 }
 

admin/mnet/adminlib.php

@@ -64,7 +64,7 @@ function mnet_get_functions($type, $parentname) {
         foreach($rpcrecords as $rpc) {
             if (!array_key_exists($rpc->function_name, $methodServiceArray)) {
                 $rpc->enabled = 0;
-                update_record('mnet_rpc', $rpc);
+                update_record('mnet_rpc', addslashes_recursive($rpc));
             }
         }
     }
@@ -85,7 +85,7 @@ function mnet_get_functions($type, $parentname) {
             } else {
                 array_unshift($profile, $details['returns']);
             }
-            $dataobject->profile       = serialize($profile);
+            $dataobject->profile       = addslashes(serialize($profile));
             $dataobject->help          = addslashes($details['description']);
         } else {
             $dataobject->profile       = serialize(array(array('type' => 'void', 'description' => 'No return value')));

admin/mnet/enr_course_enrol.php

@@ -130,7 +130,7 @@
                 a.courseid
             FROM
                 {$CFG->prefix}user u
-            LEFT JOIN
+            JOIN
                 {$CFG->prefix}mnet_enrol_assignments a
             ON
                 a.userid = u.id AND a.courseid={$courseid}

admin/mnet/mnet_review.html

@@ -1,23 +1,9 @@
 <?php
-$logurl = $CFG->wwwroot.
-          '/course/report/log/index.php?chooselog=1&amp;showusers=1&amp;showcourses=1&amp;host_course='.$mnet_peer->id.
-          '%2F1&amp;user='.'0'.
-          '&amp;date=0'.
-          '&amp;modid=&amp;modaction=0&amp;logformat=showashtml';
 
 admin_externalpage_print_header();
 
-if (isset($mnet_peer->id) && $mnet_peer->id > 0) {
-    $tabs[] = new tabobject('mnetdetails', 'peers.php?step=update&amp;hostid='.$mnet_peer->id, $strmnetedithost, $strmnetedithost, false);
-    $tabs[] = new tabobject('mnetservices', 'mnet_services.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetservices, $strmnetservices, false);
-    $tabs[] = new tabobject('mnetthemes', 'mnet_themes.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetthemes, $strmnetthemes, false);
-    if ($mnet_peer->application->name == 'moodle') {
-        $tabs[] = new tabobject('mnetlog', $logurl, $strmnetlog, $strmnetlog, false);
-    }
-} else {
-    $tabs[] = new tabobject('mnetdetails', '#', $strmnetedithost, $strmnetedithost, false);
-}
-print_tabs(array($tabs), 'mnetdetails');
+$currenttab = 'mnetdetails';
+require_once($CFG->dirroot .'/admin/mnet/tabs.php');
 
 print_simple_box_start("center", "");
 ?>

admin/mnet/mnet_review_allhosts.html

@@ -1,10 +1,8 @@
 <?php
 admin_externalpage_print_header();
 
-$tabs[] = new tabobject('mnetdetails', 'peers.php?step=update&amp;hostid='.$mnet_peer->id, $strmnetedithost, $strmnetedithost, false);
-$tabs[] = new tabobject('mnetservices', 'mnet_services.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetservices, $strmnetservices, false);
-$tabs[] = new tabobject('mnetthemes', 'mnet_themes.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetthemes, $strmnetthemes, false);
-print_tabs(array($tabs), 'mnetdetails');
+$currenttab = 'mnetdetails';
+require_once($CFG->dirroot .'/admin/mnet/tabs.php');
 
 print_simple_box_start("center", "");
 ?>

admin/mnet/mnet_services.html

@@ -1,19 +1,9 @@
 <?php
 admin_externalpage_print_header();
 
-$logurl = $CFG->wwwroot.
-          '/course/report/log/index.php?chooselog=1&amp;showusers=1&amp;showcourses=1&amp;host_course='.$mnet_peer->id.
-          '%2F1&amp;user='.'0'.
-          '&amp;date=0'.
-          '&amp;modid=&amp;modaction=0&amp;logformat=showashtml';
+$currenttab = 'mnetservices';
+require_once($CFG->dirroot .'/admin/mnet/tabs.php');
 
-$tabs[] = new tabobject('mnetdetails', 'peers.php?step=update&amp;hostid='.$mnet_peer->id, $strmnetedithost, $strmnetedithost, false);
-$tabs[] = new tabobject('mnetservices', 'mnet_services.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetservices, $strmnetservices, false);
-$tabs[] = new tabobject('mnetthemes', 'mnet_themes.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetthemes, $strmnetthemes, false);
-if ($mnet_peer->id != $CFG->mnet_all_hosts_id && $mnet_peer->application->name == 'moodle') {
-    $tabs[] = new tabobject('mnetlog', $logurl, $strmnetlog, $strmnetlog, false);
-}
-print_tabs(array($tabs), 'mnetservices');
 print_simple_box_start("center", "");
 
 ?>
@@ -27,11 +17,12 @@ print_simple_box_start("center", "");
 <?php 
     foreach($myservices as $name => $versions) {
     $version = current($versions);
+    $langmodule = ($version['parent_type'] == 'mod' ? '' : ($version['parent_type'] . '_')) . $version['parent'];
 ?>
 <tr>
     <td align="left" valign="top" colspan="2">
-    <h3><?php echo get_string($name.'_name', $version['parent_type'].'_'.$version['parent'] , $mnet_peer->name); ?></h3>
-    <?php echo get_string($name.'_description', $version['parent_type'].'_'.$version['parent'], $mnet_peer->name); ?>
+    <h3><?php echo get_string($name.'_name', $langmodule , $mnet_peer->name); ?></h3>
+    <?php echo get_string($name.'_description', $langmodule, $mnet_peer->name); ?>
 <?php
         $breakstring = '';
         foreach($versions as $version){

admin/mnet/mnet_services.php

@@ -24,6 +24,10 @@
     // force   Go ahead with something we've been warned is strange
     $step   = optional_param('step', NULL, PARAM_ALPHA);
     $hostid = optional_param('hostid', NULL, PARAM_INT);
+    $publishes  = optional_param('publish', null, PARAM_BOOL); // optional_param cleans arrays too
+    $subscribes = optional_param('subscribe', null, PARAM_BOOL); // optional_param cleans arrays too
+    $exists     = optional_param('exists', null, PARAM_BOOL); // optional_param cleans arrays too
+
     $nocertstring = '';
     $nocertmatch  = '';
     $badcert = '';
@@ -43,21 +47,21 @@
     if (($form = data_submitted()) && confirm_sesskey()) {
         $mnet_peer->set_id($hostid);
         $treevals = array();
-        foreach($_POST['exists'] as $key => $value) {
-            $host2service   = get_record('mnet_host2service', 'hostid', $_POST['hostid'], 'serviceid', $key);
-            $publish        = (isset($_POST['publish'][$key]) && $_POST['publish'][$key] == 'on')? 1 : 0;
-            $subscribe      = (isset($_POST['subscribe'][$key]) && $_POST['subscribe'][$key] == 'on')? 1 : 0;
+        foreach($exists as $key => $value) {
+            $host2service   = get_record('mnet_host2service', 'hostid', $hostid, 'serviceid', $key);
+            $publish        = array_key_exists($key, $publishes) ? $publishes[$key] : 0;
+            $subscribe      = array_key_exists($key, $subscribes) ? $subscribes[$key] : 0;
 
             if ($publish != 1 && $subscribe != 1) {
                 if (false == $host2service) {
                     // We don't have or need a record - do nothing!
                 } else {
                     // We don't need the record - delete it
-                    delete_records('mnet_host2service', 'hostid', $_POST['hostid'], 'serviceid', $key);
+                    delete_records('mnet_host2service', 'hostid', $hostid, 'serviceid', $key);
                 }
             } elseif (false == $host2service && ($publish == 1 || $subscribe == 1)) {
                 $host2service = new stdClass();
-                $host2service->hostid = $_POST['hostid'];
+                $host2service->hostid = $hostid;
                 $host2service->serviceid = $key;
                 
                 $host2service->publish = $publish;
@@ -81,7 +85,7 @@
             $id_list .= ', '.$CFG->mnet_all_hosts_id;
         }
 
-        $concat = sql_concat('COALESCE(h2s.id,0) ', ' \'-\' ', ' svc.id');
+        $concat = sql_concat('COALESCE(h2s.id,0) ', ' \'-\' ', ' svc.id', '\'-\'', 'r.parent_type', '\'-\'', 'r.parent');
 
         $query = "
             SELECT DISTINCT

admin/mnet/mnet_themes.html

@@ -3,19 +3,8 @@ admin_externalpage_print_header();
 print_heading(get_string('themes'));
 $original_theme = fullclone($THEME);
 
-$logurl = $CFG->wwwroot.
-          '/course/report/log/index.php?chooselog=1&showusers=1&showcourses=1&host_course='.$mnet_peer->id.
-          '%2F1&user='.'0'.
-          '&date=0'.
-          '&modid=&modaction=0&logformat=showashtml';
-
-$tabs[] = new tabobject('mnetdetails', 'peers.php?step=update&hostid='.$mnet_peer->id, $strmnetedithost, $strmnetedithost, false);
-$tabs[] = new tabobject('mnetservices', 'mnet_services.php?step=list&hostid='.$mnet_peer->id, $strmnetservices, $strmnetservices, false);
-$tabs[] = new tabobject('mnetthemes', 'mnet_themes.php?step=list&hostid='.$mnet_peer->id, $strmnetthemes, $strmnetthemes, false);
-if ($mnet_peer->id != $CFG->mnet_all_hosts_id) {
-    $tabs[] = new tabobject('mnetlog', $logurl, $strmnetlog, $strmnetlog, false);
-}
-    print_tabs(array($tabs), 'mnetthemes');
+    $currenttab = 'mnetthemes';
+    require_once($CFG->dirroot .'/admin/mnet/tabs.php');
 
     $themes = get_list_of_plugins("theme");
     $sesskey = !empty($USER->id) ? $USER->sesskey : '';

admin/mnet/tabs.php

@@ -0,0 +1,31 @@
+<?php
+/**
+ * Handles tabs for the mnet pages.
+ * We assume that $currenttab is defined
+ *
+ */
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.'); // It must be included from a Moodle page
+}
+$strmnetservices   = get_string('mnetservices', 'mnet');
+$strmnetlog        = get_string('mnetlog', 'mnet');
+$strmnetedithost   = get_string('reviewhostdetails', 'mnet');
+$strmnetthemes     = get_string('mnetthemes', 'mnet');
+
+$logurl = $CFG->wwwroot.
+          '/course/report/log/index.php?chooselog=1&amp;showusers=1&amp;showcourses=1&amp;host_course='.$mnet_peer->id.
+          '%2F1&amp;user='.'0'.
+          '&amp;date=0'.
+          '&amp;modid=&amp;modaction=0&amp;logformat=showashtml';
+$tabs = array();
+if (isset($mnet_peer->id) && $mnet_peer->id > 0) {
+    $tabs[] = new tabobject('mnetdetails', 'peers.php?step=update&amp;hostid='.$mnet_peer->id, $strmnetedithost, $strmnetedithost, false);
+    $tabs[] = new tabobject('mnetservices', 'mnet_services.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetservices, $strmnetservices, false);
+    $tabs[] = new tabobject('mnetthemes', 'mnet_themes.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetthemes, $strmnetthemes, false);
+    if ($mnet_peer->application->name == 'moodle' && $mnet_peer->id != $CFG->mnet_all_hosts_id) {
+        $tabs[] = new tabobject('mnetlog', $logurl, $strmnetlog, $strmnetlog, false);
+    }
+} else {
+    $tabs[] = new tabobject('mnetdetails', '#', $strmnetedithost, $strmnetedithost, false);
+}
+print_tabs(array($tabs), $currenttab);

admin/report/backups/index.php

@@ -93,7 +93,7 @@
         print_simple_box_start('center');
 
     /// First, me get all the distinct backups for that course in backup_log
-        $executions = get_records_sql("SELECT DISTINCT laststarttime,laststarttime
+        $executions = get_records_sql("SELECT DISTINCT laststarttime
                                        FROM {$CFG->prefix}backup_log
                                        WHERE courseid = '$courseid'
                                        ORDER BY laststarttime DESC");

admin/report/security/lib.php

@@ -501,8 +501,8 @@ function report_security_check_passwordsaltmain($detailed=false) {
     if (empty($CFG->passwordsaltmain)) {
         $result->status = REPORT_SECURITY_WARNING;
         $result->info   = get_string('check_passwordsaltmain_warning', 'report_security');
-    } else if ($CFG->passwordsaltmain === 'a_very_long_random_string_of_characters#@6&*1'
-            || trim($CFG->passwordsaltmain) === '' || preg_match('/^([\w]+|[\d]+)$/i', $CFG->passwordsaltmain)) {
+    } else if ($CFG->passwordsaltmain === 'some long random string here with lots of characters'
+            || trim($CFG->passwordsaltmain) === '' || preg_match('/^([a-z0-9]{0,10})$/i', $CFG->passwordsaltmain)) {
         $result->status = REPORT_SECURITY_WARNING;
         $result->info   = get_string('check_passwordsaltmain_weak', 'report_security');
     } else {
@@ -1050,8 +1050,7 @@ function report_security_check_riskadmin($detailed=false) {
                      AND (sc.path = c.path OR sc.path LIKE ".sql_concat('c.path', "'/%'")." OR c.path LIKE ".sql_concat('sc.path', "'/%'").")
                      AND u.id = ra.userid AND u.deleted = 0
                      AND ra.contextid = sc.id AND ra.roleid = rc.roleid AND ra.contextid <> ".SYSCONTEXTID."
-            GROUP BY u.id, u.firstname, u.lastname, u.picture, u.imagealt, u.email, ra.contextid, ra.roleid
-            ORDER BY u.lastname, u.firstname";
+            GROUP BY u.id, u.firstname, u.lastname, u.picture, u.imagealt, u.email, ra.contextid, ra.roleid";
 
     $unsupcount = count_records_sql("SELECT COUNT('x') FROM ($sqlunsup) unsup");
 
@@ -1077,6 +1076,7 @@ function report_security_check_riskadmin($detailed=false) {
         $result->info = get_string('check_riskadmin_warning', 'report_security', $a);
 
         if ($detailed) {
+            $sqlunsup .= " ORDER BY u.lastname, u.firstname";
             $rs = get_recordset_sql($sqlunsup);
             $users = array();
             while ($user = rs_fetch_next_record($rs)) {
@@ -1113,13 +1113,13 @@ function report_security_check_riskbackup($detailed=false) {
     $syscontext = get_context_instance(CONTEXT_SYSTEM);
 
     $systemroles = get_records_sql(
-        "SELECT DISTINCT r.*
+        "SELECT DISTINCT r.id, r.name, r.shortname, r.sortorder
            FROM {$CFG->prefix}role r
            JOIN {$CFG->prefix}role_capabilities rc ON rc.roleid = r.id
           WHERE rc.capability = 'moodle/backup:userinfo' AND rc.contextid = $syscontext->id AND rc.permission = ".CAP_ALLOW."");
 
     $overriddenroles = get_records_sql(
-        "SELECT DISTINCT r.*, rc.contextid
+        "SELECT DISTINCT r.id, r.name, r.shortname, r.sortorder, rc.contextid
            FROM {$CFG->prefix}role r
            JOIN {$CFG->prefix}role_capabilities rc ON rc.roleid = r.id
           WHERE rc.capability = 'moodle/backup:userinfo' AND rc.contextid <> $syscontext->id AND rc.permission = ".CAP_ALLOW."");

admin/report/unittest/ex_reporter.php

@@ -66,22 +66,39 @@ class ExHtmlReporter extends HtmlReporter {
     function paintFail($message) {
         // Explicitly call grandparent, not parent::paintFail.
         SimpleScorer::paintFail($message);
-        $this->_paintPassFail('fail', $message);
+        $this->_paintPassFail('fail', $message, debug_backtrace());
     }
 
     /**
      * Called when an error (uncaught exception or PHP error) needs to be output.
      */
     function paintError($message) {
-        // Explicitly call grandparent, not parent::paintFail.
+        // Explicitly call grandparent, not parent::paintError.
         SimpleScorer::paintError($message);
         $this->_paintPassFail('exception', $message);
     }
 
     /**
-     * Private method. Used by printPass/Fail/Error.
+     * Called when a caught exception needs to be output.
      */
-    function _paintPassFail($passorfail, $message) {
+    function paintException($exception) {
+        // Explicitly call grandparent, not parent::paintException.
+        SimpleScorer::paintException($exception);
+        $message = 'Unexpected exception of type [' . get_class($exception) .
+                '] with message ['. $exception->getMessage() .
+                '] in ['. $exception->getFile() .
+                ' line ' . $exception->getLine() . ']';
+        $stacktrace = null;
+        if (method_exists($exception, 'getTrace')) {
+            $stacktrace = $exception->getTrace();
+        }
+        $this->_paintPassFail('exception', $message, $stacktrace);
+    }
+
+    /**
+     * Private method. Used by printPass/Fail/Error/Exception.
+     */
+    function _paintPassFail($passorfail, $message, $stacktrace = null) {
         global $FULLME, $CFG;
 
         print_simple_box_start('', '100%', '', 5, $passorfail . ' generalbox');
@@ -100,6 +117,25 @@ class ExHtmlReporter extends HtmlReporter {
         echo "<a href=\"{$url}path=$folder$file\" title=\"$this->strrunonlyfile\">$file</a>";
         echo $this->strseparator, implode($this->strseparator, $breadcrumb);
         echo $this->strseparator, '<br />', $this->_htmlEntities($message), "\n\n";
+        if ($stacktrace) {
+            $dotsadded = false;
+            $interestinglines = 0;
+            $filteredstacktrace = array();
+            foreach ($stacktrace as $frame) {
+                if (empty($frame['file']) || (strpos($frame['file'], 'simpletestlib') === false
+                        && strpos($frame['file'], 'report/unittest') === false)) {
+                    $filteredstacktrace[] = $frame;
+                    $interestinglines += 1;
+                    $dotsadded = false;
+                } else if (!$dotsadded) {
+                    $filteredstacktrace[] = array('line' => '...', 'file' => '...');
+                    $dotsadded = true;
+                }
+            }
+            if ($interestinglines > 1 || $passorfail == 'exception') {
+                echo '<div class="notifytiny">' . format_backtrace($filteredstacktrace) . "</div>\n\n";
+            }
+        }
         print_simple_box_end();
         flush();
     }
@@ -193,4 +229,45 @@ class ExHtmlReporter extends HtmlReporter {
         return get_string($identifier, 'simpletest', $a);
     }
 }
+
+/**
+ * Formats a backtrace ready for output.
+ *
+ * @param array $callers backtrace array, as returned by debug_backtrace().
+ * @param boolean $plaintext if false, generates HTML, if true generates plain text.
+ * @return string formatted backtrace, ready for output.
+ */
+function format_backtrace($callers, $plaintext = false) {
+    // do not use $CFG->dirroot because it might not be available in destructors
+    $dirroot = dirname(dirname(__FILE__));
+
+    if (empty($callers)) {
+        return '';
+    }
+
+    $from = $plaintext ? '' : '<ul style="text-align: left">';
+    foreach ($callers as $caller) {
+        if (!isset($caller['line'])) {
+            $caller['line'] = '?'; // probably call_user_func()
+        }
+        if (!isset($caller['file'])) {
+            $caller['file'] = 'unknownfile'; // probably call_user_func()
+        }
+        $from .= $plaintext ? '* ' : '<li>';
+        $from .= 'line ' . $caller['line'] . ' of ' . str_replace($dirroot, '', $caller['file']);
+        if (isset($caller['function'])) {
+            $from .= ': call to ';
+            if (isset($caller['class'])) {
+                $from .= $caller['class'] . $caller['type'];
+            }
+            $from .= $caller['function'] . '()';
+        } else if (isset($caller['exception'])) {
+            $from .= ': '.$caller['exception'].' thrown';
+        }
+        $from .= $plaintext ? "\n" : '</li>';
+    }
+    $from .= $plaintext ? '' : '</ul>';
+
+    return $from;
+}
 ?>

admin/report/unittest/ex_simple_test.php

@@ -56,7 +56,7 @@ class AutoGroupTest extends TestSuite {
             }
             $file_path = $path . '/' . $file;
             if (is_dir($file_path)) {
-                if ($file != 'CVS' && !in_array($file_path, $this->ignorefolders)) {
+                if ($file != 'CVS' && $file != '.git' && !in_array($file_path, $this->ignorefolders)) {
                     $this->_recurseFolders($file_path);
                 }
             } elseif (preg_match('/simpletest(\/|\\\\)test.*\.php$/', $file_path) ||

admin/roles/assign.php

@@ -325,7 +325,7 @@
                 if ($validroleids) {
                     $roleids =  '('.implode(',', $validroleids).')';
 
-                    $select = " SELECT u.id, u.firstname, u.lastname, u.email";
+                    $select = " SELECT DISTINCT u.id, u.firstname, u.lastname, u.email";
                     $countselect = "SELECT COUNT(u.id)";
                     $from   = " FROM {$CFG->prefix}user u
                                 INNER JOIN {$CFG->prefix}role_assignments ra ON ra.userid = u.id

admin/settings/security.php

@@ -26,7 +26,7 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
                        2700 => get_string('numminutes', '', 45),
                        3600 => get_string('numminutes', '', 60))));
     $temp->add(new admin_setting_configselect('fullnamedisplay', get_string('fullnamedisplay', 'admin'), get_string('configfullnamedisplay', 'admin'),
-                  'firstname lastname', array('language' => get_string('language'),
+                  'language', array('language' => get_string('language'),
                                               'firstname lastname' => get_string('firstname').' + '.get_string('lastname'),
                                               'lastname firstname' => get_string('lastname').' + '.get_string('firstname'),
                                               'firstname' => get_string('firstname'))));
@@ -65,16 +65,16 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
     $temp->add(new admin_setting_configcheckbox('loginhttps', get_string('loginhttps', 'admin'), get_string('configloginhttps', 'admin'), 0));
     $temp->add(new admin_setting_configcheckbox('cookiesecure', get_string('cookiesecure', 'admin'), get_string('configcookiesecure', 'admin'), 0));
     $temp->add(new admin_setting_configcheckbox('cookiehttponly', get_string('cookiehttponly', 'admin'), get_string('configcookiehttponly', 'admin'), 0));
-    $temp->add(new admin_setting_configcheckbox('regenloginsession', get_string('regenloginsession', 'admin'), get_string('configregenloginsession', 'admin'), 0));
+    $temp->add(new admin_setting_configcheckbox('regenloginsession', get_string('regenloginsession', 'admin'), get_string('configregenloginsession', 'admin'), 1));
     $temp->add(new admin_setting_configtext('excludeoldflashclients', get_string('excludeoldflashclients', 'admin'), get_string('configexcludeoldflashclients', 'admin'), '10.0.12', PARAM_TEXT));
     $ADMIN->add('security', $temp);
 
 
     // "modulesecurity" settingpage
     $temp = new admin_settingpage('modulesecurity', get_string('modulesecurity', 'admin'));
-    $temp->add(new admin_setting_configselect('restrictmodulesfor', get_string('restrictmodulesfor', 'admin'), get_string('configrestrictmodulesfor', 'admin'), 'none', array('none' => 'No courses',
-                                                                                                                                                                              'all' => 'All courses',
-                                                                                                                                                                              'requested' => 'Requested courses')));
+    $temp->add(new admin_setting_configselect('restrictmodulesfor', get_string('restrictmodulesfor', 'admin'), get_string('configrestrictmodulesfor', 'admin'), 'none', array('none' => get_string('nocourses'),
+                                                                                                                                                                              'all' => get_string('fulllistofcourses'),
+                                                                                                                                                                              'requested' => get_string('requestedcourses'))));
     $temp->add(new admin_setting_configcheckbox('restrictbydefault', get_string('restrictbydefault', 'admin'), get_string('configrestrictbydefault', 'admin'), 0));
     if (!$options = get_records("modules")) {
         $options = array();

admin/settings/users.php

@@ -25,7 +25,7 @@ if ($hassiteconfig
                                             get_string('alternatelogin', 'auth', htmlspecialchars($CFG->wwwroot.'/login/index.php')), ''));
     $temp->add(new admin_setting_configtext('forgottenpasswordurl', get_string('forgottenpasswordurl', 'auth'),
                                             get_string('forgottenpassword', 'auth'), ''));
-    $temp->add(new admin_setting_configtextarea('auth_instructions', get_string('instructions', 'auth'),
+    $temp->add(new admin_setting_confightmltextarea('auth_instructions', get_string('instructions', 'auth'),
                                                 get_string('authinstructions', 'auth'), ''));
     $temp->add(new admin_setting_configtext('allowemailaddresses', get_string('allowemailaddresses', 'admin'), get_string('configallowemailaddresses', 'admin'), '', PARAM_NOTAGS));
     $temp->add(new admin_setting_configtext('denyemailaddresses', get_string('denyemailaddresses', 'admin'), get_string('configdenyemailaddresses', 'admin'), '', PARAM_NOTAGS));

admin/uploadpicture.php

@@ -191,25 +191,19 @@ function process_directory ($dir, $userfield, $overwrite, &$results) {
  */
 function process_file ($file, $userfield, $overwrite) {
     // Add additional checks on the filenames, as they are user
-    // controlled and we don't want to open any security holes.
+    // controlled and we don't want to open any security holes.    
     $path_parts = pathinfo(cleardoubleslashes($file));
     $basename  = $path_parts['basename'];
     $extension = $path_parts['extension'];
-    if ($basename != clean_param($basename, PARAM_CLEANFILE)) {
-        // The original picture file name has invalid characters
-        notify(get_string('uploadpicture_invalidfilename', 'admin',
-                          clean_param($basename, PARAM_CLEANHTML)));
-        return PIX_FILE_ERROR;
-    }
-
+    
     // The picture file name (without extension) must match the
     // userfield attribute.
     $uservalue = substr($basename, 0,
                         strlen($basename) -
                         strlen($extension) - 1);
 
