Moodle release 1.9.14

weekly release 1.9.13+
Merge branch 'wip-MDL-25454-MOODLE_19_STABLE' of git://github.com/marinaglancy/moodle into MOODLE_19_STABLE
2011-10-09 00:56:48 +02:00 · 2011-10-07 00:13:18 +02:00 · 2011-10-03 14:23:16 +13:00 · 2011-10-03 13:51:17 +13:00 · 2011-09-29 17:12:24 +08:00 · 2011-09-29 10:01:20 +08:00
699 changed files with 26055 additions and 19443 deletions
@@ -0,0 +1,27 @@
+# This file specifies intentionally untracked files that all Moodle git
+# repositories should ignore. It is recommended not to modify this file in your
+# local clone. Instead, use .git/info/exclude and add new records there as
+# needed.
+#
+# Example: if you deploy a contributed plugin mod/foobar into your site, put
+# the following line into .git/info/exclude file in your Moodle clone:
+# /mod/foobar/
+#
+# See gitignore(5) man page for more details
+#
+/config.php
+/lib/editor/tinymce/extra/tools/temp/
+*~
+*.swp
+/tags
+/TAGS
+/cscope.*
+/.patches/
+/.idea/
+/nbproject/
+CVS
+.DS_Store
+/.settings/
+/.project
+/.buildpath
+/.cache
@@ -24,7 +24,7 @@ a few minutes:

 For more information, see the INSTALL DOCUMENTATION:

-   http://docs.moodle.org/en/Installing_Moodle 
+   http://docs.moodle.org/19/en/Installing_Moodle

 A local copy can also be found in 

@@ -241,10 +241,13 @@

        if ($CFG->longtimenosee) { // value in days
            $cuttime = $timenow - ($CFG->longtimenosee * 3600 * 24);
-            $rs = get_recordset_sql ("SELECT id, userid, courseid
-                                        FROM {$CFG->prefix}user_lastaccess
-                                       WHERE courseid != ".SITEID."
-                                         AND timeaccess < $cuttime ");
+            $rs = get_recordset_sql ("SELECT la.id, la.userid, la.courseid
+                                        FROM {$CFG->prefix}user_lastaccess la
+                                        JOIN {$CFG->prefix}course c
+                                          ON c.id = la.courseid
+                                       WHERE la.courseid != ".SITEID."
+                                         AND la.timeaccess < $cuttime
+                                         AND c.metacourse = 0 ");
            while ($assign = rs_fetch_next_record($rs)) {
                if ($context = get_context_instance(CONTEXT_COURSE, $assign->courseid)) {
                    if (role_unassign(0, $assign->userid, 0, $context->id)) {
@@ -348,25 +351,24 @@
        mtrace('checking for create_password');
        if (count_records('user_preferences', 'name', 'create_password', 'value', '1')) {
            mtrace('creating passwords for new users');
-            $newusers = get_records_sql("SELECT  u.id as id, u.email, u.firstname, 
-                                                u.lastname, u.username,
-                                                p.id as prefid 
-                                        FROM {$CFG->prefix}user u 
-                                             JOIN {$CFG->prefix}user_preferences p ON u.id=p.userid
-                                        WHERE p.name='create_password' AND p.value='1' AND u.email !='' ");
-
-            foreach ($newusers as $newuserid => $newuser) {
-                $newuser->emailstop = 0; // send email regardless
-                // email user                               
-                if (setnew_password_and_mail($newuser)) {
-                    // remove user pref
-                    delete_records('user_preferences', 'id', $newuser->prefid);
-                } else {
-                    trigger_error("Could not create and mail new user password!");
+            $newuserssql = "SELECT u.id as id, u.email, u.firstname, u.lastname, u.username, p.id as prefid
+                              FROM {$CFG->prefix}user u
+                              JOIN {$CFG->prefix}user_preferences p ON u.id=p.userid
+                             WHERE p.name='create_password' AND p.value='1' AND u.email !='' ";
+            if ($newusers = get_records_sql($newuserssql)) {
+                foreach ($newusers as $newuserid => $newuser) {
+                    $newuser->emailstop = 0; // send email regardless
+                    // email user
+                    if (setnew_password_and_mail($newuser)) {
+                        // remove user pref
+                        delete_records('user_preferences', 'id', $newuser->prefid);
+                    } else {
+                        trigger_error("Could not create and mail new user password!");
+                    }
                }
            }
        }
-        
+
        if (!empty($CFG->usetags)) {
            require_once($CFG->dirroot.'/tag/lib.php');
            tag_cron();
@@ -185,6 +185,8 @@
          <ON_CHECK message="ctyperecommended" />
        </FEEDBACK>
      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
    </PHP_EXTENSIONS>
    <CUSTOM_CHECKS>
      <CUSTOM_CHECK file="question/upgrade.php" function="question_check_no_rqp_questions" level="optional">
@@ -282,6 +284,24 @@
          <ON_CHECK message="simplexmlrequired" />
        </FEEDBACK>
      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="intlrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
    </PHP_EXTENSIONS>
    <PHP_SETTINGS>
      <PHP_SETTING name="memory_limit" value="40M" level="required">
@@ -301,6 +321,125 @@
      </PHP_SETTING>
    </PHP_SETTINGS>
    <CUSTOM_CHECKS>
+      <CUSTOM_CHECK file="lib/customcheckslib.php" function="php_check_php533" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="php533warning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
    </CUSTOM_CHECKS>
  </MOODLE>
+  <MOODLE version="2.1" requires="1.9">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mysql" version="5.0.25">
+        <FEEDBACK>
+          <ON_ERROR message="mysql416required" />
+        </FEEDBACK>
+      </VENDOR>
+      <VENDOR name="postgres" version="8.3" />
+      <VENDOR name="mssql" version="9.0" />
+      <VENDOR name="odbc_mssql" version="9.0" />
+      <VENDOR name="mssql_n" version="9.0" />
+      <VENDOR name="oracle" version="10.2" />
+      <VENDOR name="sqlite" version="2.0" />
+    </DATABASE>
+    <PHP version="5.3.2" level="required">
+    </PHP>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opensslrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="gdrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_CHECK message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="intlrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="40M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="safe_mode" value="0" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingsafemode" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+  </MOODLE>
 </COMPATIBILITY_MATRIX>
@@ -47,7 +47,7 @@

 /// Check some PHP server settings

-    $documentationlink = '<a href="http://docs.moodle.org/en/Installation">Installation docs</a>';
+    $documentationlink = '<a href="http://docs.moodle.org/19/en/Installation">Installation docs</a>';

    if (ini_get_bool('session.auto_start')) {
        error("The PHP server variable 'session.auto_start' should be Off - $documentationlink");
@@ -143,7 +143,7 @@
            print_box(text_to_html(get_string('gpl')), 'copyrightnotice');
            echo "<br />";
            notice_yesno(get_string('doyouagree'), "index.php?agreelicense=1",
-                                                   "http://docs.moodle.org/en/License");
+                                                   "http://docs.moodle.org/dev/License");
            print_footer('none');
            exit;
        }
@@ -152,7 +152,7 @@
            $navigation = build_navigation(array(array('name'=>$strcurrentrelease, 'link'=>null, 'type'=>'misc')));
            print_header($strcurrentrelease, $strcurrentrelease, $navigation, "", "", false, "&nbsp;", "&nbsp;");
            print_heading("Moodle $release");
-            print_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/en/Release_Notes'), 'generalbox boxaligncenter boxwidthwide');
+            print_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/19/en/Release_Notes'), 'generalbox boxaligncenter boxwidthwide');
            echo '<form action="index.php"><div>';
            echo '<input type="hidden" name="agreelicense" value="1" />';
            echo '<input type="hidden" name="confirmrelease" value="1" />';
@@ -286,7 +286,7 @@
                $navigation = build_navigation(array(array('name'=>$strcurrentrelease, 'link'=>null, 'type'=>'misc')));
                print_header($strcurrentrelease, $strcurrentrelease, $navigation, "", "", false, "&nbsp;", "&nbsp;");
                print_heading("Moodle $release");
-                print_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/en/Release_Notes'));
+                print_box(get_string('releasenoteslink', 'admin', 'http://docs.moodle.org/19/en/Release_Notes'));

                require_once($CFG->libdir.'/environmentlib.php');
                print_heading(get_string('environment', 'admin'));
@@ -687,10 +687,10 @@
    //////////////////////////////////////////////////////////////////////////////////////////////////
    ////  IT IS ILLEGAL AND A VIOLATION OF THE GPL TO HIDE, REMOVE OR MODIFY THIS COPYRIGHT NOTICE ///
    $copyrighttext = '<a href="http://moodle.org/">Moodle</a> '.
-                     '<a href="http://docs.moodle.org/en/Release" title="'.$CFG->version.'">'.$CFG->release.'</a><br />'.
+                     '<a href="http://docs.moodle.org/dev/Releases" title="'.$CFG->version.'">'.$CFG->release.'</a><br />'.
                     'Copyright &copy; 1999 onwards, Martin Dougiamas<br />'.
-                     'and <a href="http://docs.moodle.org/en/Credits">many other contributors</a>.<br />'.
-                     '<a href="http://docs.moodle.org/en/License">GNU Public License</a>';
+                     'and <a href="http://docs.moodle.org/dev/Credits">many other contributors</a>.<br />'.
+                     '<a href="http://docs.moodle.org/dev/License">GNU Public License</a>';
    print_box($copyrighttext, 'copyright');
    //////////////////////////////////////////////////////////////////////////////////////////////////

@@ -248,7 +248,7 @@
        if ($parent == 'en_utf8') {
            continue;
        }
-        if (strpos($parent, '[[') !== false) {
+        if (empty($parent) || strpos($parent, '[[') !== false) {
            continue; // no parent
        }
        if (!isset($installedlangs[$parent])) {
@@ -178,7 +178,7 @@ if (!$acl) {
        }
        $deletecolumn = "<a href=\"?id={$aclrecord->id}&amp;action=delete&amp;sesskey={$USER->sesskey}\">"
                . get_string('delete') . "</a>";
-        $table->data[] = array ($aclrecord->username, $aclrecord->mnet_host_id, $accesscolumn, $deletecolumn);
+        $table->data[] = array (s($aclrecord->username), $aclrecord->mnet_host_id, $accesscolumn, $deletecolumn);
    }
 }

@@ -130,7 +130,7 @@
                a.courseid
            FROM
                {$CFG->prefix}user u
-            LEFT JOIN
+            JOIN
                {$CFG->prefix}mnet_enrol_assignments a
            ON
                a.userid = u.id AND a.courseid={$courseid}
@@ -7,6 +7,10 @@
 if (!defined('MOODLE_INTERNAL')) {
    die('Direct access to this script is forbidden.'); // It must be included from a Moodle page
 }
+$strmnetservices   = get_string('mnetservices', 'mnet');
+$strmnetlog        = get_string('mnetlog', 'mnet');
+$strmnetedithost   = get_string('reviewhostdetails', 'mnet');
+$strmnetthemes     = get_string('mnetthemes', 'mnet');

 $logurl = $CFG->wwwroot.
          '/course/report/log/index.php?chooselog=1&amp;showusers=1&amp;showcourses=1&amp;host_course='.$mnet_peer->id.
@@ -93,7 +93,7 @@
        print_simple_box_start('center');

    /// First, me get all the distinct backups for that course in backup_log
-        $executions = get_records_sql("SELECT DISTINCT laststarttime,laststarttime
+        $executions = get_records_sql("SELECT DISTINCT laststarttime
                                       FROM {$CFG->prefix}backup_log
                                       WHERE courseid = '$courseid'
                                       ORDER BY laststarttime DESC");
@@ -75,12 +75,12 @@
                .$param->extras
                ." ORDER BY ".$param->orderby;
        }
-        error_log($sql);

        $courses = get_records_sql($sql, 0, $numcourses);

        if (empty($courses)) {
-            notify(get_string('statsnodata'));echo '</td></tr></table>';echo '<p>after notify</p>';
+            notify(get_string('statsnodata'));
+            echo '</td></tr></table>';

        } else {
            if (empty($CFG->gdversion)) {
@@ -1050,8 +1050,7 @@ function report_security_check_riskadmin($detailed=false) {
                     AND (sc.path = c.path OR sc.path LIKE ".sql_concat('c.path', "'/%'")." OR c.path LIKE ".sql_concat('sc.path', "'/%'").")
                     AND u.id = ra.userid AND u.deleted = 0
                     AND ra.contextid = sc.id AND ra.roleid = rc.roleid AND ra.contextid <> ".SYSCONTEXTID."
-            GROUP BY u.id, u.firstname, u.lastname, u.picture, u.imagealt, u.email, ra.contextid, ra.roleid
-            ORDER BY u.lastname, u.firstname";
+            GROUP BY u.id, u.firstname, u.lastname, u.picture, u.imagealt, u.email, ra.contextid, ra.roleid";

    $unsupcount = count_records_sql("SELECT COUNT('x') FROM ($sqlunsup) unsup");

@@ -1077,6 +1076,7 @@ function report_security_check_riskadmin($detailed=false) {
        $result->info = get_string('check_riskadmin_warning', 'report_security', $a);

        if ($detailed) {
+            $sqlunsup .= " ORDER BY u.lastname, u.firstname";
            $rs = get_recordset_sql($sqlunsup);
            $users = array();
            while ($user = rs_fetch_next_record($rs)) {
@@ -1113,13 +1113,13 @@ function report_security_check_riskbackup($detailed=false) {
    $syscontext = get_context_instance(CONTEXT_SYSTEM);

    $systemroles = get_records_sql(
-        "SELECT DISTINCT r.*
+        "SELECT DISTINCT r.id, r.name, r.shortname, r.sortorder
           FROM {$CFG->prefix}role r
           JOIN {$CFG->prefix}role_capabilities rc ON rc.roleid = r.id
          WHERE rc.capability = 'moodle/backup:userinfo' AND rc.contextid = $syscontext->id AND rc.permission = ".CAP_ALLOW."");

    $overriddenroles = get_records_sql(
-        "SELECT DISTINCT r.*, rc.contextid
+        "SELECT DISTINCT r.id, r.name, r.shortname, r.sortorder, rc.contextid
           FROM {$CFG->prefix}role r
           JOIN {$CFG->prefix}role_capabilities rc ON rc.roleid = r.id
          WHERE rc.capability = 'moodle/backup:userinfo' AND rc.contextid <> $syscontext->id AND rc.permission = ".CAP_ALLOW."");
@@ -66,22 +66,39 @@ class ExHtmlReporter extends HtmlReporter {
    function paintFail($message) {
        // Explicitly call grandparent, not parent::paintFail.
        SimpleScorer::paintFail($message);
-        $this->_paintPassFail('fail', $message);
+        $this->_paintPassFail('fail', $message, debug_backtrace());
    }

    /**
     * Called when an error (uncaught exception or PHP error) needs to be output.
     */
    function paintError($message) {
-        // Explicitly call grandparent, not parent::paintFail.
+        // Explicitly call grandparent, not parent::paintError.
        SimpleScorer::paintError($message);
        $this->_paintPassFail('exception', $message);
    }

    /**
-     * Private method. Used by printPass/Fail/Error.
+     * Called when a caught exception needs to be output.
     */
-    function _paintPassFail($passorfail, $message) {
+    function paintException($exception) {
+        // Explicitly call grandparent, not parent::paintException.
+        SimpleScorer::paintException($exception);
+        $message = 'Unexpected exception of type [' . get_class($exception) .
+                '] with message ['. $exception->getMessage() .
+                '] in ['. $exception->getFile() .
+                ' line ' . $exception->getLine() . ']';
+        $stacktrace = null;
+        if (method_exists($exception, 'getTrace')) {
+            $stacktrace = $exception->getTrace();
+        }
+        $this->_paintPassFail('exception', $message, $stacktrace);
+    }
+
+    /**
+     * Private method. Used by printPass/Fail/Error/Exception.
+     */
+    function _paintPassFail($passorfail, $message, $stacktrace = null) {
        global $FULLME, $CFG;

        print_simple_box_start('', '100%', '', 5, $passorfail . ' generalbox');
@@ -100,6 +117,25 @@ class ExHtmlReporter extends HtmlReporter {
        echo "<a href=\"{$url}path=$folder$file\" title=\"$this->strrunonlyfile\">$file</a>";
        echo $this->strseparator, implode($this->strseparator, $breadcrumb);
        echo $this->strseparator, '<br />', $this->_htmlEntities($message), "\n\n";
+        if ($stacktrace) {
+            $dotsadded = false;
+            $interestinglines = 0;
+            $filteredstacktrace = array();
+            foreach ($stacktrace as $frame) {
+                if (empty($frame['file']) || (strpos($frame['file'], 'simpletestlib') === false
+                        && strpos($frame['file'], 'report/unittest') === false)) {
+                    $filteredstacktrace[] = $frame;
+                    $interestinglines += 1;
+                    $dotsadded = false;
+                } else if (!$dotsadded) {
+                    $filteredstacktrace[] = array('line' => '...', 'file' => '...');
+                    $dotsadded = true;
+                }
+            }
+            if ($interestinglines > 1 || $passorfail == 'exception') {
+                echo '<div class="notifytiny">' . format_backtrace($filteredstacktrace) . "</div>\n\n";
+            }
+        }
        print_simple_box_end();
        flush();
    }
@@ -193,4 +229,45 @@ class ExHtmlReporter extends HtmlReporter {
        return get_string($identifier, 'simpletest', $a);
    }
 }
+
+/**
+ * Formats a backtrace ready for output.
+ *
+ * @param array $callers backtrace array, as returned by debug_backtrace().
+ * @param boolean $plaintext if false, generates HTML, if true generates plain text.
+ * @return string formatted backtrace, ready for output.
+ */
+function format_backtrace($callers, $plaintext = false) {
+    // do not use $CFG->dirroot because it might not be available in destructors
+    $dirroot = dirname(dirname(__FILE__));
+
+    if (empty($callers)) {
+        return '';
+    }
+
+    $from = $plaintext ? '' : '<ul style="text-align: left">';
+    foreach ($callers as $caller) {
+        if (!isset($caller['line'])) {
+            $caller['line'] = '?'; // probably call_user_func()
+        }
+        if (!isset($caller['file'])) {
+            $caller['file'] = 'unknownfile'; // probably call_user_func()
+        }
+        $from .= $plaintext ? '* ' : '<li>';
+        $from .= 'line ' . $caller['line'] . ' of ' . str_replace($dirroot, '', $caller['file']);
+        if (isset($caller['function'])) {
+            $from .= ': call to ';
+            if (isset($caller['class'])) {
+                $from .= $caller['class'] . $caller['type'];
+            }
+            $from .= $caller['function'] . '()';
+        } else if (isset($caller['exception'])) {
+            $from .= ': '.$caller['exception'].' thrown';
+        }
+        $from .= $plaintext ? "\n" : '</li>';
+    }
+    $from .= $plaintext ? '' : '</ul>';
+
+    return $from;
+}
 ?>
@@ -72,7 +72,7 @@
    $straction = get_string('assignroles', 'role');
    $strroletoassign = get_string('roletoassign', 'role');
    $strsearch = get_string('search');
-    $strshowall = get_string('showall');
+    $strshowall = get_string('showallusers');
    $strparticipants = get_string('participants');
    $strsearchresults = get_string('searchresults');

@@ -25,7 +25,7 @@ if ($hassiteconfig
                                            get_string('alternatelogin', 'auth', htmlspecialchars($CFG->wwwroot.'/login/index.php')), ''));
    $temp->add(new admin_setting_configtext('forgottenpasswordurl', get_string('forgottenpasswordurl', 'auth'),
                                            get_string('forgottenpassword', 'auth'), ''));
-    $temp->add(new admin_setting_configtextarea('auth_instructions', get_string('instructions', 'auth'),
+    $temp->add(new admin_setting_confightmltextarea('auth_instructions', get_string('instructions', 'auth'),
                                                get_string('authinstructions', 'auth'), ''));
    $temp->add(new admin_setting_configtext('allowemailaddresses', get_string('allowemailaddresses', 'admin'), get_string('configallowemailaddresses', 'admin'), '', PARAM_NOTAGS));
    $temp->add(new admin_setting_configtext('denyemailaddresses', get_string('denyemailaddresses', 'admin'), get_string('configdenyemailaddresses', 'admin'), '', PARAM_NOTAGS));
@@ -1,28 +1,33 @@
 <?php // $Id$
-    require_once $CFG->libdir.'/formslib.php';

-    class admin_uploadpicture_form extends moodleform {
-        function definition (){
-            global $CFG, $USER;
-    
-            $mform =& $this->_form;
-    
-            $this->set_upload_manager(new upload_manager('userpicturesfile', false, false, null, false, 0, true, true, false));
-    
-            $mform->addElement('header', 'settingsheader', get_string('upload'));
-    
-            $mform->addElement('file', 'userpicturesfile', get_string('file'), 'size="40"');
-            $mform->addRule('userpicturesfile', null, 'required');
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}

-            $choices =& $this->_customdata;
-            $mform->addElement('select', 'userfield', get_string('uploadpicture_userfield', 'admin'), $choices);
-            $mform->setType('userfield', PARAM_INT);
+require_once $CFG->libdir.'/formslib.php';

-            $choices = array( 0 => get_string('no'), 1 => get_string('yes') );
-            $mform->addElement('select', 'overwritepicture', get_string('uploadpicture_overwrite', 'admin'), $choices);
-            $mform->setType('overwritepicture', PARAM_INT);
-    
-            $this->add_action_buttons(false, get_string('uploadpictures', 'admin'));
-        }
+class admin_uploadpicture_form extends moodleform {
+    function definition (){
+        global $CFG, $USER;
+
+        $mform =& $this->_form;
+
+        $this->set_upload_manager(new upload_manager('userpicturesfile', false, false, null, false, 0, true, true, false));
+
+        $mform->addElement('header', 'settingsheader', get_string('upload'));
+
+        $mform->addElement('file', 'userpicturesfile', get_string('file'), 'size="40"');
+        $mform->addRule('userpicturesfile', null, 'required');
+
+        $choices =& $this->_customdata;
+        $mform->addElement('select', 'userfield', get_string('uploadpicture_userfield', 'admin'), $choices);
+        $mform->setType('userfield', PARAM_INT);
+
+        $choices = array( 0 => get_string('no'), 1 => get_string('yes') );
+        $mform->addElement('select', 'overwritepicture', get_string('uploadpicture_overwrite', 'admin'), $choices);
+        $mform->setType('overwritepicture', PARAM_INT);
+
+        $this->add_action_buttons(false, get_string('uploadpictures', 'admin'));
    }
+}
 ?>
@@ -558,7 +558,7 @@ if ($formdata = $mform->is_cancelled()) {
                continue;
            }
            // save custom profile fields data
-            profile_save_data($user);
+            profile_save_data(addslashes_recursive($user));

            // make sure user context exists
            get_context_instance(CONTEXT_USER, $user->id);
@@ -665,7 +665,7 @@ if ($formdata = $mform->is_cancelled()) {
                    $newgroupdata = new object();
                    $newgroupdata->name = $addgroup;
                    $newgroupdata->courseid = $ccache[$shortname]->id;
-                    if ($ccache[$shortname]->groups[$addgroup]->id = groups_create_group($newgroupdata)){
+                    if ($ccache[$shortname]->groups[$addgroup]->id = groups_create_group(addslashes_recursive($newgroupdata))){
                        $ccache[$shortname]->groups[$addgroup]->name = $newgroupdata->name;
                    } else {
                        $upt->track('enrolments', get_string('unknowngroup', 'error', $addgroup), 'error');
@@ -1,4 +1,9 @@
 <?php // $Id$
+
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once $CFG->libdir.'/formslib.php';

 class admin_uploaduser_form1 extends moodleform {
@@ -2,7 +2,7 @@ XMLDB - Base classes and edition interface.

