weekly release 2.6.11+

Also fixing a typo on the $referer variable.

auth/email/auth.php

@@ -139,12 +139,12 @@ class auth_plugin_email extends auth_plugin_base {
         $user = get_complete_user_data('username', $username);
 
         if (!empty($user)) {
-            if ($user->confirmed) {
-                return AUTH_CONFIRM_ALREADY;
-
-            } else if ($user->auth != $this->authtype) {
+            if ($user->auth != $this->authtype) {
                 return AUTH_CONFIRM_ERROR;
 
+            } else if ($user->secret == $confirmsecret && $user->confirmed) {
+                return AUTH_CONFIRM_ALREADY;
+
             } else if ($user->secret == $confirmsecret) {   // They have provided the secret key to get in
                 $DB->set_field("user", "confirmed", 1, array("id"=>$user->id));
                 if ($user->firstaccess == 0) {

auth/ldap/auth.php

@@ -604,12 +604,12 @@ class auth_plugin_ldap extends auth_plugin_base {
         $user = get_complete_user_data('username', $username);
 
         if (!empty($user)) {
-            if ($user->confirmed) {
-                return AUTH_CONFIRM_ALREADY;
-
-            } else if ($user->auth != $this->authtype) {
+            if ($user->auth != $this->authtype) {
                 return AUTH_CONFIRM_ERROR;
 
+            } else if ($user->secret == $confirmsecret && $user->confirmed) {
+                return AUTH_CONFIRM_ALREADY;
+
             } else if ($user->secret == $confirmsecret) {   // They have provided the secret key to get in
                 if (!$this->user_activate($username)) {
                     return AUTH_CONFIRM_FAIL;
@@ -1649,7 +1649,8 @@ class auth_plugin_ldap extends auth_plugin_base {
                                       $_SERVER['HTTP_REFERER'] != $CFG->wwwroot &&
                                       $_SERVER['HTTP_REFERER'] != $CFG->wwwroot.'/' &&
                                       $_SERVER['HTTP_REFERER'] != $CFG->httpswwwroot.'/login/' &&
-                                      $_SERVER['HTTP_REFERER'] != $CFG->httpswwwroot.'/login/index.php')
+                                      $_SERVER['HTTP_REFERER'] != $CFG->httpswwwroot.'/login/index.php' &&
+                                      clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL) != '')
                     ? $_SERVER['HTTP_REFERER'] : NULL;
             }
 

course/tests/externallib_test.php

@@ -225,7 +225,8 @@ class core_course_externallib_testcase extends externallib_advanced_testcase {
             $generatedcat = $generatedcats[$category['id']];
             $this->assertEquals($category['idnumber'], $generatedcat->idnumber);
             $this->assertEquals($category['name'], $generatedcat->name);
-            $this->assertEquals($category['description'], $generatedcat->description);
+            // Description was converted to the HTML format.
+            $this->assertEquals($category['description'], format_text($generatedcat->description, FORMAT_MOODLE, array('para' => false)));
             $this->assertEquals($category['descriptionformat'], FORMAT_HTML);
         }
 
@@ -530,7 +531,8 @@ class core_course_externallib_testcase extends externallib_advanced_testcase {
             $dbcourse = $generatedcourses[$course['id']];
             $this->assertEquals($course['idnumber'], $dbcourse->idnumber);
             $this->assertEquals($course['fullname'], $dbcourse->fullname);
-            $this->assertEquals($course['summary'], $dbcourse->summary);
+            // Summary was converted to the HTML format.
+            $this->assertEquals($course['summary'], format_text($dbcourse->summary, FORMAT_MOODLE, array('para' => false)));
             $this->assertEquals($course['summaryformat'], FORMAT_HTML);
             $this->assertEquals($course['shortname'], $dbcourse->shortname);
             $this->assertEquals($course['categoryid'], $dbcourse->category);

course/togglecompletion.php

@@ -73,8 +73,9 @@ if ($courseid) {
         }
 
         // Return to previous page
-        if (!empty($_SERVER['HTTP_REFERER'])) {
-            redirect($_SERVER['HTTP_REFERER']);
+        $referer = clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL);
+        if (!empty($referer)) {
+            redirect($referer);
         } else {
             redirect('view.php?id='.$course->id);
         }

files/externallib.php

@@ -321,6 +321,7 @@ class core_files_external extends external_api {
         $context = self::get_context_from_params($fileinfo);
         self::validate_context($context);
         if (($fileinfo['component'] == 'user' and $fileinfo['filearea'] == 'private')) {
+            require_capability('moodle/user:manageownfiles', $context);
             debugging('Uploading directly to user private files area is deprecated. Upload to a draft area and then move the files with core_user::add_user_private_files');
         }
 

install/lang/ba/langconfig.php

@@ -0,0 +1,34 @@
+<?php
+
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Automatically generated strings for Moodle installer
+ *
+ * Do not edit this file manually! It contains just a subset of strings
+ * needed during the very first steps of installation. This file was
+ * generated automatically by export-installer.php (which is part of AMOS
+ * {@link http://docs.moodle.org/dev/Languages/AMOS}) using the
+ * list of strings defined in /install/stringnames.txt.
+ *
+ * @package   installer
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$string['thisdirection'] = 'ltr';
+$string['thislanguage'] = 'Башҡорт теле';

install/lang/el/admin.php

@@ -30,6 +30,15 @@
 
 defined('MOODLE_INTERNAL') || die();
 
+$string['clianswerno'] = 'ο';
+$string['cliansweryes'] = 'ν';
+$string['cliincorrectvalueerror'] = 'Σφάλμα, λανθασμένη τιμή "{$a->value}" για το "{$a->option}"';
+$string['cliincorrectvalueretry'] = 'Λανθασμένη τιμή, παρακαλώ προσπαθήστε ξανά';
 $string['clitypevalue'] = 'δώσε μία τιμή';
+$string['clitypevaluedefault'] = 'δώσε μία τιμή, πάτησε Enter για να χρησιμοποιήσεις τη προκαθορισμένη τιμή ({$a})';
+$string['cliunknowoption'] = 'Μη αναγνωρίσιμες επιλογές:
+{$a}
+Παρακαλώ χρησιμοποιείστε την επιλογή --βοήθεια';
+$string['cliyesnoprompt'] = 'πατώντας ν (σημαίνει ναι) αλλιώς πατώντας ο (σημαίνει όχι)';
 $string['environmentrequireinstall'] = 'απαιτείται να εγκατασταθεί/ ενεργοποιηθεί';
 $string['environmentrequireversion'] = 'απαιτείται η έκδοση {$a->needed} ενώ εσείς έχετε την {$a->current}';

install/lang/es_mx/error.php

@@ -45,7 +45,7 @@ $string['downloadedfilecheckfailed'] = 'Ha fallado la comprobación del archivo
 $string['invalidmd5'] = 'La variable de verificación MD5 es incorrecta no es valida - trate nuevamente';
 $string['missingrequiredfield'] = 'Falta algún campo necesario';
 $string['remotedownloaderror'] = '<p>Falló la descarga del componente a su servidor. Se recomienda ampliamente verificar los ajustes del proxy, extensión PHP cURL.</p>
-<p>Debe descargar el<a href="{$a->url}">{$a->url}</a> archivo manualmente, copiarlo en "{$a->dest}" en su servidor y descomprimirlo allí..</p>';
+<p>Debe descargar el<a href="{$a->url}">{$a->url}</a> archivo manualmente, copiarlo en "{$a->dest}" en su servidor y descomprimirlo allí.</p>';
 $string['wrongdestpath'] = 'Ruta de destino errónea.';
 $string['wrongsourcebase'] = 'Base de fuente de URL errónea.';
 $string['wrongzipfilename'] = 'Nombre de archivo ZIP erróneo.';

