Moodle release 2.2.8

weekly release 2.2.7+
Merge branch 'install_22_STABLE' of git://git.moodle.cz/moodle-install into MOODLE_22_STABLE
2013-03-08 19:59:24 +01:00 · 2013-03-07 16:21:08 +01:00 · 2013-03-07 16:16:13 +01:00 · 2013-03-07 16:33:45 +08:00 · 2013-03-07 16:33:32 +08:00 · 2013-03-07 14:39:37 +08:00
194 changed files with 4008 additions and 2964 deletions
@@ -28,7 +28,8 @@ require_once(dirname(dirname(__FILE__)) . '/config.php');
 require_once($CFG->libdir . '/adminlib.php');
 require_once($CFG->libdir . '/pluginlib.php');

-require_capability('moodle/site:config', get_context_instance(CONTEXT_SYSTEM));
 admin_externalpage_setup('pluginsoverview');
+require_capability('moodle/site:config', get_context_instance(CONTEXT_SYSTEM));
+
 $output = $PAGE->get_renderer('core', 'admin');
 echo $output->plugin_management_page(plugin_manager::instance());
@@ -41,6 +41,9 @@ $return = true;
 if (!empty($edit) || !empty($new)) {
    if (!empty($edit)) {
        $instance = repository::get_instance($edit);
+        if ($instance->instance->contextid != $context->id) {
+            throw new repository_exception('nopermissiontoaccess', 'repository');
+        }
        $instancetype = repository::get_type_by_id($instance->options['typeid']);
        $classname = 'repository_' . $instancetype->get_typename();
        $configs  = $instance->get_instance_option_names();
@@ -103,10 +106,12 @@ if (!empty($edit) || !empty($new)) {
    $return = true;
 } else if (!empty($delete)) {
    $instance = repository::get_instance($delete);
-    //if you try to delete an instance set as readonly, display an error message
    if ($instance->readonly) {
-            throw new repository_exception('readonlyinstance', 'repository');
-     }
+        // If you try to delete an instance set as readonly, display an error message.
+        throw new repository_exception('readonlyinstance', 'repository');
+    } else if ($instance->instance->contextid != $context->id) {
+        throw new repository_exception('nopermissiontoaccess', 'repository');
+    }
    if ($sure) {
        if (!confirm_sesskey()) {
            print_error('confirmsesskeybad', '', $baseurl);
@@ -285,7 +285,11 @@ if ($formdata = $mform2->is_cancelled()) {
            $userserrors++;
            continue;
        }
-
+        if ($user->username !== clean_param($user->username, PARAM_USERNAME)) {
+            $upt->track('status', get_string('invalidusername', 'error', 'username'), 'error');
+            $upt->track('username', $errorstr, 'error');
+            $userserrors++;
+        }
        if ($existinguser = $DB->get_record('user', array('username'=>$user->username, 'mnethostid'=>$CFG->mnet_localhost_id))) {
            $upt->track('id', $existinguser->id, 'normal', false);
        }
@@ -81,7 +81,7 @@ function user_download_ods($fields) {

    $worksheet = array();

-    $worksheet[0] =& $workbook->add_worksheet('');
+    $worksheet[0] = $workbook->add_worksheet('');
    $col = 0;
    foreach ($fields as $fieldname) {
        $worksheet[0]->write(0, $col, $fieldname);
@@ -119,7 +119,7 @@ function user_download_xls($fields) {

    $worksheet = array();

-    $worksheet[0] =& $workbook->add_worksheet('');
+    $worksheet[0] = $workbook->add_worksheet('');
    $col = 0;
    foreach ($fields as $fieldname) {
        $worksheet[0]->write(0, $col, $fieldname);
@@ -691,7 +691,7 @@ class auth_plugin_ldap extends auth_plugin_base {
 /// User removal
        // Find users in DB that aren't in ldap -- to be removed!
        // this is still not as scalable (but how often do we mass delete?)
-        if ($this->config->removeuser !== AUTH_REMOVEUSER_KEEP) {
+        if ($this->config->removeuser != AUTH_REMOVEUSER_KEEP) {
            $sql = 'SELECT u.*
                      FROM {user} u
                      LEFT JOIN {tmp_extuser} e ON (u.username = e.username AND u.mnethostid = e.mnethostid)
@@ -98,7 +98,7 @@ $PAGE->navbar->add($backup->get_stage_name());
 $renderer = $PAGE->get_renderer('core','backup');
 echo $OUTPUT->header();
 if ($backup->enforce_changed_dependencies()) {
-    echo $renderer->dependency_notification(get_string('dependenciesenforced','backup'));
+    debugging('Your settings have been altered due to unmet dependencies', DEBUG_DEVELOPER);
 }
 echo $renderer->progress_bar($backup->get_progress_bar());
 echo $backup->display();
@@ -33,7 +33,7 @@ $currentcontext = required_param('currentcontext', PARAM_INT);
 // file parameters
 $component  = optional_param('component', null, PARAM_COMPONENT);
 $filearea   = optional_param('filearea', null, PARAM_AREA);
-$returnurl  = optional_param('returnurl', null, PARAM_URL);
+$returnurl  = optional_param('returnurl', null, PARAM_LOCALURL);

 list($context, $course, $cm) = get_context_info_array($currentcontext);
 $filecontext = get_context_instance_by_id($contextid);
@@ -640,7 +640,10 @@ class moodle1_converter extends base_converter {
            return $files;
        }
        foreach ($matches[2] as $match) {
-            $files[] = str_replace(array('$@FILEPHP@$', '$@SLASH@$', '$@FORCEDOWNLOAD@$'), array('', '/', ''), $match);
+            $file = str_replace(array('$@FILEPHP@$', '$@SLASH@$', '$@FORCEDOWNLOAD@$'), array('', '/', ''), $match);
+            if ($file === clean_param($file, PARAM_PATH)) {
+                $files[] = rawurldecode($file);
+            }
        }

        return array_unique($files);
@@ -657,9 +660,16 @@ class moodle1_converter extends base_converter {
    public static function rewrite_filephp_usage($text, array $files) {

        foreach ($files as $file) {
+            // Expect URLs properly encoded by default.
+            $parts   = explode('/', $file);
+            $encoded = implode('/', array_map('rawurlencode', $parts));
+            $fileref = '$@FILEPHP@$'.str_replace('/', '$@SLASH@$', $encoded);
+            $text    = str_replace($fileref.'$@FORCEDOWNLOAD@$', '@@PLUGINFILE@@'.$encoded.'?forcedownload=1', $text);
+            $text    = str_replace($fileref, '@@PLUGINFILE@@'.$encoded, $text);
+            // Add support for URLs without any encoding.
            $fileref = '$@FILEPHP@$'.str_replace('/', '$@SLASH@$', $file);
-            $text    = str_replace($fileref.'$@FORCEDOWNLOAD@$', '@@PLUGINFILE@@'.$file.'?forcedownload=1', $text);
-            $text    = str_replace($fileref, '@@PLUGINFILE@@'.$file, $text);
+            $text    = str_replace($fileref.'$@FORCEDOWNLOAD@$', '@@PLUGINFILE@@'.$encoded.'?forcedownload=1', $text);
+            $text    = str_replace($fileref, '@@PLUGINFILE@@'.$encoded, $text);
        }

        return $text;
@@ -1205,6 +1215,10 @@ class moodle1_file_manager implements loggable {

        $sourcefullpath = $this->basepath.'/'.$sourcepath;

+        if ($sourcefullpath !== clean_param($sourcefullpath, PARAM_PATH)) {
+            throw new moodle1_convert_exception('file_invalid_path', $sourcefullpath);
+        }
+
        if (!is_readable($sourcefullpath)) {
            throw new moodle1_convert_exception('file_not_readable', $sourcefullpath);
        }
@@ -1264,6 +1278,11 @@ class moodle1_file_manager implements loggable {
     */
    public function migrate_directory($rootpath, $relpath='/') {

+        // Check the trailing slash in the $rootpath
+        if (substr($rootpath, -1) === '/') {
+            $rootpath = substr($rootpath, 0, strlen($rootpath) - 1);
+        }
+
        if (!file_exists($this->basepath.'/'.$rootpath.$relpath)) {
            return array();
        }
@@ -253,13 +253,15 @@ class moodle1_converter_test extends UnitTestCase {
        $fileids = $fileman->get_fileids();
        $this->assertIsA($fileids, 'array');
        $this->assertEqual(0, count($fileids));
-        // try to migrate a non-existing directory
-        $returned = $fileman->migrate_directory('not/existing/directory');
-        $this->assertIsA($returned, 'array');
-        $this->assertEqual(0, count($returned));
-        $fileids = $fileman->get_fileids();
-        $this->assertIsA($fileids, 'array');
-        $this->assertEqual(0, count($fileids));
+        // try to migrate an invalid file
+        $fileman->itemid = 1;
+        $thrown = false;
+        try {
+            $fileman->migrate_file('/../../../../../../../../../../../../../../etc/passwd');
+        } catch (moodle1_convert_exception $e) {
+            $thrown = true;
+        }
+        $this->assertTrue($thrown);
        // migrate a single file
        $fileman->itemid = 4;
        $fileman->migrate_file('moddata/unittest/4/icon.gif');
@@ -291,6 +293,63 @@ class moodle1_converter_test extends UnitTestCase {
        $converter->drop_stash_storage();
    }

+    public function test_migrate_directory() {
+        // Set-up the file manager.
+        $converter = convert_factory::get_converter('moodle1', $this->tempdir);
+        $converter->create_stash_storage();
+        $contextid = $converter->get_contextid(CONTEXT_MODULE, 32);
+        $fileman   = $converter->get_file_manager($contextid, 'mod_unittest', 'testarea');
+        // This fileman has not converted anything yet.
+        $fileids = $fileman->get_fileids();
+        $this->assertIsA($fileids, 'array');
+        $this->assertEqual(0, count($fileids));
+        // Try to migrate a non-existing directory.
+        $returned = $fileman->migrate_directory('not/existing/directory');
+        $this->assertIsA($returned, 'array');
+        $this->assertEqual(0, count($returned));
+        $fileids = $fileman->get_fileids();
+        $this->assertIsA($fileids, 'array');
+        $this->assertEqual(0, count($fileids));
+        // Try to migrate whole course_files.
+        $returned = $fileman->migrate_directory('course_files');
+        $this->assertIsA($returned, 'array');
+        $this->assertEqual(4, count($returned)); // Two files, two directories.
+        $fileids = $fileman->get_fileids();
+        $this->assertIsA($fileids, 'array');
+        $this->assertEqual(4, count($fileids));
+        $this->assertTrue(is_file($converter->get_workdir_path().'/files/4e/4ea114b0558f53e3af8dd9afc0e0810a95c2a724'));
+        // Check the file records.
+        $files = array();
+        $filerecordids = $converter->get_stash_itemids('files');
+        foreach ($filerecordids as $filerecordid) {
+            $filerecord = $converter->get_stash('files', $filerecordid);
+            $files[$filerecord['filepath'].$filerecord['filename']] = $filerecord;
+        }
+        $this->assertIsA($files['/.'], 'array');
+        $this->assertIsA($files['/file1.gif'], 'array');
+        $this->assertIsA($files['/sub1/.'], 'array');
+        $this->assertIsA($files['/sub1/file2.gif'], 'array');
+        $this->assertEqual(sha1(''), $files['/.']['contenthash']);
+        $this->assertEqual(sha1(''), $files['/sub1/.']['contenthash']);
+        $this->assertEqual('4ea114b0558f53e3af8dd9afc0e0810a95c2a724', $files['/file1.gif']['contenthash']);
+        $this->assertEqual('4ea114b0558f53e3af8dd9afc0e0810a95c2a724', $files['/sub1/file2.gif']['contenthash']);
+        $converter->drop_stash_storage();
+    }
+
+    public function test_migrate_directory_with_trailing_slash() {
+        // Set-up the file manager.
+        $converter = convert_factory::get_converter('moodle1', $this->tempdir);
+        $converter->create_stash_storage();
+        $contextid = $converter->get_contextid(CONTEXT_MODULE, 32);
+        $fileman   = $converter->get_file_manager($contextid, 'mod_unittest', 'testarea');
+        // Try to migrate a subdirectory passed with the trailing slash.
+        // This may display a debugging message which is expected.
+        $returned = $fileman->migrate_directory('course_files/sub1/');
+        $this->assertIsA($returned, 'array');
+        $this->assertEqual(2, count($returned)); // One file, one directory.
+        $converter->drop_stash_storage();
+    }
+
    public function test_convert_path() {
        $path = new convert_path('foo_bar', '/ROOT/THINGS/FOO/BAR');
        $this->assertEqual('foo_bar', $path->get_name());
@@ -421,6 +480,8 @@ class moodle1_converter_test extends UnitTestCase {

        $text = 'This is a text containing links to file.php
 as it is parsed from the backup file. <br /><br /><img border="0" width="110" vspace="0" hspace="0" height="92" title="News" alt="News" src="$@FILEPHP@$$@SLASH@$pics$@SLASH@$news.gif" /><a href="$@FILEPHP@$$@SLASH@$pics$@SLASH@$news.gif$@FORCEDOWNLOAD@$">download image</a><br />
+    <div><a href=\'$@FILEPHP@$/../../../../../../../../../../../../../../../etc/passwd\'>download passwords</a></div>
+    <div><a href=\'$@FILEPHP@$$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$etc$@SLASH@$shadow\'>download shadows</a></div>
    <br /><a href=\'$@FILEPHP@$$@SLASH@$MANUAL.DOC$@FORCEDOWNLOAD@$\'>download manual</a><br />';

        $files = moodle1_converter::find_referenced_files($text);
@@ -429,12 +490,41 @@ as it is parsed from the backup file. <br /><br /><img border="0" width="110" vs
        $this->assertTrue(in_array('/pics/news.gif', $files));
        $this->assertTrue(in_array('/MANUAL.DOC', $files));

-        $text = moodle1_converter::rewrite_filephp_usage($text, array('/pics/news.gif', '/another/file/notused.txt'), $files);
+        $text = moodle1_converter::rewrite_filephp_usage($text, array('/pics/news.gif', '/another/file/notused.txt'));
        $this->assertEqual($text, 'This is a text containing links to file.php
 as it is parsed from the backup file. <br /><br /><img border="0" width="110" vspace="0" hspace="0" height="92" title="News" alt="News" src="@@PLUGINFILE@@/pics/news.gif" /><a href="@@PLUGINFILE@@/pics/news.gif?forcedownload=1">download image</a><br />
+    <div><a href=\'$@FILEPHP@$/../../../../../../../../../../../../../../../etc/passwd\'>download passwords</a></div>
+    <div><a href=\'$@FILEPHP@$$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$..$@SLASH@$etc$@SLASH@$shadow\'>download shadows</a></div>
    <br /><a href=\'$@FILEPHP@$$@SLASH@$MANUAL.DOC$@FORCEDOWNLOAD@$\'>download manual</a><br />');
    }

+    public function test_referenced_files_urlencoded() {
+
+        $text = 'This is a text containing links to file.php
+as it is parsed from the backup file. <br /><br /><img border="0" width="110" vspace="0" hspace="0" height="92" title="News" alt="News" src="$@FILEPHP@$$@SLASH@$pics$@SLASH@$news.gif" /><a href="$@FILEPHP@$$@SLASH@$pics$@SLASH@$news.gif$@FORCEDOWNLOAD@$">no space</a><br />
+    <br /><a href=\'$@FILEPHP@$$@SLASH@$pics$@SLASH@$news%20with%20spaces.gif$@FORCEDOWNLOAD@$\'>with urlencoded spaces</a><br />
+<a href="$@FILEPHP@$$@SLASH@$illegal%20pics%2Bmovies$@SLASH@$romeo%2Bjuliet.avi">Download the full AVI for free! (space and plus encoded)</a>
+<a href="$@FILEPHP@$$@SLASH@$illegal pics+movies$@SLASH@$romeo+juliet.avi">Download the full AVI for free! (none encoded)</a>
+<a href="$@FILEPHP@$$@SLASH@$illegal%20pics+movies$@SLASH@$romeo+juliet.avi">Download the full AVI for free! (only space encoded)</a>
+<a href="$@FILEPHP@$$@SLASH@$illegal pics%2Bmovies$@SLASH@$romeo%2Bjuliet.avi">Download the full AVI for free! (only plus)</a>';
+
+        $files = moodle1_converter::find_referenced_files($text);
+        $this->assertIsA($files, 'array');
+        $this->assertEqual(3, count($files));
+        $this->assertTrue(in_array('/pics/news.gif', $files));
+        $this->assertTrue(in_array('/pics/news with spaces.gif', $files));
+        $this->assertTrue(in_array('/illegal pics+movies/romeo+juliet.avi', $files));
+
+        $text = moodle1_converter::rewrite_filephp_usage($text, $files);
+        $this->assertEqual('This is a text containing links to file.php
+as it is parsed from the backup file. <br /><br /><img border="0" width="110" vspace="0" hspace="0" height="92" title="News" alt="News" src="@@PLUGINFILE@@/pics/news.gif" /><a href="@@PLUGINFILE@@/pics/news.gif?forcedownload=1">no space</a><br />
+    <br /><a href=\'@@PLUGINFILE@@/pics/news%20with%20spaces.gif?forcedownload=1\'>with urlencoded spaces</a><br />
+<a href="@@PLUGINFILE@@/illegal%20pics%2Bmovies/romeo%2Bjuliet.avi">Download the full AVI for free! (space and plus encoded)</a>
+<a href="@@PLUGINFILE@@/illegal%20pics%2Bmovies/romeo%2Bjuliet.avi">Download the full AVI for free! (none encoded)</a>
+<a href="$@FILEPHP@$$@SLASH@$illegal%20pics+movies$@SLASH@$romeo+juliet.avi">Download the full AVI for free! (only space encoded)</a>
+<a href="$@FILEPHP@$$@SLASH@$illegal pics%2Bmovies$@SLASH@$romeo%2Bjuliet.avi">Download the full AVI for free! (only plus)</a>', $text);
+    }
+
    public function test_question_bank_conversion() {
        global $CFG;