 Complete Documentation:

-  http://docs.moodle.org/en/XMLDB_Defining_one_XML_structure
+  http://docs.moodle.org/19/en/XMLDB_Defining_one_XML_structure

 Ciao, Eloy Lafuente (stronk7)

@@ -70,7 +70,7 @@ Once the XMLDB format was approved, we'll be able to build all the
 for each RDBMS flavour.

 Once the interface was finished (2-3 days from now) related documentation
-will be sent to http://docs.moodle.org/en/XML_database_schema in order
+will be sent to http://docs.moodle.org/19/en/XML_database_schema in order
 to comment/modify/approve the final XML format.

 All the code is, obviously GPL, with its copyrights and so on...
@@ -25,8 +25,8 @@
 ///////////////////////////////////////////////////////////////////////////

 /// This class will show all the reserved words in a format suitable to
-/// be pasted to: http://docs.moodle.org/en/XMLDB_reserved_words and
-/// http://docs.moodle.org/en/Database_reserved_words
+/// be pasted to: http://docs.moodle.org/19/en/XMLDB_reserved_words and
+/// http://docs.moodle.org/19/en/Database_reserved_words
 /// Also, it introspects te DB looking for such words and informing about

 class view_reserved_words extends XMLDBAction {
@@ -1,240 +1,283 @@
-<?php
-
-/**
- * @file CAS/PGTStorage/pgt-file.php
- * Basic class for PGT file storage
- */
-
-/**
- * @class PGTStorageFile
- * The PGTStorageFile class is a class for PGT file storage. An instance of 
- * this class is returned by CASClient::SetPGTStorageFile().
- *
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
- *
- * @ingroup internalPGTStorageFile
- */
-
-class PGTStorageFile extends PGTStorage
-{
-  /** 
-   * @addtogroup internalPGTStorageFile 
-   * @{ 
-   */
-
-  /**
-   * a string telling where PGT's should be stored on the filesystem. Written by
-   * PGTStorageFile::PGTStorageFile(), read by getPath().
-   *
-   * @private
-   */
-  var $_path;
-
-  /**
-   * This method returns the name of the directory where PGT's should be stored 
-   * on the filesystem.
-   *
-   * @return the name of a directory (with leading and trailing '/')
-   *
-   * @private
-   */
-  function getPath()
-    {
-      return $this->_path;
-    }
-
-  /**
-   * a string telling the format to use to store PGT's (plain or xml). Written by
-   * PGTStorageFile::PGTStorageFile(), read by getFormat().
-   *
-   * @private
-   */
-  var $_format;
-
-  /**
-   * This method returns the format to use when storing PGT's on the filesystem.
-   *
-   * @return a string corresponding to the format used (plain or xml).
-   *
-   * @private
-   */
-  function getFormat()
-    {
-      return $this->_format;
-    }
-
-  // ########################################################################
-  //  DEBUGGING
-  // ########################################################################
-  
-  /**
-   * This method returns an informational string giving the type of storage
-   * used by the object (used for debugging purposes).
-   *
-   * @return an informational string.
-   * @public
-   */
-  function getStorageType()
-    {
-      return "file";
-    }
-
-  /**
-   * This method returns an informational string giving informations on the
-   * parameters of the storage.(used for debugging purposes).
-   *
-   * @return an informational string.
-   * @public
-   */
-  function getStorageInfo()
-    {
-      return 'path=`'.$this->getPath().'\', format=`'.$this->getFormat().'\'';
-    }
-
-  // ########################################################################
-  //  CONSTRUCTOR
-  // ########################################################################
-  
-  /**
-   * The class constructor, called by CASClient::SetPGTStorageFile().
-   *
-   * @param $cas_parent the CASClient instance that creates the object.
-   * @param $format the format used to store the PGT's (`plain' and `xml' allowed).
-   * @param $path the path where the PGT's should be stored
-   *
-   * @public
-   */
-  function PGTStorageFile($cas_parent,$format,$path)
-    {
-      phpCAS::traceBegin();
-      // call the ancestor's constructor
-      $this->PGTStorage($cas_parent);
-
-      if (empty($format) ) $format = CAS_PGT_STORAGE_FILE_DEFAULT_FORMAT;
-      if (empty($path) ) $path = CAS_PGT_STORAGE_FILE_DEFAULT_PATH;
-
-      // check that the path is an absolute path
-      if ( $path[0] != '/' ) {
-	phpCAS::error('an absolute path is needed for PGT storage to file');
-      }
-
-      // store the path (with a leading and trailing '/')      
-      $path = preg_replace('|[/]*$|','/',$path);
-      $path = preg_replace('|^[/]*|','/',$path);
-      $this->_path = $path;
-
-      // check the format and store it
-      switch ($format) {
-      case CAS_PGT_STORAGE_FILE_FORMAT_PLAIN:
-      case CAS_PGT_STORAGE_FILE_FORMAT_XML:
-	$this->_format = $format;
-	break;
-      default:
-	phpCAS::error('unknown PGT file storage format (`'.CAS_PGT_STORAGE_FILE_FORMAT_PLAIN.'\' and `'.CAS_PGT_STORAGE_FILE_FORMAT_XML.'\' allowed)');
-      }
-      phpCAS::traceEnd();      
-    }
-
-  // ########################################################################
-  //  INITIALIZATION
-  // ########################################################################
-  
-  /**
-   * This method is used to initialize the storage. Halts on error.
-   *
-   * @public
-   */
-  function init()
-    {
-      phpCAS::traceBegin();
-      // if the storage has already been initialized, return immediatly
-      if ( $this->isInitialized() )
-	return;
-      // call the ancestor's method (mark as initialized)
-      parent::init();
-      phpCAS::traceEnd();      
-    }
-
-  // ########################################################################
-  //  PGT I/O
-  // ########################################################################
-
-  /**
-   * This method returns the filename corresponding to a PGT Iou.
-   *
-   * @param $pgt_iou the PGT iou.
-   *
-   * @return a filename
-   * @private
-   */
-  function getPGTIouFilename($pgt_iou)
-    {
-      phpCAS::traceBegin();
-      $filename = $this->getPath().$pgt_iou.'.'.$this->getFormat();
-
-      phpCAS::traceEnd($filename);
-      return $filename;
-    }
-  
-  /**
-   * This method stores a PGT and its corresponding PGT Iou into a file. Echoes a
-   * warning on error.
-   *
-   * @param $pgt the PGT
-   * @param $pgt_iou the PGT iou
-   *
-   * @public
-   */
-  function write($pgt,$pgt_iou)
-    {
-      phpCAS::traceBegin();
-      $fname = $this->getPGTIouFilename($pgt_iou);
-      if ( $f=fopen($fname,"w") ) {
-	if ( fputs($f,$pgt) === FALSE ) {
-	  phpCAS::error('could not write PGT to `'.$fname.'\'');
-	}
-	fclose($f);
-      } else {
-	phpCAS::error('could not open `'.$fname.'\'');
-      }
-      phpCAS::traceEnd();      
-    }
-
-  /**
-   * This method reads a PGT corresponding to a PGT Iou and deletes the 
-   * corresponding file.
-   *
-   * @param $pgt_iou the PGT iou
-   *
-   * @return the corresponding PGT, or FALSE on error
-   *
-   * @public
-   */
-  function read($pgt_iou)
-    {
-      phpCAS::traceBegin();
-      $pgt = FALSE;
-      $fname = $this->getPGTIouFilename($pgt_iou);
-
-      if ( !($f=fopen($fname,"r")) ) {
-	phpCAS::trace('could not open `'.$fname.'\'');
-      } else {
-	if ( ($pgt=fgets($f)) === FALSE ) {
-	  phpCAS::trace('could not read PGT from `'.$fname.'\'');
-	} 
-	fclose($f);
-      }
-
-      // delete the PGT file
-      @unlink($fname);
-
-      phpCAS::traceEnd($pgt);
-      return $pgt;
-    }
-  
-  /** @} */
-  
-}
-
-  
-?>
+<?php
+/*
+ * Copyright © 2003-2010, The ESUP-Portail consortium & the JA-SIG Collaborative.
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ * 
+ *     * Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright notice,
+ *       this list of conditions and the following disclaimer in the documentation
+ *       and/or other materials provided with the distribution.
+ *     * Neither the name of the ESUP-Portail consortium & the JA-SIG
+ *       Collaborative nor the names of its contributors may be used to endorse or
+ *       promote products derived from this software without specific prior
+ *       written permission.
+
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+/**
+ * @file CAS/PGTStorage/pgt-file.php
+ * Basic class for PGT file storage
+ */
+
+/**
+ * @class PGTStorageFile
+ * The PGTStorageFile class is a class for PGT file storage. An instance of 
+ * this class is returned by CASClient::SetPGTStorageFile().
+ *
+ * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
+ *
+ * @ingroup internalPGTStorageFile
+ */
+
+class PGTStorageFile extends PGTStorage
+{
+  /** 
+   * @addtogroup internalPGTStorageFile 
+   * @{ 
+   */
+
+  /**
+   * a string telling where PGT's should be stored on the filesystem. Written by
+   * PGTStorageFile::PGTStorageFile(), read by getPath().
+   *
+   * @private
+   */
+  var $_path;
+
+  /**
+   * This method returns the name of the directory where PGT's should be stored 
+   * on the filesystem.
+   *
+   * @return the name of a directory (with leading and trailing '/')
+   *
+   * @private
+   */
+  function getPath()
+    {
+      return $this->_path;
+    }
+
+  /**
+   * a string telling the format to use to store PGT's (plain or xml). Written by
+   * PGTStorageFile::PGTStorageFile(), read by getFormat().
+   *
+   * @private
+   */
+  var $_format;
+
+  /**
+   * This method returns the format to use when storing PGT's on the filesystem.
+   *
+   * @return a string corresponding to the format used (plain or xml).
+   *
+   * @private
+   */
+  function getFormat()
+    {
+      return $this->_format;
+    }
+
+  // ########################################################################
+  //  DEBUGGING
+  // ########################################################################
+  
+  /**
+   * This method returns an informational string giving the type of storage
+   * used by the object (used for debugging purposes).
+   *
+   * @return an informational string.
+   * @public
+   */
+  function getStorageType()
+    {
+      return "file";
+    }
+
+  /**
+   * This method returns an informational string giving informations on the
+   * parameters of the storage.(used for debugging purposes).
+   *
+   * @return an informational string.
+   * @public
+   */
+  function getStorageInfo()
+    {
+      return 'path=`'.$this->getPath().'\', format=`'.$this->getFormat().'\'';
+    }
+
+  // ########################################################################
+  //  CONSTRUCTOR
+  // ########################################################################
+  
+  /**
+   * The class constructor, called by CASClient::SetPGTStorageFile().
+   *
+   * @param $cas_parent the CASClient instance that creates the object.
+   * @param $format the format used to store the PGT's (`plain' and `xml' allowed).
+   * @param $path the path where the PGT's should be stored
+   *
+   * @public
+   */
+  function PGTStorageFile($cas_parent,$format,$path)
+    {
+      phpCAS::traceBegin();
+      // call the ancestor's constructor
+      $this->PGTStorage($cas_parent);
+
+      if (empty($format) ) $format = CAS_PGT_STORAGE_FILE_DEFAULT_FORMAT;
+      if (empty($path) ) $path = CAS_PGT_STORAGE_FILE_DEFAULT_PATH;
+
+      // check that the path is an absolute path
+      if (getenv("OS")=="Windows_NT"){
+      	
+      	 if (!preg_match('`^[a-zA-Z]:`', $path)) {
+	     	phpCAS::error('an absolute path is needed for PGT storage to file');
+      	}
+      	
+      }
+      else
+      {
+      
+      	if ( $path[0] != '/' ) {
+			phpCAS::error('an absolute path is needed for PGT storage to file');
+      	}
+
+      	// store the path (with a leading and trailing '/')      
+      	$path = preg_replace('|[/]*$|','/',$path);
+      	$path = preg_replace('|^[/]*|','/',$path);
+      }
+      
+      $this->_path = $path;
+      // check the format and store it
+      switch ($format) {
+      case CAS_PGT_STORAGE_FILE_FORMAT_PLAIN:
+      case CAS_PGT_STORAGE_FILE_FORMAT_XML:
+	$this->_format = $format;
+	break;
+      default:
+	phpCAS::error('unknown PGT file storage format (`'.CAS_PGT_STORAGE_FILE_FORMAT_PLAIN.'\' and `'.CAS_PGT_STORAGE_FILE_FORMAT_XML.'\' allowed)');
+      }
+      phpCAS::traceEnd();      
+    }
+
+  // ########################################################################
+  //  INITIALIZATION
+  // ########################################################################
+  
+  /**
+   * This method is used to initialize the storage. Halts on error.
+   *
+   * @public
+   */
+  function init()
+    {
+      phpCAS::traceBegin();
+      // if the storage has already been initialized, return immediatly
+      if ( $this->isInitialized() )
+	return;
+      // call the ancestor's method (mark as initialized)
+      parent::init();
+      phpCAS::traceEnd();      
+    }
+
+  // ########################################################################
+  //  PGT I/O
+  // ########################################################################
+
+  /**
+   * This method returns the filename corresponding to a PGT Iou.
+   *
+   * @param $pgt_iou the PGT iou.
+   *
+   * @return a filename
+   * @private
+   */
+  function getPGTIouFilename($pgt_iou)
+    {
+      phpCAS::traceBegin();
+      $filename = $this->getPath().$pgt_iou.'.'.$this->getFormat();
+      phpCAS::traceEnd($filename);
+      return $filename;
+    }
+  
+  /**
+   * This method stores a PGT and its corresponding PGT Iou into a file. Echoes a
+   * warning on error.
+   *
+   * @param $pgt the PGT
+   * @param $pgt_iou the PGT iou
+   *
+   * @public
+   */
+  function write($pgt,$pgt_iou)
+	  {
+	  phpCAS::traceBegin();
+	  $fname = $this->getPGTIouFilename($pgt_iou);
+	  if(!file_exists($fname)){
+		  if ( $f=fopen($fname,"w") ) {
+			  if ( fputs($f,$pgt) === FALSE ) {
+				  phpCAS::error('could not write PGT to `'.$fname.'\'');
+			  }
+			  fclose($f);
+		  } else {
+			  phpCAS::error('could not open `'.$fname.'\'');
+		  }
+	  }else{
+		  phpCAS::error('File exists: `'.$fname.'\'');
+	  }
+	  phpCAS::traceEnd();      
+	  }
+
+  /**
+   * This method reads a PGT corresponding to a PGT Iou and deletes the 
+   * corresponding file.
+   *
+   * @param $pgt_iou the PGT iou
+   *
+   * @return the corresponding PGT, or FALSE on error
+   *
+   * @public
+   */
+  function read($pgt_iou)
+	  {
+	  phpCAS::traceBegin();
+	  $pgt = FALSE;
+	  $fname = $this->getPGTIouFilename($pgt_iou);
+	  if (file_exists($fname)){
+		  if ( !($f=fopen($fname,"r")) ) {
+			  phpCAS::trace('could not open `'.$fname.'\'');
+		  } else {
+			  if ( ($pgt=fgets($f)) === FALSE ) {
+				  phpCAS::trace('could not read PGT from `'.$fname.'\'');
+			  } 
+			  fclose($f);
+		  }
+		  
+		  // delete the PGT file
+		  @unlink($fname);
+	  }else{
+		  phpCAS::trace('No such file `'.$fname.'\'');
+	  }
+	  phpCAS::traceEnd($pgt);
+	  return $pgt;
+	  }
+  
+  /** @} */
+  
+}
+
+  
+?>
@@ -1,189 +1,214 @@
-<?php
-
-/**
- * @file CAS/PGTStorage/pgt-main.php
- * Basic class for PGT storage
- */
-
-/**
- * @class PGTStorage
- * The PGTStorage class is a generic class for PGT storage. This class should
- * not be instanciated itself but inherited by specific PGT storage classes.
- *
- * @author   Pascal Aubry <pascal.aubry at univ-rennes1.fr>
- *
- * @ingroup internalPGTStorage
- */
-
-class PGTStorage
-{
-  /** 
-   * @addtogroup internalPGTStorage
-   * @{ 
-   */
-
-  // ########################################################################
-  //  CONSTRUCTOR
-  // ########################################################################
-  
-  /**
-   * The constructor of the class, should be called only by inherited classes.
-   *
-   * @param $cas_parent the CASclient instance that creates the current object.
-   *
-   * @protected
-   */
-  function PGTStorage($cas_parent)
-    {
-      phpCAS::traceBegin();
-      if ( !$cas_parent->isProxy() ) {
-	phpCAS::error('defining PGT storage makes no sense when not using a CAS proxy'); 
-      }
-      phpCAS::traceEnd();
-    }
-
-  // ########################################################################
-  //  DEBUGGING
-  // ########################################################################
-  
-  /**
-   * This virtual method returns an informational string giving the type of storage
-   * used by the object (used for debugging purposes).
-   *
-   * @public
-   */
-  function getStorageType()
-    {
-      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
-    }
-
-  /**
-   * This virtual method returns an informational string giving informations on the
-   * parameters of the storage.(used for debugging purposes).
-   *
-   * @public
-   */
-  function getStorageInfo()
-    {
-      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
-    }
-
-  // ########################################################################
-  //  ERROR HANDLING
-  // ########################################################################
-  
-  /**
-   * string used to store an error message. Written by PGTStorage::setErrorMessage(),
-   * read by PGTStorage::getErrorMessage().
-   *
-   * @hideinitializer
-   * @private
-   * @deprecated not used.
-   */
-  var $_error_message=FALSE;
-
-  /**
-   * This method sets en error message, which can be read later by 
-   * PGTStorage::getErrorMessage().
-   *
-   * @param $error_message an error message
-   *
-   * @protected
-   * @deprecated not used.
-   */
-  function setErrorMessage($error_message)
-    {
-      $this->_error_message = $error_message;
-    }
-
-  /**
-   * This method returns an error message set by PGTStorage::setErrorMessage().
-   *
-   * @return an error message when set by PGTStorage::setErrorMessage(), FALSE
-   * otherwise.
-   *
-   * @public
-   * @deprecated not used.
-   */
-  function getErrorMessage()
-    {
-      return $this->_error_message;
-    }
-
-  // ########################################################################
-  //  INITIALIZATION
-  // ########################################################################
-
-  /**
-   * a boolean telling if the storage has already been initialized. Written by 
-   * PGTStorage::init(), read by PGTStorage::isInitialized().
-   *
-   * @hideinitializer
-   * @private
-   */
-  var $_initialized = FALSE;
-
-  /**
-   * This method tells if the storage has already been intialized.
-   *
-   * @return a boolean
-   *
-   * @protected
-   */
-  function isInitialized()
-    {
-      return $this->_initialized;
-    }
-
-  /**
-   * This virtual method initializes the object.
-   *
-   * @protected
-   */
-  function init()
-    {
-      $this->_initialized = TRUE;
-    }
-
-  // ########################################################################
-  //  PGT I/O
-  // ########################################################################
-
-  /**
-   * This virtual method stores a PGT and its corresponding PGT Iuo.
-   * @note Should never be called.
-   *
-   * @param $pgt the PGT
-   * @param $pgt_iou the PGT iou
-   *
-   * @protected
-   */
-  function write($pgt,$pgt_iou)
-    {
-      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
-    }
-
-  /**
-   * This virtual method reads a PGT corresponding to a PGT Iou and deletes
-   * the corresponding storage entry.
-   * @note Should never be called.
-   *
-   * @param $pgt_iou the PGT iou
-   *
-   * @protected
-   */
-  function read($pgt_iou)
-    {
-      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
-    }
-
-  /** @} */
-  
-} 
-
-// include specific PGT storage classes
-include_once(dirname(__FILE__).'/pgt-file.php'); 
-// incompatibility with Moodle
-//include_once(dirname(__FILE__).'/pgt-db.php');
-  
-?>
+<?php
+/*
+ * Copyright © 2003-2010, The ESUP-Portail consortium & the JA-SIG Collaborative.
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ * 
+ *     * Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright notice,
+ *       this list of conditions and the following disclaimer in the documentation
+ *       and/or other materials provided with the distribution.
+ *     * Neither the name of the ESUP-Portail consortium & the JA-SIG
+ *       Collaborative nor the names of its contributors may be used to endorse or
+ *       promote products derived from this software without specific prior
+ *       written permission.
+
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+/**
+ * @file CAS/PGTStorage/pgt-main.php
+ * Basic class for PGT storage
+ */
+
+/**
+ * @class PGTStorage
+ * The PGTStorage class is a generic class for PGT storage. This class should
+ * not be instanciated itself but inherited by specific PGT storage classes.
+ *
+ * @author   Pascal Aubry <pascal.aubry at univ-rennes1.fr>
+ *
+ * @ingroup internalPGTStorage
+ */
+
+class PGTStorage
+{
+  /** 
+   * @addtogroup internalPGTStorage
+   * @{ 
+   */
+
+  // ########################################################################
+  //  CONSTRUCTOR
+  // ########################################################################
+  
+  /**
+   * The constructor of the class, should be called only by inherited classes.
+   *
+   * @param $cas_parent the CASclient instance that creates the current object.
+   *
+   * @protected
+   */
+  function PGTStorage($cas_parent)
+    {
+      phpCAS::traceBegin();
+      if ( !$cas_parent->isProxy() ) {
+	phpCAS::error('defining PGT storage makes no sense when not using a CAS proxy'); 
+      }
+      phpCAS::traceEnd();
+    }
+
+  // ########################################################################
+  //  DEBUGGING
+  // ########################################################################
+  
+  /**
+   * This virtual method returns an informational string giving the type of storage
+   * used by the object (used for debugging purposes).
+   *
+   * @public
+   */
+  function getStorageType()
+    {
+      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
+    }
+
+  /**
+   * This virtual method returns an informational string giving informations on the
+   * parameters of the storage.(used for debugging purposes).
+   *
+   * @public
+   */
+  function getStorageInfo()
+    {
+      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
+    }
+
+  // ########################################################################
+  //  ERROR HANDLING
+  // ########################################################################
+  
+  /**
+   * string used to store an error message. Written by PGTStorage::setErrorMessage(),
+   * read by PGTStorage::getErrorMessage().
+   *
+   * @hideinitializer
+   * @private
+   * @deprecated not used.
+   */
+  var $_error_message=FALSE;
+
+  /**
+   * This method sets en error message, which can be read later by 
+   * PGTStorage::getErrorMessage().
+   *
+   * @param $error_message an error message
+   *
+   * @protected
+   * @deprecated not used.
+   */
+  function setErrorMessage($error_message)
+    {
+      $this->_error_message = $error_message;
+    }
+
+  /**
+   * This method returns an error message set by PGTStorage::setErrorMessage().
+   *
+   * @return an error message when set by PGTStorage::setErrorMessage(), FALSE
+   * otherwise.
+   *
+   * @public
+   * @deprecated not used.
+   */
+  function getErrorMessage()
+    {
+      return $this->_error_message;
+    }
+
+  // ########################################################################
+  //  INITIALIZATION
+  // ########################################################################
+
+  /**
+   * a boolean telling if the storage has already been initialized. Written by 
+   * PGTStorage::init(), read by PGTStorage::isInitialized().
+   *
+   * @hideinitializer
+   * @private
+   */
+  var $_initialized = FALSE;
+
+  /**
+   * This method tells if the storage has already been intialized.
+   *
+   * @return a boolean
+   *
+   * @protected
+   */
+  function isInitialized()
+    {
+      return $this->_initialized;
+    }
+
+  /**
+   * This virtual method initializes the object.
+   *
+   * @protected
+   */
+  function init()
+    {
+      $this->_initialized = TRUE;
+    }
+
+  // ########################################################################
+  //  PGT I/O
+  // ########################################################################
+
+  /**
+   * This virtual method stores a PGT and its corresponding PGT Iuo.
+   * @note Should never be called.
+   *
+   * @param $pgt the PGT
+   * @param $pgt_iou the PGT iou
+   *
+   * @protected
+   */
+  function write($pgt,$pgt_iou)
+    {
+      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
+    }
+
+  /**
+   * This virtual method reads a PGT corresponding to a PGT Iou and deletes
+   * the corresponding storage entry.
+   * @note Should never be called.
+   *
+   * @param $pgt_iou the PGT iou
+   *
+   * @protected
+   */
+  function read($pgt_iou)
+    {
+      phpCAS::error(__CLASS__.'::'.__FUNCTION__.'() should never be called'); 
+    }
+
+  /** @} */
+  
+} 
+
+// include specific PGT storage classes
+include_once(dirname(__FILE__).'/pgt-file.php'); 
+  
+?>
@@ -10,12 +10,12 @@
 			require_once('domxml-php4-to-php5.php');
 	}