install/lang/ja/error.php

@@ -42,7 +42,7 @@ $string['cannotsavemd5file'] = 'mp5ファイルを保存できません。';
 $string['cannotsavezipfile'] = 'ZIPファイルを保存できません。';
 $string['cannotunzipfile'] = 'ZIPファイルを解凍できません。';
 $string['componentisuptodate'] = 'コンポーネントは最新です。';
-$string['dmlexceptiononinstall'] = '<p>データベースエラーが発生しました: [{$a->errorcode}].<br />{$a->debuginfo}</p>';
+$string['dmlexceptiononinstall'] = '<p>データベースエラーが発生しました: [{$a->errorcode}]<br />{$a->debuginfo}</p>';
 $string['downloadedfilecheckfailed'] = 'ダウンロードファイルのチェックに失敗しました。';
 $string['invalidmd5'] = 'チェック変数が正しくありません - 再度お試しください。';
 $string['missingrequiredfield'] = 'いくつかの必須入力フィールドが入力されていません。';

install/lang/ja/install.php

@@ -33,10 +33,10 @@ defined('MOODLE_INTERNAL') || die();
 $string['admindirname'] = 'Adminディレクトリ';
 $string['availablelangs'] = '利用可能な言語パック';
 $string['chooselanguagehead'] = '言語を選択してください。';
-$string['chooselanguagesub'] = 'インストールのみに使用する言語を選択してください。この言語は、サイトのデフォルト言語としても使用されます。サイト言語は、後で変更することが可能です。';
-$string['clialreadyconfigured'] = '設定ファイルconfig.phpはすでに登録されています。このサイトをインストールしたい場合、admin/cli/install_database.phpを使用してください。';
-$string['clialreadyinstalled'] = '設定ファイルconfig.phpは、すでに登録されています。あなたのサイトをアップグレードしたい場合、admin/cli/upgrade.phpを使用してください。';
-$string['cliinstallheader'] = 'Moodle {$a} コマンドライン・インストールプログラム';
+$string['chooselanguagesub'] = 'インストールのみに使用する言語を選択してください。この言語はサイトのデフォルト言語としても使用されます。後でサイト言語を変更することができます。';
+$string['clialreadyconfigured'] = '設定ファイルconfig.phpはすでに登録されています。このサイトをインストールする場合、admin/cli/install_database.phpを使用してください。';
+$string['clialreadyinstalled'] = '設定ファイルconfig.phpは、すでに登録されています。このサイトをアップグレードする場合、admin/cli/upgrade.phpを使用してください。';
+$string['cliinstallheader'] = 'Moodle {$a} コマンドラインインストールプログラム';
 $string['databasehost'] = 'データベースホスト :';
 $string['databasename'] = 'データベース名 :';
 $string['databasetypehead'] = 'データベースドライバを選択する';
@@ -45,44 +45,55 @@ $string['datarootpermission'] = 'データディレクトリパーミッショ
 $string['dbprefix'] = 'テーブル接頭辞';
 $string['dirroot'] = 'Moodleディレクトリ';
 $string['environmenthead'] = 'あなたの環境を確認しています ...';
-$string['environmentsub2'] = 'それぞれのMoodleリリースには、PHPバージョンの最小必要条件および多くの必須PHP拡張モジュールがあります。完全な環境チェックは、インストールおよびアップグレードごとに実行されます。新しいPHPバージョンのインストールまたはPHP拡張モジュールの有効化に関して分からない場合、あなたのサーバ管理者に連絡してください。';
+$string['environmentsub2'] = 'それぞれのMoodleリリースにはPHPバージョンの最小必要条件および多くの必須PHP拡張モジュールがあります。完全な環境チェックはインストールおよびアップグレードごとに実行されます。新しいPHPバージョンのインストールまたはPHP拡張モジュールの有効化に関して分からない場合、あなたのサーバ管理者にご連絡ください。';
 $string['errorsinenvironment'] = '環境チェックが失敗しました!';
 $string['installation'] = 'インストレーション';
-$string['langdownloaderror'] = '残念ですが、言語「 {$a} 」がインストールされていません。インストール処理は英語で継続されます。';
-$string['memorylimithelp'] = '<p>現在、サーバのPHPメモリー制限が {$a} に設定されています。</p>
+$string['langdownloaderror'] = '残念ですが、言語「 {$a} 」をダウンロードできませんでした。インストール処理は英語で継続されます。';
+$string['memorylimithelp'] = '<p>現在、サーバのPHPメモリ制限が {$a} に設定されています。</p>
 
-<p>この設定ではMoodleのメモリーに関わるトラブルが発生する可能性があります。 特に多くのモジュールを使用したり、多くのユーザがMoodleを使用する場合にトラブルが発生します。</p>
+<p>この設定ではMoodleのメモリに関わるトラブルが発生する可能性があります。 特に多くのモジュールを使用したり、多くのユーザがMoodleを使用する場合にトラブルが発生します。</p>
 