-    // userfield names are safe, so don't quote them.
-    if (!($user = get_record('user', $userfield, addslashes($uservalue)))) {
+    // userfield names are safe, so don't quote them.    
+    if (!($user = get_record('user', $userfield, addslashes($uservalue),'deleted',0))) {
         $a = new Object();
         $a->userfield = clean_param($userfield, PARAM_CLEANHTML);
         $a->uservalue = clean_param($uservalue, PARAM_CLEANHTML);

admin/uploadpicture_form.php

@@ -1,28 +1,33 @@
 <?php // $Id$
-    require_once $CFG->libdir.'/formslib.php';
 
-    class admin_uploadpicture_form extends moodleform {
-        function definition (){
-            global $CFG, $USER;
-    
-            $mform =& $this->_form;
-    
-            $this->set_upload_manager(new upload_manager('userpicturesfile', false, false, null, false, 0, true, true, false));
-    
-            $mform->addElement('header', 'settingsheader', get_string('upload'));
-    
-            $mform->addElement('file', 'userpicturesfile', get_string('file'), 'size="40"');
-            $mform->addRule('userpicturesfile', null, 'required');
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
 
-            $choices =& $this->_customdata;
-            $mform->addElement('select', 'userfield', get_string('uploadpicture_userfield', 'admin'), $choices);
-            $mform->setType('userfield', PARAM_INT);
+require_once $CFG->libdir.'/formslib.php';
 
-            $choices = array( 0 => get_string('no'), 1 => get_string('yes') );
-            $mform->addElement('select', 'overwritepicture', get_string('uploadpicture_overwrite', 'admin'), $choices);
-            $mform->setType('overwritepicture', PARAM_INT);
-    
-            $this->add_action_buttons(false, get_string('uploadpictures', 'admin'));
-        }
+class admin_uploadpicture_form extends moodleform {
+    function definition (){
+        global $CFG, $USER;
+
+        $mform =& $this->_form;
+
+        $this->set_upload_manager(new upload_manager('userpicturesfile', false, false, null, false, 0, true, true, false));
+
+        $mform->addElement('header', 'settingsheader', get_string('upload'));
+
+        $mform->addElement('file', 'userpicturesfile', get_string('file'), 'size="40"');
+        $mform->addRule('userpicturesfile', null, 'required');
+
+        $choices =& $this->_customdata;
+        $mform->addElement('select', 'userfield', get_string('uploadpicture_userfield', 'admin'), $choices);
+        $mform->setType('userfield', PARAM_INT);
+
+        $choices = array( 0 => get_string('no'), 1 => get_string('yes') );
+        $mform->addElement('select', 'overwritepicture', get_string('uploadpicture_overwrite', 'admin'), $choices);
+        $mform->setType('overwritepicture', PARAM_INT);
+
+        $this->add_action_buttons(false, get_string('uploadpictures', 'admin'));
     }
+}
 ?>

admin/uploaduser_form.php

@@ -1,4 +1,9 @@
 <?php // $Id$
+
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once $CFG->libdir.'/formslib.php';
 
 class admin_uploaduser_form1 extends moodleform {

admin/user/user_message_form.php

@@ -9,7 +9,7 @@ class user_message_form extends moodleform {
         $mform->addElement('header', 'general', get_string('message', 'message'));
 
 
-        $mform->addElement('textarea', 'messagebody', get_string('messagebody'), array('rows'=>15, 'cols'=>60));
+        $mform->addElement('htmleditor', 'messagebody', get_string('messagebody'), array('rows'=>15, 'cols'=>60));
         $mform->addRule('messagebody', '', 'required', null, 'client');
         $mform->setHelpButton('messagebody', array('writing', 'reading', 'questions', 'richtext'), false, 'editorhelpbutton');
         $mform->addElement('format', 'format', get_string('format'));

auth/cas/CAS/CAS/PGTStorage/pgt-file.php

@@ -1,240 +1,283 @@
-<?php
-
-/**
- * @file CAS/PGTStorage/pgt-file.php
- * Basic class for PGT file storage
- */
-
-/**
- * @class PGTStorageFile
- * The PGTStorageFile class is a class for PGT file storage. An instance of 
- * this class is returned by CASClient::SetPGTStorageFile().
- *
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
- *
- * @ingroup internalPGTStorageFile
- */
-
-class PGTStorageFile extends PGTStorage
-{
-  /** 
-   * @addtogroup internalPGTStorageFile 
-   * @{ 
-   */
-
-  /**
-   * a string telling where PGT's should be stored on the filesystem. Written by
-   * PGTStorageFile::PGTStorageFile(), read by getPath().
-   *
-   * @private
-   */
-  var $_path;
-
-  /**
-   * This method returns the name of the directory where PGT's should be stored 
-   * on the filesystem.
-   *
-   * @return the name of a directory (with leading and trailing '/')
-   *
-   * @private
-   */
-  function getPath()
-    {
-      return $this->_path;
-    }
-
-  /**
-   * a string telling the format to use to store PGT's (plain or xml). Written by
-   * PGTStorageFile::PGTStorageFile(), read by getFormat().
-   *
-   * @private
-   */
-  var $_format;
-
-  /**
-   * This method returns the format to use when storing PGT's on the filesystem.
-   *
-   * @return a string corresponding to the format used (plain or xml).
-   *
-   * @private
-   */
-  function getFormat()
-    {
-      return $this->_format;
-    }
-
-  // ########################################################################
-  //  DEBUGGING
-  // ########################################################################
-  
-  /**
-   * This method returns an informational string giving the type of storage
-   * used by the object (used for debugging purposes).
-   *
-   * @return an informational string.
-   * @public
-   */
-  function getStorageType()
-    {
-      return "file";
-    }
-
-  /**
-   * This method returns an informational string giving informations on the
-   * parameters of the storage.(used for debugging purposes).
-   *
-   * @return an informational string.
-   * @public
-   */
-  function getStorageInfo()
-    {
-      return 'path=`'.$this->getPath().'\', format=`'.$this->getFormat().'\'';
-    }
-
-  // ########################################################################
-  //  CONSTRUCTOR
-  // ########################################################################
-  
-  /**
-   * The class constructor, called by CASClient::SetPGTStorageFile().
-   *
-   * @param $cas_parent the CASClient instance that creates the object.
-   * @param $format the format used to store the PGT's (`plain' and `xml' allowed).
-   * @param $path the path where the PGT's should be stored
-   *
-   * @public
-   */
-  function PGTStorageFile($cas_parent,$format,$path)
-    {
-      phpCAS::traceBegin();
-      // call the ancestor's constructor
-      $this->PGTStorage($cas_parent);
-
-      if (empty($format) ) $format = CAS_PGT_STORAGE_FILE_DEFAULT_FORMAT;
-      if (empty($path) ) $path = CAS_PGT_STORAGE_FILE_DEFAULT_PATH;
-
-      // check that the path is an absolute path
-      if ( $path[0] != '/' ) {
-	phpCAS::error('an absolute path is needed for PGT storage to file');
-      }
-
-      // store the path (with a leading and trailing '/')      
-      $path = preg_replace('|[/]*$|','/',$path);
-      $path = preg_replace('|^[/]*|','/',$path);
-      $this->_path = $path;
-
-      // check the format and store it
-      switch ($format) {
-      case CAS_PGT_STORAGE_FILE_FORMAT_PLAIN:
-      case CAS_PGT_STORAGE_FILE_FORMAT_XML:
-	$this->_format = $format;
-	break;
-      default:
-	phpCAS::error('unknown PGT file storage format (`'.CAS_PGT_STORAGE_FILE_FORMAT_PLAIN.'\' and `'.CAS_PGT_STORAGE_FILE_FORMAT_XML.'\' allowed)');
-      }
-      phpCAS::traceEnd();      
-    }
-
-  // ########################################################################
-  //  INITIALIZATION
-  // ########################################################################
-  
-  /**
-   * This method is used to initialize the storage. Halts on error.
-   *
-   * @public
-   */
-  function init()
-    {
-      phpCAS::traceBegin();
-      // if the storage has already been initialized, return immediatly
-      if ( $this->isInitialized() )
-	return;
-      // call the ancestor's method (mark as initialized)
-      parent::init();
-      phpCAS::traceEnd();      
-    }
-
-  // ########################################################################
-  //  PGT I/O
-  // ########################################################################
-
-  /**
-   * This method returns the filename corresponding to a PGT Iou.
-   *
-   * @param $pgt_iou the PGT iou.
-   *
-   * @return a filename
-   * @private
-   */
-  function getPGTIouFilename($pgt_iou)
-    {
-      phpCAS::traceBegin();
-      $filename = $this->getPath().$pgt_iou.'.'.$this->getFormat();
-
-      phpCAS::traceEnd($filename);
-      return $filename;
-    }
-  
-  /**
-   * This method stores a PGT and its corresponding PGT Iou into a file. Echoes a
-   * warning on error.
-   *
-   * @param $pgt the PGT
-   * @param $pgt_iou the PGT iou
-   *
-   * @public
-   */
-  function write($pgt,$pgt_iou)
-    {
-      phpCAS::traceBegin();
-      $fname = $this->getPGTIouFilename($pgt_iou);
-      if ( $f=fopen($fname,"w") ) {
-	if ( fputs($f,$pgt) === FALSE ) {
-	  phpCAS::error('could not write PGT to `'.$fname.'\'');
-	}
-	fclose($f);
-      } else {
-	phpCAS::error('could not open `'.$fname.'\'');
-      }
-      phpCAS::traceEnd();      
-    }
-
-  /**
-   * This method reads a PGT corresponding to a PGT Iou and deletes the 
-   * corresponding file.
-   *
-   * @param $pgt_iou the PGT iou
-   *
-   * @return the corresponding PGT, or FALSE on error
-   *
-   * @public
-   */
-  function read($pgt_iou)
-    {
-      phpCAS::traceBegin();
-      $pgt = FALSE;
-      $fname = $this->getPGTIouFilename($pgt_iou);
-
-      if ( !($f=fopen($fname,"r")) ) {
-	phpCAS::trace('could not open `'.$fname.'\'');
-      } else {
-	if ( ($pgt=fgets($f)) === FALSE ) {
-	  phpCAS::trace('could not read PGT from `'.$fname.'\'');
-	} 
-	fclose($f);
-      }
-
-      // delete the PGT file
-      @unlink($fname);
-
-      phpCAS::traceEnd($pgt);
-      return $pgt;
-    }
-  
-  /** @} */
-  
-}
-
-  
-?>
+<?php
+/*
+ * Copyright © 2003-2010, The ESUP-Portail consortium & the JA-SIG Collaborative.
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ * 
+ *     * Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright notice,
+ *       this list of conditions and the following disclaimer in the documentation
+ *       and/or other materials provided with the distribution.
+ *     * Neither the name of the ESUP-Portail consortium & the JA-SIG
+ *       Collaborative nor the names of its contributors may be used to endorse or
+ *       promote products derived from this software without specific prior
+ *       written permission.
+
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+/**
+ * @file CAS/PGTStorage/pgt-file.php
+ * Basic class for PGT file storage
+ */
+
+/**
+ * @class PGTStorageFile
+ * The PGTStorageFile class is a class for PGT file storage. An instance of 
+ * this class is returned by CASClient::SetPGTStorageFile().
+ *
+ * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
+ *
+ * @ingroup internalPGTStorageFile
+ */
+
+class PGTStorageFile extends PGTStorage
+{
+  /** 
+   * @addtogroup internalPGTStorageFile 
+   * @{ 
+   */
+
+  /**
+   * a string telling where PGT's should be stored on the filesystem. Written by
+   * PGTStorageFile::PGTStorageFile(), read by getPath().
+   *
+   * @private
+   */
+  var $_path;
+
+  /**
+   * This method returns the name of the directory where PGT's should be stored 
+   * on the filesystem.
+   *
+   * @return the name of a directory (with leading and trailing '/')
+   *
+   * @private
+   */
+  function getPath()
+    {
+      return $this->_path;
+    }
+
+  /**
+   * a string telling the format to use to store PGT's (plain or xml). Written by
+   * PGTStorageFile::PGTStorageFile(), read by getFormat().
+   *
+   * @private
+   */
+  var $_format;
+
+  /**
+   * This method returns the format to use when storing PGT's on the filesystem.
+   *
+   * @return a string corresponding to the format used (plain or xml).
+   *
+   * @private
+   */
+  function getFormat()
+    {
+      return $this->_format;
+    }
+
+  // ########################################################################
+  //  DEBUGGING
+  // ########################################################################
+  
+  /**
+   * This method returns an informational string giving the type of storage
+   * used by the object (used for debugging purposes).
+   *
+   * @return an informational string.
+   * @public
+   */
+  function getStorageType()
+    {
+      return "file";
+    }
+
+  /**
+   * This method returns an informational string giving informations on the
+   * parameters of the storage.(used for debugging purposes).
+   *
+   * @return an informational string.
+   * @public
+   */
+  function getStorageInfo()
+    {
+      return 'path=`'.$this->getPath().'\', format=`'.$this->getFormat().'\'';
+    }
+
+  // ########################################################################
+  //  CONSTRUCTOR
+  // ########################################################################
+  
+  /**
+   * The class constructor, called by CASClient::SetPGTStorageFile().
+   *
+   * @param $cas_parent the CASClient instance that creates the object.
+   * @param $format the format used to store the PGT's (`plain' and `xml' allowed).
+   * @param $path the path where the PGT's should be stored
+   *
+   * @public
+   */
+  function PGTStorageFile($cas_parent,$format,$path)
+    {
+      phpCAS::traceBegin();
+      // call the ancestor's constructor
+      $this->PGTStorage($cas_parent);
+
+      if (empty($format) ) $format = CAS_PGT_STORAGE_FILE_DEFAULT_FORMAT;
+      if (empty($path) ) $path = CAS_PGT_STORAGE_FILE_DEFAULT_PATH;
+
+      // check that the path is an absolute path
+      if (getenv("OS")=="Windows_NT"){
+      	
+      	 if (!preg_match('`^[a-zA-Z]:`', $path)) {
+	     	phpCAS::error('an absolute path is needed for PGT storage to file');
+      	}
+      	
+      }
+      else
+      {
+      
+      	if ( $path[0] != '/' ) {
+			phpCAS::error('an absolute path is needed for PGT storage to file');
+      	}
+
+      	// store the path (with a leading and trailing '/')      
+      	$path = preg_replace('|[/]*$|','/',$path);
+      	$path = preg_replace('|^[/]*|','/',$path);
+      }
+      
+      $this->_path = $path;
+      // check the format and store it
+      switch ($format) {
+      case CAS_PGT_STORAGE_FILE_FORMAT_PLAIN:
+      case CAS_PGT_STORAGE_FILE_FORMAT_XML:
+	$this->_format = $format;
+	break;
+      default:
+	phpCAS::error('unknown PGT file storage format (`'.CAS_PGT_STORAGE_FILE_FORMAT_PLAIN.'\' and `'.CAS_PGT_STORAGE_FILE_FORMAT_XML.'\' allowed)');
+      }
+      phpCAS::traceEnd();      
+    }
+
+  // ########################################################################
+  //  INITIALIZATION
+  // ########################################################################
+  
+  /**
+   * This method is used to initialize the storage. Halts on error.
+   *
+   * @public
+   */
+  function init()
+    {
+      phpCAS::traceBegin();
+      // if the storage has already been initialized, return immediatly
+      if ( $this->isInitialized() )
+	return;
+      // call the ancestor's method (mark as initialized)
+      parent::init();
+      phpCAS::traceEnd();      
+    }
+
+  // ########################################################################
+  //  PGT I/O
+  // ########################################################################
+
+  /**
+   * This method returns the filename corresponding to a PGT Iou.
+   *
+   * @param $pgt_iou the PGT iou.
+   *
+   * @return a filename
+   * @private
+   */
+  function getPGTIouFilename($pgt_iou)
+    {
+      phpCAS::traceBegin();
+      $filename = $this->getPath().$pgt_iou.'.'.$this->getFormat();
+      phpCAS::traceEnd($filename);
+      return $filename;
+    }
+  
+  /**
+   * This method stores a PGT and its corresponding PGT Iou into a file. Echoes a
+   * warning on error.
+   *
+   * @param $pgt the PGT
+   * @param $pgt_iou the PGT iou
+   *
+   * @public
+   */
+  function write($pgt,$pgt_iou)
+	  {
+	  phpCAS::traceBegin();
+	  $fname = $this->getPGTIouFilename($pgt_iou);
+	  if(!file_exists($fname)){
+		  if ( $f=fopen($fname,"w") ) {
+			  if ( fputs($f,$pgt) === FALSE ) {
+				  phpCAS::error('could not write PGT to `'.$fname.'\'');
+			  }
+			  fclose($f);
+		  } else {
+			  phpCAS::error('could not open `'.$fname.'\'');
+		  }
+	  }else{
+		  phpCAS::error('File exists: `'.$fname.'\'');
+	  }
+	  phpCAS::traceEnd();      
+	  }
+
+  /**
+   * This method reads a PGT corresponding to a PGT Iou and deletes the 
+   * corresponding file.
+   *
+   * @param $pgt_iou the PGT iou
+   *
+   * @return the corresponding PGT, or FALSE on error
+   *
+   * @public
+   */
+  function read($pgt_iou)
+	  {
+	  phpCAS::traceBegin();
+	  $pgt = FALSE;
+	  $fname = $this->getPGTIouFilename($pgt_iou);
+	  if (file_exists($fname)){
+		  if ( !($f=fopen($fname,"r")) ) {
+			  phpCAS::trace('could not open `'.$fname.'\'');
+		  } else {
+			  if ( ($pgt=fgets($f)) === FALSE ) {
+				  phpCAS::trace('could not read PGT from `'.$fname.'\'');
+			  } 
+			  fclose($f);
+		  }
+		  
+		  // delete the PGT file
+		  @unlink($fname);
+	  }else{
+		  phpCAS::trace('No such file `'.$fname.'\'');
+	  }
+	  phpCAS::traceEnd($pgt);
+	  return $pgt;
+	  }
+  
+  /** @} */
+  
+}
+
+  
+?>

auth/cas/CAS/CAS/PGTStorage/pgt-main.php

@@ -1,189 +1,214 @@
-<?php
-
-/**
- * @file CAS/PGTStorage/pgt-main.php
- * Basic class for PGT storage
- */
-
-/**
- * @class PGTStorage
- * The PGTStorage class is a generic class for PGT storage. This class should
- * not be instanciated itself but inherited by specific PGT storage classes.
- *
- * @author   Pascal Aubry <pascal.aubry at univ-rennes1.fr>
- *
- * @ingroup internalPGTStorage
- */
-
-class PGTStorage
-{
-  /** 
-   * @addtogroup internalPGTStorage
-   * @{ 
-   */
-
-  // ########################################################################
-  //  CONSTRUCTOR
-  // ########################################################################
-  
-  /**
-   * The constructor of the class, should be called only by inherited classes.
-   *
-   * @param $cas_parent the CASclient instance that creates the current object.
-   *
-   * @protected
-   */
-  function PGTStorage($cas_parent)
-    {
-      phpCAS::traceBegin();
-      if ( !$cas_parent->isProxy() ) {
-	phpCAS::error('defining PGT storage makes no sense when not using a CAS proxy'); 
-      }
-      phpCAS::traceEnd();
-    }
-
-  // ########################################################################
-  //  DEBUGGING
-  // ########################################################################
-  
-  /**
-   * This virtual method returns an informational string giving the type of storage
-   * used by the object (used for debugging purposes).
-   *
-   * @public
-   */
-  function getStorageType()
-    {
-      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
-    }
-
-  /**
-   * This virtual method returns an informational string giving informations on the
-   * parameters of the storage.(used for debugging purposes).
-   *
-   * @public
-   */
-  function getStorageInfo()
-    {
-      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
-    }
-
-  // ########################################################################
-  //  ERROR HANDLING
-  // ########################################################################
-  
-  /**
-   * string used to store an error message. Written by PGTStorage::setErrorMessage(),
-   * read by PGTStorage::getErrorMessage().
-   *
-   * @hideinitializer
-   * @private
-   * @deprecated not used.
-   */
-  var $_error_message=FALSE;
-
-  /**
-   * This method sets en error message, which can be read later by 
-   * PGTStorage::getErrorMessage().
-   *
-   * @param $error_message an error message
-   *
-   * @protected
-   * @deprecated not used.
-   */
-  function setErrorMessage($error_message)
-    {
-      $this->_error_message = $error_message;
-    }
-
-  /**
-   * This method returns an error message set by PGTStorage::setErrorMessage().
-   *
-   * @return an error message when set by PGTStorage::setErrorMessage(), FALSE
-   * otherwise.
-   *
-   * @public
-   * @deprecated not used.
-   */
-  function getErrorMessage()
-    {
-      return $this->_error_message;
-    }
-
-  // ########################################################################
-  //  INITIALIZATION
-  // ########################################################################
-
-  /**
-   * a boolean telling if the storage has already been initialized. Written by 
-   * PGTStorage::init(), read by PGTStorage::isInitialized().
-   *
-   * @hideinitializer
-   * @private
-   */
-  var $_initialized = FALSE;
-
-  /**
-   * This method tells if the storage has already been intialized.
-   *
-   * @return a boolean
-   *
-   * @protected
-   */
-  function isInitialized()
-    {
-      return $this->_initialized;
-    }
-
-  /**
-   * This virtual method initializes the object.
-   *
-   * @protected
-   */
-  function init()
-    {
-      $this->_initialized = TRUE;
-    }
-
-  // ########################################################################
-  //  PGT I/O
-  // ########################################################################
-
-  /**
-   * This virtual method stores a PGT and its corresponding PGT Iuo.
-   * @note Should never be called.
-   *
-   * @param $pgt the PGT
-   * @param $pgt_iou the PGT iou
-   *
-   * @protected
-   */
-  function write($pgt,$pgt_iou)
-    {
-      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
-    }
-
-  /**
-   * This virtual method reads a PGT corresponding to a PGT Iou and deletes
-   * the corresponding storage entry.
-   * @note Should never be called.
-   *
-   * @param $pgt_iou the PGT iou
-   *
-   * @protected
-   */
-  function read($pgt_iou)
-    {
-      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
-    }
-
-  /** @} */
-  
-} 
-
-// include specific PGT storage classes
-include_once(dirname(__FILE__).'/pgt-file.php'); 
-// incompatibility with Moodle
-//include_once(dirname(__FILE__).'/pgt-db.php');
-  
-?>
+<?php
+/*
+ * Copyright © 2003-2010, The ESUP-Portail consortium & the JA-SIG Collaborative.
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ * 
+ *     * Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright notice,
+ *       this list of conditions and the following disclaimer in the documentation
+ *       and/or other materials provided with the distribution.
+ *     * Neither the name of the ESUP-Portail consortium & the JA-SIG
+ *       Collaborative nor the names of its contributors may be used to endorse or
+ *       promote products derived from this software without specific prior
+ *       written permission.
+
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+/**
+ * @file CAS/PGTStorage/pgt-main.php
+ * Basic class for PGT storage
+ */
+
+/**
+ * @class PGTStorage
+ * The PGTStorage class is a generic class for PGT storage. This class should
+ * not be instanciated itself but inherited by specific PGT storage classes.
+ *
+ * @author   Pascal Aubry <pascal.aubry at univ-rennes1.fr>
+ *
+ * @ingroup internalPGTStorage
+ */
+
+class PGTStorage
+{
+  /** 
+   * @addtogroup internalPGTStorage
+   * @{ 
+   */
+
+  // ########################################################################
+  //  CONSTRUCTOR
+  // ########################################################################
+  
+  /**
+   * The constructor of the class, should be called only by inherited classes.
+   *
+   * @param $cas_parent the CASclient instance that creates the current object.
+   *
+   * @protected
+   */
+  function PGTStorage($cas_parent)
+    {
+      phpCAS::traceBegin();
+      if ( !$cas_parent->isProxy() ) {
+	phpCAS::error('defining PGT storage makes no sense when not using a CAS proxy'); 
+      }
+      phpCAS::traceEnd();
+    }
+
+  // ########################################################################
+  //  DEBUGGING
+  // ########################################################################
+  
+  /**
+   * This virtual method returns an informational string giving the type of storage
+   * used by the object (used for debugging purposes).
+   *
+   * @public
+   */
+  function getStorageType()
+    {
+      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
+    }
+
+  /**
+   * This virtual method returns an informational string giving informations on the
+   * parameters of the storage.(used for debugging purposes).
+   *
+   * @public
+   */
+  function getStorageInfo()
+    {
+      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
+    }
+
+  // ########################################################################
+  //  ERROR HANDLING
+  // ########################################################################
+  
+  /**
+   * string used to store an error message. Written by PGTStorage::setErrorMessage(),
+   * read by PGTStorage::getErrorMessage().
+   *
+   * @hideinitializer
+   * @private
+   * @deprecated not used.
+   */
+  var $_error_message=FALSE;
+
+  /**
+   * This method sets en error message, which can be read later by 
+   * PGTStorage::getErrorMessage().
+   *
+   * @param $error_message an error message
+   *
+   * @protected
+   * @deprecated not used.
+   */
+  function setErrorMessage($error_message)
+    {
+      $this->_error_message = $error_message;
+    }
+
+  /**
+   * This method returns an error message set by PGTStorage::setErrorMessage().
+   *
+   * @return an error message when set by PGTStorage::setErrorMessage(), FALSE
+   * otherwise.
+   *
+   * @public
+   * @deprecated not used.
+   */
+  function getErrorMessage()
+    {
+      return $this->_error_message;
+    }
+
+  // ########################################################################
+  //  INITIALIZATION
+  // ########################################################################
+
+  /**
+   * a boolean telling if the storage has already been initialized. Written by 
+   * PGTStorage::init(), read by PGTStorage::isInitialized().
+   *
+   * @hideinitializer
+   * @private
+   */
+  var $_initialized = FALSE;
+
+  /**
+   * This method tells if the storage has already been intialized.
+   *
+   * @return a boolean
+   *
+   * @protected
+   */
+  function isInitialized()
+    {
+      return $this->_initialized;
+    }
+
+  /**
+   * This virtual method initializes the object.
+   *
+   * @protected
+   */
+  function init()
+    {
+      $this->_initialized = TRUE;
+    }
+
+  // ########################################################################
+  //  PGT I/O
+  // ########################################################################
+
+  /**
+   * This virtual method stores a PGT and its corresponding PGT Iuo.
+   * @note Should never be called.
+   *
+   * @param $pgt the PGT
+   * @param $pgt_iou the PGT iou
+   *
+   * @protected
+   */
+  function write($pgt,$pgt_iou)
+    {
+      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
+    }
+
+  /**
+   * This virtual method reads a PGT corresponding to a PGT Iou and deletes
+   * the corresponding storage entry.
+   * @note Should never be called.
+   *
+   * @param $pgt_iou the PGT iou
+   *
+   * @protected
+   */
+  function read($pgt_iou)
+    {
+      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
+    }
+
+  /** @} */
+  
+} 
+
+// include specific PGT storage classes
+include_once(dirname(__FILE__).'/pgt-file.php'); 
+  
+?>

auth/cas/CAS/CAS/domxml-php4-to-php5.php

@@ -10,12 +10,12 @@
 			require_once('domxml-php4-to-php5.php');
 	}
 
-	Version 1.20a, 2008-11-06, http://alexandre.alapetite.net/doc-alex/domxml-php4-php5/
+	Version 1.21.1a, 2009-03-13, http://alexandre.alapetite.fr/doc-alex/domxml-php4-php5/
 
 	------------------------------------------------------------------
-	Written by Alexandre Alapetite, http://alexandre.alapetite.net/cv/
+	Written by Alexandre Alapetite, http://alexandre.alapetite.fr/cv/
 
-	Copyright 2004-2008, GNU Lesser General Public License,
+	Copyright 2004-2009, GNU Lesser General Public License,
 	http://www.gnu.org/licenses/lgpl.html
 
 	This program is free software: you can redistribute it and/or modify
@@ -39,7 +39,7 @@
 	   in order to improve this file for the benefit of everybody.
 