-	Version 1.20a, 2008-11-06, http://alexandre.alapetite.net/doc-alex/domxml-php4-php5/
+	Version 1.21.1a, 2009-03-13, http://alexandre.alapetite.fr/doc-alex/domxml-php4-php5/

 	------------------------------------------------------------------
-	Written by Alexandre Alapetite, http://alexandre.alapetite.net/cv/
+	Written by Alexandre Alapetite, http://alexandre.alapetite.fr/cv/

-	Copyright 2004-2008, GNU Lesser General Public License,
+	Copyright 2004-2009, GNU Lesser General Public License,
 	http://www.gnu.org/licenses/lgpl.html

 	This program is free software: you can redistribute it and/or modify
@@ -39,7 +39,7 @@
 	   in order to improve this file for the benefit of everybody.

 	If you want to distribute this code, please do it as a link to:
-	http://alexandre.alapetite.net/doc-alex/domxml-php4-php5/
+	http://alexandre.alapetite.fr/doc-alex/domxml-php4-php5/
 */

 define('DOMXML_LOAD_PARSING',0);
@@ -179,6 +179,7 @@ class php4DOMDocument extends php4DOMNode
 	}
 	function html_dump_mem() {return $this->myDOMNode->saveHTML();}
 	function root() {return parent::_newDOMElement($this->myDOMNode->documentElement,$this);}
+	function xinclude() {return $this->myDOMNode->xinclude();}
 	function xpath_new_context() {return new php4DOMXPath($this);}
 }

@@ -262,7 +263,7 @@ class php4DOMNode
 				return false;
 		}
 	}
-	function add_child($newnode) {return append_child($newnode);}
+	function add_child($newnode) {return $this->append_child($newnode);}
 	function add_namespace($uri,$prefix) {return false;}
 	function append_child($newnode) {return self::_newDOMElement($this->myDOMNode->appendChild($this->_importNode($newnode)),$this->myOwnerDocument);}
 	function append_sibling($newnode) {return self::_newDOMElement($this->myDOMNode->parentNode->appendChild($this->_importNode($newnode)),$this->myOwnerDocument);}
@@ -458,8 +459,8 @@ class php4DOMXPath
 	}
 	function xpath_eval($eval_str,$contextnode=null)
 	{
-		if (method_exists($this->myDOMXPath,'evaluate')) $xp=isset($contextnode) ? $this->myDOMXPath->evaluate($eval_str,$contextnode->myDOMNode) : $this->myDOMXPath->evaluate($eval_str);
-		else $xp=isset($contextnode) ? $this->myDOMXPath->query($eval_str,$contextnode->myDOMNode) : $this->myDOMXPath->query($eval_str);
+		if (method_exists($this->myDOMXPath,'evaluate')) $xp=isset($contextnode->myDOMNode) ? $this->myDOMXPath->evaluate($eval_str,$contextnode->myDOMNode) : $this->myDOMXPath->evaluate($eval_str);
+		else $xp=isset($contextnode->myDOMNode) ? $this->myDOMXPath->query($eval_str,$contextnode->myDOMNode) : $this->myDOMXPath->query($eval_str);
 		$xp=new php4DOMNodelist($xp,$this->myOwnerDocument);
 		return ($xp->type===XPATH_UNDEFINED) ? false : $xp;
 	}
@@ -467,7 +468,7 @@ class php4DOMXPath
 }