-<p>可能でしたら、PHPのメモリー制限上限を40M以上に設定されることをお勧めします。この設定を実現するために、いくつかの方法があります:
+<p>可能でしたら、PHPのメモリ制限上限を40M以上に設定されることをお勧めします。この設定を実現するために、いくつかの方法があります:
 <ol>
-<li>あなたがリコンパイル可能な場合、PHPを<i>--enable-memory-limit</i>オプションでコンパイルしてください。これにより、Moodle自身がメモリー制限を設定することが可能になります。</li>
+<li>あなたがリコンパイル可能な場合、PHPを<i>--enable-memory-limit</i>オプションでコンパイルしてください。これにより、Moodle自身がメモリ制限を設定することが可能になります。</li>
 <li>あなたがphp.iniファイルにアクセスできる場合、<b>memory_limit</b>設定を40Mのように変更することができます。php.iniファイルにアクセスできない場合、管理者に変更を依頼してください。</li>
 <li>いくつかのPHPサーバでは、下記の行を含む.htaccessファイルをMoodleディレクトリに作成することができます:
 <blockquote><div>php_value memory_limit 40M</div></blockquote>
 <p>しかし、この設定が<b>すべての</b>PHPページの動作を妨げる場合もあります。ページ閲覧中にエラーが表示される場合、.htaccessファイルを削除してください。</p></li>
 </ol>';
 $string['paths'] = 'パス';
-$string['pathserrcreatedataroot'] = 'データディレクトリ ({$a->dataroot}) は、インストーラーで作成できません。';
+$string['pathserrcreatedataroot'] = 'データディレクトリ ({$a->dataroot}) はインストーラーで作成できません。';
 $string['pathshead'] = 'パスを確認する';
 $string['pathsrodataroot'] = 'datarootディレクトリに書き込み権がありません。';
-$string['pathsroparentdataroot'] = '親ディレクトリ ({$a->parent}) に書き込み権がありません。データディレクトリ ({$a->dataroot}) は、インストーラーで作成できません。';
-$string['pathssubadmindir'] = '極わずかですが、あなたがコントロールパネル等にアクセスするため、特別なURLとして/adminを使用するウェブホストがあります。残念なことに、これはMoodle管理ページの標準的なローケーションと競合してしまいます。ここに新しいディレクトリ名を入力することで、あなたのMoodleのadminディレクトリを修正することができます。例えば、<em>moodleadmin</em>です。これにより、Moodleのadminリンクが修正されます。';
-$string['pathssubdataroot'] = 'あなたには、Moodleがファイルをアップロードすることのできる場所が必要です。このディレクトリは、ウェブサーバユーザ (通常「nobody」または「apache」) から読み込みおよび「書き込み」できる必要があります。しかし、ウェブからは直接アクセスできないようにしてください。データディレクトリがない場合、インストーラーは作成を試みます。';
-$string['pathssubdirroot'] = 'Moodleコードを含むディレクトリに関するフルパスです。';
-$string['pathssubwwwroot'] = 'Moodleにアクセスすることのできるフルウェブアドレスです。複数アドレスを使用して、Moodleにアクセスすることはできません。あなたのサイトに複数のパブリックアドレスがある場合、このアドレスを除く、すべてのアドレスにパーマネントリダイレクトを設定してください。あなたのサイトにイントラネットおよびインターネットからアクセスできる場合、ここにはパブリックアドレスを入力してください。また、イントラネットユーザもパブリックアドレスを利用できるよう、DNSを設定してください。アドレスが正しくない場合、あなたのブラウザのURLを変更して、異なる値でインストールを再開してください。';
-$string['pathsunsecuredataroot'] = 'dirrootロケーションが安全ではありません。';
+$string['pathsroparentdataroot'] = '親ディレクトリ ({$a->parent}) に書き込み権がありません。データディレクトリ ({$a->dataroot}) はインストーラーで作成できません。';
+$string['pathssubadmindir'] = 'まれに、コントロールパネルまたはその他の管理ツールにアクセスするためのURLとして/adminディレクトリを使用しているウェブホストがあります。残念ですが、これはMoodle管理ページの標準的なロケーションと衝突します。あなたはインストール時にadminディレクトリをリネームすることができます。ここに新しいディレクトリ名を入力してください。例: <br /> <br /><b>moodleadmin</b><br /> <br />
+これによりMoodleでのadminへのリンクを変更します。';
+$string['pathssubdataroot'] = '<p>ユーザによってアップロードされたファイルコンテンツすべてをMoodleが保存するディレクトリです。</p>
+<p>このディレクトリはウェブサーバユーザ (通常「nobody」または「apache」) から読み込みおよび書き込みできる必要があります。</p>
+<p>ウェブからは直接アクセスできないようにしてください。</p>
+<p>現在ディレクトリが存在しない場合、インストレーションプロセスは作成を試みます。</p';
+$string['pathssubdirroot'] = '<p>Moodleコードを含むディレクトリに関するフルパスです。</p>';
+$string['pathssubwwwroot'] = '<p>Moodleにアクセスすることのできるフルウェブアドレスです。例えば、ユーザがブラウザのアドレスバーに入力してMoodleにアクセスするためのアドレスです。</p>
+
+<p>複数アドレスを使用してMoodleにアクセスすることはできません。あなたのサイトに複数アドレスからアクセスできる場合、最も簡単なアドレスを選択して、すべてのアドレスにパーマネントリダイレクトを設定してください。</p>
+
+<p>あなたのサイトにインターネットおよび内部ネットワーク (イントラネットと呼ばれます) からアクセスできる場合、ここではパブリックアドレスを使用してください。</p>
+
+<p>現在のアドレスが正しくない場合、あなたのブラウザのURLを変更して、異なる値でインストレーションを再開してください。</p>';
+$string['pathsunsecuredataroot'] = 'dataroot ロケーションが安全ではありません。';
 $string['pathswrongadmindir'] = 'adminディレクトリがありません。';
 $string['phpextension'] = '{$a} PHP拡張モジュール';
 $string['phpversion'] = 'PHPバージョン';
-$string['phpversionhelp'] = '<p>Moodleには、少なくとも 4.3.0 または 5.1.0 のPHPバージョンが必要です (5.0.x には既知の多数の問題があります)。</p>
+$string['phpversionhelp'] = '<p>Moodleには少なくとも4.3.0または5.1.0のPHPバージョンが必要です (5.0.x には既知の多数の問題があります)。</p>
 <p>現在、バージョン {$a} が動作しています。</p>
 <p>PHPをアップグレードするか、新しいバージョンがインストールされているホストに移動してください!<br />
-(5.0.x の場合、バージョン 4.4.x にダウングレードすることもできます。)</p>';
+(5.0.x の場合、anataha
+バージョン 4.4.x にダウングレードすることもできます。)</p>';
 $string['welcomep10'] = '{$a->installername} ({$a->installerversion})';
 $string['welcomep20'] = 'インストールが正常に完了して、あなたのコンピュータで <strong>{$a->packname} {$a->packversion}</strong> パッケージが起動されたため、このページが表示されています。おめでとうございます!';
 $string['welcomep30'] = 'このリリース <strong>{$a->installername}</strong> には<strong>Moodle</strong>で環境を作成するアプリケーションが含まれています。すなわち:';
 $string['welcomep40'] = 'パッケージには <strong>Moodle {$a->moodlerelease} ({$a->moodleversion})</strong> も含まれています。';
-$string['welcomep50'] = 'このパッケージ内のすべてのアプリケーションの使用は個々のライセンスによって規定されています。全体の <strong>{$a->installername}</strong> パッケージは <a href="http://www.opensource.org/docs/definition_plain.html">オープンソース</a> であり、<a href="http://www.gnu.org/copyleft/gpl.html">GPL</a>ライセンスの下で配布されています。';
-$string['welcomep60'] = '次からのページは、あなたのコンピュータに<strong>Moodle</strong>を簡単に設定およびセットアップする手順にしたがって進みます。あなたはデフォルトの設定を使用することも、必要に応じて任意で設定を変更することもできます。';
+$string['welcomep50'] = 'このパッケージ内のすべてのアプリケーションの使用は個々のライセンスによって規定されています。全体の<strong>{$a->installername}</strong>パッケージは<a href="http://www.opensource.org/docs/definition_plain.html">オープンソース</a>であり、<a href="http://www.gnu.org/copyleft/gpl.html">GPL</a>ライセンスの下で配布されています。';
+$string['welcomep60'] = '次からのページはあなたのコンピュータに<strong>Moodle</strong>を簡単に設定およびセットアップする手順にしたがって進みます。あなたはデフォルトの設定を使用することも、必要に応じて任意で設定を変更することもできます。';
 $string['welcomep70'] = '<strong>Moodle</strong>のセットアップを続けるには「次へ」ボタンをクリックしてください。';
 $string['wwwroot'] = 'ウェブアドレス';

install/lang/mk/install.php

@@ -34,6 +34,9 @@ $string['admindirname'] = 'Директориум аdmin';
 $string['availablelangs'] = 'Достапни јазични пакети';
 $string['chooselanguagehead'] = 'Изберете јазик';
 $string['chooselanguagesub'] = 'Изберете јазик САМО за инсталацијата. Подоцна ќе можете да изберете јазик за страницата и за корисниците.';
+$string['clialreadyconfigured'] = 'Конфигурациската датотека config.php веќе постои. Ве молиме користете ја admin/cli/install_database.php за да го инсталирате Moodle на овој сајт.';
+$string['clialreadyinstalled'] = 'Конфигурациската датотека config.php веќе постои. Ве молиме користете ја admin/cli/install_database.php за да го надградите Moodle за овој сајт.';
+$string['cliinstallheader'] = 'Програма за инсталирање на Moodle {$a} командна линија';
 $string['dataroot'] = 'Директориум';
 $string['dbprefix'] = 'Префикс на табели';
 $string['dirroot'] = 'Moodle директориум';

install/lang/mn/admin.php

@@ -30,5 +30,9 @@
 
 defined('MOODLE_INTERNAL') || die();
 
+$string['clianswerno'] = 'n';
+$string['cliansweryes'] = 'y';
+$string['cliincorrectvalueretry'] = 'Буруу утга, дахин оролдоно уу';
+$string['clitypevalue'] = 'төрлийн утга';
 $string['environmentrequireinstall'] = 'суусан/идэвхжсэн байх ёстой';
 $string['environmentrequireversion'] = 'та {$a->current} хувилбар ашиглаж байна {$a->needed} хувилбарыг ашиглагх ёстой';

install/lang/mn/moodle.php

@@ -33,3 +33,4 @@ defined('MOODLE_INTERNAL') || die();
 $string['language'] = 'Хэл';
 $string['next'] = 'Дараагийн';
 $string['previous'] = 'Өмнөх';
+$string['reload'] = 'Дахин ачаалах';

install/lang/oc_lnc/admin.php

@@ -39,6 +39,6 @@ $string['clitypevaluedefault'] = 'tipe valor, tapez Entrée per utilizar la valo
 $string['cliunknowoption'] = 'Options non reconnues :
  {$a}.
 Utilisez l\'option --help.';
-$string['cliyesnoprompt'] = 'Tapez y (pour oui) o n (pour non)';
+$string['cliyesnoprompt'] = 'Picatz y (per òc) o n (per non)';
 $string['environmentrequireinstall'] = 'doit être installé e activé';
 $string['environmentrequireversion'] = 'la version {$a->needed} es requise ; vous utilisez actualament la version {$a->current}';

