Bumping to 1.9.9

As all strings must be defined in the English language pack, we must add
thislanguageint into English langconfig.php, too. Also added empty
parentlang, even it is not used, for the same reason.

Backported from HEAD.

admin/cron.php

@@ -223,6 +223,9 @@
     grade_cron();
     mtrace('done.');
 
+    mtrace('Starting processing the event queue...');
+    events_cron();
+    mtrace('done.');
 
 /// Run all core cron jobs, but not every time since they aren't too important.
 /// These don't have a timer to reduce load, so we'll use a random number 

admin/lang.php

@@ -1013,6 +1013,10 @@ function lang_fix_value_before_save($value='') {
     if (ini_get_bool('magic_quotes_sybase')) {          // Unescape escaped sybase quotes
         $value = str_replace("''", "'", $value);
     }
+    // escape all embedded variables
+    $value = str_replace('$', '\$', $value);            // Add slashes for $
+    // unescape placeholders: only $a and $a->something are allowed. All other $variables are left escaped
+    $value = preg_replace('/\\\\\$a($|[^_a-zA-Z0-9\-]|\->[a-zA-Z0-9_]+)/', '$a\\1', $value);
     $value = str_replace("'", "\\'", $value);           // Add slashes for '
     $value = str_replace('"', "\\\"", $value);          // Add slashes for "
     $value = str_replace("%","%%",$value);              // Escape % characters

admin/langimport.php

@@ -248,7 +248,7 @@
         if ($parent == 'en_utf8') {
             continue;
         }
-        if (strpos($parent, '[[') !== false) {
+        if (empty($parent) || strpos($parent, '[[') !== false) {
             continue; // no parent
         }
         if (!isset($installedlangs[$parent])) {

admin/mnet/access_control.php

@@ -178,7 +178,7 @@ if (!$acl) {
         }
         $deletecolumn = "<a href=\"?id={$aclrecord->id}&amp;action=delete&amp;sesskey={$USER->sesskey}\">"
                 . get_string('delete') . "</a>";
-        $table->data[] = array ($aclrecord->username, $aclrecord->mnet_host_id, $accesscolumn, $deletecolumn);
+        $table->data[] = array (s($aclrecord->username), $aclrecord->mnet_host_id, $accesscolumn, $deletecolumn);
     }
 }
 

admin/mnet/adminlib.php

@@ -64,7 +64,7 @@ function mnet_get_functions($type, $parentname) {
         foreach($rpcrecords as $rpc) {
             if (!array_key_exists($rpc->function_name, $methodServiceArray)) {
                 $rpc->enabled = 0;
-                update_record('mnet_rpc', $rpc);
+                update_record('mnet_rpc', addslashes_recursive($rpc));
             }
         }
     }
@@ -85,7 +85,7 @@ function mnet_get_functions($type, $parentname) {
             } else {
                 array_unshift($profile, $details['returns']);
             }
-            $dataobject->profile       = serialize($profile);
+            $dataobject->profile       = addslashes(serialize($profile));
             $dataobject->help          = addslashes($details['description']);
         } else {
             $dataobject->profile       = serialize(array(array('type' => 'void', 'description' => 'No return value')));

admin/mnet/mnet_review.html

@@ -1,23 +1,9 @@
 <?php
-$logurl = $CFG->wwwroot.
-          '/course/report/log/index.php?chooselog=1&amp;showusers=1&amp;showcourses=1&amp;host_course='.$mnet_peer->id.
-          '%2F1&amp;user='.'0'.
-          '&amp;date=0'.
-          '&amp;modid=&amp;modaction=0&amp;logformat=showashtml';
 
 admin_externalpage_print_header();
 
-if (isset($mnet_peer->id) && $mnet_peer->id > 0) {
-    $tabs[] = new tabobject('mnetdetails', 'peers.php?step=update&amp;hostid='.$mnet_peer->id, $strmnetedithost, $strmnetedithost, false);
-    $tabs[] = new tabobject('mnetservices', 'mnet_services.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetservices, $strmnetservices, false);
-    $tabs[] = new tabobject('mnetthemes', 'mnet_themes.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetthemes, $strmnetthemes, false);
-    if ($mnet_peer->application->name == 'moodle') {
-        $tabs[] = new tabobject('mnetlog', $logurl, $strmnetlog, $strmnetlog, false);
-    }
-} else {
-    $tabs[] = new tabobject('mnetdetails', '#', $strmnetedithost, $strmnetedithost, false);
-}
-print_tabs(array($tabs), 'mnetdetails');
+$currenttab = 'mnetdetails';
+require_once($CFG->dirroot .'/admin/mnet/tabs.php');
 
 print_simple_box_start("center", "");
 ?>

admin/mnet/mnet_review_allhosts.html

@@ -1,10 +1,8 @@
 <?php
 admin_externalpage_print_header();
 
-$tabs[] = new tabobject('mnetdetails', 'peers.php?step=update&amp;hostid='.$mnet_peer->id, $strmnetedithost, $strmnetedithost, false);
-$tabs[] = new tabobject('mnetservices', 'mnet_services.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetservices, $strmnetservices, false);
-$tabs[] = new tabobject('mnetthemes', 'mnet_themes.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetthemes, $strmnetthemes, false);
-print_tabs(array($tabs), 'mnetdetails');
+$currenttab = 'mnetdetails';
+require_once($CFG->dirroot .'/admin/mnet/tabs.php');
 
 print_simple_box_start("center", "");
 ?>

admin/mnet/mnet_services.html

@@ -1,19 +1,9 @@
 <?php
 admin_externalpage_print_header();
 
-$logurl = $CFG->wwwroot.
-          '/course/report/log/index.php?chooselog=1&amp;showusers=1&amp;showcourses=1&amp;host_course='.$mnet_peer->id.
-          '%2F1&amp;user='.'0'.
-          '&amp;date=0'.
-          '&amp;modid=&amp;modaction=0&amp;logformat=showashtml';
+$currenttab = 'mnetservices';
+require_once($CFG->dirroot .'/admin/mnet/tabs.php');
 
-$tabs[] = new tabobject('mnetdetails', 'peers.php?step=update&amp;hostid='.$mnet_peer->id, $strmnetedithost, $strmnetedithost, false);
-$tabs[] = new tabobject('mnetservices', 'mnet_services.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetservices, $strmnetservices, false);
-$tabs[] = new tabobject('mnetthemes', 'mnet_themes.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetthemes, $strmnetthemes, false);
-if ($mnet_peer->id != $CFG->mnet_all_hosts_id && $mnet_peer->application->name == 'moodle') {
-    $tabs[] = new tabobject('mnetlog', $logurl, $strmnetlog, $strmnetlog, false);
-}
-print_tabs(array($tabs), 'mnetservices');
 print_simple_box_start("center", "");
 
 ?>
@@ -27,11 +17,12 @@ print_simple_box_start("center", "");
 <?php 
     foreach($myservices as $name => $versions) {
     $version = current($versions);
+    $langmodule = ($version['parent_type'] == 'mod' ? '' : ($version['parent_type'] . '_')) . $version['parent'];
 ?>
 <tr>
     <td align="left" valign="top" colspan="2">
-    <h3><?php echo get_string($name.'_name', $version['parent_type'].'_'.$version['parent'] , $mnet_peer->name); ?></h3>
-    <?php echo get_string($name.'_description', $version['parent_type'].'_'.$version['parent'], $mnet_peer->name); ?>
+    <h3><?php echo get_string($name.'_name', $langmodule , $mnet_peer->name); ?></h3>
+    <?php echo get_string($name.'_description', $langmodule, $mnet_peer->name); ?>
 <?php
         $breakstring = '';
         foreach($versions as $version){

admin/mnet/mnet_services.php

@@ -24,6 +24,10 @@
     // force   Go ahead with something we've been warned is strange
     $step   = optional_param('step', NULL, PARAM_ALPHA);
     $hostid = optional_param('hostid', NULL, PARAM_INT);
+    $publishes  = optional_param('publish', null, PARAM_BOOL); // optional_param cleans arrays too
+    $subscribes = optional_param('subscribe', null, PARAM_BOOL); // optional_param cleans arrays too
+    $exists     = optional_param('exists', null, PARAM_BOOL); // optional_param cleans arrays too
+
     $nocertstring = '';
     $nocertmatch  = '';
     $badcert = '';
@@ -43,21 +47,21 @@
     if (($form = data_submitted()) && confirm_sesskey()) {
         $mnet_peer->set_id($hostid);
         $treevals = array();
-        foreach($_POST['exists'] as $key => $value) {
-            $host2service   = get_record('mnet_host2service', 'hostid', $_POST['hostid'], 'serviceid', $key);
-            $publish        = (isset($_POST['publish'][$key]) && $_POST['publish'][$key] == 'on')? 1 : 0;
-            $subscribe      = (isset($_POST['subscribe'][$key]) && $_POST['subscribe'][$key] == 'on')? 1 : 0;
+        foreach($exists as $key => $value) {
+            $host2service   = get_record('mnet_host2service', 'hostid', $hostid, 'serviceid', $key);
+            $publish        = array_key_exists($key, $publishes) ? $publishes[$key] : 0;
+            $subscribe      = array_key_exists($key, $subscribes) ? $subscribes[$key] : 0;
 
             if ($publish != 1 && $subscribe != 1) {
                 if (false == $host2service) {
                     // We don't have or need a record - do nothing!
                 } else {
                     // We don't need the record - delete it
-                    delete_records('mnet_host2service', 'hostid', $_POST['hostid'], 'serviceid', $key);
+                    delete_records('mnet_host2service', 'hostid', $hostid, 'serviceid', $key);
                 }
             } elseif (false == $host2service && ($publish == 1 || $subscribe == 1)) {
                 $host2service = new stdClass();
-                $host2service->hostid = $_POST['hostid'];
+                $host2service->hostid = $hostid;
                 $host2service->serviceid = $key;
                 
                 $host2service->publish = $publish;
@@ -81,7 +85,7 @@
             $id_list .= ', '.$CFG->mnet_all_hosts_id;
         }
 
-        $concat = sql_concat('COALESCE(h2s.id,0) ', ' \'-\' ', ' svc.id');
+        $concat = sql_concat('COALESCE(h2s.id,0) ', ' \'-\' ', ' svc.id', '\'-\'', 'r.parent_type', '\'-\'', 'r.parent');
 
         $query = "
             SELECT DISTINCT

admin/mnet/mnet_themes.html

@@ -3,19 +3,8 @@ admin_externalpage_print_header();
 print_heading(get_string('themes'));
 $original_theme = fullclone($THEME);
 
-$logurl = $CFG->wwwroot.
-          '/course/report/log/index.php?chooselog=1&showusers=1&showcourses=1&host_course='.$mnet_peer->id.
-          '%2F1&user='.'0'.
-          '&date=0'.
-          '&modid=&modaction=0&logformat=showashtml';
-
-$tabs[] = new tabobject('mnetdetails', 'peers.php?step=update&hostid='.$mnet_peer->id, $strmnetedithost, $strmnetedithost, false);
-$tabs[] = new tabobject('mnetservices', 'mnet_services.php?step=list&hostid='.$mnet_peer->id, $strmnetservices, $strmnetservices, false);
-$tabs[] = new tabobject('mnetthemes', 'mnet_themes.php?step=list&hostid='.$mnet_peer->id, $strmnetthemes, $strmnetthemes, false);
-if ($mnet_peer->id != $CFG->mnet_all_hosts_id) {
-    $tabs[] = new tabobject('mnetlog', $logurl, $strmnetlog, $strmnetlog, false);
-}
-    print_tabs(array($tabs), 'mnetthemes');
+    $currenttab = 'mnetthemes';
+    require_once($CFG->dirroot .'/admin/mnet/tabs.php');
 
     $themes = get_list_of_plugins("theme");
     $sesskey = !empty($USER->id) ? $USER->sesskey : '';

admin/mnet/tabs.php

@@ -0,0 +1,27 @@
+<?php
+/**
+ * Handles tabs for the mnet pages.
+ * We assume that $currenttab is defined
+ *
+ */
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.'); // It must be included from a Moodle page
+}
+
+$logurl = $CFG->wwwroot.
+          '/course/report/log/index.php?chooselog=1&amp;showusers=1&amp;showcourses=1&amp;host_course='.$mnet_peer->id.
+          '%2F1&amp;user='.'0'.
+          '&amp;date=0'.
+          '&amp;modid=&amp;modaction=0&amp;logformat=showashtml';
+$tabs = array();
+if (isset($mnet_peer->id) && $mnet_peer->id > 0) {
+    $tabs[] = new tabobject('mnetdetails', 'peers.php?step=update&amp;hostid='.$mnet_peer->id, $strmnetedithost, $strmnetedithost, false);
+    $tabs[] = new tabobject('mnetservices', 'mnet_services.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetservices, $strmnetservices, false);
+    $tabs[] = new tabobject('mnetthemes', 'mnet_themes.php?step=list&amp;hostid='.$mnet_peer->id, $strmnetthemes, $strmnetthemes, false);
+    if ($mnet_peer->application->name == 'moodle' && $mnet_peer->id != $CFG->mnet_all_hosts_id) {
+        $tabs[] = new tabobject('mnetlog', $logurl, $strmnetlog, $strmnetlog, false);
+    }
+} else {
+    $tabs[] = new tabobject('mnetdetails', '#', $strmnetedithost, $strmnetedithost, false);
+}
+print_tabs(array($tabs), $currenttab);

admin/report/security/lib.php

@@ -501,8 +501,8 @@ function report_security_check_passwordsaltmain($detailed=false) {
     if (empty($CFG->passwordsaltmain)) {
         $result->status = REPORT_SECURITY_WARNING;
         $result->info   = get_string('check_passwordsaltmain_warning', 'report_security');
-    } else if ($CFG->passwordsaltmain === 'a_very_long_random_string_of_characters#@6&*1'
-            || trim($CFG->passwordsaltmain) === '' || preg_match('/^([\w]+|[\d]+)$/i', $CFG->passwordsaltmain)) {
+    } else if ($CFG->passwordsaltmain === 'some long random string here with lots of characters'
+            || trim($CFG->passwordsaltmain) === '' || preg_match('/^([a-z0-9]{0,10})$/i', $CFG->passwordsaltmain)) {
         $result->status = REPORT_SECURITY_WARNING;
         $result->info   = get_string('check_passwordsaltmain_weak', 'report_security');
     } else {

admin/report/unittest/ex_reporter.php

@@ -66,22 +66,39 @@ class ExHtmlReporter extends HtmlReporter {
     function paintFail($message) {
         // Explicitly call grandparent, not parent::paintFail.
         SimpleScorer::paintFail($message);
-        $this->_paintPassFail('fail', $message);
+        $this->_paintPassFail('fail', $message, debug_backtrace());
     }
 
     /**
      * Called when an error (uncaught exception or PHP error) needs to be output.
      */
     function paintError($message) {
-        // Explicitly call grandparent, not parent::paintFail.
+        // Explicitly call grandparent, not parent::paintError.
         SimpleScorer::paintError($message);
         $this->_paintPassFail('exception', $message);
     }
 
     /**
-     * Private method. Used by printPass/Fail/Error.
+     * Called when a caught exception needs to be output.
      */
-    function _paintPassFail($passorfail, $message) {
+    function paintException($exception) {
+        // Explicitly call grandparent, not parent::paintException.
+        SimpleScorer::paintException($exception);
+        $message = 'Unexpected exception of type [' . get_class($exception) .
+                '] with message ['. $exception->getMessage() .
+                '] in ['. $exception->getFile() .
+                ' line ' . $exception->getLine() . ']';
+        $stacktrace = null;
+        if (method_exists($exception, 'getTrace')) {
+            $stacktrace = $exception->getTrace();
+        }
+        $this->_paintPassFail('exception', $message, $stacktrace);
+    }
+
+    /**
+     * Private method. Used by printPass/Fail/Error/Exception.
+     */
+    function _paintPassFail($passorfail, $message, $stacktrace = null) {
         global $FULLME, $CFG;
 
         print_simple_box_start('', '100%', '', 5, $passorfail . ' generalbox');
@@ -100,6 +117,25 @@ class ExHtmlReporter extends HtmlReporter {
         echo "<a href=\"{$url}path=$folder$file\" title=\"$this->strrunonlyfile\">$file</a>";
         echo $this->strseparator, implode($this->strseparator, $breadcrumb);
         echo $this->strseparator, '<br />', $this->_htmlEntities($message), "\n\n";
+        if ($stacktrace) {
+            $dotsadded = false;
+            $interestinglines = 0;
+            $filteredstacktrace = array();
+            foreach ($stacktrace as $frame) {
+                if (empty($frame['file']) || (strpos($frame['file'], 'simpletestlib') === false
+                        && strpos($frame['file'], 'report/unittest') === false)) {
+                    $filteredstacktrace[] = $frame;
+                    $interestinglines += 1;
+                    $dotsadded = false;
+                } else if (!$dotsadded) {
+                    $filteredstacktrace[] = array('line' => '...', 'file' => '...');
+                    $dotsadded = true;
+                }
+            }
+            if ($interestinglines > 1 || $passorfail == 'exception') {
+                echo '<div class="notifytiny">' . format_backtrace($filteredstacktrace) . "</div>\n\n";
+            }
+        }
         print_simple_box_end();
         flush();
     }
@@ -193,4 +229,45 @@ class ExHtmlReporter extends HtmlReporter {
         return get_string($identifier, 'simpletest', $a);
     }
 }
+
+/**
+ * Formats a backtrace ready for output.
+ *
+ * @param array $callers backtrace array, as returned by debug_backtrace().
+ * @param boolean $plaintext if false, generates HTML, if true generates plain text.
+ * @return string formatted backtrace, ready for output.
+ */
+function format_backtrace($callers, $plaintext = false) {
+    // do not use $CFG->dirroot because it might not be available in destructors
+    $dirroot = dirname(dirname(__FILE__));
+
+    if (empty($callers)) {
+        return '';
+    }
+
+    $from = $plaintext ? '' : '<ul style="text-align: left">';
+    foreach ($callers as $caller) {
+        if (!isset($caller['line'])) {
+            $caller['line'] = '?'; // probably call_user_func()
+        }
+        if (!isset($caller['file'])) {
+            $caller['file'] = 'unknownfile'; // probably call_user_func()
+        }
+        $from .= $plaintext ? '* ' : '<li>';
+        $from .= 'line ' . $caller['line'] . ' of ' . str_replace($dirroot, '', $caller['file']);
+        if (isset($caller['function'])) {
+            $from .= ': call to ';
+            if (isset($caller['class'])) {
+                $from .= $caller['class'] . $caller['type'];
+            }
+            $from .= $caller['function'] . '()';
+        } else if (isset($caller['exception'])) {
+            $from .= ': '.$caller['exception'].' thrown';
+        }
+        $from .= $plaintext ? "\n" : '</li>';
+    }
+    $from .= $plaintext ? '' : '</ul>';
+
+    return $from;
+}
 ?>

admin/report/unittest/ex_simple_test.php

@@ -56,7 +56,7 @@ class AutoGroupTest extends TestSuite {
             }
             $file_path = $path . '/' . $file;
             if (is_dir($file_path)) {
-                if ($file != 'CVS' && !in_array($file_path, $this->ignorefolders)) {
+                if ($file != 'CVS' && $file != '.git' && !in_array($file_path, $this->ignorefolders)) {
                     $this->_recurseFolders($file_path);
                 }
             } elseif (preg_match('/simpletest(\/|\\\\)test.*\.php$/', $file_path) ||

admin/roles/assign.php

@@ -325,7 +325,7 @@
                 if ($validroleids) {
                     $roleids =  '('.implode(',', $validroleids).')';
 