 if (extension_loaded('xsl'))
-{//See also: http://alexandre.alapetite.net/doc-alex/xslt-php4-php5/
+{//See also: http://alexandre.alapetite.fr/doc-alex/xslt-php4-php5/
 	function domxml_xslt_stylesheet($xslstring) {return new php4DomXsltStylesheet(DOMDocument::loadXML($xslstring));}
 	function domxml_xslt_stylesheet_doc($dom_document) {return new php4DomXsltStylesheet($dom_document);}
 	function domxml_xslt_stylesheet_file($xslfile) {return new php4DomXsltStylesheet(DOMDocument::load($xslfile));}
@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * @file languages/spanish.php
+ * @author Iván-Benjamín García Torà <ivaniclixx AT gmail DOT com>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'usant servidor',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => 'Autentificació CAS necessària!',
+ CAS_STR_LOGOUT 
+ => 'Sortida de CAS necessària!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'Ja hauria d\ haver estat redireccionat al servidor CAS. Feu click <a href="%s">aquí</a> per a continuar.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => 'Autentificació CAS fallida!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>No estàs autentificat.</p><p>Pots tornar a intentar-ho fent click <a href="%s">aquí</a>.</p><p>Si el problema persisteix hauría de contactar amb l\'<a href="mailto:%s">administrador d\'aquest llocc</a>.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => 'El servei `<b>%s</b>\' no està disponible (<b>%s</b>).'
+);
+
+?>
@@ -1,79 +1,27 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file languages/english.php
-
-
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
-
-
- * @sa @link internalLang Internationalization @endlink
-
-
- * @ingroup internalLang
-
-
- */
-
-
-
-
-
-$this->_strings = array(
-
-
- CAS_STR_USING_SERVER 
-
-
- => 'using server',
-
-
- CAS_STR_AUTHENTICATION_WANTED 
-
-
- => 'CAS Authentication wanted!',
-
-
- CAS_STR_LOGOUT 
-
-
- => 'CAS logout wanted!',
-
-
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
-
- => 'You should already have been redirected to the CAS server. Click <a href="%s">here</a> to continue.',
-
-
- CAS_STR_AUTHENTICATION_FAILED 
-
-
- => 'CAS Authentication failed!',
-
-
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
-
- => '<p>You were not authenticated.</p><p>You may submit your request again by clicking <a href="%s">here</a>.</p><p>If the problem persists, you may contact <a href="mailto:%s">the administrator of this site</a>.</p>',
-
-
- CAS_STR_SERVICE_UNAVAILABLE
-
-
- => 'The service `<b>%s</b>\' is not available (<b>%s</b>).'
-
-
-);
-
-
-
-
-
+<?php
+
+/**
+ * @file languages/english.php
+ * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'using server',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => 'CAS Authentication wanted!',
+ CAS_STR_LOGOUT 
+ => 'CAS logout wanted!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'You should already have been redirected to the CAS server. Click <a href="%s">here</a> to continue.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => 'CAS Authentication failed!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>You were not authenticated.</p><p>You may submit your request again by clicking <a href="%s">here</a>.</p><p>If the problem persists, you may contact <a href="mailto:%s">the administrator of this site</a>.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => 'The service `<b>%s</b>\' is not available (<b>%s</b>).'
+);
+
 ?>
@@ -1,82 +1,28 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file languages/english.php
-
-
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
-
-
- * @sa @link internalLang Internationalization @endlink
-
-
- * @ingroup internalLang
-
-
- */
-
-
-
-
-
-$this->_strings = array(
-
-
- CAS_STR_USING_SERVER 
-
-
- => 'utilisant le serveur',
-
-
- CAS_STR_AUTHENTICATION_WANTED 
-
-
- => 'Authentication CAS nécessaire&nbsp;!',
-
-
- CAS_STR_LOGOUT 
-
-
- => 'Déconnexion demandée&nbsp;!',
-
-
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
-
- => 'Vous auriez du etre redirigé(e) vers le serveur CAS. Cliquez <a href="%s">ici</a> pour continuer.',
-
-
- CAS_STR_AUTHENTICATION_FAILED 
-
-
- => 'Authentification CAS infructueuse&nbsp;!',
-
-
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
-
- => '<p>Vous n\'avez pas été authentifié(e).</p><p>Vous pouvez soumettre votre requete à nouveau en cliquant <a href="%s">ici</a>.</p><p>Si le problème persiste, vous pouvez contacter <a href="mailto:%s">l\'administrateur de ce site</a>.</p>',
-
-
- CAS_STR_SERVICE_UNAVAILABLE
-
-
- => 'Le service `<b>%s</b>\' est indisponible (<b>%s</b>)'
-
-
-
-
-
-);
-
-
-
-
-
+<?php
+
+/**
+ * @file languages/english.php
+ * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'utilisant le serveur',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => 'Authentication CAS n�cessaire&nbsp;!',
+ CAS_STR_LOGOUT 
+ => 'D�connexion demand�e&nbsp;!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'Vous auriez du etre redirig�(e) vers le serveur CAS. Cliquez <a href="%s">ici</a> pour continuer.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => 'Authentification CAS infructueuse&nbsp;!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>Vous n\'avez pas �t� authentifi�(e).</p><p>Vous pouvez soumettre votre requete � nouveau en cliquant <a href="%s">ici</a>.</p><p>Si le probl�me persiste, vous pouvez contacter <a href="mailto:%s">l\'administrateur de ce site</a>.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => 'Le service `<b>%s</b>\' est indisponible (<b>%s</b>)'
+
+);
+
 ?>
@@ -1,79 +1,27 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file languages/german.php
-
-
- * @author Henrik Genssen <hg at mediafactory.de>
-
-
- * @sa @link internalLang Internationalization @endlink
-
-
- * @ingroup internalLang
-
-
- */
-
-
-
-
-
-$this->_strings = array(
-
-
- CAS_STR_USING_SERVER 
-
-
- => 'via Server',
-
-
- CAS_STR_AUTHENTICATION_WANTED 
-
-
- => 'CAS Authentifizierung erforderlich!',
-
-
- CAS_STR_LOGOUT 
-
-
- => 'CAS Abmeldung!',
-
-
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
-
- => 'eigentlich h&auml;ten Sie zum CAS Server weitergeleitet werden sollen. Dr&uuml;cken Sie <a href="%s">hier</a> um fortzufahren.',
-
-
- CAS_STR_AUTHENTICATION_FAILED 
-
-
- => 'CAS Anmeldung fehlgeschlagen!',
-
-
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
-
- => '<p>Sie wurden nicht angemeldet.</p><p>Um es erneut zu versuchen klicken Sie <a href="%s">hier</a>.</p><p>Wenn das Problem bestehen bleibt, kontkatieren Sie den <a href="mailto:%s">Administrator</a> dieser Seite.</p>',
-
-
- CAS_STR_SERVICE_UNAVAILABLE
-
-
- => 'Der Dienst `<b>%s</b>\' ist nicht verf&uuml;gbar (<b>%s</b>).'
-
-
-);
-
-
-
-
-
+<?php
+
+/**
+ * @file languages/german.php
+ * @author Henrik Genssen <hg at mediafactory.de>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'via Server',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => 'CAS Authentifizierung erforderlich!',
+ CAS_STR_LOGOUT 
+ => 'CAS Abmeldung!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'eigentlich h&auml;ten Sie zum CAS Server weitergeleitet werden sollen. Dr&uuml;cken Sie <a href="%s">hier</a> um fortzufahren.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => 'CAS Anmeldung fehlgeschlagen!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>Sie wurden nicht angemeldet.</p><p>Um es erneut zu versuchen klicken Sie <a href="%s">hier</a>.</p><p>Wenn das Problem bestehen bleibt, kontkatieren Sie den <a href="mailto:%s">Administrator</a> dieser Seite.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => 'Der Dienst `<b>%s</b>\' ist nicht verf&uuml;gbar (<b>%s</b>).'
+);
+
 ?>
@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * @file languages/greek.php
+ * @author Vangelis Haniotakis <haniotak at ucnet.uoc.gr>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => '��������������� � ������������',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => '���������� � ����������� CAS!',
+ CAS_STR_LOGOUT 
+ => '���������� � ���������� ��� CAS!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => '�� ������ �� ������ �������������� ���� ����������� CAS. ����� ���� <a href="%s">���</a> ��� �� ����������.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => '� ����������� CAS �������!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>��� ���������������.</p><p>�������� �� ����������������, �������� ���� <a href="%s">���</a>.</p><p>��� �� �������� ���������, ����� �� ����� �� ��� <a href="mailto:%s">�����������</a>.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => '� �������� `<b>%s</b>\' ��� ����� ��������� (<b>%s</b>).'
+);
+
+?>
@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * @file languages/japanese.php
+ * @author fnorif (fnorif@yahoo.co.jp)
+ * 
+ * Now Encoding is EUC-JP and LF
+ **/
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'using server',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => 'CAS�ˤ��ǧ�ڤ�Ԥ��ޤ�',
+ CAS_STR_LOGOUT 
+ => 'CAS����?�����Ȥ��ޤ�!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'CAS�����Ф˹Ԥ�ɬ�פ�����ޤ�����ưŪ��ž������ʤ����� <a href="%s">������</a> �򥯥�å�����³�Ԥ��ޤ���',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => 'CAS�ˤ��ǧ�ڤ˼��Ԥ��ޤ���',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>ǧ�ڤǤ��ޤ���Ǥ���.</p><p>�⤦���٥ꥯ�����Ȥ������������<a href="%s">������</a>�򥯥�å�.</p><p>���꤬��褷�ʤ����� <a href="mailto:%s">���Υ����Ȥδ����</a>���䤤��碌�Ƥ�������.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => '�����ӥ� `<b>%s</b>\' �����ѤǤ��ޤ��� (<b>%s</b>).'
+);
+
+?>
@@ -1,70 +1,24 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file languages/languages.php
-
-
- * Internationalization constants
-
-
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
-
-
- * @sa @link internalLang Internationalization @endlink
-
-
- * @ingroup internalLang
-
-
- */
-
-
-
-
-
-//@{
-
-
-/**
-
-
- * a phpCAS string index
-
-
- */
-
-
-define("CAS_STR_USING_SERVER",                1);
-
-
-define("CAS_STR_AUTHENTICATION_WANTED",       2);
-
-
-define("CAS_STR_LOGOUT",                      3);
-
-
-define("CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED", 4);
-
-
-define("CAS_STR_AUTHENTICATION_FAILED",       5);
-
-
-define("CAS_STR_YOU_WERE_NOT_AUTHENTICATED",  6);
-
-
-define("CAS_STR_SERVICE_UNAVAILABLE",         7);
-
-
-//@}
-
-
-
-
-
+<?php
+
+/**
+ * @file languages/languages.php
+ * Internationalization constants
+ * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+//@{
+/**
+ * a phpCAS string index
+ */
+define("CAS_STR_USING_SERVER",                1);
+define("CAS_STR_AUTHENTICATION_WANTED",       2);
+define("CAS_STR_LOGOUT",                      3);
+define("CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED", 4);
+define("CAS_STR_AUTHENTICATION_FAILED",       5);
+define("CAS_STR_YOU_WERE_NOT_AUTHENTICATED",  6);
+define("CAS_STR_SERVICE_UNAVAILABLE",         7);
+//@}
+
 ?>
@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * @file languages/spanish.php
+ * @author Iván-Benjamín García Torà <ivaniclixx AT gmail DOT com>
+ * @sa @link internalLang Internationalization @endlink
+ * @ingroup internalLang
+ */
+
+$this->_strings = array(
+ CAS_STR_USING_SERVER 
+ => 'usando servidor',
+ CAS_STR_AUTHENTICATION_WANTED 
+ => '¡Autentificación CAS necesaria!',
+ CAS_STR_LOGOUT 
+ => '¡Salida CAS necesaria!',
+ CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
+ => 'Ya debería haber sido redireccionado al servidor CAS. Haga click <a href="%s">aquí</a> para continuar.',
+ CAS_STR_AUTHENTICATION_FAILED 
+ => '¡Autentificación CAS fallida!',
+ CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
+ => '<p>No estás autentificado.</p><p>Puedes volver a intentarlo haciendo click <a href="%s">aquí</a>.</p><p>Si el problema persiste debería contactar con el <a href="mailto:%s">administrador de este sitio</a>.</p>',
+ CAS_STR_SERVICE_UNAVAILABLE
+ => 'El servicio `<b>%s</b>\' no está disponible (<b>%s</b>).'
+);
+
+?>
@@ -1,568 +0,0 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file CAS/PGTStorage/pgt-db.php
-
-
- * Basic class for PGT database storage
-
-
- */
-
-
-
-
-
-// include phpDB library (the test was introduced in release 0.4.8 for 
-
-
-// the integration into Tikiwiki).
-
-
-if (!class_exists('DB')) {
-
-
-  @include_once('DB.php');
-
-
-}
-
-
-
-
-
-/**
-
-
- * @class PGTStorageDB
-
-
- * The PGTStorageDB class is a class for PGT database storage. An instance of 
-
-
- * this class is returned by CASClient::SetPGTStorageDB().
-
-
- *
-
-
- * @author Pascal Aubry <pascal.aubry at univ-rennes1.fr>
-
-
- *
-
-
- * @ingroup internalPGTStorageDB
-
-
- */
-
-
-
-
-
-class PGTStorageDB extends PGTStorage
-
-
-{
-
-
-  /** 
-
-
-   * @addtogroup internalPGTStorageDB
-
-
-   * @{ 
-
-
-   */
-
-
-
-
-
-  /**
-
-
-   * a string representing a PEAR DB URL to connect to the database. Written by
-
-
-   * PGTStorageDB::PGTStorageDB(), read by getURL().
-
-
-   *
-
-
-   * @hideinitializer
-
-
-   * @private
-
-
-   */
-
-
-  var $_url='';
-
-
-
-
-
-  /**
-
-
-   * This method returns the PEAR DB URL to use to connect to the database.
-
-
-   *
-
-
-   * @return a PEAR DB URL
-
-
-   *
-
-
-   * @private
-
-
-   */
-
-
-  function getURL()
-
-
-    {
-
-
-      return $this->_url;
-
-
-    }
-
-
-
-
-
-  /**
-
-
-   * The handle of the connection to the database where PGT's are stored. Written by
-
-
-   * PGTStorageDB::init(), read by getLink().
-
-
-   *
-
-
-   * @hideinitializer
-
-
-   * @private
-
-
-   */
-
-
-  var $_link = null;
-
-
-
-
-
-  /**
-
-
-   * This method returns the handle of the connection to the database where PGT's are 
-
-
-   * stored.
-
-
-   *
-
-
-   * @return a handle of connection.
-
-
-   *
-
-
-   * @private
-
-
-   */
-
-
-  function getLink()
-
-
-    {
-
-
-      return $this->_link;
-
-
-    }
-
-
-
-
-
-  /**
-
-
-   * The name of the table where PGT's are stored. Written by 
-
-
-   * PGTStorageDB::PGTStorageDB(), read by getTable().
-
-
-   *
-
-
-   * @hideinitializer
-
-
-   * @private
-
-
-   */
-
-
-  var $_table = '';
-
-
-
-
-
-  /**
-
-
-   * This method returns the name of the table where PGT's are stored.
-
-
-   *
-
-
-   * @return the name of a table.
-
-
-   *
-
-
-   * @private
-
-
-   */
-
-
-  function getTable()
-
-
-    {
-
-
-      return $this->_table;
-
-
-    }
-
-
-
-
-
-  // ########################################################################
-
-
-  //  DEBUGGING
-
-
-  // ########################################################################
-
-
-  
-
-
-  /**
-
-
-   * This method returns an informational string giving the type of storage
-
-
-   * used by the object (used for debugging purposes).
-
-
-   *
-
-
-   * @return an informational string.
-
-
-   * @public
-
-
-   */
-
-
-  function getStorageType()
-
-
-    {
-
-
-      return "database";
-
-
-    }
-
-
-
-
-
-  /**
-
-
-   * This method returns an informational string giving informations on the
-
-
-   * parameters of the storage.(used for debugging purposes).
-
-
-   *
-
-
-   * @public
-
-
-   */
-
-
-  function getStorageInfo()
-
-
-    {
-
-
-      return 'url=`'.$this->getURL().'\', table=`'.$this->getTable().'\'';
-
-
-    }
-
-
-
-
-
-  // ########################################################################
-
-
-  //  CONSTRUCTOR
-
-
-  // ########################################################################
-
-
-  
-
-
-  /**
-
-
-   * The class constructor, called by CASClient::SetPGTStorageDB().
-
-
-   *
-
-
-   * @param $cas_parent the CASClient instance that creates the object.
-
-
-   * @param $user the user to access the data with
-
-
-   * @param $password the user's password
-
-
-   * @param $database_type the type of the database hosting the data
-
-
-   * @param $hostname the server hosting the database
-
-
-   * @param $port the port the server is listening on
-
-
-   * @param $database the name of the database
-
-
-   * @param $table the name of the table storing the data
-
-
-   *
-
-
-   * @public
-
-
-   */
-
-
-  function PGTStorageDB($cas_parent,$user,$password,$database_type,$hostname,$port,$database,$table)
-
-
-    {
-
-
-      phpCAS::traceBegin();
-
-
-
-
-
-      // call the ancestor's constructor
-
-
-      $this->PGTStorage($cas_parent);
-
-
-
-
-
-      if ( empty($database_type) ) $database_type = CAS_PGT_STORAGE_DB_DEFAULT_DATABASE_TYPE;
-
-
-      if ( empty($hostname) ) $hostname = CAS_PGT_STORAGE_DB_DEFAULT_HOSTNAME;
-
-
-      if ( $port==0 ) $port = CAS_PGT_STORAGE_DB_DEFAULT_PORT;
-
-
-      if ( empty($database) ) $database = CAS_PGT_STORAGE_DB_DEFAULT_DATABASE;
-
-
-      if ( empty($table) ) $table = CAS_PGT_STORAGE_DB_DEFAULT_TABLE;
-
-
-
-
-
-      // build and store the PEAR DB URL
-
-
-      $this->_url = $database_type.':'.'//'.$user.':'.$password.'@'.$hostname.':'.$port.'/'.$database;
-
-
-
-
-
-      // XXX should use setURL and setTable
-
-
-      phpCAS::traceEnd();
-
-
-    }
-
-
-  
-
-
-  // ########################################################################
-
-
-  //  INITIALIZATION
-
-
-  // ########################################################################
-
-
-  
-
-
-  /**
-
-
-   * This method is used to initialize the storage. Halts on error.
-
-
-   *
-
-
-   * @public
-
-
-   */
-
-
-  function init()
-
-
-    {
-
-
-      phpCAS::traceBegin();
-
-
-      // if the storage has already been initialized, return immediatly
-
-
-      if ( $this->isInitialized() )
-
-
-	return;
-
-
-      // call the ancestor's method (mark as initialized)
-
-
-      parent::init();
-
-
-      
-
-
-      // try to connect to the database
-
-
-      $this->_link = DB::connect($this->getURL());
-
-
-      if ( DB::isError($this->_link) ) {
-
-
-	phpCAS::error('could not connect to database ('.DB::errorMessage($this->_link).')');
-
-
-      }
-
-
-      var_dump($this->_link);
-
-
-      phpCAS::traceBEnd();
-
-
-    }
-
-
-
-
-
-  /** @} */
-
-
-}
-
-
-
-
-
-?>
@@ -1,79 +0,0 @@
-<?php
-
-
-
-
-
-/**
-
-
- * @file languages/greek.php
-
-
- * @author Vangelis Haniotakis <haniotak at ucnet.uoc.gr>
-
-
- * @sa @link internalLang Internationalization @endlink
-
-
- * @ingroup internalLang
-
-
- */
-
-
-
-
-
-$this->_strings = array(
-
-
- CAS_STR_USING_SERVER 
-
-
- => '÷ñçóéìïðïéåßôáé ï åîõðçñåôçôÞò',
-
-
- CAS_STR_AUTHENTICATION_WANTED 
-
-
- => 'Áðáéôåßôáé ç ôáõôïðïßçóç CAS!',
-
-
- CAS_STR_LOGOUT 
-
-
- => 'Áðáéôåßôáé ç áðïóýíäåóç áðü CAS!',
-
-
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
-
- => 'Èá Ýðñåðå íá åß÷áôå áíáêáôåõèõíèåß óôïí åîõðçñåôçôÞ CAS. ÊÜíôå êëßê <a href="%s">åäþ</a> ãéá íá óõíå÷ßóåôå.',
-
-
- CAS_STR_AUTHENTICATION_FAILED 
-
-
- => 'Ç ôáõôïðïßçóç CAS áðÝôõ÷å!',
-
-
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
-
- => '<p>Äåí ôáõôïðïéçèÞêáôå.</p><p>Ìðïñåßôå íá îáíáðñïóðáèÞóåôå, êÜíïíôáò êëßê <a href="%s">åäþ</a>.</p><p>Åáí ôï ðñüâëçìá åðéìåßíåé, åëÜôå óå åðáöÞ ìå ôïí <a href="mailto:%s">äéá÷åéñéóôÞ</a>.</p>',
-
-
- CAS_STR_SERVICE_UNAVAILABLE
-
-
- => 'Ç õðçñåóßá `<b>%s</b>\' äåí åßíáé äéáèÝóéìç (<b>%s</b>).'
-
-
-);
-
-
-
-
-
-?>
@@ -1,53 +0,0 @@
-<?php
-
-
-
-/**
-
- * @file languages/japanese.php
-
- * @author fnorif (fnorif@yahoo.co.jp)
-
- * 
-
- * Now Encoding is EUC-JP and LF
-
- **/
-
-
-
-$this->_strings = array(
-
- CAS_STR_USING_SERVER 
-
- => 'using server',
-
- CAS_STR_AUTHENTICATION_WANTED 
-
- => 'CASによる認証を行います',
-
- CAS_STR_LOGOUT 
-
- => 'CASからログアウトします!',
-
- CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED 
-
- => 'CASサーバに行く必要があります。自動的に転送されない場合は <a href="%s">こちら</a> をクリックして続行します。',
-
- CAS_STR_AUTHENTICATION_FAILED 
-
- => 'CASによる認証に失敗しました',
-
- CAS_STR_YOU_WERE_NOT_AUTHENTICATED 
-
- => '<p>認証できませんでした.</p><p>もう一度リクエストを送信する場合は<a href="%s">こちら</a>をクリック.</p><p>問題が解決しない場合は <a href="mailto:%s">このサイトの管理者</a>に問い合わせてください.</p>',
-
- CAS_STR_SERVICE_UNAVAILABLE
-
- => 'サービス `<b>%s</b>\' は利用できません (<b>%s</b>).'
-
-);
-
-
-
-?>
@@ -1,7 +0,0 @@
-PHP CAS library import
-
-List of changes:
-1/ backported fix for: http://www.ja-sig.org/issues/browse/PHPCAS-52 (MDL-21802) 
-
-
-skodak
@@ -97,8 +97,10 @@ class auth_plugin_cas extends auth_plugin_base {
      $username = optional_param("username");

      if (!empty($username)) {
-		  if (strstr($SESSION->wantsurl,'ticket') || strstr($SESSION->wantsurl,'NOCAS'))
-			  unset($SESSION->wantsurl);
+          if (isset($SESSION->wantsurl) && (strstr($SESSION->wantsurl, 'ticket') ||
+                                            strstr($SESSION->wantsurl, 'NOCAS'))) {
+              unset($SESSION->wantsurl);
+          }
          return;		
        }

@@ -112,6 +114,13 @@ class auth_plugin_cas extends auth_plugin_base {
 // Connection to CAS server
 	 $this->connectCAS();

+     if($this->config->certificate_check && $this->config->certificate_path){
+         phpCAS::setCasServerCACert($this->config->certificate_path);
+     }else{
+         // Don't try to validate the server SSL credentials
+         phpCAS::setNoCasServerValidation();
+     }
+
 	  // Gestion de la connection CAS si acc�s direct d'un ent ou autre	
 	 if (phpCAS::checkAuthentication()) {
 		$frm->username=phpCAS::getUser();
@@ -121,7 +130,7 @@ class auth_plugin_cas extends auth_plugin_base {
 		return;
 	 }	 	

-	  if ($_GET["loginguest"]== true) {
+          if (isset($_GET["loginguest"]) && ($_GET["loginguest"]== true)) {
 			$frm->username="guest";
 			$frm->password="guest";
 			return;
@@ -161,7 +170,7 @@ class auth_plugin_cas extends auth_plugin_base {
 	  if ($this->config->logoutcas ) {
 	        $backurl = $CFG->wwwroot;
 		  $this->connectCAS();
-	        phpCAS::logout($backurl);
+                phpCAS::logoutWithURL($backurl);
 	     }
    }
    /**
@@ -175,12 +184,13 @@ class auth_plugin_cas extends auth_plugin_base {
 	global $PHPCAS_CLIENT;
 // mode proxy CAS
 if ( !is_object($PHPCAS_CLIENT) ) {
+        // Make sure phpCAS doesn't try to start a new PHP session when connecting to the CAS server.
 	if  ($this->config->proxycas) {
-	    phpCAS::proxy($this->config->casversion, $this-> config->hostname, (int) $this->config->port, $this->config->baseuri);
+	    phpCAS::proxy($this->config->casversion, $this-> config->hostname, (int) $this->config->port, $this->config->baseuri, false);
 	}
 // mode client CAS
 	else {
-	    phpCAS::client($this->config->casversion, $this-> config->hostname, (int) $this->config->port, $this->config->baseuri);
+	    phpCAS::client($this->config->casversion, $this-> config->hostname, (int) $this->config->port, $this->config->baseuri, false);
 	}
    }
 	
@@ -196,6 +206,19 @@ if ( !is_object($PHPCAS_CLIENT) ) {
    function config_form($config, $err, $user_fields) {
        include 'config.html';
    }
+
+    /**
+     * A chance to validate form data, and last chance to
+     * do stuff before it is inserted in config_plugin
+     * @param object object with submitted configuration settings (without system magic quotes)
+     * @param array $err array of error messages
+     */
+    function validate_form(&$form, &$err) {
+        $certificate_path = trim($form->certificate_path);
+        if ($form->certificate_check && empty($certificate_path)) {
+            $err['certificate_path'] = get_string('auth_cas_certificate_path_empty', 'auth');
+        }
+    }
    /**
     * Returns the URL for changing the user's pw, or empty if the default can
     * be used.
@@ -242,6 +265,10 @@ if ( !is_object($PHPCAS_CLIENT) ) {
            $config->logoutcas = '';
        if (!isset ($config->multiauth))
            $config->multiauth = '';
+        if (!isset ($config->certificate_check))
+            $config->certificate_check = '';
+        if (!isset ($config->certificate_path))
+            $config->certificate_path = '';
        // LDAP settings
        if (!isset($config->host_url))
            { $config->host_url = ''; }
@@ -284,6 +311,8 @@ if ( !is_object($PHPCAS_CLIENT) ) {
        set_config('proxycas',     $config->proxycas,     'auth/cas');
        set_config('logoutcas',     $config->logoutcas,     'auth/cas');
        set_config('multiauth',     $config->multiauth,     'auth/cas');
+        set_config('certificate_check',     $config->certificate_check,     'auth/cas');
+        set_config('certificate_path',     $config->certificate_path,     'auth/cas');
        // save LDAP settings
        set_config('host_url', $config->host_url, 'auth/cas');
        set_config('ldapencoding', $config->ldapencoding, 'auth/cas');
@@ -364,6 +393,13 @@ if ( !is_object($PHPCAS_CLIENT) ) {
     * @return mixed array with no magic quotes or false on error
     */
    function get_userinfo($username) {
+        // No LDAP servers configured, so user info has to be provided
+        // via other methods (CSV file, manually, etc.). Return empty
+        // array so existing user info is not lost.
+        if (empty($this->config->host_url)) {
+            return array();
+        }
+
        $textlib = textlib_get_instance();
        $extusername = $textlib->convert(stripslashes($username), 'utf-8', $this->config->ldapencoding);
        $ldapconnection = $this->ldap_connect();
@@ -475,6 +511,9 @@ if ( !is_object($PHPCAS_CLIENT) ) {
            if (!empty($this->config->version)) {
                ldap_set_option($connresult, LDAP_OPT_PROTOCOL_VERSION, $this->config->version);
            }
+            if ($this->config->user_type == 'ad') {
+                 ldap_set_option($connresult, LDAP_OPT_REFERRALS, 0);
+            }
            if (!empty($binddn)) {
                //bind with search-user
                //$debuginfo .= 'Using bind user'.$binddn.'and password:'.$bindpwd;
@@ -618,6 +657,12 @@ if ( !is_object($PHPCAS_CLIENT) ) {
     */
    function sync_users ($bulk_insert_records = 1000, $do_updates = true) {
        global $CFG;
+
+        if(empty($this->config->host_url)) {
+            echo "No LDAP server configured for CAS! Syncing disabled.\n";
+            return;
+        }
+
        $textlib = textlib_get_instance();
        $droptablesql = array(); /// sql commands to drop the table (because session scope could be a problem for
                                 /// some persistent drivers like ODBTP (mssql) or if this function is invoked
@@ -630,7 +675,7 @@ if ( !is_object($PHPCAS_CLIENT) ) {
                $droptablesql[] = 'DROP TEMPORARY TABLE ' . $temptable; // sql command to drop the table (because session scope could be a problem)
                execute_sql_arr($droptablesql, true, false); /// Drop temp table to avoid persistence problems later
                echo "Creating temp table $temptable\n";
-                execute_sql('CREATE TEMPORARY TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username)) TYPE=MyISAM', false);
+                execute_sql('CREATE TEMPORARY TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username)) ENGINE=MyISAM', false);
                break;
            case 'postgres':
                $temptable = $CFG->prefix . 'extuser';
@@ -773,9 +818,9 @@ if ( !is_object($PHPCAS_CLIENT) ) {
                    $updateuser->id = $user->id;
                    $updateuser->auth = 'cas';
                    if (update_record('user', $updateuser)) {
-                        echo "\t"; print_string('auth_dbreviveser', 'auth', array($user->username, $user->id)); echo "\n";
+                        echo "\t"; print_string('auth_dbreviveduser', 'auth', array($user->username, $user->id)); echo "\n";
                    } else {
-                        echo "\t"; print_string('auth_dbreviveusererror', 'auth', $user->username); echo "\n";
+                        echo "\t"; print_string('auth_dbrevivedusererror', 'auth', $user->username); echo "\n";
                    }
                }
                commit_sql();
@@ -966,7 +1011,7 @@ if ( !is_object($PHPCAS_CLIENT) ) {
     * @return boolean result
     */
    function iscreator($username) {
-        if ((empty($this->config->attrcreators) && empty($this->config->groupecreators)) or empty($this->config->memberattribute)) {
+        if (empty($this->config->host_url) or (empty($this->config->attrcreators) && empty($this->config->groupecreators)) or empty($this->config->memberattribute)) {
            return null;
        }
        $textlib = textlib_get_instance();
@@ -48,6 +48,14 @@

        $config->multiauth = '';

+    if (!isset ($config->certificate_check)) 
+
+        $config->certificate_check = '';
+
+    if (!isset ($config->certificate_path))
+
+        $config->certificate_path = '';
+
  // set to defaults if undefined (LDAP)

    if (!isset($config->host_url))
@@ -364,6 +372,44 @@ if (!function_exists('ldap_connect')) { // Is php4-ldap really there?



