Moodle release 2.7.20

MDL-58740 block_course_overview: check session key
Thanks to Kukas Schmidt for initial patch
2017-05-07 21:32:36 +02:00 · 2017-05-04 08:55:16 +08:00 · 2017-05-04 08:55:16 +08:00 · 2017-05-04 08:55:16 +08:00 · 2017-05-03 10:27:36 +08:00 · 2017-05-03 09:20:29 +08:00
53 changed files with 3202 additions and 2344 deletions
@@ -1145,6 +1145,11 @@
          <ON_CHECK message="unsupporteddbtablerowformat" />
        </FEEDBACK>
      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_libcurl_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="libcurlwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
    </CUSTOM_CHECKS>
  </MOODLE>
  <MOODLE version="2.8" requires="2.2">
@@ -1418,6 +1423,11 @@
          <ON_CHECK message="unsupporteddbtablerowformat" />
        </FEEDBACK>
      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_libcurl_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="libcurlwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
    </CUSTOM_CHECKS>
  </MOODLE>
  <MOODLE version="3.0" requires="2.2">
@@ -1434,6 +1444,7 @@
      <VENDOR name="oracle" version="10.2" />
    </DATABASE>
    <PHP version="5.4.4" level="required">
+      <RESTRICT function="restrict_php_version_71" message="unsupportedphpversion71" />
    </PHP>
    <PCREUNICODE level="optional">
      <FEEDBACK>
@@ -1556,6 +1567,11 @@
          <ON_CHECK message="unsupporteddbtablerowformat" />
        </FEEDBACK>
      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_libcurl_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="libcurlwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
    </CUSTOM_CHECKS>
  </MOODLE>
  <MOODLE version="3.1" requires="2.7">
@@ -1572,6 +1588,7 @@
      <VENDOR name="oracle" version="10.2" />
    </DATABASE>
    <PHP version="5.4.4" level="required">
+      <RESTRICT function="restrict_php_version_71" message="unsupportedphpversion71" />
    </PHP>
    <PCREUNICODE level="optional">
      <FEEDBACK>
@@ -1696,6 +1713,11 @@
          <ON_CHECK message="unsupporteddbtablerowformat" />
        </FEEDBACK>
      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_libcurl_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="libcurlwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
    </CUSTOM_CHECKS>
  </MOODLE>
  <MOODLE version="3.2" requires="2.7">
@@ -1841,6 +1863,187 @@
          <ON_CHECK message="unoconvwarning" />
        </FEEDBACK>
      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_libcurl_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="libcurlwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+    </CUSTOM_CHECKS>
+  </MOODLE>
+  <MOODLE version="3.3" requires="2.7">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mariadb" version="5.5.31" />
+      <VENDOR name="mysql" version="5.5.31" />
+      <VENDOR name="postgres" version="9.3" />
+      <VENDOR name="mssql" version="10.0" />
+      <VENDOR name="oracle" version="10.2" />
+    </DATABASE>
+    <PHP version="5.6.5" level="required">
+    </PHP>
+    <PCREUNICODE level="optional">
+      <FEEDBACK>
+        <ON_CHECK message="pcreunicodewarning" />
+      </FEEDBACK>
+    </PCREUNICODE>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="opensslrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zlib" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="gdrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlreader" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="intlrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="hash" level="required"/>
+      <PHP_EXTENSION name="fileinfo" level="required"/>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="96M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="opcache.enable" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opcacherecommended" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+    <CUSTOM_CHECKS>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_storage_engine" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbstorageengine" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="question/engine/upgrade/upgradelib.php" function="quiz_attempts_upgraded" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="quizattemptsupgradedmessage" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_slasharguments" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="slashargumentswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_tables_row_format" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unsupporteddbtablerowformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_unoconv_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unoconvwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_libcurl_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="libcurlwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_format" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfileformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_per_table" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfilepertable" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_large_prefix" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddblargeprefix" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_is_https" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="ishttpswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_incomplete_unicode_support" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="incompleteunicodesupport" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
    </CUSTOM_CHECKS>
  </MOODLE>
 </COMPATIBILITY_MATRIX>
@@ -27,9 +27,12 @@ if (isloggedin()) {
    $primaryadminemail = NULL;
    $primaryadminname  = NULL;
 }
-$temp->add(new admin_setting_configtext('supportname', new lang_string('supportname', 'admin'), new lang_string('configsupportname', 'admin'), $primaryadminname, PARAM_NOTAGS));
-$temp->add(new admin_setting_configtext('supportemail', new lang_string('supportemail', 'admin'), new lang_string('configsupportemail', 'admin'), $primaryadminemail, PARAM_NOTAGS));
-$temp->add(new admin_setting_configtext('supportpage', new lang_string('supportpage', 'admin'), new lang_string('configsupportpage', 'admin'), '', PARAM_URL));
+$temp->add(new admin_setting_configtext('supportname', new lang_string('supportname', 'admin'),
+    new lang_string('configsupportname', 'admin'), $primaryadminname, PARAM_NOTAGS));
+$temp->add(new admin_setting_configtext('supportemail', new lang_string('supportemail', 'admin'),
+    new lang_string('configsupportemail', 'admin'), $primaryadminemail, PARAM_EMAIL));
+$temp->add(new admin_setting_configtext('supportpage', new lang_string('supportpage', 'admin'),
+    new lang_string('configsupportpage', 'admin'), '', PARAM_URL));
 $ADMIN->add('server', $temp);