@@ -154,7 +154,7 @@ $PAGE->navbar->add($backup->get_stage_name());
 // Display the current stage
 echo $OUTPUT->header();
 if ($backup->enforce_changed_dependencies()) {
-    echo $renderer->dependency_notification(get_string('dependenciesenforced','backup'));
+    debugging('Your settings have been altered due to unmet dependencies', DEBUG_DEVELOPER);
 }
 echo $renderer->progress_bar($backup->get_progress_bar());
 echo $backup->display();
@@ -857,7 +857,7 @@ class backup_gradebook_structure_step extends backup_structure_step {
        $grade_category   = new backup_nested_element('grade_category', array('id'), array(
                //'courseid',
                'parent', 'depth', 'path', 'fullname', 'aggregation', 'keephigh',
-                'dropload', 'aggregateonlygraded', 'aggregateoutcomes', 'aggregatesubcats',
+                'droplow', 'aggregateonlygraded', 'aggregateoutcomes', 'aggregatesubcats',
                'timecreated', 'timemodified', 'hidden'));

        $letters = new backup_nested_element('grade_letters');
@@ -189,6 +189,15 @@ class restore_gradebook_structure_step extends restore_structure_step {
                $data->id = $newitemid = $existinggradeitem->id;
                $DB->update_record('grade_items', $data);
            }
+        } else if ($data->itemtype == 'manual') {
+            // Manual items aren't assigned to a cm, so don't go duplicating them in the target if one exists.
+            $gi = array(
+                'itemtype' => $data->itemtype,
+                'courseid' => $data->courseid,
+                'itemname' => $data->itemname,
+                'categoryid' => $data->categoryid,
+            );
+            $newitemid = $DB->get_field('grade_items', 'id', $gi);
        }

        if (empty($newitemid)) {
@@ -287,8 +296,13 @@ class restore_gradebook_structure_step extends restore_structure_step {

        $data->courseid = $this->get_courseid();

-        $newitemid = $DB->insert_record('grade_settings', $data);
-        //$this->set_mapping('grade_setting', $oldid, $newitemid);
+        if (!$DB->record_exists('grade_settings', array('courseid' => $data->courseid, 'name' => $data->name))) {
+            $newitemid = $DB->insert_record('grade_settings', $data);
+        } else {
+            $newitemid = $data->id;
+        }
+
+        $this->set_mapping('grade_setting', $oldid, $newitemid);
    }

    /**
@@ -2765,9 +2779,6 @@ class restore_create_categories_and_questions extends restore_structure_step {
            $data->penalty = 1;
        }

-        $data->timecreated  = $this->apply_date_offset($data->timecreated);
-        $data->timemodified = $this->apply_date_offset($data->timemodified);
-
        $userid = $this->get_mappingid('user', $data->createdby);
        $data->createdby = $userid ? $userid : $this->task->get_userid();

@@ -2821,6 +2832,22 @@ class restore_create_categories_and_questions extends restore_structure_step {
                       AND ' . $DB->sql_compare_text('hint', 255) . ' = ' . $DB->sql_compare_text('?', 255);
            $params = array($newquestionid, $data->hint);
            $newitemid = $DB->get_field_sql($sql, $params);
+
+            // Not able to find the hint, let's try cleaning the hint text
+            // of all the question's hints in DB as slower fallback. MDL-33863.
+            if (!$newitemid) {
+                $potentialhints = $DB->get_records('question_hints',
+                        array('questionid' => $newquestionid), '', 'id, hint');
+                foreach ($potentialhints as $potentialhint) {
+                    // Clean in the same way than {@link xml_writer::xml_safe_utf8()}.
+                    $cleanhint = preg_replace('/[\x-\x8\xb-\xc\xe-\x1f\x7f]/is','', $potentialhint->hint); // Clean CTRL chars.
+                    $cleanhint = preg_replace("/\r\n|\r/", "\n", $cleanhint); // Normalize line ending.
+                    if ($cleanhint === $data->hint) {
+                        $newitemid = $data->id;
+                    }
+                }
+            }
+
            // If we haven't found the newitemid, something has gone really wrong, question in DB
            // is missing hints, exception
            if (!$newitemid) {
@@ -61,7 +61,7 @@ $PAGE->navbar->add($restore->get_stage_name());
 $renderer = $PAGE->get_renderer('core','backup');
 echo $OUTPUT->header();
 if (!$restore->is_independent() && $restore->enforce_changed_dependencies()) {
-    echo $renderer->dependency_notification(get_string('dependenciesenforced','backup'));
+    debugging('Your settings have been altered due to unmet dependencies', DEBUG_DEVELOPER);
 }
 echo $renderer->progress_bar($restore->get_progress_bar());
 echo $restore->display($renderer);
@@ -75,7 +75,7 @@ class file_logger extends base_logger {
        if (substr($this->fullpath, -5) !== '.html') {
            $content = $prefix . str_repeat('  ', $depth) . $message . PHP_EOL;
        } else {
-            $content = $prefix . str_repeat('&nbsp;&nbsp;', $depth) . htmlentities($message, ENT_QUOTES) . '<br/>' . PHP_EOL;
+            $content = $prefix . str_repeat('&nbsp;&nbsp;', $depth) . htmlentities($message, ENT_QUOTES, 'UTF-8') . '<br/>' . PHP_EOL;
        }
        if (false === fwrite($this->fhandle, $content)) {
            throw new base_logger_exception('error_writing_file', $this->fullpath);
@@ -38,7 +38,7 @@ class output_indented_logger extends base_logger {
        if (defined('STDOUT')) {
            echo $prefix . str_repeat('  ', $depth) . $message . PHP_EOL;
        } else {
-            echo $prefix . str_repeat('&nbsp;&nbsp;', $depth) . htmlentities($message, ENT_QUOTES) . '<br/>' . PHP_EOL;
+            echo $prefix . str_repeat('&nbsp;&nbsp;', $depth) . htmlentities($message, ENT_QUOTES, 'UTF-8') . '<br/>' . PHP_EOL;
        }
        flush();
        return true;
@@ -37,7 +37,7 @@ class output_text_logger extends base_logger {
        if (defined('STDOUT')) {
            echo $prefix . $message . PHP_EOL;
        } else {
-            echo $prefix . htmlentities($message, ENT_QUOTES) . '<br/>' . PHP_EOL;
+            echo $prefix . htmlentities($message, ENT_QUOTES, 'UTF-8') . '<br/>' . PHP_EOL;
        }
        flush();
        return true;
@@ -69,7 +69,7 @@ class block_community extends block_list {
        }

        $icon = html_writer::empty_tag('img', array('src' => $OUTPUT->pix_url('i/group'),
-                    'class' => 'icon', 'alt' => get_string('addcourse', 'block_community')));
+                    'class' => 'icon', 'alt' => ""));
        $addcourseurl = new moodle_url('/blocks/community/communitycourse.php',
                        array('add' => true, 'courseid' => $this->page->course->id));
        $searchlink = html_writer::tag('a', $icon . '&nbsp;' . get_string('addcourse', 'block_community'),
@@ -213,6 +213,7 @@
    background-color:#F6F6F6;
    border:1px solid #CCCCCC;
    overflow: auto;
+    padding: 7px 6px;
 }

 #page-blocks-community-communitycourse .moodle-dialogue-base .moodle-dialogue-bd {
@@ -222,5 +223,5 @@

 #page-blocks-community-communitycourse .moodle-dialogue-base .closebutton {
    margin-top:4px;
-    width:30px;
+    margin-right:4px;
 }
@@ -9,8 +9,8 @@ YUI.add('moodle-block_community-comments', function(Y) {
    Y.extend(COMMENTS, Y.Base, {

        event:null,
-        overlayevent:null,
-        overlays: [], //all the comment boxes
+        panelevent:null,
+        panels: [], //all the comment boxes

        initializer : function(params) {

@@ -18,17 +18,18 @@ YUI.add('moodle-block_community-comments', function(Y) {
            for (var i=0;i<this.get('commentids').length;i++)
            {
                var commentid = this.get('commentids')[i];
-                this.overlays[commentid] = new M.core.dialogue({
-                    headerContent:Y.one('#commentoverlay-'+commentid+' .commenttitle').get('innerHTML'),
+                this.panels[commentid] = new M.core.dialogue({
+                    headerContent:Y.Node.create('<h1>')
+                        .append(Y.one('#commentoverlay-'+commentid+' .commenttitle').get('innerHTML')),
                    bodyContent:Y.one('#commentoverlay-'+commentid).get('innerHTML'),
                    visible: false, //by default it is not displayed
                    lightbox : false,
                    zIndex:100
                });

-                this.overlays[commentid].get('contentBox').one('.commenttitle').remove();
-                this.overlays[commentid].render();
-                this.overlays[commentid].hide();
+                this.panels[commentid].get('contentBox').one('.commenttitle').remove();
+                this.panels[commentid].render();
+                this.panels[commentid].hide();

                Y.one('#comments-'+commentid).on('click', this.show, this, commentid);
            }
@@ -37,34 +38,34 @@ YUI.add('moodle-block_community-comments', function(Y) {

        show : function (e, commentid) {

-            //hide all overlays
+            //hide all panels
            for (var i=0;i<this.get('commentids').length;i++)
            {
                this.hide(e, this.get('commentids')[i]);
            }

-            this.overlays[commentid].show(); //show the overlay
+            this.panels[commentid].show(); //show the panel

-            e.halt(); // we are going to attach a new 'hide overlay' event to the body,
+            e.halt(); // we are going to attach a new 'hide panel' event to the body,
            // because javascript always propagate event to parent tag,
            // we need to tell Yahoo to stop to call the event on parent tag
            // otherwise the hide event will be call right away.

-            //we add a new event on the body in order to hide the overlay for the next click
+            //we add a new event on the body in order to hide the panel for the next click
            this.event = Y.one(document.body).on('click', this.hide, this, commentid);
-            //we add a new event on the overlay in order to hide the overlay for the next click (touch device)
-            this.overlayevent = Y.one("#commentoverlay-"+commentid).on('click', this.hide, this, commentid);
+            //we add a new event on the panel in order to hide the panel for the next click (touch device)
+            this.panelevent = Y.one("#commentoverlay-"+commentid).on('click', this.hide, this, commentid);
        },

        hide : function (e, commentid) {
-            this.overlays[commentid].hide(); //hide the overlay
+            this.panels[commentid].hide(); //hide the panel
            if (this.event != null) {
                this.event.detach(); //we need to detach the body hide event
            //Note: it would work without but create js warning everytime
            //we click on the body
            }
-            if (this.overlayevent != null) {
-                this.overlayevent.detach(); //we need to detach the overlay hide event
+            if (this.panelevent != null) {
+                this.panelevent.detach(); //we need to detach the panel hide event
            //Note: it would work without but create js warning everytime
            //we click on the body
            }
@@ -84,5 +85,5 @@ YUI.add('moodle-block_community-comments', function(Y) {
    }

 }, '@VERSION@', {
-    requires:['base','overlay', 'moodle-enrol-notification']
+    requires:['base', 'moodle-enrol-notification']
 });
@@ -11,8 +11,8 @@ YUI.add('moodle-block_community-imagegallery', function(Y) {
        event:null,
        previousevent:null,
        nextevent:null,
-        overlayevent:null,
-        overlay:null, //all the comment boxes
+        panelevent:null,
+        panel:null, //all the images boxes
        imageidnumbers: [],
        imageloadingevent: null,
        loadingimage: null,
@@ -26,15 +26,15 @@ YUI.add('moodle-block_community-imagegallery', function(Y) {
                +'</div>');
            objBody.append(this.loadingimage);

-            /// create the div for overlay
+            /// create the div for panel
            var objBody = Y.one(document.body);
-            var overlaytitle = Y.Node.create('<div id="imagetitleoverlay" class="hiddenoverlay"></div>');
-            objBody.append(overlaytitle);
-            var overlay = Y.Node.create('<div id="imageoverlay" class="hiddenoverlay"></div>');
-            objBody.append(overlay);
+            var paneltitle = Y.Node.create('<div id="imagetitleoverlay" class="hiddenoverlay"></div>');
+            objBody.append(paneltitle);
+            var panel = Y.Node.create('<div id="imageoverlay" class="hiddenoverlay"></div>');
+            objBody.append(panel);

-            /// create the overlay
-            this.overlay = new M.core.dialogue({
+            /// create the panel
+            this.panel = new M.core.dialogue({
                headerContent:Y.one('#imagetitleoverlay').get('innerHTML'),
                bodyContent:Y.one('#imageoverlay').get('innerHTML'),
                visible: false, //by default it is not displayed
@@ -42,8 +42,8 @@ YUI.add('moodle-block_community-imagegallery', function(Y) {
                zIndex:100
            });

-            this.overlay.render();
-            this.overlay.hide();
+            this.panel.render();
+            this.panel.hide();

            //attach a show event on the image divs (<tag id='image-X'>)
            for (var i=0;i<this.get('imageids').length;i++)
@@ -85,31 +85,31 @@ YUI.add('moodle-block_community-imagegallery', function(Y) {
            var maxheight = windowheight - 150;

            //load the title + link to next image
-            var overlaytitle = Y.one('#imagetitleoverlay');
+            var paneltitle = Y.one('#imagetitleoverlay');
            var previousimagelink = "<div id=\"previousarrow\" class=\"imagearrow\">←</div>";
            var nextimagelink = "<div id=\"nextarrow\" class=\"imagearrow\">→</div>";

-            /// need to load the images in the overlay
-            var overlay = Y.one('#imageoverlay');
-            overlay.setContent('');
+            /// need to load the images in the panel
+            var panel = Y.one('#imageoverlay');
+            panel.setContent('');


-            overlay.append(Y.Node.create('<div style="text-align:center"><img id=\"imagetodisplay\" src="' + url
+            panel.append(Y.Node.create('<div style="text-align:center"><img id=\"imagetodisplay\" src="' + url
                + '" style="max-height:' + maxheight + 'px;"></div>'));
-            this.overlay.destroy();
-            this.overlay = new M.core.dialogue({
-                headerContent:previousimagelink + '<div id=\"imagenumber\" class=\"imagetitle\"> Image '
-                + screennumber + ' / ' + this.imageidnumbers[imageid] + ' </div>' + nextimagelink,
+            this.panel.destroy();
+            this.panel = new M.core.dialogue({
+                headerContent:previousimagelink + '<div id=\"imagenumber\" class=\"imagetitle\"><h1> Image '
+                + screennumber + ' / ' + this.imageidnumbers[imageid] + ' </h1></div>' + nextimagelink,
                bodyContent:Y.one('#imageoverlay').get('innerHTML'),
                visible: false, //by default it is not displayed
                lightbox : false,
                zIndex:100
            });
-            this.overlay.render();
-            this.overlay.hide(); //show the overlay
-            this.overlay.set("centered", true);
+            this.panel.render();
+            this.panel.hide(); //show the panel
+            this.panel.set("centered", true);

-            e.halt(); // we are going to attach a new 'hide overlay' event to the body,
+            e.halt(); // we are going to attach a new 'hide panel' event to the body,
            // because javascript always propagate event to parent tag,
            // we need to tell Yahoo to stop to call the event on parent tag
            // otherwise the hide event will be call right away.
@@ -123,14 +123,14 @@ YUI.add('moodle-block_community-imagegallery', function(Y) {
                var screenshot = new Image();
                screenshot.src = url;

-                var overlaywidth = windowwidth - 100;
-                if(overlaywidth > screenshot.width) {
-                    overlaywidth = screenshot.width;
+                var panelwidth = windowwidth - 100;
+                if(panelwidth > screenshot.width) {
+                    panelwidth = screenshot.width;
                }

-                this.overlay.set('width', overlaywidth);
-                this.overlay.set("centered", true);
-                this.overlay.show();
+                this.panel.set('width', panelwidth);
+                this.panel.set("centered", true);
+                this.panel.show();

            }, this, url);

@@ -147,12 +147,12 @@ YUI.add('moodle-block_community-imagegallery', function(Y) {
            Y.one('#nextarrow').on('click', this.show, this, imageid, nextnumber);
            Y.one('#imagenumber').on('click', this.show, this, imageid, nextnumber);

-            //we add a new event on the body in order to hide the overlay for the next click
+            //we add a new event on the body in order to hide the panel for the next click
            this.event = Y.one(document.body).on('click', this.hide, this);
-            //we add a new event on the overlay in order to hide the overlay for the next click (touch device)
-            this.overlayevent = Y.one("#imageoverlay").on('click', this.hide, this);
+            //we add a new event on the panel in order to hide the panel for the next click (touch device)
+            this.panelevent = Y.one("#imageoverlay").on('click', this.hide, this);

-            this.overlay.on('visibleChange',function(e){
+            this.panel.on('visibleChange',function(e){
                if(e.newVal == 0){
                    this.get('maskNode').remove()
                }
@@ -167,14 +167,14 @@ YUI.add('moodle-block_community-imagegallery', function(Y) {
            //hide the loading image
            Y.one('#hubloadingimage').setStyle('display', 'none');