+<tr valign="top"  class="required">
+
+    <td align="right"><?php print_string('auth_cas_certificate_check_key', 'auth') ?>:</td>
+
+    <td>
+
+        <?php choose_from_menu ($yesno, 'certificate_check', $config->certificate_check, ''); ?>
+
+    </td>
+
+    <td><?php print_string('auth_cas_certificate_check', 'auth') ?></td>
+
+</tr>
+
+
+
+<tr valign="top" class="required">
+
+    <td align="right"><?php print_string('auth_cas_certificate_path_key', 'auth') ?>:</td>
+
+    <td>
+
+        <input name="certificate_path" type="text" size="30" value="<?php echo $config->certificate_path ?>" />
+
+        <?php if (isset($err['certificate_path'])) formerr($err['certificate_path']); ?>
+
+    </td>
+
+    <td>
+
+        <?php print_string('auth_cas_certificate_path', 'auth') ?>
+      
+    </td>
+
+</tr>
+
+
+
 <tr>

   <td colspan="2">
@@ -61,7 +61,7 @@ class auth_plugin_db extends auth_plugin_base {
                                     WHERE {$this->config->fielduser} = '".$this->ext_addslashes($extusername)."' ");
            if (!$rs) {
                $authdb->Close();
-                print_error('auth_dbcantconnect','auth');
+                debugging(get_string('auth_dbcantconnect','auth'));
                return false;
            }

@@ -94,7 +94,7 @@ class auth_plugin_db extends auth_plugin_base {
                                  AND {$this->config->fieldpass} = '".$this->ext_addslashes($extpassword)."' ");
            if (!$rs) {
                $authdb->Close();
-                print_error('auth_dbcantconnect','auth');
+                debugging(get_string('auth_dbcantconnect','auth'));
                return false;
            }

@@ -364,7 +364,7 @@ class auth_plugin_db extends auth_plugin_base {
                if ($old_user = get_record('user', 'username', $user->username, 'deleted', 1, 'mnethostid', $user->mnethostid)) {
                    $user->id = $old_user->id;
                    set_field('user', 'deleted', 0, 'username', $user->username);
-                    echo "\t"; print_string('auth_dbreviveuser', 'auth', array(stripslashes($user->username), $user->id)); echo "\n";
+                    echo "\t"; print_string('auth_dbreviveduser', 'auth', array(stripslashes($user->username), $user->id)); echo "\n";
                } elseif ($id = insert_record ('user',$user)) { // it is truly a new user
                    echo "\t"; print_string('auth_dbinsertuser','auth',array(stripslashes($user->username), $id)); echo "\n";
                    // if relevant, tag for password generation
@@ -563,7 +563,7 @@ class auth_plugin_ldap extends auth_plugin_base {
        switch (strtolower($CFG->dbfamily)) {
            case 'mysql':
                $droptablesql[] = 'DROP TEMPORARY TABLE ' . $temptable; // sql command to drop the table (because session scope could be a problem)
-                $createtemptablesql = 'CREATE TEMPORARY TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username)) TYPE=MyISAM';
+                $createtemptablesql = 'CREATE TEMPORARY TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username)) ENGINE=MyISAM';
                break;
            case 'postgres':
                $droptablesql[] = 'DROP TABLE ' . $temptable; // sql command to drop the table (because session scope could be a problem)
@@ -723,9 +723,9 @@ class auth_plugin_ldap extends auth_plugin_base {
                    $updateuser->id = $user->id;
                    $updateuser->auth = 'ldap';
                    if (update_record('user', $updateuser)) {
-                        echo "\t"; print_string('auth_dbreviveser', 'auth', array($user->username, $user->id)); echo "\n";
+                        echo "\t"; print_string('auth_dbreviveduser', 'auth', array($user->username, $user->id)); echo "\n";
                    } else {
-                        echo "\t"; print_string('auth_dbreviveusererror', 'auth', $user->username); echo "\n";
+                        echo "\t"; print_string('auth_dbrevivedusererror', 'auth', $user->username); echo "\n";
                    }
                }
                commit_sql();
@@ -853,14 +853,15 @@ class auth_plugin_ldap extends auth_plugin_base {
                    if (!empty($this->config->forcechangepassword)) {
                        set_user_preference('auth_forcepasswordchange', 1, $userobj->id);
                    }
+
+                    // add course creators if needed
+                    if ($creatorrole !== false and $this->iscreator(stripslashes($user->username))) {
+                        role_assign($creatorrole->id, $id, 0, $sitecontext->id, 0, 0, 0, 'ldap');
+                    }
                } else {
                    echo "\t"; print_string('auth_dbinsertusererror', 'auth', $user->username); echo "\n";
                }

-                // add course creators if needed
-                if ($creatorrole !== false and $this->iscreator(stripslashes($user->username))) {
-                    role_assign($creatorrole->id, $user->id, 0, $sitecontext->id, 0, 0, 0, 'ldap');
-                }
            }
            commit_sql();
            unset($add_users); // free mem
@@ -1534,7 +1535,7 @@ class auth_plugin_ldap extends auth_plugin_base {
            // check cheaply if the user's DN sits in a subtree
            // of the "group" DN provided. Granted, this isn't
            // a proper LDAP group, but it's a popular usage.
-            if (strpos(strrev($memberuser), strrev($group))===0) {
+            if (strpos(strrev(strtolower($memberuser)), strrev(strtolower($group)))===0) {
                $result = true;
                break;
            }
@@ -193,18 +193,13 @@ class auth_plugin_shibboleth extends auth_plugin_base {
     *
     */
    function logoutpage_hook() {
-        global $redirect;
+        global $SESSION, $redirect;
        
-        // Only do this if logout handler is defined
-        if (
-              isset($this->config->logout_handler) 
-              && !empty($this->config->logout_handler)
-           ){
+        // Only do this if logout handler is defined, and if the user is actually logged in via Shibboleth
+        $logouthandlervalid = isset($this->config->logout_handler) && !empty($this->config->logout_handler);
+        if (  isset($SESSION->shibboleth_session_id) && $logouthandlervalid ) {
            // Check if there is an alternative logout return url defined
-            if (
-                  isset($this->config->logout_return_url) 
-                  && !empty($this->config->logout_return_url)
-               ){
+            if (isset($this->config->logout_return_url) && !empty($this->config->logout_return_url)) {
                // Set temp_redirect to alternative return url
                $temp_redirect = $this->config->logout_return_url;
            } else {
@@ -59,7 +59,7 @@
 <tr valign="top">
    <td align="right"><?php print_string("auth_shib_idp_list", "auth") ?>:</td>
    <td>
-        <textarea name="organization_selection" rows="10" cols="30" style="overflow: auto; white-space: nowrap;"
+        <textarea name="organization_selection" rows="10" cols="30" style="overflow: auto;"
 ><?php 
        if (!isset($config->organization_selection)){
            echo  'urn:mace:organization1:providerID, Example Organization 1
@@ -100,15 +100,22 @@ function schedule_backup_cron() {
                    $status = false;
                    continue;
                }
+                // Skip courses that do not yet need backup
+                $skipped = !($backup_course->nextstarttime > 0 && $backup_course->nextstarttime < $now);
                // Skip backup of unavailable courses that have remained unmodified in a month
-                $skipped = false;
-                if (!$course->visible && ($now - $course->timemodified) > 31*24*60*60) {  //Hidden + unmodified last month
-                    mtrace("            SKIPPING - hidden+unmodified");
-                    set_field("backup_courses","laststatus","3","courseid",$backup_course->courseid);
-                    $skipped = true;
+                if (!$skipped && !$course->visible && ($now - $course->timemodified) > 31*24*60*60) {  //Hidden + settings were unmodified last month
+                    //Check log if there were any modifications to the course content
+                    $sql = 'SELECT l.id FROM '.$CFG->prefix .'log l WHERE '.
+                            'l.course='. $course->id. ' AND l.time>'. ($now-31*24*60*60). " AND lower(l.action) not like '%view%'";
+                    $logexists = record_exists_sql($sql);
+                    if (!$logexists) {
+                        mtrace("            SKIPPING - hidden+unmodified");
+                        set_field("backup_courses", "laststatus", "3", "courseid", $backup_course->courseid);
+                        $skipped = true;
+                    }
                }
-                //Now we backup every non skipped course with nextstarttime < now
-                if (!$skipped  && $backup_course->nextstarttime > 0 && $backup_course->nextstarttime < $now) {
+                //Now we backup every non-skipped course
+                if (!$skipped) {
                    //We have to send a email because we have included at least one backup
                    $emailpending = true;
                    //Only make the backup if laststatus isn't 2-UNFINISHED (uncontrolled error)
@@ -2400,6 +2400,9 @@
            $result = $blockobject->encode_content_links($result,$mypreferences);
        }

+        // Finally encode some well-know links to course
+        $result = backup_course_encode_links($result, $mypreferences);
+
        if ($result != $content) {
            debugging('<br /><hr />'.s($content).'<br />changed to<br />'.s($result).'<hr /><br />');
        }
@@ -2407,6 +2410,22 @@
        return $result;
    }

+    /**
+     * Encode some well-know links to course. Restore will recode them to new course id
+     */
+    function backup_course_encode_links($content, $preferences) {
+        global $CFG;
+
+        $base = preg_quote($CFG->wwwroot,"/");
+
+        // Link to the course main page (it also covers "&topic=xx" and "&week=xx"
+        // because they don't become transformed (section number) in backup/restore
+        $search = '/(' . $base . '\/course\/view.php\?id\=)([0-9]+)/';
+        $result = preg_replace($search,'$@COURSEVIEWBYID*$2@$', $content);
+
+        return $result;
+    }
+
    /**
     * Callback preg_replace function used by backup_encode_absolute_links()
     * to process $@FILEPHP@$ URLs to get slasharguments independent URLs
@@ -66,7 +66,7 @@ function backup_upgrade($oldversion=0) {
                      `value` varchar(255) NOT NULL default '',
                      PRIMARY KEY  (`id`),
                      UNIQUE KEY `name` (`name`)
-                  ) TYPE=MyISAM COMMENT='To store backup configuration variables'");
+                  ) ENGINE=MyISAM COMMENT='To store backup configuration variables'");
    }

    if ($oldversion < 2003120800 and $result) {
@@ -79,7 +79,7 @@ function backup_upgrade($oldversion=0) {
                      `nextstarttime` int(10) unsigned NOT NULL default '0',
                      PRIMARY KEY  (`id`),
                      UNIQUE KEY `courseid` (`courseid`)
-                  ) TYPE=MyISAM COMMENT='To store every course backup status'");
+                  ) ENGINE=MyISAM COMMENT='To store every course backup status'");

        if ($result) {
            $result = execute_sql("CREATE TABLE `{$CFG->prefix}backup_log` (    
@@ -89,7 +89,7 @@ function backup_upgrade($oldversion=0) {
                          `laststarttime` int(10) unsigned NOT NULL default '0',
                          `info` varchar(255) NOT NULL default '',
                          PRIMARY KEY  (`id`)
-                      ) TYPE=MyISAM COMMENT='To store every course backup log info'");
+                      ) ENGINE=MyISAM COMMENT='To store every course backup log info'");
        }
    }

@@ -105,7 +105,7 @@ function backup_upgrade($oldversion=0) {
                          `new_id` int(10) unsigned NOT NULL default '0',
                          PRIMARY KEY  (`id`),
                          UNIQUE KEY `{$CFG->prefix}backup_files_uk` (`backup_code`,`file_type`,`path`)
-                      ) TYPE=MyISAM COMMENT='To store and recode ids to user and course files.'");
+                      ) ENGINE=MyISAM COMMENT='To store and recode ids to user and course files.'");
        }
        if ($result) {
            $result = execute_sql("DROP TABLE {$CFG->prefix}backup_ids");
@@ -120,7 +120,7 @@ function backup_upgrade($oldversion=0) {
                          `info` mediumtext,
                          PRIMARY KEY  (`id`),
                          UNIQUE KEY `{$CFG->prefix}backup_ids_uk` (`backup_code` ,`table_name`,`old_id`)
-                      ) TYPE=MyISAM COMMENT='To store and convert ids in backup/restore'");
+                      ) ENGINE=MyISAM COMMENT='To store and convert ids in backup/restore'");
        }
    }

@@ -200,11 +200,31 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
        return $status;
    }

+    /**
+     * This function decodes some well-know links to course
+     */
+    function course_decode_content_links($content, $restore) {
+
+        global $CFG;
+
+        // Links to course
+        $searchstring = '/\$@(COURSEVIEWBYID)\*([0-9]+)@\$/';
+        $replacestring= $CFG->wwwroot . '/course/view.php?id=' . $restore->course_id;
+        $result = preg_replace($searchstring, $replacestring, $content);
+
+        return $result;
+    }
+
    //This function is called from all xxxx_decode_content_links_caller(),
    //its task is to ask all modules (maybe other linkable objects) to restore
    //links to them.
    function restore_decode_content_links_worker($content,$restore) {
        global $CFG;
+
+        // Course links decoder
+        $content = course_decode_content_links($content, $restore);
+
+        // Module links decoders
        foreach($restore->mods as $name => $info) {
            $function_name = $name."_decode_content_links";
            if (function_exists($function_name)) {
@@ -3618,6 +3638,10 @@ define('RESTORE_GROUPS_GROUPINGS', 3);
                            } else {
                                $sca->userid = $USER->id;
                            }
+                            // If course scale, recode the course field
+                            if ($sca->courseid != 0) {
+                                $sca->courseid = $restore->course_id;
+                            }
                            // If scale is standard, if user lacks perms to manage standar scales
                            // 'downgrade' them to course scales
                            if ($sca->courseid == 0 and !has_capability('moodle/course:managescales', get_context_instance(CONTEXT_SYSTEM), $sca->userid)) {
@@ -142,7 +142,7 @@ global $CFG;
           `visible` tinyint(1) not null default '0',
           `configdata` text not null default '',
           PRIMARY KEY(`id`)
-          ) TYPE=MyISAM;");
+          ) ENGINE=MyISAM;");
    }
    
    if ($oldversion < 2005090200) {
@@ -101,6 +101,7 @@ if (isset($rss_record)) {


 if ($act == 'updfeed') {
+    require_sesskey();

    if (!$managefeeds) {
        error(get_string('noguestpost', 'forum').
@@ -153,6 +154,7 @@ if ($act == 'updfeed') {
    redirect($referrer, $message);

 } else if ($act == 'addfeed' ) {
+    require_sesskey();

    $canaddprivfeeds = has_capability('block/rss_client:createprivatefeeds', $context);
    $canaddsharedfeeds = has_capability('block/rss_client:createsharedfeeds', $context);
@@ -225,6 +227,7 @@ if ($act == 'updfeed') {
    rss_print_form($act, $url, $rssid, $preferredtitle, $shared, $id, $context);

 } else if ($act == 'delfeed') {
+    require_sesskey();

    if (!$managefeeds) {
        error(get_string('noguestpost', 'forum').
@@ -88,7 +88,7 @@ class block_section_links extends block_base {
        if (!empty($display)) {
            $link = $CFG->wwwroot.'/course/view.php?id='.$this->instance->pageid.'&amp;'.$sectionname.'=';
        } else {
-            $link = '#section-';
+            $link = '#sectionblock-';
        }

        $sql = "SELECT section, visible
@@ -1,5 +1,9 @@
 <?php  // $Id$

+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once($CFG->libdir.'/formslib.php');

 class blog_edit_form extends moodleform {
@@ -1,5 +1,7 @@
 <?php //$Id$

+defined('MOODLE_INTERNAL') || die();
+
 /// Sets up blocks and navigation for index.php

 require_once($CFG->dirroot .'/blog/lib.php');
@@ -659,17 +659,20 @@


    /// Find the base url from $_GET variables, for print_paging_bar
+    /// WARNING:  EVIL EVIL EVIL!  This function directly acesses $_GET which is a big no no. MDL-22631
+    /// I added some clean_param() calls for now but $_GET should just not ever be used directly.  
+    /// The function is totally gone in Moodle 2.0.
    function get_baseurl($filtertype, $filterselect) {

-        $getcopy  = $_GET;
-
-        unset($getcopy['blogpage']);
+        unset($_GET['blogpage']);

        $strippedurl = strip_querystring(qualified_me());
-        if(!empty($getcopy)) {
+        if(!empty($_GET)) {
            $first = false;
            $querystring = '';
-            foreach($getcopy as $var => $val) {
+            foreach($_GET as $var => $val) {
+                $var = clean_param($var, PARAM_ALPHANUM);   // See MDL-22631
+                $val = clean_param($val, PARAM_CLEAN);
                if(!$first) {
                    $first = true;
                    if ($var != 'filterselect' && $var != 'filtertype') {
@@ -680,8 +683,8 @@
                    }
                } else {
                    if ($var != 'filterselect' && $var != 'filtertype') {
-                    $querystring .= '&amp;'.$var.'='.$val;
-                    $hasparam = true;
+                        $querystring .= '&amp;'.$var.'='.$val;
+                        $hasparam = true;
                    }
                }
            }
@@ -364,6 +364,8 @@ $CFG->admin = 'admin';
 // When working with production data on test servers, no emails should ever be send to real users
 // $CFG->noemailever = true;
 //
+// Divert all outgoing emails to this address to test and debug emailing features
+// $CFG->divertallemailsto = 'root@localhost.local';
 //
 //=========================================================================
 // ALL DONE!  To continue installation, visit your main page with a browser
@@ -57,15 +57,28 @@
        if ($resort and confirm_sesskey()) {
            if ($courses = get_courses($category->id, "fullname ASC", 'c.id,c.fullname,c.sortorder')) {
                // move it off the range
-                $count = get_record_sql('SELECT MIN(sortorder) AS min, 1
+
+                $sortorderresult = get_record_sql('SELECT MIN(sortorder) AS min, 1
                                         FROM ' . $CFG->prefix . 'course WHERE category=' . $category->id);
-                $count = $count->min;
+                $sortordermin = $sortorderresult->min;
+
+                $sortorderresult = get_record_sql('SELECT MAX(sortorder) AS max, 1
+                                         FROM ' . $CFG->prefix . 'course WHERE category=' . $category->id);
+                $sortorder = $sortordermax = $sortorderresult->max + 100;
+
+                //place the courses above the maximum existing sortorder to avoid duplicate index errors
+                //after they've been sorted we'll shift them down again
                begin_sql();
                foreach ($courses as $course) {
-                    set_field('course', 'sortorder', $count, 'id', $course->id);
-                    $count++;
+                    set_field('course', 'sortorder', $sortorder, 'id', $course->id);
+                    $sortorder++;
                }
                commit_sql();
+
+                //shift course sortorder back down the amount we moved them up
+                execute_sql('UPDATE '. $CFG->prefix .'course SET sortorder = sortorder-'.($sortordermax-$sortordermin).
+                        ' WHERE category='.$category->id);
+
                fix_course_sortorder($category->id);
            }
        }
@@ -118,7 +131,10 @@
 /// Print current category description
    if (!$editingon && $category->description) {
        print_box_start();
-        echo format_text($category->description); // for multilang filter
+        $options = new stdClass();
+        $options->noclean = true;
+        $options->para = false;
+        echo format_text($category->description, FORMAT_MOODLE, $options); // for multilang filter
        print_box_end();
    }

@@ -1,5 +1,9 @@
 <?php  //$Id$

+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once($CFG->libdir.'/formslib.php');
 require_once($CFG->libdir . '/questionlib.php');

@@ -84,11 +84,11 @@
 /// process data if submitted

        //preprocess data
-        if ($data->enrolstartdisabled){
+        if (!empty($data->enrolstartdisabled)) {
            $data->enrolstartdate = 0;
        }

-        if ($data->enrolenddisabled) {
+        if (!empty($data->enrolenddisabled)) {
            $data->enrolenddate = 0;
        }

@@ -1,5 +1,9 @@
 <?php  //$Id$

+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once($CFG->libdir.'/formslib.php');

 class course_edit_form extends moodleform {
@@ -61,6 +61,8 @@ if ($mform->is_cancelled()) {
        // Update an existing category.
        $newcategory->id = $category->id;
        if ($newcategory->parent != $category->parent) {
+            // check category manage capability if parent changed
+            require_capability('moodle/category:manage', get_category_or_system_context((int)$newcategory->parent));
            $parent_cat = get_record('course_categories', 'id', $newcategory->parent);
            move_category($newcategory, $parent_cat);
        }
@@ -9,11 +9,17 @@ class editcategory_form extends moodleform {
        $category = $this->_customdata;