@@ -64,7 +64,7 @@ class block_course_overview extends block_base {
        $content = array();

        $updatemynumber = optional_param('mynumber', -1, PARAM_INT);
-        if ($updatemynumber >= 0) {
+        if ($updatemynumber >= 0 && optional_param('sesskey', '', PARAM_RAW) && confirm_sesskey()) {
            block_course_overview_update_mynumber($updatemynumber);
        }

@@ -125,4 +125,4 @@ class block_course_overview extends block_base {
        $config = get_config('block_course_overview');
        return !empty($config->showwelcomearea);
    }
-}
+}
@@ -82,7 +82,7 @@ function block_course_overview_get_myorder() {
    // If preference was not found, look in the old location and convert if found.
    $order = array();
    if ($value = get_user_preferences('course_overview_course_order')) {
-        $order = unserialize($value);
+        $order = unserialize_array($value);
        block_course_overview_update_myorder($order);
        unset_user_preference('course_overview_course_order');
    }
@@ -191,7 +191,7 @@ class block_course_overview_renderer extends plugin_renderer_base {
        for ($i = 1; $i <= $max; $i++) {
            $options[$i] = $i;
        }
-        $url = new moodle_url('/my/index.php');
+        $url = new moodle_url('/my/index.php', ['sesskey' => sesskey()]);
        $select = new single_select($url, 'mynumber', $options, block_course_overview_get_max_user_courses(), array());
        $select->set_label(get_string('numtodisplay', 'block_course_overview'));
        $output .= $this->output->render($select);
@@ -52,11 +52,11 @@ $action = (empty($id)) ? 'add' : 'edit';

 $external = new stdClass();

-// Check that this id exists
-if (!empty($id) && !$DB->record_exists('blog_external', array('id' => $id))) {
-    print_error('wrongexternalid', 'blog');
-} elseif (!empty($id)) {
-    $external = $DB->get_record('blog_external', array('id' => $id));
+// Retrieve the external blog record.
+if (!empty($id)) {
+    if (!$external = $DB->get_record('blog_external', array('id' => $id, 'userid' => $USER->id))) {
+        print_error('wrongexternalid', 'blog');
+    }
 }

 $strformheading = ($action == 'edit') ? get_string('editexternalblog', 'blog') : get_string('addnewexternalblog', 'blog');
@@ -891,7 +891,7 @@ function blog_get_headers($courseid=null, $groupid=null, $userid=null, $tagid=nu
        }

        // Append Search info
-        if (!empty($search)) {
+        if (!empty($search) && has_capability('moodle/blog:search', $sitecontext)) {
            $headers['filters']['search'] = $search;
            $blogurl->param('search', $search);
            $PAGE->navbar->add(get_string('searchterm', 'blog', $search), $blogurl->out());
@@ -1605,7 +1605,7 @@ class grade_report_grader extends grade_report {