-            this.overlay.hide(); //hide the overlay
+            this.panel.hide(); //hide the panel
            if (this.event != null) {
                this.event.detach(); //we need to detach the body hide event
            //Note: it would work without but create js warning everytime
            //we click on the body
            }
-            if (this.overlayevent != null) {
-                this.overlayevent.detach(); //we need to detach the overlay hide event
+            if (this.panelevent != null) {
+                this.panelevent.detach(); //we need to detach the panel hide event
            //Note: it would work without but create js warning everytime
            //we click on the body
            }
@@ -195,5 +195,5 @@ YUI.add('moodle-block_community-imagegallery', function(Y) {
    }

 }, '@VERSION@', {
-    requires:['base','node','overlay', 'moodle-enrol-notification']
+    requires:['base','node', 'moodle-enrol-notification']
 });
@@ -916,7 +916,7 @@ M.core_dock.genericblock.prototype = {
            }, this);
            // Add a close icon
            // Must set the image src seperatly of we get an error with XML strict headers
-            var closeicon = Y.Node.create('<span class="hidepanelicon" tabindex="0"><img alt="" style="width:11px;height:11px;cursor:pointer;" /></span>');
+            var closeicon = Y.Node.create('<span class="hidepanelicon" tabindex="0"><img alt="'+M.str.block.hidepanel+'" title="'+M.str.block.hidedockpanel+'" style="width:11px;height:11px;cursor:pointer;"/></span>');
            closeicon.one('img').setAttribute('src', M.util.image_url('t/dockclose', 'moodle'));
            closeicon.on('forceclose|click', this.hide, this);
            closeicon.on('dock:actionkey',this.hide, this, {actions:{enter:true,toggle:true}});
@@ -151,12 +151,13 @@ class block_online_users extends block_base {
                $timeago = format_time($now - $user->lastaccess); //bruno to calculate correctly on frontpage

                if (isguestuser($user)) {
-                    $this->content->text .= '<div class="user">'.$OUTPUT->user_picture($user, array('size'=>16));
+                    $this->content->text .= '<div class="user">'.$OUTPUT->user_picture($user, array('size'=>16, 'alttext'=>false));
                    $this->content->text .= get_string('guestuser').'</div>';

                } else {
-                    $this->content->text .= '<div class="user">'.$OUTPUT->user_picture($user, array('size'=>16));
-                    $this->content->text .= '<a href="'.$CFG->wwwroot.'/user/view.php?id='.$user->id.'&amp;course='.$this->page->course->id.'" title="'.$timeago.'">'.$user->fullname.'</a></div>';
+                    $this->content->text .= '<div class="user">';
+                    $this->content->text .= '<a href="'.$CFG->wwwroot.'/user/view.php?id='.$user->id.'&amp;course='.$this->page->course->id.'" title="'.$timeago.'">';
+                    $this->content->text .= $OUTPUT->user_picture($user, array('size'=>16, 'alttext'=>false, 'link'=>false)) .$user->fullname.'</a></div>';
                }
                if ($canshowicon and ($USER->id != $user->id) and !isguestuser($user)) {  // Only when logged in and messaging active etc
                    $anchortagcontents = '<img class="iconsmall" src="'.$OUTPUT->pix_url('t/message') . '" alt="'. get_string('messageselectadd') .'" />';
@@ -104,11 +104,23 @@ function blog_rss_get_params($filters) {
 function blog_rss_get_feed($context, $args) {
    global $CFG, $SITE, $DB;

+    if (empty($CFG->bloglevel)) {
+        debugging('Blogging disabled on this site, RSS feeds are not available');
+        return null;
+    }
+
    if (empty($CFG->enablerssfeeds)) {
        debugging('Sorry, RSS feeds are disabled on this site');
        return '';
    }

+    if ($CFG->bloglevel == BLOG_SITE_LEVEL) {
+        if (isguestuser()) {
+            debugging(get_string('nopermissiontoshow','error'));
+            return '';
+        }
+    }
+
    $sitecontext = get_context_instance(CONTEXT_SYSTEM);
    if (!has_capability('moodle/blog:view', $sitecontext)) {
        return null;
@@ -1931,24 +1931,22 @@ class calendar_event {
            if ($usingeditor) {
                switch ($this->properties->eventtype) {
                    case 'user':
-                        $this->editorcontext = $this->properties->context;
                        $this->properties->courseid = 0;
+                        $this->properties->course = 0;
                        $this->properties->groupid = 0;
                        $this->properties->userid = $USER->id;
                        break;
                    case 'site':
-                        $this->editorcontext = $this->properties->context;
                        $this->properties->courseid = SITEID;
+                        $this->properties->course = SITEID;
                        $this->properties->groupid = 0;
                        $this->properties->userid = $USER->id;
                        break;
                    case 'course':
-                        $this->editorcontext = $this->properties->context;
                        $this->properties->groupid = 0;
                        $this->properties->userid = $USER->id;
                        break;
                    case 'group':
-                        $this->editorcontext = $this->properties->context;
                        $this->properties->userid = $USER->id;
                        break;
                    default:
@@ -1958,6 +1956,13 @@ class calendar_event {
                        break;
                }

+                // If we are actually using the editor, we recalculate the context because some default values
+                // were set when calculate_context() was called from the constructor.
+                if ($usingeditor) {
+                    $this->properties->context = $this->calculate_context($this->properties);
+                    $this->editorcontext = $this->properties->context;
+                }
+
                $editor = $this->properties->description;
                $this->properties->format = $this->properties->description['format'];
                $this->properties->description = $this->properties->description['text'];
@@ -1976,7 +1981,6 @@ class calendar_event {
                                                $this->editoroptions,
                                                $editor['text'],
                                                $this->editoroptions['forcehttps']);
-
                $DB->set_field('event', 'description', $this->properties->description, array('id'=>$this->properties->id));
            }

@@ -460,7 +460,7 @@ class core_calendar_renderer extends plugin_renderer_base {
        // Paddding (the first week may have blank days in the beginning)
        for($i = $display->minwday; $i < $startwday; ++$i) {
            $cell = new html_table_cell('&nbsp;');
-            $cell->attributes = array('class'=>'nottoday');
+            $cell->attributes = array('class'=>'nottoday dayblank');
            $row->cells[] = $cell;
        }

@@ -519,10 +519,10 @@ class core_calendar_renderer extends plugin_renderer_base {
            }

            // Special visual fx for today
-            if($display->thismonth && $calendar->day == $calendar->day) {
-                $cellclasses[] = 'today';
+            if ($display->thismonth && $calendar->day == $date['mday']) {
+                $cellclasses[] = 'day today';
            } else {
-                $cellclasses[] = 'nottoday';
+                $cellclasses[] = 'day nottoday';
            }
            $cell->attributes = array('class'=>join(' ',$cellclasses));

@@ -553,7 +553,7 @@ class core_calendar_renderer extends plugin_renderer_base {
        // Paddding (the last week may have blank days at the end)
        for($i = $dayweek; $i <= $display->maxwday; ++$i) {
            $cell = new html_table_cell('&nbsp;');
-            $cell->attributes = array('class'=>'nottoday');
+            $cell->attributes = array('class'=>'nottoday dayblank');
            $row->cells[] = $cell;
        }
        $table->data[] = $row;
@@ -70,8 +70,8 @@ echo $OUTPUT->heading(get_string('assignto', 'cohort', format_string($cohort->na
 echo $OUTPUT->notification(get_string('removeuserwarning', 'core_cohort'));

 // Get the user_selector we will need.
-$potentialuserselector = new cohort_candidate_selector('addselect', array('cohortid'=>$cohort->id));
-$existinguserselector = new cohort_existing_selector('removeselect', array('cohortid'=>$cohort->id));
+$potentialuserselector = new cohort_candidate_selector('addselect', array('cohortid'=>$cohort->id, 'accesscontext'=>$context));
+$existinguserselector = new cohort_existing_selector('removeselect', array('cohortid'=>$cohort->id, 'accesscontext'=>$context));

 // Process incoming user assignments to the cohort

@@ -184,7 +184,7 @@ bodyContent: '<div class="comment-delete-confirm"><a href="#" id="confirmdelete-
                        val = val.replace('___name___', list[i].fullname);
                    }
                    if (list[i]['delete']||newcmt) {
-                        list[i].content = '<div class="comment-delete"><a href="#" id ="comment-delete-'+this.client_id+'-'+list[i].id+'" title="'+M.str.moodle.deletecomment+'"><img src="'+M.util.image_url('t/delete', 'core')+'" /></a></div>' + list[i].content;
+                        list[i].content = '<div class="comment-delete"><a href="#" id ="comment-delete-'+this.client_id+'-'+list[i].id+'" title="'+M.str.moodle.deletecomment+'"><img alt="" src="'+M.util.image_url('t/delete', 'core')+'" /></a></div>' + list[i].content;
                    }
                    val = val.replace('___time___', list[i].time);
                    val = val.replace('___picture___', list[i].avatar);
@@ -34,7 +34,7 @@ $action    = optional_param('action',    '',  PARAM_ALPHA);
 $area      = optional_param('area',      '',  PARAM_AREA);
 $content   = optional_param('content',   '',  PARAM_RAW);
 $itemid    = optional_param('itemid',    '',  PARAM_INT);
-$returnurl = optional_param('returnurl', '/', PARAM_URL);
+$returnurl = optional_param('returnurl', '/', PARAM_LOCALURL);
 $component = optional_param('component', '',  PARAM_COMPONENT);

 // Currently this script can only add comments
@@ -191,6 +191,7 @@ if ($editingon && can_edit_in_category()) {
    // Integrate into the admin tree only if the user can edit categories at the top level,
    // otherwise the admin block does not appear to this user, and you get an error.
    require_once($CFG->libdir . '/adminlib.php');
+    navigation_node::override_active_url(new moodle_url('/course/category.php', array('id' => $id)));
    admin_externalpage_setup('coursemgmt', '', $urlparams, $CFG->wwwroot . '/course/category.php');
    $PAGE->set_context($context);   // Ensure that we are actually showing blocks etc for the cat context

@@ -32,7 +32,11 @@ $categoryid = optional_param('category', 0, PARAM_INT); // course category - can
 $returnto = optional_param('returnto', 0, PARAM_ALPHANUM); // generic navigation return page switch

 $PAGE->set_pagelayout('admin');
-$PAGE->set_url('/course/edit.php');
+$pageparams = array('id'=>$id);
+if (empty($id)) {
+    $pageparams = array('category'=>$categoryid);
+}
+$PAGE->set_url('/course/edit.php', $pageparams);

 // basic access control checks
 if ($id) { // editing course
@@ -46,7 +50,6 @@ if ($id) { // editing course
    $category = $DB->get_record('course_categories', array('id'=>$course->category), '*', MUST_EXIST);
    $coursecontext = get_context_instance(CONTEXT_COURSE, $course->id);
    require_capability('moodle/course:update', $coursecontext);
-    $PAGE->url->param('id',$id);

 } else if ($categoryid) { // creating new course in this category
    $course = null;
@@ -54,7 +57,6 @@ if ($id) { // editing course
    $category = $DB->get_record('course_categories', array('id'=>$categoryid), '*', MUST_EXIST);
    $catcontext = get_context_instance(CONTEXT_COURSECAT, $category->id);
    require_capability('moodle/course:create', $catcontext);
-    $PAGE->url->param('category',$categoryid);
    $PAGE->set_context($catcontext);

 } else {
@@ -120,7 +120,11 @@ class course_edit_form extends moodleform {
        $mform->addHelpButton('format', 'format');
        $mform->setDefault('format', $courseconfig->format);

-        for ($i = 0; $i <= $courseconfig->maxsections; $i++) {
+        $max = $courseconfig->maxsections;
+        if (!isset($max) || !is_numeric($max)) {
+            $max = 52;
+        }
+        for ($i = 0; $i <= $max; $i++) {
            $sectionmenu[$i] = "$i";
        }
        $mform->addElement('select', 'numsections', get_string('numberweeks'), $sectionmenu);
@@ -198,7 +198,7 @@ class core_course_external extends external_api {
                                array(
                                    'id' => new external_value(PARAM_INT, 'activity id'),
                                    'url' => new external_value(PARAM_URL, 'activity url', VALUE_OPTIONAL),
-                                    'name' => new external_value(PARAM_TEXT, 'activity module name'),
+                                    'name' => new external_value(PARAM_RAW, 'activity module name'),
                                    'description' => new external_value(PARAM_RAW, 'activity description', VALUE_OPTIONAL),
                                    'visible' => new external_value(PARAM_INT, 'is the module visible', VALUE_OPTIONAL),
                                    'modicon' => new external_value(PARAM_URL, 'activity icon url'),
@@ -583,7 +583,7 @@ function print_log_csv($course, $user, $date, $order='l.time DESC', $modname,
            $ld = $DB->get_record('log_display', array('module'=>$log->module, 'action'=>$log->action));
            $ldcache[$log->module][$log->action] = $ld;
        }
-        if ($ld && !empty($log->info)) {
+        if ($ld && is_numeric($log->info)) {
            // ugly hack to make sure fullname is shown correctly
            if (($ld->mtable == 'user') and ($ld->field ==  $DB->sql_concat('firstname', "' '" , 'lastname'))) {
                $log->info = fullname($DB->get_record($ld->mtable, array('id'=>$log->info)), true);
@@ -653,7 +653,7 @@ function print_log_xls($course, $user, $date, $order='l.time DESC', $modname,
    // Creating worksheets
    for ($wsnumber = 1; $wsnumber <= $nroPages; $wsnumber++) {
        $sheettitle = get_string('logs').' '.$wsnumber.'-'.$nroPages;
-        $worksheet[$wsnumber] =& $workbook->add_worksheet($sheettitle);
+        $worksheet[$wsnumber] = $workbook->add_worksheet($sheettitle);
        $worksheet[$wsnumber]->set_column(1, 1, 30);
        $worksheet[$wsnumber]->write_string(0, 0, get_string('savedat').
                                    userdate(time(), $strftimedatetime));
@@ -682,7 +682,7 @@ function print_log_xls($course, $user, $date, $order='l.time DESC', $modname,
            $ld = $DB->get_record('log_display', array('module'=>$log->module, 'action'=>$log->action));
            $ldcache[$log->module][$log->action] = $ld;
        }
-        if ($ld && !empty($log->info)) {
+        if ($ld && is_numeric($log->info)) {
            // ugly hack to make sure fullname is shown correctly
            if (($ld->mtable == 'user') and ($ld->field == $DB->sql_concat('firstname', "' '" , 'lastname'))) {
                $log->info = fullname($DB->get_record($ld->mtable, array('id'=>$log->info)), true);
@@ -766,7 +766,7 @@ function print_log_ods($course, $user, $date, $order='l.time DESC', $modname,
    // Creating worksheets
    for ($wsnumber = 1; $wsnumber <= $nroPages; $wsnumber++) {
        $sheettitle = get_string('logs').' '.$wsnumber.'-'.$nroPages;
-        $worksheet[$wsnumber] =& $workbook->add_worksheet($sheettitle);
+        $worksheet[$wsnumber] = $workbook->add_worksheet($sheettitle);
        $worksheet[$wsnumber]->set_column(1, 1, 30);
        $worksheet[$wsnumber]->write_string(0, 0, get_string('savedat').
                                    userdate(time(), $strftimedatetime));
@@ -795,7 +795,7 @@ function print_log_ods($course, $user, $date, $order='l.time DESC', $modname,
            $ld = $DB->get_record('log_display', array('module'=>$log->module, 'action'=>$log->action));
            $ldcache[$log->module][$log->action] = $ld;
        }
-        if ($ld && !empty($log->info)) {
+        if ($ld && is_numeric($log->info)) {
            // ugly hack to make sure fullname is shown correctly
            if (($ld->mtable == 'user') and ($ld->field == $DB->sql_concat('firstname', "' '" , 'lastname'))) {
                $log->info = fullname($DB->get_record($ld->mtable, array('id'=>$log->info)), true);
@@ -78,7 +78,7 @@ if ($backup->get_stage() !== backup_ui::STAGE_COMPLETE) {
    echo $OUTPUT->header();
    echo $OUTPUT->heading(get_string('publishcourseon', 'hub', !empty($hubname)?$hubname:$huburl), 3, 'main');
    if ($backup->enforce_changed_dependencies()) {
-        echo $renderer->dependency_notification(get_string('dependenciesenforced', 'backup'));
+        debugging('Your settings have been altered due to unmet dependencies', DEBUG_DEVELOPER);
    }
    echo $renderer->progress_bar($backup->get_progress_bar());
    echo $backup->display();
@@ -99,6 +99,9 @@ class recent_form extends moodleform {

            $mform->addElement('select', 'user', get_string('participants'), $options);
            $mform->setAdvanced('user');
+        } else {
+            // Default to no user.
+            $mform->addElement('hidden', 'user', 0);
        }

        $options = array(''=>get_string('allactivities'));
@@ -143,8 +143,9 @@ class core_course_renderer extends plugin_renderer_base {
                }

                if ($course->summary) {
+                    $url = new moodle_url('/course/info.php', array('id' => $course->id));
                    $image = html_writer::empty_tag('img', array('src'=>$this->output->pix_url('i/info'), 'alt'=>$this->strings->summary));
-                    $content .= html_writer::link(new moodle_url('/course/info.php', array('id'=>$course->id)), $image, array('title'=>$this->strings->summary));
+                    $content .= $this->action_link($url, $image, new popup_action('click', $url, 'courseinfo'), array('title' => $this->strings->summary));
                }
                $content .= html_writer::end_tag('div');
                $content .= html_writer::end_tag('div');
@@ -35,7 +35,7 @@ require_once($CFG->dirroot.'/course/lib.php');