 	If you want to distribute this code, please do it as a link to:
-	http://alexandre.alapetite.net/doc-alex/domxml-php4-php5/
+	http://alexandre.alapetite.fr/doc-alex/domxml-php4-php5/
 */
 
 define('DOMXML_LOAD_PARSING',0);
@@ -179,6 +179,7 @@ class php4DOMDocument extends php4DOMNode
 	}
 	function html_dump_mem() {return $this->myDOMNode->saveHTML();}
 	function root() {return parent::_newDOMElement($this->myDOMNode->documentElement,$this);}
+	function xinclude() {return $this->myDOMNode->xinclude();}
 	function xpath_new_context() {return new php4DOMXPath($this);}
 }
 
@@ -262,7 +263,7 @@ class php4DOMNode
 				return false;
 		}
 	}
-	function add_child($newnode) {return append_child($newnode);}
+	function add_child($newnode) {return $this->append_child($newnode);}
 	function add_namespace($uri,$prefix) {return false;}
 	function append_child($newnode) {return self::_newDOMElement($this->myDOMNode->appendChild($this->_importNode($newnode)),$this->myOwnerDocument);}
 	function append_sibling($newnode) {return self::_newDOMElement($this->myDOMNode->parentNode->appendChild($this->_importNode($newnode)),$this->myOwnerDocument);}
@@ -458,8 +459,8 @@ class php4DOMXPath
 	}
 	function xpath_eval($eval_str,$contextnode=null)
 	{
-		if (method_exists($this->myDOMXPath,'evaluate')) $xp=isset($contextnode) ? $this->myDOMXPath->evaluate($eval_str,$contextnode->myDOMNode) : $this->myDOMXPath->evaluate($eval_str);
-		else $xp=isset($contextnode) ? $this->myDOMXPath->query($eval_str,$contextnode->myDOMNode) : $this->myDOMXPath->query($eval_str);
+		if (method_exists($this->myDOMXPath,'evaluate')) $xp=isset($contextnode->myDOMNode) ? $this->myDOMXPath->evaluate($eval_str,$contextnode->myDOMNode) : $this->myDOMXPath->evaluate($eval_str);
+		else $xp=isset($contextnode->myDOMNode) ? $this->myDOMXPath->query($eval_str,$contextnode->myDOMNode) : $this->myDOMXPath->query($eval_str);
 		$xp=new php4DOMNodelist($xp,$this->myOwnerDocument);
 		return ($xp->type===XPATH_UNDEFINED) ? false : $xp;
 	}
@@ -467,7 +468,7 @@ class php4DOMXPath
 }
 
 if (extension_loaded('xsl'))
-{//See also: http://alexandre.alapetite.net/doc-alex/xslt-php4-php5/
+{//See also: http://alexandre.alapetite.fr/doc-alex/xslt-php4-php5/
 	function domxml_xslt_stylesheet($xslstring) {return new php4DomXsltStylesheet(DOMDocument::loadXML($xslstring));}
 	function domxml_xslt_stylesheet_doc($dom_document) {return new php4DomXsltStylesheet($dom_document);}
 	function domxml_xslt_stylesheet_file($xslfile) {return new php4DomXsltStylesheet(DOMDocument::load($xslfile));}

auth/cas/CAS/CAS/languages/catalan.php

@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * @file languages/spanish.php
+ * @author Iván-Benjamín García Torà <ivaniclixx AT gmail DOT com>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'usant servidor',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => 'Autentificació CAS necessària!',
+ CAS_STR_LOGOUT 
+ => 'Sortida de CAS necessària!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'Ja hauria d\ haver estat redireccionat al servidor CAS. Feu click <a href="%s">aquí</a> per a continuar.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => 'Autentificació CAS fallida!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>No estàs autentificat.</p><p>Pots tornar a intentar-ho fent click <a href="%s">aquí</a>.</p><p>Si el problema persisteix hauría de contactar amb l\'<a href="mailto:%s">administrador d\'aquest llocc</a>.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => 'El servei `<b>%s</b>\' no està disponible (<b>%s</b>).'
+);
+
+?>

auth/cas/CAS/CAS/languages/english.php

@@ -1,79 +1,27 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file languages/english.php
-
-
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
-
-
- * @sa @link internalLang Internationalization @endlink
-
-
- * @ingroup internalLang
-
-
- */
-
-
-
-
-
-$this->_strings = array(
-
-
- CAS_STR_USING_SERVER 
-
-
- => 'using server',
-
-
- CAS_STR_AUTHENTICATION_WANTED 
-
-
- => 'CAS Authentication wanted!',
-
-
- CAS_STR_LOGOUT 
-
-
- => 'CAS logout wanted!',
-
-
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
-
- => 'You should already have been redirected to the CAS server. Click <a href="%s">here</a> to continue.',
-
-
- CAS_STR_AUTHENTICATION_FAILED 
-
-
- => 'CAS Authentication failed!',
-
-
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
-
- => '<p>You were not authenticated.</p><p>You may submit your request again by clicking <a href="%s">here</a>.</p><p>If the problem persists, you may contact <a href="mailto:%s">the administrator of this site</a>.</p>',
-
-
- CAS_STR_SERVICE_UNAVAILABLE
-
-
- => 'The service `<b>%s</b>\' is not available (<b>%s</b>).'
-
-
-);
-
-
-
-
-
+<?php
+
+/**
+ * @file languages/english.php
+ * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'using server',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => 'CAS Authentication wanted!',
+ CAS_STR_LOGOUT 
+ => 'CAS logout wanted!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'You should already have been redirected to the CAS server. Click <a href="%s">here</a> to continue.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => 'CAS Authentication failed!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>You were not authenticated.</p><p>You may submit your request again by clicking <a href="%s">here</a>.</p><p>If the problem persists, you may contact <a href="mailto:%s">the administrator of this site</a>.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => 'The service `<b>%s</b>\' is not available (<b>%s</b>).'
+);
+
 ?>

auth/cas/CAS/CAS/languages/french.php

@@ -1,82 +1,28 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file languages/english.php
-
-
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
-
-
- * @sa @link internalLang Internationalization @endlink
-
-
- * @ingroup internalLang
-
-
- */
-
-
-
-
-
-$this->_strings = array(
-
-
- CAS_STR_USING_SERVER 
-
-
- => 'utilisant le serveur',
-
-
- CAS_STR_AUTHENTICATION_WANTED 
-
-
- => 'Authentication CAS nécessaire&nbsp;!',
-
-
- CAS_STR_LOGOUT 
-
-
- => 'Déconnexion demandée&nbsp;!',
-
-
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
-
- => 'Vous auriez du etre redirigé(e) vers le serveur CAS. Cliquez <a href="%s">ici</a> pour continuer.',
-
-
- CAS_STR_AUTHENTICATION_FAILED 
-
-
- => 'Authentification CAS infructueuse&nbsp;!',
-
-
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
-
- => '<p>Vous n\'avez pas été authentifié(e).</p><p>Vous pouvez soumettre votre requete à nouveau en cliquant <a href="%s">ici</a>.</p><p>Si le problème persiste, vous pouvez contacter <a href="mailto:%s">l\'administrateur de ce site</a>.</p>',
-
-
- CAS_STR_SERVICE_UNAVAILABLE
-
-
- => 'Le service `<b>%s</b>\' est indisponible (<b>%s</b>)'
-
-
-
-
-
-);
-
-
-
-
-
+<?php
+
+/**
+ * @file languages/english.php
+ * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'utilisant le serveur',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => 'Authentication CAS n�cessaire&nbsp;!',
+ CAS_STR_LOGOUT 
+ => 'D�connexion demand�e&nbsp;!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'Vous auriez du etre redirig�(e) vers le serveur CAS. Cliquez <a href="%s">ici</a> pour continuer.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => 'Authentification CAS infructueuse&nbsp;!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>Vous n\'avez pas �t� authentifi�(e).</p><p>Vous pouvez soumettre votre requete � nouveau en cliquant <a href="%s">ici</a>.</p><p>Si le probl�me persiste, vous pouvez contacter <a href="mailto:%s">l\'administrateur de ce site</a>.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => 'Le service `<b>%s</b>\' est indisponible (<b>%s</b>)'
+
+);
+
 ?>

auth/cas/CAS/CAS/languages/german.php

@@ -1,79 +1,27 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file languages/german.php
-
-
- * @author Henrik Genssen <hg at mediafactory.de>
-
-
- * @sa @link internalLang Internationalization @endlink
-
-
- * @ingroup internalLang
-
-
- */
-
-
-
-
-
-$this->_strings = array(
-
-
- CAS_STR_USING_SERVER 
-
-
- => 'via Server',
-
-
- CAS_STR_AUTHENTICATION_WANTED 
-
-
- => 'CAS Authentifizierung erforderlich!',
-
-
- CAS_STR_LOGOUT 
-
-
- => 'CAS Abmeldung!',
-
-
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
-
- => 'eigentlich h&auml;ten Sie zum CAS Server weitergeleitet werden sollen. Dr&uuml;cken Sie <a href="%s">hier</a> um fortzufahren.',
-
-
- CAS_STR_AUTHENTICATION_FAILED 
-
-
- => 'CAS Anmeldung fehlgeschlagen!',
-
-
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
-
- => '<p>Sie wurden nicht angemeldet.</p><p>Um es erneut zu versuchen klicken Sie <a href="%s">hier</a>.</p><p>Wenn das Problem bestehen bleibt, kontkatieren Sie den <a href="mailto:%s">Administrator</a> dieser Seite.</p>',
-
-
- CAS_STR_SERVICE_UNAVAILABLE
-
-
- => 'Der Dienst `<b>%s</b>\' ist nicht verf&uuml;gbar (<b>%s</b>).'
-
-
-);
-
-
-
-
-
+<?php
+
+/**
+ * @file languages/german.php
+ * @author Henrik Genssen <hg at mediafactory.de>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'via Server',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => 'CAS Authentifizierung erforderlich!',
+ CAS_STR_LOGOUT 
+ => 'CAS Abmeldung!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'eigentlich h&auml;ten Sie zum CAS Server weitergeleitet werden sollen. Dr&uuml;cken Sie <a href="%s">hier</a> um fortzufahren.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => 'CAS Anmeldung fehlgeschlagen!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>Sie wurden nicht angemeldet.</p><p>Um es erneut zu versuchen klicken Sie <a href="%s">hier</a>.</p><p>Wenn das Problem bestehen bleibt, kontkatieren Sie den <a href="mailto:%s">Administrator</a> dieser Seite.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => 'Der Dienst `<b>%s</b>\' ist nicht verf&uuml;gbar (<b>%s</b>).'
+);
+
 ?>

auth/cas/CAS/CAS/languages/greek.php

@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * @file languages/greek.php
+ * @author Vangelis Haniotakis <haniotak at ucnet.uoc.gr>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => '��������������� � ������������',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => '���������� � ����������� CAS!',
+ CAS_STR_LOGOUT 
+ => '���������� � ���������� ��� CAS!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => '�� ������ �� ������ �������������� ���� ����������� CAS. ����� ���� <a href="%s">���</a> ��� �� ����������.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => '� ����������� CAS �������!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>��� ���������������.</p><p>�������� �� ����������������, �������� ���� <a href="%s">���</a>.</p><p>��� �� �������� ���������, ����� �� ����� �� ��� <a href="mailto:%s">�����������</a>.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => '� �������� `<b>%s</b>\' ��� ����� ��������� (<b>%s</b>).'
+);
+
+?>

auth/cas/CAS/CAS/languages/japanese.php

@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * @file languages/japanese.php
+ * @author fnorif (fnorif@yahoo.co.jp)
+ * 
+ * Now Encoding is EUC-JP and LF
+ **/
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'using server',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => 'CAS�ˤ��ǧ�ڤ�Ԥ��ޤ�',
+ CAS_STR_LOGOUT 
+ => 'CAS����?�����Ȥ��ޤ�!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'CAS�����Ф˹Ԥ�ɬ�פ�����ޤ�����ưŪ��ž������ʤ����� <a href="%s">������</a> �򥯥�å�����³�Ԥ��ޤ���',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => 'CAS�ˤ��ǧ�ڤ˼��Ԥ��ޤ���',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>ǧ�ڤǤ��ޤ���Ǥ���.</p><p>�⤦���٥ꥯ�����Ȥ������������<a href="%s">������</a>�򥯥�å�.</p><p>���꤬��褷�ʤ����� <a href="mailto:%s">���Υ����Ȥδ����</a>���䤤��碌�Ƥ�������.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => '�����ӥ� `<b>%s</b>\' �����ѤǤ��ޤ��� (<b>%s</b>).'
+);
+
+?>

auth/cas/CAS/CAS/languages/languages.php

@@ -1,70 +1,24 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file languages/languages.php
-
-
- * Internationalization constants
-
-
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
-
-
- * @sa @link internalLang Internationalization @endlink
-
-
- * @ingroup internalLang
-
-
- */
-
-
-
-
-
-//@{
-
-
-/**
-
-
- * a phpCAS string index
-
-
- */
-
-
-define("CAS_STR_USING_SERVER",                1);
-
-
-define("CAS_STR_AUTHENTICATION_WANTED",       2);
-
-
-define("CAS_STR_LOGOUT",                      3);
-
-
-define("CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED", 4);
-
-
-define("CAS_STR_AUTHENTICATION_FAILED",       5);
-
-
-define("CAS_STR_YOU_WERE_NOT_AUTHENTICATED",  6);
-
-
-define("CAS_STR_SERVICE_UNAVAILABLE",         7);
-
-
-//@}
-
-
-
-
-
+<?php
+
+/**
+ * @file languages/languages.php
+ * Internationalization constants
+ * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+//@{
+/**
+ * a phpCAS string index
+ */
+define("CAS_STR_USING_SERVER",                1);
+define("CAS_STR_AUTHENTICATION_WANTED",       2);
+define("CAS_STR_LOGOUT",                      3);
+define("CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED", 4);
+define("CAS_STR_AUTHENTICATION_FAILED",       5);
+define("CAS_STR_YOU_WERE_NOT_AUTHENTICATED",  6);
+define("CAS_STR_SERVICE_UNAVAILABLE",         7);
+//@}
+
 ?>

auth/cas/CAS/CAS/languages/spanish.php

@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * @file languages/spanish.php
+ * @author Iván-Benjamín García Torà <ivaniclixx AT gmail DOT com>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'usando servidor',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => '¡Autentificación CAS necesaria!',
+ CAS_STR_LOGOUT 
+ => '¡Salida CAS necesaria!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'Ya debería haber sido redireccionado al servidor CAS. Haga click <a href="%s">aquí</a> para continuar.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => '¡Autentificación CAS fallida!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>No estás autentificado.</p><p>Puedes volver a intentarlo haciendo click <a href="%s">aquí</a>.</p><p>Si el problema persiste debería contactar con el <a href="mailto:%s">administrador de este sitio</a>.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => 'El servicio `<b>%s</b>\' no está disponible (<b>%s</b>).'
+);
+
+?>

auth/cas/CAS/PGTStorage/pgt-db.php

@@ -1,568 +0,0 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file CAS/PGTStorage/pgt-db.php
-
-
- * Basic class for PGT database storage
-
-
- */
-
-
-
-
-
-// include phpDB library (the test was introduced in release 0.4.8 for 
-
-
-// the integration into Tikiwiki).
-
-
-if (!class_exists('DB')) {
-
-
-  @include_once('DB.php');
-
-
-}
-
-
-
-
-
-/**
-
-
- * @class PGTStorageDB
-
-
- * The PGTStorageDB class is a class for PGT database storage. An instance of 
-
-
- * this class is returned by CASClient::SetPGTStorageDB().
-
-
- *
-
-
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
-
-
- *
-
-
- * @ingroup internalPGTStorageDB
-
-
- */
-
-
-
-
-
-class PGTStorageDB extends PGTStorage
-
-
-{
-
-
-  /** 
-
-
-   * @addtogroup internalPGTStorageDB
-
-
-   * @{ 
-
-
-   */
-
-
-
-
-
-  /**
-
-
-   * a string representing a PEAR DB URL to connect to the database. Written by
-
-
-   * PGTStorageDB::PGTStorageDB(), read by getURL().
-
-
-   *
-
-
-   * @hideinitializer
-
-
-   * @private
-
-
-   */
-
-
-  var $_url='';
-
-
-
-
-
-  /**
-
-
-   * This method returns the PEAR DB URL to use to connect to the database.
-
-
-   *
-
-
-   * @return a PEAR DB URL
-
-
-   *
-
-
-   * @private
-
-
-   */
-
-
-  function getURL()
-
-
-    {
-
-
-      return $this->_url;
-
-
-    }
-
-
-
-
-
-  /**
-
-
-   * The handle of the connection to the database where PGT's are stored. Written by
-
-
-   * PGTStorageDB::init(), read by getLink().
-
-
-   *
-
-
-   * @hideinitializer
-
-
-   * @private
-
-
-   */
-
-
-  var $_link = null;
-
-
-
-
-
-  /**
-
-
-   * This method returns the handle of the connection to the database where PGT's are 
-
-
-   * stored.
-
-
-   *
-
-
-   * @return a handle of connection.
-
-
-   *
-
-
-   * @private
-
-
-   */
-
-
-  function getLink()
-
-
-    {
-
-
-      return $this->_link;
-
-
-    }
-
-
-
-
-
-  /**
-
-
-   * The name of the table where PGT's are stored. Written by 
-
-
-   * PGTStorageDB::PGTStorageDB(), read by getTable().
-
-
-   *
-
-
-   * @hideinitializer
-
-
-   * @private
-
-
-   */
-
-
-  var $_table = '';
-
-
-
-
-
-  /**
-
-
-   * This method returns the name of the table where PGT's are stored.
-
-
-   *
-
-
-   * @return the name of a table.
-
-
-   *
-
-
-   * @private
-
-
-   */
-
-
-  function getTable()
-
-
-    {
-
-
-      return $this->_table;
-
-
-    }
-
-
-
-
-
-  // ########################################################################
-
-
-  //  DEBUGGING
-
-
-  // ########################################################################
-
-
-  
-
-
-  /**
-
-
-   * This method returns an informational string giving the type of storage
-
-
-   * used by the object (used for debugging purposes).
-
-
-   *
-
-
-   * @return an informational string.
-
-
-   * @public
-
-
-   */
-
-
-  function getStorageType()
-
-
-    {
-
-
-      return "database";
-
-
-    }
-
-
-
-
-
-  /**
-
-
-   * This method returns an informational string giving informations on the
-
-
-   * parameters of the storage.(used for debugging purposes).
-
-
-   *
-
-
-   * @public
-
-
-   */
-
-
-  function getStorageInfo()
-
-
-    {
-
-
-      return 'url=`'.$this->getURL().'\', table=`'.$this->getTable().'\'';
-
-
-    }
-
-
-
-
-
-  // ########################################################################
-
-
-  //  CONSTRUCTOR
-
-
-  // ########################################################################
-
-
-  
-
-
-  /**
-
-
-   * The class constructor, called by CASClient::SetPGTStorageDB().
-
-
-   *
-
-
-   * @param $cas_parent the CASClient instance that creates the object.
-
-
-   * @param $user the user to access the data with
-
-
-   * @param $password the user's password
-
-
-   * @param $database_type the type of the database hosting the data
-
-
-   * @param $hostname the server hosting the database
-
-
-   * @param $port the port the server is listening on
-
-
-   * @param $database the name of the database
-
-
-   * @param $table the name of the table storing the data
-
-
-   *
-
-
-   * @public
-
-
-   */
-
-
-  function PGTStorageDB($cas_parent,$user,$password,$database_type,$hostname,$port,$database,$table)
-
-
-    {
-
-
-      phpCAS::traceBegin();
-
-
-
-
-
-      // call the ancestor's constructor
-
-
-      $this->PGTStorage($cas_parent);
-
-
-
-
-
-      if ( empty($database_type) ) $database_type = CAS_PGT_STORAGE_DB_DEFAULT_DATABASE_TYPE;
-
-
-      if ( empty($hostname) ) $hostname = CAS_PGT_STORAGE_DB_DEFAULT_HOSTNAME;
-
-
-      if ( $port==0 ) $port = CAS_PGT_STORAGE_DB_DEFAULT_PORT;
-
-
-      if ( empty($database) ) $database = CAS_PGT_STORAGE_DB_DEFAULT_DATABASE;
-
-
-      if ( empty($table) ) $table = CAS_PGT_STORAGE_DB_DEFAULT_TABLE;
-
-
-
-
-
-      // build and store the PEAR DB URL
-
-
-      $this->_url = $database_type.':'.'//'.$user.':'.$password.'@'.$hostname.':'.$port.'/'.$database;
-
-
-
-
-
-      // XXX should use setURL and setTable
-
-
-      phpCAS::traceEnd();
-
-
-    }
-
-
-  
-
-
-  // ########################################################################
-
-
-  //  INITIALIZATION
-
-
-  // ########################################################################
-
-
-  
-
-
-  /**
-
-
-   * This method is used to initialize the storage. Halts on error.
-
-
-   *
-
-
-   * @public
-
-
-   */
-
-
-  function init()
-
-
-    {
-
-
-      phpCAS::traceBegin();
-
-
-      // if the storage has already been initialized, return immediatly
-
-
-      if ( $this->isInitialized() )
-
-
-	return;
-
-
-      // call the ancestor's method (mark as initialized)
-
-
-      parent::init();
-
-
-      
-
-
-      // try to connect to the database
-
-
-      $this->_link = DB::connect($this->getURL());
-
-
-      if ( DB::isError($this->_link) ) {
-
-
-	phpCAS::error('could not connect to database ('.DB::errorMessage($this->_link).')');
-
-
-      }
-
-
-      var_dump($this->_link);
-
-
-      phpCAS::traceBEnd();
-
-
-    }
-
-
-
-
-
-  /** @} */
-
-
-}
-
-
-
-
-
-?>

auth/cas/CAS/languages/greek.php

@@ -1,79 +0,0 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file languages/greek.php
-
-
- * @author Vangelis Haniotakis <haniotak at ucnet.uoc.gr>
-
-
- * @sa @link internalLang Internationalization @endlink
-
-
- * @ingroup internalLang
-
-
- */
-
-
-
-
-
-$this->_strings = array(
-
-
- CAS_STR_USING_SERVER 
-
-
- => '÷ñçóéìïðïéåßôáé ï åîõðçñåôçôÞò',
-
-
- CAS_STR_AUTHENTICATION_WANTED 
-
-
- => 'Áðáéôåßôáé ç ôáõôïðïßçóç CAS!',
-
-
- CAS_STR_LOGOUT 
-
-
- => 'Áðáéôåßôáé ç áðïóýíäåóç áðü CAS!',
-
-
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
-
- => 'Èá Ýðñåðå íá åß÷áôå áíáêáôåõèõíèåß óôïí åîõðçñåôçôÞ CAS. ÊÜíôå êëßê <a href="%s">åäþ</a> ãéá íá óõíå÷ßóåôå.',
-
-
- CAS_STR_AUTHENTICATION_FAILED 
-
-
- => 'Ç ôáõôïðïßçóç CAS áðÝôõ÷å!',
-
-
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
-
- => '<p>Äåí ôáõôïðïéçèÞêáôå.</p><p>Ìðïñåßôå íá îáíáðñïóðáèÞóåôå, êÜíïíôáò êëßê <a href="%s">åäþ</a>.</p><p>Åáí ôï ðñüâëçìá åðéìåßíåé, åëÜôå óå åðáöÞ ìå ôïí <a href="mailto:%s">äéá÷åéñéóôÞ</a>.</p>',
-
-
- CAS_STR_SERVICE_UNAVAILABLE
-
-
- => 'Ç õðçñåóßá `<b>%s</b>\' äåí åßíáé äéáèÝóéìç (<b>%s</b>).'
-
-
-);
-
-
-
-
-
-?>

auth/cas/CAS/languages/japanese.php

@@ -1,53 +0,0 @@
-<?php
-
-
-
-/**
-
- * @file languages/japanese.php
-
- * @author fnorif (fnorif@yahoo.co.jp)
-
- * 
-
- * Now Encoding is EUC-JP and LF
-
- **/
-
-
-
-$this->_strings = array(
-
- CAS_STR_USING_SERVER 
-
- => 'using server',
-
- CAS_STR_AUTHENTICATION_WANTED 
-
- => 'CASによる認証を行います',
-
- CAS_STR_LOGOUT 
-
- => 'CASからログアウトします!',
-
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
- => 'CASサーバに行く必要があります。自動的に転送されない場合は <a href="%s">こちら</a> をクリックして続行します。',
-
- CAS_STR_AUTHENTICATION_FAILED 
-
- => 'CASによる認証に失敗しました',
-
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
- => '<p>認証できませんでした.</p><p>もう一度リクエストを送信する場合は<a href="%s">こちら</a>をクリック.</p><p>問題が解決しない場合は <a href="mailto:%s">このサイトの管理者</a>に問い合わせてください.</p>',
-
- CAS_STR_SERVICE_UNAVAILABLE
-
- => 'サービス `<b>%s</b>\' は利用できません (<b>%s</b>).'
-
-);
-
-
-
-?>

auth/cas/auth.php

@@ -97,8 +97,10 @@ class auth_plugin_cas extends auth_plugin_base {
       $username = optional_param("username");
 
       if (!empty($username)) {
-		  if (strstr($SESSION->wantsurl,'ticket') || strstr($SESSION->wantsurl,'NOCAS'))
-			  unset($SESSION->wantsurl);
+          if (isset($SESSION->wantsurl) && (strstr($SESSION->wantsurl, 'ticket') ||
+                                            strstr($SESSION->wantsurl, 'NOCAS'))) {
+              unset($SESSION->wantsurl);
+          }
           return;		
         }
 