        // get list of categories to use as parents, with site as the first one
-        $options = array(get_string('top'));
+        $options = array();
+        if (has_capability('moodle/category:manage', get_system_context()) || $category->parent == 0) {
+            $options[0] = get_string('top');
+        }
        $parents = array();
        if ($category->id) {
            // Editing an existing category.
            make_categories_list($options, $parents, 'moodle/category:manage', $category->id);
+            if (empty($options[$category->parent])) {
+               $options[$category->parent] = get_field('course_categories', 'name', 'id', $category->parent);
+            }
            $strsubmit = get_string('savechanges');
        } else {
            // Making a new category
@@ -21,7 +21,7 @@
 </tr>
 </table>
 <div class="singlebutton">
-<input type="hidden" name="id" value="<?php echo $form->id ?>" />
+<input type="hidden" name="id" value="<?php echo $id ?>" />
 <input type="hidden" name="sesskey" value="<?php echo sesskey() ?>" />
 <input type="submit" value="<?php print_string("savechanges") ?>" />
 </div>
@@ -54,7 +54,7 @@
    } else {
        $sectionname  = get_section_name($course->format);
        $stredit      = get_string('edit', '', " $sectionname $section->section");
-        $strsummaryof = get_string('summaryof', '', " $sectionname $form->section");
+        $strsummaryof = get_string('summaryof', '', " $sectionname $section->section");
    }

    print_header_simple($stredit, '', build_navigation(array(array('name' => $stredit, 'link' => null, 'type' => 'misc'))), 'theform.summary' );
@@ -53,7 +53,7 @@
    }

 /// Check if the course is a meta course  (bug 5734)
-    if ($course->metacourse) {
+    if ($course->metacourse && !($course->guest == 2 && isguestuser())) {
        print_header_simple();
        notice(get_string('coursenotaccessible'), "$CFG->wwwroot/index.php");
    }
@@ -5,6 +5,6 @@


 $CFG->ajaxcapable = true;
-$CFG->ajaxtestedbrowsers = array('MSIE' => 6.0, 'Gecko' => 20061111);
+$CFG->ajaxtestedbrowsers = array('MSIE' => 6.0, 'Gecko' => 20061111, 'Safari'=>531, 'Chrome'=>6.0);

 ?>
@@ -113,7 +113,7 @@

    if ($thissection->summary or $thissection->sequence or isediting($course->id)) {
        echo '<tr id="section-0" class="section main">';
-        echo '<td class="left side">&nbsp;</td>';
+        echo '<td id="sectionblock-0" class="left side">&nbsp;</td>';
        echo '<td class="content">';
        
        echo '<div class="summary">';
@@ -194,7 +194,7 @@
            }

            echo '<tr id="section-'.$section.'" class="section main'.$sectionstyle.'">';
-            echo '<td class="left side">'.$currenttext.$section.'</td>';
+            echo '<td id="sectionblock-'.$section.'" class="left side">'.$currenttext.$section.'</td>';

            echo '<td class="content">';
            if (!has_capability('moodle/course:viewhiddensections', $context) and !$thissection->visible) {   // Hidden for students
@@ -221,11 +221,11 @@
            echo '<td class="right side">';
            if ($displaysection == $section) {      // Show the zoom boxes
                echo '<a href="view.php?id='.$course->id.'&amp;topic=0#section-'.$section.'" title="'.$strshowalltopics.'">'.
-                     '<img src="'.$CFG->pixpath.'/i/all.gif" alt="'.$strshowalltopics.'" /></a><br />';
+                     '<img src="'.$CFG->pixpath.'/i/all.gif" class="icon topicall" alt="'.$strshowalltopics.'" /></a><br />';
            } else {
                $strshowonlytopic = get_string('showonlytopic', '', $section);
                echo '<a href="view.php?id='.$course->id.'&amp;topic='.$section.'" title="'.$strshowonlytopic.'">'.
-                     '<img src="'.$CFG->pixpath.'/i/one.gif" alt="'.$strshowonlytopic.'" /></a><br />';
+                     '<img src="'.$CFG->pixpath.'/i/one.gif" class="icon topicone" alt="'.$strshowonlytopic.'" /></a><br />';
            }

            if (isediting($course->id) && has_capability('moodle/course:update', get_context_instance(CONTEXT_COURSE, $course->id))) {
@@ -5,6 +5,6 @@


 $CFG->ajaxcapable = true;
-$CFG->ajaxtestedbrowsers = array('MSIE' => 6.0, 'Gecko' => 20061111);
+$CFG->ajaxtestedbrowsers = array('MSIE' => 6.0, 'Gecko' => 20061111, 'Safari'=>531, 'Chrome'=>6.0);

 ?>
@@ -100,7 +100,7 @@

    if ($thissection->summary or $thissection->sequence or isediting($course->id)) {
        echo '<tr id="section-0" class="section main">';
-        echo '<td class="left side">&nbsp;</td>';
+        echo '<td id="sectionblock-0" class="left side">&nbsp;</td>';
        echo '<td class="content">';
        
        echo '<div class="summary">';
@@ -187,7 +187,7 @@
            }

            echo '<tr id="section-'.$section.'" class="section main'.$sectionstyle.'">';
-            echo '<td class="left side">&nbsp;'.$currenttext.'</td>';
+            echo '<td id="sectionblock-'.$section.'" class="left side">&nbsp;'.$currenttext.'</td>';

            $weekperiod = $weekday.' - '.$endweekday;

@@ -29,7 +29,7 @@
    $taught_courses = array();
    if (!empty($tcourseids)) {
        $tcourseids = substr($tcourseids,0,-1);
-        $taught_courses = get_records_list('course', 'id', $tcourseids, 'sortorder');
+        $taught_courses = get_records_list('course', 'id', $tcourseids, 'sortorder', 'id, fullname');
    }

    if (!empty($creator)) {
@@ -1,4 +1,4 @@
-<?php // $Id: uploadgroups.php, 2005/10/31 19:09:31
+<?php // $Id$

 /// Bulk group creation registration script from a comma separated file

@@ -523,7 +523,7 @@ function print_log_csv($course, $user, $date, $order='l.time DESC', $modname,
    header("Pragma: public");

    echo get_string('savedat').userdate(time(), $strftimedatetime)."\n";
-    echo $text;
+    echo $text."\n";

    if (empty($logs['logs'])) {
        return true;
@@ -1,4 +1,9 @@
 <?php
+
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once ($CFG->libdir.'/formslib.php');
 /**
 * This class adds extra methods to form wrapper specific to be used for module
@@ -1,5 +1,9 @@
 <?php //$$

+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once($CFG->libdir.'/formslib.php');

 class recent_form extends moodleform {
@@ -170,38 +170,36 @@

        switch ($action) {
            case 'view':
-                $actionsql = 'l.action IN (\''.implode('\',\'', $viewnames).'\' )';
+                $actionsql = 'action IN (\''.implode('\',\'', $viewnames).'\' )';
                break;
            case 'post':
-                $actionsql = 'l.action IN (\''.implode('\',\'', $postnames).'\' )';
+                $actionsql = 'action IN (\''.implode('\',\'', $postnames).'\' )';
                break;
            default:
                // some modules have stuff we want to hide, ie mail blocked etc so do actually need to limit here.
-                $actionsql = 'l.action IN (\''.implode('\',\'', array_merge($viewnames, $postnames)).'\' )';
+                $actionsql = 'action IN (\''.implode('\',\'', array_merge($viewnames, $postnames)).'\' )';
        }

        $relatedcontexts = get_related_contexts_string($context);

-        $sql = "SELECT ra.userid, u.firstname, u.lastname, u.idnumber, COUNT(l.action) AS count
-                  FROM {$CFG->prefix}role_assignments ra
-                       JOIN {$CFG->prefix}user u           ON u.id = ra.userid
-                       LEFT OUTER JOIN {$CFG->prefix}log l ON (l.userid = ra.userid AND l.cmid = $instanceid AND l.time > $timefrom AND $actionsql)
-                 WHERE ra.contextid $relatedcontexts AND ra.roleid = $roleid";
+        $sql = "SELECT ra.userid, u.firstname, u.lastname, u.idnumber, l.actioncount AS count
+                FROM (SELECT * FROM {$CFG->prefix}role_assignments WHERE contextid $relatedcontexts AND roleid = $roleid ) ra
+                JOIN {$CFG->prefix}user u ON u.id = ra.userid
+                LEFT JOIN (
+                    SELECT userid, COUNT(action) AS actioncount FROM {$CFG->prefix}log WHERE cmid = $instanceid AND time > $timefrom AND $actionsql GROUP BY userid
+                ) l ON (l.userid = ra.userid)";
+

        if ($table->get_sql_where()) {
-            $sql .= ' AND '.$table->get_sql_where(); //initial bar
+            $sql .= ' WHERE '.$table->get_sql_where(); //initial bar
        }

-        $sql .= " GROUP BY ra.userid, u.firstname, u.lastname, u.idnumber";
-
        if ($table->get_sql_sort()) {
            $sql .= ' ORDER BY '.$table->get_sql_sort();
        }

        $countsql = "SELECT COUNT(DISTINCT(ra.userid))
                       FROM {$CFG->prefix}role_assignments ra
-                            JOIN {$CFG->prefix}user u           ON u.id = ra.userid
-                            LEFT OUTER JOIN {$CFG->prefix}log l ON (l.userid = ra.userid AND l.cmid = $instanceid AND l.time > $timefrom AND $actionsql)
                      WHERE ra.contextid $relatedcontexts AND ra.roleid = $roleid";

        $totalcount = count_records_sql($countsql);
@@ -31,6 +31,10 @@
 * @package course
 *//** */

+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once($CFG->libdir.'/formslib.php');

 /**
@@ -1,4 +1,8 @@
 <?php // $Id$
+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once $CFG->libdir.'/formslib.php';

 class course_reset_form extends moodleform {
@@ -73,7 +73,7 @@
    } else {
        if (has_capability('moodle/course:managescales', $context)) {
            echo "<p align=\"center\">(";
-            print_string("scalestip");
+            print_string("scalestip2");
            echo ")</p>";
        }
    }
@@ -87,7 +87,7 @@ Cron
 ====

 If your class offers a cron() method, it will be invoked by
-the standard Moodle cron every 5 minutes. Note that if the
+the standard Moodle cron every time it is called. Note that if the
 tasks are not lightweight you must control how frequently they
 execute, perhaps offering a config option.

@@ -71,7 +71,7 @@ class enrolment_plugin_authorize
            $curcost = get_course_cost($course);
            echo '<div class="mdl-align">';
            echo '<p>'.get_string('paymentrequired').'</p>';
-            echo '<p><b>'.get_string('cost').": $curcost[currency] $curcost[cost]".'</b></p>';
+            echo '<p><b>'.get_string('cost').': '. $curcost['currency'] . $curcost['localizedcost'] .'</b></p>';
            echo '<p><a href="'.$CFG->httpswwwroot.'/login/">'.get_string('loginsite').'</a></p>';
            echo '</div>';
        }
@@ -387,7 +387,7 @@ class enrolment_plugin_authorize
            }

            $str .= '<div class="cost" title="'.$strrequirespayment.'">'.$strcost.': ';
-            $str .= $currency . ' ' . $curcost['cost'].'</div>';
+            $str .= $currency . ' ' . $curcost['localizedcost'].'</div>';
        }

        return $str;
@@ -12,10 +12,11 @@ function get_course_cost($course)
    if (!empty($course->cost)) {
        $cost = (float)(((float)$course->cost) < 0) ? $CFG->enrol_cost : $course->cost;
    }
-
-    $cost = format_float($cost, 2);
+    $costlocalizeddisplay = format_float($cost, 2);
+    $cost = format_float($cost, 2, false);
    $ret = array(
        'cost' => $cost,
+        'localizedcost' => $costlocalizeddisplay,
        'currency' => $currency
    );

@@ -93,7 +93,7 @@ function setup_enrolments(&$user) {
                //error_log('[ENROL_DB] Found '.count($existing).' existing roles and '.$count.' in external database');

                foreach ($courselist as $coursefield) {   /// Check the list of courses against existing
-                    $course = get_record('course', $CFG->enrol_localcoursefield, $coursefield);
+                    $course = get_record('course', $CFG->enrol_localcoursefield, addslashes($coursefield));
                    if (!is_object($course)) {
                        if (empty($CFG->enrol_db_autocreate)) { // autocreation not allowed
                            if (debugging('',DEBUG_ALL)) {
@@ -157,7 +157,7 @@ function setup_enrolments(&$user) {
                    if ($role_assignment->enrol == 'database') {
                        //error_log('[ENROL_DB] Removing user from context '.$role_assignment->contextid);
                        role_unassign($role_assignment->roleid, $user->id, '', $role_assignment->contextid);
-                    } 
+                    }
                }
            }
        } else {
@@ -231,7 +231,7 @@ function sync_enrolments($role = null) {
        $course = false;
        $course = get_record( 'course',
                              $CFG->enrol_localcoursefield,
-                              $extcourse );
+                              addslashes($extcourse) );

        if (!is_object($course)) {
            if (empty($CFG->enrol_db_autocreate)) { // autocreation not allowed
@@ -157,13 +157,13 @@ function get_access_icons($course) {
                        continue;
                    }

-                    if (! $user = get_record("user", "idnumber", $fields[2]) ) {
+                    if (! $user = get_record("user", "idnumber", addslashes($fields[2])) ) {
                        $this->log .= "Unknown user idnumber in field 3 - ignoring line\n";
                        continue;
                    }


-                    if (! $course = get_record("course", "idnumber", $fields[3]) ) {
+                    if (! $course = get_record("course", "idnumber", addslashes($fields[3])) ) {
                        $this->log .= "Unknown course idnumber in field 4 - ignoring line\n";
                        continue;
                    }
@@ -516,11 +516,12 @@ function process_group_tag($tagcontents){
                        // Else if we're allowed to create new categories, let's create this one
                        $newcat->name = $group->category;
                       $newcat->visible = 0;
-                       if($catid = insert_record('course_categories', $newcat)){
+                       if($catid = insert_record('course_categories', addslashes_object($newcat))){
                           $course->category = $catid;
                           $this->log_line("Created new (hidden) category, #$catid: $newcat->name");
                       }else{
-                           $this->log_line('Failed to create new category: '.$newcat->name);
+                           $this->log_line('Failed to create new category: '.$newcat->name.' so using default category instead.');
+                           $course->category = 1;
                       }
                    }else{
                        // If not found and not allowed to create, stick with default
@@ -4,8 +4,8 @@ require_once("$CFG->dirroot/enrol/enrol.class.php");

 class enrolment_plugin_ldap {

-    var $log;    
-    
+    var $log;
+
    var $enrol_localcoursefield = 'idnumber';

 /**
@@ -23,7 +23,7 @@ function setup_enrolments(&$user) {
        notify("[ENROL_LDAP] LDAP-module cannot connect to server: {$CFG->enrol_ldap_host_url}");
        return false;
    }
-    
+
    // we are connected OK, continue...

    // Get all the possible roles
@@ -37,7 +37,7 @@ function setup_enrolments(&$user) {
    if (!$roleassignments) {
        $roleassignments = array();
    }
-    
+
    // Get the ones that came from LDAP
    $ldap_assignments = array_filter($roleassignments, create_function('$x', 'return $x->enrol == \'ldap\';'));

@@ -46,20 +46,20 @@ function setup_enrolments(&$user) {
    // Get enrolments for each type of role from LDAP.
    foreach($roles as $role) {
        $enrolments = $this->find_ext_enrolments(
-            $ldap_connection, 
-            $user->idnumber , 
+            $ldap_connection,
+            $user->idnumber ,
            $role);

        //error_log('[ENROL_LDAP] LDAP reports ' . count($enrolments) . ' enrolments of type ' . $role->shortname . '.');

        foreach ($enrolments as $enrol){
-    
+
            $course_ext_id = $enrol[$CFG->enrol_ldap_course_idnumber][0];
            if(empty($course_ext_id)){
                error_log("[ENROL_LDAP] The course external id is invalid!\n");
                continue; // next; skip this one!
            }
-            
+
            // create the course  ir required
            $course_obj = get_record( 'course',
                                      $this->enrol_localcoursefield,
@@ -74,18 +74,18 @@ function setup_enrolments(&$user) {
                    error_log("[ENROL_LDAP] User $user->username enrolled to a nonexistant course $course_ext_id \n");
                }
            }
-            
+
            // deal with enrolment in the moodle db
-            if (!empty($course_obj)) { // does course exist now?     
-        
+            if (!empty($course_obj)) { // does course exist now?
+
                $context = get_context_instance(CONTEXT_COURSE, $course_obj->id);
                //$courseroles = get_user_roles($context, $user->id);
-            
+
                if (!get_record('role_assignments', 'roleid', $role->id, 'userid', $user->id, 'contextid', $context->id)) {
                    //error_log("[ENROL_LDAP] Assigning role '{$role->name}' to {$user->id} ({$user->username}) in course {$course_obj->id} ({$course_obj->shortname})");
                    if (!role_assign($role->id, $user->id, 0, $context->id, 0, 0, 0, 'ldap')){
                        error_log("[ENROL_LDAP] Failed to assign role '{$role->name}' to $user->id ($user->username) into course $course_obj->id ($course_obj->shortname)");
-                    } 
+                    }
                } else {
                    //error_log("[ENROL_LDAP] Role '{$role->name}' already assigned to {$user->id} ({$user->username}) in course {$course_obj->id} ({$course_obj->shortname})");
                }
@@ -115,7 +115,7 @@ function setup_enrolments(&$user) {
    @ldap_close($ldap_connection);

    //error_log('[ENROL_LDAP] finished with setup_enrolments');
-    
+
    return true;
 }

@@ -137,7 +137,7 @@ function sync_enrolments($type, $enrol = false) {
        notify("LDAP-module cannot connect to server: $CFG->ldap_host_url");
        return false;
    }
-    
+
    // we are connected OK, continue...
    $this->enrol_ldap_bind($ldap_connection);

@@ -145,7 +145,7 @@ function sync_enrolments($type, $enrol = false) {
    $ldap_contexts = explode(";",$CFG->{'enrol_ldap_contexts_role'.$role->id});

    // get all the fields we will want for the potential course creation
-    // as they are light. don't get membership -- potentially a lot of data. 
+    // as they are light. don't get membership -- potentially a lot of data.
    $ldap_fields_wanted = array( 'dn', $CFG->enrol_ldap_course_idnumber);
    if (!empty($CFG->enrol_ldap_course_fullname)){
        array_push($ldap_fields_wanted, $CFG->enrol_ldap_course_fullname);
@@ -161,11 +161,11 @@ function sync_enrolments($type, $enrol = false) {
    }

    // define the search pattern
-    if (!empty($CFG->enrol_ldap_objectclass)){ 
+    if (!empty($CFG->enrol_ldap_objectclass)){
        $ldap_search_pattern='(objectclass='.$CFG->enrol_ldap_objectclass.')';
    } else {
       $ldap_search_pattern="(objectclass=*)";
-        
+
    }

    // first, pack the sortorder...
@@ -176,19 +176,19 @@ function sync_enrolments($type, $enrol = false) {
        $context = trim($context);
        if ($CFG->enrol_ldap_search_sub){
            //use ldap_search to find first user from subtree
-            $ldap_result = @ldap_search($ldap_connection, 
-                                        $context, 
+            $ldap_result = @ldap_search($ldap_connection,
+                                        $context,
                                        $ldap_search_pattern,
                                        $ldap_fields_wanted);

        } else {
            //search only in this context
-            $ldap_result = @ldap_list($ldap_connection, 
-                                        $context, 
+            $ldap_result = @ldap_list($ldap_connection,
+                                        $context,
                                        $ldap_search_pattern,
                                        $ldap_fields_wanted,0,0);
        }
- 
+
        // check and push results
        $records = $ldap_result
            ? ldap_get_entries($ldap_connection,$ldap_result)
@@ -197,9 +197,9 @@ function sync_enrolments($type, $enrol = false) {
        // ldap libraries return an odd array, really. fix it:
        $flat_records=array();
        for ($c=0;$c<$records['count'];$c++) {
-            array_push($flat_records, $records["$c"]); 
+            array_push($flat_records, $records["$c"]);
        }
-        // free mem -- is there a leak? 
+        // free mem -- is there a leak?
        $records=0; $ldap_result=0;

        if (count($flat_records)) {
@@ -208,7 +208,7 @@ function sync_enrolments($type, $enrol = false) {
            foreach($flat_records as $course){
                $idnumber = $course{$CFG->enrol_ldap_course_idnumber}[0];
                print "== Synching $idnumber\n";
-                // does the course exist in moodle already? 
+                // does the course exist in moodle already?
                $course_obj = false;
                $course_obj = get_record( 'course',
                                          $this->enrol_localcoursefield,
@@ -237,22 +237,22 @@ function sync_enrolments($type, $enrol = false) {
                    $context = get_context_instance(CONTEXT_COURSE, $course_obj->id);

                    // pull the ldap membership into a nice array
-                    // this is an odd array -- mix of hash and array -- 
+                    // this is an odd array -- mix of hash and array --
                    $ldapmembers=array();

                    if(array_key_exists('enrol_ldap_memberattribute_role'.$role->id, $CFG)
                     && !empty($CFG->{'enrol_ldap_memberattribute_role'.$role->id})
                     && !empty($course[strtolower($CFG->{'enrol_ldap_memberattribute_role'.$role->id} ) ])){ // may have no membership!