        // Try looking for old location of user setting that used to store all courses in one serialized user preference.
        if (($oldcollapsedpref = get_user_preferences('grade_report_grader_collapsed_categories')) !== null) {
-            if ($collapsedall = @unserialize($oldcollapsedpref)) {
+            if ($collapsedall = unserialize_array($oldcollapsedpref)) {
                // We found the old-style preference, filter out only categories that belong to this course and update the prefs.
                $collapsed = static::filter_collapsed_categories($courseid, $collapsedall);
                if (!empty($collapsed['aggregatesonly']) || !empty($collapsed['gradesonly'])) {
@@ -32,20 +32,21 @@ defined('MOODLE_INTERNAL') || die();

 $string['cannotcreatedboninstall'] = '<p>No és pot crear la base de dades.</p> <p>La base de dades especificada no existeix i l\'usuari que heu proporcionat no té permís per a crear-la.</p>
 <p>L\'administrador del lloc hauria de verificar la configuració de la base de dades.</p>';
-$string['cannotcreatelangdir'] = 'No s\'ha pogut crear el directori d\'idiomes.';
+$string['cannotcreatelangdir'] = 'No s\'ha pogut crear el directori d\'idiomes';
 $string['cannotcreatetempdir'] = 'No s\'ha pogut crear el directori temporal';
 $string['cannotdownloadcomponents'] = 'No s\'han pogut baixar components';
-$string['cannotdownloadzipfile'] = 'No s\'ha pogut baixar el fitxer zip';
+$string['cannotdownloadzipfile'] = 'No s\'ha pogut baixar el fitxer ZIP';
 $string['cannotfindcomponent'] = 'No s\'ha pogut trobar el component';
 $string['cannotsavemd5file'] = 'No s\'ha pogut desar el fitxer md5';
-$string['cannotsavezipfile'] = 'No s\'ha pogut desar el fitxer zip';
+$string['cannotsavezipfile'] = 'No s\'ha pogut desar el fitxer ZIP';
 $string['cannotunzipfile'] = 'No s\'ha pogut descomprimir el fitxer';
-$string['componentisuptodate'] = 'El component està al dia';
+$string['componentisuptodate'] = 'El component està actualitzat';
 $string['dmlexceptiononinstall'] = '<p>S\'ha produït un error de la base de dades [{$a->errorcode}].<br />{$a->debuginfo}</p>';
 $string['downloadedfilecheckfailed'] = 'Ha fallat la comprovació del fitxer baixat';
 $string['invalidmd5'] = 'L\'md5 no és vàlid. Torneu-ho a provar';
 $string['missingrequiredfield'] = 'Falta algun camp necessari';
-$string['remotedownloaderror'] = 'No s\'ha pogut baixar el component al vostre servidor. Verifiqueu els paràmetres de servidor intermediari. Es recomana l\'extensió cURL.<br /><br />Haureu de baixar manualment el fitxer <a href="{$a->url}">{$a->url}</a>, copiar-lo a la ubicació "{$a->dest}" del vostre servidor i descomprimir-lo allí.';
+$string['remotedownloaderror'] = '<p>No s\'ha pogut baixar el component al vostre servidor. Verifiqueu els paràmetres del servidor intermediari. Es recomana vivament l\'extensió cURL de PHP.</p>
+<p>Haureu de baixar manualment el fitxer <a href="{$a->url}">{$a->url}</a>, copiar-lo a la ubicació «{$a->dest}» del vostre servidor i descomprimir-lo allí.</p>';
 $string['wrongdestpath'] = 'El camí de destinació és erroni';
 $string['wrongsourcebase'] = 'L\'adreça (URL) base de la font és errònia';
 $string['wrongzipfilename'] = 'El nom del fitxer ZIP és erroni';
@@ -34,7 +34,7 @@ $string['admindirname'] = 'Directori d\'administració';
 $string['availablelangs'] = 'Llista d\'idiomes disponibles';
 $string['chooselanguagehead'] = 'Trieu un idioma';
 $string['chooselanguagesub'] = 'Trieu un idioma per a la instal·lació. S\'utilitzarà també com a idioma per defecte del lloc, tot i que després podeu canviar-lo.';
-$string['clialreadyconfigured'] = 'El fitxer config.php ja existeix, feu servir dmin/cli/install_database.php si voleu instal·lar aquest lloc web.';
+$string['clialreadyconfigured'] = 'El fitxer config.php ja existeix, feu servir admin/cli/install_database.php si voleu instal·lar el Moodle en aquest lloc web.';
 $string['clialreadyinstalled'] = 'El fitxer de configuració config.php ja existeix. Feu servir admin/cli/upgrade.php si voleu actualitzar Moodle per a aquest lloc web.';
 $string['cliinstallheader'] = 'Programa d\'instal·lació de línia d\'ordres de Moodle {$a}';
 $string['databasehost'] = 'Servidor de base de dades:';
@@ -68,7 +68,10 @@ $string['pathshead'] = 'Confirmeu els camins';
 $string['pathsrodataroot'] = 'No es pot escriure en el directori dataroot.';
 $string['pathsroparentdataroot'] = 'No es pot escriure en el directori pare ({$a->parent}). L\'instal·lador no pot crear el directori ({$a->dataroot}).';
 $string['pathssubadmindir'] = 'Alguns serveis d\'allotjament web (pocs) utilitzen /admin com a URL especial perquè accediu a un tauler de control o quelcom semblant. Malauradament, això entra en conflicte amb la ubicació estàndard de les pàgines d\'administració de Moodle. Podeu arreglar aquest problema canviant el nom del directori d\'administració de Moodle en la vostra instal·lació i posant el nou nom aquí. Per exemple: <em>moodleadmin</em>. Això arreglarà els enllaços d\'administració de Moodle.';
-$string['pathssubdataroot'] = 'Necessiteu un espai on Moodle pugui desar els fitxers penjats. Aquest directori hauria de tenir permisos de lectura I ESCRIPTURA per a l\'usuari del servidor web (normalment \'nobody\' o \'apache\'), però no cal que sigui accessible directament via web. L\'instal·lador provarà de crear-lo si no existeix.';
+$string['pathssubdataroot'] = '<p>Directori on el Moodle emmagatzemarà els materials pujats pels usuaris.</p>
+<p>Aquest directori hauria de tenir permisos de lectura i escriptura per a l\'usuari del servidor web (normalment \'www-data\', \'nobody\', or \'apache\').</p>
+<p>No ha de ser accessible directament via web.</p>
+<p>L\'instal·lador provarà de crear-lo si no existeix.</p>';
 $string['pathssubdirroot'] = 'Camí complet del directori d\'instal·lació de Moodle.';
 $string['pathssubwwwroot'] = '<p>L\'adreça web completa on s\'accedirà a Moodle; per exemple, l\'adreça que els usuaris introduiran a la barra d\'adreces del navegador per accedir a Moodle.</p> <p> No és possible accedir a Moodle utilitzant diferents adreces. Si el vostre lloc és accessible a través de diferents adreces, trieu-ne la més fàcil i configureu una redirecció permanent per a cadascuna de les altres adreces.</p> <p>
 Si el vostre lloc és accessible tant des d\'Internet com des d\'una xarxa interna (anomenada de vegades intranet), utilitzeu l\'adreça pública aquí.</p> <p>Si l\'adreça actual no és correcta, canvieu l\'URL a la barra d\'adreces del navegador i reinicieu la instal·lació.';
@@ -30,5 +30,6 @@