install/lang/oc_lnc/install.php

@@ -0,0 +1,55 @@
+<?php
+
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Automatically generated strings for Moodle installer
+ *
+ * Do not edit this file manually! It contains just a subset of strings
+ * needed during the very first steps of installation. This file was
+ * generated automatically by export-installer.php (which is part of AMOS
+ * {@link http://docs.moodle.org/dev/Languages/AMOS}) using the
+ * list of strings defined in /install/stringnames.txt.
+ *
+ * @package   installer
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$string['admindirname'] = 'Dorsièr d\'administracion';
+$string['availablelangs'] = 'Paquetatges de lenga disponibles';
+$string['chooselanguagehead'] = 'Causissètz una lenga';
+$string['cliinstallheader'] = 'Programa d\'installacion de Moodle {$a} en linha de comanda';
+$string['databasehost'] = 'Servidor de banca de donadas';
+$string['databasename'] = 'Nom de la banca de donadas';
+$string['databasetypehead'] = 'Seleccionar un pilòt de banca de donadas';
+$string['dataroot'] = 'Dorsièr de donadas';
+$string['dbprefix'] = 'Prefix de las taulas';
+$string['dirroot'] = 'Dorsièr Moodle';
+$string['environmenthead'] = 'Verificacion de l\'environament...';
+$string['errorsinenvironment'] = 'Fracàs de la verificacion de l\'environament !';
+$string['installation'] = 'Installacion';
+$string['paths'] = 'Camins';
+$string['pathserrcreatedataroot'] = 'Lo dorsièr de donadas ({$a->dataroot}) pòt pas èsser creat per l\'installador.';
+$string['pathshead'] = 'Confirmar los camins d\'accès';
+$string['pathsrodataroot'] = 'Lo dorsièr de donadas es pas accessible en escritura.';
+$string['pathsunsecuredataroot'] = 'L\'emplaçament del dorsièr de donadas es pas segur';
+$string['pathswrongadmindir'] = 'Lo dorsièr d\'administracion existís pas';
+$string['phpextension'] = 'Extension PHP {$a}';
+$string['phpversion'] = 'Version de PHP';
+$string['welcomep10'] = '{$a->installername} ({$a->installerversion})';
+$string['wwwroot'] = 'Adreça web';

install/lang/oc_lnc/moodle.php

@@ -30,7 +30,7 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$string['language'] = 'Langue';
+$string['language'] = 'Lenga';
 $string['next'] = 'Seguent';
-$string['previous'] = 'Précédent';
-$string['reload'] = 'Actualiser';
+$string['previous'] = 'Precedent';
+$string['reload'] = 'Actualizar';

install/lang/pt/admin.php

@@ -34,8 +34,8 @@ $string['clianswerno'] = 'n';
 $string['cliansweryes'] = 's';
 $string['cliincorrectvalueerror'] = 'Erro: o valor "{$a->value}" não é permitido para a opção "{$a->option}"';
 $string['cliincorrectvalueretry'] = 'Valor incorreto, por favor tente novamente';
-$string['clitypevalue'] = 'valor do tipo';
-$string['clitypevaluedefault'] = 'valor do tipo, pressione a tecla Enter para usar o valor predefinido ({$a})';
+$string['clitypevalue'] = 'introduza valor';
+$string['clitypevaluedefault'] = 'introduza valor, pressione a tecla Enter para usar o valor predefinido ({$a})';
 $string['cliunknowoption'] = 'Opções desconhecidas: {$a} Por favor use a opção --help';
 $string['cliyesnoprompt'] = 'digite s (para sim) ou n (para não)';
 $string['environmentrequireinstall'] = 'deve estar instalada e ativa';

install/lang/pt_br/install.php

@@ -31,11 +31,11 @@
 defined('MOODLE_INTERNAL') || die();
 
 $string['admindirname'] = 'Diretório admin';
-$string['availablelangs'] = 'Lista de idiomas disponíveis';
+$string['availablelangs'] = 'Pacotes de idioma disponíveis';
 $string['chooselanguagehead'] = 'Escolha um idioma';
 $string['chooselanguagesub'] = 'Por favor, escolha o idioma para a instalação.Este idioma também será utilizado como idioma padrão do site, embora você possa mudar mais tarde.';
-$string['clialreadyconfigured'] = 'Arquivo config.php já existente. Por favor use admin/cli/install_database.php se você quer instalar este site';
-$string['clialreadyinstalled'] = 'O arquivo config.php já existe, por favor use admin/cli/upgrade.php, se você quiser atualizar este site.';
+$string['clialreadyconfigured'] = 'Arquivo config.php já existe. Por favor, use admin/cli/install_database.php para instalar o Moodle neste site.';
+$string['clialreadyinstalled'] = 'Arquivo config.php já existe. Por favor use admin/cli/install_database.php para atualizar o Moodle neste site.';
 $string['cliinstallheader'] = 'Programa de instalação por linha de comando do Moodle {$a}';
 $string['databasehost'] = 'Host da base de dados';
 $string['databasename'] = 'Nome da base de dados';
@@ -69,11 +69,15 @@ $string['pathshead'] = 'Confirme os caminhos';
 $string['pathsrodataroot'] = 'O diretório de dados raiz não pode ser acessado para escrita.';
 $string['pathsroparentdataroot'] = 'O diretório pai ({$a->parent}) não pode ser escrito. O diretório de dados ({$a->dataroot}) não pode ser criado pelo instalador.';
 $string['pathssubadmindir'] = 'Alguns poucos webhosts usam /admin como um URL especial para acesso ao painel de controle ou outras coisas. Infelizmente isto conflita com a localizaçao padrão das páginas do administrador Moodle. Você pode corrigir isso renomeando a pasta admin na sua instalação, e colocando esse novo nome aqui. Por exemplo: <em>moodleadmin</em>. Isto irá corrigir os links das páginas do administrador Moodle.';
-$string['pathssubdataroot'] = 'Você precisa de um local onde o Moodle possa salvar arquivos enviados. Este diretório deve possuir permissões de leitura e escrita pelo usuário do servidor web
-(geralmente \'nobody\' ou \'apache \'), mas não deverá ser acessível diretamente através da web. O instalador irá tentar criá-lo se ele não existir.';
-$string['pathssubdirroot'] = 'Caminho completo do diretório para instalação do Moddle.';
-$string['pathssubwwwroot'] = 'Endereço web completo onde o Moodle será acessado.
-Não é possível acessar o Moodle usando múltiplos endereços. Se seu site tem múltiplos endereços públicos você deve configurar redirecionamentos permantentes em todos eles exceto esse. Se seu site é acessado tanto da Intranet como Internet, use o endereço público aqui e configure o DNS para que os usuários da Intranet possam usar o endereço público também. Se o endereço não estiver correto, por favo mude a URL no seu navegador para reiniciar a instalação com um valor diferente.';
+$string['pathssubdataroot'] = '<p>Um diretório em que Moodle pode armazenar todo o conteúdo de arquivos enviados pelos usuários. </p>
+<p>Este diretório deve ser legível e gravável tanto pelo usuário do servidor web (geralmente "www-data \',\' nobody \', ou\' apache\'). </p>
+<p>Não deve ser diretamente acessível através da web. </p>
+<p>Se o diretório não existir atualmente, o processo de instalação irá tentar criá-la. </p>';
+$string['pathssubdirroot'] = '<p>Caminho completo do diretório para instalação do Moddle.</p>';
+$string['pathssubwwwroot'] = '<p>O endereço completo em que Moodle pode ser acessado ou seja, o endereço que os usuários vão digitar na barra de endereços do seu navegador para acessar Moodle. </p>
+<p>Não é possível acessar Moodle usando múltiplos endereços. Se o seu site é acessível através de múltiplos endereços, em seguida, escolher o mais fácil e configurar um redirecionamento permanente para cada um dos outros endereços. </p>
+<p>Se o seu site é acessível tanto a partir da Internet e, a partir de uma rede interna (às vezes chamado de Intranet), em seguida, use o endereço público aqui. </p>
+<p>Se o endereço atual não está correto, por favor, mude o URL na barra de endereços do navegador e reiniciar a instalação. </p>';
 $string['pathsunsecuredataroot'] = 'A localização da pasta de dados não é segura.';
 $string['pathswrongadmindir'] = 'Diretório Admin não existe';
 $string['phpextension'] = 'Extensão PHP {$a}';

install/lang/tn/langconfig.php

@@ -0,0 +1,34 @@
+<?php
+
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Automatically generated strings for Moodle installer
+ *
+ * Do not edit this file manually! It contains just a subset of strings
+ * needed during the very first steps of installation. This file was
+ * generated automatically by export-installer.php (which is part of AMOS
+ * {@link http://docs.moodle.org/dev/Languages/AMOS}) using the
+ * list of strings defined in /install/stringnames.txt.
+ *
+ * @package   installer
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$string['thisdirection'] = 'ltr';
+$string['thislanguage'] = 'Setswana';

install/lang/tr/admin.php

@@ -32,13 +32,13 @@ defined('MOODLE_INTERNAL') || die();
 