-                    $select = " SELECT u.id, u.firstname, u.lastname, u.email";
+                    $select = " SELECT DISTINCT u.id, u.firstname, u.lastname, u.email";
                     $countselect = "SELECT COUNT(u.id)";
                     $from   = " FROM {$CFG->prefix}user u
                                 INNER JOIN {$CFG->prefix}role_assignments ra ON ra.userid = u.id

admin/settings/security.php

@@ -26,7 +26,7 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
                        2700 => get_string('numminutes', '', 45),
                        3600 => get_string('numminutes', '', 60))));
     $temp->add(new admin_setting_configselect('fullnamedisplay', get_string('fullnamedisplay', 'admin'), get_string('configfullnamedisplay', 'admin'),
-                  'firstname lastname', array('language' => get_string('language'),
+                  'language', array('language' => get_string('language'),
                                               'firstname lastname' => get_string('firstname').' + '.get_string('lastname'),
                                               'lastname firstname' => get_string('lastname').' + '.get_string('firstname'),
                                               'firstname' => get_string('firstname'))));
@@ -65,16 +65,16 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
     $temp->add(new admin_setting_configcheckbox('loginhttps', get_string('loginhttps', 'admin'), get_string('configloginhttps', 'admin'), 0));
     $temp->add(new admin_setting_configcheckbox('cookiesecure', get_string('cookiesecure', 'admin'), get_string('configcookiesecure', 'admin'), 0));
     $temp->add(new admin_setting_configcheckbox('cookiehttponly', get_string('cookiehttponly', 'admin'), get_string('configcookiehttponly', 'admin'), 0));
-    $temp->add(new admin_setting_configcheckbox('regenloginsession', get_string('regenloginsession', 'admin'), get_string('configregenloginsession', 'admin'), 0));
+    $temp->add(new admin_setting_configcheckbox('regenloginsession', get_string('regenloginsession', 'admin'), get_string('configregenloginsession', 'admin'), 1));
     $temp->add(new admin_setting_configtext('excludeoldflashclients', get_string('excludeoldflashclients', 'admin'), get_string('configexcludeoldflashclients', 'admin'), '10.0.12', PARAM_TEXT));
     $ADMIN->add('security', $temp);
 
 
     // "modulesecurity" settingpage
     $temp = new admin_settingpage('modulesecurity', get_string('modulesecurity', 'admin'));
-    $temp->add(new admin_setting_configselect('restrictmodulesfor', get_string('restrictmodulesfor', 'admin'), get_string('configrestrictmodulesfor', 'admin'), 'none', array('none' => 'No courses',
-                                                                                                                                                                              'all' => 'All courses',
-                                                                                                                                                                              'requested' => 'Requested courses')));
+    $temp->add(new admin_setting_configselect('restrictmodulesfor', get_string('restrictmodulesfor', 'admin'), get_string('configrestrictmodulesfor', 'admin'), 'none', array('none' => get_string('nocourses'),
+                                                                                                                                                                              'all' => get_string('fulllistofcourses'),
+                                                                                                                                                                              'requested' => get_string('requestedcourses'))));
     $temp->add(new admin_setting_configcheckbox('restrictbydefault', get_string('restrictbydefault', 'admin'), get_string('configrestrictbydefault', 'admin'), 0));
     if (!$options = get_records("modules")) {
         $options = array();

admin/settings/users.php

@@ -25,7 +25,7 @@ if ($hassiteconfig
                                             get_string('alternatelogin', 'auth', htmlspecialchars($CFG->wwwroot.'/login/index.php')), ''));
     $temp->add(new admin_setting_configtext('forgottenpasswordurl', get_string('forgottenpasswordurl', 'auth'),
                                             get_string('forgottenpassword', 'auth'), ''));
-    $temp->add(new admin_setting_configtextarea('auth_instructions', get_string('instructions', 'auth'),
+    $temp->add(new admin_setting_confightmltextarea('auth_instructions', get_string('instructions', 'auth'),
                                                 get_string('authinstructions', 'auth'), ''));
     $temp->add(new admin_setting_configtext('allowemailaddresses', get_string('allowemailaddresses', 'admin'), get_string('configallowemailaddresses', 'admin'), '', PARAM_NOTAGS));
     $temp->add(new admin_setting_configtext('denyemailaddresses', get_string('denyemailaddresses', 'admin'), get_string('configdenyemailaddresses', 'admin'), '', PARAM_NOTAGS));

admin/uploadpicture.php

@@ -191,25 +191,19 @@ function process_directory ($dir, $userfield, $overwrite, &$results) {
  */
 function process_file ($file, $userfield, $overwrite) {
     // Add additional checks on the filenames, as they are user
-    // controlled and we don't want to open any security holes.
+    // controlled and we don't want to open any security holes.    
     $path_parts = pathinfo(cleardoubleslashes($file));
     $basename  = $path_parts['basename'];
     $extension = $path_parts['extension'];
-    if ($basename != clean_param($basename, PARAM_CLEANFILE)) {
-        // The original picture file name has invalid characters
-        notify(get_string('uploadpicture_invalidfilename', 'admin',
-                          clean_param($basename, PARAM_CLEANHTML)));
-        return PIX_FILE_ERROR;
-    }
-
+    
     // The picture file name (without extension) must match the
     // userfield attribute.
     $uservalue = substr($basename, 0,
                         strlen($basename) -
                         strlen($extension) - 1);
 
-    // userfield names are safe, so don't quote them.
-    if (!($user = get_record('user', $userfield, addslashes($uservalue)))) {
+    // userfield names are safe, so don't quote them.    
+    if (!($user = get_record('user', $userfield, addslashes($uservalue),'deleted',0))) {
         $a = new Object();
         $a->userfield = clean_param($userfield, PARAM_CLEANHTML);
         $a->uservalue = clean_param($uservalue, PARAM_CLEANHTML);

admin/uploadpicture_form.php

@@ -1,28 +1,33 @@
 <?php // $Id$
-    require_once $CFG->libdir.'/formslib.php';
 
-    class admin_uploadpicture_form extends moodleform {
-        function definition (){
-            global $CFG, $USER;
-    
-            $mform =& $this->_form;
-    
-            $this->set_upload_manager(new upload_manager('userpicturesfile', false, false, null, false, 0, true, true, false));
-    
-            $mform->addElement('header', 'settingsheader', get_string('upload'));
-    
-            $mform->addElement('file', 'userpicturesfile', get_string('file'), 'size="40"');
-            $mform->addRule('userpicturesfile', null, 'required');
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
 
-            $choices =& $this->_customdata;
-            $mform->addElement('select', 'userfield', get_string('uploadpicture_userfield', 'admin'), $choices);
-            $mform->setType('userfield', PARAM_INT);
+require_once $CFG->libdir.'/formslib.php';
 
-            $choices = array( 0 => get_string('no'), 1 => get_string('yes') );
-            $mform->addElement('select', 'overwritepicture', get_string('uploadpicture_overwrite', 'admin'), $choices);
-            $mform->setType('overwritepicture', PARAM_INT);
-    
-            $this->add_action_buttons(false, get_string('uploadpictures', 'admin'));
-        }
+class admin_uploadpicture_form extends moodleform {
+    function definition (){
+        global $CFG, $USER;
+
+        $mform =& $this->_form;
+
+        $this->set_upload_manager(new upload_manager('userpicturesfile', false, false, null, false, 0, true, true, false));
+
+        $mform->addElement('header', 'settingsheader', get_string('upload'));
+
+        $mform->addElement('file', 'userpicturesfile', get_string('file'), 'size="40"');
+        $mform->addRule('userpicturesfile', null, 'required');
+
+        $choices =& $this->_customdata;
+        $mform->addElement('select', 'userfield', get_string('uploadpicture_userfield', 'admin'), $choices);
+        $mform->setType('userfield', PARAM_INT);
+
+        $choices = array( 0 => get_string('no'), 1 => get_string('yes') );
+        $mform->addElement('select', 'overwritepicture', get_string('uploadpicture_overwrite', 'admin'), $choices);
+        $mform->setType('overwritepicture', PARAM_INT);
+
+        $this->add_action_buttons(false, get_string('uploadpictures', 'admin'));
     }
+}
 ?>

admin/uploaduser_form.php

@@ -1,4 +1,9 @@
 <?php // $Id$
+
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once $CFG->libdir.'/formslib.php';
 
 class admin_uploaduser_form1 extends moodleform {

admin/user/user_message_form.php

@@ -9,7 +9,7 @@ class user_message_form extends moodleform {
         $mform->addElement('header', 'general', get_string('message', 'message'));
 
 
-        $mform->addElement('textarea', 'messagebody', get_string('messagebody'), array('rows'=>15, 'cols'=>60));
+        $mform->addElement('htmleditor', 'messagebody', get_string('messagebody'), array('rows'=>15, 'cols'=>60));
         $mform->addRule('messagebody', '', 'required', null, 'client');
         $mform->setHelpButton('messagebody', array('writing', 'reading', 'questions', 'richtext'), false, 'editorhelpbutton');
         $mform->addElement('format', 'format', get_string('format'));

auth/cas/CAS/CAS/PGTStorage/pgt-db.php

@@ -1,568 +1,190 @@
 <?php
 
-
-
-
-
 /**
-
-
  * @file CAS/PGTStorage/pgt-db.php
-
-
  * Basic class for PGT database storage
-
-
  */
 
-
-
-
-
-// include phpDB library (the test was introduced in release 0.4.8 for 
-
-
-// the integration into Tikiwiki).
-
-
-if (!class_exists('DB')) {
-
-
-  @include_once('DB.php');
-
-
-}
-
-
-
-
-
 /**
-
-
  * @class PGTStorageDB
-
-
  * The PGTStorageDB class is a class for PGT database storage. An instance of 
-
-
  * this class is returned by CASClient::SetPGTStorageDB().
-
-
  *
-
-
  * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
-
-
  *
-
-
  * @ingroup internalPGTStorageDB
-
-
  */
 
-
-
-
-
 class PGTStorageDB extends PGTStorage
-
-
 {
-
-
   /** 
-
-
    * @addtogroup internalPGTStorageDB
-
-
    * @{ 
-
-
    */
 
-
-
-
-
   /**
-
-
    * a string representing a PEAR DB URL to connect to the database. Written by
-
-
    * PGTStorageDB::PGTStorageDB(), read by getURL().
-
-
    *
-
-
    * @hideinitializer
-
-
    * @private
-
-
    */
-
-
   var $_url='';
 
-
-
-
-
   /**
-
-
    * This method returns the PEAR DB URL to use to connect to the database.
-
-
    *
-
-
    * @return a PEAR DB URL
-
-
    *
-
-
    * @private
-
-
    */
-
-
   function getURL()
-
-
     {
-
-
       return $this->_url;
-
-
     }
 
-
-
-
-
   /**
-
-
    * The handle of the connection to the database where PGT's are stored. Written by
-
-
    * PGTStorageDB::init(), read by getLink().
-
-
    *
-
-
    * @hideinitializer
-
-
    * @private
-
-
    */
-
-
   var $_link = null;
 
-
-
-
-
   /**
-
-
    * This method returns the handle of the connection to the database where PGT's are 
-
-
    * stored.
-
-
    *
-
-
    * @return a handle of connection.
-
-
    *
-
-
    * @private
-
-
    */
-
-
   function getLink()
-
-
     {
-
-
       return $this->_link;
-
-
     }
 
-
-
-
-
   /**
-
-
    * The name of the table where PGT's are stored. Written by 
-
-
    * PGTStorageDB::PGTStorageDB(), read by getTable().
-
-
    *
-
-
    * @hideinitializer
-
-
    * @private
-
-
    */
-
-
   var $_table = '';
 
-
-
-
-
   /**
-
-
    * This method returns the name of the table where PGT's are stored.
-
-
    *
-
-
    * @return the name of a table.
-
-
    *
-
-
    * @private
-
-
    */
-
-
   function getTable()
-
-
     {
-
-
       return $this->_table;
-
-
     }
 
-
-
-
-
   // ########################################################################
-
-
   //  DEBUGGING
-
-
   // ########################################################################
-
-
   
-
-
   /**
-
-
    * This method returns an informational string giving the type of storage
-
-
    * used by the object (used for debugging purposes).
-
-
    *
-
-
    * @return an informational string.
-
-
    * @public
-
-
    */
-
-
   function getStorageType()
-
-
     {
-
-
       return "database";
-
-
     }
 
-
-
-
-
   /**
-
-
    * This method returns an informational string giving informations on the
-
-
    * parameters of the storage.(used for debugging purposes).
-
-
    *
-
-
    * @public
-
-
    */
-
-
   function getStorageInfo()
-
-
     {
-
-
       return 'url=`'.$this->getURL().'\', table=`'.$this->getTable().'\'';
-
-
     }
 
-
-
-
-
   // ########################################################################
-
-
   //  CONSTRUCTOR
-
-
   // ########################################################################
-
-
   
-
-
   /**
-
-
    * The class constructor, called by CASClient::SetPGTStorageDB().
-
-
    *
-
-
    * @param $cas_parent the CASClient instance that creates the object.
-
-
    * @param $user the user to access the data with
-
-
    * @param $password the user's password
-
-
    * @param $database_type the type of the database hosting the data
-
-
    * @param $hostname the server hosting the database
-
-
    * @param $port the port the server is listening on
-
-
    * @param $database the name of the database
-
-
    * @param $table the name of the table storing the data
-
-
    *
-
-
    * @public
-
-
    */
-
-
   function PGTStorageDB($cas_parent,$user,$password,$database_type,$hostname,$port,$database,$table)
-
-
     {
-
-
       phpCAS::traceBegin();
 
-
-
-
-
       // call the ancestor's constructor
-
-
       $this->PGTStorage($cas_parent);
 
-
-
-
-
       if ( empty($database_type) ) $database_type = CAS_PGT_STORAGE_DB_DEFAULT_DATABASE_TYPE;
-
-
       if ( empty($hostname) ) $hostname = CAS_PGT_STORAGE_DB_DEFAULT_HOSTNAME;
-
-
       if ( $port==0 ) $port = CAS_PGT_STORAGE_DB_DEFAULT_PORT;
-
-
       if ( empty($database) ) $database = CAS_PGT_STORAGE_DB_DEFAULT_DATABASE;
-
-
       if ( empty($table) ) $table = CAS_PGT_STORAGE_DB_DEFAULT_TABLE;
 
-
-
-
-
       // build and store the PEAR DB URL
-
-
       $this->_url = $database_type.':'.'//'.$user.':'.$password.'@'.$hostname.':'.$port.'/'.$database;
 
-
-
-
-
       // XXX should use setURL and setTable
-
-
       phpCAS::traceEnd();
-
-
     }
-
-
   
-
-
   // ########################################################################
-
-
   //  INITIALIZATION
-
-
   // ########################################################################
-
-
   
-
-
   /**
-
-
    * This method is used to initialize the storage. Halts on error.
-
-
    *
-
-
    * @public
-
-
    */
-
-
   function init()
-
-
     {
-
-
       phpCAS::traceBegin();
-
-
       // if the storage has already been initialized, return immediatly
-
-
       if ( $this->isInitialized() )
-
-
-	return;
-
-
+		return;
       // call the ancestor's method (mark as initialized)
-
-
       parent::init();
-
-
       
-
+	  //include phpDB library (the test was introduced in release 0.4.8 for 
+	  //the integration into Tikiwiki).
+	  if (!class_exists('DB')) {
+		include_once('DB.php');
+	  }
 
       // try to connect to the database
-
-
       $this->_link = DB::connect($this->getURL());
-
-
       if ( DB::isError($this->_link) ) {
-
-
 	phpCAS::error('could not connect to database ('.DB::errorMessage($this->_link).')');
-
-
       }
-
-
       var_dump($this->_link);
-
-
       phpCAS::traceBEnd();
-
-
     }
 
-
-
-
-
   /** @} */
-
-
 }
 
-
-
-
-
 ?>

auth/cas/CAS/CAS/PGTStorage/pgt-file.php

@@ -114,15 +114,26 @@ class PGTStorageFile extends PGTStorage
       if (empty($path) ) $path = CAS_PGT_STORAGE_FILE_DEFAULT_PATH;
 
       // check that the path is an absolute path
-      if ( $path[0] != '/' ) {
-	phpCAS::error('an absolute path is needed for PGT storage to file');
+      if (getenv("OS")=="Windows_NT"){
+      	
+      	 if (!preg_match('`^[a-zA-Z]:`', $path)) {
+	     	phpCAS::error('an absolute path is needed for PGT storage to file');
+      	}
+      	
       }
+      else
+      {
+      
+      	if ( $path[0] != '/' ) {
+			phpCAS::error('an absolute path is needed for PGT storage to file');
+      	}
 
-      // store the path (with a leading and trailing '/')      
-      $path = preg_replace('|[/]*$|','/',$path);
-      $path = preg_replace('|^[/]*|','/',$path);
+      	// store the path (with a leading and trailing '/')      
+      	$path = preg_replace('|[/]*$|','/',$path);
+      	$path = preg_replace('|^[/]*|','/',$path);
+      }
+      
       $this->_path = $path;
-
       // check the format and store it
       switch ($format) {
       case CAS_PGT_STORAGE_FILE_FORMAT_PLAIN:
@@ -171,7 +182,6 @@ class PGTStorageFile extends PGTStorage
     {
       phpCAS::traceBegin();
       $filename = $this->getPath().$pgt_iou.'.'.$this->getFormat();
-
       phpCAS::traceEnd($filename);
       return $filename;
     }
@@ -215,7 +225,6 @@ class PGTStorageFile extends PGTStorage
       phpCAS::traceBegin();
       $pgt = FALSE;
       $fname = $this->getPGTIouFilename($pgt_iou);
-
       if ( !($f=fopen($fname,"r")) ) {
 	phpCAS::trace('could not open `'.$fname.'\'');
       } else {
@@ -237,4 +246,4 @@ class PGTStorageFile extends PGTStorage
 }
 
   
-?>
+?>

auth/cas/CAS/CAS/PGTStorage/pgt-main.php

@@ -183,7 +183,6 @@ class PGTStorage
 
 // include specific PGT storage classes
 include_once(dirname(__FILE__).'/pgt-file.php'); 
-// incompatibility with Moodle
-//include_once(dirname(__FILE__).'/pgt-db.php');
+include_once(dirname(__FILE__).'/pgt-db.php');
   
-?>
+?>

auth/cas/CAS/CAS/domxml-php4-to-php5.php

@@ -10,7 +10,7 @@
 			require_once('domxml-php4-to-php5.php');
 	}
 
-	Version 1.20a, 2008-11-06, http://alexandre.alapetite.net/doc-alex/domxml-php4-php5/
+	Version 1.21, 2008-12-05, http://alexandre.alapetite.net/doc-alex/domxml-php4-php5/
 