 defined('MOODLE_INTERNAL') || die();

+$string['parentlanguage'] = '';
 $string['thisdirection'] = 'ltr';
 $string['thislanguage'] = 'Català';
@@ -69,9 +69,15 @@ $string['pathshead'] = 'Potvrdit cesty';
 $string['pathsrodataroot'] = 'Do datového adresáře nelze zapisovat.';
 $string['pathsroparentdataroot'] = 'Do nadřazeného adresáře ({$a->parent}) nelze zapisovat. Datový adresář ({$a->dataroot}) nemůže být tímto průvodcem instalací vytvořen.';
 $string['pathssubadmindir'] = 'Na některých serverech je URL adresa /admin vyhrazena pro speciální účely (např. pro ovládací panel). Na takových serverech může dojít ke kolizi se standardním umístěním stránek pro správu Moodle. Máte-li tento problém, přejmenujte adresář <eM>admin</em> ve vaší instalaci Moodle a sem zadejte jeho nový název - například <em>moodleadmin</em>. Všechny generované odkazy na stránky správy Moodle budou používat tento nový název.';
-$string['pathssubdataroot'] = 'Moodle potřebuje prostor, kam si bude ukládat nahrané soubory a další údaje. K tomuto adresáři musí mít proces webového serveru právo ke čtení i k zápisu (webový server bývá většinou spouštěn pod uživatelem "www-data" nebo "apache"). Tento adresář ale zároveň nesmí být dostupný přímo přes webové rozhraní. Instalační skript se pokusí tento adresář vytvořit, pokud nebude existovat.';
+$string['pathssubdataroot'] = '<p>Moodle potřebuje prostor, kam si bude ukládat nahrané soubory a další údaje. .</p>
+<p>K tomuto adresáři musí mít proces webového serveru právo ke čtení i k zápisu (webový server bývá většinou spouštěn pod uživatelem "www-data" nebo "apache"). .</p>
+<p>Tento adresář ale zároveň nesmí být dostupný přímo přes webové rozhraní. .</p>
+<p>Instalační skript se pokusí tento adresář vytvořit, pokud nebude existovat..</p>';
 $string['pathssubdirroot'] = 'Absolutní cesta k adresáři s instalací Moodle';
-$string['pathssubwwwroot'] = 'Zadejte úplnou webovou adresu, na níž bude Moodle dostupný. Moodle potřebuje jedinečnou adresu, není možné jej provozovat na několika URL současně. Používáte-li několik veřejných domén, musíte si sami nastavit permanentní přesměrování na jednu z nich a tu pak použít. Pokud je váš server dostupný z vnější a z vnitřní sítě pod různými IP adresami, použijte jeho veřejnou adresu a nastavte si váš DNS server tak, že ji mohou používat i uživatelé z vnitřní sítě.';
+$string['pathssubwwwroot'] = '<p>Zadejte úplnou webovou adresu, na níž bude Moodle dostupný, t.j. adresa, kterou zadají uživatelé do adresního řádku svého prohlížeče, aby spustili Moodle.</p>
+<p>Moodle potřebuje jedinečnou adresu, není možné jej provozovat na několika URL současně. Používáte-li několik veřejných domén, musíte si sami nastavit permanentní přesměrování na jednu z nich a tu pak použít.</p>
+<p> Pokud je váš server dostupný z vnější a z vnitřní sítě pod různými IP adresami, použijte jeho veřejnou adresu a nastavte si váš DNS server tak, že ji mohou používat i uživatelé z vnitřní sítě.</p>
+<p>Pokud aktuální adresa není správná, změňte URL adresu v adresním řádku prohlížeče a spusťte instalaci.</p>';
 $string['pathsunsecuredataroot'] = 'Umístění datového adresáře není bezpečné';