-                        $ldapmembers = $course[strtolower($CFG->{'enrol_ldap_memberattribute_role'.$role->id} )]; 
+                        $ldapmembers = $course[strtolower($CFG->{'enrol_ldap_memberattribute_role'.$role->id} )];
                        unset($ldapmembers['count']); // remove oddity ;)
                        $ldapmembers = addslashes_recursive($ldapmembers);
                    }
-                    
+
                    // prune old ldap enrolments
                    // hopefully they'll fit in the max buffer size for the RDBMS
                    $sql = '
-                        SELECT enr.userid AS user, 1
+                        SELECT enr.userid
                        FROM '.$CFG->prefix.'role_assignments enr
                        JOIN '.$CFG->prefix.'user usr ON usr.id=enr.userid
                        WHERE enr.roleid = '.$role->id.'
@@ -266,7 +266,7 @@ function sync_enrolments($type, $enrol = false) {
                    $todelete = get_records_sql($sql);
                    if(!empty($todelete)){
                        foreach ($todelete as $member) {
-                            $member = $member->user;
+                            $member = $member->userid;

                            if (role_unassign($role->id, $member, 0, $context->id, 'ldap')) {
                                print "Unassigned $type from $member for course $course_obj->id ($course_obj->shortname)\n";
@@ -275,21 +275,21 @@ function sync_enrolments($type, $enrol = false) {
                            }
                        }
                    }
-                    
-                    // insert current enrolments 
+
+                    // insert current enrolments
                    // bad we can't do INSERT IGNORE with postgres...
                    foreach ($ldapmembers as $ldapmember) {
                        $sql = 'SELECT id,1 FROM '.$CFG->prefix.'user '
                                ." WHERE idnumber='$ldapmember'";
-                        $member = get_record_sql($sql); 
-//                        print "sql: $sql \nidnumber = ".stripslashes($ldapmember)." \n".var_dump($member); 
+                        $member = get_record_sql($sql);
+//                        print "sql: $sql \nidnumber = ".stripslashes($ldapmember)." \n".var_dump($member);
                        if(empty($member) || empty($member->id)){
                            print "Could not find user ".stripslashes($ldapmember).", skipping\n";
                            continue;
                        }
                        $member = $member->id;
-                        if (!get_record('role_assignments', 'roleid', $role->id, 
-                                        'contextid', $context->id, 
+                        if (!get_record('role_assignments', 'roleid', $role->id,
+                                        'contextid', $context->id,
                                        'userid', $member, 'enrol', 'ldap')){
                            if (role_assign($role->id, $member, 0, $context->id, 0, 0, 0, 'ldap')){
                                print "Assigned role $type to $member (".stripslashes($ldapmember).") for course $course_obj->id ($course_obj->shortname)\n";
@@ -302,10 +302,10 @@ function sync_enrolments($type, $enrol = false) {
            }
        }
    }
-    
+
    // we are done now, a bit of housekeeping
    fix_course_sortorder();
-    
+
    @ldap_close($ldap_connection);
    return true;
 }
@@ -321,7 +321,7 @@ function config_form($frm) {
    global $CFG;

    $this->check_legacy_config();
-    
+
    include("$CFG->dirroot/enrol/ldap/config.html");
 }

@@ -339,7 +339,7 @@ function process_config($config) {
        $config->enrol_ldap_version = '';
    }
    set_config('enrol_ldap_version', $config->enrol_ldap_version);
-    
+
    if (!isset ($config->enrol_ldap_bind_dn)) {
        $config->enrol_ldap_bind_dn = '';
    }
@@ -348,58 +348,58 @@ function process_config($config) {
    if (!isset ($config->enrol_ldap_bind_pw)) {
        $config->enrol_ldap_bind_pw = '';
    }
-    set_config('enrol_ldap_bind_pw', $config->enrol_ldap_bind_pw);    
-    
+    set_config('enrol_ldap_bind_pw', $config->enrol_ldap_bind_pw);
+
    if (!isset ($config->enrol_ldap_objectclass)) {
        $config->enrol_ldap_objectclass = '';
    }
-    set_config('enrol_ldap_objectclass', $config->enrol_ldap_objectclass);    
-    
+    set_config('enrol_ldap_objectclass', $config->enrol_ldap_objectclass);
+
    if (!isset ($config->enrol_ldap_category)) {
        $config->enrol_ldap_category  = '';
    }
-    set_config('enrol_ldap_category', $config->enrol_ldap_category);    
-    
+    set_config('enrol_ldap_category', $config->enrol_ldap_category);
+
    if (!isset ($config->enrol_ldap_template)) {
        $config->enrol_ldap_template = '';
    }
-    set_config('enrol_ldap_template', $config->enrol_ldap_template);    
-    
+    set_config('enrol_ldap_template', $config->enrol_ldap_template);
+
    if (!isset ($config->enrol_ldap_course_fullname)) {
        $config->enrol_ldap_course_fullname = '';
    }
-    set_config('enrol_ldap_course_fullname', $config->enrol_ldap_course_fullname);    
+    set_config('enrol_ldap_course_fullname', $config->enrol_ldap_course_fullname);

    if (!isset ($config->enrol_ldap_course_shortname)) {
        $config->enrol_ldap_course_shortname = '';
    }
-    set_config('enrol_ldap_course_shortname', $config->enrol_ldap_course_shortname);    
-    
+    set_config('enrol_ldap_course_shortname', $config->enrol_ldap_course_shortname);
+
    if (!isset ($config->enrol_ldap_course_summary)) {
        $config->enrol_ldap_course_summary = '';
    }
-    set_config('enrol_ldap_course_summary', $config->enrol_ldap_course_summary);    
-    
+    set_config('enrol_ldap_course_summary', $config->enrol_ldap_course_summary);
+
    if (!isset ($config->enrol_ldap_course_idnumber)) {
        $config->enrol_ldap_course_idnumber = '';
    }
-    set_config('enrol_ldap_course_idnumber', $config->enrol_ldap_course_idnumber); 
-    
+    set_config('enrol_ldap_course_idnumber', $config->enrol_ldap_course_idnumber);
+
    if (!isset ($config->enrol_localcoursefield)) {
        $config->enrol_localcoursefield = '';
    }
    set_config('enrol_localcoursefield', $config->enrol_localcoursefield);
-    
+
    if (!isset ($config->enrol_ldap_user_memberfield)) {
        $config->enrol_ldap_user_memberfield = '';
    }
-    set_config('enrol_ldap_user_memberfield', $config->enrol_ldap_user_memberfield); 
-    
+    set_config('enrol_ldap_user_memberfield', $config->enrol_ldap_user_memberfield);
+
    if (!isset ($config->enrol_ldap_search_sub)) {
        $config->enrol_ldap_search_sub = '0';
    }
-    set_config('enrol_ldap_search_sub', $config->enrol_ldap_search_sub); 
-    
+    set_config('enrol_ldap_search_sub', $config->enrol_ldap_search_sub);
+
    if (!isset ($config->enrol_ldap_autocreate)) {
        $config->enrol_ldap_autocreate = '0';
    }
@@ -410,11 +410,11 @@ function process_config($config) {
        if (!isset($config->{'enrol_ldap_contexts_role'.$role->id})) {
            $config->{'enrol_ldap_contexts_role'.$role->id} = '';
        }
-        
+
        if (!isset($config->{'enrol_ldap_memberattribute_role'.$role->id})) {
            $config->{'enrol_ldap_memberattribute_role'.$role->id} = '';
        }
-        
+
        set_config('enrol_ldap_contexts_role'.$role->id, $config->{'enrol_ldap_contexts_role'.$role->id});
        set_config('enrol_ldap_memberattribute_role'.$role->id, $config->{'enrol_ldap_memberattribute_role'.$role->id});
    }
@@ -435,7 +435,7 @@ function enrol_ldap_connect(){

        if (!empty($CFG->enrol_ldap_bind_dn)) {
            $bind = ldap_bind( $result,
-                                 $CFG->enrol_ldap_bind_dn, 
+                                 $CFG->enrol_ldap_bind_dn,
                                 $CFG->enrol_ldap_bind_pw );
            if (!$bind) {
                notify("Error in binding to LDAP server");
@@ -464,11 +464,11 @@ function enrol_ldap_bind($ldap_connection){
        }

    } else {
-        //bind anonymously 
+        //bind anonymously
        if ( !ldap_bind($ldap_connection)){
            notify("Error: could not bind ldap anonymously");
            return false;
-        }  
+        }
    }

    return true;
@@ -477,13 +477,13 @@ function enrol_ldap_bind($ldap_connection){
 function find_ext_enrolments ($ldap_connection, $memberuid, $role){
 /// role is a record from the mdl_role table
 /// return multidimentional array array with of courses (at least dn and idnumber)
-/// 
+///

    global $CFG;

    if(empty($memberuid)) { // No "idnumber" stored for this user, so no LDAP enrolments
        return array();
-    } 
+    }

    //default return value
    $courses = array();
@@ -493,7 +493,7 @@ function find_ext_enrolments ($ldap_connection, $memberuid, $role){
    $ldap_contexts = explode(";",$CFG->{'enrol_ldap_contexts_role'.$role->id});

    // get all the fields we will want for the potential course creation
-    // as they are light. don't get membership -- potentially a lot of data. 
+    // as they are light. don't get membership -- potentially a lot of data.
    $ldap_fields_wanted = array( 'dn', $CFG->enrol_ldap_course_idnumber);
    if (!empty($CFG->enrol_ldap_course_fullname)){
        array_push($ldap_fields_wanted, $CFG->enrol_ldap_course_fullname);
@@ -507,7 +507,7 @@ function find_ext_enrolments ($ldap_connection, $memberuid, $role){

    // define the search pattern
    $ldap_search_pattern = "(".$CFG->{'enrol_ldap_memberattribute_role'.$role->id}."=".$this->filter_addslashes($memberuid).")";
-    if (!empty($CFG->enrol_ldap_objectclass)){ 
+    if (!empty($CFG->enrol_ldap_objectclass)){
        $ldap_search_pattern='(&(objectclass='.$CFG->enrol_ldap_objectclass.')'.$ldap_search_pattern.')';
    }

@@ -516,31 +516,31 @@ function find_ext_enrolments ($ldap_connection, $memberuid, $role){
        if (empty($context)) {
            continue; // next;
        }
-        
+
        if ($CFG->enrol_ldap_search_sub){
            //use ldap_search to find first user from subtree
-            $ldap_result = ldap_search($ldap_connection, 
-                                        $context, 
+            $ldap_result = ldap_search($ldap_connection,
+                                        $context,
                                        $ldap_search_pattern,
                                        $ldap_fields_wanted);

        } else {
            //search only in this context
-            $ldap_result = ldap_list($ldap_connection, 
-                                        $context, 
+            $ldap_result = ldap_list($ldap_connection,
+                                        $context,
                                        $ldap_search_pattern,
                                        $ldap_fields_wanted);
        }
- 
+
        // check and push results
-        $records = ldap_get_entries($ldap_connection,$ldap_result);        
+        $records = ldap_get_entries($ldap_connection,$ldap_result);

        // ldap libraries return an odd array, really. fix it:
        $flat_records=array();
        for ($c=0;$c<$records['count'];$c++) {
-            array_push($flat_records, $records["$c"]); 
+            array_push($flat_records, $records["$c"]);
        }
-        
+
        if (count($flat_records)) {
            $courses = array_merge($courses, $flat_records);
        }
@@ -551,7 +551,7 @@ function find_ext_enrolments ($ldap_connection, $memberuid, $role){

 // will create the moodle course from the template
 // course_ext is an array as obtained from ldap -- flattened somewhat
-// NOTE: if you pass true for $skip_fix_course_sortorder 
+// NOTE: if you pass true for $skip_fix_course_sortorder
 // you will want to call fix_course_sortorder() after your are done
 // with course creation
 function create_course ($course_ext,$skip_fix_course_sortorder=0){
@@ -578,7 +578,7 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
    $course->shortname = $course_ext[$CFG->enrol_ldap_course_shortname][0];
    if (   empty($course->idnumber)
        || empty($course->fullname)
-        || empty($course->shortname) ) { 
+        || empty($course->shortname) ) {
        // we are in trouble!
        error_log("Cannot create course: missing required data from the LDAP record!");
         error_log(var_export($course, true));
@@ -588,10 +588,10 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
    $course->summary = empty($CFG->enrol_ldap_course_summary) || empty($course_ext[$CFG->enrol_ldap_course_summary][0])
        ? ''
        : $course_ext[$CFG->enrol_ldap_course_summary][0];
-    
+
    if(!empty($CFG->enrol_ldap_category)){ // optional ... but ensure it is set!
        $course->category = $CFG->enrol_ldap_category;
-    } 
+    }
    if ($course->category == 0){ // must be avoided as it'll break moodle
        $course->category = 1; // the misc 'catch-all' category
    }
@@ -600,13 +600,13 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
    $sort = get_record_sql('SELECT MAX(sortorder) AS max, 1 FROM ' . $CFG->prefix . 'course WHERE category=' . $course->category);
    $sort = $sort->max;
    $sort++;
-    $course->sortorder = $sort; 
+    $course->sortorder = $sort;

    // override with local data
    $course->startdate = time();
    $course->timecreated = time();
    $course->visible     = 1;
-    
+
    $course = addslashes_recursive($course);

    // store it and log
@@ -619,8 +619,8 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
        blocks_repopulate_page($page); // Return value no


-        if(!$skip_fix_course_sortorder){ 
-            fix_course_sortorder(); 
+        if(!$skip_fix_course_sortorder){
+            fix_course_sortorder();
        }
        add_to_log($newcourseid, "course", "new", "view.php?id=$newcourseid", "enrol/ldap auto-creation");
    } else {
@@ -628,7 +628,7 @@ function create_course ($course_ext,$skip_fix_course_sortorder=0){
        notify("Serious Error! Could not create the new course!");
        return false;
    }
-    
+
    return $newcourseid;
 }

@@ -665,7 +665,7 @@ function check_legacy_config () {

        unset_config('enrol_ldap_teacher_contexts');
    }
-    
+
    if (isset($CFG->enrol_ldap_teacher_memberattribute)) {
        if (isset($teacher_role)
         or $teacher_role = get_record('role', 'shortname', 'teacher')) {
@@ -171,7 +171,7 @@ class enrolment_plugin_mnet {
                co.cost,
                co.currency,
                co.defaultrole as defaultroleid,
-                r.name
+                r.name as defaultrolename
            FROM
                {$CFG->prefix}course_categories ca
            JOIN
@@ -206,7 +206,7 @@ class enrolment_plugin_mnet {
                    co.cost,
                    co.currency,
                    co.defaultrole as defaultroleid,
-                    r.name
+                    r.name as defaultrolename
                FROM
                    {$CFG->prefix}course_categories ca
                JOIN
@@ -13,7 +13,7 @@

      //TODO: Blog attachments do not have access control implemented - anybody can read them!
      //      It might be better to move the code to separate file because the access
-      //      control is quite complex - see bolg/index.php 
+      //      control is quite complex - see bolg/index.php

    require_once('config.php');
    require_once('lib/filelib.php');
@@ -29,7 +29,7 @@

    $relativepath = get_file_argument('file.php');
    $forcedownload = optional_param('forcedownload', 0, PARAM_BOOL);
-    
+
    // relative path must start with '/', because of backup/restore!!!
    if (!$relativepath) {
        error('No valid arguments supplied or incorrect server configuration');
@@ -39,12 +39,20 @@

    $pathname = $CFG->dataroot.$relativepath;

+    // protect imsenterprise plugin data
+    if (strtolower("$CFG->dataroot/1/imsenterprise-enrol.xml") === strtolower(realpath($pathname))
+        or (!empty($CFG->enrol_imsfilelocation) and strtolower($CFG->enrol_imsfilelocation) === strtolower(realpath($pathname)))) {
+        require_login();
+        require_capability('moodle/site:config', get_context_instance(CONTEXT_SYSTEM));
+        $forcedownload = 1;
+    }
+
    // extract relative path components
    $args = explode('/', trim($relativepath, '/'));
    if (count($args) == 0) { // always at least courseid, may search for index.html in course root
        error('No valid arguments supplied');
    }
-  
+
    // security: limit access to existing course subdirectories
    if (($args[0]!='blog') and (!$course = get_record_sql("SELECT * FROM {$CFG->prefix}course WHERE id='".(int)$args[0]."'"))) {
        error('Invalid course ID');
@@ -84,7 +92,7 @@
        if (!has_capability('moodle/site:backup', get_context_instance(CONTEXT_COURSE, $course->id))) {
            error('Access not allowed');
        } else {
-            $lifetime = 0; //disable browser caching for backups 
+            $lifetime = 0; //disable browser caching for backups
        }
    }

@@ -120,7 +128,7 @@
            if (!has_capability('mod/assignment:grade', get_context_instance(CONTEXT_MODULE, $cm->id))) {
                error('Access not allowed');
            }
-        } 
+        }
    }

    // security: force download of all attachments submitted by students
@@ -144,11 +152,11 @@
    }
    if ($args[0] == 'blog') {
        $forcedownload  = 1; // force download of all attachments
-    }    
+    }

    // security: some protection of hidden resource files
    // warning: it may break backwards compatibility
-    if ((!empty($CFG->preventaccesstohiddenfiles)) 
+    if ((!empty($CFG->preventaccesstohiddenfiles))
        and (count($args) >= 2)
        and (!(strtolower($args[1]) == 'moddata' and strtolower($args[2]) != 'resource')) // do not block files from other modules!
        and (!has_capability('moodle/course:viewhiddenactivities', get_context_instance(CONTEXT_COURSE, $course->id)))) {
@@ -8,8 +8,8 @@
 //  USER is a persistent variable using sessions

    require('../config.php');
-    require($CFG->libdir.'/filelib.php');
-    require($CFG->libdir.'/adminlib.php');
+    require_once($CFG->libdir . '/filelib.php');
+    require_once($CFG->libdir . '/adminlib.php');

    $id      = required_param('id', PARAM_INT);
    $file    = optional_param('file', '', PARAM_PATH);
@@ -23,7 +23,7 @@
    require_capability('moodle/site:config', get_context_instance(CONTEXT_SYSTEM));

    $query = urldecode($_SERVER['QUERY_STRING']);
-    error_reporting(E_ALL);
+    error_reporting(DEBUG_ALL);

    if ($query) {
      $output = $query;
@@ -36,70 +36,80 @@ function mediaplugin_filter($courseid, $text) {
    $newtext = $text; // fullclone is slow and not needed here

    if ($CFG->filter_mediaplugin_enable_mp3) {
-        $search = '/<a.*?href="([^<]+\.mp3)"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.mp3)"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_mp3_callback', $newtext);
    }

+    if ($CFG->filter_mediaplugin_enable_ogg) {
+        $search =   '/<a\s[^>]*href="([^"]+\.ogg)"[^>]*>.*?<\/a>/is';
+        $newtext = preg_replace_callback($search, 'filter_mediaplugin_ogg_callback', $newtext);
+    }
+
+    if ($CFG->filter_mediaplugin_enable_ogv) {
+        $search =   '/<a\s[^>]*href="([^"]+\.ogv)"[^>]*>.*?<\/a>/is';
+        $newtext = preg_replace_callback($search, 'filter_mediaplugin_ogv_callback', $newtext);
+    }
+
    if ($CFG->filter_mediaplugin_enable_swf) {
-        $search = '/<a.*?href="([^<]+\.swf)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.swf)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_swf_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_flv) {
-        $search = '/<a.*?href="([^<]+\.flv)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.flv)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_flv_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_mov) {
-        $search = '/<a.*?href="([^<]+\.mov)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.mov)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);

        // MDL-18658
-        $search = '/<a.*?href="([^<]+\.mp4)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.mp4)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);

-        $search = '/<a.*?href="([^<]+\.m4v)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.m4v)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);

-        $search = '/<a.*?href="([^<]+\.m4a)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^<]+\.m4a)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_wmv) {
-        $search = '/<a.*?href="([^<]+\.wmv)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.wmv)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_wmp_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_mpg) {
-        $search = '/<a.*?href="([^<]+\.mpe?g)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.mpe?g)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_qt_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_avi) {
-        $search = '/<a.*?href="([^<]+\.avi)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.avi)(\?d=([\d]{1,4}%?)x([\d]{1,4}%?))?"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_wmp_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_ram) {
-        $search = '/<a.*?href="([^<]+\.ram)"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.ram)"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_real_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_rpm) {
-        $search = '/<a.*?href="([^<]+\.rpm)"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.rpm)"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_real_callback', $newtext);
    }

    if ($CFG->filter_mediaplugin_enable_rm) {
-        $search = '/<a.*?href="([^<]+\.rm)"[^>]*>.*?<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]+\.rm)"[^>]*>.*?<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_real_callback', $newtext);
    }

    if (!empty($CFG->filter_mediaplugin_enable_youtube)) {
-        $search = '/<a[^>]*?href="([^<]*)youtube.com\/watch\?v=([^"]*)"[^>]*>(.*?)<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]*)youtube.com\/watch\?v=([^"]*)"[^>]*>(.*?)<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_youtube_callback', $newtext);