 	------------------------------------------------------------------
 	Written by Alexandre Alapetite, http://alexandre.alapetite.net/cv/
@@ -179,6 +179,7 @@ class php4DOMDocument extends php4DOMNode
 	}
 	function html_dump_mem() {return $this->myDOMNode->saveHTML();}
 	function root() {return parent::_newDOMElement($this->myDOMNode->documentElement,$this);}
+	function xinclude() {return $this->myDOMNode->xinclude();}
 	function xpath_new_context() {return new php4DOMXPath($this);}
 }
 

auth/cas/CAS/CAS/languages/catalan.php

@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * @file languages/spanish.php
+ * @author Iván-Benjamín García Torà <ivaniclixx AT gmail DOT com>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'usant servidor',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => 'Autentificació CAS necessària!',
+ CAS_STR_LOGOUT 
+ => 'Sortida de CAS necessària!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'Ja hauria d\ haver estat redireccionat al servidor CAS. Feu click <a href="%s">aquí</a> per a continuar.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => 'Autentificació CAS fallida!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>No estàs autentificat.</p><p>Pots tornar a intentar-ho fent click <a href="%s">aquí</a>.</p><p>Si el problema persisteix hauría de contactar amb l\'<a href="mailto:%s">administrador d\'aquest llocc</a>.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => 'El servei `<b>%s</b>\' no està disponible (<b>%s</b>).'
+);
+
+?>

auth/cas/CAS/CAS/languages/english.php

@@ -1,79 +1,27 @@
 <?php
 
-
-
-
-
 /**
-
-
  * @file languages/english.php
-
-
  * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
-
-
  * @sa @link internalLang Internationalization @endlink
-
-
  * @ingroup internalLang
-
-
  */
 
-
-
-
-
 $this->_strings = array(
-
-
  CAS_STR_USING_SERVER 
-
-
  => 'using server',
-
-
  CAS_STR_AUTHENTICATION_WANTED 
-
-
  => 'CAS Authentication wanted!',
-
-
  CAS_STR_LOGOUT 
-
-
  => 'CAS logout wanted!',
-
-
  CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
-
  => 'You should already have been redirected to the CAS server. Click <a href="%s">here</a> to continue.',
-
-
  CAS_STR_AUTHENTICATION_FAILED 
-
-
  => 'CAS Authentication failed!',
-
-
  CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
-
  => '<p>You were not authenticated.</p><p>You may submit your request again by clicking <a href="%s">here</a>.</p><p>If the problem persists, you may contact <a href="mailto:%s">the administrator of this site</a>.</p>',
-
-
  CAS_STR_SERVICE_UNAVAILABLE
-
-
  => 'The service `<b>%s</b>\' is not available (<b>%s</b>).'
-
-
 );
 
-
-
-
-
 ?>

auth/cas/CAS/CAS/languages/french.php

@@ -1,82 +1,28 @@
 <?php
 
-
-
-
-
 /**
-
-
  * @file languages/english.php
-
-
  * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
-
-
  * @sa @link internalLang Internationalization @endlink
-
-
  * @ingroup internalLang
-
-
  */
 
-
-
-
-
 $this->_strings = array(
-
-
  CAS_STR_USING_SERVER 
-
-
  => 'utilisant le serveur',
-
-
  CAS_STR_AUTHENTICATION_WANTED 
-
-
- => 'Authentication CAS nécessaire&nbsp;!',
-
-
+ => 'Authentication CAS n�cessaire&nbsp;!',
  CAS_STR_LOGOUT 
-
-
- => 'Déconnexion demandée&nbsp;!',
-
-
+ => 'D�connexion demand�e&nbsp;!',
  CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
-
- => 'Vous auriez du etre redirigé(e) vers le serveur CAS. Cliquez <a href="%s">ici</a> pour continuer.',
-
-
+ => 'Vous auriez du etre redirig�(e) vers le serveur CAS. Cliquez <a href="%s">ici</a> pour continuer.',
  CAS_STR_AUTHENTICATION_FAILED 
-
-
  => 'Authentification CAS infructueuse&nbsp;!',
-
-
  CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
-
- => '<p>Vous n\'avez pas été authentifié(e).</p><p>Vous pouvez soumettre votre requete à nouveau en cliquant <a href="%s">ici</a>.</p><p>Si le problème persiste, vous pouvez contacter <a href="mailto:%s">l\'administrateur de ce site</a>.</p>',
-
-
+ => '<p>Vous n\'avez pas �t� authentifi�(e).</p><p>Vous pouvez soumettre votre requete � nouveau en cliquant <a href="%s">ici</a>.</p><p>Si le probl�me persiste, vous pouvez contacter <a href="mailto:%s">l\'administrateur de ce site</a>.</p>',
  CAS_STR_SERVICE_UNAVAILABLE
-
-
  => 'Le service `<b>%s</b>\' est indisponible (<b>%s</b>)'
 
-
-
-
-
 );
 
-
-
-
-
 ?>

auth/cas/CAS/CAS/languages/german.php

@@ -1,79 +1,27 @@
 <?php
 
-
-
-
-
 /**
-
-
  * @file languages/german.php
-
-
  * @author Henrik Genssen <hg at mediafactory.de>
-
-
  * @sa @link internalLang Internationalization @endlink
-
-
  * @ingroup internalLang
-
-
  */
 
-
-
-
-
 $this->_strings = array(
-
-
  CAS_STR_USING_SERVER 
-
-
  => 'via Server',
-
-
  CAS_STR_AUTHENTICATION_WANTED 
-
-
  => 'CAS Authentifizierung erforderlich!',
-
-
  CAS_STR_LOGOUT 
-
-
  => 'CAS Abmeldung!',
-
-
  CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
-
  => 'eigentlich h&auml;ten Sie zum CAS Server weitergeleitet werden sollen. Dr&uuml;cken Sie <a href="%s">hier</a> um fortzufahren.',
-
-
  CAS_STR_AUTHENTICATION_FAILED 
-
-
  => 'CAS Anmeldung fehlgeschlagen!',
-
-
  CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
-
  => '<p>Sie wurden nicht angemeldet.</p><p>Um es erneut zu versuchen klicken Sie <a href="%s">hier</a>.</p><p>Wenn das Problem bestehen bleibt, kontkatieren Sie den <a href="mailto:%s">Administrator</a> dieser Seite.</p>',
-
-
  CAS_STR_SERVICE_UNAVAILABLE
-
-
  => 'Der Dienst `<b>%s</b>\' ist nicht verf&uuml;gbar (<b>%s</b>).'
-
-
 );
 
-
-
-
-
 ?>

auth/cas/CAS/CAS/languages/greek.php

@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * @file languages/greek.php
+ * @author Vangelis Haniotakis <haniotak at ucnet.uoc.gr>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => '��������������� � ������������',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => '���������� � ����������� CAS!',
+ CAS_STR_LOGOUT 
+ => '���������� � ���������� ��� CAS!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => '�� ������ �� ������ �������������� ���� ����������� CAS. ����� ���� <a href="%s">���</a> ��� �� ����������.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => '� ����������� CAS �������!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>��� ���������������.</p><p>�������� �� ����������������, �������� ���� <a href="%s">���</a>.</p><p>��� �� �������� ���������, ����� �� ����� �� ��� <a href="mailto:%s">�����������</a>.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => '� �������� `<b>%s</b>\' ��� ����� ��������� (<b>%s</b>).'
+);
+
+?>

auth/cas/CAS/CAS/languages/japanese.php

@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * @file languages/japanese.php
+ * @author fnorif (fnorif@yahoo.co.jp)
+ * 
+ * Now Encoding is EUC-JP and LF
+ **/
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'using server',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => 'CAS�ˤ��ǧ�ڤ�Ԥ��ޤ�',
+ CAS_STR_LOGOUT 
+ => 'CAS����?�����Ȥ��ޤ�!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'CAS�����Ф˹Ԥ�ɬ�פ�����ޤ�����ưŪ��ž������ʤ����� <a href="%s">������</a> �򥯥�å�����³�Ԥ��ޤ���',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => 'CAS�ˤ��ǧ�ڤ˼��Ԥ��ޤ���',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>ǧ�ڤǤ��ޤ���Ǥ���.</p><p>�⤦���٥ꥯ�����Ȥ������������<a href="%s">������</a>�򥯥�å�.</p><p>���꤬��褷�ʤ����� <a href="mailto:%s">���Υ����Ȥδ����</a>���䤤��碌�Ƥ�������.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => '�����ӥ� `<b>%s</b>\' �����ѤǤ��ޤ��� (<b>%s</b>).'
+);
+
+?>

auth/cas/CAS/CAS/languages/languages.php

@@ -1,70 +1,24 @@
 <?php
 
-
-
-
-
 /**
-
-
  * @file languages/languages.php
-
-
  * Internationalization constants
-
-
  * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
-
-
  * @sa @link internalLang Internationalization @endlink
-
-
  * @ingroup internalLang
-
-
  */
 
-
-
-
-
 //@{
-
-
 /**
-
-
  * a phpCAS string index
-
-
  */
-
-
 define("CAS_STR_USING_SERVER",                1);
-
-
 define("CAS_STR_AUTHENTICATION_WANTED",       2);
-
-
 define("CAS_STR_LOGOUT",                      3);
-
-
 define("CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED", 4);
-
-
 define("CAS_STR_AUTHENTICATION_FAILED",       5);
-
-
 define("CAS_STR_YOU_WERE_NOT_AUTHENTICATED",  6);
-
-
 define("CAS_STR_SERVICE_UNAVAILABLE",         7);
-
-
 //@}
 
-
-
-
-
 ?>

auth/cas/CAS/CAS/languages/spanish.php

@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * @file languages/spanish.php
+ * @author Iván-Benjamín García Torà <ivaniclixx AT gmail DOT com>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'usando servidor',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => '¡Autentificación CAS necesaria!',
+ CAS_STR_LOGOUT 
+ => '¡Salida CAS necesaria!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'Ya debería haber sido redireccionado al servidor CAS. Haga click <a href="%s">aquí</a> para continuar.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => '¡Autentificación CAS fallida!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>No estás autentificado.</p><p>Puedes volver a intentarlo haciendo click <a href="%s">aquí</a>.</p><p>Si el problema persiste debería contactar con el <a href="mailto:%s">administrador de este sitio</a>.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => 'El servicio `<b>%s</b>\' no está disponible (<b>%s</b>).'
+);
+
+?>

auth/cas/CAS/languages/greek.php

@@ -1,79 +0,0 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file languages/greek.php
-
-
- * @author Vangelis Haniotakis <haniotak at ucnet.uoc.gr>
-
-
- * @sa @link internalLang Internationalization @endlink
-
-
- * @ingroup internalLang
-
-
- */
-
-
-
-
-
-$this->_strings = array(
-
-
- CAS_STR_USING_SERVER 
-
-
- => '÷ñçóéìïðïéåßôáé ï åîõðçñåôçôÞò',
-
-
- CAS_STR_AUTHENTICATION_WANTED 
-
-
- => 'Áðáéôåßôáé ç ôáõôïðïßçóç CAS!',
-
-
- CAS_STR_LOGOUT 
-
-
- => 'Áðáéôåßôáé ç áðïóýíäåóç áðü CAS!',
-
-
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
-
- => 'Èá Ýðñåðå íá åß÷áôå áíáêáôåõèõíèåß óôïí åîõðçñåôçôÞ CAS. ÊÜíôå êëßê <a href="%s">åäþ</a> ãéá íá óõíå÷ßóåôå.',
-
-
- CAS_STR_AUTHENTICATION_FAILED 
-
-
- => 'Ç ôáõôïðïßçóç CAS áðÝôõ÷å!',
-
-
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
-
- => '<p>Äåí ôáõôïðïéçèÞêáôå.</p><p>Ìðïñåßôå íá îáíáðñïóðáèÞóåôå, êÜíïíôáò êëßê <a href="%s">åäþ</a>.</p><p>Åáí ôï ðñüâëçìá åðéìåßíåé, åëÜôå óå åðáöÞ ìå ôïí <a href="mailto:%s">äéá÷åéñéóôÞ</a>.</p>',
-
-
- CAS_STR_SERVICE_UNAVAILABLE
-
-
- => 'Ç õðçñåóßá `<b>%s</b>\' äåí åßíáé äéáèÝóéìç (<b>%s</b>).'
-
-
-);
-
-
-
-
-
-?>

auth/cas/CAS/languages/japanese.php

@@ -1,53 +0,0 @@
-<?php
-
-
-
-/**
-
- * @file languages/japanese.php
-
- * @author fnorif (fnorif@yahoo.co.jp)
-
- * 
-
- * Now Encoding is EUC-JP and LF
-
- **/
-
-
-
-$this->_strings = array(
-
- CAS_STR_USING_SERVER 
-
- => 'using server',
-
- CAS_STR_AUTHENTICATION_WANTED 
-
- => 'CASによる認証を行います',
-
- CAS_STR_LOGOUT 
-
- => 'CASからログアウトします!',
-
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
- => 'CASサーバに行く必要があります。自動的に転送されない場合は <a href="%s">こちら</a> をクリックして続行します。',
-
- CAS_STR_AUTHENTICATION_FAILED 
-
- => 'CASによる認証に失敗しました',
-
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
- => '<p>認証できませんでした.</p><p>もう一度リクエストを送信する場合は<a href="%s">こちら</a>をクリック.</p><p>問題が解決しない場合は <a href="mailto:%s">このサイトの管理者</a>に問い合わせてください.</p>',
-
- CAS_STR_SERVICE_UNAVAILABLE
-
- => 'サービス `<b>%s</b>\' は利用できません (<b>%s</b>).'
-
-);
-
-
-
-?>

auth/cas/auth.php

@@ -97,8 +97,10 @@ class auth_plugin_cas extends auth_plugin_base {
       $username = optional_param("username");
 
       if (!empty($username)) {
-		  if (strstr($SESSION->wantsurl,'ticket') || strstr($SESSION->wantsurl,'NOCAS'))
-			  unset($SESSION->wantsurl);
+          if (isset($SESSION->wantsurl) && (strstr($SESSION->wantsurl, 'ticket') ||
+                                            strstr($SESSION->wantsurl, 'NOCAS'))) {
+              unset($SESSION->wantsurl);
+          }
           return;		
         }
 
@@ -112,6 +114,9 @@ class auth_plugin_cas extends auth_plugin_base {
 // Connection to CAS server
 	 $this->connectCAS();
 
+         // Don't try to validate the server SSL credentials
+         phpCAS::setNoCasServerValidation();
+
 	  // Gestion de la connection CAS si acc�s direct d'un ent ou autre	
 	 if (phpCAS::checkAuthentication()) {
 		$frm->username=phpCAS::getUser();
@@ -121,7 +126,7 @@ class auth_plugin_cas extends auth_plugin_base {
 		return;
 	 }	 	
 
-	  if ($_GET["loginguest"]== true) {
+          if (isset($_GET["loginguest"]) && ($_GET["loginguest"]== true)) {
 			$frm->username="guest";
 			$frm->password="guest";
 			return;
@@ -161,7 +166,7 @@ class auth_plugin_cas extends auth_plugin_base {
 	  if ($this->config->logoutcas ) {
 	        $backurl = $CFG->wwwroot;
 		  $this->connectCAS();
-	        phpCAS::logout($backurl);
+                phpCAS::logoutWithURL($backurl);
 	     }
     }
     /**
@@ -175,12 +180,13 @@ class auth_plugin_cas extends auth_plugin_base {
 	global $PHPCAS_CLIENT;
 // mode proxy CAS
 if ( !is_object($PHPCAS_CLIENT) ) {
+        // Make sure phpCAS doesn't try to start a new PHP session when connecting to the CAS server.
 	if  ($this->config->proxycas) {
-	    phpCAS::proxy($this->config->casversion, $this-> config->hostname, (int) $this->config->port, $this->config->baseuri);
+	    phpCAS::proxy($this->config->casversion, $this-> config->hostname, (int) $this->config->port, $this->config->baseuri, false);
 	}
 // mode client CAS
 	else {
-	    phpCAS::client($this->config->casversion, $this-> config->hostname, (int) $this->config->port, $this->config->baseuri);
+	    phpCAS::client($this->config->casversion, $this-> config->hostname, (int) $this->config->port, $this->config->baseuri, false);
 	}
     }
 	
@@ -773,9 +779,9 @@ if ( !is_object($PHPCAS_CLIENT) ) {
                     $updateuser->id = $user->id;
                     $updateuser->auth = 'cas';
                     if (update_record('user', $updateuser)) {
-                        echo "\t"; print_string('auth_dbreviveser', 'auth', array($user->username, $user->id)); echo "\n";
+                        echo "\t"; print_string('auth_dbreviveduser', 'auth', array($user->username, $user->id)); echo "\n";
                     } else {
-                        echo "\t"; print_string('auth_dbreviveusererror', 'auth', $user->username); echo "\n";
+                        echo "\t"; print_string('auth_dbrevivedusererror', 'auth', $user->username); echo "\n";
                     }
                 }
                 commit_sql();

auth/cas/config.html

@@ -602,7 +602,7 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
 
        $opt_deref[LDAP_DEREF_ALWAYS] = get_string('yes');
 
-       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, LDAP_DEREF_NEVER, '');
+       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, '');
 
        if (isset($err['opt_deref'])) formerr($err['opt_deref']);
 

auth/db/auth.php

@@ -364,7 +364,7 @@ class auth_plugin_db extends auth_plugin_base {
                 if ($old_user = get_record('user', 'username', $user->username, 'deleted', 1, 'mnethostid', $user->mnethostid)) {
                     $user->id = $old_user->id;
                     set_field('user', 'deleted', 0, 'username', $user->username);
-                    echo "\t"; print_string('auth_dbreviveuser', 'auth', array(stripslashes($user->username), $user->id)); echo "\n";
+                    echo "\t"; print_string('auth_dbreviveduser', 'auth', array(stripslashes($user->username), $user->id)); echo "\n";
                 } elseif ($id = insert_record ('user',$user)) { // it is truly a new user
                     echo "\t"; print_string('auth_dbinsertuser','auth',array(stripslashes($user->username), $id)); echo "\n";
                     // if relevant, tag for password generation

auth/ldap/auth.php

@@ -723,9 +723,9 @@ class auth_plugin_ldap extends auth_plugin_base {
                     $updateuser->id = $user->id;
                     $updateuser->auth = 'ldap';
                     if (update_record('user', $updateuser)) {
-                        echo "\t"; print_string('auth_dbreviveser', 'auth', array($user->username, $user->id)); echo "\n";
+                        echo "\t"; print_string('auth_dbreviveduser', 'auth', array($user->username, $user->id)); echo "\n";
                     } else {
-                        echo "\t"; print_string('auth_dbreviveusererror', 'auth', $user->username); echo "\n";
+                        echo "\t"; print_string('auth_dbrevivedusererror', 'auth', $user->username); echo "\n";
                     }
                 }
                 commit_sql();

auth/ldap/config.html

@@ -199,7 +199,7 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?
        $opt_deref = array();
        $opt_deref[LDAP_DEREF_NEVER] = get_string('no');
        $opt_deref[LDAP_DEREF_ALWAYS] = get_string('yes');
-       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, LDAP_DEREF_NEVER, '');
+       choose_from_menu($opt_deref, 'opt_deref', $config->opt_deref, '');
        if (isset($err['opt_deref'])) formerr($err['opt_deref']);
     ?>
     </td>

auth/mnet/auth.php

@@ -230,6 +230,17 @@ class auth_plugin_mnet extends auth_plugin_base {
         return $url;
     }
 