 $string['pathswrongadmindir'] = 'Adresář pro správu serveru (admin) neexistuje';
 $string['phpextension'] = '{$a} PHP rozšíření';
@@ -82,7 +88,7 @@ $string['phpversionhelp'] = '<p>Moodle vyžaduje PHP alespoň verze 4.3.0 nebo 5
 (U PHP 5.0.x můžete také přejít na nižší verzi 4.4.x )</p>';
 $string['welcomep10'] = '{$a->installername} ({$a->installerversion})';
 $string['welcomep20'] = 'Podařilo se vám úspěšně nainstalovat a spustit balíček <strong>{$a->packname} {$a->packversion}</strong>. Gratulujeme!';
-$string['welcomep30'] = '<strong>{$a->installername}</strong> obsahuje aplikace k vytvoření prostředí, ve kterém bude provozován váš <strong>Moodle</strong>. Jmenovitě se jedná o:';
+$string['welcomep30'] = 'Tato verze <strong>{$a->installername}</strong> obsahuje aplikace k vytvoření prostředí, ve kterém bude provozován váš <strong>Moodle</strong>. Jmenovitě se jedná o:';
 $string['welcomep40'] = 'Balíček rovněž obsahuje <strong>Moodle ve verzi {$a->moodlerelease} ({$a->moodleversion})</strong>.';
 $string['welcomep50'] = 'Použití všech aplikací v tomto balíčku je vázáno jejich příslušnými licencemi. Kompletní balíček <strong>{$a->installername}</strong> je software s <a href="http://www.opensource.org/docs/definition_plain.html"> otevřeným kódem (open source)</a> a je šířen pod licencí <a href="http://www.gnu.org/copyleft/gpl.html">GPL</a>.';
 $string['welcomep60'] = 'Následující stránky vás v několik jednoduchých krocích nastavením <strong>Moodlu</strong> na vašem počítači. Můžete přijmout výchozí nastavení, nebo si je upravit podle svých potřeb.';
@@ -40,9 +40,11 @@ $string['cannotsavemd5file'] = 'Kan ikke gemme md5-fil';
 $string['cannotsavezipfile'] = 'Kan ikke gemme zip-fil';
 $string['cannotunzipfile'] = 'Kan ikke pakke filen ud';
 $string['componentisuptodate'] = 'Komponenten er ajour';
+$string['dmlexceptiononinstall'] = '<p>En databasefejl er opstået [{$a->errorcode}].<br />{$a->debuginfo}</p>';
 $string['downloadedfilecheckfailed'] = 'Downloadet fil-tjek fejlede';
 $string['invalidmd5'] = 'Tjekvariablen var forkert - prøv igen';
 $string['missingrequiredfield'] = 'Der mangler nogle obligatoriske felter';
+$string['remotedownloaderror'] = '<p>Download af komponent til din server fejlede. Verificer venligst proxy-indstillilngerne; udvidelsen PHP cURL  anbefales kraftigt. </p> <p>Du må downloade filen <a href="{$a->url}">{$a->url}</a> manuelt, kopier den til "{$a->dest}" på din server og udpakke den der.</p>';
 $string['wrongdestpath'] = 'Forkert destinationssti';
 $string['wrongsourcebase'] = 'Forkert kilde-URL';
 $string['wrongzipfilename'] = 'Forkert zip-filnavn';
@@ -41,7 +41,8 @@ $string['databasehost'] = 'Databasevært';
 $string['databasename'] = 'Databasenavn';
 $string['databasetypehead'] = 'Vælg databasedriver';
 $string['dataroot'] = 'Datamappe';
-$string['dbprefix'] = 'Præfix for tabeller';
+$string['datarootpermission'] = 'Rettighed til datamapper';
+$string['dbprefix'] = 'Præfiks for tabeller';
 $string['dirroot'] = 'Moodle-mappe';
 $string['environmenthead'] = 'Kontrollerer din serveropsætning...';
 $string['environmentsub2'] = 'Hver version af Moodle har nogle minimumskrav til PHP-version og nogle obligatoriske PHP-extensions.
@@ -30,4 +30,5 @@