@@ -112,6 +114,13 @@ class auth_plugin_cas extends auth_plugin_base {
 // Connection to CAS server
 	 $this->connectCAS();
 
+     if($this->config->certificate_check && $this->config->certificate_path){
+         phpCAS::setCasServerCACert($this->config->certificate_path);
+     }else{
+         // Don't try to validate the server SSL credentials
+         phpCAS::setNoCasServerValidation();
+     }
+
 	  // Gestion de la connection CAS si acc�s direct d'un ent ou autre	
 	 if (phpCAS::checkAuthentication()) {
 		$frm->username=phpCAS::getUser();
@@ -121,7 +130,7 @@ class auth_plugin_cas extends auth_plugin_base {
 		return;
 	 }	 	
 
-	  if ($_GET["loginguest"]== true) {
+          if (isset($_GET["loginguest"]) && ($_GET["loginguest"]== true)) {
 			$frm->username="guest";
 			$frm->password="guest";
 			return;
@@ -161,7 +170,7 @@ class auth_plugin_cas extends auth_plugin_base {
 	  if ($this->config->logoutcas ) {
 	        $backurl = $CFG->wwwroot;
 		  $this->connectCAS();
-	        phpCAS::logout($backurl);
+                phpCAS::logoutWithURL($backurl);
 	     }
     }
     /**
@@ -175,12 +184,13 @@ class auth_plugin_cas extends auth_plugin_base {
 	global $PHPCAS_CLIENT;
 // mode proxy CAS
 if ( !is_object($PHPCAS_CLIENT) ) {
+        // Make sure phpCAS doesn't try to start a new PHP session when connecting to the CAS server.
 	if  ($this->config->proxycas) {
-	    phpCAS::proxy($this->config->casversion, $this-> config->hostname, (int) $this->config->port, $this->config->baseuri);
+	    phpCAS::proxy($this->config->casversion, $this-> config->hostname, (int) $this->config->port, $this->config->baseuri, false);
 	}
 // mode client CAS
 	else {
-	    phpCAS::client($this->config->casversion, $this-> config->hostname, (int) $this->config->port, $this->config->baseuri);
+	    phpCAS::client($this->config->casversion, $this-> config->hostname, (int) $this->config->port, $this->config->baseuri, false);
 	}
     }
 	
@@ -196,6 +206,19 @@ if ( !is_object($PHPCAS_CLIENT) ) {
     function config_form($config, $err, $user_fields) {
         include 'config.html';
     }
+
+    /**
+     * A chance to validate form data, and last chance to
+     * do stuff before it is inserted in config_plugin
+     * @param object object with submitted configuration settings (without system magic quotes)
+     * @param array $err array of error messages
+     */
+    function validate_form(&$form, &$err) {
+        $certificate_path = trim($form->certificate_path);
+        if ($form->certificate_check && empty($certificate_path)) {
+            $err['certificate_path'] = get_string('auth_cas_certificate_path_empty', 'auth');
+        }
+    }
     /**
      * Returns the URL for changing the user's pw, or empty if the default can
      * be used.
@@ -242,6 +265,10 @@ if ( !is_object($PHPCAS_CLIENT) ) {
             $config->logoutcas = '';
         if (!isset ($config->multiauth))
             $config->multiauth = '';
+        if (!isset ($config->certificate_check))
+            $config->certificate_check = '';
+        if (!isset ($config->certificate_path))
+            $config->certificate_path = '';
         // LDAP settings
         if (!isset($config->host_url))
             { $config->host_url = ''; }
@@ -284,6 +311,8 @@ if ( !is_object($PHPCAS_CLIENT) ) {
         set_config('proxycas',     $config->proxycas,     'auth/cas');
         set_config('logoutcas',     $config->logoutcas,     'auth/cas');
         set_config('multiauth',     $config->multiauth,     'auth/cas');
+        set_config('certificate_check',     $config->certificate_check,     'auth/cas');
+        set_config('certificate_path',     $config->certificate_path,     'auth/cas');
         // save LDAP settings
         set_config('host_url', $config->host_url, 'auth/cas');
         set_config('ldapencoding', $config->ldapencoding, 'auth/cas');
@@ -364,6 +393,13 @@ if ( !is_object($PHPCAS_CLIENT) ) {
      * @return mixed array with no magic quotes or false on error
      */
     function get_userinfo($username) {
+        // No LDAP servers configured, so user info has to be provided
+        // via other methods (CSV file, manually, etc.). Return empty
+        // array so existing user info is not lost.
+        if (empty($this->config->host_url)) {
+            return array();
+        }
+
         $textlib = textlib_get_instance();
         $extusername = $textlib->convert(stripslashes($username), 'utf-8', $this->config->ldapencoding);
         $ldapconnection = $this->ldap_connect();
@@ -475,6 +511,9 @@ if ( !is_object($PHPCAS_CLIENT) ) {
             if (!empty($this->config->version)) {
                 ldap_set_option($connresult, LDAP_OPT_PROTOCOL_VERSION, $this->config->version);
             }
+            if ($this->config->user_type == 'ad') {
+                 ldap_set_option($connresult, LDAP_OPT_REFERRALS, 0);
+            }
             if (!empty($binddn)) {
                 //bind with search-user
                 //$debuginfo .= 'Using bind user'.$binddn.'and password:'.$bindpwd;
@@ -618,6 +657,12 @@ if ( !is_object($PHPCAS_CLIENT) ) {
      */
     function sync_users ($bulk_insert_records = 1000, $do_updates = true) {
         global $CFG;
+
+        if(empty($this->config->host_url)) {
+            echo "No LDAP server configured for CAS! Syncing disabled.\n";
+            return;
+        }
+
         $textlib = textlib_get_instance();
         $droptablesql = array(); /// sql commands to drop the table (because session scope could be a problem for
                                  /// some persistent drivers like ODBTP (mssql) or if this function is invoked
@@ -773,9 +818,9 @@ if ( !is_object($PHPCAS_CLIENT) ) {
                     $updateuser->id = $user->id;
                     $updateuser->auth = 'cas';
                     if (update_record('user', $updateuser)) {
-                        echo "\t"; print_string('auth_dbreviveser', 'auth', array($user->username, $user->id)); echo "\n";
+                        echo "\t"; print_string('auth_dbreviveduser', 'auth', array($user->username, $user->id)); echo "\n";
                     } else {
-                        echo "\t"; print_string('auth_dbreviveusererror', 'auth', $user->username); echo "\n";
+                        echo "\t"; print_string('auth_dbrevivedusererror', 'auth', $user->username); echo "\n";
                     }
                 }
                 commit_sql();
@@ -966,7 +1011,7 @@ if ( !is_object($PHPCAS_CLIENT) ) {
      * @return boolean result
      */
     function iscreator($username) {
-        if ((empty($this->config->attrcreators) && empty($this->config->groupecreators)) or empty($this->config->memberattribute)) {
+        if (empty($this->config->host_url) or (empty($this->config->attrcreators) && empty($this->config->groupecreators)) or empty($this->config->memberattribute)) {
             return null;
         }
         $textlib = textlib_get_instance();

auth/cas/config.html

@@ -48,6 +48,14 @@
 
         $config->multiauth = '';
 
+    if (!isset ($config->certificate_check)) 
+
+        $config->certificate_check = '';
+
+    if (!isset ($config->certificate_path))
+
+        $config->certificate_path = '';
+
   // set to defaults if undefined (LDAP)
 
     if (!isset($config->host_url))
@@ -364,6 +372,44 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
 
 
 
+<tr valign="top"  class="required">
+
+    <td align="right"><?php print_string('auth_cas_certificate_check_key', 'auth') ?>:</td>
+
+    <td>
+
+        <?php choose_from_menu ($yesno, 'certificate_check', $config->certificate_check, ''); ?>
+
+    </td>
+
+    <td><?php print_string('auth_cas_certificate_check', 'auth') ?></td>
+
+</tr>
+
+
+
+<tr valign="top" class="required">
+
+    <td align="right"><?php print_string('auth_cas_certificate_path_key', 'auth') ?>:</td>
+
+    <td>
+
+        <input name="certificate_path" type="text" size="30" value="<?php echo $config->certificate_path ?>" />
+
+        <?php if (isset($err['certificate_path'])) formerr($err['certificate_path']); ?>
+
+    </td>
+
+    <td>
+
+        <?php print_string('auth_cas_certificate_path', 'auth') ?>
+      
+    </td>
+
+</tr>
+
+
+
 <tr>
 
    <td colspan="2">
@@ -602,7 +648,7 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
 
        $opt_deref[LDAP_DEREF_ALWAYS] = get_string('yes');
 
-       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, LDAP_DEREF_NEVER, '');
+       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, '');
 
        if (isset($err['opt_deref'])) formerr($err['opt_deref']);
 

auth/db/auth.php

@@ -61,7 +61,7 @@ class auth_plugin_db extends auth_plugin_base {
                                      WHERE {$this->config->fielduser} = '".$this->ext_addslashes($extusername)."' ");
             if (!$rs) {
                 $authdb->Close();
-                print_error('auth_dbcantconnect','auth');
+                debugging(get_string('auth_dbcantconnect','auth'));
                 return false;
             }
 
@@ -94,7 +94,7 @@ class auth_plugin_db extends auth_plugin_base {
                                   AND {$this->config->fieldpass} = '".$this->ext_addslashes($extpassword)."' ");
             if (!$rs) {
                 $authdb->Close();
-                print_error('auth_dbcantconnect','auth');
+                debugging(get_string('auth_dbcantconnect','auth'));
                 return false;
             }
 
@@ -364,7 +364,7 @@ class auth_plugin_db extends auth_plugin_base {
                 if ($old_user = get_record('user', 'username', $user->username, 'deleted', 1, 'mnethostid', $user->mnethostid)) {
                     $user->id = $old_user->id;
                     set_field('user', 'deleted', 0, 'username', $user->username);
-                    echo "\t"; print_string('auth_dbreviveuser', 'auth', array(stripslashes($user->username), $user->id)); echo "\n";
+                    echo "\t"; print_string('auth_dbreviveduser', 'auth', array(stripslashes($user->username), $user->id)); echo "\n";
                 } elseif ($id = insert_record ('user',$user)) { // it is truly a new user
                     echo "\t"; print_string('auth_dbinsertuser','auth',array(stripslashes($user->username), $id)); echo "\n";
                     // if relevant, tag for password generation

auth/ldap/auth.php

@@ -723,9 +723,9 @@ class auth_plugin_ldap extends auth_plugin_base {
                     $updateuser->id = $user->id;
                     $updateuser->auth = 'ldap';
                     if (update_record('user', $updateuser)) {
-                        echo "\t"; print_string('auth_dbreviveser', 'auth', array($user->username, $user->id)); echo "\n";
+                        echo "\t"; print_string('auth_dbreviveduser', 'auth', array($user->username, $user->id)); echo "\n";
                     } else {
-                        echo "\t"; print_string('auth_dbreviveusererror', 'auth', $user->username); echo "\n";
+                        echo "\t"; print_string('auth_dbrevivedusererror', 'auth', $user->username); echo "\n";
                     }
                 }
                 commit_sql();
@@ -853,14 +853,15 @@ class auth_plugin_ldap extends auth_plugin_base {
                     if (!empty($this->config->forcechangepassword)) {
                         set_user_preference('auth_forcepasswordchange', 1, $userobj->id);
                     }
+
+                    // add course creators if needed
+                    if ($creatorrole !== false and $this->iscreator(stripslashes($user->username))) {
+                        role_assign($creatorrole->id, $id, 0, $sitecontext->id, 0, 0, 0, 'ldap');
+                    }
                 } else {
                     echo "\t"; print_string('auth_dbinsertusererror', 'auth', $user->username); echo "\n";
                 }
 
-                // add course creators if needed
-                if ($creatorrole !== false and $this->iscreator(stripslashes($user->username))) {
-                    role_assign($creatorrole->id, $user->id, 0, $sitecontext->id, 0, 0, 0, 'ldap');
-                }
             }
             commit_sql();
             unset($add_users); // free mem
@@ -1534,7 +1535,7 @@ class auth_plugin_ldap extends auth_plugin_base {
             // check cheaply if the user's DN sits in a subtree
             // of the "group" DN provided. Granted, this isn't
             // a proper LDAP group, but it's a popular usage.
-            if (strpos(strrev($memberuser), strrev($group))===0) {
+            if (strpos(strrev(strtolower($memberuser)), strrev(strtolower($group)))===0) {
                 $result = true;
                 break;
             }

auth/ldap/config.html

@@ -199,7 +199,7 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
        $opt_deref = array();
        $opt_deref[LDAP_DEREF_NEVER] = get_string('no');
        $opt_deref[LDAP_DEREF_ALWAYS] = get_string('yes');
-       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, LDAP_DEREF_NEVER, '');
+       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, '');
        if (isset($err['opt_deref'])) formerr($err['opt_deref']);
     ?>
     </td>

auth/mnet/auth.php

@@ -230,6 +230,17 @@ class auth_plugin_mnet extends auth_plugin_base {
         return $url;
     }
 
+    /**
+     * after a successful login, land.php will call complete_user_login
+     * which will in turn regenerate the session id.
+     * this means that what is stored in mnet_session table needs updating.
+     *
+     */
+    function update_session_id() {
+        global $USER;
+        return set_field('mnet_session', 'session_id', session_id(), 'username', $USER->username, 'mnethostid', $USER->mnethostid, 'useragent', sha1($_SERVER['HTTP_USER_AGENT']));
+    }
+
     /**
      * This function confirms the remote (ID provider) host's mnet session
      * by communicating the token and UA over the XMLRPC transport layer, and
@@ -291,16 +302,16 @@ class auth_plugin_mnet extends auth_plugin_base {
         // TODO: refactor into a separate function
         if (empty($localuser) || ! $localuser->id) {
             if (empty($this->config->auto_add_remote_users)) {
-                print_error('nolocaluser', 'mnet');
+                print_error('nolocaluser2', 'mnet');
             }
             $remoteuser->mnethostid = $remotehost->id;
-            if (! insert_record('user', addslashes_recursive($remoteuser))) {
+            $remoteuser->firstaccess = time(); // First time user in this server, grab it here
+
+            if (!$remoteuser->id =  insert_record('user', addslashes_recursive($remoteuser))) {
                 print_error('databaseerror', 'mnet');
             }
             $firsttime = true;
-            if (! $localuser = get_record('user', 'username', addslashes($remoteuser->username), 'mnethostid', $remotehost->id)) {
-                print_error('nolocaluser', 'mnet');
-            }
+            $localuser = $remoteuser;
         }
 
         // check sso access control list for permission first
@@ -367,6 +378,9 @@ class auth_plugin_mnet extends auth_plugin_base {
         }
 
         $localuser->mnethostid = $remotepeer->id;
+        if (empty($localuser->firstaccess)) { // Now firstaccess, grab it here
+            $localuser->firstaccess = time();
+        }
 
         $bool = update_record('user', addslashes_recursive($localuser));
         if (!$bool) {

auth/mnet/land.php

@@ -34,6 +34,7 @@ $localuser = $mnetauth->confirm_mnet_session($token, $remotewwwroot);
 // log in
 $USER = get_complete_user_data('id', $localuser->id, $localuser->mnethostid);
 complete_user_login($USER);
+$mnetauth->update_session_id();
 
 if (!empty($localuser->mnet_foreign_host_array)) {
     $USER->mnet_foreign_host_array = $localuser->mnet_foreign_host_array;

auth/shibboleth/config.html

@@ -59,7 +59,7 @@
 <tr valign="top">
     <td align="right"><?php print_string("auth_shib_idp_list", "auth") ?>:</td>
     <td>
-        <textarea name="organization_selection" rows="10" cols="30" style="overflow: auto; white-space: nowrap;"
+        <textarea name="organization_selection" rows="10" cols="30" style="overflow: auto;"
 ><?php 
         if (!isset($config->organization_selection)){
             echo  'urn:mace:organization1:providerID, Example Organization 1

backup/backup_check.html

@@ -133,7 +133,12 @@
         $backupprefs->backup_blogs = 0;
         $backupprefs->backuproleassignments = array();
 
-        print_simple_box("<font color=\"red\">".get_string("backupnoneusersinfo")."</font>","center", "70%", '', "20", "noticebox");
+        if ($backupuserinfo) { // Based on perms, decide the msg to show
+            $nousersmsgtoshow = 'backupnoneusersinfo';
+        } else {
+            $nousersmsgtoshow = 'backupmissinguserinfoperms';
+        }
+        print_simple_box("<font color=\"red\">".get_string($nousersmsgtoshow)."</font>","center", "70%", '', "20", "noticebox");
         echo "<hr />";
     }
 

backup/backuplib.php

@@ -2400,6 +2400,9 @@
             $result = $blockobject->encode_content_links($result,$mypreferences);
         }
 
+        // Finally encode some well-know links to course
+        $result = backup_course_encode_links($result, $mypreferences);
+
         if ($result != $content) {
             debugging('<br /><hr />'.s($content).'<br />changed to<br />'.s($result).'<hr /><br />');
         }
@@ -2407,6 +2410,22 @@
         return $result;
     }
 
+    /**
+     * Encode some well-know links to course. Restore will recode them to new course id
+     */
+    function backup_course_encode_links($content, $preferences) {
+        global $CFG;
+
+        $base = preg_quote($CFG->wwwroot,"/");
+
+        // Link to the course main page (it also covers "&topic=xx" and "&week=xx"
+        // because they don't become transformed (section number) in backup/restore
+        $search = '/(' . $base . '\/course\/view.php\?id\=)([0-9]+)/';
+        $result = preg_replace($search,'$@COURSEVIEWBYID*$2@$', $content);
+
+        return $result;
+    }
+
     /**
      * Callback preg_replace function used by backup_encode_absolute_links()
      * to process $@FILEPHP@$ URLs to get slasharguments independent URLs

backup/cc/schemas/cclibxml2validator.xsd

@@ -9,9 +9,10 @@
     xmlns:cc        ="http://www.imsglobal.org/xsd/imsccauth_v1p0"
     version="1.0"
     elementFormDefault  ="qualified"
-    attributeFormDefault="unqualified"    
+    attributeFormDefault="unqualified"
     >
-    
+
+    <xs:import namespace ="http://www.w3.org/XML/1998/namespace"          schemaLocation = "xml.xsd"                                      />
     <xs:import namespace ="http://www.imsglobal.org/xsd/imscc/imscp_v1p1" schemaLocation = "imscp_v1p2_localised.xsd"                     />
     <xs:import namespace ="http://ltsc.ieee.org/xsd/imscc/LOM"            schemaLocation = "domainProfile_1/lomLoose_localised.xsd"       />
     <xs:import namespace ="http://ltsc.ieee.org/xsd/LOM"                  schemaLocation = "domainProfile_2/lomLoose_localised.xsd"       />

backup/cc/schemas/xml.xsd

@@ -0,0 +1,286 @@
+<?xml version='1.0'?>
+<xs:schema targetNamespace="http://www.w3.org/XML/1998/namespace" 
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" 
+  xmlns   ="http://www.w3.org/1999/xhtml"
+  xml:lang="en">
+
+ <xs:annotation>
+  <xs:documentation>
+   <div>
+    <h1>About the XML namespace</h1>
+
+    <div class="bodytext">
+     <p>
+      This schema document describes the XML namespace, in a form
+      suitable for import by other schema documents.
+     </p>
+     <p>
+      See <a href="http://www.w3.org/XML/1998/namespace.html">
+      http://www.w3.org/XML/1998/namespace.html</a> and
+      <a href="http://www.w3.org/TR/REC-xml">
+      http://www.w3.org/TR/REC-xml</a> for information 
+      about this namespace.
+     </p>
+     <p>
+      Note that local names in this namespace are intended to be
+      defined only by the World Wide Web Consortium or its subgroups.
+      The names currently defined in this namespace are listed below.
+      They should not be used with conflicting semantics by any Working
+      Group, specification, or document instance.
+     </p>
+     <p>   
+      See further below in this document for more information about <a
+      href="#usage">how to refer to this schema document from your own
+      XSD schema documents</a> and about <a href="#nsversioning">the
+      namespace-versioning policy governing this schema document</a>.
+     </p>
+    </div>
+   </div>
+  </xs:documentation>
+ </xs:annotation>
+
+ <xs:attribute name="lang">
+  <xs:annotation>
+   <xs:documentation>
+    <div>
+     
+      <h3>lang (as an attribute name)</h3>
+      <p>
+       denotes an attribute whose value
+       is a language code for the natural language of the content of
+       any element; its value is inherited.  This name is reserved
+       by virtue of its definition in the XML specification.</p>
+     
+    </div>
+    <div>
+     <h4>Notes</h4>
+     <p>
+      Attempting to install the relevant ISO 2- and 3-letter
+      codes as the enumerated possible values is probably never
+      going to be a realistic possibility.  
+     </p>
+     <p>
+      See BCP 47 at <a href="http://www.rfc-editor.org/rfc/bcp/bcp47.txt">
+       http://www.rfc-editor.org/rfc/bcp/bcp47.txt</a>
+      and the IANA language subtag registry at
+      <a href="http://www.iana.org/assignments/language-subtag-registry">
+       http://www.iana.org/assignments/language-subtag-registry</a>
+      for further information.
+     </p>
+     <p>
+      The union allows for the 'un-declaration' of xml:lang with
+      the empty string.
+     </p>
+    </div>
+   </xs:documentation>
+  </xs:annotation>
+  <xs:simpleType>
+   <xs:union memberTypes="xs:language">
+    <xs:simpleType>    
+     <xs:restriction base="xs:string">
+      <xs:enumeration value=""/>
+     </xs:restriction>
+    </xs:simpleType>
+   </xs:union>
+  </xs:simpleType>
+ </xs:attribute>
+
+ <xs:attribute name="space">
+  <xs:annotation>
+   <xs:documentation>
+    <div>
+     
+      <h3>space (as an attribute name)</h3>
+      <p>
+       denotes an attribute whose
+       value is a keyword indicating what whitespace processing
+       discipline is intended for the content of the element; its
+       value is inherited.  This name is reserved by virtue of its
+       definition in the XML specification.</p>
+     
+    </div>
+   </xs:documentation>
+  </xs:annotation>
+  <xs:simpleType>
+   <xs:restriction base="xs:NCName">
+    <xs:enumeration value="default"/>
+    <xs:enumeration value="preserve"/>
+   </xs:restriction>
+  </xs:simpleType>
+ </xs:attribute>
+ 
+ <xs:attribute name="base" type="xs:anyURI"> <xs:annotation>
+   <xs:documentation>
+    <div>
+     
+      <h3>base (as an attribute name)</h3>
+      <p>
+       denotes an attribute whose value
+       provides a URI to be used as the base for interpreting any
+       relative URIs in the scope of the element on which it
+       appears; its value is inherited.  This name is reserved
+       by virtue of its definition in the XML Base specification.</p>
+     
+     <p>
+      See <a
+      href="http://www.w3.org/TR/xmlbase/">http://www.w3.org/TR/xmlbase/</a>
+      for information about this attribute.
+     </p>
+    </div>
+   </xs:documentation>
+  </xs:annotation>
+ </xs:attribute>
+ 
+ <xs:attribute name="id" type="xs:ID">
+  <xs:annotation>
+   <xs:documentation>
+    <div>
+     
+      <h3>id (as an attribute name)</h3> 
+      <p>
+       denotes an attribute whose value
+       should be interpreted as if declared to be of type ID.
+       This name is reserved by virtue of its definition in the
+       xml:id specification.</p>
+     
+     <p>
+      See <a
+      href="http://www.w3.org/TR/xml-id/">http://www.w3.org/TR/xml-id/</a>
+      for information about this attribute.
+     </p>
+    </div>
+   </xs:documentation>
+  </xs:annotation>
+ </xs:attribute>
+
+ <xs:attributeGroup name="specialAttrs">
+  <xs:attribute ref="xml:base"/>
+  <xs:attribute ref="xml:lang"/>
+  <xs:attribute ref="xml:space"/>
+  <xs:attribute ref="xml:id"/>
+ </xs:attributeGroup>
+
+ <xs:annotation>
+  <xs:documentation>
+   <div>
+   
+    <h3>Father (in any context at all)</h3> 
+
+    <div class="bodytext">
+     <p>
+      denotes Jon Bosak, the chair of 
+      the original XML Working Group.  This name is reserved by 
+      the following decision of the W3C XML Plenary and 
+      XML Coordination groups:
+     </p>
+     <blockquote>
+       <p>
+	In appreciation for his vision, leadership and
+	dedication the W3C XML Plenary on this 10th day of
+	February, 2000, reserves for Jon Bosak in perpetuity
+	the XML name "xml:Father".
+       </p>
+     </blockquote>
+    </div>
+   </div>
+  </xs:documentation>
+ </xs:annotation>
+
+ <xs:annotation>
+  <xs:documentation>
+   <div xml:id="usage" id="usage">
+    <h2><a name="usage">About this schema document</a></h2>
+
+    <div class="bodytext">
+     <p>
+      This schema defines attributes and an attribute group suitable
+      for use by schemas wishing to allow <code>xml:base</code>,
+      <code>xml:lang</code>, <code>xml:space</code> or
+      <code>xml:id</code> attributes on elements they define.
+     </p>
+     <p>
+      To enable this, such a schema must import this schema for
+      the XML namespace, e.g. as follows:
+     </p>
+     <pre>
+          &lt;schema . . .>
+           . . .
+           &lt;import namespace="http://www.w3.org/XML/1998/namespace"
+                      schemaLocation="http://www.w3.org/2001/xml.xsd"/>
+     </pre>
+     <p>
+      or
+     </p>
+     <pre>
+           &lt;import namespace="http://www.w3.org/XML/1998/namespace"
+                      schemaLocation="http://www.w3.org/2009/01/xml.xsd"/>
+     </pre>
+     <p>
+      Subsequently, qualified reference to any of the attributes or the
+      group defined below will have the desired effect, e.g.
+     </p>
+     <pre>
+          &lt;type . . .>
+           . . .
+           &lt;attributeGroup ref="xml:specialAttrs"/>
+     </pre>
+     <p>
+      will define a type which will schema-validate an instance element
+      with any of those attributes.
+     </p>
+    </div>
+   </div>
+  </xs:documentation>
+ </xs:annotation>
+
+ <xs:annotation>
+  <xs:documentation>
+   <div id="nsversioning" xml:id="nsversioning">
+    <h2><a name="nsversioning">Versioning policy for this schema document</a></h2>
+    <div class="bodytext">
+     <p>
+      In keeping with the XML Schema WG's standard versioning
+      policy, this schema document will persist at
+      <a href="http://www.w3.org/2009/01/xml.xsd">
+       http://www.w3.org/2009/01/xml.xsd</a>.
+     </p>
+     <p>
+      At the date of issue it can also be found at
+      <a href="http://www.w3.org/2001/xml.xsd">
+       http://www.w3.org/2001/xml.xsd</a>.
+     </p>
+     <p>
+      The schema document at that URI may however change in the future,
+      in order to remain compatible with the latest version of XML
+      Schema itself, or with the XML namespace itself.  In other words,
+      if the XML Schema or XML namespaces change, the version of this
+      document at <a href="http://www.w3.org/2001/xml.xsd">
+       http://www.w3.org/2001/xml.xsd 
+      </a> 
+      will change accordingly; the version at 
+      <a href="http://www.w3.org/2009/01/xml.xsd">
+       http://www.w3.org/2009/01/xml.xsd 
+      </a> 
+      will not change.
+     </p>
+     <p>
+      Previous dated (and unchanging) versions of this schema 
+      document are at:
+     </p>
+     <ul>
+      <li><a href="http://www.w3.org/2009/01/xml.xsd">
+	http://www.w3.org/2009/01/xml.xsd</a></li>
+      <li><a href="http://www.w3.org/2007/08/xml.xsd">
+	http://www.w3.org/2007/08/xml.xsd</a></li>
+      <li><a href="http://www.w3.org/2004/10/xml.xsd">
+	http://www.w3.org/2004/10/xml.xsd</a></li>
+      <li><a href="http://www.w3.org/2001/03/xml.xsd">
+	http://www.w3.org/2001/03/xml.xsd</a></li>
+     </ul>
+    </div>
+   </div>
+  </xs:documentation>
+ </xs:annotation>
+
+</xs:schema>
+