 $id         = required_param('id', PARAM_INT);
 $switchrole = optional_param('switchrole',-1, PARAM_INT);
-$returnurl  = optional_param('returnurl', false, PARAM_URL);
+$returnurl  = optional_param('returnurl', false, PARAM_LOCALURL);

 $PAGE->set_url('/course/switchrole.php', array('id'=>$id));

@@ -86,4 +86,4 @@ if ($returnurl === false) {
    $returnurl = new moodle_url('/course/view.php', array('id' => $course->id));
 }

-redirect($returnurl);
+redirect($returnurl);
@@ -151,7 +151,7 @@ class enrol_flatfile_plugin extends enrol_plugin {
            if(! @unlink($filename)) {
                $eventdata = new stdClass();
                $eventdata->modulename        = 'moodle';
-                $eventdata->component         = 'course';
+                $eventdata->component         = 'enrol_flatfile';
                $eventdata->name              = 'flatfile_enrolment';
                $eventdata->userfrom          = get_admin();
                $eventdata->userto            = get_admin();
@@ -169,7 +169,7 @@ class enrol_flatfile_plugin extends enrol_plugin {
                // Send mail to admin
                $eventdata = new stdClass();
                $eventdata->modulename        = 'moodle';
-                $eventdata->component         = 'course';
+                $eventdata->component         = 'enrol_flatfile';
                $eventdata->name              = 'flatfile_enrolment';
                $eventdata->userfrom          = get_admin();
                $eventdata->userto            = get_admin();
@@ -280,7 +280,7 @@ class enrol_flatfile_plugin extends enrol_plugin {

                $eventdata = new stdClass();
                $eventdata->modulename        = 'moodle';
-                $eventdata->component         = 'course';
+                $eventdata->component         = 'enrol_flatfile';
                $eventdata->name              = 'flatfile_enrolment';
                $eventdata->userfrom          = $teacher;
                $eventdata->userto            = $user;
@@ -303,7 +303,7 @@ class enrol_flatfile_plugin extends enrol_plugin {

                    $eventdata = new stdClass();
                    $eventdata->modulename        = 'moodle';
-                    $eventdata->component         = 'course';
+                    $eventdata->component         = 'enrol_flatfile';
                    $eventdata->name              = 'flatfile_enrolment';
                    $eventdata->userfrom          = $user;
                    $eventdata->userto            = $teacher;
@@ -141,6 +141,11 @@ YUI.add('moodle-enrol_manual-quickenrolment', function(Y) {
            base.one('.'+CSS.HEADER+' h2').setStyle('cursor', 'move');

            this.get(UEP.BASE).one('.'+CSS.SEARCHOPTIONS+' .'+CSS.COLLAPSIBLEHEADING).one('img').setAttribute('src', M.util.image_url('t/collapsed', 'moodle'));
+            this.get(UEP.BASE).one('.'+CSS.SEARCHOPTIONS+' .'+CSS.COLLAPSIBLEHEADING).once('click', function() {
+                // We want to do this just once, the first time the controls are shown.
+                this.populateStartDates();
+                this.populateDuration();
+            }, this);
            this.get(UEP.BASE).one('.'+CSS.SEARCHOPTIONS+' .'+CSS.COLLAPSIBLEHEADING).on('click', function(){
                this.get(UEP.BASE).one('.'+CSS.SEARCHOPTIONS+' .'+CSS.COLLAPSIBLEHEADING).toggleClass(CSS.ACTIVE);
                this.get(UEP.BASE).one('.'+CSS.SEARCHOPTIONS+' .'+CSS.COLLAPSIBLEAREA).toggleClass(CSS.HIDDEN);
@@ -150,10 +155,7 @@ YUI.add('moodle-enrol_manual-quickenrolment', function(Y) {
                    this.get(UEP.BASE).one('.'+CSS.SEARCHOPTIONS+' .'+CSS.COLLAPSIBLEHEADING).one('img').setAttribute('src', M.util.image_url('t/expanded', 'moodle'));
                }
            }, this);
-
            this.populateAssignableRoles();
-            this.populateStartDates();
-            this.populateDuration();
        },
        populateAssignableRoles : function() {
            this.on('assignablerolesloaded', function(){
@@ -192,9 +194,10 @@ YUI.add('moodle-enrol_manual-quickenrolment', function(Y) {
            var select = this.get(UEP.BASE).one('.'+CSS.ENROLMENTOPTION+'.'+CSS.DURATION+' select');
            var defaultvalue = this.get(UEP.DEFAULTDURATION);
            var index = 0, count = 0;
+            var durationdays = M.util.get_string('durationdays', 'enrol', '{a}');
            for (var i = 1; i <= 365; i++) {
                count++;
-                var option = create('<option value="'+i+'">'+M.util.get_string('durationdays', 'enrol', i)+'</option>');
+                var option = create('<option value="'+i+'">'+durationdays.replace('{a}', i)+'</option>');
                if (i == defaultvalue) {
                    index = count;
                }
@@ -90,13 +90,14 @@ if (! $plugin_instance = $DB->get_record("enrol", array("id"=>$data->instanceid,
 $plugin = enrol_get_plugin('paypal');

 /// Open a connection back to PayPal to validate the data
+$paypaladdr = empty($CFG->usepaypalsandbox) ? 'www.paypal.com' : 'www.sandbox.paypal.com';
 $c = new curl();
 $options = array(
    'returntransfer' => true,
-    'httpheader' => array('application/x-www-form-urlencoded'),
+    'httpheader' => array('application/x-www-form-urlencoded', "Host: $paypaladdr"),
    'timeout' => 30,
+    'CURLOPT_HTTP_VERSION' => CURL_HTTP_VERSION_1_1,
 );
-$paypaladdr = empty($CFG->usepaypalsandbox) ? 'www.paypal.com' : 'www.sandbox.paypal.com';
 $location = "https://$paypaladdr/cgi-bin/webscr";
 $result = $c->post($location, $req, $options);

@@ -171,7 +172,7 @@ if (strlen($result) > 0) {

        }

-        if ($data->business != $plugin->get_config('paypalbusiness')) {   // Check that the email is the one we want it to be
+        if (textlib::strtolower($data->business) !== textlib::strtolower($plugin->get_config('paypalbusiness'))) {   // Check that the email is the one we want it to be
            message_paypal_error_to_admin("Business email is {$data->business} (not ".
                    $plugin->get_config('paypalbusiness').")", $data);
            die;
@@ -207,4 +207,23 @@ class enrol_paypal_plugin extends enrol_plugin {
        return $OUTPUT->box(ob_get_clean());
    }

+    /**
+     * Gets an array of the user enrolment actions
+     *
+     * @param course_enrolment_manager $manager
+     * @param stdClass $ue A user enrolment object
+     * @return array An array of user_enrolment_actions
+     */
+    public function get_user_enrolment_actions(course_enrolment_manager $manager, $ue) {
+        $actions = array();
+        $context = $manager->get_context();
+        $instance = $ue->enrolmentinstance;
+        $params = $manager->get_moodlepage()->url->params();
+        $params['ue'] = $ue->id;
+        if ($this->allow_unenrol($instance) && has_capability("enrol/paypal:unenrol", $context)) {
+            $url = new moodle_url('/enrol/unenroluser.php', $params);
+            $actions[] = new user_enrolment_action(new pix_icon('t/delete', ''), get_string('unenrol', 'enrol'), $url, array('class'=>'unenrollink', 'rel'=>$ue->id));
+        }
+        return $actions;
+    }
 }
@@ -431,7 +431,7 @@ class course_enrolment_table extends html_table implements renderable {

        $this->page           = optional_param(self::PAGEVAR, 0, PARAM_INT);
        $this->perpage        = optional_param(self::PERPAGEVAR, self::DEFAULTPERPAGE, PARAM_INT);
-        $this->sort           = optional_param(self::SORTVAR, self::DEFAULTSORT, PARAM_ALPHA);
+        $this->sort           = optional_param(self::SORTVAR, self::DEFAULTSORT, PARAM_ALPHANUM);
        $this->sortdirection  = optional_param(self::SORTDIRECTIONVAR, self::DEFAULTSORTDIRECTION, PARAM_ALPHA);

        $this->attributes = array('class'=>'userenrolment');
@@ -1,11 +1,14 @@
 .moodle-dialogue-base .hidden,
 .moodle-dialogue-base .moodle-dialogue-hidden {display:none;}
-.moodle-dialogue-base .moodle-dialogue-lightbox {background-color:#AAA;position:absolute;top:0;left:0;width:100%;height:100%;}
+.moodle-dialogue-base .moodle-dialogue-lightbox {background-color:#AAA;}
 .moodle-dialogue-base .moodle-dialogue {background-color:#666;border:0 solid #666;border-right-width:3px;border-bottom-width:3px;}
 .moodle-dialogue-base .moodle-dialogue-wrap {background-color:#FFF;margin-top:-3px;margin-left:-3px;border:1px solid #555;height:auto;}
-.moodle-dialogue-base .moodle-dialogue-hd {font-size:110%;color:inherit;font-weight:bold;text-align:left;padding:5px 6px;margin:0;border-bottom:1px solid #ccc;background-color:#f6f6f6;}
-.moodle-dialogue-base .closebutton {background-image:url(sprite.png);width:25px;height:15px;background-repeat:no-repeat;float:right;vertical-align:middle;display:inline-block;cursor:pointer;}
+.moodle-dialogue-base .moodle-dialogue-wrap .moodle-dialogue-hd {font-size:110%;color:inherit;font-weight:bold;text-align:left;padding:5px 6px;margin:0;border-bottom:1px solid #ccc;background:#f6f6f6;}
+.moodle-dialogue-base .moodle-dialogue-wrap .moodle-dialogue-hd h1{font-size:100%;font-weight:bold;margin:0;padding:0;display:inline;}
+.moodle-dialogue-base .moodle-dialogue-wrap .moodle-dialogue-hd .yui3-widget-buttons {padding: 5px;}
+.moodle-dialogue-base .closebutton {background-image:url(sprite.png);width:25px;height:15px;background-repeat:no-repeat;float:right;vertical-align:middle;display:inline-block;cursor:pointer;padding:0px;border-style:none;}
 .moodle-dialogue-base .moodle-dialogue-bd {padding:5px; overflow: auto;}
+.moodle-dialogue-base .moodle-dialogue-wrap .moodle-dialogue-content {background:#FFF;padding:0px;}
 .moodle-dialogue-base .moodle-dialogue-ft {}

 .moodle-dialogue-confirm .confirmation-dialogue {text-align:center;}
@@ -8,8 +8,6 @@ var DIALOGUE_NAME = 'Moodle dialogue',
    ALERT_NAME = 'Moodle alert',
    C = Y.Node.create,
    BASE = 'notificationBase',
-    LIGHTBOX = 'lightbox',
-    NODELIGHTBOX = 'nodeLightbox',
    COUNT = 0,
    CONFIRMYES = 'yesLabel',
    CONFIRMNO = 'noLabel',
@@ -31,7 +29,6 @@ var DIALOGUE = function(config) {
    var id = 'moodle-dialogue-'+COUNT;
    config.notificationBase =
        C('<div class="'+CSS.BASE+'">')
-            .append(C('<div class="'+CSS.LIGHTBOX+' '+CSS.HIDDEN+'"></div>'))
            .append(C('<div id="'+id+'" class="'+CSS.WRAP+'"></div>')
                .append(C('<div class="'+CSS.HEADER+' yui3-widget-hd"></div>'))
                .append(C('<div class="'+CSS.BODY+' yui3-widget-bd"></div>'))
@@ -42,34 +39,41 @@ var DIALOGUE = function(config) {
    config.visible =    config.visible || false;
    config.center =     config.centered || true;
    config.centered =   false;
+
+    // lightbox param to keep the stable versions API
+    if (config.lightbox === true) {
+        config.modal = true;
+    }
+    delete config.lightbox;
+
+    // closeButton param to keep the stable versions API
+    if (config.closeButton === false) {
+        config.buttons = null;
+    } else {
+        config.buttons = [
+            {
+                section: Y.WidgetStdMod.HEADER,
+                value     : '',
+                classNames: 'closebutton',
+                action: function (e) {
+                    e.preventDefault();
+                    this.hide();
+                }
+            }
+        ];
+    }
    DIALOGUE.superclass.constructor.apply(this, [config]);
 };
-Y.extend(DIALOGUE, Y.Overlay, {
+Y.extend(DIALOGUE, Y.Panel, {
    initializer : function(config) {
-        this.set(NODELIGHTBOX, this.get(BASE).one('.'+CSS.LIGHTBOX).setStyle('opacity', 0.5));
        this.after('visibleChange', this.visibilityChanged, this);
-        this.after('headerContentChange', function(e){
-            var h = (this.get('closeButton'))?this.get(BASE).one('.'+CSS.HEADER):false;
-            if (h && !h.one('.closebutton')) {
-                var c = C('<div class="closebutton"></div>');
-                c.on('click', this.hide, this);
-                h.append(c);
-            }
-        }, this);
        this.render();
        this.show();
    },
    visibilityChanged : function(e) {
        switch (e.attrName) {
            case 'visible':
-                if (this.get(LIGHTBOX)) {
-                    var l = this.get(NODELIGHTBOX);
-                    if (!e.prevVal && e.newVal) {
-                        l.setStyle('height',l.get('docHeight')+'px').removeClass(CSS.HIDDEN);
-                    } else if (e.prevVal && !e.newVal) {
-                        l.addClass(CSS.HIDDEN);
-                    }
-                }
+                this.get('maskNode').addClass(CSS.LIGHTBOX);
                if (this.get('center') && !e.prevVal && e.newVal) {
                    this.centerDialogue();
                }
@@ -95,9 +99,6 @@ Y.extend(DIALOGUE, Y.Overlay, {
    ATTRS : {
        notificationBase : {

-        },
-        nodeLightbox : {
-            value : null
        },
        lightbox : {
            validator : Y.Lang.isBoolean,
@@ -116,6 +117,9 @@ Y.extend(DIALOGUE, Y.Overlay, {

 var ALERT = function(config) {
    config.closeButton = false;
+    if (config.lightbox !== false) {
+        config.lightbox = true;
+    }
    ALERT.superclass.constructor.apply(this, [config]);
 };
 Y.extend(ALERT, DIALOGUE, {
@@ -129,7 +133,7 @@ Y.extend(ALERT, DIALOGUE, {
                            .append(yes));
        this.get(BASE).addClass('moodle-dialogue-confirm');
        this.setStdModContent(Y.WidgetStdMod.BODY, content, Y.WidgetStdMod.REPLACE);
-        this.setStdModContent(Y.WidgetStdMod.HEADER, this.get(TITLE), Y.WidgetStdMod.REPLACE);
+        this.setStdModContent(Y.WidgetStdMod.HEADER, '<h1>' + this.get(TITLE) + '</h1>', Y.WidgetStdMod.REPLACE);
        this.after('destroyedChange', function(){this.get(BASE).remove();}, this);
        this._enterKeypress = Y.on('key', this.submit, window, 'down:13', this);
        yes.on('click', this.submit, this);
@@ -166,6 +170,9 @@ Y.extend(ALERT, DIALOGUE, {
 });

 var CONFIRM = function(config) {
+    if (config.lightbox !== false) {
+        config.lightbox = true;
+    }
    CONFIRM.superclass.constructor.apply(this, [config]);
 };
 Y.extend(CONFIRM, DIALOGUE, {
@@ -184,7 +191,7 @@ Y.extend(CONFIRM, DIALOGUE, {
                            .append(no));
        this.get(BASE).addClass('moodle-dialogue-confirm');
        this.setStdModContent(Y.WidgetStdMod.BODY, content, Y.WidgetStdMod.REPLACE);
-        this.setStdModContent(Y.WidgetStdMod.HEADER, this.get(TITLE), Y.WidgetStdMod.REPLACE);
+        this.setStdModContent(Y.WidgetStdMod.HEADER, '<h1>' + this.get(TITLE) + '</h1>', Y.WidgetStdMod.REPLACE);
        this.after('destroyedChange', function(){this.get(BASE).remove();}, this);
        this._enterKeypress = Y.on('key', this.submit, window, 'down:13', this, true);
        this._escKeypress = Y.on('key', this.submit, window, 'down:27', this, false);
@@ -237,7 +244,7 @@ Y.extend(EXCEPTION, DIALOGUE, {
    _keypress : null,
    initializer : function(config) {
        this.get(BASE).addClass('moodle-dialogue-exception');
-        this.setStdModContent(Y.WidgetStdMod.HEADER, config.name, Y.WidgetStdMod.REPLACE);
+        this.setStdModContent(Y.WidgetStdMod.HEADER, '<h1>' + config.name + '</h1>', Y.WidgetStdMod.REPLACE);
        var content = C('<div class="moodle-exception"></div>')
                    .append(C('<div class="moodle-exception-message">'+this.get('message')+'</div>'))
                    .append(C('<div class="moodle-exception-param hidden param-filename"><label>File:</label> '+this.get('fileName')+'</div>'))
@@ -308,7 +315,7 @@ Y.extend(AJAXEXCEPTION, DIALOGUE, {
    _keypress : null,
    initializer : function(config) {
        this.get(BASE).addClass('moodle-dialogue-exception');
-        this.setStdModContent(Y.WidgetStdMod.HEADER, config.name, Y.WidgetStdMod.REPLACE);
+        this.setStdModContent(Y.WidgetStdMod.HEADER, '<h1>' + config.name + '</h1>', Y.WidgetStdMod.REPLACE);
        var content = C('<div class="moodle-ajaxexception"></div>')
                    .append(C('<div class="moodle-exception-message">'+this.get('error')+'</div>'))
                    .append(C('<div class="moodle-exception-param hidden param-debuginfo"><label>URL:</label> '+this.get('reproductionlink')+'</div>'))
@@ -372,4 +379,4 @@ M.core.confirm = CONFIRM;
 M.core.exception = EXCEPTION;
 M.core.ajaxException = AJAXEXCEPTION;