 $string['clianswerno'] = 'h';
 $string['cliansweryes'] = 'e';
-$string['cliincorrectvalueerror'] = 'Hata, "{$a->option}" için geçeriz değer ("{$a->value}")';
+$string['cliincorrectvalueerror'] = 'Hata, "{$a->option}" seçeneği için  geçersiz değer : "{$a->value}"';
 $string['cliincorrectvalueretry'] = 'Geçersiz değer, lütfen tekrar deneyin';
-$string['clitypevalue'] = 'değeri yazın';
+$string['clitypevalue'] = '';
 $string['clitypevaluedefault'] = 'değeri yazın, varsayılan değeri ({$a}) kullanmak için Enter tuşuna basın';
-$string['cliunknowoption'] = 'Tanınmayan seçenekler:
-{$a}
+$string['cliunknowoption'] = 'Tanımlanamauan seçenek:
+   {$a}
 Lütfen --help seçeneğini kullanın.';
-$string['cliyesnoprompt'] = 'e (evet) veya h (hayır) yazın';
+$string['cliyesnoprompt'] = 'e (evet) ya da h (hayır) yazın';
 $string['environmentrequireinstall'] = 'yüklenmiş ve etkinleştirilmiş olmalıdır';
 $string['environmentrequireversion'] = 'sürüm {$a->needed} gerekli ve şu anda {$a->current} çalışıyor';

install/lang/tr/install.php

@@ -30,21 +30,21 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$string['admindirname'] = 'Yönetici Dizini';
+$string['admindirname'] = 'Yönetici dizini';
 $string['availablelangs'] = 'Kullanılabilir dil paketleri';
-$string['chooselanguagehead'] = 'Bir dil seçin';
+$string['chooselanguagehead'] = 'Dil seçin';
 $string['chooselanguagesub'] = 'Lütfen, SADECE kurulum için bir dil seçin. Site ve kullanıcı dillerini sonraki ekranda seçebilirsiniz.';
 $string['clialreadyconfigured'] = 'config.php halihazırda mevcut, lütfen eğer bu siteyi yüklemek istiyorsanız şu dizini kullanın: admin/cli/install_database.php';
 $string['clialreadyinstalled'] = 'Config.php zaten var. Sitenizi güncellemek istiyorsanız bu adresi kullanın: admin/cli/install_database.php';
 $string['cliinstallheader'] = 'Moodle {$a} komut satırı kurulum programı';
 $string['databasehost'] = 'Veritabanı sunucusu';
 $string['databasename'] = 'Veritabanı adı';
-$string['databasetypehead'] = 'Veritabanı sürücünü seçin';
-$string['dataroot'] = 'Veri Dizini';
-$string['datarootpermission'] = 'Veri dizinleri izni';
+$string['databasetypehead'] = 'Veritabanı sürücüsü seçin';
+$string['dataroot'] = 'Veritabanı dizini';
+$string['datarootpermission'] = 'Veritabanı dizin izinleri';
 $string['dbprefix'] = 'Tablo öneki';
-$string['dirroot'] = 'Moodle Dizini';
-$string['environmenthead'] = 'Ortam kontrol ediliyor...';
+$string['dirroot'] = 'Moodle dizini';
+$string['environmenthead'] = 'Ortam kontrol ediliyor ...';
 $string['environmentsub2'] = 'Her Moodle dağıtımı, bazı PHP versiyon gereksinimi ve bir takım PHP uzantılarının yüklü olmalı zorunluluğuna sahiptir. Tüm ortam denetimi her yükleme ve güncellemeden önce yapılmalıdır. Eğer PHP \'nin yeni versiyonunu veya PHP uzantılarını nasıl yükleyeceğinizi bilmiyorsanız lütfen sunucu yöneticiniz ile iletişime geçiniz.';
 $string['errorsinenvironment'] = 'Ortam kontrolu başarısız oldu!';
 $string['installation'] = 'Kurulum';
@@ -72,10 +72,10 @@ için yapmasını isteyin.</li>
 (sayfanız altına baktığınızda bazı hatalar göreceksiniz)
 Böyle bir durumda .htaccess dosyasını silmeniz gerekiyor.</p></li>
 </ol>';
-$string['paths'] = 'Yollar';
+$string['paths'] = 'Dizin yolları';
 $string['pathserrcreatedataroot'] = 'Veri Klasörü ({$a->dataroot}) kurulum tarafından oluşturulamıyor.';
-$string['pathshead'] = 'Yolları doğrulayın';
-$string['pathsrodataroot'] = 'Veri yolu yazılabilir değil.';
+$string['pathshead'] = 'Dizin yollarını onayla';
+$string['pathsrodataroot'] = 'Veritabanı kök dizini yazılabilir değil.';
 $string['pathsroparentdataroot'] = 'Ana klasör ({$a->parent}) yazılabilir değil. Veri Klasörü ({$a->dataroot}) kurulum tarafından oluşturulamıyor.';
 $string['pathssubadmindir'] = 'Pek az web sunucusu /admin adresini kontrol paneline yada benzeri birşeye erişmek için kullanır. Ne yazık ki bu Moodle admin sayfalarının standart konumuyla bir karışıklık yaratır. Bu durumu düzeltmek için kurulumunuzdaki admin dizinini yeniden isimlendirip buraya yeni ismi yazınız. Örneğin: <em>moodleadmin</em>. Bu Moodle\'daki admin bağlantısını düzeltecektir.';
 $string['pathssubdataroot'] = '<p>Moodle\'ın yüklenen dosyaları kayıt etmesi için bir yere ihtiyacınız var. </p>

lib/externallib.php

@@ -706,7 +706,7 @@ function external_validate_format($format) {
  * All web service servers must set this singleton when parsing the $_GET and $_POST.
  *
  * @param string $text The content that may contain ULRs in need of rewriting.
- * @param int $textformat The text format, by default FORMAT_HTML.
+ * @param int $textformat The text format.
  * @param int $contextid This parameter and the next two identify the file area to use.
  * @param string $component
  * @param string $filearea helps identify the file area.
@@ -726,9 +726,8 @@ function external_format_text($text, $textformat, $contextid, $component, $filea
     }
 
     if (!$settings->get_raw()) {
-        $textformat = FORMAT_HTML; // Force format to HTML when not raw.
-        $text = format_text($text, $textformat,
-                array('noclean' => true, 'para' => false, 'filter' => $settings->get_filter()));
+        $text = format_text($text, $textformat, array('para' => false, 'filter' => $settings->get_filter()));
+        $textformat = FORMAT_HTML; // Once converted to html (from markdown, plain... lets inform consumer this is already HTML).
     }
 
     return array($text, $textformat);

lib/moodlelib.php

@@ -1029,10 +1029,16 @@ function clean_param($param, $type) {
             // Allow http absolute, root relative and relative URLs within wwwroot.
             $param = clean_param($param, PARAM_URL);
             if (!empty($param)) {
+
+                // Simulate the HTTPS version of the site.
+                $httpswwwroot = str_replace('http://', 'https://', $CFG->wwwroot);
+
                 if (preg_match(':^/:', $param)) {
                     // Root-relative, ok!
-                } else if (preg_match('/^'.preg_quote($CFG->wwwroot, '/').'/i', $param)) {
+                } else if (preg_match('/^' . preg_quote($CFG->wwwroot, '/') . '/i', $param)) {
                     // Absolute, and matches our wwwroot.
+                } else if (!empty($CFG->loginhttps) && preg_match('/^' . preg_quote($httpswwwroot, '/') . '/i', $param)) {
+                    // Absolute, and matches our httpswwwroot.
                 } else {
                     // Relative - let's make sure there are no tricks.
                     if (validateUrlSyntax('/' . $param, 's-u-P-a-p-f+q?r?')) {

lib/navigationlib.php

@@ -1167,7 +1167,7 @@ class global_navigation extends navigation_node {
                 // course node and not populate it.
 