backup/restore_check.html

@@ -352,6 +352,40 @@
             }
         }
 
+        // Re-check all the roles creation/mapping stuff
+        if (!empty($restore->course_id)) {
+            $contexttosearch = get_context_instance(CONTEXT_COURSE, $restore->course_id);
+        // if we know the target category, check capability on it
+        } else if (!empty($restore->restore_restorecatto)) {
+            $contexttosearch = get_context_instance(CONTEXT_COURSECAT, $restore->restore_restorecatto);
+        } else {
+            $contexttosearch = get_context_instance(CONTEXT_SYSTEM);
+        }
+        $cancreateroles = has_capability('moodle/role:manage', get_context_instance(CONTEXT_SYSTEM));
+        $canassignroles = has_capability('moodle/role:assign', $contexttosearch);
+        $canoverridecaps= has_capability('moodle/role:override', $contexttosearch) || has_capability('moodle/role:safeoverride', $contexttosearch);
+        if (!empty($restore->rolesmapping)) {
+            foreach ($restore->rolesmapping as $originalrole => $targetrole) {
+                // First, if new role is selected, check used really can do that
+                if (empty($targetrole) && !$cancreateroles) {
+                    $messages[] = get_string('restorecannotcreateorassignroles');
+                    $show_continue_button = false;
+                    break;
+                }
+                // Now, check that the target role is available for role assignments
+                if (!empty($targetrole) && !$canassignroles) {
+                    $messages[] = get_string('restorecannotassignroles');
+                    $show_continue_button = false;
+                    break;
+                }
+                // Now, check that the target role is available for capability overrides
+                if (!empty($targetrole) && !$canoverridecaps) {
+                    $messages[] = get_string('restorecannotoverrideperms');
+                    $show_continue_button = false;
+                    break;
+                }
+            }
+        }
 
     /// If restoring users and backup has mnet remote users and we are restoring to different site, forbid restore to non-admins. MDL-17009
         if ($restore->users != 2 &&                                                   /// If restoring users

backup/restore_form.html

@@ -622,9 +622,10 @@ if ($restoreuserinfo) {
     $allroles = get_records('role');
 
     echo ('<table width="100%" class="restore-form-instances">');
-    echo ('<tr><td align="right" style="width:50%"><b>'.get_string('sourcerole').'</b></td><td align="left" style="width:50%"><b>'.get_string('targetrole').'</b></td></tr>');
 
     if ($info->backup_moodle_version < 2006092801) {
+        echo ('<tr><td align="right" style="width:50%"><b>'.get_string('sourcerole').'</b></td><td align="left" style="width:50%"><b>'.get_string('targetrole').'</b></td></tr>');
+
         // 1.6 and below backup
 
         /// Editting teacher
@@ -669,6 +670,20 @@ if ($restoreuserinfo) {
         // 1.7 and above backup
         $roles = restore_read_xml_roles($xml_file);
 
+        // Calculate if any role can be mapped
+        $str_new = '';
+        $canmaproles = false;
+        if (has_capability('moodle/role:manage', get_context_instance(CONTEXT_SYSTEM))) {
+            $str_new = 'new role';
+            $canmaproles = true;
+        } else if (!empty($siterolesarray)) {
+            $canmaproles = true;
+        }
+
+        if ($canmaproles) {
+            echo ('<tr><td align="right" style="width:50%"><b>'.get_string('sourcerole').'</b></td><td align="left" style="width:50%"><b>'.get_string('targetrole').'</b></td></tr>');
+        }
+
         if (!empty($roles->roles)) { // possible to have course with no roles
             foreach ($siterolesarray as $siteroleid=>$siteroleshortname) {
                 $siteroleschoicearray[$siteroleid] = $siterolesnamearray[$siteroleid]." (". $siterolesarray[$siteroleid].")";
@@ -676,7 +691,12 @@ if ($restoreuserinfo) {
 
             foreach ($roles->roles as $roleid=>$role) {
 
-                $mappableroles = $siteroleschoicearray;
+                if (!$canmaproles) { // User cannot map roles at all, add hidden element and continue
+                    echo "<tr><td colspan=\"2\"><input type=\"hidden\" name=\"roles_{$roleid}\" value=\"0\" /></td></tr>";
+                    continue;
+                }
+
+                $mappableroles = !empty($siteroleschoicearray) ? $siteroleschoicearray : array();
 
                 echo ('<tr><td align="right">');
                 echo '<label for="menuroles_'.$roleid.'">'.format_string($role->name)." (".($role->shortname).")".'</label>';
@@ -700,8 +720,21 @@ if ($restoreuserinfo) {
                             break;
                         }
                     }
+                    // Hack a bit, so, if role continues unmatched, and was "editingteacher", and "teacher" is available
+                    // preselect it as fallback matching (can happen a lot)
+                    if ($matchrole == 0 && $role->shortname == 'editingteacher' && in_array('teacher', $siterolesarray)) {
+                        $matchrole = array_search('teacher', $siterolesarray);
+                    }
+
+                    // If arrived here, role continues unmatched and the user lacks the 'moodle/role:manage' capability
+                    // perform automatic matching to site defaultcourseroleid (only if available in the list)
+                    if ($matchrole == 0 && !has_capability('moodle/role:manage', get_context_instance(CONTEXT_SYSTEM))) {
+                        if (array_key_exists($CFG->defaultcourseroleid, $siterolesarray)) {
+                            $matchrole = $CFG->defaultcourseroleid;
+                        }
+                    }
                 }
-                choose_from_menu ($mappableroles, "roles_".$roleid, $matchrole, 'new role', '', '0');
+                choose_from_menu ($mappableroles, "roles_".$roleid, $matchrole, $str_new, '', '0');
                 echo ('</td></tr>');
             }
         }

backup/restorelib.php

@@ -200,11 +200,31 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
         return $status;
     }
 
+    /**
+     * This function decodes some well-know links to course
+     */
+    function course_decode_content_links($content, $restore) {
+
+        global $CFG;
+
+        // Links to course
+        $searchstring = '/\$@(COURSEVIEWBYID)\*([0-9]+)@\$/';
+        $replacestring= $CFG->wwwroot . '/course/view.php?id=' . $restore->course_id;
+        $result = preg_replace($searchstring, $replacestring, $content);
+
+        return $result;
+    }
+
     //This function is called from all xxxx_decode_content_links_caller(),
     //its task is to ask all modules (maybe other linkable objects) to restore
     //links to them.
     function restore_decode_content_links_worker($content,$restore) {
         global $CFG;
+
+        // Course links decoder
+        $content = course_decode_content_links($content, $restore);
+
+        // Module links decoders
         foreach($restore->mods as $name => $info) {
             $function_name = $name."_decode_content_links";
             if (function_exists($function_name)) {
@@ -705,22 +725,34 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
     * Here it's the logic applied, keep it updated:
     *
     *  If restoring users from same site backup:
-    *      1A - If match by id and username and mnethost  => ok, return target user
-    *      1B - If match by id and mnethost and user is deleted in DB and
-    *           match by email LIKE 'backup_email%'  => ok, return target user
-    *      1C - If match by id and mnethost and user is deleted in backup file
+    *      1A - Normal check: If match by id and username and mnethost  => ok, return target user
+    *      1B - Handle users deleted in DB and "alive" in backup file:
+    *           If match by id and mnethost and user is deleted in DB and
+    *           (match by username LIKE 'backup_email.%' or by non empty email = md5(username)) => ok, return target user
+    *      1C - Handle users deleted in backup file and "alive" in DB:
+    *           If match by id and mnethost and user is deleted in backup file
     *           and match by email = email_without_time(backup_email) => ok, return target user
-    *      1D - If match by username and mnethost and doesn't match by id => conflict, return false
-    *      1E - else => user needs to be created, return true
+    *      1D - Conflict: If match by username and mnethost and doesn't match by id => conflict, return false
+    *      1E - None of the above, return true => User needs to be created
     *
-    *  if restoring from another site backup:
-    *      2A - If match by username and mnethost and
-    *           (email or non-zero firstaccess) => ok, return target user
-    *      2B - Note: we cannot handle "deleted" situations here as far
-    *           as username gets modified and id cannot be used here
-    *      2C - If match by username and mnethost and not
-    *           by (email or non-zero firstaccess) => conflict, return false
-    *      2D - else => user needs to be created, return true
+    *  if restoring from another site backup (cannot match by id here, replace it by email/firstaccess combination):
+    *      2A - Normal check: If match by username and mnethost and (email or non-zero firstaccess) => ok, return target user
+    *      2B - Handle users deleted in DB and "alive" in backup file:
+    *           2B1 - If match by mnethost and user is deleted in DB and not empty email = md5(username) and
+    *                 (username LIKE 'backup_email.%' or non-zero firstaccess) => ok, return target user
+    *           2B2 - If match by mnethost and user is deleted in DB and
+    *                 username LIKE 'backup_email.%' and non-zero firstaccess) => ok, return target user
+    *                 (to cover situations were md5(username) wasn't implemented on delete we requiere both)
+    *      2C - Handle users deleted in backup file and "alive" in DB:
+    *           If match mnethost and user is deleted in backup file
+    *           and by email = email_without_time(backup_email) and non-zero firstaccess=> ok, return target user
+    *      2D - Conflict: If match by username and mnethost and not by (email or non-zero firstaccess) => conflict, return false
+    *      2E - None of the above, return true => User needs to be created
+    *
+    * Note: for DB deleted users email is stored in username field, hence we
+    *       are looking there for emails. See delete_user()
+    * Note: for DB deleted users md5(username) is stored *sometimes* in the email field,
+    *       hence we are looking there for usernames if not empty. See delete_user()
     */
     function restore_check_user($restore, $user) {
         global $CFG;
@@ -734,7 +766,7 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
         }
 
         // Handle checks from same site backups
-        if (backup_is_same_site($restore)) {
+        if (backup_is_same_site($restore) && empty($CFG->forcedifferentsitecheckingusersonrestore)) {
 
             // 1A - If match by id and username and mnethost => ok, return target user
             if ($rec = get_record('user', 'id', $user->id, 'username', addslashes($user->username), 'mnethostid', $user->mnethostid)) {
@@ -742,32 +774,40 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
             }
 
             // 1B - Handle users deleted in DB and "alive" in backup file
-            // 1B1- If match by id and mnethost and user is deleted in DB and
-            //      match by email LIKE 'backup_email.%'  => ok, return target user
-            // Note: for deleted users email is stored in username field, hence we
-            //       are looking there for emails in the query below. See delete_user()
+            // Note: for DB deleted users email is stored in username field, hence we
+            //       are looking there for emails. See delete_user()
+            // Note: for DB deleted users md5(username) is stored *sometimes* in the email field,
+            //       hence we are looking there for usernames if not empty. See delete_user()
+            // If match by id and mnethost and user is deleted in DB and
+            // match by username LIKE 'backup_email.%' or by non empty email = md5(username) => ok, return target user
             if ($rec = get_record_sql("SELECT *
                                          FROM {$CFG->prefix}user u
                                         WHERE id = $user->id
                                           AND mnethostid = $user->mnethostid
                                           AND deleted = 1
-                                          AND username LIKE '$user->email.%'")) {
+                                          AND (
+                                                  username LIKE '".addslashes($user->email).".%'
+                                               OR (
+                                                      ".sql_isnotempty('user', 'email', false, false)."
+                                                  AND email = '".md5($user->username)."'
+                                                  )
+                                              )")) {
                 return $rec; // Matching user, deleted in DB found, return it
             }
 
             // 1C - Handle users deleted in backup file and "alive" in DB
-            // 1C1- If match by id and mnethost and user is deleted in backup file
-            //      and match by email = email_without_time(backup_email) => ok, return target user
+            // If match by id and mnethost and user is deleted in backup file
+            // and match by email = email_without_time(backup_email) => ok, return target user
             if ($user->deleted) {
+                // Note: for DB deleted users email is stored in username field, hence we
+                //       are looking there for emails. See delete_user()
                 // Trim time() from email
-                // Note: for deleted users email is stored in username field, hece
-                //       we are trimming the username field to get the email. See delete_user()
                 $trimemail = preg_replace('/(.*?)\.[0-9]+.?$/', '\\1', $user->username);
                 if ($rec = get_record_sql("SELECT *
                                              FROM {$CFG->prefix}user u
                                             WHERE id = $user->id
                                               AND mnethostid = $user->mnethostid
-                                              AND email = '$trimemail'")) {
+                                              AND email = '".addslashes($trimemail)."'")) {
                     return $rec; // Matching user, deleted in backup file found, return it
                 }
             }
@@ -786,38 +826,80 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
             //     (email or non-zero firstaccess) => ok, return target user
             if ($rec = get_record_sql("SELECT *
                                          FROM {$CFG->prefix}user u
-                                        WHERE username = '$user->username'
+                                        WHERE username = '".addslashes($user->username)."'
                                           AND mnethostid = $user->mnethostid
                                           AND (
-                                                  email = '$user->email'
+                                                  email = '".addslashes($user->email)."'
                                                OR (
                                                       firstaccess != 0
                                                   AND firstaccess = $user->firstaccess
                                                   )
                                               )")) {
-                return $rec; // Matching user
+                return $rec; // Matching user found, return it
             }
 
             // 2B - Handle users deleted in DB and "alive" in backup file
-            // Note: for deleted users email is stored in username field, hence we
-            //       are looking there for emails in the query below. See delete_user()
-            // Note: for deleted users md5(username) is stored *sometimes* in the
-            // email field, hence we are looking there for usernames in the query below
-            // 2B - Note: we cannot handle "deleted" situations here as far
-            //     as username gets modified and id cannot be used either
-            // 2B1-deleted = 1 AND email = md5(username) AND mnsethostid AND (username like $user->email.% OR firstaccess)
-            // 2B2 deleted and mnsethostid AND username like $user->email.% AND firstaccess
-
-            // 2C - Handle users deleted in backup file and "alive" in DB
-
-            // 2D - If match by username and mnethost and not
-            //     by (email or non-zero firstaccess) => conflict, return false
+            // Note: for DB deleted users email is stored in username field, hence we
+            //       are looking there for emails. See delete_user()
+            // Note: for DB deleted users md5(username) is stored *sometimes* in the email field,
+            //       hence we are looking there for usernames if not empty. See delete_user()
+            // 2B1 - If match by mnethost and user is deleted in DB and not empty email = md5(username) and
+            //       (by username LIKE 'backup_email.%' or non-zero firstaccess) => ok, return target user
             if ($rec = get_record_sql("SELECT *
                                          FROM {$CFG->prefix}user u
-                                        WHERE username = '$user->username'
+                                        WHERE mnethostid = $user->mnethostid
+                                          AND deleted = 1
+                                          AND ".sql_isnotempty('user', 'email', false, false)."
+                                          AND email = '".md5($user->username)."'
+                                          AND (
+                                                  username LIKE '".addslashes($user->email).".%'
+                                               OR (
+                                                      firstaccess != 0
+                                                  AND firstaccess = $user->firstaccess
+                                                  )
+                                              )")) {
+                return $rec; // Matching user found, return it
+            }
+
+            // 2B2 - If match by mnethost and user is deleted in DB and
+            //       username LIKE 'backup_email.%' and non-zero firstaccess) => ok, return target user
+            //       (this covers situations where md5(username) wasn't being stored so we require both
+            //        the email & non-zero firstaccess to match)
+            if ($rec = get_record_sql("SELECT *
+                                         FROM {$CFG->prefix}user u
+                                        WHERE mnethostid = $user->mnethostid
+                                          AND deleted = 1
+                                          AND username LIKE '".addslashes($user->email).".%'
+                                          AND firstaccess != 0
+                                          AND firstaccess = $user->firstaccess")) {
+                return $rec; // Matching user found, return it
+            }
+
+            // 2C - Handle users deleted in backup file and "alive" in DB
+            // If match mnethost and user is deleted in backup file
+            // and match by email = email_without_time(backup_email) and non-zero firstaccess=> ok, return target user
+            if ($user->deleted) {
+                // Note: for DB deleted users email is stored in username field, hence we
+                //       are looking there for emails. See delete_user()
+                // Trim time() from email
+                $trimemail = preg_replace('/(.*?)\.[0-9]+.?$/', '\\1', $user->username);
+                if ($rec = get_record_sql("SELECT *
+                                             FROM {$CFG->prefix}user u
+                                            WHERE mnethostid = $user->mnethostid
+                                              AND email = '".addslashes($trimemail)."'
+                                              AND firstaccess != 0
+                                              AND firstaccess = $user->firstaccess")) {
+                    return $rec; // Matching user, deleted in backup file found, return it
+                }
+            }
+
+            // 2D - If match by username and mnethost and not by (email or non-zero firstaccess) => conflict, return false
+            if ($rec = get_record_sql("SELECT *
+                                         FROM {$CFG->prefix}user u
+                                        WHERE username = '".addslashes($user->username)."'
                                           AND mnethostid = $user->mnethostid
                                       AND NOT (
-                                                  email = '$user->email'
+                                                  email = '".addslashes($user->email)."'
                                                OR (
                                                       firstaccess != 0
                                                   AND firstaccess = $user->firstaccess
@@ -830,7 +912,7 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
         // Arrived here, return true as the user will need to be created and no
         // conflicts have been found in the logic above. This covers:
         // 1E - else => user needs to be created, return true
-        // 2D - else => user needs to be created, return true
+        // 2E - else => user needs to be created, return true
         return true;
     }
 
@@ -885,7 +967,7 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
             $user = $rec->info;
 
             // Find the correct mnethostid for user before performing any further check
-            if (empty($user->mnethosturl) || $user->mnethosturl===$CFG->wwwroot) {
+            if (empty($user->mnethosturl) || $user->mnethosturl === $CFG->wwwroot) {
                 $user->mnethostid = $CFG->mnet_localhost_id;
             } else {
                 // fast url-to-id lookups
@@ -900,13 +982,18 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
             $usercheck = restore_check_user($restore, $user);
 
             if (is_object($usercheck)) { // No problem, we have found one user in DB to be mapped to
+                // Annotate it, for later process by restore_create_users(). Set new_id to mapping user->id
+                backup_putid($restore->backup_unique_code, 'user', $userid, $usercheck->id, $user);
 
             } else if ($usercheck === false) { // Found conflict, report it as problem
                 $problems[] = get_string('restoreuserconflict', '', $user->username);
                 $status = false;
 
             } else if ($usercheck === true) { // User needs to be created, check if we are able
-                if (!$cancreateuser) { // Cannot create, report as problem
+                if ($cancreateuser) { // Can create user, annotate it, for later process by restore_create_users(). Set new_id to 0
+                    backup_putid($restore->backup_unique_code, 'user', $userid, 0, $user);
+
+                } else { // Cannot create user, report it as problem
 
                     $problems[] = get_string('restorecannotcreateuser', '', $user->username);
                     $status = false;
@@ -1667,7 +1754,7 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
         $restoreall = true;  // set to false if any grade_item is not selected/restored
         $importing  = !empty($SESSION->restore->importing); // there should not be a way to import old backups, but anyway ;-)
 
-        if ($importing || $restore->users == 2) {
+        if ($importing) {
             $restoreall = false;
 
         } else {
@@ -1858,7 +1945,7 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
         $restoreall = true;  // set to false if any grade_item is not selected/restored or already exist
         $importing  = !empty($SESSION->restore->importing);
 
-        if ($importing || $restore->users == 2) {
+        if ($importing) {
             $restoreall = false;
 
         } else {
@@ -2704,25 +2791,17 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
         $authcache = array(); // Cache to get some bits from authentication plugins
 
         $status = true;
-        //Check it exists
-        if (!file_exists($xml_file)) {
-            $status = false;
-        }
-        //Get info from xml
-        if ($status) {
-            //info will contain the old_id of every user
-            //in backup_ids->info will be the real info (serialized)
-            $info = restore_read_xml_users($restore,$xml_file);
-        }
 
-        //Now, get evey user_id from $info and user data from $backup_ids
-        //and create the necessary db structures
+        // Users have already been checked by restore_precheck_users() so they are loaded
+        // in backup_ids table. They don't need to be loaded (parsed) from XML again. Also, note
+        // the same function has performed the needed modifications in the $user->mnethostid field
+        // so we don't need to do it again here at all. Just some checks.
 