-}, '@VERSION@', {requires:['base','node','overlay','event-key', 'moodle-enrol-notification-skin']});
+}, '@VERSION@', {requires:['base','node','panel','event-key', 'moodle-enrol-notification-skin']});
@@ -114,7 +114,7 @@ class edit_outcome_form extends moodleform {
            if (empty($courseid)) {
                $mform->hardFreeze('standard');

-            } else if (empty($outcome->courseid) and !has_capability('moodle/grade:manage', get_context_instance(CONTEXT_SYSTEM))) {
+            } else if (!has_capability('moodle/grade:manage', get_context_instance(CONTEXT_SYSTEM))) {
                $mform->hardFreeze('standard');

            } else if ($coursecount and empty($outcome->courseid)) {
@@ -41,7 +41,7 @@ require_capability('moodle/grade:manage', $context);

 // default return url
 $gpr = new grade_plugin_return();
-$returnurl = $gpr->get_return_url($CFG->wwwroot.'/grade/report.php?id='.$course->id);
+$returnurl = $gpr->get_return_url($CFG->wwwroot.'/grade/report/index.php?id='.$course->id);

 if (!$grade_item = grade_item::fetch(array('id'=>$id, 'courseid'=>$course->id))) {
    print_error('invaliditemid');
@@ -50,7 +50,7 @@ if (!has_capability('moodle/grade:manage', $context)) {

 // default return url
 $gpr = new grade_plugin_return();
-$returnurl = $gpr->get_return_url($CFG->wwwroot.'/grade/report.php?id='.$course->id);
+$returnurl = $gpr->get_return_url($CFG->wwwroot.'/grade/report/index.php?id='.$course->id);

 // security checks!
 if (!empty($id)) {
@@ -41,7 +41,7 @@ class grade_export_ods extends grade_export {
    /// Sending HTTP headers
        $workbook->send($downloadfilename);
    /// Adding the worksheet
-        $myxls =& $workbook->add_worksheet($strgrades);
+        $myxls = $workbook->add_worksheet($strgrades);

    /// Print names of all the fields
        $myxls->write_string(0,0,get_string("firstname"));
@@ -40,7 +40,7 @@ class grade_export_xls extends grade_export {
    /// Sending HTTP headers
        $workbook->send($downloadfilename);
    /// Adding the worksheet
-        $myxls =& $workbook->add_worksheet($strgrades);
+        $myxls = $workbook->add_worksheet($strgrades);

    /// Print names of all the fields
        $myxls->write_string(0,0,get_string("firstname"));
@@ -214,7 +214,7 @@ border-color:#cecece;
 }

 .path-grade-report-grader th {
-padding:2px 10px 0;
+padding:1px 10px;
 }

 .path-grade-report-grader span.inclusion-links {
@@ -377,6 +377,8 @@ float:left;
 clear:none;
 padding-top:20px;
 }
+.path-grade-report-grader.dir-rtl .left_scroller {float:right;}
+

 .path-grade-report-grader .right_scroller {
 width:auto;
@@ -350,17 +350,21 @@ abstract class grade_report {
        global $CFG, $DB;
        static $hiding_affected = null;//array of items in this course affected by hiding

-        //if we're dealing with multiple users we need to know when we've moved on to a new user
+        // If we're dealing with multiple users we need to know when we've moved on to a new user.
        static $previous_userid = null;

+        // If we're dealing with multiple courses we need to know when we've moved on to a new course.
+        static $previous_courseid = null;
+
        if( $this->showtotalsifcontainhidden==GRADE_REPORT_SHOW_REAL_TOTAL_IF_CONTAINS_HIDDEN ) {
            return $finalgrade;
        }

-        //if we've moved on to another user don't return the previous user's affected grades
-        if ($previous_userid!=$this->user->id) {
+        // If we've moved on to another course or user, reload the grades.
+        if ($previous_userid != $this->user->id || $previous_courseid != $courseid) {
            $hiding_affected = null;
            $previous_userid = $this->user->id;
+            $previous_courseid = $courseid;
        }

        if( !$hiding_affected ) {
@@ -48,12 +48,12 @@ $string['environmenthead'] = 'Comprobando su entorno';
 $string['environmentsub2'] = 'Cada versión de Moodle tiene algún requisito mínimo de la versión de PHP y un número obligatorio de extensiones de PHP. Una comprobación del entorno completo se realiza antes de cada instalación y actualización. Por favor, póngase en contacto con el administrador del servidor si no sabe cómo instalar la nueva versión o habilitar las extensiones PHP.';
 $string['errorsinenvironment'] = '¡La comprobación del entorno falló!';
 $string['installation'] = 'Instalación';
-$string['langdownloaderror'] = 'El idioma "{$a}" no pudo ser instalado. El proceso de instalación continuará en inglés.';
+$string['langdownloaderror'] = 'El idioma "{$a}" no pudo ser instalado. El proceso de instalación continuará en Inglés.';
 $string['memorylimithelp'] = '<p>El límite de memoria PHP en su servidor es actualmente {$a}.</p>

 <p>Esto puede ocasionar que Moodle tenga problemas de memoria más adelante, especialmente si usted tiene activados muchos módulos y/o muchos usuarios.</p>

-<p>Recomendamos que configure PHP con el límite más alto posible, e.g. 40M.
+<p>Recomendamos que configure PHP con el límite más alto posible, por ejemplo: 40M.
 Hay varias formas de hacer esto:</p>
 <ol>
 <li>Si puede hacerlo, recompile PHP con <i>--enable-memory-limit</i>.
@@ -32,4 +32,4 @@ defined('MOODLE_INTERNAL') || die();

 $string['parentlanguage'] = '';
 $string['thisdirection'] = 'ltr';
-$string['thislanguage'] = 'Español - Mexico';
+$string['thislanguage'] = 'Español - México';
@@ -0,0 +1,33 @@
+<?php
+
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Automatically generated strings for Moodle installer
+ *
+ * Do not edit this file manually! It contains just a subset of strings
+ * needed during the very first steps of installation. This file was
+ * generated automatically by export-installer.php (which is part of AMOS
+ * {@link http://docs.moodle.org/dev/Languages/AMOS}) using the
+ * list of strings defined in /install/stringnames.txt.
+ *
+ * @package   installer
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$string['missingrequiredfield'] = 'بعضی از فیلدهای ضروری خالی است';
@@ -30,7 +30,7 @@

 defined('MOODLE_INTERNAL') || die();

-$string['language'] = 'חבילת שפה';
+$string['language'] = 'שפת ממשק';
 $string['next'] = 'הלאה';
 $string['previous'] = 'קודם';
 $string['reload'] = 'טען מחדש';
@@ -0,0 +1,34 @@
+<?php
+
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Automatically generated strings for Moodle installer
+ *
+ * Do not edit this file manually! It contains just a subset of strings
+ * needed during the very first steps of installation. This file was
+ * generated automatically by export-installer.php (which is part of AMOS
+ * {@link http://docs.moodle.org/dev/Languages/AMOS}) using the
+ * list of strings defined in /install/stringnames.txt.
+ *
+ * @package   installer
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$string['parentlanguage'] = 'he';
+$string['thislanguage'] = 'Hebrew kids';
@@ -80,10 +80,10 @@ $string['phpextension'] = 'PHP ekstenzija {$a}';
 $string['phpversion'] = 'PHP inačica';
 $string['phpversionhelp'] = '<p>Moodle zahtijeva najmanje PHP inačicu 4.3.0 ili 5.1.0 (5.0.x funkcionira uz brojne uočene probleme).</p> <p>Trenutno imate inačicu {$a}</p> <p>Morate nadograditi PHP ili premestiti Moodle instalaciju na web poslužitelj s novijom verzijom PHP-a!</br> (U slučaju inačice 5.0.x bilo bi najbolje da je vratite na inačicu 4.4.x)</p>';
 $string['welcomep10'] = '{$a->installername} ({$a->installerversion})';
-$string['welcomep20'] = 'Prikazana vam je ova stranica jer ste uspješno instalirali i pokrenuli <strong>{$a->packname} {$a->packversion}</strong> paket na vašem poslužitelju. Čestitamo!';
-$string['welcomep30'] = 'Ova inačica <strong>{$a->installername}</strong> uključuje aplikacije za stvaranje okruženja u kojem će <strong>Moodle</strong> uspješno funkcionirati, konkretno:';
+$string['welcomep20'] = 'Prikazana vam je ova stranica jer ste uspješno instalirali i pokrenuli <strong>{$a->packname} {$a->packversion}</strong> paket na svom poslužitelju. Čestitamo!';
+$string['welcomep30'] = 'Ova inačica <strong>{$a->installername}</strong> uključuje aplikacije za stvaranje okruženja u kojem će sustav <strong>Moodle</strong> uspješno funkcionirati, konkretno:';
 $string['welcomep40'] = 'Ovaj paket obuhvaća i <strong>Moodle {$a->moodlerelease} ({$a->moodleversion})</strong>.';
-$string['welcomep50'] = 'Korištenje svih aplikacija u ovom paketu je uređeno licencama pod kojima su izdane. Cijeli  <strong>{$a->installername}</strong> paket je rješenje <a href="http://www.opensource.org/docs/definition_plain.html">otvorenog koda</a> distribuirano pod <a href="http://www.gnu.org/copyleft/gpl.html">GPL</a> licencom.';
-$string['welcomep60'] = 'Sljedeće stranice će vas voditi kroz postupak instalacije i podešavanja <em>Moodle</em> na poslužitelju. Možete prihvatiti zadane postavke ili promijeniti iste sukladno vašim potrebama.';
+$string['welcomep50'] = 'Korištenje svih aplikacija u ovom paketu je uređeno licencama pod kojima su izdane. Cijeli paket <strong>{$a->installername}</strong> je rješenje <a href="http://www.opensource.org/docs/definition_plain.html">otvorenog koda</a> distribuirano pod <a href="http://www.gnu.org/copyleft/gpl.html">GPL</a> licencom.';
+$string['welcomep60'] = 'Sljedeće stranice će vas voditi kroz postupak instalacije i podešavanja sustava <em>Moodle</em> na poslužitelju. Možete prihvatiti zadane postavke ili promijeniti iste sukladno vašim potrebama.';
 $string['welcomep70'] = 'Kliknite na "Next" gumb kako bi započeli <strong>Moodle</strong> instalaciju.';
 $string['wwwroot'] = 'Web adresa';
@@ -31,6 +31,6 @@
 defined('MOODLE_INTERNAL') || die();

 $string['language'] = 'Jezik';
-$string['next'] = 'Nastavi';
+$string['next'] = 'Nastavite';
 $string['previous'] = 'Prethodni';
 $string['reload'] = 'Učitaj ponovno';
@@ -0,0 +1,33 @@
+<?php
+
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Automatically generated strings for Moodle installer
+ *
+ * Do not edit this file manually! It contains just a subset of strings
+ * needed during the very first steps of installation. This file was
+ * generated automatically by export-installer.php (which is part of AMOS
+ * {@link http://docs.moodle.org/dev/Languages/AMOS}) using the
+ * list of strings defined in /install/stringnames.txt.
+ *
+ * @package   installer
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$string['thislanguage'] = 'Kurmanji';
@@ -0,0 +1,99 @@
+<?php
+
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Automatically generated strings for Moodle installer
+ *
+ * Do not edit this file manually! It contains just a subset of strings
+ * needed during the very first steps of installation. This file was
+ * generated automatically by export-installer.php (which is part of AMOS
+ * {@link http://docs.moodle.org/dev/Languages/AMOS}) using the
+ * list of strings defined in /install/stringnames.txt.
+ *
+ * @package   installer
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$string['admindirname'] = 'Administratoriaus aplankas';
+$string['availablelangs'] = 'Galimų kalbų sąrašas';
+$string['chooselanguagehead'] = 'Pasirinkite kalbą';
+$string['chooselanguagesub'] = 'Prašome pasirinkti diegimo kalbą. Ši kalba taip pat taps numatytąją svetainės kalba. Tačiau vėliau, jei norėsite, Jūs galėsite ją pakeisti.';
+$string['clialreadyconfigured'] = 'config.php failas jau egzistuoja. Prašome naudotis admin/cli/install_database.php, jei Jūs norite įdiegti šią svetainę.';
+$string['clialreadyinstalled'] = 'config.php failas jau egzistuoja. Prašome naudoti admin/cli/upgrade.php jei Jūs norite išplėtoti šią svetainę.';
+$string['cliinstallheader'] = '"Moodle" {$a} komandinės eilutės įdiegimo programa';
+$string['databasehost'] = 'Duomenų bazės serveris';
+$string['databasename'] = 'Duomenų bazės pavadinimas';
+$string['databasetypehead'] = 'Pasirinkite duomenų bazės tvarkyklę';
+$string['dataroot'] = 'Duomenų aplankas';
+$string['datarootpermission'] = 'Duomenų aplanko leidimai';
+$string['dbprefix'] = 'Lentelių priešdėlis';
+$string['dirroot'] = '"Moodle" aplankas';
+$string['environmenthead'] = 'Tikrinama Jūsų aplinka...';
+$string['environmentsub2'] = 'Kiekviena "Moodle" laida turi kai kuriuos minimalius reikalavimus PHP versijai ir tam tikrą privalomų PHP plėtinių skaičių.
+Pilnas aplinkos patikrinimas yra padaromas prieš kiekvieną įdiegimą ar plėtotę. Prašome susisiekti su serverio administratoriumi, jeigu Jūs nežinote kaip įdiegti naują versiją ar įgalinti PHP plėtinius.';
+$string['errorsinenvironment'] = 'Aplinkos patikrinimas nesėkmingas!';
+$string['installation'] = 'Įdiegimas';
+$string['langdownloaderror'] = 'Deja "{$a}" kalba negali būti parsiųsta. Diegimo procesas bus tęsiamas anglų kalba.';
+$string['memorylimithelp'] = '<p>Šiuo metu Jūsų serverio PHP atminties limitas yra {$a}.</p>
+
+<p>Vėliau tai gali sukelti atminties trūkumo problemų "Moodle", ypač jei Jūs turite daug įgalintų modulių ir/ar daug vartotojų.</p>
+
+<p>Mes rekomenduojame suderinti PHP taip, kad jis turėtų kiek galima didesnį limitą, pvz.: 40MB.
+ Tam yra keletas būdų, kuriuos Jūs galite pabandyti:</p>
+<ol>
+<li>Jei Jūs galite, sukompiliuokite iš naujo PHP panaudodami <i>--enable-memory-limit</i> raktą.
+   Tai leis nustatyti atminties limitą pačiai "Moodle".</li>
+<li>Jei Jūs turite galimybę koreguoti Jūsų "php.ini" failą, tada pakeiskite <b>memory_limit</b> nuostatą į kažką artimo 40MB. Jei Jūs negalite koreguoti, tuomet gal galite paprašyti, kad Jūsų serverio administratorius tai padarytų už Jus.</li>
+<li>Kai kuriuose PHP serveriuose Jūs galite sukurti ".htaccess" failą "Moodle" aplanke ir įrašykite į jį šią eilutę:
+<blockquote><div>php_value memory_limit 40M</div></blockquote>
+<p>Tačiau kai kuriuose serveriuose tai neleis veikti <b>visiems</b> PHP puslapiams (Jūs matysite klaidas bandydami peržiūrėti tinklapius). Taigi Jums gali tekti pašalinti ".htaccess" failą.</p></li>
+</ol>';
+$string['paths'] = 'Keliai';
+$string['pathserrcreatedataroot'] = 'Diegiklis negali sukurti duomenų katalogo ({$a->dataroot}).';
+$string['pathshead'] = 'Patvirtinkite kelius';
+$string['pathsrodataroot'] = 'Dataroot katalogas yra neįrašomas';
+$string['pathsroparentdataroot'] = 'Virškatalogis ({$a->parent}) yra neįrašomas. Diegiklis negali sukurti duomenų katalogo ({$a->dataroot}).';
+$string['pathssubadmindir'] = 'Nedaugelis interneto paslaugų tiekėjų naudoja /admin kaip specialų URL skirtą prisijungti prie valdymo skydo ar panašiai. Deja tai kelia konfliktus su įprastais Moodle administravimo puslapių talpinimo keliais. Jūs galite tai pataisyti
+pervardydami admin katalogą Jūsų diegime bei įrašydami naują pavadinimą čia. Pavyzdžiui: <em>moodleadmin</em>. Tai pakeis visas admin nuorodas Moodle diegime.';
+$string['pathssubdataroot'] = 'Jums reikia vietos kur Moodle gali išsaugoti įkeliamus failus. Šis katalogas turi būti skaitomas IR ĮRAŠOMAS web serverio naudotojo
+(dažniausiai tai \'nobody\' arba \'apache\'), tačiau jis neturi būti pasiekiamas tiesiogiai per internetą. Diegiklis pabandys sukurti katalogą, jei tokio nėra.';
+$string['pathssubdirroot'] = 'Pilnas kelias iki Moodle diegimo vietos.';
+$string['pathssubwwwroot'] = 'Pilnas internetinis adresas, kuriuo bus pasiekiamas Moodle.
+Pasiekti Moodle naudojantis keliais adresais yra neįmanoma.
+Jei Jūsų svetainėje yra keletas viešų adresų, Jūs turite visuose adresuose nustatyti pastovų peradresavimą į šį adresą.
+Jei Jūsų svetainė yra pasiekiama ir iš Intraneto, ir iš Interneto - panaudokite viešą adresą čia ir nustatykite DNS taip, kad Intraneto naudotojai taip pat galėtų matyti viešą adresą.
+Jei adresas neteisingas - prašome pakeisti URL Jūsų naršyklėje ir pradėti diegimą su nauju adresu.';
+$string['pathsunsecuredataroot'] = 'Dataroot katalogo vieta yra nesaugi.';
+$string['pathswrongadmindir'] = 'Admin katalogas neegzistuoja';
+$string['phpextension'] = '{$a} PHP plėtinys';
+$string['phpversion'] = 'PHP versija';
+$string['phpversionhelp'] = '<p>Moodle reikalauja, kad būtų įdiegta bent 4.3.0 arba 5.1.0 PHP versija (5.0.x versija turi keletą žymių problemų).
+</p>
+<p>Jūs šiuo metu naudojate {$a} versiją</p>
+<p>Jūs turite išplėtoti turimą PHP versiją iki naujesnės arba persikelti pas kitą interneto paslaugų tiekėją, turintį naujesnę PHP versiją!<br/>
+(Turint 5.0.x versiją, Jūs turėtumėte pereiti prie žemesnės 4.4.x versijos)</p>';
+$string['welcomep10'] = '{$a->installername} ({$a->installerversion})';
+$string['welcomep20'] = 'Jūs matote šį puslapį, nes sėkmingai įdiegėte ir užkrovėte <strong>{$a->packname} {$a->packversion}</strong> paketą savo kompiuteryje.
+Sveikiname!';
+$string['welcomep30'] = 'Šis <strong>{$a->installername}</strong> leidimas turi programas skirtas sukurti aplinką, kurioje <strong>Moodle</strong> veiks. Būtent:';
+$string['welcomep40'] = 'Šis paketas taip pat turi  <strong>Moodle {$a->moodlerelease} ({$a->moodleversion})</strong>.';
+$string['welcomep50'] = 'Pakete esančių programų naudojimas yra reguliuojamas atitinkamų licencijų. Pilnas <strong>{$a->installername}</strong> paketas  yra <a href="http://www.opensource.org/docs/definition_plain.html">atviro kodo</a> ir platinamas remiantis <a href="http://www.gnu.org/copyleft/gpl.html">GPL</a> licencija.';
+$string['welcomep60'] = 'Sekantys puslapiai ves Jus per keletą lengvų žingsnių, kurie padės sukonfigūruoti ir nustatyti <strong>Moodle</strong> Jūsų kompiuteryje. Jūs galite priimti nustatymus pagal nutylėjimą arba, pasirinktinai, pakeisti juos pagal savo poreikius.';
+$string['welcomep70'] = 'Spauskite "Toliau" mygtuką, norėdami tęsti <strong>Moodle</strong> nustatymą.';
+$string['wwwroot'] = 'Interneto adresas';
@@ -45,7 +45,7 @@ $string['datarootpermission'] = 'Toestemming datamappen';
 $string['dbprefix'] = 'Tabelvoorvoegsel';
 $string['dirroot'] = 'Moodle-map';
 $string['environmenthead'] = 'Omgeving controleren ...';
-$string['environmentsub2'] = 'Elke Moodleversie vraagt een minimum PHP-versie en een aantal vereiste PHP-extenties.
+$string['environmentsub2'] = 'Elke Moodleversie vraagt een minimale PHP-versie en een aantal vereiste PHP-extenties.
 De volledige installatie-omgeving wordt gecontroleerd voor elke installatie en upgrade. Contacteer je server beheerder als je niet weet hoe je de juiste PHP-versie moet installeren of PHP-extenties moet inschakelen.';
 $string['errorsinenvironment'] = 'Fouten in je omgeving!';
 $string['installation'] = 'Installatie';
@@ -30,7 +30,7 @@