+    /**
+     * after a successful login, land.php will call complete_user_login
+     * which will in turn regenerate the session id.
+     * this means that what is stored in mnet_session table needs updating.
+     *
+     */
+    function update_session_id() {
+        global $USER;
+        return set_field('mnet_session', 'session_id', session_id(), 'username', $USER->username, 'mnethostid', $USER->mnethostid, 'useragent', sha1($_SERVER['HTTP_USER_AGENT']));
+    }
+
     /**
      * This function confirms the remote (ID provider) host's mnet session
      * by communicating the token and UA over the XMLRPC transport layer, and
@@ -291,16 +302,16 @@ class auth_plugin_mnet extends auth_plugin_base {
         // TODO: refactor into a separate function
         if (empty($localuser) || ! $localuser->id) {
             if (empty($this->config->auto_add_remote_users)) {
-                print_error('nolocaluser', 'mnet');
+                print_error('nolocaluser2', 'mnet');
             }
             $remoteuser->mnethostid = $remotehost->id;
-            if (! insert_record('user', addslashes_recursive($remoteuser))) {
+            $remoteuser->firstaccess = time(); // First time user in this server, grab it here
+
+            if (!$remoteuser->id =  insert_record('user', addslashes_recursive($remoteuser))) {
                 print_error('databaseerror', 'mnet');
             }
             $firsttime = true;
-            if (! $localuser = get_record('user', 'username', addslashes($remoteuser->username), 'mnethostid', $remotehost->id)) {
-                print_error('nolocaluser', 'mnet');
-            }
+            $localuser = $remoteuser;
         }
 
         // check sso access control list for permission first
@@ -367,6 +378,9 @@ class auth_plugin_mnet extends auth_plugin_base {
         }
 
         $localuser->mnethostid = $remotepeer->id;
+        if (empty($localuser->firstaccess)) { // Now firstaccess, grab it here
+            $localuser->firstaccess = time();
+        }
 
         $bool = update_record('user', addslashes_recursive($localuser));
         if (!$bool) {

auth/mnet/land.php

@@ -34,6 +34,7 @@ $localuser = $mnetauth->confirm_mnet_session($token, $remotewwwroot);
 // log in
 $USER = get_complete_user_data('id', $localuser->id, $localuser->mnethostid);
 complete_user_login($USER);
+$mnetauth->update_session_id();
 
 if (!empty($localuser->mnet_foreign_host_array)) {
     $USER->mnet_foreign_host_array = $localuser->mnet_foreign_host_array;

auth/shibboleth/config.html

@@ -59,7 +59,7 @@
 <tr valign="top">
     <td align="right"><?php print_string("auth_shib_idp_list", "auth") ?>:</td>
     <td>
-        <textarea name="organization_selection" rows="10" cols="30" style="overflow: auto; white-space: nowrap;"
+        <textarea name="organization_selection" rows="10" cols="30" style="overflow: auto;"
 ><?php 
         if (!isset($config->organization_selection)){
             echo  'urn:mace:organization1:providerID, Example Organization 1

backup/backup_check.html

@@ -133,7 +133,12 @@
         $backupprefs->backup_blogs = 0;
         $backupprefs->backuproleassignments = array();
 
-        print_simple_box("<font color=\"red\">".get_string("backupnoneusersinfo")."</font>","center", "70%", '', "20", "noticebox");
+        if ($backupuserinfo) { // Based on perms, decide the msg to show
+            $nousersmsgtoshow = 'backupnoneusersinfo';
+        } else {
+            $nousersmsgtoshow = 'backupmissinguserinfoperms';
+        }
+        print_simple_box("<font color=\"red\">".get_string($nousersmsgtoshow)."</font>","center", "70%", '', "20", "noticebox");
         echo "<hr />";
     }
 

backup/backuplib.php

@@ -2400,6 +2400,9 @@
             $result = $blockobject->encode_content_links($result,$mypreferences);
         }
 
+        // Finally encode some well-know links to course
+        $result = backup_course_encode_links($result, $mypreferences);
+
         if ($result != $content) {
             debugging('<br /><hr />'.s($content).'<br />changed to<br />'.s($result).'<hr /><br />');
         }
@@ -2407,6 +2410,22 @@
         return $result;
     }
 
+    /**
+     * Encode some well-know links to course. Restore will recode them to new course id
+     */
+    function backup_course_encode_links($content, $preferences) {
+        global $CFG;
+
+        $base = preg_quote($CFG->wwwroot,"/");
+
+        // Link to the course main page (it also covers "&topic=xx" and "&week=xx"
+        // because they don't become transformed (section number) in backup/restore
+        $search = '/(' . $base . '\/course\/view.php\?id\=)([0-9]+)/';
+        $result = preg_replace($search,'$@COURSEVIEWBYID*$2@$', $content);
+
+        return $result;
+    }
+
     /**
      * Callback preg_replace function used by backup_encode_absolute_links()
      * to process $@FILEPHP@$ URLs to get slasharguments independent URLs

backup/cc/schemas/cclibxml2validator.xsd

@@ -9,9 +9,10 @@
     xmlns:cc        ="http://www.imsglobal.org/xsd/imsccauth_v1p0"
     version="1.0"
     elementFormDefault  ="qualified"
-    attributeFormDefault="unqualified"    
+    attributeFormDefault="unqualified"
     >
-    
+
+    <xs:import namespace ="http://www.w3.org/XML/1998/namespace"          schemaLocation = "xml.xsd"                                      />
     <xs:import namespace ="http://www.imsglobal.org/xsd/imscc/imscp_v1p1" schemaLocation = "imscp_v1p2_localised.xsd"                     />
     <xs:import namespace ="http://ltsc.ieee.org/xsd/imscc/LOM"            schemaLocation = "domainProfile_1/lomLoose_localised.xsd"       />
     <xs:import namespace ="http://ltsc.ieee.org/xsd/LOM"                  schemaLocation = "domainProfile_2/lomLoose_localised.xsd"       />

backup/cc/schemas/xml.xsd

@@ -0,0 +1,286 @@
+<?xml version='1.0'?>
+<xs:schema targetNamespace="http://www.w3.org/XML/1998/namespace" 
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" 
+  xmlns   ="http://www.w3.org/1999/xhtml"
+  xml:lang="en">
+
+ <xs:annotation>
+  <xs:documentation>
+   <div>
+    <h1>About the XML namespace</h1>
+
+    <div class="bodytext">
+     <p>
+      This schema document describes the XML namespace, in a form
+      suitable for import by other schema documents.
+     </p>
+     <p>
+      See <a href="http://www.w3.org/XML/1998/namespace.html">
+      http://www.w3.org/XML/1998/namespace.html</a> and
+      <a href="http://www.w3.org/TR/REC-xml">
+      http://www.w3.org/TR/REC-xml</a> for information 
+      about this namespace.
+     </p>
+     <p>
+      Note that local names in this namespace are intended to be
+      defined only by the World Wide Web Consortium or its subgroups.
+      The names currently defined in this namespace are listed below.
+      They should not be used with conflicting semantics by any Working
+      Group, specification, or document instance.
+     </p>
+     <p>   
+      See further below in this document for more information about <a
+      href="#usage">how to refer to this schema document from your own
+      XSD schema documents</a> and about <a href="#nsversioning">the
+      namespace-versioning policy governing this schema document</a>.
+     </p>
+    </div>
+   </div>
+  </xs:documentation>
+ </xs:annotation>
+
+ <xs:attribute name="lang">
+  <xs:annotation>
+   <xs:documentation>
+    <div>
+     
+      <h3>lang (as an attribute name)</h3>
+      <p>
+       denotes an attribute whose value
+       is a language code for the natural language of the content of
+       any element; its value is inherited.  This name is reserved
+       by virtue of its definition in the XML specification.</p>
+     
+    </div>
+    <div>
+     <h4>Notes</h4>
+     <p>
+      Attempting to install the relevant ISO 2- and 3-letter
+      codes as the enumerated possible values is probably never
+      going to be a realistic possibility.  
+     </p>
+     <p>
+      See BCP 47 at <a href="http://www.rfc-editor.org/rfc/bcp/bcp47.txt">
+       http://www.rfc-editor.org/rfc/bcp/bcp47.txt</a>
+      and the IANA language subtag registry at
+      <a href="http://www.iana.org/assignments/language-subtag-registry">
+       http://www.iana.org/assignments/language-subtag-registry</a>
+      for further information.
+     </p>
+     <p>
+      The union allows for the 'un-declaration' of xml:lang with
+      the empty string.
+     </p>
+    </div>
+   </xs:documentation>
+  </xs:annotation>
+  <xs:simpleType>
+   <xs:union memberTypes="xs:language">
+    <xs:simpleType>    
+     <xs:restriction base="xs:string">
+      <xs:enumeration value=""/>
+     </xs:restriction>
+    </xs:simpleType>
+   </xs:union>
+  </xs:simpleType>
+ </xs:attribute>
+
+ <xs:attribute name="space">
+  <xs:annotation>
+   <xs:documentation>
+    <div>
+     
+      <h3>space (as an attribute name)</h3>
+      <p>
+       denotes an attribute whose
+       value is a keyword indicating what whitespace processing
+       discipline is intended for the content of the element; its
+       value is inherited.  This name is reserved by virtue of its
+       definition in the XML specification.</p>
+     
+    </div>
+   </xs:documentation>
+  </xs:annotation>
+  <xs:simpleType>
+   <xs:restriction base="xs:NCName">
+    <xs:enumeration value="default"/>
+    <xs:enumeration value="preserve"/>
+   </xs:restriction>
+  </xs:simpleType>
+ </xs:attribute>
+ 
+ <xs:attribute name="base" type="xs:anyURI"> <xs:annotation>
+   <xs:documentation>
+    <div>
+     
+      <h3>base (as an attribute name)</h3>
+      <p>
+       denotes an attribute whose value
+       provides a URI to be used as the base for interpreting any
+       relative URIs in the scope of the element on which it
+       appears; its value is inherited.  This name is reserved
+       by virtue of its definition in the XML Base specification.</p>
+     
+     <p>
+      See <a
+      href="http://www.w3.org/TR/xmlbase/">http://www.w3.org/TR/xmlbase/</a>
+      for information about this attribute.
+     </p>
+    </div>
+   </xs:documentation>
+  </xs:annotation>
+ </xs:attribute>
+ 
+ <xs:attribute name="id" type="xs:ID">
+  <xs:annotation>
+   <xs:documentation>
+    <div>
+     
+      <h3>id (as an attribute name)</h3> 
+      <p>
+       denotes an attribute whose value
+       should be interpreted as if declared to be of type ID.
+       This name is reserved by virtue of its definition in the
+       xml:id specification.</p>
+     
+     <p>
+      See <a
+      href="http://www.w3.org/TR/xml-id/">http://www.w3.org/TR/xml-id/</a>
+      for information about this attribute.
+     </p>
+    </div>
+   </xs:documentation>
+  </xs:annotation>
+ </xs:attribute>
+
+ <xs:attributeGroup name="specialAttrs">
+  <xs:attribute ref="xml:base"/>
+  <xs:attribute ref="xml:lang"/>
+  <xs:attribute ref="xml:space"/>
+  <xs:attribute ref="xml:id"/>
+ </xs:attributeGroup>
+
+ <xs:annotation>
+  <xs:documentation>
+   <div>
+   
+    <h3>Father (in any context at all)</h3> 
+
+    <div class="bodytext">
+     <p>
+      denotes Jon Bosak, the chair of 
+      the original XML Working Group.  This name is reserved by 
+      the following decision of the W3C XML Plenary and 
+      XML Coordination groups:
+     </p>
+     <blockquote>
+       <p>
+	In appreciation for his vision, leadership and
+	dedication the W3C XML Plenary on this 10th day of
+	February, 2000, reserves for Jon Bosak in perpetuity
+	the XML name "xml:Father".
+       </p>
+     </blockquote>
+    </div>
+   </div>
+  </xs:documentation>
+ </xs:annotation>
+
+ <xs:annotation>
+  <xs:documentation>
+   <div xml:id="usage" id="usage">
+    <h2><a name="usage">About this schema document</a></h2>
+
+    <div class="bodytext">
+     <p>
+      This schema defines attributes and an attribute group suitable
+      for use by schemas wishing to allow <code>xml:base</code>,
+      <code>xml:lang</code>, <code>xml:space</code> or
+      <code>xml:id</code> attributes on elements they define.
+     </p>
+     <p>
+      To enable this, such a schema must import this schema for
+      the XML namespace, e.g. as follows:
+     </p>
+     <pre>
+          &lt;schema . . .>
+           . . .
+           &lt;import namespace="http://www.w3.org/XML/1998/namespace"
+                      schemaLocation="http://www.w3.org/2001/xml.xsd"/>
+     </pre>
+     <p>
+      or
+     </p>
+     <pre>
+           &lt;import namespace="http://www.w3.org/XML/1998/namespace"
+                      schemaLocation="http://www.w3.org/2009/01/xml.xsd"/>
+     </pre>
+     <p>
+      Subsequently, qualified reference to any of the attributes or the
+      group defined below will have the desired effect, e.g.
+     </p>
+     <pre>
+          &lt;type . . .>
+           . . .
+           &lt;attributeGroup ref="xml:specialAttrs"/>
+     </pre>
+     <p>
+      will define a type which will schema-validate an instance element
+      with any of those attributes.
+     </p>
+    </div>
+   </div>
+  </xs:documentation>
+ </xs:annotation>
+
+ <xs:annotation>
+  <xs:documentation>
+   <div id="nsversioning" xml:id="nsversioning">
+    <h2><a name="nsversioning">Versioning policy for this schema document</a></h2>
+    <div class="bodytext">
+     <p>
+      In keeping with the XML Schema WG's standard versioning
+      policy, this schema document will persist at
+      <a href="http://www.w3.org/2009/01/xml.xsd">
+       http://www.w3.org/2009/01/xml.xsd</a>.
+     </p>
+     <p>
+      At the date of issue it can also be found at
+      <a href="http://www.w3.org/2001/xml.xsd">
+       http://www.w3.org/2001/xml.xsd</a>.
+     </p>
+     <p>
+      The schema document at that URI may however change in the future,
+      in order to remain compatible with the latest version of XML
+      Schema itself, or with the XML namespace itself.  In other words,
+      if the XML Schema or XML namespaces change, the version of this
+      document at <a href="http://www.w3.org/2001/xml.xsd">
+       http://www.w3.org/2001/xml.xsd 
+      </a> 
+      will change accordingly; the version at 
+      <a href="http://www.w3.org/2009/01/xml.xsd">
+       http://www.w3.org/2009/01/xml.xsd 
+      </a> 
+      will not change.
+     </p>
+     <p>
+      Previous dated (and unchanging) versions of this schema 
+      document are at:
+     </p>
+     <ul>
+      <li><a href="http://www.w3.org/2009/01/xml.xsd">
+	http://www.w3.org/2009/01/xml.xsd</a></li>
+      <li><a href="http://www.w3.org/2007/08/xml.xsd">
+	http://www.w3.org/2007/08/xml.xsd</a></li>
+      <li><a href="http://www.w3.org/2004/10/xml.xsd">
+	http://www.w3.org/2004/10/xml.xsd</a></li>
+      <li><a href="http://www.w3.org/2001/03/xml.xsd">
+	http://www.w3.org/2001/03/xml.xsd</a></li>
+     </ul>
+    </div>
+   </div>
+  </xs:documentation>
+ </xs:annotation>
+
+</xs:schema>
+

backup/restore_check.html

@@ -352,6 +352,40 @@
             }
         }
 
+        // Re-check all the roles creation/mapping stuff
+        if (!empty($restore->course_id)) {
+            $contexttosearch = get_context_instance(CONTEXT_COURSE, $restore->course_id);
+        // if we know the target category, check capability on it
+        } else if (!empty($restore->restore_restorecatto)) {
+            $contexttosearch = get_context_instance(CONTEXT_COURSECAT, $restore->restore_restorecatto);
+        } else {
+            $contexttosearch = get_context_instance(CONTEXT_SYSTEM);
+        }
+        $cancreateroles = has_capability('moodle/role:manage', get_context_instance(CONTEXT_SYSTEM));
+        $canassignroles = has_capability('moodle/role:assign', $contexttosearch);
+        $canoverridecaps= has_capability('moodle/role:override', $contexttosearch) || has_capability('moodle/role:safeoverride', $contexttosearch);
+        if (!empty($restore->rolesmapping)) {
+            foreach ($restore->rolesmapping as $originalrole => $targetrole) {
+                // First, if new role is selected, check used really can do that
+                if (empty($targetrole) && !$cancreateroles) {
+                    $messages[] = get_string('restorecannotcreateorassignroles');
+                    $show_continue_button = false;
+                    break;
+                }
+                // Now, check that the target role is available for role assignments
+                if (!empty($targetrole) && !$canassignroles) {
+                    $messages[] = get_string('restorecannotassignroles');
+                    $show_continue_button = false;
+                    break;
+                }
+                // Now, check that the target role is available for capability overrides
+                if (!empty($targetrole) && !$canoverridecaps) {
+                    $messages[] = get_string('restorecannotoverrideperms');
+                    $show_continue_button = false;
+                    break;
+                }
+            }
+        }
 
     /// If restoring users and backup has mnet remote users and we are restoring to different site, forbid restore to non-admins. MDL-17009
         if ($restore->users != 2 &&                                                   /// If restoring users

backup/restore_form.html

@@ -622,9 +622,10 @@ if ($restoreuserinfo) {
     $allroles = get_records('role');
 
     echo ('<table width="100%" class="restore-form-instances">');
-    echo ('<tr><td align="right" style="width:50%"><b>'.get_string('sourcerole').'</b></td><td align="left" style="width:50%"><b>'.get_string('targetrole').'</b></td></tr>');
 
     if ($info->backup_moodle_version < 2006092801) {
+        echo ('<tr><td align="right" style="width:50%"><b>'.get_string('sourcerole').'</b></td><td align="left" style="width:50%"><b>'.get_string('targetrole').'</b></td></tr>');
+
         // 1.6 and below backup
 
         /// Editting teacher
@@ -669,6 +670,20 @@ if ($restoreuserinfo) {
         // 1.7 and above backup
         $roles = restore_read_xml_roles($xml_file);
 
+        // Calculate if any role can be mapped
+        $str_new = '';
+        $canmaproles = false;
+        if (has_capability('moodle/role:manage', get_context_instance(CONTEXT_SYSTEM))) {
+            $str_new = 'new role';
+            $canmaproles = true;
+        } else if (!empty($siterolesarray)) {
+            $canmaproles = true;
+        }
+
+        if ($canmaproles) {
+            echo ('<tr><td align="right" style="width:50%"><b>'.get_string('sourcerole').'</b></td><td align="left" style="width:50%"><b>'.get_string('targetrole').'</b></td></tr>');
+        }
+
         if (!empty($roles->roles)) { // possible to have course with no roles
             foreach ($siterolesarray as $siteroleid=>$siteroleshortname) {
                 $siteroleschoicearray[$siteroleid] = $siterolesnamearray[$siteroleid]." (". $siterolesarray[$siteroleid].")";
@@ -676,7 +691,12 @@ if ($restoreuserinfo) {
 
             foreach ($roles->roles as $roleid=>$role) {
 
-                $mappableroles = $siteroleschoicearray;
+                if (!$canmaproles) { // User cannot map roles at all, add hidden element and continue
+                    echo "<tr><td colspan=\"2\"><input type=\"hidden\" name=\"roles_{$roleid}\" value=\"0\" /></td></tr>";
+                    continue;
+                }
+
+                $mappableroles = !empty($siteroleschoicearray) ? $siteroleschoicearray : array();
 
                 echo ('<tr><td align="right">');
                 echo '<label for="menuroles_'.$roleid.'">'.format_string($role->name)." (".($role->shortname).")".'</label>';
@@ -700,8 +720,21 @@ if ($restoreuserinfo) {
                             break;
                         }
                     }
+                    // Hack a bit, so, if role continues unmatched, and was "editingteacher", and "teacher" is available
+                    // preselect it as fallback matching (can happen a lot)
+                    if ($matchrole == 0 && $role->shortname == 'editingteacher' && in_array('teacher', $siterolesarray)) {
+                        $matchrole = array_search('teacher', $siterolesarray);
+                    }
+
+                    // If arrived here, role continues unmatched and the user lacks the 'moodle/role:manage' capability
+                    // perform automatic matching to site defaultcourseroleid (only if available in the list)
+                    if ($matchrole == 0 && !has_capability('moodle/role:manage', get_context_instance(CONTEXT_SYSTEM))) {
+                        if (array_key_exists($CFG->defaultcourseroleid, $siterolesarray)) {
+                            $matchrole = $CFG->defaultcourseroleid;
+                        }
+                    }
                 }
-                choose_from_menu ($mappableroles, "roles_".$roleid, $matchrole, 'new role', '', '0');
+                choose_from_menu ($mappableroles, "roles_".$roleid, $matchrole, $str_new, '', '0');
                 echo ('</td></tr>');
             }
         }

backup/restorelib.php

@@ -200,11 +200,31 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
         return $status;
     }
 