 defined('MOODLE_INTERNAL') || die();

+$string['cannotfindcomponent'] = 'کامپوننت پیدا نشد';
 $string['missingrequiredfield'] = 'بعضی از فیلدهای ضروری خالی است';
@@ -34,6 +34,8 @@ $string['admindirname'] = 'دایرکتوری مدیر';
 $string['availablelangs'] = 'بسته‌های زبانی موجود';
 $string['chooselanguagehead'] = 'انتخاب زبان';
 $string['chooselanguagesub'] = 'لطفاً زبانی را به جهت استفاده در حین نصب انتخاب نمائید. زبان سایت و کاربر را در صفحه‌ای دیگر می‌توانید انتخاب کنید.';
+$string['databasehost'] = 'میزبان پایگاه داده';
+$string['databasename'] = 'نام پایگاه داده';
 $string['dataroot'] = 'دایرکتوری داده';
 $string['dbprefix'] = 'پیشوند جدول‌ها';
 $string['dirroot'] = 'دایرکتوری مودل';
@@ -41,5 +41,5 @@ $string['cliunknowoption'] = 'אפשרויות לא מוכרות :
 {$a}
 אנא השתמש באפשרות העזרה.';
 $string['cliyesnoprompt'] = 'רשום y (שפרושו כן) או n (שפרושו לא)';
-$string['environmentrequireinstall'] = 'נדרש להתקין/לאפשר זאת';
-$string['environmentrequireversion'] = 'גירסת {$a->needed} נדרשת אך הגירסה הנוכחית היא {$a->current}';
+$string['environmentrequireinstall'] = 'נדרש להתקין ולאפשר הרחבה זו';
+$string['environmentrequireversion'] = 'גירסה {$a->needed} נדרשת אך הגירסה הנוכחית היא {$a->current}';
@@ -32,5 +32,8 @@ defined('MOODLE_INTERNAL') || die();