 defined('MOODLE_INTERNAL') || die();

-$string['cannotcreatelangdir'] = 'Nie można utworzyć katalogu językowego';
+$string['cannotcreatelangdir'] = 'Nie można utworzyć katalogu lang/';
 $string['cannotcreatetempdir'] = 'Nie można utworzyć katalogu tymczasowego';
 $string['cannotdownloadcomponents'] = 'Nie można pobrać składowych (komponentów)';
 $string['cannotdownloadzipfile'] = 'Nie można pobrać pliku ZIP';
@@ -35,7 +35,7 @@ $string['availablelangs'] = 'Lista de idiomas disponíveis';
 $string['chooselanguagehead'] = 'Escolha um idioma';
 $string['chooselanguagesub'] = 'Por favor, escolha o idioma para a instalação.Este idioma também será utilizado como idioma padrão do site, embora você possa mudar mais tarde.';
 $string['clialreadyconfigured'] = 'Arquivo config.php já existente. Por favor use admin/cli/install_database.php se você quer instalar este site';
-$string['clialreadyinstalled'] = 'O arquivo config.php já existe, por favor use admin/cli/upgrade.php, se você quiser atualizar o seu site.';
+$string['clialreadyinstalled'] = 'O arquivo config.php já existe, por favor use admin/cli/upgrade.php, se você quiser atualizar este site.';
 $string['cliinstallheader'] = 'Programa de instalação por linha de comando do Moodle {$a}';
 $string['databasehost'] = 'Host da base de dados';
 $string['databasename'] = 'Nome da base de dados';
@@ -0,0 +1,33 @@
+<?php
+
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Automatically generated strings for Moodle installer
+ *
+ * Do not edit this file manually! It contains just a subset of strings
+ * needed during the very first steps of installation. This file was
+ * generated automatically by export-installer.php (which is part of AMOS
+ * {@link http://docs.moodle.org/dev/Languages/AMOS}) using the
+ * list of strings defined in /install/stringnames.txt.
+ *
+ * @package   installer
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$string['thislanguage'] = 'тоҷикӣ';
@@ -0,0 +1,33 @@
+<?php
+
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Automatically generated strings for Moodle installer
+ *
+ * Do not edit this file manually! It contains just a subset of strings
+ * needed during the very first steps of installation. This file was
+ * generated automatically by export-installer.php (which is part of AMOS
+ * {@link http://docs.moodle.org/dev/Languages/AMOS}) using the
+ * list of strings defined in /install/stringnames.txt.
+ *
+ * @package   installer
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$string['thislanguage'] = 'Turkmen';
@@ -37,6 +37,8 @@ $string['defaultregion'] = 'Default region';
 $string['defaultregion_help'] = 'Themes may define one or more named block regions where blocks are displayed. This setting defines which of these you want this block to appear in by default. The region may be overridden on specific pages if required.';
 $string['defaultweight'] = 'Default weight';
 $string['defaultweight_help'] = 'The default weight allows you to choose roughly where you want the block to appear in the chosen region, either at the top or the bottom. The final location is calculated from all the blocks in that region (for example, only one block can actually be at the top). This value can be overridden on specific pages if required.';
+$string['hidedockpanel'] = 'Hide the dock panel';
+$string['hidepanel'] = 'Hide panel';
 $string['moveblockhere'] = 'Move block here';
 $string['movingthisblockcancel'] = 'Moving this block ({$a})';
 $string['onthispage'] = 'On this page';
@@ -322,6 +322,7 @@ $string['invalidurl'] = 'Invalid URL';
 $string['invaliduser'] = 'Invalid user';
 $string['invaliduserid'] = 'Invalid user id';
 $string['invaliduserfield'] = 'Invalid user field: {$a}';
+$string['invalidusername'] = 'The given username contains invalid characters';
 $string['invalidxmlfile'] = '"{$a}" is not a valid XML file';
 $string['iplookupfailed'] = 'Cannot find geo information about this IP address {$a}';
 $string['iplookupprivate'] = 'Cannot display lookup of private IP address';
@@ -424,6 +425,7 @@ $string['refoundtoorigi'] = 'Refunded to original amount: {$a}';
 $string['remotedownloaderror'] = 'Download of component to your server failed, please verify proxy settings, PHP cURL extension is highly recommended.<br /><br />You must download the <a href="{$a->url}">{$a->url}</a> file manually, copy it to "{$a->dest}" in your server and unzip it there.';
 $string['remotedownloadnotallowed'] = 'Download of components to your server isn\'t allowed (allow_url_fopen is disabled).<br /><br />You must download the <a href="{$a->url}">{$a->url}</a> file manually, copy it to "{$a->dest}" in your server and unzip it there.';
 $string['reportnotavailable'] = 'This type of report is only available for the site course';
+$string['requirecorrectaccess'] = 'Invalid url or port.';
 $string['requireloginerror'] = 'Course or activity not accessible.';
 $string['restorechecksumfailed'] = 'Some problem happened with the restore information stored in your session. Please check your PHP memory/DB package size limits. Restore stopped.';
 $string['restore_path_element_missingmethod'] = 'Restore method {$a} is missing. It must be defined by a developer.';
@@ -2898,8 +2898,13 @@ function get_user_roles_in_course($userid, $courseid) {
 function user_can_assign(context $context, $targetroleid) {
    global $DB;

-    // first check if user has override capability
-    // if not return false;
+    // First check to see if the user is a site administrator.
+    if (is_siteadmin()) {
+        return true;
+    }
+
+    // Check if user has override capability.
+    // If not return false.
    if (!has_capability('moodle/role:assign', $context)) {
        return false;
    }
@@ -3634,7 +3634,7 @@ class admin_settings_num_course_sections extends admin_setting_configselect {
    /** Lazy-load the available choices for the select box */
    public function load_choices() {
        $max = get_config('moodlecourse', 'maxsections');
-        if (empty($max)) {
+        if (!isset($max) || !is_numeric($max)) {
            $max = 52;
        }
        for ($i = 0; $i <= $max; $i++) {
@@ -1791,6 +1791,7 @@ function block_add_block_ui($page, $output) {

    $actionurl = new moodle_url($page->url, array('sesskey'=>sesskey()));
    $select = new single_select($actionurl, 'bui_addblock', $menu, null, array(''=>get_string('adddots')), 'add_block');
+    $select->set_label(get_string('addblock'), array('class'=>'accesshide'));
    $bc->content = $OUTPUT->render($select);
    return $bc;
 }
@@ -1694,7 +1694,7 @@ function add_to_log($courseid, $module, $action, $url='', $info='', $cm=0, $user
    $timenow = time();
    $info = $info;
    if (!empty($url)) { // could break doing html_entity_decode on an empty var.
-        $url = html_entity_decode($url);
+        $url = html_entity_decode($url, ENT_QUOTES, 'UTF-8');
    } else {
        $url = '';
    }
@@ -7247,5 +7247,26 @@ FROM
        upgrade_main_savepoint(true, 2011120505.09);
    }

+    if ($oldversion < 2011120506.06) {
+        // Remove "_utf8" suffix from all langs in course table.
+        $langs = $DB->get_records_sql("SELECT DISTINCT lang FROM {course} WHERE lang LIKE ?", array('%_utf8'));
+
+        foreach ($langs as $lang=>$unused) {
+            $newlang = str_replace('_utf8', '', $lang);
+            $sql = "UPDATE {course} SET lang = :newlang WHERE lang = :lang";
+            $DB->execute($sql, array('newlang'=>$newlang, 'lang'=>$lang));
+        }
+
+        // Main savepoint reached.
+        upgrade_main_savepoint(true, 2011120506.06);
+    }
+
+    if ($oldversion < 2011120507.03) {
+        // Make sure the sortorder is not above the unsigned integer MySQL range.
+        fix_course_sortorder();
+        // Main savepoint reached.
+        upgrade_main_savepoint(true, 2011120507.03);
+    }
+
    return true;
 }
@@ -141,7 +141,7 @@ class oracle_sql_generator extends sql_generator {
    public function getTypeSQL($xmldb_type, $xmldb_length=null, $xmldb_decimals=null) {

        switch ($xmldb_type) {
-            case XMLDB_TYPE_INTEGER:    // From http://www.postgresql.org/docs/7.4/interactive/datatype.html
+            case XMLDB_TYPE_INTEGER:    // See http://www.acs.ilstu.edu/docs/oracle/server.101/b10759/sql_elements001.htm#sthref86.
                if (empty($xmldb_length)) {
                    $xmldb_length = 10;
                }
@@ -437,9 +437,11 @@ function getSequenceFromDB($xmldb_table) {
    $tablename = $this->getTableName($xmldb_table);
    $sequencename = $tablename . '_id_seq';

-    if (!$this->mdb->get_record_sql("SELECT *
-                                       FROM pg_class
-                                      WHERE relname = ? AND relkind = 'S'",
+    if (!$this->mdb->get_record_sql("SELECT c.*
+                                       FROM pg_catalog.pg_class c
+                                       JOIN pg_catalog.pg_namespace as ns ON ns.oid = c.relnamespace
+                                      WHERE c.relname = ? AND c.relkind = 'S'
+                                            AND (ns.nspname = current_schema() OR ns.oid = pg_my_temp_schema())",
                                    array($sequencename))) {
        $sequencename = false;
    }
@@ -457,9 +459,11 @@ function getSequenceFromDB($xmldb_table) {
            case 'ix':
            case 'uix':
            case 'seq':
-                if ($check = $this->mdb->get_records_sql("SELECT relname
-                                                            FROM pg_class
-                                                           WHERE lower(relname) = ?", array(strtolower($object_name)))) {
+                if ($check = $this->mdb->get_records_sql("SELECT c.relname
+                                                                    FROM pg_class c
+                                                                    JOIN pg_catalog.pg_namespace as ns ON ns.oid = c.relnamespace
+                                                                   WHERE lower(c.relname) = ?
+                                                                         AND (ns.nspname = current_schema() OR ns.oid = pg_my_temp_schema())", array(strtolower($object_name)))) {
                    return true;
                }
                break;
@@ -467,9 +471,11 @@ function getSequenceFromDB($xmldb_table) {
            case 'uk':
            case 'fk':
            case 'ck':
-                if ($check = $this->mdb->get_records_sql("SELECT conname
-                                                            FROM pg_constraint
-                                                           WHERE lower(conname) = ?", array(strtolower($object_name)))) {
+                if ($check = $this->mdb->get_records_sql("SELECT c.conname
+                                                                    FROM pg_constraint c
+                                                                    JOIN pg_catalog.pg_namespace as ns ON ns.oid = c.connamespace
+                                                                   WHERE lower(c.conname) = ?
+                                                                         AND (ns.nspname = current_schema() OR ns.oid = pg_my_temp_schema())", array(strtolower($object_name)))) {
                    return true;
                }
                break;
@@ -171,7 +171,7 @@ abstract class pdo_moodle_database extends moodle_database {
     * Function to print/save/ignore debugging messages related to SQL queries.
     */
    protected function debug_query($sql, $params = null) {
-        echo '<hr /> (', $this->get_dbtype(), '): ',  htmlentities($sql);
+        echo '<hr /> (', $this->get_dbtype(), '): ',  htmlentities($sql, ENT_QUOTES, 'UTF-8');
        if($params) {
            echo ' (parameters ';
            print_r($params);
@@ -174,8 +174,14 @@ class pgsql_native_moodle_database extends moodle_database {
        pg_set_client_encoding($this->pgsql, 'utf8');
        $this->query_end(true);

+        $sql = '';
+        // Select schema if specified, otherwise the first one wins.
+        if (!empty($this->dboptions['dbschema'])) {
+            $sql .= "SET search_path = '".$this->dboptions['dbschema']."'; ";
+        }
+
        // find out the bytea oid
-        $sql = "SELECT oid FROM pg_type WHERE typname = 'bytea'";
+        $sql .= "SELECT oid FROM pg_type WHERE typname = 'bytea'";
        $this->query_start($sql, null, SQL_QUERY_AUX);
        $result = pg_query($this->pgsql, $sql);
        $this->query_end($result);
@@ -278,21 +284,13 @@ class pgsql_native_moodle_database extends moodle_database {
        }
        $this->tables = array();
        $prefix = str_replace('_', '|_', $this->prefix);
-        if ($this->is_min_version('9.1')) {
-            // Use ANSI standard information_schema in recent versions where it is fast enough.
-            $sql = "SELECT table_name
-                      FROM information_schema.tables
-                     WHERE table_name LIKE '$prefix%' ESCAPE '|'
-                       AND table_type IN ('BASE TABLE', 'LOCAL TEMPORARY')";
-        } else {
-            // information_schema is horribly slow in <= 9.0, so use pg internals.
-            // Note the pg_is_other_temp_schema. We only want temp objects from our own session.
-            $sql = "SELECT c.relname
-                      FROM pg_class c
-                     WHERE c.relname LIKE '$prefix%' ESCAPE '|'
+        $sql = "SELECT c.relname
+                  FROM pg_catalog.pg_class c
+                  JOIN pg_catalog.pg_namespace as ns ON ns.oid = c.relnamespace
+                 WHERE c.relname LIKE '$prefix%' ESCAPE '|'
                       AND c.relkind = 'r'
-                       AND NOT pg_is_other_temp_schema(c.relnamespace)";
-        }
+                       AND NOT pg_is_other_temp_schema(c.relnamespace)
+                       AND (ns.nspname = current_schema() OR ns.oid = pg_my_temp_schema())";
        $this->query_start($sql, null, SQL_QUERY_AUX);
        $result = pg_query($this->pgsql, $sql);
        $this->query_end($result);
@@ -319,9 +317,11 @@ class pgsql_native_moodle_database extends moodle_database {
        $indexes = array();
        $tablename = $this->prefix.$table;

-        $sql = "SELECT *
-                  FROM pg_catalog.pg_indexes
-                 WHERE tablename = '$tablename'";
+        $sql = "SELECT i.*
+                  FROM pg_catalog.pg_indexes i
+                  JOIN pg_catalog.pg_namespace as ns ON ns.nspname = i.schemaname
+                 WHERE i.tablename = '$tablename'
+                       AND (i.schemaname = current_schema() OR ns.oid = pg_my_temp_schema())";

        $this->query_start($sql, null, SQL_QUERY_AUX);
        $result = pg_query($this->pgsql, $sql);
@@ -362,10 +362,12 @@ class pgsql_native_moodle_database extends moodle_database {

        $sql = "SELECT a.attnum, a.attname AS field, t.typname AS type, a.attlen, a.atttypmod, a.attnotnull, a.atthasdef, d.adsrc
                  FROM pg_catalog.pg_class c
+                  JOIN pg_catalog.pg_namespace as ns ON ns.oid = c.relnamespace
                  JOIN pg_catalog.pg_attribute a ON a.attrelid = c.oid
                  JOIN pg_catalog.pg_type t ON t.oid = a.atttypid
             LEFT JOIN pg_catalog.pg_attrdef d ON (d.adrelid = c.oid AND d.adnum = a.attnum)
                 WHERE relkind = 'r' AND c.relname = '$tablename' AND c.reltype > 0 AND a.attnum > 0
+                       AND (ns.nspname = current_schema() OR ns.oid = pg_my_temp_schema())
              ORDER BY a.attnum";

        $this->query_start($sql, null, SQL_QUERY_AUX);
@@ -50,6 +50,7 @@ Modified:
 * string processing - uses our lang framework
 * form hacks
 * MDL-27890 - allow editor to be smaller
+ * MDL-25736 - French spellchecker fixes.