-        if (!empty($info->users)) {
+        // Get users ids from backup_ids table
+        $userids = get_fieldset_select('backup_ids', 'old_id', "backup_code = $restore->backup_unique_code AND table_name = 'user'");
 
-        /// Grab mnethosts keyed by wwwroot, to map to id
-            $mnethosts = get_records('mnet_host', '', '',
-                                     'wwwroot', 'wwwroot, id');
+        // Have users to process, proceed with them
+        if (!empty($userids)) {
 
         /// Get languages for quick search later
             $languages = get_list_of_languages();
@@ -2732,12 +2811,25 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
 
         /// Init trailing messages
             $messages = array();
-            foreach ($info->users as $userid) {
-                $rec = backup_getid($restore->backup_unique_code,"user",$userid);
-                $user = $rec->info;
+            foreach ($userids as $userid) {
+                // Defaults
+                $user_exists = false; // By default user does not exist
+                $newid = null;        // By default, there is not newid
+
+                // Get record from backup_ids
+                $useridsdbrec = backup_getid($restore->backup_unique_code, 'user', $userid);
+
+                // Based in restore_precheck_users() calculations, if the user exists
+                // new_id must contain the id of the matching user
+                if (!empty($useridsdbrec->new_id)) {
+                    $user_exists = true;
+                    $newid = $useridsdbrec->new_id;
+                }
+
+                $user = $useridsdbrec->info;
                 foreach (array_keys(get_object_vars($user)) as $field) {
                     if (!is_array($user->$field)) {
-                        $user->$field = backup_todb($user->$field);
+                        $user->$field = backup_todb($user->$field, false);
                         if (is_null($user->$field)) {
                             $user->$field = '';
                         }
@@ -2782,31 +2874,12 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
                 //Has role teacher or student or needed
                 $is_course_user = ($is_teacher or $is_student or $is_needed);
 
-                // in case we are restoring to same server, look for user by id and username
-                // it should return record always, but in sites rebuilt from scratch
-                // and being reconstructed using course backups
-                $user_data = false;
-                if (backup_is_same_site($restore)) {
-                    $user_data = get_record('user', 'id', $user->id, 'username', addslashes($user->username));
-                }
-
                 // Only try to perform mnethost/auth modifications if restoring to another server
                 // or if, while restoring to same server, the user doesn't exists yet (rebuilt site)
                 //
                 // So existing user data in same server *won't be modified by restore anymore*,
                 // under any circumpstance. If somehting is wrong with existing data, it's server fault.
-                if (!backup_is_same_site($restore) || (backup_is_same_site($restore) && !$user_data)) {
-                    //Calculate mnethostid
-                    if (empty($user->mnethosturl) || $user->mnethosturl===$CFG->wwwroot) {
-                        $user->mnethostid = $CFG->mnet_localhost_id;
-                    } else {
-                        // fast url-to-id lookups
-                        if (isset($mnethosts[$user->mnethosturl])) {
-                            $user->mnethostid = $mnethosts[$user->mnethosturl]->id;
-                        } else {
-                            $user->mnethostid = $CFG->mnet_localhost_id;
-                        }
-                    }
+                if (!backup_is_same_site($restore) || (backup_is_same_site($restore) && !$user_exists)) {
                     //Arriving here, any user with mnet auth and using $CFG->mnet_localhost_id is wrong
                     //as own server cannot be accesed over mnet. Change auth to manual and inform about the switch
                     if ($user->auth == 'mnet' && $user->mnethostid == $CFG->mnet_localhost_id) {
@@ -2825,21 +2898,6 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
                 }
                 unset($user->mnethosturl);
 
-                //To store user->id along all the iteration
-                $newid=null;
-                //check if it exists (by username) and get its id
-                $user_exists = true;
-                if (!backup_is_same_site($restore) || !$user_data) { /// Restoring to another server, or rebuilding site (failed id&
-                                                                     /// login search above), look for existing user based on fields
-                    $user_data = get_record('user', 'username', addslashes($user->username), 'mnethostid', $user->mnethostid);
-                }
-
-                if (!$user_data) {
-                    $user_exists = false;
-                } else {
-                    $newid = $user_data->id;
-                }
-
                 //Flags to see what parts are we going to restore
                 $create_user = true;
                 $create_roles = true;
@@ -2871,8 +2929,6 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
                 if ($create_user) {
                     //Unset the id because it's going to be inserted with a new one
                     unset ($user->id);
-                    // relink the descriptions
-                    $user->description = stripslashes($user->description);
 
                 /// Disable pictures based on global setting or existing empty value (old backups can contain wrong empties)
                     if (!empty($CFG->disableuserimages) || empty($user->picture)) {
@@ -3120,7 +3176,7 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
                     }
                     backup_flush(300);
                 }
-            } /// End of loop over all the users loaded from xml
+            } /// End of loop over all the users loaded from backup_ids table
 
         /// Inform about all the messages geerated while restoring users
             if (!defined('RESTORE_SILENTLY')) {
@@ -3582,6 +3638,10 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
                             } else {
                                 $sca->userid = $USER->id;
                             }
+                            // If course scale, recode the course field
+                            if ($sca->courseid != 0) {
+                                $sca->courseid = $restore->course_id;
+                            }
                             // If scale is standard, if user lacks perms to manage standar scales
                             // 'downgrade' them to course scales
                             if ($sca->courseid == 0 and !has_capability('moodle/course:managescales', get_context_instance(CONTEXT_SYSTEM), $sca->userid)) {
@@ -8202,7 +8262,6 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
 
         // Precheck the users section, detecting various situations that can lead to problems, so
         // we stop restore before performing any further action
-        /*
         if (!defined('RESTORE_SILENTLY')) {
             echo '<li>'.get_string('restoreusersprecheck').'</li>';
         }
@@ -8216,7 +8275,6 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
             }
             return false;
         }
-        */
 
         //If we've selected to restore into new course
         //create it (course)
@@ -9046,6 +9104,7 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
      * It isn't now, just overwriting
      */
     function restore_create_roles($restore, $xmlfile) {
+        global $CFG;
         if (!defined('RESTORE_SILENTLY')) {
             echo "<li>".get_string("creatingrolesdefinitions").'</li>';
         }
@@ -9080,7 +9139,8 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
                     $status = backup_putid($restore->backup_unique_code,"role",$oldroleid,
                                      $rolemappings[$oldroleid]); // adding a new id
 
-                } else {
+                // check for permissions before create new roles
+                } else if (has_capability('moodle/role:manage', get_context_instance(CONTEXT_SYSTEM))) {
 
                     // code to make new role name/short name if same role name or shortname exists
                     $fullname = $roledata->name;
@@ -9123,7 +9183,14 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
 
                         insert_record('role_capabilities', $roleinfo);
                     }
+                } else {
+                    // map the new role to course default role
+                    if (!$default_role = get_field("course", "defaultrole", "id", $restore->course_id)) {
+                        $default_role = $CFG->defaultcourseroleid;
+                    }
+                    $status = backup_putid($restore->backup_unique_code, "role", $oldroleid, $default_role);
                 }
+
             /// Now, restore role nameincourse (only if the role had nameincourse in backup)
                 if (!empty($roledata->nameincourse)) {
                     $newrole = backup_getid($restore->backup_unique_code, 'role', $oldroleid); /// Look for target role

blocks/admin/block_admin.php

@@ -116,7 +116,7 @@ class block_admin extends block_list {
         if ($course->metacourse) {
             if (has_capability('moodle/course:managemetacourse', $context)) {
                 $strchildcourses = get_string('childcourses');
-                $this->content->items[]='<a href="importstudents.php?id='.$this->instance->pageid.'">'.$strchildcourses.'</a>';
+                $this->content->items[]='<a href="'.$CFG->wwwroot.'/course/importstudents.php?id='.$this->instance->pageid.'">'.$strchildcourses.'</a>';
                 $this->content->icons[]='<img src="'.$CFG->pixpath.'/i/course.gif" class="icon" alt="" />';
             } else if (has_capability('moodle/role:assign', $context)) {
                 $strchildcourses = get_string('childcourses');

blocks/mentees/block_mentees.php

@@ -38,7 +38,7 @@ class block_mentees extends block_base {
                                            
             $this->content->text = '<ul>';
             foreach ($usercontexts as $usercontext) {
-                $this->content->text .= '<li><a href="'.$CFG->wwwroot.'/user/view.php?id='.$usercontext->instanceid.'&amp;course=1">'.fullname($usercontext).'</a></li>';                
+                $this->content->text .= '<li><a href="'.$CFG->wwwroot.'/user/view.php?id='.$usercontext->instanceid.'&amp;course='.SITEID.'">'.fullname($usercontext).'</a></li>';
             }
             $this->content->text .= '</ul>';                    
         }

blocks/quiz_results/block_quiz_results.php

@@ -337,7 +337,7 @@ class block_quiz_results extends block_base {
                 foreach($best as $userid => $gradeid) {
                     switch($nameformat) {
                         case B_QUIZRESULTS_NAME_FORMAT_ID:
-                            $thisname = $course->student.' '.intval($users[$userid]->idnumber);
+                            $thisname = $course->student.' '.$users[$userid]->idnumber;
                         break;
                         case B_QUIZRESULTS_NAME_FORMAT_ANON:
                             $thisname = $course->student;

blocks/rss_client/block_rss_client_action.php

@@ -101,6 +101,7 @@ if (isset($rss_record)) {
 
 
 if ($act == 'updfeed') {
+    require_sesskey();
 
     if (!$managefeeds) {
         error(get_string('noguestpost', 'forum').
@@ -153,6 +154,7 @@ if ($act == 'updfeed') {
     redirect($referrer, $message);
 
 } else if ($act == 'addfeed' ) {
+    require_sesskey();
 
     $canaddprivfeeds = has_capability('block/rss_client:createprivatefeeds', $context);
     $canaddsharedfeeds = has_capability('block/rss_client:createsharedfeeds', $context);
@@ -225,6 +227,7 @@ if ($act == 'updfeed') {
     rss_print_form($act, $url, $rssid, $preferredtitle, $shared, $id, $context);
 
 } else if ($act == 'delfeed') {
+    require_sesskey();
 
     if (!$managefeeds) {
         error(get_string('noguestpost', 'forum').

blocks/search/config_global.html

@@ -122,7 +122,7 @@ if (!isset($CFG->block_search_softlock)){
     </tr>
 </table>
 
-<fieldset name="">
+<fieldset class="">
 <legend align="top"><?php print_string('pdfhandling', 'block_search') ?></legend> 
 <table cellspacing="5" width="90%">
     <tr>
@@ -147,7 +147,7 @@ if (!isset($CFG->block_search_softlock)){
 </table>
 </fieldset>
 
-<fieldset name="">
+<fieldset class="">
 <legend align="top"><?php print_string('wordhandling', 'block_search') ?></legend> 
 <table cellspacing="5" width="90%">
     <tr>
@@ -198,7 +198,7 @@ if (!empty($types)){
         $type = trim($type);
         if (preg_match("/\\b$type\\b/i", $defaultfiletypes)) continue;
 ?>
-<fieldset name="">
+<fieldset class="">
 <legend align="top"><?php echo get_string('handlingfor', 'block_search').' '.$utype ?></legend> 
 <table cellspacing="5" width="90%">
     <tr>
@@ -234,7 +234,7 @@ if (!empty($types)){
 }
 ?>
 
-<fieldset name="">
+<fieldset class="">
 <legend align="top"><?php echo get_string('searchdiscovery', 'block_search') ?></legend> 
 <table>
     <tr>
@@ -250,7 +250,7 @@ if (!empty($types)){
 </table>
 </fieldset>
 
-<fieldset name="">
+<fieldset class="">
 <legend align="top"><?php echo get_string('modulessearchswitches', 'block_search') ?></legend> 
 <table cellspacing="5" width="90%">
     <tr valign="top">
@@ -283,7 +283,7 @@ if (!$found_searchable_modules) {
 </table>
 </fieldset>
 
-<fieldset name="">
+<fieldset class="">
 <legend align="top"><?php echo get_string('blockssearchswitches', 'block_search') ?></legend> 
 <table cellspacing="5" width="90%">
     <tr valign="top">

blocks/section_links/block_section_links.php

@@ -4,7 +4,7 @@ class block_section_links extends block_base {
 
     function init() {
         $this->title = get_string('blockname', 'block_section_links');
-        $this->version = 2007101509;
+        $this->version = 2007101511;
     }
 
     function instance_config($instance) {
@@ -29,6 +29,11 @@ class block_section_links extends block_base {
         global $CFG, $USER, $COURSE;
 
         $highlight = 0;
+        if(isset($this->config)){
+            $config = $this->config;
+        } else{
+            $config = get_config('blocks/section_links');
+        }
 
         if ($this->content !== NULL) {
             return $this->content;
@@ -60,11 +65,21 @@ class block_section_links extends block_base {
             $sectionname = 'topic';
         }
         $inc = 1;
-        if ($course->numsections > 22) {
-            $inc = 2;
+
+        if(!empty($config->numsections1) and ($course->numsections > $config->numsections1)) {
+            $inc = $config->incby1;
+        } else {
+            if ($course->numsections > 22) {
+                $inc = 2;
+            }
         }
-        if ($course->numsections > 40) {
-            $inc = 5;
+
+        if(!empty($config->numsections2) and ($course->numsections > $config->numsections2)) {
+            $inc = $config->incby2;
+        } else {
+            if ($course->numsections > 40) {
+                $inc = 5;
+            }
         }
 
         if (!empty($USER->id)) {
@@ -73,7 +88,7 @@ class block_section_links extends block_base {
         if (!empty($display)) {
             $link = $CFG->wwwroot.'/course/view.php?id='.$this->instance->pageid.'&'.$sectionname.'=';
         } else {
-            $link = '#section-';
+            $link = '#sectionblock-';
         }
 
         $sql = "SELECT section, visible
@@ -112,6 +127,16 @@ class block_section_links extends block_base {
         $this->content->text = $text;
         return $this->content;
     }
+    /**
+     * Has instance config
+     * @return boolean
+     **/
+    function instance_allow_config() {
+        return true;
+    }
+    function before_delete() {
+        delete_records('config_plugins', 'plugin', 'blocks/section_links');
+    }
 }
 
 ?>

blocks/section_links/config_instance.html

@@ -0,0 +1,73 @@
+<?php
+$numberofsections = array();
+for ($i = 1; $i < 53; $i++){
+	$numberofsections[$i] = $i;
+}
+
+$increments = array();
+
+for ($i = 1; $i < 11; $i++){
+	$increments[$i] = $i;
+}
+
+if(isset($this->config)){
+	$config = $this->config;
+} else{
+	$config = get_config('blocks/section_links');
+}
+
+$selected = array();
+if (!empty($config->numsections1)) {
+    if (empty($config->incby1)) {
+        $config->incby1 = 2;
+    }
+    $selected[1] = array($config->numsections1, $config->incby1);
+} else {
+    $selected[1] = array(22, 2);
+}
+
+if (!empty($config->numsections2)) {
+    if (empty($config->incby1)) {
+        $config->incby1 = 5;
+    }
+    $selected[2] = array($config->numsections2, $config->incby2);
+} else {
+    $selected[2] = array(40, 5);
+}
+
+?>
+<table cellpadding="9" cellspacing="0">
+<?php
+for($i = 1; $i < 3; $i++){
+?>
+	<tr valign="top">
+	    <td align="right">
+	        <?php print_string('numsections'.$i, 'block_section_links'); ?>:
+	    </td>
+	    <td>
+	        <?php choose_from_menu($numberofsections, 'numsections'.$i, $selected[$i][0]); ?>
+	    </td>
+	    <td>
+	        <?php print_string('numsectionsdesc'.$i, 'block_section_links'); ?>
+	    </td>
+	</tr>
+	<tr valign="top">
+	    <td align="right">
+	        <?php print_string('incby'.$i, 'block_section_links'); ?>:
+	    </td>
+	    <td>
+	        <?php choose_from_menu($increments, 'incby'.$i, $selected[$i][1]); ?>
+	    </td>
+	    <td>
+	        <?php print_string('incbydesc'.$i, 'block_section_links'); ?>
+	    </td>
+	</tr>	
+<?php }
+?>
+<tr>
+    <td colspan="3" align="center">
+        <input type="hidden" name="sesskey" value="<?php echo sesskey();?>">
+        <input type="submit" value="<?php print_string('savechanges') ?>" />
+    </td>
+</tr>
+</table>

blocks/section_links/settings.php

@@ -0,0 +1,33 @@
+<?php
+$configs = array();
+
+$numberofsections = array();
+
+for ($i = 1; $i < 53; $i++){
+	$numberofsections[$i] = $i;
+}
+$increments = array();
+
+for ($i = 1; $i < 11; $i++){
+	$increments[$i] = $i;
+}
+
+$selected = array(1 => array(22,2), 
+                  2 => array(40,5));
+
+for($i = 1; $i < 3; $i++){
+    $configs[] = new admin_setting_configselect('numsections'.$i, get_string('numsections'.$i, 'block_section_links'), 
+                        get_string('numsectionsdesc'.$i, 'block_section_links'),
+                        $selected[$i][0], $numberofsections);
+
+    $configs[] = new admin_setting_configselect('incby'.$i, get_string('incby'.$i, 'block_section_links'), 
+                        get_string('incbydesc'.$i, 'block_section_links'),
+                        $selected[$i][1], $increments);
+}
+                                          
+foreach ($configs as $config) {
+    $config->plugin = 'blocks/section_links';
+    $settings->add($config);
+}
+
+?>

blocks/tag_youtube/block_tag_youtube.php

@@ -5,7 +5,6 @@ require_once($CFG->libdir . '/filelib.php');
 require_once($CFG->libdir . '/magpie/rss_cache.inc');
 require_once($CFG->libdir . '/phpxml/xml.php');
 
-define('YOUTUBE_DEV_KEY', 'Dlp6qqRbI28');
 define('DEFAULT_NUMBER_OF_VIDEOS', 5);
 define('YOUTUBE_CACHE_EXPIRATION', 1800);
 
@@ -22,6 +21,9 @@ class block_tag_youtube extends block_base {
 
     function specialization() {
         $this->title = !empty($this->config->title) ? $this->config->title : get_string('blockname', 'block_tag_youtube');
+        // Convert numeric categories (old YouTube API) to
+        // textual ones (new Google Data API)
+        $this->config->category = !empty($this->config->category) ? $this->category_map_old2new($this->config->category) : '0';
     }
 
     function instance_allow_multiple() {
@@ -30,7 +32,7 @@ class block_tag_youtube extends block_base {
 
     function preferred_width() {
         return 140;
-    } 
+    }
 
     function get_content() {
 
@@ -67,19 +69,18 @@ class block_tag_youtube extends block_base {
             $numberofvideos = $this->config->numberofvideos;
         }
 
-        $request = 'http://www.youtube.com/api2_rest?method=youtube.videos.list_by_playlist';
-        $request .= '&dev_id=' . YOUTUBE_DEV_KEY;
-        $request .= "&id={$this->config->playlist}";
-        $request .= "&page=1";
-        $request .= "&per_page={$numberofvideos}";
-
+        $request = 'http://gdata.youtube.com/feeds/api/playlists/' .
+                   $this->config->playlist .
+                   '?start-index=1&max-results=' .
+                   $numberofvideos .
+                   '&format=5';
         return $this->fetch_request($request);
     }
 
     function get_videos_by_tag(){
 
         $tagid = optional_param('id', 0, PARAM_INT);   // tag id - for backware compatibility
-        $tag = optional_param('tag', '', PARAM_TAG); // tag 
+        $tag = optional_param('tag', '', PARAM_TAG); // tag
 
         if ($tag) {
             $tagobject = tag_get('name', $tag);
@@ -98,11 +99,11 @@ class block_tag_youtube extends block_base {
             $numberofvideos = $this->config->numberofvideos;
         }
 
-        $request = 'http://www.youtube.com/api2_rest?method=youtube.videos.list_by_tag';
-        $request .= '&dev_id='. YOUTUBE_DEV_KEY;
-        $request .= "&tag={$querytag}";
-        $request .= "&page=1";
-        $request .= "&per_page={$numberofvideos}";
+        $request = 'http://gdata.youtube.com/feeds/api/videos?vq=' .
+                   $querytag .
+                   '&start-index=1&max-results=' .
+                   $numberofvideos .
+                   '&format=5';
 
         return $this->fetch_request($request);
     }
@@ -110,7 +111,7 @@ class block_tag_youtube extends block_base {
     function get_videos_by_tag_and_category(){
 
         $tagid = optional_param('id', 0, PARAM_INT);   // tag id - for backware compatibility
-        $tag = optional_param('tag', '', PARAM_TAG); // tag 
+        $tag = optional_param('tag', '', PARAM_TAG); // tag
 
         if ($tag) {
             $tagobject = tag_get('name', $tag);
@@ -129,12 +130,13 @@ class block_tag_youtube extends block_base {
             $numberofvideos = $this->config->numberofvideos;
         }
 
-        $request = 'http://www.youtube.com/api2_rest?method=youtube.videos.list_by_category_and_tag';
-        $request .= '&category_id='.$this->config->category;
-        $request .= '&dev_id=' . YOUTUBE_DEV_KEY;
-        $request .= "&tag={$querytag}";
-        $request .= "&page=1";
-        $request .= "&per_page={$numberofvideos}";
+        $request = 'http://gdata.youtube.com/feeds/api/videos?category=' .
+                   $this->category_map_old2new($this->config->category) .
+                   '&vq=' .
+                   $querytag .
+                   '&start-index=1&max-results=' .
+                   $numberofvideos .
+                   '&format=5';
 
         return $this->fetch_request($request);
     }
@@ -151,6 +153,8 @@ class block_tag_youtube extends block_base {
         if ( $cache_status == 'HIT' ) {
             $cached_response = $cache->get( $request );
 
+            // TODO: Stop using phpxml, switching to DOM/Simple for this
+            // TODO: Drop lib/phpxml if 0 uses in core/contrib
             $xmlobj = XML_unserialize($cached_response);
             return $this->render_video_list($xmlobj);
         }
@@ -168,6 +172,8 @@ class block_tag_youtube extends block_base {
             $cache->set($request, $response);
         }
 
+        // TODO: Stop using phpxml, switching to DOM/Simple for this
+        // TODO: Drop lib/phpxml if 0 uses in core/contrib
         $xmlobj = XML_unserialize($response);
         return $this->render_video_list($xmlobj);
     }
@@ -176,26 +182,89 @@ class block_tag_youtube extends block_base {
 
         $text = '';
         $text .= '<ul class="yt-video-entry unlist img-text">';
-        $videos = $xmlobj['ut_response']['video_list']['video'];
+        $videos = $xmlobj['feed']['entry'];
 
         if (is_array($videos) ) {
             foreach($videos as $video){
+                $url       = s($video['media:group']['media:player attr']['url']);
+                $thumbnail = s($video['media:group']['media:thumbnail']['0 attr']['url']);
+                $title     = s($video['media:group']['media:title']);
+                $seconds   = $video['media:group']['yt:duration attr']['seconds'];
+
                 $text .= '<li>';
                 $text .= '<div class="clearfix">';
-                $text .= '<a href="'. s($video['url']) . '">';
-                $text .= '<img alt="" class="youtube-thumb" src="'. $video['thumbnail_url'] .'" /></a>';
-                $text .= '</div><span><a href="'. s($video['url']) . '">'.s($video['title']).'</a></span>';
+                $text .= '<a href="'. $url . '">';
+                $text .= '<img alt="" class="youtube-thumb" src="'. $thumbnail .'" /></a>';
+                $text .= '</div><span><a href="'. $url . '">'. $title .'</a></span>';
                 $text .= '<div>';
-                $text .= format_time($video['length_seconds']);
+                $text .= format_time($seconds);
                 $text .= "</div></li>\n";
             }
-        } else { 
+        } else {
             // if youtube is offline, or for whatever reason the previous
-            // call doesn't work... 
+            // call doesn't work...
             //add_to_log(SITEID, 'blocks/tag_youtube', 'problem in getting videos off youtube');
         }
         $text .= "</ul><div class=\"clearer\"></div>\n";
         return $text;
     }
+
+    function get_categories() {
+        // TODO: Right now using sticky categories from
+        // http://gdata.youtube.com/schemas/2007/categories.cat
+        // This should be performed from time to time by the block insead
+        // and cached somewhere, avoiding deprecated ones and observing regions
+        return array (
+            '0' => get_string('anycategory', 'block_tag_youtube'),
+            'Film'  => get_string('filmsanimation', 'block_tag_youtube'),
+            'Autos' => get_string('autosvehicles', 'block_tag_youtube'),
+            'Music' => get_string('music', 'block_tag_youtube'),
+            'Animals'=> get_string('petsanimals', 'block_tag_youtube'),
+            'Sports' => get_string('sports', 'block_tag_youtube'),
+            'Travel' => get_string('travel', 'block_tag_youtube'),
+            'Games'  => get_string('gadgetsgames', 'block_tag_youtube'),
+            'Comedy' => get_string('comedy', 'block_tag_youtube'),
+            'People' => get_string('peopleblogs', 'block_tag_youtube'),
+            'News'   => get_string('newspolitics', 'block_tag_youtube'),
+            'Entertainment' => get_string('entertainment', 'block_tag_youtube'),
+            'Education' => get_string('education', 'block_tag_youtube'),
+            'Howto'  => get_string('howtodiy', 'block_tag_youtube'),
+            'Tech'   => get_string('scienceandtech', 'block_tag_youtube')
+        );
+    }
+
+    /**
+     * Provide conversion from old numeric categories available in youtube API
+     * to the new ones available in the Google API
+     *
+     * @param int $oldcat old category code
+     * @return mixed new category code or 0 (if no match found)
+     *
+     * TODO: Someday this should be applied on upgrade for all the existing
+     * block instances so we won't need the mapping any more. That would imply
+     * to implement restore handling to perform the conversion of old blocks.
+     */
+    function category_map_old2new($oldcat) {
+        $oldoptions = array (
+            0  => '0',
+            1  => 'Film',
+            2  => 'Autos',
+            23 => 'Comedy',
+            24 => 'Entertainment',
+            10 => 'Music',
+            25 => 'News',
+            22 => 'People',
+            15 => 'Animals',
+            26 => 'Howto',
+            17 => 'Sports',
+            19 => 'Travel',
+            20 => 'Games'
+        );
+        if (array_key_exists($oldcat, $oldoptions)) {
+            return $oldoptions[$oldcat];
+        } else {
+            return $oldcat;
+        }
+    }
 }
 ?>

blocks/tag_youtube/config_instance.html

@@ -12,30 +12,15 @@
 <tr valign="top">
     <td align="right"><?php print_string('category', 'block_tag_youtube'); ?>:</td>
     <td>
-        <?php 
+        <?php
                 if (isset($this->config) && isset($this->config->category)) {
                         $selected = $this->config->category;
                 } else {
                        $selected = 0;
                 }
-    /* http://youtube.com/dev_api_ref?m=youtube.videos.list_by_category_and_tag */
-                $options = array ( 0 => get_string('anycategory', 'block_tag_youtube'),
-                                   1  => get_string('filmsanimation', 'block_tag_youtube'),
-                                   2 => get_string('autosvehicles', 'block_tag_youtube'),
-                                   23 => get_string('comedy', 'block_tag_youtube'),
-                                   24 => get_string('entertainment', 'block_tag_youtube'),
-                                   10 => get_string('music', 'block_tag_youtube'),
-                                   25 => get_string('newspolitics', 'block_tag_youtube'),
-                                   22 => get_string('peopleblogs', 'block_tag_youtube'),
-                                   15 => get_string('petsanimals', 'block_tag_youtube'),
-                                   26 => get_string('howtodiy', 'block_tag_youtube'),
-                                   17 => get_string('sports', 'block_tag_youtube'),
-                                   19 => get_string('travel', 'block_tag_youtube'),
-                                   20 => get_string('gadgetsgames', 'block_tag_youtube'),
-                                   );
-
-                choose_from_menu ($options, 'category', $selected);
-        ?>    
+                $categories = $this->get_categories();
+                choose_from_menu ($categories, 'category', $selected);
+        ?>
     </td>
 </tr>
 <tr valign="top">
@@ -48,4 +33,4 @@
     <td colspan="3" align="center">
     <input type="submit" value="<?php print_string('savechanges') ?>" /></td>
 </tr>
-</table>
+</table>

blog/edit.php

@@ -108,8 +108,8 @@ switch ($action) {
             error('Incorrect blog post id');
         }
         $post->id           = $existing->id;
-        $post->subject      = $existing->subject;
-        $post->summary      = $existing->summary;
+        $post->subject      = clean_text($existing->subject);
+        $post->summary      = clean_text($existing->summary, $existing->format);
         $post->publishstate = $existing->publishstate;
         $post->format       = $existing->format;
         $post->action       = $action;

blog/edit_form.php

@@ -1,5 +1,9 @@
 <?php  // $Id$
 
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once($CFG->libdir.'/formslib.php');
 
 class blog_edit_form extends moodleform {

blog/header.php

@@ -1,5 +1,7 @@
 <?php //$Id$
 
+defined('MOODLE_INTERNAL') || die();
+
 /// Sets up blocks and navigation for index.php
 
 require_once($CFG->dirroot .'/blog/lib.php');

blog/lib.php

@@ -659,17 +659,20 @@
 
 
     /// Find the base url from $_GET variables, for print_paging_bar
+    /// WARNING:  EVIL EVIL EVIL!  This function directly acesses $_GET which is a big no no. MDL-22631
+    /// I added some clean_param() calls for now but $_GET should just not ever be used directly.  
+    /// The function is totally gone in Moodle 2.0.
     function get_baseurl($filtertype, $filterselect) {
 