-        $search = '/<a[^>]*?href="([^<]*)youtube.com\/v\/([^"]*)"[^>]*>(.*?)<\/a>/is';
+        $search = '/<a\s[^>]*href="([^"]*)youtube.com\/v\/([^"]*)"[^>]*>(.*?)<\/a>/is';
        $newtext = preg_replace_callback($search, 'mediaplugin_filter_youtube_callback', $newtext);
    }

@@ -133,20 +143,65 @@ function mediaplugin_filter_mp3_callback($link) {
    static $count = 0;
    $count++;
    $id = 'filter_mp3_'.time().$count; //we need something unique because it might be stored in text cache
+    $url = $link[1];
+    $jsurl = addslashes_js($link[1]);

-    $url = addslashes_js($link[1]);
-
-    return $link[0].
+    $printlink = '<a href="'.$url.'">'.get_string('mp3audio', 'mediaplugin').'</a>';
+    return $printlink.
 '<span class="mediaplugin mediaplugin_mp3" id="'.$id.'">('.get_string('mp3audio', 'mediaplugin').')</span>
 <script type="text/javascript">
 //<![CDATA[
-  var FO = { movie:"'.$CFG->wwwroot.'/filter/mediaplugin/mp3player.swf?src='.$url.'",
+  var FO = { movie:"'.$CFG->wwwroot.'/filter/mediaplugin/mp3player.swf?src='.$jsurl.'",
    width:"90", height:"15", majorversion:"6", build:"40", flashvars:"'.$c.'", quality: "high" };
  UFO.create(FO, "'.$id.'");
 //]]>
 </script>';
 }

+function filter_mediaplugin_ogg_callback($link) {
+    global $CFG;
+
+    static $count = 0;
+    $count++;
+    $id = 'filter_ogg_'.time().$count; //we need something unique because it might be stored in text cache
+
+    $url = $link[1];
+    $printlink = '<a href="'.$url.'">'.get_string('oggaudio', 'mediaplugin').'</a>';
+
+    $unsupportedplugins = get_string('unsupportedplugins', 'mediaplugin', $printlink);
+    $output = <<<OET
+    <span class="mediaplugin mediaplugin_ogg" id="$id">
+    <audio id="$id" src="$url" controls="true" width="100">
+        $unsupportedplugins
+    </audio>
+    </span>
+OET;
+
+    return $output;
+}
+
+function filter_mediaplugin_ogv_callback($link) {
+    global $CFG;
+
+    static $count = 0;
+    $count++;
+    $id = 'filter_ogv_'.time().$count; //we need something unique because it might be stored in text cache
+
+    $url = $link[1];
+    $printlink = '<a href="'.$url.'">'.get_string('ogvvideo', 'mediaplugin').'</a>';
+
+    $unsupportedplugins = get_string('unsupportedplugins', 'mediaplugin', $printlink);
+    $output = <<<OET
+    <span class="mediaplugin mediaplugin_ogv" id="$id">
+    <video id="$id" src="$url" controls="true" width="600" >
+        $unsupportedplugins
+    </video>
+    </span>
+OET;
+
+    return $output;
+}
+
 function mediaplugin_filter_swf_callback($link) {
    static $count = 0;
    $count++;
@@ -154,13 +209,15 @@ function mediaplugin_filter_swf_callback($link) {

    $width  = empty($link[3]) ? '400' : $link[3];
    $height = empty($link[4]) ? '300' : $link[4];
-    $url = addslashes_js($link[1]);
+    $url = $link[1];
+    $jsurl = addslashes_js($link[1]);
+    $printlink = '<a href="'.$url.'">'.get_string('flashvideo', 'mediaplugin').'</a>';

-    return $link[0].
+    return $printlink.
 '<span class="mediaplugin mediaplugin_swf" id="'.$id.'">('.get_string('flashanimation', 'mediaplugin').')</span>
 <script type="text/javascript">
 //<![CDATA[
-  var FO = { movie:"'.$url.'", width:"'.$width.'", height:"'.$height.'", majorversion:"6", build:"40",
+  var FO = { movie:"'.$jsurl.'", width:"'.$width.'", height:"'.$height.'", majorversion:"6", build:"40",
    allowscriptaccess:"never", quality: "high" };
  UFO.create(FO, "'.$id.'");
 //]]>
@@ -176,13 +233,15 @@ function mediaplugin_filter_flv_callback($link) {

    $width  = empty($link[3]) ? '480' : $link[3];
    $height = empty($link[4]) ? '360' : $link[4];
-    $url = addslashes_js($link[1]);
+    $url = $link[1];
+    $jsurl = addslashes_js($link[1]);
+    $printlink = '<a href="'.$url.'">'.get_string('flashvideo', 'mediaplugin').'</a>';

-    return $link[0].
+    return $printlink.
 '<span class="mediaplugin mediaplugin_flv" id="'.$id.'">('.get_string('flashvideo', 'mediaplugin').')</span>
 <script type="text/javascript">
 //<![CDATA[
-  var FO = { movie:"'.$CFG->wwwroot.'/filter/mediaplugin/flvplayer.swf?file='.$url.'",
+  var FO = { movie:"'.$CFG->wwwroot.'/filter/mediaplugin/flvplayer.swf?file='.$jsurl.'",
    width:"'.$width.'", height:"'.$height.'", majorversion:"6", build:"40",
    allowscriptaccess:"never", quality: "high", allowfullscreen: "true" };
  UFO.create(FO, "'.$id.'");
@@ -191,29 +250,31 @@ function mediaplugin_filter_flv_callback($link) {
 }

 function mediaplugin_filter_real_callback($link, $autostart=false) {
-    $url = addslashes_js($link[1]);
+    $url = $link[1];
+    $jsurl = addslashes_js($link[1]);
    $mimetype = mimeinfo('type', $url);
    $autostart = $autostart ? 'true' : 'false';
+    $printlink = '<a href="'.$url.'">'.get_string('realaudio', 'mediaplugin').'</a>';

 // embed kept for now see MDL-8674
-    return $link[0].
+    return $printlink.
 '<span class="mediaplugin mediaplugin_real">
 <script type="text/javascript">
 //<![CDATA[
 document.write(\'<object classid="clsid:CFCDAA03-8BE4-11cf-B84B-0020AFBBCCFA" width="240" height="180">\\
-  <param name="src" value="'.$url.'" />\\
+  <param name="src" value="'.$jsurl.'" />\\
  <param name="autostart" value="'.$autostart.'" />\\
  <param name="controls" value="imagewindow" />\\
  <param name="console" value="video" />\\
  <param name="loop" value="true" />\\
-  <embed src="'.$url.'" width="240" height="180" loop="true" type="'.$mimetype.'" controls="imagewindow" console="video" autostart="'.$autostart.'" />\\
+  <embed src="'.$jsurl.'" width="240" height="180" loop="true" type="'.$mimetype.'" controls="imagewindow" console="video" autostart="'.$autostart.'" />\\
  </object><br />\\
  <object classid="clsid:CFCDAA03-8BE4-11cf-B84B-0020AFBBCCFA" width="240" height="30">\\
-  <param name="src" value="'.$url.'" />\\
+  <param name="src" value="'.$jsurl.'" />\\
  <param name="autostart" value="'.$autostart.'" />\\
  <param name="controls" value="ControlPanel" />\\
  <param name="console" value="video" />\\
-  <embed src="'.$url.'" width="240" height="30" controls="ControlPanel" type="'.$mimetype.'" console="video" autostart="'.$autostart.'" />\\
+  <embed src="'.$jsurl.'" width="240" height="30" controls="ControlPanel" type="'.$mimetype.'" console="video" autostart="'.$autostart.'" />\\
  </object>\');
 //]]>
 </script></span>';
@@ -224,18 +285,20 @@ document.write(\'<object classid="clsid:CFCDAA03-8BE4-11cf-B84B-0020AFBBCCFA" wi
 */
 function mediaplugin_filter_youtube_callback($link, $autostart=false) {

-    $site = addslashes_js($link[1]);
-    $url = addslashes_js($link[2]);
-    $info = addslashes_js($link[3]);
+    $site = s($link[1]);
+    $url = $link[2];
+    $info = s($link[3]);

-    return '<object title="'.$info.'" 
-                    class="mediaplugin mediaplugin_youtube" type="application/x-shockwave-flash" 
+    return '<span class="mediaplugin mediaplugin_youtube">'.
+           '<object title="'.$info.'"
+                    class="mediaplugin mediaplugin_youtube" type="application/x-shockwave-flash"
                    data="'.$site.'youtube.com/v/'.$url.'&amp;fs=1&amp;rel=0" width="425" height="344">'.
           '<param name="movie" value="'.$site.'youtube.com/v/'.$url.'&amp;fs=1&amp;rel=0" />'.
           '<param name="FlashVars" value="playerMode=embedded" />'.
           '<param name="wmode" value="transparent" />'.
           '<param name="allowFullScreen" value="true" />'.
-           '</object>';
+           '</object>'.
+           '</span>';
 }

 /**
@@ -254,8 +317,9 @@ function mediaplugin_filter_wmp_callback($link, $autostart=false) {
    }
    $mimetype = mimeinfo('type', $url);
    $autostart = $autostart ? 'true' : 'false';
+    $printlink = '<a href="'.$url.'">'.get_string('wmpvideo', 'mediaplugin').'</a>';

-    return $link[0].
+    return $printlink.
 '<span class="mediaplugin mediaplugin_wmp">
 <object classid="CLSID:6BF52A52-394A-11d3-B153-00C04F79FAA6" '.$mpsize.'
  standby="Loading Microsoft(R) Windows(R) Media Player components..."
@@ -293,8 +357,9 @@ function mediaplugin_filter_qt_callback($link, $autostart=false) {
    }
    $mimetype = mimeinfo('type', $url);
    $autostart = $autostart ? 'true' : 'false';
+    $printlink = '<a href="'.$url.'">'.get_string('quicktime', 'mediaplugin').'</a>';

-    return $link[0].
+    return $printlink.
 '<span class="mediaplugin mediaplugin_qt">
 <object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"
  codebase="http://www.apple.com/qtactivex/qtplugin.cab" '.$size.'>
@@ -21,4 +21,8 @@ $settings->add(new admin_setting_configcheckbox('filter_mediaplugin_enable_rpm',
 $settings->add(new admin_setting_configcheckbox('filter_mediaplugin_enable_rm', get_string('mediapluginrm','admin'), '', 1));

 $settings->add(new admin_setting_configcheckbox('filter_mediaplugin_enable_youtube', get_string('mediapluginyoutube','admin'), '', 0));
+
+$settings->add(new admin_setting_configcheckbox('filter_mediaplugin_enable_ogg', get_string('mediapluginogg','admin'), '', 1));
+
+$settings->add(new admin_setting_configcheckbox('filter_mediaplugin_enable_ogv', get_string('mediapluginogv','admin'), '', 1));
 ?>
@@ -164,7 +164,7 @@ function tex_filter ($courseid, $text) {
            $texcache->timemodified = time();
            insert_record("cache_filters",$texcache, false);
        }
-        $filename = $md5 . ".gif";
+        $filename = $md5 . ".{$CFG->filter_tex_convertformat}";
        $text = str_replace( $matches[0][$i], string_file_picture_tex($filename, $texexp, '', '', $align, $alt), $text);
    }
    return $text;
@@ -37,6 +37,12 @@ $items[] = new admin_setting_configexecutable('filter_tex_pathlatex', get_string
 $items[] = new admin_setting_configexecutable('filter_tex_pathdvips', get_string('pathdvips', 'admin'), '', $default_filter_tex_pathdvips);
 $items[] = new admin_setting_configexecutable('filter_tex_pathconvert', get_string('pathconvert', 'admin'), '', $default_filter_tex_pathconvert);

+// Even if we offer GIF and PNG formats here, in the update callback we check whether
+// all the paths actually point to executables. If they don't, we force the setting 
+// to GIF, as that's the only format mimeTeX can produce.
+$formats = array('gif' => 'GIF', 'png' => 'PNG');
+$items[] = new admin_setting_configselect('filter_tex_convertformat', get_string('convertformat', 'admin'), get_string('configconvertformat', 'admin'), 'gif', $formats);
+
 foreach ($items as $item) {
    $item->set_updatedcallback('filter_tex_updatedcallback');
    $settings->add($item);
@@ -82,11 +82,11 @@
        }

        /**
-         * Render TeX string into gif
+         * Render TeX string into gif/png
         * @param string $formula TeX formula
         * @param string $filename base of filename for output (no extension)
         * @param int $fontsize font size
-         * @param int $density density value for .ps to .gif conversion
+         * @param int $density density value for .ps to .gif/.png conversion
         * @param string $background background color (e.g, #FFFFFF).
         * @param file $log valid open file handle for optional logging (debugging only)
         * @return bool true if successful
@@ -106,7 +106,7 @@
            $tex = "{$this->temp_dir}/$filename.tex";
            $dvi = "{$this->temp_dir}/$filename.dvi";
            $ps  = "{$this->temp_dir}/$filename.ps";
-            $gif = "{$this->temp_dir}/$filename.gif";
+            $img = "{$this->temp_dir}/$filename.{$CFG->filter_tex_convertformat}";

            // turn the latex doc into a .tex file in the temp area
            $fh = fopen( $tex, 'w' );
@@ -126,30 +126,32 @@
                return false;
            }

-            // run convert on document (.ps to .gif)
+            // run convert on document (.ps to .gif/.png)
            if ($background) {
                $bg_opt = "-transparent \"$background\""; // Makes transparent background
            } else {
                $bg_opt = "";
            }
-            $command = "{$CFG->filter_tex_pathconvert} -density $density -trim $bg_opt $ps $gif";
+            $command = "{$CFG->filter_tex_pathconvert} -density $density -trim $bg_opt $ps $img";
            if ($this->execute($command, $log )) {
                return false;
            }

-            return $gif;
+            return $img;
        }

        /**
         * Delete files created in temporary area
-         * Don't forget to copy the final gif before calling this
+         * Don't forget to copy the final gif/png before calling this
         * @param string $filename file base (no extension)
         */
        function clean_up( $filename ) {
+            global $CFG;
+
            unlink( "{$this->temp_dir}/$filename.tex" );
            unlink( "{$this->temp_dir}/$filename.dvi" );
            unlink( "{$this->temp_dir}/$filename.ps" );
-            unlink( "{$this->temp_dir}/$filename.gif" );
+            unlink( "{$this->temp_dir}/$filename.{$CFG->filter_tex_convertformat}" );
            unlink( "{$this->temp_dir}/$filename.aux" );
            unlink( "{$this->temp_dir}/$filename.log" );
            return;
@@ -84,6 +84,13 @@ function filter_tex_updatedcallback($name) {

    delete_records('cache_filters', 'filter', 'tex');
    delete_records('cache_filters', 'filter', 'algebra');
+
+    if (!(is_file($CFG->filter_tex_pathlatex) && is_executable($CFG->filter_tex_pathlatex) &&
+          is_file($CFG->filter_tex_pathdvips) && is_executable($CFG->filter_tex_pathdvips) &&
+          is_file($CFG->filter_tex_pathconvert) && is_executable($CFG->filter_tex_pathconvert))) {
+        // LaTeX, dvips or convert are not available, and mimetex can only produce GIFs so...
+        set_config('filter_tex_convertformat', 'gif');
+    }
 }

 ?>
@@ -26,8 +26,6 @@
    $cmd    = '';               // Initialise these variables
    $status = '';

-    error_reporting(E_ALL);
-
    $relativepath = get_file_argument('pix.php');

    $args = explode('/', trim($relativepath, '/'));
@@ -40,7 +38,7 @@
    }

    if (!file_exists($pathname)) {
-        $md5 = str_replace('.gif','',$image);
+        $md5 = str_replace(".{$CFG->filter_tex_convertformat}",'',$image);
        if ($texcache = get_record('cache_filters', 'filter', 'tex', 'md5key', $md5)) {
            if (!file_exists($CFG->dataroot.'/filter/tex')) {
                make_upload_directory('filter/tex');
@@ -25,7 +25,7 @@
    require_capability('moodle/site:config', get_context_instance(CONTEXT_SYSTEM), $USER->id); /// Required cap to run this. MDL-18552

    $query = urldecode($_SERVER['QUERY_STRING']);
-    error_reporting(E_ALL);
+    error_reporting(DEBUG_ALL);
    $output = '';

    // look up in cache if required
@@ -123,6 +123,7 @@
            return;
        }

+        $texexp = stripslashes($texexp);
        $image  = md5($texexp) . ".gif";
        $filetype = 'image/gif';
        if (!file_exists("$CFG->dataroot/filter/tex")) {
@@ -217,7 +218,7 @@
        $tex = "$latex->temp_dir/$md5.tex";
        $dvi = "$latex->temp_dir/$md5.dvi";
        $ps = "$latex->temp_dir/$md5.ps";
-        $gif = "$latex->temp_dir/$md5.gif";
+        $img = "$latex->temp_dir/$md5.{$CFG->filter_tex_convertformat}";

        // put the expression as a file into the temp area
        $expression = stripslashes($expression);
@@ -240,13 +241,13 @@
        $output .= execute($cmd);

        // step 3: convert command
-        $cmd = "$CFG->filter_tex_pathconvert -density 240 -trim $ps $gif ";
+        $cmd = "$CFG->filter_tex_pathconvert -density 240 -trim $ps $img ";
        $output .= execute($cmd);

        if (!$graphic) {
            echo($output);
        } else {
-            send_file($gif, "$md5.gif");
+            send_file($img, "$md5.{$CFG->filter_tex_convertformat}");
         }
    }

@@ -287,13 +288,13 @@
           target="inlineframe">
            <center>
             <input type="text" name="tex" size="50"
-                    value="f(x)=\Bigint_{-\infty}^x~e^{-t^2}dt" />
+                    value="f(x)=\int_{-\infty}^x~e^{-t^2}dt" />
            </center>
           <p>The following tests are available:</p>
           <ol>
           <li><input type="radio" name="action" value="ShowDB" id="ShowDB" />
               <label for="ShowDB">See the cache_filters database entry for this expression (if any).</label></li>
-           <li><input type="radio" name="DeleteDB" value="DeleteDB" id="DeleteDB" />
+           <li><input type="radio" name="action" value="DeleteDB" id="DeleteDB" />
               <label for="DeleteDB">Delete the cache_filters database entry for this expression (if any).</label></li>
           <li><input type="radio" name="action" value="ShowImageMimetex" id="ShowImageMimetex"  checked="checked" />
               <label for="ShowImageMimetex">Show a graphic image of the algebraic expression rendered with mimetex.</label></li>
@@ -320,7 +321,7 @@ searches the database cache_filters table to see if this TeX expression had been
 processed before. If not, it adds a DB entry for that expression.  It then
 replaces the TeX expression by an &lt;img src=&quot;.../filter/tex/pix.php...&quot;&gt;
 tag.  The filter/tex/pix.php script then searches the database to find an
-appropriate gif image file for that expression and to create one if it doesn't exist.
+appropriate gif/png image file for that expression and to create one if it doesn't exist.
 It will then use either the LaTex/Ghostscript renderer (using external executables
 on your system) or the bundled Mimetex executable. The full Latex/Ghostscript
 renderer produces better results and is tried first. 
@@ -331,7 +332,7 @@ you might try to fix them.</p>
 process this expression. Then the database entry for that expression contains
 a bad TeX expression in the rawtext field (usually blank). You can fix this
 by clicking on &quot;Delete DB Entry&quot;</li>
-<li>The TeX to gif image conversion process does not work. 
+<li>The TeX to gif/png image conversion process does not work. 
 If paths are specified in the filter configuation screen for the three
 executables these will be tried first. Note that they still must be correctly
 installed and have the correct permissions. In particular make sure that you 
@@ -16,6 +16,10 @@
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.


+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once $CFG->libdir.'/formslib.php';

 class edit_letter_form extends moodleform {
@@ -16,6 +16,10 @@
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.


+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once $CFG->libdir.'/formslib.php';

 class edit_outcome_form extends moodleform {
@@ -16,6 +16,10 @@
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.


+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once $CFG->libdir.'/formslib.php';

 class edit_scale_form extends moodleform {
@@ -79,7 +83,8 @@ class edit_scale_form extends moodleform {
            if (empty($courseid)) {
                $mform->hardFreeze('standard');

-            } else if (empty($scale->courseid) and !has_capability('moodle/course:managescales', get_context_instance(CONTEXT_SYSTEM))) {
+            } else if (!has_capability('moodle/course:managescales', get_context_instance(CONTEXT_SYSTEM))) {
+                //if they dont have managescales at system level the shouldnt be allowed to make scales standard (or not standard)
                $mform->hardFreeze('standard');

            } else if ($used and !empty($scale->courseid)) {
@@ -15,6 +15,10 @@
 // You should have received a copy of the GNU General Public License
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.

+if (!defined('MOODLE_INTERNAL')) {
+    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
+}
+
 require_once($CFG->libdir.'/formslib.php');

 /**
--- a/Show More
+++ b/Show More