 TODO:
 * update strings to integrate with AMOS
@@ -1,3 +1,5 @@
+Version 2.0.6.1 (2012-11-16)
+	Fixed security issue with google spellchecker.
 Version 2.0.6 (2011-09-29)
 	Fixed incorrect position of suggestion menu.
 	Fixed handling of mispelled words with no suggestions in PSpellShell engine.
@@ -39,7 +39,7 @@ class GoogleSpell extends SpellChecker {
 		$matches = $this->_getMatches($lang, $word);

 		if (count($matches) > 0)
-			$sug = explode("\t", utf8_encode($this->_unhtmlentities($matches[0][4])));
+			$sug = explode("\t", $this->_unhtmlentities($matches[0][4]));

 		// Remove empty
 		foreach ($sug as $item) {
@@ -51,6 +51,8 @@ class GoogleSpell extends SpellChecker {
 	}

 	function &_getMatches($lang, $str) {
+		$lang = preg_replace('/[^a-z\-]/i', '', $lang); // Sanitize, remove everything but a-z or -
+		$str = preg_replace('/[\x00-\x1F\x7F]/', '', $str); // Sanitize, remove all control characters
 		$server = "www.google.com";
 		$port = 443;
 		$path = "/tbproxy/spell?lang=" . $lang . "&hl=en";
@@ -74,8 +74,8 @@ class MoodleExcelWorkbook {
     * @param string $name Name of the sheet
     * @return object MoodleExcelWorksheet
     */
-    function &add_worksheet($name = '') {
-    /// Create the Moodle Worksheet. Returns one pointer to it
+    function add_worksheet($name = '') {
+        // Create the Moodle Worksheet. Returns one pointer to it
        $ws = new MoodleExcelWorksheet ($name, $this->pear_excel_workbook, $this->latin_output);
        return $ws;
    }
@@ -138,6 +138,9 @@ class MoodleExcelWorksheet {
     */
    function MoodleExcelWorksheet($name, &$workbook, $latin_output=false) {

+        // Replace any characters in the name that Excel cannot cope with.
+        $name = strtr($name, '[]*/\?:', '       ');
+
        if (strlen($name) > 31) {
            // Excel does not seem able to cope with sheet names > 31 chars.
            // With $latin_output = false, it does not cope at all.
@@ -1892,7 +1892,7 @@ function send_file($path, $filename, $lifetime = 'default' , $filter=0, $pathiss
            $options = new stdClass();
            $options->newlines = false;
            $options->noclean = true;
-            $text = htmlentities($pathisstring ? $path : implode('', file($path)));
+            $text = htmlentities($pathisstring ? $path : implode('', file($path)), ENT_QUOTES, 'UTF-8');
            $output = '<pre>'. format_text($text, FORMAT_MOODLE, $options, $COURSE->id) .'</pre>';

            header('Content-Length: '.strlen($output));
@@ -3362,7 +3362,6 @@ function file_pluginfile($relativepath, $forcedownload) {
            if (!$event = $DB->get_record('event', array('id'=>(int)$eventid, 'eventtype'=>'site'))) {
                send_file_not_found();
            }
-            // Check that we got an event and that it's userid is that of the user

            // Get the file and serve if successful
            $filename = array_pop($args);
@@ -3410,8 +3409,8 @@ function file_pluginfile($relativepath, $forcedownload) {
                require_login($course);
            }

-            // Must be able to at least view the course
-            if (!is_enrolled($context) and !is_viewing($context)) {
+            // Must be able to at least view the course. This does not apply to the front page.
+            if ($course->id != SITEID && (!is_enrolled($context)) && (!is_viewing($context))) {
                //TODO: hmm, do we really want to block guests here?
                send_file_not_found();
            }
@@ -3432,10 +3431,10 @@ function file_pluginfile($relativepath, $forcedownload) {
                if (!has_capability('moodle/site:accessallgroups', $context) && !groups_is_member($event->groupid, $USER->id)) {
                    send_file_not_found();
                }
-            } else if ($event->eventtype === 'course') {
-                //ok
+            } else if ($event->eventtype === 'course' || $event->eventtype === 'site') {
+                // Ok. Please note that the event type 'site' still uses a course context.
            } else {
-                // some other type
+                // Some other type.
                send_file_not_found();
            }

@@ -287,7 +287,7 @@ M.form_filemanager.init = function(Y, options) {
                    var pathid  = 'fm-path-node-'+this.client_id;
                    pathid += ('-'+count);

-                    var crumb = Y.Node.create('<a href="###" id="'+pathid+'">'+path[p].name+'</a>');
+                    var crumb = Y.Node.create('<a href="###" id="'+pathid+'">'+Y.Escape.html(path[p].name)+'</a>');
                    breadcrumb.appendChild(arrow);
                    breadcrumb.appendChild(crumb);

@@ -399,7 +399,7 @@ M.form_filemanager.init = function(Y, options) {
                        }
                    break;
                }
-                var fullname = list[i].fullname;
+                var fullname = Y.Escape.html(list[i].fullname);

                if (list[i].sortorder == 1) {
                    html = html.replace('___fullname___', '<strong><a title="'+fullname+'" href="'+url+'" id="'+fileid+'"><img src="'+list[i].icon+'" /> ' + fullname + '</a></strong>');
@@ -115,7 +115,6 @@ YUI.add('moodle-form-dateselector', function(Y) {
            M.form.dateselector.currentowner = this;
            M.form.dateselector.calendar.cfg.setProperty('mindate', new Date(this.yearselect.firstOptionValue(), 0, 1));
            M.form.dateselector.calendar.cfg.setProperty('maxdate', new Date(this.yearselect.lastOptionValue(), 11, 31));
-            M.form.dateselector.panel.set('constrain', this.get('node').ancestor('form'));
            M.form.dateselector.panel.show();
            M.form.dateselector.fix_position();
            setTimeout(function(){M.form.dateselector.cancel_any_timeout()}, 100);
@@ -183,7 +182,6 @@ YUI.add('moodle-form-dateselector', function(Y) {
        initPanel : function(config) {
            this.panel = new Y.Overlay({
                visible : false,
-                constrain : true,
                bodyContent : Y.Node.create('<div id="dateselector-calendar-content"></div>'),
                id : 'dateselector-calendar-panel'
            });
@@ -244,7 +242,6 @@ YUI.add('moodle-form-dateselector', function(Y) {
        },
        fix_position : function() {
            if (this.currentowner) {
-                this.panel.set('constrain', Y.one(document.body));
                this.panel.set('align', {
                    node:this.currentowner.get('node').one('select'),
                    points:[Y.WidgetPositionAlign.BL, Y.WidgetPositionAlign.TL]
@@ -1670,7 +1670,7 @@ class MoodleQuickForm extends HTML_QuickForm_DHTMLRulesTableless {
                    $value = '';
                    // If we have a default value then export it.
                    if (isset($this->_defaultValues[$varname])) {
-                        $value = array($varname => $this->_defaultValues[$varname]);
+                        $value = $this->prepare_fixed_value($varname, $this->_defaultValues[$varname]);
                    }
                } else {
                    $value = $this->_elements[$key]->exportValue($this->_submitValues, true);
@@ -1700,6 +1700,29 @@ class MoodleQuickForm extends HTML_QuickForm_DHTMLRulesTableless {
        }
        return $unfiltered;
    }
+    /**
+     * This is a bit of a hack, and it duplicates the code in
+     * HTML_QuickForm_element::_prepareValue, but I could not think of a way or
+     * reliably calling that code. (Think about date selectors, for example.)
+     * @param string $name the element name.
+     * @param mixed $value the fixed value to set.
+     * @return mixed the appropriate array to add to the $unfiltered array.
+     */
+    protected function prepare_fixed_value($name, $value) {
+        if (null === $value) {
+            return null;
+        } else {
+            if (!strpos($name, '[')) {
+                return array($name => $value);
+            } else {
+                $valueAry = array();
+                $myIndex  = "['" . str_replace(array(']', '['), array('', "']['"), $name) . "']";
+                eval("\$valueAry$myIndex = \$value;");
+                return $valueAry;
+            }
+        }
+    }
+
    /**
     * Adds a validation rule for the given field
     *
@@ -287,13 +287,20 @@ class google_docs {
        if($search){
            $url.='?q='.urlencode($search);
        }
-        $content = $this->google_curl->get($url);
-
-        $xml = new SimpleXMLElement($content);
-

        $files = array();
-        foreach($xml->entry as $gdoc){
+        $content = $this->google_curl->get($url);
+        try {
+            if (strpos($content, '<?xml') !== 0) {
+                throw new moodle_exception('invalidxmlresponse');
+            }
+            $xml = new SimpleXMLElement($content);
+        } catch (Exception $e) {
+            // An error occured while trying to parse the XML, let's just return nothing. SimpleXML does not
+            // return a more specific Exception, that's why the global Exception class is caught here.
+            return $files;
+        }
+        foreach ($xml->entry as $gdoc) {
            $docid  = (string) $gdoc->children('http://schemas.google.com/g/2005')->resourceId;
            list($type, $docid) = explode(':', $docid);

@@ -485,13 +492,22 @@ class google_picasa {
     *
     * @return mixes $files Array in the format get_listing uses for folders
     */
-    public function get_albums(){
-        $content = $this->google_curl->get(google_picasa::LIST_ALBUMS_URL);
-        $xml = new SimpleXMLElement($content);
-
+    public function get_albums() {
        $files = array();
+        $content = $this->google_curl->get(google_picasa::LIST_ALBUMS_URL);

-        foreach($xml->entry as $album){
+        try {
+            if (strpos($content, '<?xml') !== 0) {
+                throw new moodle_exception('invalidxmlresponse');
+            }
+            $xml = new SimpleXMLElement($content);
+        } catch (Exception $e) {
+            // An error occured while trying to parse the XML, let's just return nothing. SimpleXML does not
+            // return a more specific Exception, that's why the global Exception class is caught here.
+            return $files;
+        }
+
+        foreach ($xml->entry as $album) {
            $gphoto = $album->children('http://schemas.google.com/photos/2007');

            $mediainfo = $album->children('http://search.yahoo.com/mrss/');
@@ -507,7 +523,6 @@ class google_picasa {
                'thumbnail_height' => 160,
                'children' => array(),
            );
-
        }

        return $files;
@@ -520,14 +535,22 @@ class google_picasa {
     * @param string $rawxml XML from picasa api
     * @return mixed $files A list of files for the file picker
     */
-    public function get_photo_details($rawxml){
-
-        $xml = new SimpleXMLElement($rawxml);
-        $this->lastalbumname = (string)$xml->title;
-
+    public function get_photo_details($rawxml) {
        $files = array();

-        foreach($xml->entry as $photo){
+        try {
+            if (strpos($rawxml, '<?xml') !== 0) {
+                throw new moodle_exception('invalidxmlresponse');
+            }
+            $xml = new SimpleXMLElement($rawxml);
+        } catch (Exception $e) {
+            // An error occured while trying to parse the XML, let's just return nothing. SimpleXML does not
+            // return a more specific Exception, that's why the global Exception class is caught here.
+            return $files;
+        }
+        $this->lastalbumname = (string)$xml->title;
+
+        foreach ($xml->entry as $photo) {
            $gphoto = $photo->children('http://schemas.google.com/photos/2007');

            $mediainfo = $photo->children('http://search.yahoo.com/mrss/');
@@ -892,7 +892,9 @@ class grade_category extends grade_object {
                $droppedsomething = false;

                $grade_keys = array_keys($grade_values);
-                if (count($grade_keys) === 0) {
+                $gradekeycount = count($grade_keys);
+
+                if ($gradekeycount === 0) {
                    //We've dropped all grade items
                    break;
                }
@@ -916,7 +918,7 @@ class grade_category extends grade_object {
                }

                $i = 1;
-                while ($originalindex+$i < count($grade_keys)) {
+                while ($originalindex + $i < $gradekeycount) {

                    $possibleitemid = $grade_keys[$originalindex+$i];
                    $i++;
@@ -1670,16 +1670,27 @@ class grade_item extends grade_object {
            return true; // no need to recalculate locked items
        }

-        // precreate grades - we need them to exist
-        $params = array($this->courseid, $this->id, $this->id);
-        $sql = "SELECT DISTINCT go.userid
-                  FROM {grade_grades} go
-                       JOIN {grade_items} gi
-                       ON (gi.id = go.itemid AND gi.courseid = ?)
-                       LEFT OUTER JOIN {grade_grades} g
-                       ON (g.userid = go.userid AND g.itemid = ?)
-                 WHERE gi.id <> ? AND g.id IS NULL";
-        if ($missing = $DB->get_records_sql($sql, $params)) {
+        // Precreate grades - we need them to exist
+        if ($userid) {
+            $missing = array();
+            if (!$DB->record_exists('grade_grades', array('itemid'=>$this->id, 'userid'=>$userid))) {
+                $m = new stdClass();
+                $m->userid = $userid;
+                $missing[] = $m;
+            }
+        } else {
+            // Find any users who have grades for some but not all grade items in this course
+            $params = array('gicourseid' => $this->courseid, 'ggitemid' => $this->id);
+            $sql = "SELECT gg.userid
+                      FROM {grade_grades} gg
+                           JOIN {grade_items} gi
+                           ON (gi.id = gg.itemid AND gi.courseid = :gicourseid)
+                     GROUP BY gg.userid
+                     HAVING SUM(CASE WHEN gg.itemid = :ggitemid THEN 1 ELSE 0 END) = 0";
+            $missing = $DB->get_records_sql($sql, $params);
+        }
+
+        if ($missing) {
            foreach ($missing as $m) {
                $grade = new grade_grade(array('itemid'=>$this->id, 'userid'=>$m->userid), false);
                $grade->grade_item =& $this;
@@ -320,11 +320,16 @@ M.util.init_maximised_embed = function(Y, id) {
        if (Y.Lang.isString(el)) {
            el = Y.one('#' + el);
        }
-        var val = el.getStyle(prop);
-        if (val == 'auto') {
-            val = el.getComputedStyle(prop);
+        // Ensure element exists.
+        if (el) {
+            var val = el.getStyle(prop);
+            if (val == 'auto') {
+                val = el.getComputedStyle(prop);
+            }
+            return parseInt(val);
+        } else {
+            return 0;
        }
-        return parseInt(val);
    };

    var resize_object = function() {
@@ -127,10 +127,11 @@ function message_send($eventdata) {
        if (isset($defaultpreferences->{$defaultpreference})) {
            $permitted = $defaultpreferences->{$defaultpreference};
        } else {
-            //MDL-25114 They supplied an $eventdata->component $eventdata->name combination which doesn't
-            //exist in the message_provider table (thus there is no default settings for them)
-            $preferrormsg = get_string('couldnotfindpreference', 'message', $defaultpreference);
-            throw new coding_exception($preferrormsg,'blah');
+            // MDL-25114 They supplied an $eventdata->component $eventdata->name combination which doesn't
+            // exist in the message_provider table (thus there is no default settings for them).
+            $preferrormsg = "Could not load preference $defaultpreference. Make sure the component and name you supplied
+                    to message_send() are valid.";
+            throw new coding_exception($preferrormsg);
        }