+    /**
+     * This function decodes some well-know links to course
+     */
+    function course_decode_content_links($content, $restore) {
+
+        global $CFG;
+
+        // Links to course
+        $searchstring = '/\$@(COURSEVIEWBYID)\*([0-9]+)@\$/';
+        $replacestring= $CFG->wwwroot . '/course/view.php?id=' . $restore->course_id;
+        $result = preg_replace($searchstring, $replacestring, $content);
+
+        return $result;
+    }
+
     //This function is called from all xxxx_decode_content_links_caller(),
     //its task is to ask all modules (maybe other linkable objects) to restore
     //links to them.
     function restore_decode_content_links_worker($content,$restore) {
         global $CFG;
+
+        // Course links decoder
+        $content = course_decode_content_links($content, $restore);
+
+        // Module links decoders
         foreach($restore->mods as $name => $info) {
             $function_name = $name."_decode_content_links";
             if (function_exists($function_name)) {
@@ -705,22 +725,34 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
     * Here it's the logic applied, keep it updated:
     *
     *  If restoring users from same site backup:
-    *      1A - If match by id and username and mnethost  => ok, return target user
-    *      1B - If match by id and mnethost and user is deleted in DB and
-    *           match by email LIKE 'backup_email%'  => ok, return target user
-    *      1C - If match by id and mnethost and user is deleted in backup file
+    *      1A - Normal check: If match by id and username and mnethost  => ok, return target user
+    *      1B - Handle users deleted in DB and "alive" in backup file:
+    *           If match by id and mnethost and user is deleted in DB and
+    *           (match by username LIKE 'backup_email.%' or by non empty email = md5(username)) => ok, return target user
+    *      1C - Handle users deleted in backup file and "alive" in DB:
+    *           If match by id and mnethost and user is deleted in backup file
     *           and match by email = email_without_time(backup_email) => ok, return target user
-    *      1D - If match by username and mnethost and doesn't match by id => conflict, return false
-    *      1E - else => user needs to be created, return true
+    *      1D - Conflict: If match by username and mnethost and doesn't match by id => conflict, return false
+    *      1E - None of the above, return true => User needs to be created
     *
-    *  if restoring from another site backup:
-    *      2A - If match by username and mnethost and
-    *           (email or non-zero firstaccess) => ok, return target user
-    *      2B - Note: we cannot handle "deleted" situations here as far
-    *           as username gets modified and id cannot be used here
-    *      2C - If match by username and mnethost and not
-    *           by (email or non-zero firstaccess) => conflict, return false
-    *      2D - else => user needs to be created, return true
+    *  if restoring from another site backup (cannot match by id here, replace it by email/firstaccess combination):
+    *      2A - Normal check: If match by username and mnethost and (email or non-zero firstaccess) => ok, return target user
+    *      2B - Handle users deleted in DB and "alive" in backup file:
+    *           2B1 - If match by mnethost and user is deleted in DB and not empty email = md5(username) and
+    *                 (username LIKE 'backup_email.%' or non-zero firstaccess) => ok, return target user
+    *           2B2 - If match by mnethost and user is deleted in DB and
+    *                 username LIKE 'backup_email.%' and non-zero firstaccess) => ok, return target user
+    *                 (to cover situations were md5(username) wasn't implemented on delete we requiere both)
+    *      2C - Handle users deleted in backup file and "alive" in DB:
+    *           If match mnethost and user is deleted in backup file
+    *           and by email = email_without_time(backup_email) and non-zero firstaccess=> ok, return target user
+    *      2D - Conflict: If match by username and mnethost and not by (email or non-zero firstaccess) => conflict, return false
+    *      2E - None of the above, return true => User needs to be created
+    *
+    * Note: for DB deleted users email is stored in username field, hence we
+    *       are looking there for emails. See delete_user()
+    * Note: for DB deleted users md5(username) is stored *sometimes* in the email field,
+    *       hence we are looking there for usernames if not empty. See delete_user()
     */
     function restore_check_user($restore, $user) {
         global $CFG;
@@ -734,7 +766,7 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
         }
 
         // Handle checks from same site backups
-        if (backup_is_same_site($restore)) {
+        if (backup_is_same_site($restore) && empty($CFG->forcedifferentsitecheckingusersonrestore)) {
 
             // 1A - If match by id and username and mnethost => ok, return target user
             if ($rec = get_record('user', 'id', $user->id, 'username', addslashes($user->username), 'mnethostid', $user->mnethostid)) {
@@ -742,32 +774,40 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
             }
 
             // 1B - Handle users deleted in DB and "alive" in backup file
-            // 1B1- If match by id and mnethost and user is deleted in DB and
-            //      match by email LIKE 'backup_email.%'  => ok, return target user
-            // Note: for deleted users email is stored in username field, hence we
-            //       are looking there for emails in the query below. See delete_user()
+            // Note: for DB deleted users email is stored in username field, hence we
+            //       are looking there for emails. See delete_user()
+            // Note: for DB deleted users md5(username) is stored *sometimes* in the email field,
+            //       hence we are looking there for usernames if not empty. See delete_user()
+            // If match by id and mnethost and user is deleted in DB and
+            // match by username LIKE 'backup_email.%' or by non empty email = md5(username) => ok, return target user
             if ($rec = get_record_sql("SELECT *
                                          FROM {$CFG->prefix}user u
                                         WHERE id = $user->id
                                           AND mnethostid = $user->mnethostid
                                           AND deleted = 1
-                                          AND username LIKE '$user->email.%'")) {
+                                          AND (
+                                                  username LIKE '".addslashes($user->email).".%'
+                                               OR (
+                                                      ".sql_isnotempty('user', 'email', false, false)."
+                                                  AND email = '".md5($user->username)."'
+                                                  )
+                                              )")) {
                 return $rec; // Matching user, deleted in DB found, return it
             }
 
             // 1C - Handle users deleted in backup file and "alive" in DB
-            // 1C1- If match by id and mnethost and user is deleted in backup file
-            //      and match by email = email_without_time(backup_email) => ok, return target user
+            // If match by id and mnethost and user is deleted in backup file
+            // and match by email = email_without_time(backup_email) => ok, return target user
             if ($user->deleted) {
+                // Note: for DB deleted users email is stored in username field, hence we
+                //       are looking there for emails. See delete_user()
                 // Trim time() from email
-                // Note: for deleted users email is stored in username field, hece
-                //       we are trimming the username field to get the email. See delete_user()
                 $trimemail = preg_replace('/(.*?)\.[0-9]+.?$/', '\\1', $user->username);
                 if ($rec = get_record_sql("SELECT *
                                              FROM {$CFG->prefix}user u
                                             WHERE id = $user->id
                                               AND mnethostid = $user->mnethostid
-                                              AND email = '$trimemail'")) {
+                                              AND email = '".addslashes($trimemail)."'")) {
                     return $rec; // Matching user, deleted in backup file found, return it
                 }
             }
@@ -786,38 +826,80 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
             //     (email or non-zero firstaccess) => ok, return target user
             if ($rec = get_record_sql("SELECT *
                                          FROM {$CFG->prefix}user u
-                                        WHERE username = '$user->username'
+                                        WHERE username = '".addslashes($user->username)."'
                                           AND mnethostid = $user->mnethostid
                                           AND (
-                                                  email = '$user->email'
+                                                  email = '".addslashes($user->email)."'
                                                OR (
                                                       firstaccess != 0
                                                   AND firstaccess = $user->firstaccess
                                                   )
                                               )")) {
-                return $rec; // Matching user
+                return $rec; // Matching user found, return it
             }
 
             // 2B - Handle users deleted in DB and "alive" in backup file
-            // Note: for deleted users email is stored in username field, hence we
-            //       are looking there for emails in the query below. See delete_user()
-            // Note: for deleted users md5(username) is stored *sometimes* in the
-            // email field, hence we are looking there for usernames in the query below
-            // 2B - Note: we cannot handle "deleted" situations here as far
-            //     as username gets modified and id cannot be used either
-            // 2B1-deleted = 1 AND email = md5(username) AND mnsethostid AND (username like $user->email.% OR firstaccess)
-            // 2B2 deleted and mnsethostid AND username like $user->email.% AND firstaccess
-
-            // 2C - Handle users deleted in backup file and "alive" in DB
-
-            // 2D - If match by username and mnethost and not
-            //     by (email or non-zero firstaccess) => conflict, return false
+            // Note: for DB deleted users email is stored in username field, hence we
+            //       are looking there for emails. See delete_user()
+            // Note: for DB deleted users md5(username) is stored *sometimes* in the email field,
+            //       hence we are looking there for usernames if not empty. See delete_user()
+            // 2B1 - If match by mnethost and user is deleted in DB and not empty email = md5(username) and
+            //       (by username LIKE 'backup_email.%' or non-zero firstaccess) => ok, return target user
             if ($rec = get_record_sql("SELECT *
                                          FROM {$CFG->prefix}user u
-                                        WHERE username = '$user->username'
+                                        WHERE mnethostid = $user->mnethostid
+                                          AND deleted = 1
+                                          AND ".sql_isnotempty('user', 'email', false, false)."
+                                          AND email = '".md5($user->username)."'
+                                          AND (
+                                                  username LIKE '".addslashes($user->email).".%'
+                                               OR (
+                                                      firstaccess != 0
+                                                  AND firstaccess = $user->firstaccess
+                                                  )
+                                              )")) {
+                return $rec; // Matching user found, return it
+            }
+
+            // 2B2 - If match by mnethost and user is deleted in DB and
+            //       username LIKE 'backup_email.%' and non-zero firstaccess) => ok, return target user
+            //       (this covers situations where md5(username) wasn't being stored so we require both
+            //        the email & non-zero firstaccess to match)
+            if ($rec = get_record_sql("SELECT *
+                                         FROM {$CFG->prefix}user u
+                                        WHERE mnethostid = $user->mnethostid
+                                          AND deleted = 1
+                                          AND username LIKE '".addslashes($user->email).".%'
+                                          AND firstaccess != 0
+                                          AND firstaccess = $user->firstaccess")) {
+                return $rec; // Matching user found, return it
+            }
+
+            // 2C - Handle users deleted in backup file and "alive" in DB
+            // If match mnethost and user is deleted in backup file
+            // and match by email = email_without_time(backup_email) and non-zero firstaccess=> ok, return target user
+            if ($user->deleted) {
+                // Note: for DB deleted users email is stored in username field, hence we
+                //       are looking there for emails. See delete_user()
+                // Trim time() from email
+                $trimemail = preg_replace('/(.*?)\.[0-9]+.?$/', '\\1', $user->username);
+                if ($rec = get_record_sql("SELECT *
+                                             FROM {$CFG->prefix}user u
+                                            WHERE mnethostid = $user->mnethostid
+                                              AND email = '".addslashes($trimemail)."'
+                                              AND firstaccess != 0
+                                              AND firstaccess = $user->firstaccess")) {
+                    return $rec; // Matching user, deleted in backup file found, return it
+                }
+            }
+
+            // 2D - If match by username and mnethost and not by (email or non-zero firstaccess) => conflict, return false
+            if ($rec = get_record_sql("SELECT *
+                                         FROM {$CFG->prefix}user u
+                                        WHERE username = '".addslashes($user->username)."'
                                           AND mnethostid = $user->mnethostid
                                       AND NOT (
-                                                  email = '$user->email'
+                                                  email = '".addslashes($user->email)."'
                                                OR (
                                                       firstaccess != 0
                                                   AND firstaccess = $user->firstaccess
@@ -830,7 +912,7 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
         // Arrived here, return true as the user will need to be created and no
         // conflicts have been found in the logic above. This covers:
         // 1E - else => user needs to be created, return true
-        // 2D - else => user needs to be created, return true
+        // 2E - else => user needs to be created, return true
         return true;
     }
 
@@ -885,7 +967,7 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
             $user = $rec->info;
 
             // Find the correct mnethostid for user before performing any further check
-            if (empty($user->mnethosturl) || $user->mnethosturl===$CFG->wwwroot) {
+            if (empty($user->mnethosturl) || $user->mnethosturl === $CFG->wwwroot) {
                 $user->mnethostid = $CFG->mnet_localhost_id;
             } else {
                 // fast url-to-id lookups
@@ -900,13 +982,18 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
             $usercheck = restore_check_user($restore, $user);
 
             if (is_object($usercheck)) { // No problem, we have found one user in DB to be mapped to
+                // Annotate it, for later process by restore_create_users(). Set new_id to mapping user->id
+                backup_putid($restore->backup_unique_code, 'user', $userid, $usercheck->id, $user);
 
             } else if ($usercheck === false) { // Found conflict, report it as problem
                 $problems[] = get_string('restoreuserconflict', '', $user->username);
                 $status = false;
 
             } else if ($usercheck === true) { // User needs to be created, check if we are able
-                if (!$cancreateuser) { // Cannot create, report as problem
+                if ($cancreateuser) { // Can create user, annotate it, for later process by restore_create_users(). Set new_id to 0
+                    backup_putid($restore->backup_unique_code, 'user', $userid, 0, $user);
+
+                } else { // Cannot create user, report it as problem
 
                     $problems[] = get_string('restorecannotcreateuser', '', $user->username);
                     $status = false;
@@ -1667,7 +1754,7 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
         $restoreall = true;  // set to false if any grade_item is not selected/restored
         $importing  = !empty($SESSION->restore->importing); // there should not be a way to import old backups, but anyway ;-)
 
-        if ($importing || $restore->users == 2) {
+        if ($importing) {
             $restoreall = false;
 
         } else {
@@ -1858,7 +1945,7 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
         $restoreall = true;  // set to false if any grade_item is not selected/restored or already exist
         $importing  = !empty($SESSION->restore->importing);
 
-        if ($importing || $restore->users == 2) {
+        if ($importing) {
             $restoreall = false;
 
         } else {
@@ -2704,25 +2791,17 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
         $authcache = array(); // Cache to get some bits from authentication plugins
 
         $status = true;
-        //Check it exists
-        if (!file_exists($xml_file)) {
-            $status = false;
-        }
-        //Get info from xml
-        if ($status) {
-            //info will contain the old_id of every user
-            //in backup_ids->info will be the real info (serialized)
-            $info = restore_read_xml_users($restore,$xml_file);
-        }
 
-        //Now, get evey user_id from $info and user data from $backup_ids
-        //and create the necessary db structures
+        // Users have already been checked by restore_precheck_users() so they are loaded
+        // in backup_ids table. They don't need to be loaded (parsed) from XML again. Also, note
+        // the same function has performed the needed modifications in the $user->mnethostid field
+        // so we don't need to do it again here at all. Just some checks.
 
-        if (!empty($info->users)) {
+        // Get users ids from backup_ids table
+        $userids = get_fieldset_select('backup_ids', 'old_id', "backup_code = $restore->backup_unique_code AND table_name = 'user'");
 
-        /// Grab mnethosts keyed by wwwroot, to map to id
-            $mnethosts = get_records('mnet_host', '', '',
-                                     'wwwroot', 'wwwroot, id');
+        // Have users to process, proceed with them
+        if (!empty($userids)) {
 
         /// Get languages for quick search later
             $languages = get_list_of_languages();
@@ -2732,12 +2811,25 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
 
         /// Init trailing messages
             $messages = array();
-            foreach ($info->users as $userid) {
-                $rec = backup_getid($restore->backup_unique_code,"user",$userid);
-                $user = $rec->info;
+            foreach ($userids as $userid) {
+                // Defaults
+                $user_exists = false; // By default user does not exist
+                $newid = null;        // By default, there is not newid
+
+                // Get record from backup_ids
+                $useridsdbrec = backup_getid($restore->backup_unique_code, 'user', $userid);
+
+                // Based in restore_precheck_users() calculations, if the user exists
+                // new_id must contain the id of the matching user
+                if (!empty($useridsdbrec->new_id)) {
+                    $user_exists = true;
+                    $newid = $useridsdbrec->new_id;
+                }
+
+                $user = $useridsdbrec->info;
                 foreach (array_keys(get_object_vars($user)) as $field) {
                     if (!is_array($user->$field)) {
-                        $user->$field = backup_todb($user->$field);
+                        $user->$field = backup_todb($user->$field, false);
                         if (is_null($user->$field)) {
                             $user->$field = '';
                         }
@@ -2782,31 +2874,12 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
                 //Has role teacher or student or needed
                 $is_course_user = ($is_teacher or $is_student or $is_needed);
 
-                // in case we are restoring to same server, look for user by id and username
-                // it should return record always, but in sites rebuilt from scratch
-                // and being reconstructed using course backups
-                $user_data = false;
-                if (backup_is_same_site($restore)) {
-                    $user_data = get_record('user', 'id', $user->id, 'username', addslashes($user->username));
-                }
-
                 // Only try to perform mnethost/auth modifications if restoring to another server
                 // or if, while restoring to same server, the user doesn't exists yet (rebuilt site)
                 //
                 // So existing user data in same server *won't be modified by restore anymore*,
                 // under any circumpstance. If somehting is wrong with existing data, it's server fault.
-                if (!backup_is_same_site($restore) || (backup_is_same_site($restore) && !$user_data)) {
-                    //Calculate mnethostid
-                    if (empty($user->mnethosturl) || $user->mnethosturl===$CFG->wwwroot) {
-                        $user->mnethostid = $CFG->mnet_localhost_id;
-                    } else {
-                        // fast url-to-id lookups
-                        if (isset($mnethosts[$user->mnethosturl])) {
-                            $user->mnethostid = $mnethosts[$user->mnethosturl]->id;
-                        } else {
-                            $user->mnethostid = $CFG->mnet_localhost_id;
-                        }
-                    }
+                if (!backup_is_same_site($restore) || (backup_is_same_site($restore) && !$user_exists)) {
                     //Arriving here, any user with mnet auth and using $CFG->mnet_localhost_id is wrong
                     //as own server cannot be accesed over mnet. Change auth to manual and inform about the switch
                     if ($user->auth == 'mnet' && $user->mnethostid == $CFG->mnet_localhost_id) {
@@ -2825,21 +2898,6 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
                 }
                 unset($user->mnethosturl);
 