-        $getcopy  = $_GET;
-
-        unset($getcopy['blogpage']);
+        unset($_GET['blogpage']);
 
         $strippedurl = strip_querystring(qualified_me());
-        if(!empty($getcopy)) {
+        if(!empty($_GET)) {
             $first = false;
             $querystring = '';
-            foreach($getcopy as $var => $val) {
+            foreach($_GET as $var => $val) {
+                $var = clean_param($var, PARAM_ALPHANUM);   // See MDL-22631
+                $val = clean_param($val, PARAM_CLEAN);
                 if(!$first) {
                     $first = true;
                     if ($var != 'filterselect' && $var != 'filtertype') {
@@ -680,8 +683,8 @@
                     }
                 } else {
                     if ($var != 'filterselect' && $var != 'filtertype') {
-                    $querystring .= '&'.$var.'='.$val;
-                    $hasparam = true;
+                        $querystring .= '&'.$var.'='.$val;
+                        $hasparam = true;
                     }
                 }
             }

calendar/event.php

@@ -334,9 +334,9 @@
 
         case 'edit':
             if(empty($form)) {
-                $form->name = $event->name;
+                $form->name = clean_text($event->name);
                 $form->courseid = $event->courseid; // Not to update, but for date validation
-                $form->description = $event->description;
+                $form->description = clean_text($event->description);
                 $form->timestart = $event->timestart;
                 $form->timeduration = $event->timeduration;
                 $form->id = $event->id;

calendar/view.php

@@ -251,7 +251,10 @@ function calendar_show_day($d, $m, $y, $courses, $groups, $users, $courseid) {
         $text.= '</div></form></div>';
     }
 
-    $text .= get_string('dayview', 'calendar').': '.calendar_course_filter_selector($getvars);
+    $text .= '<label for="cal_course_flt_jump">'.
+               get_string('dayview', 'calendar').
+             ':</label>'.
+             calendar_course_filter_selector($getvars);
 
     echo '<div class="header">'.$text.'</div>';
 
@@ -374,7 +377,7 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course
             }
         }
     }
-    
+
     // Extract information: events vs. time
     calendar_events_by_day($events, $m, $y, $eventsbyday, $durationbyday, $typesbyday, $courses);
 
@@ -517,55 +520,51 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course
 
     echo "</table>\n"; // Tabular display of days ends
 
-	// OK, now for the filtering display 	 
-	     echo '<div class="filters"><table><tr>'; 	 
-	  	 
-	     // Global events 	 
-	     if($SESSION->cal_show_global) { 	 
-	         echo '<td class="event_global" style="width: 8px;"></td><td><strong>'.get_string('globalevents', 'calendar').':</strong> '; 	 
-	         echo get_string('shown', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showglobal&amp;'.$getvars.'">'.get_string('clickhide', 'calendar').'</a>)</td>'."\n"; 	 
-	     } 	 
-	     else { 	 
-	         echo '<td style="width: 8px;"></td><td><strong>'.get_string('globalevents', 'calendar').':</strong> '; 	 
-	         echo get_string('hidden', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showglobal&amp;'.$getvars.'">'.get_string('clickshow', 'calendar').'</a>)</td>'."\n"; 	 
-	     } 	 
-	  	 
-	     // Course events 	 
-	     if(!empty($SESSION->cal_show_course)) { 	 
-	         echo '<td class="event_course" style="width: 8px;"></td><td><strong>'.get_string('courseevents', 'calendar').':</strong> '; 	 
-	         echo get_string('shown', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showcourses&amp;'.$getvars.'">'.get_string('clickhide', 'calendar').'</a>)</td>'."\n"; 	 
-	     } 	 
-	     else { 	 
-	         echo '<td style="width: 8px;"></td><td><strong>'.get_string('courseevents', 'calendar').':</strong> '; 	 
-	         echo get_string('hidden', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showcourses&amp;'.$getvars.'">'.get_string('clickshow', 'calendar').'</a>)</td>'."\n"; 	 
-	     } 	 
-	  	 
-	     echo "</tr>\n"; 	 
-	  	 
-	     if(!empty($USER->id) && !isguest()) { 	 
-	         echo '<tr>'; 	 
-	         // Group events 	 
-	         if($SESSION->cal_show_groups) { 	 
-	             echo '<td class="event_group" style="width: 8px;"></td><td><strong>'.get_string('groupevents', 'calendar').':</strong> '; 	 
-	             echo get_string('shown', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showgroups&amp;'.$getvars.'">'.get_string('clickhide', 'calendar').'</a>)</td>'."\n"; 	 
-	         } 	 
-	         else { 	 
-	             echo '<td style="width: 8px;"></td><td><strong>'.get_string('groupevents', 'calendar').':</strong> '; 	 
-	             echo get_string('hidden', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showgroups&amp;'.$getvars.'">'.get_string('clickshow', 'calendar').'</a>)</td>'."\n"; 	 
-	         } 	 
-	         // User events 	 
-	         if($SESSION->cal_show_user) { 	 
-	             echo '<td class="event_user" style="width: 8px;"></td><td><strong>'.get_string('userevents', 'calendar').':</strong> '; 	 
-	             echo get_string('shown', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showuser&amp;'.$getvars.'">'.get_string('clickhide', 'calendar').'</a>)</td>'."\n"; 	 
-	         } 	 
-	         else { 	 
-	             echo '<td style="width: 8px;"></td><td><strong>'.get_string('userevents', 'calendar').':</strong> '; 	 
-	             echo get_string('hidden', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showuser&amp;'.$getvars.'">'.get_string('clickshow', 'calendar').'</a>)</td>'."\n"; 	 
-	         } 	 
-	         echo "</tr>\n"; 	 
-	     } 	 
-	  	 
-	     echo '</table></div>';
+    // OK, now for the filtering display
+    echo '<div class="filters"><table><tr>';
+
+    // Global events
+    if($SESSION->cal_show_global) {
+        echo '<td class="event_global" style="width: 8px;"></td><td><strong>'.get_string('globalevents', 'calendar').':</strong> ';
+        echo get_string('shown', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showglobal&amp;'.$getvars.'">'.get_string('clickhide', 'calendar').'</a>)</td>'."\n";
+    } else {
+        echo '<td style="width: 8px;"></td><td><strong>'.get_string('globalevents', 'calendar').':</strong> ';
+        echo get_string('hidden', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showglobal&amp;'.$getvars.'">'.get_string('clickshow', 'calendar').'</a>)</td>'."\n";
+    }
+
+    // Course events
+    if(!empty($SESSION->cal_show_course)) {
+        echo '<td class="event_course" style="width: 8px;"></td><td><strong>'.get_string('courseevents', 'calendar').':</strong> ';
+        echo get_string('shown', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showcourses&amp;'.$getvars.'">'.get_string('clickhide', 'calendar').'</a>)</td>'."\n";
+    } else {
+        echo '<td style="width: 8px;"></td><td><strong>'.get_string('courseevents', 'calendar').':</strong> ';
+        echo get_string('hidden', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showcourses&amp;'.$getvars.'">'.get_string('clickshow', 'calendar').'</a>)</td>'."\n";
+    }
+
+    echo "</tr>\n";
+
+    if(!empty($USER->id) && !isguest()) {
+        echo '<tr>';
+        // Group events
+        if($SESSION->cal_show_groups) {
+            echo '<td class="event_group" style="width: 8px;"></td><td><strong>'.get_string('groupevents', 'calendar').':</strong> ';
+            echo get_string('shown', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showgroups&amp;'.$getvars.'">'.get_string('clickhide', 'calendar').'</a>)</td>'."\n";
+        } else {
+            echo '<td style="width: 8px;"></td><td><strong>'.get_string('groupevents', 'calendar').':</strong> ';
+            echo get_string('hidden', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showgroups&amp;'.$getvars.'">'.get_string('clickshow', 'calendar').'</a>)</td>'."\n";
+        }
+        // User events
+        if($SESSION->cal_show_user) {
+            echo '<td class="event_user" style="width: 8px;"></td><td><strong>'.get_string('userevents', 'calendar').':</strong> ';
+            echo get_string('shown', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showuser&amp;'.$getvars.'">'.get_string('clickhide', 'calendar').'</a>)</td>'."\n";
+        } else {
+            echo '<td style="width: 8px;"></td><td><strong>'.get_string('userevents', 'calendar').':</strong> ';
+            echo get_string('hidden', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showuser&amp;'.$getvars.'">'.get_string('clickshow', 'calendar').'</a>)</td>'."\n";
+        }
+        echo "</tr>\n";
+    }
+
+    echo '</table></div>';
 }
 
 function calendar_show_upcoming_events($courses, $groups, $users, $futuredays, $maxevents, $courseid) {
@@ -581,15 +580,14 @@ function calendar_show_upcoming_events($courses, $groups, $users, $futuredays, $
         $text.= '<div>';
         $text.= '<input type="hidden" name="action" value="new" />';
         $text.= '<input type="hidden" name="course" value="'.$courseid.'" />';
-        /*
-        $text.= '<input type="hidden" name="cal_m" value="'.$m.'" />';
-        $text.= '<input type="hidden" name="cal_y" value="'.$y.'" />';
-        */
         $text.= '<input type="submit" value="'.get_string('newevent', 'calendar').'" />';
         $text.= '</div></form></div>';
     }
 
-    $text .= get_string('upcomingevents', 'calendar').': '.calendar_course_filter_selector('from=upcoming');
+    $text .= '<label for="cal_course_flt_jump">'.
+               get_string('upcomingevents', 'calendar').
+             ': </label>'.
+             calendar_course_filter_selector('from=upcoming');
 
     echo '<div class="header">'.$text.'</div>';
 

config-dist.php

@@ -28,6 +28,7 @@
 //                                                                       //
 ///////////////////////////////////////////////////////////////////////////
 unset($CFG);  // Ignore this line
+$CFG = new stdClass();
 
 //=========================================================================
 // 1. DATABASE SETUP
@@ -176,6 +177,22 @@ $CFG->admin = 'admin';
 // shared out from your site/institution!
 //      $CFG->includeuserpasswordsinbackup = true;
 //
+// Completely disable user creation when restoring a course, bypassing any
+// permissions granted via roles and capabilities. Enabling this setting
+// results in the restore process stopping when a user attempts to restore a
+// course requiring users to be created.
+//     $CFG->disableusercreationonrestore = true;
+//
+// Modify the restore process in order to force the "user checks" to assume
+// that the backup originated from a different site, so detection of matching
+// users is performed with different (more "relaxed") rules. Note that this is
+// only useful if the backup file has been created using Moodle < 1.9.4 and the
+// site has been rebuilt from scratch using backup files (not the best way btw).
+// If you obtain user conflicts on restore, rather than enabling this setting
+// permanently, try restoring the backup on a different site, back it up again
+// and then restore on the target server.
+//    $CFG->forcedifferentsitecheckingusersonrestore = true;
+//
 // Prevent stats processing and hide the GUI
 //      $CFG->disablestatsprocessing = true;
 //
@@ -347,6 +364,8 @@ $CFG->admin = 'admin';
 // When working with production data on test servers, no emails should ever be send to real users
 // $CFG->noemailever = true;
 //
+// Divert all outgoing emails to this address to test and debug emailing features
+// $CFG->divertallemailsto = 'root@localhost.local';
 //
 //=========================================================================
 // ALL DONE!  To continue installation, visit your main page with a browser

course/category.php

@@ -57,15 +57,28 @@
         if ($resort and confirm_sesskey()) {
             if ($courses = get_courses($category->id, "fullname ASC", 'c.id,c.fullname,c.sortorder')) {
                 // move it off the range
-                $count = get_record_sql('SELECT MAX(sortorder) AS max, 1
+                
+                $sortorderresult = get_record_sql('SELECT MIN(sortorder) AS min, 1
                                          FROM ' . $CFG->prefix . 'course WHERE category=' . $category->id);
-                $count = $count->max + 100;
+                $sortordermin = $sortorderresult->min;
+
+                $sortorderresult = get_record_sql('SELECT MAX(sortorder) AS max, 1
+                                         FROM ' . $CFG->prefix . 'course WHERE category=' . $category->id);
+                $sortorder = $sortordermax = $sortorderresult->max + 100;
+
+                //place the courses above the maximum existing sortorder to avoid duplicate index errors
+                //after they've been sorted we'll shift them down again
                 begin_sql();
                 foreach ($courses as $course) {
-                    set_field('course', 'sortorder', $count, 'id', $course->id);
-                    $count++;
+                    set_field('course', 'sortorder', $sortorder, 'id', $course->id);
+                    $sortorder++;
                 }
                 commit_sql();
+
+                //shift course sortorder back down the amount we moved them up
+                execute_sql('UPDATE '. $CFG->prefix .'course SET sortorder = sortorder-'.($sortordermax-$sortordermin).
+                        ' WHERE category='.$category->id);
+
                 fix_course_sortorder($category->id);
             }
         }

course/delete_category_form.php

@@ -1,5 +1,9 @@
 <?php  //$Id$
 
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once($CFG->libdir.'/formslib.php');
 require_once($CFG->libdir . '/questionlib.php');
 

course/edit.php

@@ -84,11 +84,11 @@
 /// process data if submitted
 
         //preprocess data
-        if ($data->enrolstartdisabled){
+        if (!empty($data->enrolstartdisabled)) {
             $data->enrolstartdate = 0;
         }
 
-        if ($data->enrolenddisabled) {
+        if (!empty($data->enrolenddisabled)) {
             $data->enrolenddate = 0;
         }
 

course/edit_form.php

@@ -1,5 +1,9 @@
 <?php  //$Id$
 
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once($CFG->libdir.'/formslib.php');
 
 class course_edit_form extends moodleform {

course/editcategory.php

@@ -61,6 +61,8 @@ if ($mform->is_cancelled()) {
         // Update an existing category.
         $newcategory->id = $category->id;
         if ($newcategory->parent != $category->parent) {
+            // check category manage capability if parent changed
+            require_capability('moodle/category:manage', get_category_or_system_context((int)$newcategory->parent));
             $parent_cat = get_record('course_categories', 'id', $newcategory->parent);
             move_category($newcategory, $parent_cat);
         }

course/editcategory_form.php

@@ -9,11 +9,17 @@ class editcategory_form extends moodleform {
         $category = $this->_customdata;
 
         // get list of categories to use as parents, with site as the first one
-        $options = array(get_string('top'));
+        $options = array();
+        if (has_capability('moodle/category:manage', get_system_context()) || $category->parent == 0) {
+            $options[0] = get_string('top');
+        }
         $parents = array();
         if ($category->id) {
             // Editing an existing category.
             make_categories_list($options, $parents, 'moodle/category:manage', $category->id);
+            if (empty($options[$category->parent])) {
+               $options[$category->parent] = get_field('course_categories', 'name', 'id', $category->parent);
+            }
             $strsubmit = get_string('savechanges');
         } else {
             // Making a new category

course/format/topics/ajax.php

@@ -5,6 +5,6 @@
 
 
 $CFG->ajaxcapable = true;
-$CFG->ajaxtestedbrowsers = array('MSIE' => 6.0, 'Gecko' => 20061111);
+$CFG->ajaxtestedbrowsers = array('MSIE' => 6.0, 'Gecko' => 20061111, 'Safari'=>531, 'Chrome'=>6.0);
 
 ?>

course/format/topics/format.php

@@ -113,7 +113,7 @@
 
     if ($thissection->summary or $thissection->sequence or isediting($course->id)) {
         echo '<tr id="section-0" class="section main">';
-        echo '<td class="left side">&nbsp;</td>';
+        echo '<td id="sectionblock-0" class="left side">&nbsp;</td>';
         echo '<td class="content">';
         
         echo '<div class="summary">';
@@ -194,7 +194,7 @@
             }
 
             echo '<tr id="section-'.$section.'" class="section main'.$sectionstyle.'">';
-            echo '<td class="left side">'.$currenttext.$section.'</td>';
+            echo '<td id="sectionblock-'.$section.'" class="left side">'.$currenttext.$section.'</td>';
 
             echo '<td class="content">';
             if (!has_capability('moodle/course:viewhiddensections', $context) and !$thissection->visible) {   // Hidden for students
@@ -221,11 +221,11 @@
             echo '<td class="right side">';
             if ($displaysection == $section) {      // Show the zoom boxes
                 echo '<a href="view.php?id='.$course->id.'&amp;topic=0#section-'.$section.'" title="'.$strshowalltopics.'">'.
-                     '<img src="'.$CFG->pixpath.'/i/all.gif" alt="'.$strshowalltopics.'" /></a><br />';
+                     '<img src="'.$CFG->pixpath.'/i/all.gif" class="icon topicall" alt="'.$strshowalltopics.'" /></a><br />';
             } else {
                 $strshowonlytopic = get_string('showonlytopic', '', $section);
                 echo '<a href="view.php?id='.$course->id.'&amp;topic='.$section.'" title="'.$strshowonlytopic.'">'.
-                     '<img src="'.$CFG->pixpath.'/i/one.gif" alt="'.$strshowonlytopic.'" /></a><br />';
+                     '<img src="'.$CFG->pixpath.'/i/one.gif" class="icon topicone" alt="'.$strshowonlytopic.'" /></a><br />';
             }
 
             if (isediting($course->id) && has_capability('moodle/course:update', get_context_instance(CONTEXT_COURSE, $course->id))) {

course/format/weeks/ajax.php

@@ -5,6 +5,6 @@
 
 
 $CFG->ajaxcapable = true;
-$CFG->ajaxtestedbrowsers = array('MSIE' => 6.0, 'Gecko' => 20061111);
+$CFG->ajaxtestedbrowsers = array('MSIE' => 6.0, 'Gecko' => 20061111, 'Safari'=>531, 'Chrome'=>6.0);
 
 ?>

course/format/weeks/format.php

@@ -100,7 +100,7 @@
 
     if ($thissection->summary or $thissection->sequence or isediting($course->id)) {
         echo '<tr id="section-0" class="section main">';
-        echo '<td class="left side">&nbsp;</td>';
+        echo '<td id="sectionblock-0" class="left side">&nbsp;</td>';
         echo '<td class="content">';
         
         echo '<div class="summary">';
@@ -187,7 +187,7 @@
             }
 
             echo '<tr id="section-'.$section.'" class="section main'.$sectionstyle.'">';
-            echo '<td class="left side">&nbsp;'.$currenttext.'</td>';
+            echo '<td id="sectionblock-'.$section.'" class="left side">&nbsp;'.$currenttext.'</td>';
 
             $weekperiod = $weekday.' - '.$endweekday;
 

course/import/activities/mod.php

@@ -29,7 +29,7 @@
     $taught_courses = array();
     if (!empty($tcourseids)) {
         $tcourseids = substr($tcourseids,0,-1);
-        $taught_courses = get_records_list('course', 'id', $tcourseids, 'sortorder');
+        $taught_courses = get_records_list('course', 'id', $tcourseids, 'sortorder', 'id, fullname');
     }
 
     if (!empty($creator)) {

course/import/groups/index.php

@@ -1,4 +1,4 @@
-<?php // $Id: uploadgroups.php, 2005/10/31 19:09:31
+<?php // $Id$
 
 /// Bulk group creation registration script from a comma separated file
 

course/lib.php

@@ -656,9 +656,7 @@ function print_log_xls($course, $user, $date, $order='l.time DESC', $modname,
         }
 
         $myxls->write($row, 0, $courses[$log->course], '');
-        // Excel counts from 1/1/1900
-        $excelTime=25569+$log->time/(3600*24);
-        $myxls->write($row, 1, $excelTime, $formatDate);
+        $myxls->write_date($row, 1, $log->time, $formatDate); // write_date() does conversion/timezone support. MDL-14934
         $myxls->write($row, 2, $log->ip, '');
         $fullname = fullname($log, has_capability('moodle/site:viewfullnames', get_context_instance(CONTEXT_COURSE, $course->id)));
         $myxls->write($row, 3, $fullname, '');

course/moodleform_mod.php

@@ -1,4 +1,9 @@
 <?php
+
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once ($CFG->libdir.'/formslib.php');
 /**
  * This class adds extra methods to form wrapper specific to be used for module

course/recent_form.php

@@ -1,5 +1,9 @@
 <?php //$$
 
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once($CFG->libdir.'/formslib.php');
 
 class recent_form extends moodleform {

course/report/log/indexlive.php

@@ -6,7 +6,7 @@
     require_once('lib.php');
     require_once($CFG->libdir.'/adminlib.php');
 
-    $id = optional_param('id', 0, PARAM_INT);// Course ID
+    $id = required_param('id', PARAM_INT);// Course ID
 
     if (!$course = get_record('course', 'id', $id) ) {
         error('That\'s an invalid course id'.$id);
@@ -21,7 +21,7 @@
     $strreports = get_string('reports');
 
     if ($course->id == SITEID) {
-        admin_externalpage_setup('reportloglive');
+        admin_externalpage_setup('reportloglive','',array('id' => $course->id));
         admin_externalpage_print_header();
 
     } else {

course/report/participation/index.php

@@ -170,38 +170,36 @@
 
         switch ($action) {
             case 'view':
-                $actionsql = 'l.action IN (\''.implode('\',\'', $viewnames).'\' )';
+                $actionsql = 'action IN (\''.implode('\',\'', $viewnames).'\' )';
                 break;
             case 'post':
-                $actionsql = 'l.action IN (\''.implode('\',\'', $postnames).'\' )';
+                $actionsql = 'action IN (\''.implode('\',\'', $postnames).'\' )';
                 break;
             default:
                 // some modules have stuff we want to hide, ie mail blocked etc so do actually need to limit here.
-                $actionsql = 'l.action IN (\''.implode('\',\'', array_merge($viewnames, $postnames)).'\' )';
+                $actionsql = 'action IN (\''.implode('\',\'', array_merge($viewnames, $postnames)).'\' )';
         }
 
         $relatedcontexts = get_related_contexts_string($context);
 
-        $sql = "SELECT ra.userid, u.firstname, u.lastname, u.idnumber, COUNT(l.action) AS count
-                  FROM {$CFG->prefix}role_assignments ra
-                       JOIN {$CFG->prefix}user u           ON u.id = ra.userid
-                       LEFT OUTER JOIN {$CFG->prefix}log l ON (l.userid = ra.userid AND l.cmid = $instanceid AND l.time > $timefrom AND $actionsql)
-                 WHERE ra.contextid $relatedcontexts AND ra.roleid = $roleid";
+        $sql = "SELECT ra.userid, u.firstname, u.lastname, u.idnumber, l.actioncount AS count
+                FROM (SELECT * FROM {$CFG->prefix}role_assignments WHERE contextid $relatedcontexts AND roleid = $roleid ) ra
+                JOIN {$CFG->prefix}user u ON u.id = ra.userid
+                LEFT JOIN (
+                    SELECT userid, COUNT(action) AS actioncount FROM {$CFG->prefix}log WHERE cmid = $instanceid AND time > $timefrom AND $actionsql GROUP BY userid
+                ) l ON (l.userid = ra.userid)";
+
 
         if ($table->get_sql_where()) {
-            $sql .= ' AND '.$table->get_sql_where(); //initial bar
+            $sql .= ' WHERE '.$table->get_sql_where(); //initial bar
         }
 
-        $sql .= " GROUP BY ra.userid, u.firstname, u.lastname, u.idnumber";
-
         if ($table->get_sql_sort()) {
             $sql .= ' ORDER BY '.$table->get_sql_sort();
         }
 
         $countsql = "SELECT COUNT(DISTINCT(ra.userid))
                        FROM {$CFG->prefix}role_assignments ra
-                            JOIN {$CFG->prefix}user u           ON u.id = ra.userid
-                            LEFT OUTER JOIN {$CFG->prefix}log l ON (l.userid = ra.userid AND l.cmid = $instanceid AND l.time > $timefrom AND $actionsql)
                       WHERE ra.contextid $relatedcontexts AND ra.roleid = $roleid";
 
         $totalcount = count_records_sql($countsql);

course/request_form.php

@@ -31,6 +31,10 @@
  * @package course
  *//** */
 
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once($CFG->libdir.'/formslib.php');
 