        // Find out if user has configured this output
@@ -1117,7 +1117,7 @@ function clean_param($param, $type) {

        case PARAM_TIMEZONE:    //can be int, float(with .5 or .0) or string seperated by '/' and can have '-_'
            $param = fix_utf8($param);
-            $timezonepattern = '/^(([+-]?(0?[0-9](\.[5|0])?|1[0-3]|1[0-2]\.5))|(99)|[[:alnum:]]+(\/?[[:alpha:]_-])+)$/';
+            $timezonepattern = '/^(([+-]?(0?[0-9](\.[5|0])?|1[0-3](\.0)?|1[0-2]\.5))|(99)|[[:alnum:]]+(\/?[[:alpha:]_-])+)$/';
            if (preg_match($timezonepattern, $param)) {
                return $param;
            } else {
@@ -4993,9 +4993,8 @@ function moodle_process_email($modargs,$body) {
 /**
 * Get mailer instance, enable buffering, flush buffer or disable buffering.
 *
- * @global object
 * @param string $action 'get', 'buffer', 'close' or 'flush'
- * @return object|null mailer instance if 'get' used or nothing
+ * @return moodle_phpmailer|null mailer instance if 'get' used or nothing
 */
 function get_mailer($action='get') {
    global $CFG;
@@ -5334,7 +5333,6 @@ function email_to_user($user, $from, $subject, $messagetext, $messagehtml='', $a

    if ($mail->Send()) {
        set_send_count($user);
-        $mail->IsSMTP();                               // use SMTP directly
        if (!empty($mail->SMTPDebug)) {
            echo '</pre>';
        }
@@ -3138,9 +3138,9 @@ class settings_navigation extends navigation_node {
                        continue;
                    }
                    if ($type->modclass == MOD_CLASS_RESOURCE) {
-                        $resources[html_entity_decode($type->type)] = $type->typestr;
+                        $resources[html_entity_decode($type->type, ENT_QUOTES, 'UTF-8')] = $type->typestr;
                    } else {
-                        $activities[html_entity_decode($type->type)] = $type->typestr;
+                        $activities[html_entity_decode($type->type, ENT_QUOTES, 'UTF-8')] = $type->typestr;
                    }
                }
            } else {
@@ -3785,7 +3785,7 @@ class settings_navigation extends navigation_node {

        // Messaging
        if (($currentuser && has_capability('moodle/user:editownmessageprofile', $systemcontext)) || (!isguestuser($user) && has_capability('moodle/user:editmessageprofile', $usercontext) && !is_primary_admin($user->id))) {
-            $url = new moodle_url('/message/edit.php', array('id'=>$user->id, 'course'=>$course->id));
+            $url = new moodle_url('/message/edit.php', array('id'=>$user->id));
            $usersetting->add(get_string('editmymessage', 'message'), $url, self::TYPE_SETTING);
        }

@@ -4070,7 +4070,7 @@ class navigation_json {
        }

        if ($child->forcetitle || $child->title !== $child->text) {
-            $attributes['title'] = htmlentities($child->title);
+            $attributes['title'] = htmlentities($child->title, ENT_QUOTES, 'UTF-8');
        }
        if (array_key_exists($child->key.':'.$child->type, $this->expandable)) {
            $attributes['expandable'] = $child->key;
@@ -50,7 +50,7 @@ class MoodleODSWorkbook {
    /* Create one Moodle Worksheet
     * @param string $name Name of the sheet
     */
-    function &add_worksheet($name = '') {
+    function add_worksheet($name = '') {
    /// Create the Moodle Worksheet. Returns one pointer to it
        $ws = new MoodleODSWorksheet($name);
        $this->worksheets[] =& $ws;
@@ -402,7 +402,7 @@ class page_requirements_manager {
                case 'core_filepicker':
                    $module = array('name'     => 'core_filepicker',
                                    'fullpath' => '/repository/filepicker.js',
-                                    'requires' => array('base', 'node', 'node-event-simulate', 'json', 'async-queue', 'io-base', 'io-upload-iframe', 'io-form', 'yui2-button', 'yui2-container', 'yui2-layout', 'yui2-menu', 'yui2-treeview', 'yui2-dragdrop', 'yui2-cookie'),
+                                    'requires' => array('base', 'node', 'node-event-simulate', 'json', 'async-queue', 'io-base', 'io-upload-iframe', 'io-form', 'escape', 'yui2-button', 'yui2-container', 'yui2-layout', 'yui2-menu', 'yui2-treeview', 'yui2-dragdrop', 'yui2-cookie'),
                                    'strings'  => array(array('add', 'repository'), array('back', 'repository'), array('cancel', 'moodle'), array('close', 'repository'),
                                                        array('cleancache', 'repository'), array('copying', 'repository'), array('date', 'repository'), array('downloadsucc', 'repository'),
                                                        array('emptylist', 'repository'), array('error', 'repository'), array('federatedsearch', 'repository'),
@@ -443,7 +443,7 @@ class page_requirements_manager {
                    $module = array('name'     => 'core_dock',
                                    'fullpath' => '/blocks/dock.js',
                                    'requires' => array('base', 'node', 'event-custom', 'event-mouseenter', 'event-resize'),
-                                    'strings' => array(array('addtodock', 'block'),array('undockitem', 'block'),array('undockall', 'block'),array('thisdirectionvertical', 'langconfig')));
+                                    'strings' => array(array('addtodock', 'block'),array('undockitem', 'block'),array('undockall', 'block'),array('thisdirectionvertical', 'langconfig'),array('hidedockpanel', 'block'),array('hidepanel', 'block')));
                    break;
                case 'core_message':
                    $module = array('name'     => 'core_message',
@@ -455,9 +455,12 @@ class portfolio_format_leap2a_entry {
    }

    /**
-     * hook function for subclasses to add extra links (like for files)
+     * Hook function for subclasses to add extra links (like for files)
+     *
+     * @param DomDocument $dom feed object
+     * @param DomDocument $entry feed added link
     */
-    protected function add_extra_links() {}
+    protected function add_extra_links($dom, $entry) {}
 }


@@ -1797,10 +1797,10 @@ function question_pluginfile($course, $context, $component, $filearea, $args, $f
        send_file_not_found();
    }

-    list($context, $course, $cm) = get_context_info_array($context->id);
-    require_login($course, false, $cm);
-
    if ($filearea === 'export') {
+        list($context, $course, $cm) = get_context_info_array($context->id);
+        require_login($course, false, $cm);
+
        require_once($CFG->dirroot . '/question/editlib.php');
        $contexts = new question_edit_contexts($context);
        // check export capability
@@ -173,8 +173,26 @@ function rss_get_file_full_name($componentname, $filename) {
    return "$CFG->cachedir/rss/$componentname/$filename.xml";
 }

-function rss_get_file_name($instance, $sql) {
-    return $instance->id.'_'.md5($sql);
+/**
+ * Construct the file name of the RSS File
+ *
+ * @param stdClass $instance the instance of the source of the RSS feed
+ * @param string $sql the SQL used to produce the RSS feed
+ * @param array $params the parameters used in the SQL query
+ * @return string the name of the RSS file
+ */
+function rss_get_file_name($instance, $sql, $params = array()) {
+    if ($params) {
+        // If a parameters array is passed, then we want to
+        // serialize it and then concatenate it with the sql.
+        // The reason for this is to generate a unique filename
+        // for queries using the same sql but different parameters.
+        asort($parms);
+        $serializearray = serialize($params);
+        return $instance->id.'_'.md5($sql . $serializearray);
+    } else {
+        return $instance->id.'_'.md5($sql);
+    }
 }

 /**
@@ -1069,6 +1069,10 @@ function get_moodle_cookie() {
 function session_set_user($user) {
    $_SESSION['USER'] = $user;
    unset($_SESSION['USER']->description); // conserve memory
+    if (isset($_SESSION['USER']->lang)) {
+        // Make sure it is a valid lang pack name.
+        $_SESSION['USER']->lang = clean_param($_SESSION['USER']->lang, PARAM_LANG);
+    }
    sesskey(); // init session key
 }

@@ -324,7 +324,7 @@ function default_exception_handler($ex) {
    }

    if (is_early_init($info->backtrace)) {
-        echo bootstrap_renderer::early_error($info->message, $info->moreinfourl, $info->link, $info->backtrace, $info->debuginfo);
+        echo bootstrap_renderer::early_error($info->message, $info->moreinfourl, $info->link, $info->backtrace, $info->debuginfo, $info->errorcode);
    } else {
        try {
            if ($DB) {
@@ -338,7 +338,7 @@ function default_exception_handler($ex) {
            // so we just print at least something instead of "Exception thrown without a stack frame in Unknown on line 0":-(
            if (CLI_SCRIPT or AJAX_SCRIPT) {
                // just ignore the error and send something back using the safest method
-                echo bootstrap_renderer::early_error($info->message, $info->moreinfourl, $info->link, $info->backtrace, $info->debuginfo);
+                echo bootstrap_renderer::early_error($info->message, $info->moreinfourl, $info->link, $info->backtrace, $info->debuginfo, $info->errorcode);
            } else {
                echo bootstrap_renderer::early_error_content($info->message, $info->moreinfourl, $info->link, $info->backtrace, $info->debuginfo);
                $outinfo = get_exception_info($out_ex);
@@ -478,6 +478,22 @@ function get_exception_info($ex) {
        $message = $module . '/' . $errorcode;
    }

+    // Remove some absolute paths from message and debugging info.
+    $searches = array();
+    $replaces = array();
+    $cfgnames = array('tempdir', 'cachedir', 'themedir',
+        'langmenucachefile', 'langcacheroot', 'dataroot', 'dirroot');
+    foreach ($cfgnames as $cfgname) {
+        if (property_exists($CFG, $cfgname)) {
+            $searches[] = $CFG->$cfgname;
+            $replaces[] = "[$cfgname]";
+        }
+    }
+    if (!empty($searches)) {
+        $message   = str_replace($searches, $replaces, $message);
+        $debuginfo = str_replace($searches, $replaces, $debuginfo);
+    }
+
    // Be careful, no guarantee weblib.php is loaded.
    if (function_exists('clean_text')) {
        $message = clean_text($message);
@@ -696,6 +712,20 @@ function initialise_fullme() {
            if (!defined('NO_MOODLE_COOKIES')) {
                define('NO_MOODLE_COOKIES', true);
            }
+            // The login/token.php script should call the correct url/port.
+            if (defined('REQUIRE_CORRECT_ACCESS') && REQUIRE_CORRECT_ACCESS) {
+                $wwwrootport = empty($wwwroot['port'])?'':$wwwroot['port'];
+                $calledurl = $rurl['host'];
+                if (!empty($rurl['port'])) {
+                    $calledurl .=  ':'. $rurl['port'];
+                }
+                $correcturl = $wwwroot['host'];
+                if (!empty($wwwrootport)) {
+                    $correcturl .=  ':'. $wwwrootport;
+                }
+                throw new moodle_exception('requirecorrectaccess', 'error', '', null,
+                    'You called ' . $calledurl .', you should have called ' . $correcturl);
+            }
            redirect($CFG->wwwroot, get_string('wwwrootmismatch', 'error', $CFG->wwwroot), 3);
        }
    }
@@ -1415,7 +1445,7 @@ width: 80%; -moz-border-radius: 20px; padding: 15px">
     * @param string $debuginfo extra information for developers
     * @return string
     */
-    public static function early_error($message, $moreinfourl, $link, $backtrace, $debuginfo = null) {
+    public static function early_error($message, $moreinfourl, $link, $backtrace, $debuginfo = null, $errorcode = null) {
        global $CFG;

        if (CLI_SCRIPT) {
@@ -1443,6 +1473,7 @@ width: 80%; -moz-border-radius: 20px; padding: 15px">
                    $e->stacktrace = format_backtrace($backtrace, true);
                }
            }
+            $e->errorcode  = $errorcode;
            @header('Content-Type: application/json; charset=utf-8');
            echo json_encode($e);
            return;
@@ -56,29 +56,35 @@ class textlib_test extends UnitTestCase {
        $this->assertIdentical(textlib::convert($iso2, 'iso-8859-2', 'win-1250'), $win);
        $this->assertIdentical(textlib::convert($iso2, 'iso-8859-2', 'iso-8859-2'), $iso2);
        $this->assertIdentical(textlib::convert($win, 'win-1250', 'cp1250'), $win);
+        $this->assertIdentical(textlib::convert($utf8, 'utf-8', 'utf-8'), $utf8);


        $utf8 = '言語設定';
        $str = pack("H*", "b8c0b8ecc0dfc4ea"); //EUC-JP
        $this->assertIdentical(textlib::convert($utf8, 'utf-8', 'EUC-JP'), $str);
        $this->assertIdentical(textlib::convert($str, 'EUC-JP', 'utf-8'), $utf8);
+        $this->assertIdentical(textlib::convert($utf8, 'utf-8', 'utf-8'), $utf8);

        $str = pack("H*", "1b24423840386c405f446a1b2842"); //ISO-2022-JP
        $this->assertIdentical(textlib::convert($utf8, 'utf-8', 'ISO-2022-JP'), $str);
        $this->assertIdentical(textlib::convert($str, 'ISO-2022-JP', 'utf-8'), $utf8);
+        $this->assertIdentical(textlib::convert($utf8, 'utf-8', 'utf-8'), $utf8);

        $str = pack("H*", "8cbe8cea90dd92e8"); //SHIFT-JIS
        $this->assertIdentical(textlib::convert($utf8, 'utf-8', 'SHIFT-JIS'), $str);
        $this->assertIdentical(textlib::convert($str, 'SHIFT-JIS', 'utf-8'), $utf8);
+        $this->assertIdentical(textlib::convert($utf8, 'utf-8', 'utf-8'), $utf8);

        $utf8 = '简体中文';
        $str = pack("H*", "bcf2cce5d6d0cec4"); //GB2312
        $this->assertIdentical(textlib::convert($utf8, 'utf-8', 'GB2312'), $str);
        $this->assertIdentical(textlib::convert($str, 'GB2312', 'utf-8'), $utf8);
+        $this->assertIdentical(textlib::convert($utf8, 'utf-8', 'utf-8'), $utf8);

        $str = pack("H*", "bcf2cce5d6d0cec4"); //GB18030
        $this->assertIdentical(textlib::convert($utf8, 'utf-8', 'GB18030'), $str);
        $this->assertIdentical(textlib::convert($str, 'GB18030', 'utf-8'), $utf8);
+        $this->assertIdentical(textlib::convert($utf8, 'utf-8', 'utf-8'), $utf8);
    }

    public function test_substr() {
@@ -412,4 +418,4 @@ class string_test_class extends stdClass {
    public function get_private_name() {
        return $this->publicname;
    }
-}
+}
@@ -60,6 +60,7 @@ class flexible_table {
    var $column_class    = array();
    var $column_suppress = array();
    var $column_nosort   = array('userpic');
+    private $column_textsort = array();
    var $setup           = false;
    var $sess            = NULL;
    var $baseurl         = NULL;
@@ -225,6 +226,14 @@ class flexible_table {
        $this->sort_default_order  = $defaultorder;
    }

+    /**
+     * Use text sorting functions for this column (required for text columns with Oracle).
+     * @param string column name
+     */
+    function text_sorting($column) {
+        $this->column_textsort[] = $column;
+    }
+
    /**
     * Do not sort using this column
     * @param string column name
@@ -421,6 +430,7 @@ class flexible_table {
            $SESSION->flextable[$this->uniqueid]->sortby   = array();
            $SESSION->flextable[$this->uniqueid]->i_first  = '';
            $SESSION->flextable[$this->uniqueid]->i_last   = '';
+            $SESSION->flextable[$this->uniqueid]->textsort = $this->column_textsort;
        }

        $this->sess = &$SESSION->flextable[$this->uniqueid];
@@ -511,8 +521,11 @@ class flexible_table {
        if (empty($sess->sortby)) {
            return '';
        }
+        if (empty($sess->textsort)) {
+            $sess->textsort = array();
+        }

-        return self::construct_order_by($sess->sortby);
+        return self::construct_order_by($sess->sortby, $sess->textsort);
    }

    /**
@@ -520,10 +533,14 @@ class flexible_table {
     * @param array $cols column name => SORT_ASC or SORT_DESC
     * @return SQL fragment that can be used in an ORDER BY clause.
     */
-    public static function construct_order_by($cols) {
+    public static function construct_order_by($cols, $textsortcols=array()) {
+        global $DB;
        $bits = array();

        foreach ($cols as $column => $order) {
+            if (in_array($column, $textsortcols)) {
+                $column = $DB->sql_order_by_text($column);
+            }
            if ($order == SORT_ASC) {
                $bits[] = $column . ' ASC';
            } else {
@@ -538,7 +555,7 @@ class flexible_table {
     * @return SQL fragment that can be used in an ORDER BY clause.
     */
    public function get_sql_sort() {
-        return self::construct_order_by($this->get_sort_columns());
+        return self::construct_order_by($this->get_sort_columns(), $this->column_textsort);
    }

    /**
@@ -1505,7 +1522,7 @@ class table_spreadsheet_export_format_parent extends table_default_export_format
    }

    function start_table($sheettitle) {
-        $this->worksheet =& $this->workbook->add_worksheet($sheettitle);
+        $this->worksheet = $this->workbook->add_worksheet($sheettitle);
        $this->rownum=0;
    }

--- a/Show More
+++ b/Show More