-                //To store user->id along all the iteration
-                $newid=null;
-                //check if it exists (by username) and get its id
-                $user_exists = true;
-                if (!backup_is_same_site($restore) || !$user_data) { /// Restoring to another server, or rebuilding site (failed id&
-                                                                     /// login search above), look for existing user based on fields
-                    $user_data = get_record('user', 'username', addslashes($user->username), 'mnethostid', $user->mnethostid);
-                }
-
-                if (!$user_data) {
-                    $user_exists = false;
-                } else {
-                    $newid = $user_data->id;
-                }
-
                 //Flags to see what parts are we going to restore
                 $create_user = true;
                 $create_roles = true;
@@ -2871,8 +2929,6 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
                 if ($create_user) {
                     //Unset the id because it's going to be inserted with a new one
                     unset ($user->id);
-                    // relink the descriptions
-                    $user->description = stripslashes($user->description);
 
                 /// Disable pictures based on global setting or existing empty value (old backups can contain wrong empties)
                     if (!empty($CFG->disableuserimages) || empty($user->picture)) {
@@ -3120,7 +3176,7 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
                     }
                     backup_flush(300);
                 }
-            } /// End of loop over all the users loaded from xml
+            } /// End of loop over all the users loaded from backup_ids table
 
         /// Inform about all the messages geerated while restoring users
             if (!defined('RESTORE_SILENTLY')) {
@@ -3582,6 +3638,10 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
                             } else {
                                 $sca->userid = $USER->id;
                             }
+                            // If course scale, recode the course field
+                            if ($sca->courseid != 0) {
+                                $sca->courseid = $restore->course_id;
+                            }
                             // If scale is standard, if user lacks perms to manage standar scales
                             // 'downgrade' them to course scales
                             if ($sca->courseid == 0 and !has_capability('moodle/course:managescales', get_context_instance(CONTEXT_SYSTEM), $sca->userid)) {
@@ -8202,7 +8262,6 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
 
         // Precheck the users section, detecting various situations that can lead to problems, so
         // we stop restore before performing any further action
-        /*
         if (!defined('RESTORE_SILENTLY')) {
             echo '<li>'.get_string('restoreusersprecheck').'</li>';
         }
@@ -8216,7 +8275,6 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
             }
             return false;
         }
-        */
 
         //If we've selected to restore into new course
         //create it (course)
@@ -9046,6 +9104,7 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
      * It isn't now, just overwriting
      */
     function restore_create_roles($restore, $xmlfile) {
+        global $CFG;
         if (!defined('RESTORE_SILENTLY')) {
             echo "<li>".get_string("creatingrolesdefinitions").'</li>';
         }
@@ -9080,7 +9139,8 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
                     $status = backup_putid($restore->backup_unique_code,"role",$oldroleid,
                                      $rolemappings[$oldroleid]); // adding a new id
 
-                } else {
+                // check for permissions before create new roles
+                } else if (has_capability('moodle/role:manage', get_context_instance(CONTEXT_SYSTEM))) {
 
                     // code to make new role name/short name if same role name or shortname exists
                     $fullname = $roledata->name;
@@ -9123,7 +9183,14 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
 
                         insert_record('role_capabilities', $roleinfo);
                     }
+                } else {
+                    // map the new role to course default role
+                    if (!$default_role = get_field("course", "defaultrole", "id", $restore->course_id)) {
+                        $default_role = $CFG->defaultcourseroleid;
+                    }
+                    $status = backup_putid($restore->backup_unique_code, "role", $oldroleid, $default_role);
                 }
+
             /// Now, restore role nameincourse (only if the role had nameincourse in backup)
                 if (!empty($roledata->nameincourse)) {
                     $newrole = backup_getid($restore->backup_unique_code, 'role', $oldroleid); /// Look for target role

blocks/admin/block_admin.php

@@ -116,7 +116,7 @@ class block_admin extends block_list {
         if ($course->metacourse) {
             if (has_capability('moodle/course:managemetacourse', $context)) {
                 $strchildcourses = get_string('childcourses');
-                $this->content->items[]='<a href="importstudents.php?id='.$this->instance->pageid.'">'.$strchildcourses.'</a>';
+                $this->content->items[]='<a href="'.$CFG->wwwroot.'/course/importstudents.php?id='.$this->instance->pageid.'">'.$strchildcourses.'</a>';
                 $this->content->icons[]='<img src="'.$CFG->pixpath.'/i/course.gif" class="icon" alt="" />';
             } else if (has_capability('moodle/role:assign', $context)) {
                 $strchildcourses = get_string('childcourses');

blocks/mentees/block_mentees.php

@@ -38,7 +38,7 @@ class block_mentees extends block_base {
                                            
             $this->content->text = '<ul>';
             foreach ($usercontexts as $usercontext) {
-                $this->content->text .= '<li><a href="'.$CFG->wwwroot.'/user/view.php?id='.$usercontext->instanceid.'&amp;course=1">'.fullname($usercontext).'</a></li>';                
+                $this->content->text .= '<li><a href="'.$CFG->wwwroot.'/user/view.php?id='.$usercontext->instanceid.'&amp;course='.SITEID.'">'.fullname($usercontext).'</a></li>';
             }
             $this->content->text .= '</ul>';                    
         }

blocks/quiz_results/block_quiz_results.php

@@ -337,7 +337,7 @@ class block_quiz_results extends block_base {
                 foreach($best as $userid => $gradeid) {
                     switch($nameformat) {
                         case B_QUIZRESULTS_NAME_FORMAT_ID:
-                            $thisname = $course->student.' '.intval($users[$userid]->idnumber);
+                            $thisname = $course->student.' '.$users[$userid]->idnumber;
                         break;
                         case B_QUIZRESULTS_NAME_FORMAT_ANON:
                             $thisname = $course->student;

blocks/search/config_global.html

@@ -122,7 +122,7 @@ if (!isset($CFG->block_search_softlock)){
     </tr>
 </table>
 
-<fieldset name="">
+<fieldset class="">
 <legend align="top"><?php print_string('pdfhandling', 'block_search') ?></legend> 
 <table cellspacing="5" width="90%">
     <tr>
@@ -147,7 +147,7 @@ if (!isset($CFG->block_search_softlock)){
 </table>
 </fieldset>
 
-<fieldset name="">
+<fieldset class="">
 <legend align="top"><?php print_string('wordhandling', 'block_search') ?></legend> 
 <table cellspacing="5" width="90%">
     <tr>
@@ -198,7 +198,7 @@ if (!empty($types)){
         $type = trim($type);
         if (preg_match("/\\b$type\\b/i", $defaultfiletypes)) continue;
 ?>
-<fieldset name="">
+<fieldset class="">
 <legend align="top"><?php echo get_string('handlingfor', 'block_search').' '.$utype ?></legend> 
 <table cellspacing="5" width="90%">
     <tr>
@@ -234,7 +234,7 @@ if (!empty($types)){
 }
 ?>
 
-<fieldset name="">
+<fieldset class="">
 <legend align="top"><?php echo get_string('searchdiscovery', 'block_search') ?></legend> 
 <table>
     <tr>
@@ -250,7 +250,7 @@ if (!empty($types)){
 </table>
 </fieldset>
 
-<fieldset name="">
+<fieldset class="">
 <legend align="top"><?php echo get_string('modulessearchswitches', 'block_search') ?></legend> 
 <table cellspacing="5" width="90%">
     <tr valign="top">
@@ -283,7 +283,7 @@ if (!$found_searchable_modules) {
 </table>
 </fieldset>
 
-<fieldset name="">
+<fieldset class="">
 <legend align="top"><?php echo get_string('blockssearchswitches', 'block_search') ?></legend> 
 <table cellspacing="5" width="90%">
     <tr valign="top">

blocks/section_links/block_section_links.php

@@ -4,7 +4,7 @@ class block_section_links extends block_base {
 
     function init() {
         $this->title = get_string('blockname', 'block_section_links');
-        $this->version = 2007101509;
+        $this->version = 2007101511;
     }
 
     function instance_config($instance) {
@@ -29,6 +29,11 @@ class block_section_links extends block_base {
         global $CFG, $USER, $COURSE;
 
         $highlight = 0;
+        if(isset($this->config)){
+            $config = $this->config;
+        } else{
+            $config = get_config('blocks/section_links');
+        }
 
         if ($this->content !== NULL) {
             return $this->content;
@@ -60,11 +65,21 @@ class block_section_links extends block_base {
             $sectionname = 'topic';
         }
         $inc = 1;
-        if ($course->numsections > 22) {
-            $inc = 2;
+
+        if(!empty($config->numsections1) and ($course->numsections > $config->numsections1)) {
+            $inc = $config->incby1;
+        } else {
+            if ($course->numsections > 22) {
+                $inc = 2;
+            }
         }
-        if ($course->numsections > 40) {
-            $inc = 5;
+
+        if(!empty($config->numsections2) and ($course->numsections > $config->numsections2)) {
+            $inc = $config->incby2;
+        } else {
+            if ($course->numsections > 40) {
+                $inc = 5;
+            }
         }
 
         if (!empty($USER->id)) {
@@ -112,6 +127,16 @@ class block_section_links extends block_base {
         $this->content->text = $text;
         return $this->content;
     }
+    /**
+     * Has instance config
+     * @return boolean
+     **/
+    function instance_allow_config() {
+        return true;
+    }
+    function before_delete() {
+        delete_records('config_plugins', 'plugin', 'blocks/section_links');
+    }
 }
 
 ?>

blocks/section_links/config_instance.html

@@ -0,0 +1,73 @@
+<?php
+$numberofsections = array();
+for ($i = 1; $i < 53; $i++){
+	$numberofsections[$i] = $i;
+}
+
+$increments = array();
+
+for ($i = 1; $i < 11; $i++){
+	$increments[$i] = $i;
+}
+
+if(isset($this->config)){
+	$config = $this->config;
+} else{
+	$config = get_config('blocks/section_links');
+}
+
+$selected = array();
+if (!empty($config->numsections1)) {
+    if (empty($config->incby1)) {
+        $config->incby1 = 2;
+    }
+    $selected[1] = array($config->numsections1, $config->incby1);
+} else {
+    $selected[1] = array(22, 2);
+}
+
+if (!empty($config->numsections2)) {
+    if (empty($config->incby1)) {
+        $config->incby1 = 5;
+    }
+    $selected[2] = array($config->numsections2, $config->incby2);
+} else {
+    $selected[2] = array(40, 5);
+}
+
+?>
+<table cellpadding="9" cellspacing="0">
+<?php
+for($i = 1; $i < 3; $i++){
+?>
+	<tr valign="top">
+	    <td align="right">
+	        <?php print_string('numsections'.$i, 'block_section_links'); ?>:
+	    </td>
+	    <td>
+	        <?php choose_from_menu($numberofsections, 'numsections'.$i, $selected[$i][0]); ?>
+	    </td>
+	    <td>
+	        <?php print_string('numsectionsdesc'.$i, 'block_section_links'); ?>
+	    </td>
+	</tr>
+	<tr valign="top">
+	    <td align="right">
+	        <?php print_string('incby'.$i, 'block_section_links'); ?>:
+	    </td>
+	    <td>
+	        <?php choose_from_menu($increments, 'incby'.$i, $selected[$i][1]); ?>
+	    </td>
+	    <td>
+	        <?php print_string('incbydesc'.$i, 'block_section_links'); ?>
+	    </td>
+	</tr>	
+<?php }
+?>
+<tr>
+    <td colspan="3" align="center">
+        <input type="hidden" name="sesskey" value="<?php echo sesskey();?>">
+        <input type="submit" value="<?php print_string('savechanges') ?>" />
+    </td>
+</tr>
+</table>

blocks/section_links/settings.php

@@ -0,0 +1,33 @@
+<?php
+$configs = array();
+
+$numberofsections = array();
+
+for ($i = 1; $i < 53; $i++){
+	$numberofsections[$i] = $i;
+}
+$increments = array();
+
+for ($i = 1; $i < 11; $i++){
+	$increments[$i] = $i;
+}
+
+$selected = array(1 => array(22,2), 
+                  2 => array(40,5));
+
+for($i = 1; $i < 3; $i++){
+    $configs[] = new admin_setting_configselect('numsections'.$i, get_string('numsections'.$i, 'block_section_links'), 
+                        get_string('numsectionsdesc'.$i, 'block_section_links'),
+                        $selected[$i][0], $numberofsections);
+
+    $configs[] = new admin_setting_configselect('incby'.$i, get_string('incby'.$i, 'block_section_links'), 
+                        get_string('incbydesc'.$i, 'block_section_links'),
+                        $selected[$i][1], $increments);
+}
+                                          
+foreach ($configs as $config) {
+    $config->plugin = 'blocks/section_links';
+    $settings->add($config);
+}
+
+?>

blocks/tag_youtube/block_tag_youtube.php

@@ -5,7 +5,6 @@ require_once($CFG->libdir . '/filelib.php');
 require_once($CFG->libdir . '/magpie/rss_cache.inc');
 require_once($CFG->libdir . '/phpxml/xml.php');
 
-define('YOUTUBE_DEV_KEY', 'Dlp6qqRbI28');
 define('DEFAULT_NUMBER_OF_VIDEOS', 5);
 define('YOUTUBE_CACHE_EXPIRATION', 1800);
 
@@ -22,6 +21,9 @@ class block_tag_youtube extends block_base {
 
     function specialization() {
         $this->title = !empty($this->config->title) ? $this->config->title : get_string('blockname', 'block_tag_youtube');
+        // Convert numeric categories (old YouTube API) to
+        // textual ones (new Google Data API)
+        $this->config->category = !empty($this->config->category) ? $this->category_map_old2new($this->config->category) : '0';
     }
 
     function instance_allow_multiple() {
@@ -30,7 +32,7 @@ class block_tag_youtube extends block_base {
 
     function preferred_width() {
         return 140;
-    } 
+    }
 
     function get_content() {
 
@@ -67,19 +69,18 @@ class block_tag_youtube extends block_base {
             $numberofvideos = $this->config->numberofvideos;
         }
 
-        $request = 'http://www.youtube.com/api2_rest?method=youtube.videos.list_by_playlist';
-        $request .= '&dev_id=' . YOUTUBE_DEV_KEY;
-        $request .= "&id={$this->config->playlist}";
-        $request .= "&page=1";
-        $request .= "&per_page={$numberofvideos}";
-
+        $request = 'http://gdata.youtube.com/feeds/api/playlists/' .
+                   $this->config->playlist .
+                   '?start-index=1&max-results=' .
+                   $numberofvideos .
+                   '&format=5';
         return $this->fetch_request($request);
     }
 
     function get_videos_by_tag(){
 
         $tagid = optional_param('id', 0, PARAM_INT);   // tag id - for backware compatibility
-        $tag = optional_param('tag', '', PARAM_TAG); // tag 
+        $tag = optional_param('tag', '', PARAM_TAG); // tag
 
         if ($tag) {
             $tagobject = tag_get('name', $tag);
@@ -98,11 +99,11 @@ class block_tag_youtube extends block_base {
             $numberofvideos = $this->config->numberofvideos;
         }
 
-        $request = 'http://www.youtube.com/api2_rest?method=youtube.videos.list_by_tag';
-        $request .= '&dev_id='. YOUTUBE_DEV_KEY;
-        $request .= "&tag={$querytag}";
-        $request .= "&page=1";
-        $request .= "&per_page={$numberofvideos}";
+        $request = 'http://gdata.youtube.com/feeds/api/videos?vq=' .
+                   $querytag .
+                   '&start-index=1&max-results=' .
+                   $numberofvideos .
+                   '&format=5';
 
         return $this->fetch_request($request);
     }
@@ -110,7 +111,7 @@ class block_tag_youtube extends block_base {
     function get_videos_by_tag_and_category(){
 
         $tagid = optional_param('id', 0, PARAM_INT);   // tag id - for backware compatibility
-        $tag = optional_param('tag', '', PARAM_TAG); // tag 
+        $tag = optional_param('tag', '', PARAM_TAG); // tag
 
         if ($tag) {
             $tagobject = tag_get('name', $tag);
@@ -129,12 +130,13 @@ class block_tag_youtube extends block_base {
             $numberofvideos = $this->config->numberofvideos;
         }
 
-        $request = 'http://www.youtube.com/api2_rest?method=youtube.videos.list_by_category_and_tag';
-        $request .= '&category_id='.$this->config->category;
-        $request .= '&dev_id=' . YOUTUBE_DEV_KEY;
-        $request .= "&tag={$querytag}";
-        $request .= "&page=1";
-        $request .= "&per_page={$numberofvideos}";
+        $request = 'http://gdata.youtube.com/feeds/api/videos?category=' .
+                   $this->category_map_old2new($this->config->category) .
+                   '&vq=' .
+                   $querytag .
+                   '&start-index=1&max-results=' .
+                   $numberofvideos .
+                   '&format=5';
 
         return $this->fetch_request($request);
     }
@@ -151,6 +153,8 @@ class block_tag_youtube extends block_base {
         if ( $cache_status == 'HIT' ) {
             $cached_response = $cache->get( $request );
 
+            // TODO: Stop using phpxml, switching to DOM/Simple for this
+            // TODO: Drop lib/phpxml if 0 uses in core/contrib
             $xmlobj = XML_unserialize($cached_response);
             return $this->render_video_list($xmlobj);
         }
@@ -168,6 +172,8 @@ class block_tag_youtube extends block_base {
             $cache->set($request, $response);
         }
 
+        // TODO: Stop using phpxml, switching to DOM/Simple for this
+        // TODO: Drop lib/phpxml if 0 uses in core/contrib
         $xmlobj = XML_unserialize($response);
         return $this->render_video_list($xmlobj);
     }
@@ -176,26 +182,89 @@ class block_tag_youtube extends block_base {
 