                 // Not enrolled, can't view, and hasn't switched roles
-                if (!can_access_course($course)) {
+                if (!can_access_course($course, null, '', true)) {
                     if ($coursenode->isexpandable === true) {
                         // Obviously the situation has changed, update the cache and adjust the node.
                         // This occurs if the user access to a course has been revoked (one way or another) after
@@ -1183,9 +1183,7 @@ class global_navigation extends navigation_node {
                         $canviewcourseprofile = false;
                         break;
                     }
-                }
-
-                if ($coursenode->isexpandable === false) {
+                } else if ($coursenode->isexpandable === false) {
                     // Obviously the situation has changed, update the cache and adjust the node.
                     // This occurs if the user has been granted access to a course (one way or another) after initially
                     // logging in for this session.
@@ -1230,7 +1228,7 @@ class global_navigation extends navigation_node {
 
                 // If the user is not enrolled then we only want to show the
                 // course node and not populate it.
-                if (!can_access_course($course)) {
+                if (!can_access_course($course, null, '', true)) {
                     $coursenode->make_active();
                     $canviewcourseprofile = false;
                     break;
@@ -1269,7 +1267,7 @@ class global_navigation extends navigation_node {
 
                 // If the user is not enrolled then we only want to show the
                 // course node and not populate it.
-                if (!can_access_course($course)) {
+                if (!can_access_course($course, null, '', true)) {
                     $coursenode->make_active();
                     $canviewcourseprofile = false;
                     break;
@@ -2311,7 +2309,7 @@ class global_navigation extends navigation_node {
                     $usercoursenode->add(get_string('notes', 'notes'), $url, self::TYPE_SETTING);
                 }
 
-                if (can_access_course($usercourse, $user->id)) {
+                if (can_access_course($usercourse, $user->id, '', true)) {
                     $usercoursenode->add(get_string('entercourse'), new moodle_url('/course/view.php', array('id'=>$usercourse->id)), self::TYPE_SETTING, null, null, new pix_icon('i/course', ''));
                 }
 
@@ -2410,6 +2408,7 @@ class global_navigation extends navigation_node {
         } else if ($coursetype == self::COURSE_CURRENT) {
             $parent = $this->rootnodes['currentcourse'];
             $url = new moodle_url('/course/view.php', array('id'=>$course->id));
+            $canexpandcourse = $this->can_expand_course($course);
         } else if ($coursetype == self::COURSE_MY && !$forcegeneric) {
             if (!empty($CFG->navshowmycoursecategories) && ($parent = $this->rootnodes['mycourses']->find($course->category, self::TYPE_MY_CATEGORY))) {
                 // Nothing to do here the above statement set $parent to the category within mycourses.
@@ -2489,7 +2488,7 @@ class global_navigation extends navigation_node {
         $cache = $this->get_expand_course_cache();
         $canexpand = $cache->get($course->id);
         if ($canexpand === false) {
-            $canexpand = isloggedin() && can_access_course($course);
+            $canexpand = isloggedin() && can_access_course($course, null, '', true);
             $canexpand = (int)$canexpand;
             $cache->set($course->id, $canexpand);
         }
@@ -2845,7 +2844,7 @@ class global_navigation_for_ajax extends global_navigation {
                 break;
             case self::TYPE_COURSE :
                 $course = $DB->get_record('course', array('id' => $this->instanceid), '*', MUST_EXIST);
-                if (!can_access_course($course)) {
+                if (!can_access_course($course, null, '', true)) {
                     // Thats OK all courses are expandable by default. We don't need to actually expand it we can just
                     // add the course node and break. This leads to an empty node.
                     $this->add_course($course);
@@ -3239,7 +3238,7 @@ class navbar extends navigation_node {
             }
             $categories[] = $categorynode;
         }
-        if (is_enrolled(context_course::instance($this->page->course->id))) {
+        if (is_enrolled(context_course::instance($this->page->course->id), null, '', true)) {
             $courses = $this->page->navigation->get('mycourses');
         } else {
             $courses = $this->page->navigation->get('courses');
@@ -4129,7 +4128,7 @@ class settings_navigation extends navigation_node {
                 }
             } else {
                 $canviewusercourse = has_capability('moodle/user:viewdetails', $coursecontext);
-                $userisenrolled = is_enrolled($coursecontext, $user->id);
+                $userisenrolled = is_enrolled($coursecontext, $user->id, '', true);
                 if ((!$canviewusercourse && !$canviewuser) || !$userisenrolled) {
                     return false;
                 }

lib/setuplib.php

@@ -557,10 +557,16 @@ function get_exception_info($ex) {
         }
     }
 
-    // when printing an error the continue button should never link offsite
-    if (stripos($link, $CFG->wwwroot) === false &&
-        stripos($link, $CFG->httpswwwroot) === false) {
-        $link = $CFG->wwwroot.'/';
+    // When printing an error the continue button should never link offsite.
+    // We cannot use clean_param() here as it is not guaranteed that it has been loaded yet.
+    $httpswwwroot = str_replace('http:', 'https:', $CFG->wwwroot);
+    if (stripos($link, $CFG->wwwroot) === 0) {
+        // Internal HTTP, all good.
+    } else if (!empty($CFG->loginhttps) && stripos($link, $httpswwwroot) === 0) {
+        // Internal HTTPS, all good.
+    } else {
+        // External link spotted!
+        $link = $CFG->wwwroot . '/';
     }
 
     $info = new stdClass();

lib/tests/moodlelib_test.php

@@ -583,12 +583,32 @@ class core_moodlelib_testcase extends advanced_testcase {
 
     public function test_clean_param_localurl() {
         global $CFG;
-        $this->assertSame('', clean_param('http://google.com/', PARAM_LOCALURL));
-        $this->assertSame('', clean_param('http://some.very.long.and.silly.domain/with/a/path/', PARAM_LOCALURL));
-        $this->assertSame(clean_param($CFG->wwwroot, PARAM_LOCALURL), $CFG->wwwroot);
-        $this->assertSame('/just/a/path', clean_param('/just/a/path', PARAM_LOCALURL));
+        // External, invalid.
         $this->assertSame('', clean_param('funny:thing', PARAM_LOCALURL));
+        $this->assertSame('', clean_param('http://google.com/', PARAM_LOCALURL));
+        $this->assertSame('', clean_param('https://google.com/?test=true', PARAM_LOCALURL));
+        $this->assertSame('', clean_param('http://some.very.long.and.silly.domain/with/a/path/', PARAM_LOCALURL));
+
+        // Local absolute.
+        $this->assertSame(clean_param($CFG->wwwroot, PARAM_LOCALURL), $CFG->wwwroot);
+        $this->assertSame($CFG->wwwroot . '/with/something?else=true',
+            clean_param($CFG->wwwroot . '/with/something?else=true', PARAM_LOCALURL));
+
+        // Local relative.
+        $this->assertSame('/just/a/path', clean_param('/just/a/path', PARAM_LOCALURL));
         $this->assertSame('course/view.php?id=3', clean_param('course/view.php?id=3', PARAM_LOCALURL));
+
+        // Local absolute HTTPS.
+        $httpsroot = str_replace('http:', 'https:', $CFG->wwwroot);
+        $initialloginhttps = $CFG->loginhttps;
+        $CFG->loginhttps = false;
+        $this->assertSame('', clean_param($httpsroot, PARAM_LOCALURL));
+        $this->assertSame('', clean_param($httpsroot . '/with/something?else=true', PARAM_LOCALURL));
+        $CFG->loginhttps = true;
+        $this->assertSame($httpsroot, clean_param($httpsroot, PARAM_LOCALURL));
+        $this->assertSame($httpsroot . '/with/something?else=true',
+            clean_param($httpsroot . '/with/something?else=true', PARAM_LOCALURL));
+        $CFG->loginhttps = $initialloginhttps;
     }
 