 /**

course/reset_form.php

@@ -1,4 +1,8 @@
 <?php // $Id$
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once $CFG->libdir.'/formslib.php';
 
 class course_reset_form extends moodleform {

course/rest.php

@@ -21,6 +21,8 @@ $summary    = optional_param('summary', '', PARAM_RAW);
 $sequence   = optional_param('sequence', '', PARAM_SEQUENCE);
 $visible    = optional_param('visible', 0, PARAM_INT);
 $pageaction = optional_param('action', '', PARAM_ALPHA); // Used to simulate a DELETE command
+$positiontoinsert = optional_param('positiontoinsert', '', PARAM_ALPHA);
+$positiontoinsertid = optional_param('positiontoinsertid', '', PARAM_RAW);
 
 // Authorise the user and verify some incoming data
 if (!$course = get_record('course', 'id', $courseid)) {
@@ -45,7 +47,7 @@ require_login($course->id);
 require_capability('moodle/course:update', $context);
 
 if (!empty($CFG->disablecourseajax)) {
-    errorl_log('Course AJAX not allowed');
+    error_log('Course AJAX not allowed');
     die;
 }
 
@@ -234,7 +236,7 @@ switch($req_method) {
     case 'DELETE':
         switch ($class) {
             case 'block':
-                blocks_execute_action($PAGE, $pageblocks, 'delete', $blockinstance);
+                blocks_execute_action($PAGE, $pageblocks, 'delete', $blockinstance, false, false);
                 break;
 
             case 'resource':

course/scales.php

@@ -73,7 +73,7 @@
     } else {
         if (has_capability('moodle/course:managescales', $context)) {
             echo "<p align=\"center\">(";
-            print_string("scalestip");
+            print_string("scalestip2");
             echo ")</p>";
         }
     }

enrol/README.txt

@@ -87,7 +87,7 @@ Cron
 ====
 
 If your class offers a cron() method, it will be invoked by
-the standard Moodle cron every 5 minutes. Note that if the
+the standard Moodle cron every time it is called. Note that if the
 tasks are not lightweight you must control how frequently they
 execute, perhaps offering a config option.
 

enrol/database/enrol.php

@@ -93,7 +93,7 @@ function setup_enrolments(&$user) {
                 //error_log('[ENROL_DB] Found '.count($existing).' existing roles and '.$count.' in external database');
 
                 foreach ($courselist as $coursefield) {   /// Check the list of courses against existing
-                    $course = get_record('course', $CFG->enrol_localcoursefield, $coursefield);
+                    $course = get_record('course', $CFG->enrol_localcoursefield, addslashes($coursefield));
                     if (!is_object($course)) {
                         if (empty($CFG->enrol_db_autocreate)) { // autocreation not allowed
                             if (debugging('',DEBUG_ALL)) {
@@ -157,7 +157,7 @@ function setup_enrolments(&$user) {
                     if ($role_assignment->enrol == 'database') {
                         //error_log('[ENROL_DB] Removing user from context '.$role_assignment->contextid);
                         role_unassign($role_assignment->roleid, $user->id, '', $role_assignment->contextid);
-                    } 
+                    }
                 }
             }
         } else {
@@ -231,7 +231,7 @@ function sync_enrolments($role = null) {
         $course = false;
         $course = get_record( 'course',
                               $CFG->enrol_localcoursefield,
-                              $extcourse );
+                              addslashes($extcourse) );
 
         if (!is_object($course)) {
             if (empty($CFG->enrol_db_autocreate)) { // autocreation not allowed

enrol/imsenterprise/enrol.php

@@ -516,11 +516,12 @@ function process_group_tag($tagcontents){
                         // Else if we're allowed to create new categories, let's create this one
                         $newcat->name = $group->category;
                        $newcat->visible = 0;
-                       if($catid = insert_record('course_categories', $newcat)){
+                       if($catid = insert_record('course_categories', addslashes_object($newcat))){
                            $course->category = $catid;
                            $this->log_line("Created new (hidden) category, #$catid: $newcat->name");
                        }else{
-                           $this->log_line('Failed to create new category: '.$newcat->name);
+                           $this->log_line('Failed to create new category: '.$newcat->name.' so using default category instead.');
+                           $course->category = 1;
                        }
                     }else{
                         // If not found and not allowed to create, stick with default

enrol/ldap/enrol.php

@@ -4,8 +4,8 @@ require_once("$CFG->dirroot/enrol/enrol.class.php");
 
 class enrolment_plugin_ldap {
 
-    var $log;    
-    
+    var $log;
+
     var $enrol_localcoursefield = 'idnumber';
 
 /**
@@ -23,7 +23,7 @@ function setup_enrolments(&$user) {
         notify("[ENROL_LDAP] LDAP-module cannot connect to server: {$CFG->enrol_ldap_host_url}");
         return false;
     }
-    
+
     // we are connected OK, continue...
 
     // Get all the possible roles
@@ -37,7 +37,7 @@ function setup_enrolments(&$user) {
     if (!$roleassignments) {
         $roleassignments = array();
     }
-    
+
     // Get the ones that came from LDAP
     $ldap_assignments = array_filter($roleassignments, create_function('$x', 'return $x->enrol == \'ldap\';'));
 
@@ -46,20 +46,20 @@ function setup_enrolments(&$user) {
     // Get enrolments for each type of role from LDAP.
     foreach($roles as $role) {
         $enrolments = $this->find_ext_enrolments(
-            $ldap_connection, 
-            $user->idnumber , 
+            $ldap_connection,
+            $user->idnumber ,
             $role);
 
         //error_log('[ENROL_LDAP] LDAP reports ' . count($enrolments) . ' enrolments of type ' . $role->shortname . '.');
 
         foreach ($enrolments as $enrol){
-    
+
             $course_ext_id = $enrol[$CFG->enrol_ldap_course_idnumber][0];
             if(empty($course_ext_id)){
                 error_log("[ENROL_LDAP] The course external id is invalid!\n");
                 continue; // next; skip this one!
             }
-            
+
             // create the course  ir required
             $course_obj = get_record( 'course',
                                       $this->enrol_localcoursefield,
@@ -74,18 +74,18 @@ function setup_enrolments(&$user) {
                     error_log("[ENROL_LDAP] User $user->username enrolled to a nonexistant course $course_ext_id \n");
                 }
             }
-            
+
             // deal with enrolment in the moodle db
-            if (!empty($course_obj)) { // does course exist now?     
-        
+            if (!empty($course_obj)) { // does course exist now?
+
                 $context = get_context_instance(CONTEXT_COURSE, $course_obj->id);
                 //$courseroles = get_user_roles($context, $user->id);
-            
+
                 if (!get_record('role_assignments', 'roleid', $role->id, 'userid', $user->id, 'contextid', $context->id)) {
                     //error_log("[ENROL_LDAP] Assigning role '{$role->name}' to {$user->id} ({$user->username}) in course {$course_obj->id} ({$course_obj->shortname})");
                     if (!role_assign($role->id, $user->id, 0, $context->id, 0, 0, 0, 'ldap')){
                         error_log("[ENROL_LDAP] Failed to assign role '{$role->name}' to $user->id ($user->username) into course $course_obj->id ($course_obj->shortname)");
-                    } 
+                    }
                 } else {
                     //error_log("[ENROL_LDAP] Role '{$role->name}' already assigned to {$user->id} ({$user->username}) in course {$course_obj->id} ({$course_obj->shortname})");
                 }
@@ -115,7 +115,7 @@ function setup_enrolments(&$user) {
     @ldap_close($ldap_connection);
 
     //error_log('[ENROL_LDAP] finished with setup_enrolments');
-    
+
     return true;
 }
 
@@ -137,7 +137,7 @@ function sync_enrolments($type, $enrol = false) {
         notify("LDAP-module cannot connect to server: $CFG->ldap_host_url");
         return false;
     }
-    
+
     // we are connected OK, continue...
     $this->enrol_ldap_bind($ldap_connection);
 
@@ -145,7 +145,7 @@ function sync_enrolments($type, $enrol = false) {
     $ldap_contexts = explode(";",$CFG->{'enrol_ldap_contexts_role'.$role->id});
 
     // get all the fields we will want for the potential course creation
-    // as they are light. don't get membership -- potentially a lot of data. 
+    // as they are light. don't get membership -- potentially a lot of data.
     $ldap_fields_wanted = array( 'dn', $CFG->enrol_ldap_course_idnumber);
     if (!empty($CFG->enrol_ldap_course_fullname)){
         array_push($ldap_fields_wanted, $CFG->enrol_ldap_course_fullname);
@@ -161,11 +161,11 @@ function sync_enrolments($type, $enrol = false) {
     }
 
     // define the search pattern
-    if (!empty($CFG->enrol_ldap_objectclass)){ 
+    if (!empty($CFG->enrol_ldap_objectclass)){
         $ldap_search_pattern='(objectclass='.$CFG->enrol_ldap_objectclass.')';
     } else {
        $ldap_search_pattern="(objectclass=*)";
-        
+
     }
 
     // first, pack the sortorder...
@@ -176,19 +176,19 @@ function sync_enrolments($type, $enrol = false) {
         $context = trim($context);
         if ($CFG->enrol_ldap_search_sub){
             //use ldap_search to find first user from subtree
-            $ldap_result = @ldap_search($ldap_connection, 
-                                        $context, 
+            $ldap_result = @ldap_search($ldap_connection,
+                                        $context,
                                         $ldap_search_pattern,
                                         $ldap_fields_wanted);
 
         } else {
             //search only in this context
-            $ldap_result = @ldap_list($ldap_connection, 
-                                        $context, 
+            $ldap_result = @ldap_list($ldap_connection,
+                                        $context,
                                         $ldap_search_pattern,
                                         $ldap_fields_wanted,0,0);
         }
- 
+
         // check and push results
         $records = $ldap_result
             ? ldap_get_entries($ldap_connection,$ldap_result)
@@ -197,9 +197,9 @@ function sync_enrolments($type, $enrol = false) {
         // ldap libraries return an odd array, really. fix it:
         $flat_records=array();
         for ($c=0;$c<$records['count'];$c++) {
-            array_push($flat_records, $records["$c"]); 
+            array_push($flat_records, $records["$c"]);
         }
-        // free mem -- is there a leak? 
+        // free mem -- is there a leak?
         $records=0; $ldap_result=0;
 
         if (count($flat_records)) {
@@ -208,7 +208,7 @@ function sync_enrolments($type, $enrol = false) {
             foreach($flat_records as $course){
                 $idnumber = $course{$CFG->enrol_ldap_course_idnumber}[0];
                 print "== Synching $idnumber\n";
-                // does the course exist in moodle already? 
+                // does the course exist in moodle already?
                 $course_obj = false;
                 $course_obj = get_record( 'course',
                                           $this->enrol_localcoursefield,
@@ -237,22 +237,22 @@ function sync_enrolments($type, $enrol = false) {
                     $context = get_context_instance(CONTEXT_COURSE, $course_obj->id);
 
                     // pull the ldap membership into a nice array
-                    // this is an odd array -- mix of hash and array -- 
+                    // this is an odd array -- mix of hash and array --
                     $ldapmembers=array();
 
                     if(array_key_exists('enrol_ldap_memberattribute_role'.$role->id, $CFG)
                      && !empty($CFG->{'enrol_ldap_memberattribute_role'.$role->id})
                      && !empty($course[strtolower($CFG->{'enrol_ldap_memberattribute_role'.$role->id} ) ])){ // may have no membership!
 
-                        $ldapmembers = $course[strtolower($CFG->{'enrol_ldap_memberattribute_role'.$role->id} )]; 
+                        $ldapmembers = $course[strtolower($CFG->{'enrol_ldap_memberattribute_role'.$role->id} )];
                         unset($ldapmembers['count']); // remove oddity ;)
                         $ldapmembers = addslashes_recursive($ldapmembers);
                     }
-                    
+
                     // prune old ldap enrolments
                     // hopefully they'll fit in the max buffer size for the RDBMS
                     $sql = '
-                        SELECT enr.userid AS user, 1
+                        SELECT enr.userid
                         FROM '.$CFG->prefix.'role_assignments enr
                         JOIN '.$CFG->prefix.'user usr ON usr.id=enr.userid
                         WHERE enr.roleid = '.$role->id.'
@@ -266,7 +266,7 @@ function sync_enrolments($type, $enrol = false) {
                     $todelete = get_records_sql($sql);
                     if(!empty($todelete)){
                         foreach ($todelete as $member) {
-                            $member = $member->user;
+                            $member = $member->userid;
 
                             if (role_unassign($role->id, $member, 0, $context->id, 'ldap')) {
                                 print "Unassigned $type from $member for course $course_obj->id ($course_obj->shortname)\n";
@@ -275,21 +275,21 @@ function sync_enrolments($type, $enrol = false) {
                             }
                         }
                     }
-                    
-                    // insert current enrolments 
+
+                    // insert current enrolments
                     // bad we can't do INSERT IGNORE with postgres...
                     foreach ($ldapmembers as $ldapmember) {
                         $sql = 'SELECT id,1 FROM '.$CFG->prefix.'user '
                                 ." WHERE idnumber='$ldapmember'";
-                        $member = get_record_sql($sql); 
-//                        print "sql: $sql \nidnumber = ".stripslashes($ldapmember)." \n".var_dump($member); 
+                        $member = get_record_sql($sql);
+//                        print "sql: $sql \nidnumber = ".stripslashes($ldapmember)." \n".var_dump($member);
                         if(empty($member) || empty($member->id)){
                             print "Could not find user ".stripslashes($ldapmember).", skipping\n";
                             continue;
                         }
                         $member = $member->id;
-                        if (!get_record('role_assignments', 'roleid', $role->id, 
-                                        'contextid', $context->id, 
+                        if (!get_record('role_assignments', 'roleid', $role->id,
+                                        'contextid', $context->id,
                                         'userid', $member, 'enrol', 'ldap')){
                             if (role_assign($role->id, $member, 0, $context->id, 0, 0, 0, 'ldap')){
                                 print "Assigned role $type to $member (".stripslashes($ldapmember).") for course $course_obj->id ($course_obj->shortname)\n";
@@ -302,10 +302,10 @@ function sync_enrolments($type, $enrol = false) {
             }
         }
     }
-    
+
     // we are done now, a bit of housekeeping
     fix_course_sortorder();
-    
+
     @ldap_close($ldap_connection);
     return true;
 }
@@ -321,7 +321,7 @@ function config_form($frm) {
     global $CFG;
 
     $this->check_legacy_config();
-    
+
     include("$CFG->dirroot/enrol/ldap/config.html");
 }
 
@@ -339,7 +339,7 @@ function process_config($config) {
         $config->enrol_ldap_version = '';
     }
     set_config('enrol_ldap_version', $config->enrol_ldap_version);
-    
+
     if (!isset ($config->enrol_ldap_bind_dn)) {
         $config->enrol_ldap_bind_dn = '';
     }
@@ -348,58 +348,58 @@ function process_config($config) {
     if (!isset ($config->enrol_ldap_bind_pw)) {
         $config->enrol_ldap_bind_pw = '';
     }
-    set_config('enrol_ldap_bind_pw', $config->enrol_ldap_bind_pw);    
-    
+    set_config('enrol_ldap_bind_pw', $config->enrol_ldap_bind_pw);
+
     if (!isset ($config->enrol_ldap_objectclass)) {
         $config->enrol_ldap_objectclass = '';
     }
-    set_config('enrol_ldap_objectclass', $config->enrol_ldap_objectclass);    
-    
+    set_config('enrol_ldap_objectclass', $config->enrol_ldap_objectclass);
+
     if (!isset ($config->enrol_ldap_category)) {
         $config->enrol_ldap_category  = '';
     }
-    set_config('enrol_ldap_category', $config->enrol_ldap_category);    
-    
+    set_config('enrol_ldap_category', $config->enrol_ldap_category);
+
     if (!isset ($config->enrol_ldap_template)) {
         $config->enrol_ldap_template = '';
     }
-    set_config('enrol_ldap_template', $config->enrol_ldap_template);    
-    
+    set_config('enrol_ldap_template', $config->enrol_ldap_template);
+
     if (!isset ($config->enrol_ldap_course_fullname)) {
         $config->enrol_ldap_course_fullname = '';
     }
-    set_config('enrol_ldap_course_fullname', $config->enrol_ldap_course_fullname);    
+    set_config('enrol_ldap_course_fullname', $config->enrol_ldap_course_fullname);
 
     if (!isset ($config->enrol_ldap_course_shortname)) {
         $config->enrol_ldap_course_shortname = '';
     }
-    set_config('enrol_ldap_course_shortname', $config->enrol_ldap_course_shortname);    
-    
+    set_config('enrol_ldap_course_shortname', $config->enrol_ldap_course_shortname);
+
     if (!isset ($config->enrol_ldap_course_summary)) {
         $config->enrol_ldap_course_summary = '';
     }
-    set_config('enrol_ldap_course_summary', $config->enrol_ldap_course_summary);    
-    
+    set_config('enrol_ldap_course_summary', $config->enrol_ldap_course_summary);
+
     if (!isset ($config->enrol_ldap_course_idnumber)) {
         $config->enrol_ldap_course_idnumber = '';
     }
-    set_config('enrol_ldap_course_idnumber', $config->enrol_ldap_course_idnumber); 
-    
+    set_config('enrol_ldap_course_idnumber', $config->enrol_ldap_course_idnumber);
+
     if (!isset ($config->enrol_localcoursefield)) {
         $config->enrol_localcoursefield = '';
     }
     set_config('enrol_localcoursefield', $config->enrol_localcoursefield);
-    
+
     if (!isset ($config->enrol_ldap_user_memberfield)) {
         $config->enrol_ldap_user_memberfield = '';
     }
-    set_config('enrol_ldap_user_memberfield', $config->enrol_ldap_user_memberfield); 
-    
+    set_config('enrol_ldap_user_memberfield', $config->enrol_ldap_user_memberfield);
+
     if (!isset ($config->enrol_ldap_search_sub)) {
         $config->enrol_ldap_search_sub = '0';
     }
-    set_config('enrol_ldap_search_sub', $config->enrol_ldap_search_sub); 
-    
+    set_config('enrol_ldap_search_sub', $config->enrol_ldap_search_sub);
+
     if (!isset ($config->enrol_ldap_autocreate)) {
         $config->enrol_ldap_autocreate = '0';
     }
@@ -410,11 +410,11 @@ function process_config($config) {
         if (!isset($config->{'enrol_ldap_contexts_role'.$role->id})) {
             $config->{'enrol_ldap_contexts_role'.$role->id} = '';
         }
-        
+
         if (!isset($config->{'enrol_ldap_memberattribute_role'.$role->id})) {
             $config->{'enrol_ldap_memberattribute_role'.$role->id} = '';
         }
-        
+
         set_config('enrol_ldap_contexts_role'.$role->id, $config->{'enrol_ldap_contexts_role'.$role->id});
         set_config('enrol_ldap_memberattribute_role'.$role->id, $config->{'enrol_ldap_memberattribute_role'.$role->id});
     }
@@ -435,7 +435,7 @@ function enrol_ldap_connect(){
 
         if (!empty($CFG->enrol_ldap_bind_dn)) {
             $bind = ldap_bind( $result,
-                                 $CFG->enrol_ldap_bind_dn, 
+                                 $CFG->enrol_ldap_bind_dn,
                                  $CFG->enrol_ldap_bind_pw );
             if (!$bind) {
                 notify("Error in binding to LDAP server");
@@ -464,11 +464,11 @@ function enrol_ldap_bind($ldap_connection){
         }
 
     } else {
-        //bind anonymously 
+        //bind anonymously
         if ( !ldap_bind($ldap_connection)){
             notify("Error: could not bind ldap anonymously");
             return false;
-        }  
+        }
     }
 
     return true;
@@ -477,13 +477,13 @@ function enrol_ldap_bind($ldap_connection){
 function find_ext_enrolments ($ldap_connection, $memberuid, $role){
 /// role is a record from the mdl_role table
 /// return multidimentional array array with of courses (at least dn and idnumber)
-/// 
+///
 
     global $CFG;
 
     if(empty($memberuid)) { // No "idnumber" stored for this user, so no LDAP enrolments
         return array();
-    } 
+    }
 
     //default return value
     $courses = array();
@@ -493,7 +493,7 @@ function find_ext_enrolments ($ldap_connection, $memberuid, $role){
     $ldap_contexts = explode(";",$CFG->{'enrol_ldap_contexts_role'.$role->id});
 
     // get all the fields we will want for the potential course creation
-    // as they are light. don't get membership -- potentially a lot of data. 
+    // as they are light. don't get membership -- potentially a lot of data.
     $ldap_fields_wanted = array( 'dn', $CFG->enrol_ldap_course_idnumber);
     if (!empty($CFG->enrol_ldap_course_fullname)){
         array_push($ldap_fields_wanted, $CFG->enrol_ldap_course_fullname);
@@ -507,7 +507,7 @@ function find_ext_enrolments ($ldap_connection, $memberuid, $role){
 
     // define the search pattern
     $ldap_search_pattern = "(".$CFG->{'enrol_ldap_memberattribute_role'.$role->id}."=".$this->filter_addslashes($memberuid).")";
-    if (!empty($CFG->enrol_ldap_objectclass)){ 
+    if (!empty($CFG->enrol_ldap_objectclass)){
         $ldap_search_pattern='(&(objectclass='.$CFG->enrol_ldap_objectclass.')'.$ldap_search_pattern.')';
     }
 
@@ -516,31 +516,31 @@ function find_ext_enrolments ($ldap_connection, $memberuid, $role){
         if (empty($context)) {
             continue; // next;
         }
-        
+
         if ($CFG->enrol_ldap_search_sub){
             //use ldap_search to find first user from subtree
-            $ldap_result = ldap_search($ldap_connection, 
-                                        $context, 
+            $ldap_result = ldap_search($ldap_connection,
+                                        $context,
                                         $ldap_search_pattern,
                                         $ldap_fields_wanted);
 
         } else {
             //search only in this context
-            $ldap_result = ldap_list($ldap_connection, 
-                                        $context, 
+            $ldap_result = ldap_list($ldap_connection,
+                                        $context,
                                         $ldap_search_pattern,
                                         $ldap_fields_wanted);
         }
- 
+
         // check and push results
-        $records = ldap_get_entries($ldap_connection,$ldap_result);        
+        $records = ldap_get_entries($ldap_connection,$ldap_result);
 
         // ldap libraries return an odd array, really. fix it:
         $flat_records=array();
         for ($c=0;$c<$records['count'];$c++) {
-            array_push($flat_records, $records["$c"]); 
+            array_push($flat_records, $records["$c"]);
         }
-        
+
         if (count($flat_records)) {
             $courses = array_merge($courses, $flat_records);
         }
@@ -551,7 +551,7 @@ function find_ext_enrolments ($ldap_connection, $memberuid, $role){
 
 // will create the moodle course from the template
 // course_ext is an array as obtained from ldap -- flattened somewhat
-// NOTE: if you pass true for $skip_fix_course_sortorder 
+// NOTE: if you pass true for $skip_fix_course_sortorder
 // you will want to call fix_course_sortorder() after your are done
 // with course creation
 function create_course ($course_ext,$skip_fix_course_sortorder=0){
@@ -578,7 +578,7 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
     $course->shortname = $course_ext[$CFG->enrol_ldap_course_shortname][0];
     if (   empty($course->idnumber)
         || empty($course->fullname)
-        || empty($course->shortname) ) { 
+        || empty($course->shortname) ) {
         // we are in trouble!
         error_log("Cannot create course: missing required data from the LDAP record!");
          error_log(var_export($course, true));
@@ -588,10 +588,10 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
     $course->summary = empty($CFG->enrol_ldap_course_summary) || empty($course_ext[$CFG->enrol_ldap_course_summary][0])
         ? ''
         : $course_ext[$CFG->enrol_ldap_course_summary][0];
-    
+
     if(!empty($CFG->enrol_ldap_category)){ // optional ... but ensure it is set!
         $course->category = $CFG->enrol_ldap_category;
-    } 
+    }
     if ($course->category == 0){ // must be avoided as it'll break moodle
         $course->category = 1; // the misc 'catch-all' category
     }
@@ -600,13 +600,13 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
     $sort = get_record_sql('SELECT MAX(sortorder) AS max, 1 FROM ' . $CFG->prefix . 'course WHERE category=' . $course->category);
     $sort = $sort->max;
     $sort++;
-    $course->sortorder = $sort; 
+    $course->sortorder = $sort;
 
     // override with local data
     $course->startdate = time();
     $course->timecreated = time();
     $course->visible     = 1;
-    
+
     $course = addslashes_recursive($course);
 
     // store it and log
@@ -619,8 +619,8 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
         blocks_repopulate_page($page); // Return value no
 
 
-        if(!$skip_fix_course_sortorder){ 
-            fix_course_sortorder(); 
+        if(!$skip_fix_course_sortorder){
+            fix_course_sortorder();
         }
         add_to_log($newcourseid, "course", "new", "view.php?id=$newcourseid", "enrol/ldap auto-creation");
     } else {
@@ -628,7 +628,7 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
         notify("Serious Error! Could not create the new course!");
         return false;
     }
-    
+
     return $newcourseid;
 }
 
@@ -665,7 +665,7 @@ function check_legacy_config () {
 
         unset_config('enrol_ldap_teacher_contexts');
     }
-    
+
     if (isset($CFG->enrol_ldap_teacher_memberattribute)) {
         if (isset($teacher_role)
          or $teacher_role = get_record('role', 'shortname', 'teacher')) {

enrol/mnet/config.html

@@ -21,7 +21,7 @@ if (is_array($mnethosts)) {
     <?php print choose_from_menu_yesno('enrol_mnet_allow_allcourses', $frm->enrol_mnet_allow_allcourses); ?>
     </td>
     <td>
-    <?php  print_string("allow_allcourses", "enrol_mnet") ?>
+    <?php  print_string("allow_allcourses2", "enrol_mnet") ?>
     </td>
 </tr>