         $text = '';
         $text .= '<ul class="yt-video-entry unlist img-text">';
-        $videos = $xmlobj['ut_response']['video_list']['video'];
+        $videos = $xmlobj['feed']['entry'];
 
         if (is_array($videos) ) {
             foreach($videos as $video){
+                $url       = s($video['media:group']['media:player attr']['url']);
+                $thumbnail = s($video['media:group']['media:thumbnail']['0 attr']['url']);
+                $title     = s($video['media:group']['media:title']);
+                $seconds   = $video['media:group']['yt:duration attr']['seconds'];
+
                 $text .= '<li>';
                 $text .= '<div class="clearfix">';
-                $text .= '<a href="'. s($video['url']) . '">';
-                $text .= '<img alt="" class="youtube-thumb" src="'. $video['thumbnail_url'] .'" /></a>';
-                $text .= '</div><span><a href="'. s($video['url']) . '">'.s($video['title']).'</a></span>';
+                $text .= '<a href="'. $url . '">';
+                $text .= '<img alt="" class="youtube-thumb" src="'. $thumbnail .'" /></a>';
+                $text .= '</div><span><a href="'. $url . '">'. $title .'</a></span>';
                 $text .= '<div>';
-                $text .= format_time($video['length_seconds']);
+                $text .= format_time($seconds);
                 $text .= "</div></li>\n";
             }
-        } else { 
+        } else {
             // if youtube is offline, or for whatever reason the previous
-            // call doesn't work... 
+            // call doesn't work...
             //add_to_log(SITEID, 'blocks/tag_youtube', 'problem in getting videos off youtube');
         }
         $text .= "</ul><div class=\"clearer\"></div>\n";
         return $text;
     }
+
+    function get_categories() {
+        // TODO: Right now using sticky categories from
+        // http://gdata.youtube.com/schemas/2007/categories.cat
+        // This should be performed from time to time by the block insead
+        // and cached somewhere, avoiding deprecated ones and observing regions
+        return array (
+            '0' => get_string('anycategory', 'block_tag_youtube'),
+            'Film'  => get_string('filmsanimation', 'block_tag_youtube'),
+            'Autos' => get_string('autosvehicles', 'block_tag_youtube'),
+            'Music' => get_string('music', 'block_tag_youtube'),
+            'Animals'=> get_string('petsanimals', 'block_tag_youtube'),
+            'Sports' => get_string('sports', 'block_tag_youtube'),
+            'Travel' => get_string('travel', 'block_tag_youtube'),
+            'Games'  => get_string('gadgetsgames', 'block_tag_youtube'),
+            'Comedy' => get_string('comedy', 'block_tag_youtube'),
+            'People' => get_string('peopleblogs', 'block_tag_youtube'),
+            'News'   => get_string('newspolitics', 'block_tag_youtube'),
+            'Entertainment' => get_string('entertainment', 'block_tag_youtube'),
+            'Education' => get_string('education', 'block_tag_youtube'),
+            'Howto'  => get_string('howtodiy', 'block_tag_youtube'),
+            'Tech'   => get_string('scienceandtech', 'block_tag_youtube')
+        );
+    }
+
+    /**
+     * Provide conversion from old numeric categories available in youtube API
+     * to the new ones available in the Google API
+     *
+     * @param int $oldcat old category code
+     * @return mixed new category code or 0 (if no match found)
+     *
+     * TODO: Someday this should be applied on upgrade for all the existing
+     * block instances so we won't need the mapping any more. That would imply
+     * to implement restore handling to perform the conversion of old blocks.
+     */
+    function category_map_old2new($oldcat) {
+        $oldoptions = array (
+            0  => '0',
+            1  => 'Film',
+            2  => 'Autos',
+            23 => 'Comedy',
+            24 => 'Entertainment',
+            10 => 'Music',
+            25 => 'News',
+            22 => 'People',
+            15 => 'Animals',
+            26 => 'Howto',
+            17 => 'Sports',
+            19 => 'Travel',
+            20 => 'Games'
+        );
+        if (array_key_exists($oldcat, $oldoptions)) {
+            return $oldoptions[$oldcat];
+        } else {
+            return $oldcat;
+        }
+    }
 }
 ?>

blocks/tag_youtube/config_instance.html

@@ -12,30 +12,15 @@
 <tr valign="top">
     <td align="right"><?php print_string('category', 'block_tag_youtube'); ?>:</td>
     <td>
-        <?php 
+        <?php
                 if (isset($this->config) && isset($this->config->category)) {
                         $selected = $this->config->category;
                 } else {
                        $selected = 0;
                 }
-    /* http://youtube.com/dev_api_ref?m=youtube.videos.list_by_category_and_tag */
-                $options = array ( 0 => get_string('anycategory', 'block_tag_youtube'),
-                                   1  => get_string('filmsanimation', 'block_tag_youtube'),
-                                   2 => get_string('autosvehicles', 'block_tag_youtube'),
-                                   23 => get_string('comedy', 'block_tag_youtube'),
-                                   24 => get_string('entertainment', 'block_tag_youtube'),
-                                   10 => get_string('music', 'block_tag_youtube'),
-                                   25 => get_string('newspolitics', 'block_tag_youtube'),
-                                   22 => get_string('peopleblogs', 'block_tag_youtube'),
-                                   15 => get_string('petsanimals', 'block_tag_youtube'),
-                                   26 => get_string('howtodiy', 'block_tag_youtube'),
-                                   17 => get_string('sports', 'block_tag_youtube'),
-                                   19 => get_string('travel', 'block_tag_youtube'),
-                                   20 => get_string('gadgetsgames', 'block_tag_youtube'),
-                                   );
-
-                choose_from_menu ($options, 'category', $selected);
-        ?>    
+                $categories = $this->get_categories();
+                choose_from_menu ($categories, 'category', $selected);
+        ?>
     </td>
 </tr>
 <tr valign="top">
@@ -48,4 +33,4 @@
     <td colspan="3" align="center">
     <input type="submit" value="<?php print_string('savechanges') ?>" /></td>
 </tr>
-</table>
+</table>

blog/edit.php

@@ -108,8 +108,8 @@ switch ($action) {
             error('Incorrect blog post id');
         }
         $post->id           = $existing->id;
-        $post->subject      = $existing->subject;
-        $post->summary      = $existing->summary;
+        $post->subject      = clean_text($existing->subject);
+        $post->summary      = clean_text($existing->summary, $existing->format);
         $post->publishstate = $existing->publishstate;
         $post->format       = $existing->format;
         $post->action       = $action;

blog/edit_form.php

@@ -1,5 +1,9 @@
 <?php  // $Id$
 
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once($CFG->libdir.'/formslib.php');
 
 class blog_edit_form extends moodleform {

blog/header.php

@@ -1,5 +1,7 @@
 <?php //$Id$
 
+defined('MOODLE_INTERNAL') || die();
+
 /// Sets up blocks and navigation for index.php
 
 require_once($CFG->dirroot .'/blog/lib.php');

blog/lib.php

@@ -659,17 +659,20 @@
 
 
     /// Find the base url from $_GET variables, for print_paging_bar
+    /// WARNING:  EVIL EVIL EVIL!  This function directly acesses $_GET which is a big no no. MDL-22631
+    /// I added some clean_param() calls for now but $_GET should just not ever be used directly.  
+    /// The function is totally gone in Moodle 2.0.
     function get_baseurl($filtertype, $filterselect) {
 
-        $getcopy  = $_GET;
-
-        unset($getcopy['blogpage']);
+        unset($_GET['blogpage']);
 
         $strippedurl = strip_querystring(qualified_me());
-        if(!empty($getcopy)) {
+        if(!empty($_GET)) {
             $first = false;
             $querystring = '';
-            foreach($getcopy as $var => $val) {
+            foreach($_GET as $var => $val) {
+                $var = clean_param($var, PARAM_ALPHANUM);   // See MDL-22631
+                $val = clean_param($val, PARAM_CLEAN);
                 if(!$first) {
                     $first = true;
                     if ($var != 'filterselect' && $var != 'filtertype') {
@@ -680,8 +683,8 @@
                     }
                 } else {
                     if ($var != 'filterselect' && $var != 'filtertype') {
-                    $querystring .= '&'.$var.'='.$val;
-                    $hasparam = true;
+                        $querystring .= '&'.$var.'='.$val;
+                        $hasparam = true;
                     }
                 }
             }

calendar/event.php

@@ -334,9 +334,9 @@
 
         case 'edit':
             if(empty($form)) {
-                $form->name = $event->name;
+                $form->name = clean_text($event->name);
                 $form->courseid = $event->courseid; // Not to update, but for date validation
-                $form->description = $event->description;
+                $form->description = clean_text($event->description);
                 $form->timestart = $event->timestart;
                 $form->timeduration = $event->timeduration;
                 $form->id = $event->id;

calendar/view.php

@@ -251,7 +251,10 @@ function calendar_show_day($d, $m, $y, $courses, $groups, $users, $courseid) {
         $text.= '</div></form></div>';
     }
 
-    $text .= get_string('dayview', 'calendar').': '.calendar_course_filter_selector($getvars);
+    $text .= '<label for="cal_course_flt_jump">'.
+               get_string('dayview', 'calendar').
+             ':</label>'.
+             calendar_course_filter_selector($getvars);
 
     echo '<div class="header">'.$text.'</div>';
 
@@ -374,7 +377,7 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course
             }
         }
     }
-    
+
     // Extract information: events vs. time
     calendar_events_by_day($events, $m, $y, $eventsbyday, $durationbyday, $typesbyday, $courses);
 
@@ -517,55 +520,51 @@ function calendar_show_month_detailed($m, $y, $courses, $groups, $users, $course
 
     echo "</table>\n"; // Tabular display of days ends
 
-	// OK, now for the filtering display 	 
-	     echo '<div class="filters"><table><tr>'; 	 
-	  	 
-	     // Global events 	 
-	     if($SESSION->cal_show_global) { 	 
-	         echo '<td class="event_global" style="width: 8px;"></td><td><strong>'.get_string('globalevents', 'calendar').':</strong> '; 	 
-	         echo get_string('shown', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showglobal&amp;'.$getvars.'">'.get_string('clickhide', 'calendar').'</a>)</td>'."\n"; 	 
-	     } 	 
-	     else { 	 
-	         echo '<td style="width: 8px;"></td><td><strong>'.get_string('globalevents', 'calendar').':</strong> '; 	 
-	         echo get_string('hidden', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showglobal&amp;'.$getvars.'">'.get_string('clickshow', 'calendar').'</a>)</td>'."\n"; 	 
-	     } 	 
-	  	 
-	     // Course events 	 
-	     if(!empty($SESSION->cal_show_course)) { 	 
-	         echo '<td class="event_course" style="width: 8px;"></td><td><strong>'.get_string('courseevents', 'calendar').':</strong> '; 	 
-	         echo get_string('shown', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showcourses&amp;'.$getvars.'">'.get_string('clickhide', 'calendar').'</a>)</td>'."\n"; 	 
-	     } 	 
-	     else { 	 
-	         echo '<td style="width: 8px;"></td><td><strong>'.get_string('courseevents', 'calendar').':</strong> '; 	 
-	         echo get_string('hidden', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showcourses&amp;'.$getvars.'">'.get_string('clickshow', 'calendar').'</a>)</td>'."\n"; 	 
-	     } 	 
-	  	 
-	     echo "</tr>\n"; 	 
-	  	 
-	     if(!empty($USER->id) && !isguest()) { 	 
-	         echo '<tr>'; 	 
-	         // Group events 	 
-	         if($SESSION->cal_show_groups) { 	 
-	             echo '<td class="event_group" style="width: 8px;"></td><td><strong>'.get_string('groupevents', 'calendar').':</strong> '; 	 
-	             echo get_string('shown', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showgroups&amp;'.$getvars.'">'.get_string('clickhide', 'calendar').'</a>)</td>'."\n"; 	 
-	         } 	 
-	         else { 	 
-	             echo '<td style="width: 8px;"></td><td><strong>'.get_string('groupevents', 'calendar').':</strong> '; 	 
-	             echo get_string('hidden', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showgroups&amp;'.$getvars.'">'.get_string('clickshow', 'calendar').'</a>)</td>'."\n"; 	 
-	         } 	 
-	         // User events 	 
-	         if($SESSION->cal_show_user) { 	 
-	             echo '<td class="event_user" style="width: 8px;"></td><td><strong>'.get_string('userevents', 'calendar').':</strong> '; 	 
-	             echo get_string('shown', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showuser&amp;'.$getvars.'">'.get_string('clickhide', 'calendar').'</a>)</td>'."\n"; 	 
-	         } 	 
-	         else { 	 
-	             echo '<td style="width: 8px;"></td><td><strong>'.get_string('userevents', 'calendar').':</strong> '; 	 
-	             echo get_string('hidden', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showuser&amp;'.$getvars.'">'.get_string('clickshow', 'calendar').'</a>)</td>'."\n"; 	 
-	         } 	 
-	         echo "</tr>\n"; 	 
-	     } 	 
-	  	 
-	     echo '</table></div>';
+    // OK, now for the filtering display
+    echo '<div class="filters"><table><tr>';
+
+    // Global events
+    if($SESSION->cal_show_global) {
+        echo '<td class="event_global" style="width: 8px;"></td><td><strong>'.get_string('globalevents', 'calendar').':</strong> ';
+        echo get_string('shown', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showglobal&amp;'.$getvars.'">'.get_string('clickhide', 'calendar').'</a>)</td>'."\n";
+    } else {
+        echo '<td style="width: 8px;"></td><td><strong>'.get_string('globalevents', 'calendar').':</strong> ';
+        echo get_string('hidden', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showglobal&amp;'.$getvars.'">'.get_string('clickshow', 'calendar').'</a>)</td>'."\n";
+    }
+
+    // Course events
+    if(!empty($SESSION->cal_show_course)) {
+        echo '<td class="event_course" style="width: 8px;"></td><td><strong>'.get_string('courseevents', 'calendar').':</strong> ';
+        echo get_string('shown', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showcourses&amp;'.$getvars.'">'.get_string('clickhide', 'calendar').'</a>)</td>'."\n";
+    } else {
+        echo '<td style="width: 8px;"></td><td><strong>'.get_string('courseevents', 'calendar').':</strong> ';
+        echo get_string('hidden', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showcourses&amp;'.$getvars.'">'.get_string('clickshow', 'calendar').'</a>)</td>'."\n";
+    }
+
+    echo "</tr>\n";
+
+    if(!empty($USER->id) && !isguest()) {
+        echo '<tr>';
+        // Group events
+        if($SESSION->cal_show_groups) {
+            echo '<td class="event_group" style="width: 8px;"></td><td><strong>'.get_string('groupevents', 'calendar').':</strong> ';
+            echo get_string('shown', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showgroups&amp;'.$getvars.'">'.get_string('clickhide', 'calendar').'</a>)</td>'."\n";
+        } else {
+            echo '<td style="width: 8px;"></td><td><strong>'.get_string('groupevents', 'calendar').':</strong> ';
+            echo get_string('hidden', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showgroups&amp;'.$getvars.'">'.get_string('clickshow', 'calendar').'</a>)</td>'."\n";
+        }
+        // User events
+        if($SESSION->cal_show_user) {
+            echo '<td class="event_user" style="width: 8px;"></td><td><strong>'.get_string('userevents', 'calendar').':</strong> ';
+            echo get_string('shown', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showuser&amp;'.$getvars.'">'.get_string('clickhide', 'calendar').'</a>)</td>'."\n";
+        } else {
+            echo '<td style="width: 8px;"></td><td><strong>'.get_string('userevents', 'calendar').':</strong> ';
+            echo get_string('hidden', 'calendar').' (<a href="'.CALENDAR_URL.'set.php?var=showuser&amp;'.$getvars.'">'.get_string('clickshow', 'calendar').'</a>)</td>'."\n";
+        }
+        echo "</tr>\n";
+    }
+
+    echo '</table></div>';
 }
 
 function calendar_show_upcoming_events($courses, $groups, $users, $futuredays, $maxevents, $courseid) {
@@ -581,15 +580,14 @@ function calendar_show_upcoming_events($courses, $groups, $users, $futuredays, $
         $text.= '<div>';
         $text.= '<input type="hidden" name="action" value="new" />';
         $text.= '<input type="hidden" name="course" value="'.$courseid.'" />';
-        /*
-        $text.= '<input type="hidden" name="cal_m" value="'.$m.'" />';
-        $text.= '<input type="hidden" name="cal_y" value="'.$y.'" />';
-        */
         $text.= '<input type="submit" value="'.get_string('newevent', 'calendar').'" />';
         $text.= '</div></form></div>';
     }
 
-    $text .= get_string('upcomingevents', 'calendar').': '.calendar_course_filter_selector('from=upcoming');
+    $text .= '<label for="cal_course_flt_jump">'.
+               get_string('upcomingevents', 'calendar').
+             ': </label>'.
+             calendar_course_filter_selector('from=upcoming');
 
     echo '<div class="header">'.$text.'</div>';
 

config-dist.php

@@ -28,6 +28,7 @@
 //                                                                       //
 ///////////////////////////////////////////////////////////////////////////
 unset($CFG);  // Ignore this line
+$CFG = new stdClass();
 
 //=========================================================================
 // 1. DATABASE SETUP
@@ -176,6 +177,22 @@ $CFG->admin = 'admin';
 // shared out from your site/institution!
 //      $CFG->includeuserpasswordsinbackup = true;
 //
+// Completely disable user creation when restoring a course, bypassing any
+// permissions granted via roles and capabilities. Enabling this setting
+// results in the restore process stopping when a user attempts to restore a
+// course requiring users to be created.
+//     $CFG->disableusercreationonrestore = true;
+//
+// Modify the restore process in order to force the "user checks" to assume
+// that the backup originated from a different site, so detection of matching
+// users is performed with different (more "relaxed") rules. Note that this is
+// only useful if the backup file has been created using Moodle < 1.9.4 and the
+// site has been rebuilt from scratch using backup files (not the best way btw).
+// If you obtain user conflicts on restore, rather than enabling this setting
+// permanently, try restoring the backup on a different site, back it up again
+// and then restore on the target server.
+//    $CFG->forcedifferentsitecheckingusersonrestore = true;
+//
 // Prevent stats processing and hide the GUI
 //      $CFG->disablestatsprocessing = true;
 //
@@ -347,6 +364,8 @@ $CFG->admin = 'admin';
 // When working with production data on test servers, no emails should ever be send to real users
 // $CFG->noemailever = true;
 //
+// Divert all outgoing emails to this address to test and debug emailing features
+// $CFG->divertallemailsto = 'root@localhost.local';
 //
 //=========================================================================
 // ALL DONE!  To continue installation, visit your main page with a browser

course/category.php

@@ -57,9 +57,9 @@
         if ($resort and confirm_sesskey()) {
             if ($courses = get_courses($category->id, "fullname ASC", 'c.id,c.fullname,c.sortorder')) {
                 // move it off the range
-                $count = get_record_sql('SELECT MAX(sortorder) AS max, 1
+                $count = get_record_sql('SELECT MIN(sortorder) AS min, 1
                                          FROM ' . $CFG->prefix . 'course WHERE category=' . $category->id);
-                $count = $count->max + 100;
+                $count = $count->min;
                 begin_sql();
                 foreach ($courses as $course) {
                     set_field('course', 'sortorder', $count, 'id', $course->id);

course/delete_category_form.php

@@ -1,5 +1,9 @@
 <?php  //$Id$
 
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once($CFG->libdir.'/formslib.php');
 require_once($CFG->libdir . '/questionlib.php');
 

course/edit_form.php

@@ -1,5 +1,9 @@
 <?php  //$Id$
 
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once($CFG->libdir.'/formslib.php');
 
 class course_edit_form extends moodleform {

course/lib.php

@@ -656,9 +656,7 @@ function print_log_xls($course, $user, $date, $order='l.time DESC', $modname,
         }
 
         $myxls->write($row, 0, $courses[$log->course], '');
-        // Excel counts from 1/1/1900
-        $excelTime=25569+$log->time/(3600*24);
-        $myxls->write($row, 1, $excelTime, $formatDate);
+        $myxls->write_date($row, 1, $log->time, $formatDate); // write_date() does conversion/timezone support. MDL-14934
         $myxls->write($row, 2, $log->ip, '');
         $fullname = fullname($log, has_capability('moodle/site:viewfullnames', get_context_instance(CONTEXT_COURSE, $course->id)));
         $myxls->write($row, 3, $fullname, '');

course/moodleform_mod.php

@@ -1,4 +1,9 @@
 <?php
+
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once ($CFG->libdir.'/formslib.php');
 /**
  * This class adds extra methods to form wrapper specific to be used for module

course/recent_form.php

@@ -1,5 +1,9 @@
 <?php //$$
 
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once($CFG->libdir.'/formslib.php');
 
 class recent_form extends moodleform {

course/report/log/indexlive.php

@@ -6,7 +6,7 @@
     require_once('lib.php');
     require_once($CFG->libdir.'/adminlib.php');
 