     public function test_clean_param_file() {

lib/tests/setuplib_test.php

@@ -294,4 +294,113 @@ class core_setuplib_testcase extends advanced_testcase {
         // Prove that we cannot use array_merge_recursive() instead.
         $this->assertNotSame($expected, array_merge_recursive($original, $chunk));
     }
+
+    /**
+     * Test the link processed by get_exception_info().
+     */
+    public function test_get_exception_info_link() {
+        global $CFG, $SESSION;
+
+        $initialloginhttps = $CFG->loginhttps;
+        $httpswwwroot = str_replace('http:', 'https:', $CFG->wwwroot);
+        $CFG->loginhttps = false;
+
+        // Simple local URL.
+        $url = $CFG->wwwroot . '/something/here?really=yes';
+        $exception = new moodle_exception('none', 'error', $url);
+        $infos = $this->get_exception_info($exception);
+        $this->assertSame($url, $infos->link);
+
+        // Relative local URL.
+        $url = '/something/here?really=yes';
+        $exception = new moodle_exception('none', 'error', $url);
+        $infos = $this->get_exception_info($exception);
+        $this->assertSame($CFG->wwwroot . '/', $infos->link);
+
+        // HTTPS URL when login HTTPS is not enabled.
+        $url = $httpswwwroot . '/something/here?really=yes';
+        $exception = new moodle_exception('none', 'error', $url);
+        $infos = $this->get_exception_info($exception);
+        $this->assertSame($CFG->wwwroot . '/', $infos->link);
+
+        // HTTPS URL with login HTTPS.
+        $CFG->loginhttps = true;
+        $url = $httpswwwroot . '/something/here?really=yes';
+        $exception = new moodle_exception('none', 'error', $url);
+        $infos = $this->get_exception_info($exception);
+        $this->assertSame($url, $infos->link);
+
+        // External HTTP URL.
+        $url = 'http://moodle.org/something/here?really=yes';
+        $exception = new moodle_exception('none', 'error', $url);
+        $infos = $this->get_exception_info($exception);
+        $this->assertSame($CFG->wwwroot . '/', $infos->link);
+
+        // External HTTPS URL.
+        $url = 'https://moodle.org/something/here?really=yes';
+        $exception = new moodle_exception('none', 'error', $url);
+        $infos = $this->get_exception_info($exception);
+        $this->assertSame($CFG->wwwroot . '/', $infos->link);
+
+        // External URL containing local URL.
+        $url = 'http://moodle.org/something/here?' . $CFG->wwwroot;
+        $exception = new moodle_exception('none', 'error', $url);
+        $infos = $this->get_exception_info($exception);
+        $this->assertSame($CFG->wwwroot . '/', $infos->link);
+
+        // Internal link from fromurl.
+        $SESSION->fromurl = $url = $CFG->wwwroot . '/something/here?really=yes';
+        $exception = new moodle_exception('none');
+        $infos = $this->get_exception_info($exception);
+        $this->assertSame($url, $infos->link);
+
+        // Internal HTTPS link from fromurl.
+        $SESSION->fromurl = $url = $httpswwwroot . '/something/here?really=yes';
+        $exception = new moodle_exception('none');
+        $infos = $this->get_exception_info($exception);
+        $this->assertSame($url, $infos->link);
+
+        // Internal HTTPS link from fromurl without login HTTPS.
+        $CFG->loginhttps = false;
+        $SESSION->fromurl = $httpswwwroot . '/something/here?really=yes';
+        $exception = new moodle_exception('none');
+        $infos = $this->get_exception_info($exception);
+        $this->assertSame($CFG->wwwroot . '/', $infos->link);
+
+        // External link from fromurl.
+        $SESSION->fromurl = 'http://moodle.org/something/here?really=yes';
+        $exception = new moodle_exception('none');
+        $infos = $this->get_exception_info($exception);
+        $this->assertSame($CFG->wwwroot . '/', $infos->link);
+
+        // External HTTPS link from fromurl.
+        $SESSION->fromurl = 'https://moodle.org/something/here?really=yes';
+        $exception = new moodle_exception('none');
+        $infos = $this->get_exception_info($exception);
+        $this->assertSame($CFG->wwwroot . '/', $infos->link);
+
+        // External HTTPS link from fromurl with login HTTPS.
+        $CFG->loginhttps = true;
+        $SESSION->fromurl = 'https://moodle.org/something/here?really=yes';
+        $exception = new moodle_exception('none');
+        $infos = $this->get_exception_info($exception);
+        $this->assertSame($CFG->wwwroot . '/', $infos->link);
+
+        $CFG->loginhttps = $initialloginhttps;
+        $SESSION->fromurl = '';
+    }
+
+    /**
+     * Wrapper to call {@link get_exception_info()}.
+     *
+     * @param  Exception $ex An exception.
+     * @return stdClass of information.
+     */
+    public function get_exception_info($ex) {
+        try {
+            throw $ex;
+        } catch (moodle_exception $e) {
+            return get_exception_info($e);
+        }
+    }
 }

login/confirm.php

@@ -63,7 +63,6 @@ if (!empty($data) || (!empty($p) && !empty($s))) {
         $PAGE->set_heading($COURSE->fullname);
         echo $OUTPUT->header();
         echo $OUTPUT->box_start('generalbox centerpara boxwidthnormal boxaligncenter');
-        echo "<h3>".get_string("thanks").", ". fullname($user) . "</h3>\n";
         echo "<p>".get_string("alreadyconfirmed")."</p>\n";
         echo $OUTPUT->single_button("$CFG->wwwroot/course/", get_string('courses'));
         echo $OUTPUT->box_end();
@@ -78,12 +77,14 @@ if (!empty($data) || (!empty($p) && !empty($s))) {
             print_error('cannotfinduser', '', '', s($username));
         }
 
-        complete_user_login($user);
+        if (!$user->suspended) {
+            complete_user_login($user);
 
-        if ( ! empty($SESSION->wantsurl) ) {   // Send them where they were going
-            $goto = $SESSION->wantsurl;
-            unset($SESSION->wantsurl);
-            redirect($goto);
+            if ( ! empty($SESSION->wantsurl) ) {   // Send them where they were going.
+                $goto = $SESSION->wantsurl;
+                unset($SESSION->wantsurl);
+                redirect($goto);
+            }
         }
 
         $PAGE->navbar->add(get_string("confirmed"));

login/index.php

@@ -253,7 +253,9 @@ if (empty($SESSION->wantsurl)) {
                           $_SERVER["HTTP_REFERER"] != $CFG->wwwroot.'/' &&
                           $_SERVER["HTTP_REFERER"] != $CFG->httpswwwroot.'/login/' &&
                           strpos($_SERVER["HTTP_REFERER"], $CFG->httpswwwroot.'/login/?') !== 0 &&
-                          strpos($_SERVER["HTTP_REFERER"], $CFG->httpswwwroot.'/login/index.php') !== 0) // There might be some extra params such as ?lang=.
+                          strpos($_SERVER["HTTP_REFERER"], $CFG->httpswwwroot.'/login/index.php') !== 0 &&
+                          clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL) != '')
+                          // There might be some extra params such as ?lang=.
         ? $_SERVER["HTTP_REFERER"] : NULL;
 }
 

mod/choice/view.php

@@ -150,7 +150,7 @@
         } else if (!is_enrolled($context)) {
             // Only people enrolled can make a choice
             $SESSION->wantsurl = qualified_me();
-            $SESSION->enrolcancel = (!empty($_SERVER['HTTP_REFERER'])) ? $_SERVER['HTTP_REFERER'] : '';
+            $SESSION->enrolcancel = clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL);
 
             $coursecontext = context_course::instance($course->id);
             $courseshortname = format_string($course->shortname, true, array('context' => $coursecontext));

mod/data/lib.php

@@ -823,7 +823,7 @@ function data_tags_check($dataid, $template) {
     // then we generate strings to replace
     $tagsok = true; // let's be optimistic
     foreach ($fields as $field){
-        $pattern="/\[\[".$field->name."\]\]/i";
+        $pattern="/\[\[" . preg_quote($field->name, '/') . "\]\]/i";
         if (preg_match_all($pattern, $template, $dummy)>1){
             $tagsok = false;
             echo $OUTPUT->notification('[['.$field->name.']] - '.get_string('multipletags','data'));

mod/forum/lib.php

@@ -3976,14 +3976,10 @@ function forum_set_return() {
     global $CFG, $SESSION;
 
     if (! isset($SESSION->fromdiscussion)) {
-        if (!empty($_SERVER['HTTP_REFERER'])) {
-            $referer = $_SERVER['HTTP_REFERER'];
-        } else {
-            $referer = "";
-        }
+        $referer = clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL);
         // If the referer is NOT a login screen then save it.
         if (! strncasecmp("$CFG->wwwroot/login", $referer, 300)) {
-            $SESSION->fromdiscussion = $_SERVER["HTTP_REFERER"];
+            $SESSION->fromdiscussion = $referer;
         }
     }
 }

mod/forum/post.php

@@ -87,9 +87,10 @@ if (!isloggedin() or isguestuser()) {
     $PAGE->set_context($modcontext);
     $PAGE->set_title($course->shortname);
     $PAGE->set_heading($course->fullname);
+    $referer = clean_param(get_referer(false), PARAM_LOCALURL);
 
     echo $OUTPUT->header();
-    echo $OUTPUT->confirm(get_string('noguestpost', 'forum').'<br /><br />'.get_string('liketologin'), get_login_url(), get_referer(false));
+    echo $OUTPUT->confirm(get_string('noguestpost', 'forum').'<br /><br />'.get_string('liketologin'), get_login_url(), $referer);
     echo $OUTPUT->footer();
     exit;
 }
@@ -116,7 +117,7 @@ if (!empty($forum)) {      // User is starting a new discussion in a forum
             if (!is_enrolled($coursecontext)) {
                 if (enrol_selfenrol_available($course->id)) {
                     $SESSION->wantsurl = qualified_me();
-                    $SESSION->enrolcancel = $_SERVER['HTTP_REFERER'];
+                    $SESSION->enrolcancel = clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL);
                     redirect($CFG->wwwroot.'/enrol/index.php?id='.$course->id, get_string('youneedtoenrol'));
                 }
             }
@@ -134,7 +135,6 @@ if (!empty($forum)) {      // User is starting a new discussion in a forum
         $SESSION->fromurl = '';
     }
 
-
     // Load up the $post variable.
 
     $post = new stdClass();
@@ -186,7 +186,7 @@ if (!empty($forum)) {      // User is starting a new discussion in a forum
         if (!isguestuser()) {
             if (!is_enrolled($coursecontext)) {  // User is a guest here!
                 $SESSION->wantsurl = qualified_me();
-                $SESSION->enrolcancel = $_SERVER['HTTP_REFERER'];
+                $SESSION->enrolcancel = clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL);
                 redirect($CFG->wwwroot.'/enrol/index.php?id='.$course->id, get_string('youneedtoenrol'));
             }
         }

mod/quiz/db/access.php

@@ -108,7 +108,7 @@ $capabilities = array(
 
     // Manually grade and comment on student attempts at a question.
     'mod/quiz:grade' => array(
-        'riskbitmask' => RISK_SPAM,
+        'riskbitmask' => RISK_SPAM | RISK_XSS,
         'captype' => 'write',
         'contextlevel' => CONTEXT_MODULE,
         'archetypes' => array(

mod/quiz/renderer.php

@@ -809,8 +809,8 @@ class mod_quiz_renderer extends plugin_renderer_base {
         $output .= $this->view_information($quiz, $cm, $context, $messages);
         $guestno = html_writer::tag('p', get_string('guestsno', 'quiz'));
         $liketologin = html_writer::tag('p', get_string('liketologin'));
-        $output .= $this->confirm($guestno."\n\n".$liketologin."\n", get_login_url(),
-                get_referer(false));
+        $referer = clean_param(get_referer(false), PARAM_LOCALURL);
+        $output .= $this->confirm($guestno."\n\n".$liketologin."\n", get_login_url(), $referer);
         return $output;
     }
 

mod/survey/save.php

@@ -64,7 +64,7 @@
     echo $OUTPUT->heading($survey->name);
 
     if (survey_already_done($survey->id, $USER->id)) {
-        notice(get_string("alreadysubmitted", "survey"), $_SERVER["HTTP_REFERER"]);
+        notice(get_string("alreadysubmitted", "survey"), clean_param($_SERVER["HTTP_REFERER"], PARAM_LOCALURL));
         exit;
     }
 

mod/wiki/filesedit.php

@@ -60,10 +60,11 @@ if (!wiki_user_can_view($subwiki, $wiki)) {
 require_capability('mod/wiki:managefiles', $context);
 
 if (empty($returnurl)) {
-    if (!empty($_SERVER["HTTP_REFERER"])) {
-        $returnurl = $_SERVER["HTTP_REFERER"];
+    $referer = clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL);
+    if (!empty($referer)) {
+        $returnurl = $referer;
     } else {
-        $returnurl = new moodle_url('/mod/wiki/files.php', array('subwiki'=>$subwiki->id));
+        $returnurl = new moodle_url('/mod/wiki/files.php', array('subwiki' => $subwiki->id, 'pageid' => $pageid));
     }
 }
 

user/view.php

@@ -102,8 +102,9 @@ if ($currentuser) {
     if (!is_viewing($coursecontext) && !is_enrolled($coursecontext)) { // Need to have full access to a course to see the rest of own info
         echo $OUTPUT->header();
         echo $OUTPUT->heading(get_string('notenrolled', '', $fullname));
-        if (!empty($_SERVER['HTTP_REFERER'])) {
-            echo $OUTPUT->continue_button($_SERVER['HTTP_REFERER']);
+        $referer = clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL);
+        if (!empty($referer)) {
+            echo $OUTPUT->continue_button($referer);
         }
         echo $OUTPUT->footer();
         die;
@@ -133,8 +134,9 @@ if ($currentuser) {
             $PAGE->navbar->add($struser);
             echo $OUTPUT->heading(get_string('notenrolledprofile'));
         }
-        if (!empty($_SERVER['HTTP_REFERER'])) {
-            echo $OUTPUT->continue_button($_SERVER['HTTP_REFERER']);
+        $referer = clean_param($_SERVER['HTTP_REFERER'], PARAM_LOCALURL);
+        if (!empty($referer)) {
+            echo $OUTPUT->continue_button($referer);
         }
         echo $OUTPUT->footer();
         exit;

version.php

@@ -29,11 +29,11 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$version  = 2013111810.00;              // 20131118      = branching date YYYYMMDD - do not modify!
+$version  = 2013111811.01;              // 20131118      = branching date YYYYMMDD - do not modify!
                                         //         RR    = release increments - 00 in DEV branches.
                                         //           .XX = incremental changes.
 
-$release  = '2.6.10 (Build: 20150310)'; // Human-friendly version name
+$release  = '2.6.11+ (Build: 20150619)'; // Human-friendly version name
 
 $branch   = '26';                       // This version's branch.
 $maturity = MATURITY_STABLE;             // This version's maturity level.