-    $id = optional_param('id', 0, PARAM_INT);// Course ID
+    $id = required_param('id', PARAM_INT);// Course ID
 
     if (!$course = get_record('course', 'id', $id) ) {
         error('That\'s an invalid course id'.$id);
@@ -21,7 +21,7 @@
     $strreports = get_string('reports');
 
     if ($course->id == SITEID) {
-        admin_externalpage_setup('reportloglive');
+        admin_externalpage_setup('reportloglive','',array('id' => $course->id));
         admin_externalpage_print_header();
 
     } else {

course/request_form.php

@@ -31,6 +31,10 @@
  * @package course
  *//** */
 
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once($CFG->libdir.'/formslib.php');
 
 /**

course/reset_form.php

@@ -1,4 +1,8 @@
 <?php // $Id$
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once $CFG->libdir.'/formslib.php';
 
 class course_reset_form extends moodleform {

course/rest.php

@@ -21,6 +21,8 @@ $summary    = optional_param('summary', '', PARAM_RAW);
 $sequence   = optional_param('sequence', '', PARAM_SEQUENCE);
 $visible    = optional_param('visible', 0, PARAM_INT);
 $pageaction = optional_param('action', '', PARAM_ALPHA); // Used to simulate a DELETE command
+$positiontoinsert = optional_param('positiontoinsert', '', PARAM_ALPHA);
+$positiontoinsertid = optional_param('positiontoinsertid', '', PARAM_RAW);
 
 // Authorise the user and verify some incoming data
 if (!$course = get_record('course', 'id', $courseid)) {
@@ -45,7 +47,7 @@ require_login($course->id);
 require_capability('moodle/course:update', $context);
 
 if (!empty($CFG->disablecourseajax)) {
-    errorl_log('Course AJAX not allowed');
+    error_log('Course AJAX not allowed');
     die;
 }
 
@@ -234,7 +236,7 @@ switch($req_method) {
     case 'DELETE':
         switch ($class) {
             case 'block':
-                blocks_execute_action($PAGE, $pageblocks, 'delete', $blockinstance);
+                blocks_execute_action($PAGE, $pageblocks, 'delete', $blockinstance, false, false);
                 break;
 
             case 'resource':

course/scales.php

@@ -73,7 +73,7 @@
     } else {
         if (has_capability('moodle/course:managescales', $context)) {
             echo "<p align=\"center\">(";
-            print_string("scalestip");
+            print_string("scalestip2");
             echo ")</p>";
         }
     }

enrol/mnet/config.html

@@ -21,7 +21,7 @@ if (is_array($mnethosts)) {
     <?php print choose_from_menu_yesno('enrol_mnet_allow_allcourses', $frm->enrol_mnet_allow_allcourses); ?>
     </td>
     <td>
-    <?php  print_string("allow_allcourses", "enrol_mnet") ?>
+    <?php  print_string("allow_allcourses2", "enrol_mnet") ?>
     </td>
 </tr>
 

filter/algebra/algebradebug.php

@@ -23,7 +23,7 @@
     require_capability('moodle/site:config', get_context_instance(CONTEXT_SYSTEM));
 
     $query = urldecode($_SERVER['QUERY_STRING']);
-    error_reporting(E_ALL);
+    error_reporting(DEBUG_ALL);
 
     if ($query) {
       $output = $query;

filter/tex/filter.php

@@ -164,7 +164,7 @@ function tex_filter ($courseid, $text) {
             $texcache->timemodified = time();
             insert_record("cache_filters",$texcache, false);
         }
-        $filename = $md5 . ".gif";
+        $filename = $md5 . ".{$CFG->filter_tex_convertformat}";
         $text = str_replace( $matches[0][$i], string_file_picture_tex($filename, $texexp, '', '', $align, $alt), $text);
     }
     return $text;

filter/tex/filtersettings.php

@@ -5,10 +5,9 @@ require_once($CFG->dirroot.'/filter/tex/lib.php');
 $items = array();
 $items[] = new admin_setting_heading('filter_tex_latexheading', get_string('latexsettings', 'admin'), '');
 $items[] = new admin_setting_configtextarea('filter_tex_latexpreamble', get_string('latexpreamble','admin'),
-               '', " \\usepackage[latin1]{inputenc}\n \\usepackage{amsmath}\n \\usepackage{amsfonts}\n \\RequirePackage{amsmath,amssymb,latexsym}\n");
+               '', "\\usepackage[latin1]{inputenc}\n\\usepackage{amsmath}\n\\usepackage{amsfonts}\n\\RequirePackage{amsmath,amssymb,latexsym}\n");
 $items[] = new admin_setting_configtext('filter_tex_latexbackground', get_string('backgroundcolour', 'admin'), '', '#FFFFFF');
 $items[] = new admin_setting_configtext('filter_tex_density', get_string('density', 'admin'), '', '120', PARAM_INT);
-$items[] = new admin_setting_configtext('filter_tex_density', get_string('density', 'admin'), '', '120', PARAM_INT);
 
 if (PHP_OS=='Linux') {
     $default_filter_tex_pathlatex   = "/usr/bin/latex";
@@ -38,6 +37,12 @@ $items[] = new admin_setting_configexecutable('filter_tex_pathlatex', get_string
 $items[] = new admin_setting_configexecutable('filter_tex_pathdvips', get_string('pathdvips', 'admin'), '', $default_filter_tex_pathdvips);
 $items[] = new admin_setting_configexecutable('filter_tex_pathconvert', get_string('pathconvert', 'admin'), '', $default_filter_tex_pathconvert);
 
+// Even if we offer GIF and PNG formats here, in the update callback we check whether
+// all the paths actually point to executables. If they don't, we force the setting 
+// to GIF, as that's the only format mimeTeX can produce.
+$formats = array('gif' => 'GIF', 'png' => 'PNG');
+$items[] = new admin_setting_configselect('filter_tex_convertformat', get_string('convertformat', 'admin'), get_string('configconvertformat', 'admin'), 'gif', $formats);
+
 foreach ($items as $item) {
     $item->set_updatedcallback('filter_tex_updatedcallback');
     $settings->add($item);

filter/tex/latex.php

@@ -82,11 +82,11 @@
         }
 
         /**
-         * Render TeX string into gif
+         * Render TeX string into gif/png
          * @param string $formula TeX formula
          * @param string $filename base of filename for output (no extension)
          * @param int $fontsize font size
-         * @param int $density density value for .ps to .gif conversion
+         * @param int $density density value for .ps to .gif/.png conversion
          * @param string $background background color (e.g, #FFFFFF).
          * @param file $log valid open file handle for optional logging (debugging only)
          * @return bool true if successful
@@ -106,7 +106,7 @@
             $tex = "{$this->temp_dir}/$filename.tex";
             $dvi = "{$this->temp_dir}/$filename.dvi";
             $ps  = "{$this->temp_dir}/$filename.ps";
-            $gif = "{$this->temp_dir}/$filename.gif";
+            $img = "{$this->temp_dir}/$filename.{$CFG->filter_tex_convertformat}";
 
             // turn the latex doc into a .tex file in the temp area
             $fh = fopen( $tex, 'w' );
@@ -126,30 +126,32 @@
                 return false;
             }
 
-            // run convert on document (.ps to .gif)
+            // run convert on document (.ps to .gif/.png)
             if ($background) {
                 $bg_opt = "-transparent \"$background\""; // Makes transparent background
             } else {
                 $bg_opt = "";
             }
-            $command = "{$CFG->filter_tex_pathconvert} -density $density -trim $bg_opt $ps $gif";
+            $command = "{$CFG->filter_tex_pathconvert} -density $density -trim $bg_opt $ps $img";
             if ($this->execute($command, $log )) {
                 return false;
             }
 
-            return $gif;
+            return $img;
         }
 
         /**
          * Delete files created in temporary area
-         * Don't forget to copy the final gif before calling this
+         * Don't forget to copy the final gif/png before calling this
          * @param string $filename file base (no extension)
          */
         function clean_up( $filename ) {
+            global $CFG;
+
             unlink( "{$this->temp_dir}/$filename.tex" );
             unlink( "{$this->temp_dir}/$filename.dvi" );
             unlink( "{$this->temp_dir}/$filename.ps" );
-            unlink( "{$this->temp_dir}/$filename.gif" );
+            unlink( "{$this->temp_dir}/$filename.{$CFG->filter_tex_convertformat}" );
             unlink( "{$this->temp_dir}/$filename.aux" );
             unlink( "{$this->temp_dir}/$filename.log" );
             return;

filter/tex/lib.php

@@ -84,6 +84,13 @@ function filter_tex_updatedcallback($name) {
 
     delete_records('cache_filters', 'filter', 'tex');
     delete_records('cache_filters', 'filter', 'algebra');
+
+    if (!(is_file($CFG->filter_tex_pathlatex) && is_executable($CFG->filter_tex_pathlatex) &&
+          is_file($CFG->filter_tex_pathdvips) && is_executable($CFG->filter_tex_pathdvips) &&
+          is_file($CFG->filter_tex_pathconvert) && is_executable($CFG->filter_tex_pathconvert))) {
+        // LaTeX, dvips or convert are not available, and mimetex can only produce GIFs so...
+        set_config('filter_tex_convertformat', 'gif');
+    }
 }
 
 ?>

filter/tex/pix.php

@@ -26,8 +26,6 @@
     $cmd    = '';               // Initialise these variables
     $status = '';
 
-    error_reporting(E_ALL);
-
     $relativepath = get_file_argument('pix.php');
 
     $args = explode('/', trim($relativepath, '/'));
@@ -40,7 +38,7 @@
     }
 
     if (!file_exists($pathname)) {
-        $md5 = str_replace('.gif','',$image);
+        $md5 = str_replace(".{$CFG->filter_tex_convertformat}",'',$image);
         if ($texcache = get_record('cache_filters', 'filter', 'tex', 'md5key', $md5)) {
             if (!file_exists($CFG->dataroot.'/filter/tex')) {
                 make_upload_directory('filter/tex');

filter/tex/texdebug.php

@@ -25,7 +25,7 @@
     require_capability('moodle/site:config', get_context_instance(CONTEXT_SYSTEM), $USER->id); /// Required cap to run this. MDL-18552
 
     $query = urldecode($_SERVER['QUERY_STRING']);
-    error_reporting(E_ALL);
+    error_reporting(DEBUG_ALL);
     $output = '';
 
     // look up in cache if required
@@ -123,6 +123,7 @@
             return;
         }
 
+        $texexp = stripslashes($texexp);
         $image  = md5($texexp) . ".gif";
         $filetype = 'image/gif';
         if (!file_exists("$CFG->dataroot/filter/tex")) {
@@ -217,7 +218,7 @@
         $tex = "$latex->temp_dir/$md5.tex";
         $dvi = "$latex->temp_dir/$md5.dvi";
         $ps = "$latex->temp_dir/$md5.ps";
-        $gif = "$latex->temp_dir/$md5.gif";
+        $img = "$latex->temp_dir/$md5.{$CFG->filter_tex_convertformat}";
 
         // put the expression as a file into the temp area
         $expression = stripslashes($expression);
@@ -240,13 +241,13 @@
         $output .= execute($cmd);
 
         // step 3: convert command
-        $cmd = "$CFG->filter_tex_pathconvert -density 240 -trim $ps $gif ";
+        $cmd = "$CFG->filter_tex_pathconvert -density 240 -trim $ps $img ";
         $output .= execute($cmd);
 
         if (!$graphic) {
             echo($output);
         } else {
-            send_file($gif, "$md5.gif");
+            send_file($img, "$md5.{$CFG->filter_tex_convertformat}");
          }
     }
 
@@ -287,13 +288,13 @@
            target="inlineframe">
             <center>
              <input type="text" name="tex" size="50"
-                    value="f(x)=\Bigint_{-\infty}^x~e^{-t^2}dt" />
+                    value="f(x)=\int_{-\infty}^x~e^{-t^2}dt" />
             </center>
            <p>The following tests are available:</p>
            <ol>
            <li><input type="radio" name="action" value="ShowDB" id="ShowDB" />
                <label for="ShowDB">See the cache_filters database entry for this expression (if any).</label></li>
-           <li><input type="radio" name="DeleteDB" value="DeleteDB" id="DeleteDB" />
+           <li><input type="radio" name="action" value="DeleteDB" id="DeleteDB" />
                <label for="DeleteDB">Delete the cache_filters database entry for this expression (if any).</label></li>
            <li><input type="radio" name="action" value="ShowImageMimetex" id="ShowImageMimetex"  checked="checked" />
                <label for="ShowImageMimetex">Show a graphic image of the algebraic expression rendered with mimetex.</label></li>
@@ -320,7 +321,7 @@ searches the database cache_filters table to see if this TeX expression had been
 processed before. If not, it adds a DB entry for that expression.  It then
 replaces the TeX expression by an &lt;img src=&quot;.../filter/tex/pix.php...&quot;&gt;
 tag.  The filter/tex/pix.php script then searches the database to find an
-appropriate gif image file for that expression and to create one if it doesn't exist.
+appropriate gif/png image file for that expression and to create one if it doesn't exist.
 It will then use either the LaTex/Ghostscript renderer (using external executables
 on your system) or the bundled Mimetex executable. The full Latex/Ghostscript
 renderer produces better results and is tried first. 
@@ -331,7 +332,7 @@ you might try to fix them.</p>
 process this expression. Then the database entry for that expression contains
 a bad TeX expression in the rawtext field (usually blank). You can fix this
 by clicking on &quot;Delete DB Entry&quot;</li>
-<li>The TeX to gif image conversion process does not work. 
+<li>The TeX to gif/png image conversion process does not work. 
 If paths are specified in the filter configuation screen for the three
 executables these will be tried first. Note that they still must be correctly
 installed and have the correct permissions. In particular make sure that you 

filter/tex/texed.php

@@ -1,69 +0,0 @@
-<?PHP // $Id$
-      // This function fetches math. images from the data directory
-      // If not, it obtains the corresponding TeX expression from the cache_tex db table
-      // and uses mimeTeX to create the image file
-
-    $nomoodlecookie = true;     // Because it interferes with caching
-
-    require_once("../../config.php");
-    require_once($CFG->dirroot.'/filter/tex/lib.php');
-
-    if (empty($CFG->textfilters)) {
-        error ('Filter not enabled!');
-    } else {
-        $filters = explode(',', $CFG->textfilters);
-        if (array_search('filter/tex', $filters) === FALSE) {
-            error ('Filter not enabled!');
-        }
-    }
-
-    error_reporting(E_ALL);
-    $texexp = urldecode($_SERVER['QUERY_STRING']);
-    $texexp = str_replace('formdata=','',$texexp);
-
-    if ($texexp) {
-        $image  = md5($texexp) . ".gif";
-        $filetype = 'image/gif';
-        if (!file_exists("$CFG->dataroot/filter/tex")) {
-            make_upload_directory("filter/tex");
-        }
-
-        $texexp = str_replace('&lt;','<',$texexp);
-        $texexp = str_replace('&gt;','>',$texexp);
-        $texexp = preg_replace('!\r\n?!',' ',$texexp);
-        $pathname = "$CFG->dataroot/filter/tex/$image";
-        $cmd = tex_filter_get_cmd($pathname, $texexp);
-        system($cmd, $status);
-
-        if (file_exists($pathname)) {
-            require_once($CFG->libdir . '/filelib.php');
-            send_file($pathname, $image);
-        } else {
-            echo "Image not found!";
-        }
-        exit;
-    } else {
-        echo "No tex expresion specified";
-    }
-
-?>
-
-<html>
-<head><title>mimeTeX Previewer</title></head>
-<body>
-    <p>Now enter your own expression or use the sample provided,
-     press the Submit button, and mimeTeX's rendering should be
-     displayed in the little window immediately below it.
-       <center>
-          <form action="texed.php" method="get"
-           target="inlineframe">
-             <input type="text" name="formdata" size="50"
-                    value="\Large f(x)=\Bigint_{-\infty}^x~e^{-t^2}dt" />
-             <input type="submit" />
-          </form> <br /> <br />
-          <iframe name="inlineframe" align="middle" width="80%" height="100">
-          &lt;p&gt;Something is wrong...&lt;/p&gt;
-          </iframe>
-       </center> <br />
-</body>
-</html>

grade/edit/letter/edit_form.php

@@ -16,6 +16,10 @@
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
 
 
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once $CFG->libdir.'/formslib.php';
 
 class edit_letter_form extends moodleform {

grade/edit/outcome/edit_form.php

@@ -16,6 +16,10 @@
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
 
 
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once $CFG->libdir.'/formslib.php';
 
 class edit_outcome_form extends moodleform {

grade/edit/scale/edit_form.php

@@ -16,6 +16,10 @@
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
 
 
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once $CFG->libdir.'/formslib.php';
 
 class edit_scale_form extends moodleform {

grade/edit/settings/form.php

@@ -15,6 +15,10 @@
 // You should have received a copy of the GNU General Public License
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
 
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once($CFG->libdir.'/formslib.php');
 
 /**

grade/edit/tree/calculation_form.php

@@ -15,6 +15,10 @@
 // You should have received a copy of the GNU General Public License
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
 
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once $CFG->libdir.'/formslib.php';
 
 class edit_calculation_form extends moodleform {

grade/edit/tree/category_form.php

@@ -15,6 +15,10 @@
 // You should have received a copy of the GNU General Public License
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
 
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once $CFG->libdir.'/formslib.php';
 
 class edit_category_form extends moodleform {

grade/edit/tree/grade_form.php

@@ -15,6 +15,10 @@
 // You should have received a copy of the GNU General Public License
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
 
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once $CFG->libdir.'/formslib.php';
 
 class edit_grade_form extends moodleform {

grade/edit/tree/outcomeitem_form.php

@@ -15,6 +15,10 @@
 // You should have received a copy of the GNU General Public License
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
 
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once $CFG->libdir.'/formslib.php';
 
 class edit_outcomeitem_form extends moodleform {

grade/export/grade_export_form.php

@@ -15,6 +15,10 @@
 // You should have received a copy of the GNU General Public License
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
 
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once $CFG->libdir.'/formslib.php';
 
 class grade_export_form extends moodleform {

grade/import/grade_import_form.php

@@ -15,6 +15,10 @@
 // You should have received a copy of the GNU General Public License
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
 
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once $CFG->libdir.'/formslib.php';
 require_once($CFG->libdir.'/gradelib.php');
 

grade/report/grader/functions.js

@@ -14,15 +14,25 @@ function set_row(idx) {
 }
 
 /** highlight/unset the column of a table **/
-function set_col(idx) {
+function set_col(col,gradecelloffset) {
     var table = document.getElementById('user-grades');
-    for (var i = 1; i < table.rows.length; i++) {
-        if (table.rows[i].cells[idx]) {
-            if (table.rows[i].cells[idx].className.search(/vmarked/) != -1) {
-                table.rows[i].cells[idx].className = table.rows[i].cells[idx].className.replace(' vmarked', '');
-            } else {
-                table.rows[i].cells[idx].className += ' vmarked';
-            }
+
+    //highlight the column header
+    flip_vmarked(table,2,col);
+
+    //add any grade cell offset (due to colspans) then iterate down the table
+    col += gradecelloffset;
+    for (var row = 3; row < table.rows.length; row++) {
+        flip_vmarked(table,row,col);
+    }
+}
+
+function flip_vmarked(table,row,col) {
+    if (table.rows[row].cells[col]) {
+        if (table.rows[row].cells[col].className.search(/vmarked/) != -1) {
+            table.rows[row].cells[col].className = table.rows[row].cells[col].className.replace(' vmarked', '');
+        } else {
+            table.rows[row].cells[col].className += ' vmarked';
         }
     }
 }