 $string['clianswerno'] = 'ոչ';
 $string['cliansweryes'] = 'այո';
+$string['cliincorrectvalueerror'] = 'Սխալ, "{$a->value}"-ը ոչ ճիշտ արժեք է  "{$a->option}"-ի համար';
+$string['cliincorrectvalueretry'] = 'Ոչ ճիշտ արժեք, կրկին փորձեք';
+$string['cliyesnoprompt'] = 'Մեքենագրեք y (նշանակում է այո) կամ n (նշանակում է ոչ):';
 $string['environmentrequireinstall'] = 'անհրաժեշտ է, որպեսզի  տեղակայված և թույլատրված լինի';
 $string['environmentrequireversion'] = 'պահանջվում է {$a->needed} տարբերակը, դուք գործարկում եք՝ {$a->current}';
@@ -0,0 +1,33 @@
+<?php
+
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Automatically generated strings for Moodle installer
+ *
+ * Do not edit this file manually! It contains just a subset of strings
+ * needed during the very first steps of installation. This file was
+ * generated automatically by export-installer.php (which is part of AMOS
+ * {@link http://docs.moodle.org/dev/Languages/AMOS}) using the
+ * list of strings defined in /install/stringnames.txt.
+ *
+ * @package   installer
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$string['thislanguage'] = 'Taqbaylit';
@@ -0,0 +1,33 @@
+<?php
+
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Automatically generated strings for Moodle installer
+ *
+ * Do not edit this file manually! It contains just a subset of strings
+ * needed during the very first steps of installation. This file was
+ * generated automatically by export-installer.php (which is part of AMOS
+ * {@link http://docs.moodle.org/dev/Languages/AMOS}) using the
+ * list of strings defined in /install/stringnames.txt.
+ *
+ * @package   installer
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$string['thislanguage'] = 'Malagasy';
@@ -0,0 +1,34 @@
+<?php
+
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Automatically generated strings for Moodle installer
+ *
+ * Do not edit this file manually! It contains just a subset of strings
+ * needed during the very first steps of installation. This file was
+ * generated automatically by export-installer.php (which is part of AMOS
+ * {@link http://docs.moodle.org/dev/Languages/AMOS}) using the
+ * list of strings defined in /install/stringnames.txt.
+ *
+ * @package   installer
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$string['parentlanguage'] = '';
+$string['thislanguage'] = 'Crnogorski';
@@ -0,0 +1,33 @@
+<?php
+
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Automatically generated strings for Moodle installer
+ *
+ * Do not edit this file manually! It contains just a subset of strings
+ * needed during the very first steps of installation. This file was
+ * generated automatically by export-installer.php (which is part of AMOS
+ * {@link http://docs.moodle.org/dev/Languages/AMOS}) using the
+ * list of strings defined in /install/stringnames.txt.
+ *
+ * @package   installer
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$string['paths'] = 'ठेगानाहरु';
@@ -0,0 +1,33 @@
+<?php
+
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Automatically generated strings for Moodle installer
+ *
+ * Do not edit this file manually! It contains just a subset of strings
+ * needed during the very first steps of installation. This file was
+ * generated automatically by export-installer.php (which is part of AMOS
+ * {@link http://docs.moodle.org/dev/Languages/AMOS}) using the
+ * list of strings defined in /install/stringnames.txt.
+ *
+ * @package   installer
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$string['next'] = 'अर्को';
@@ -88,6 +88,6 @@ $string['welcomep30'] = 'Deze uitgave van <strong>{$a->installername}</strong> b
 $string['welcomep40'] = 'Dit pakket bevat ook <strong>Moodle {$a->moodlerelease} ({$a->moodleversion})</strong>.';
 $string['welcomep50'] = 'Het gebruik van alle programma\'s in dit pakket wordt geregeld door hun respectievelijke licenties. Het complete <strong>{$a->installername}</strong> pakket is
 <a href="http://www.opensource.org/docs/definition_plain.html">open source</a> en wordt verdeeld onder de <a href="http://www.gnu.org/copyleft/gpl.html">GPL</a> licentie.';
-$string['welcomep60'] = 'De volgende pagina\'s leiden je door een aantal makkelijk te volgen stappen om <strong>Moodle</strong> te installeren op je computer. Je kunt de standaardinstellingen overnemen of, optionneel, ze aanpassen aan je noden.';
+$string['welcomep60'] = 'De volgende pagina\'s leiden je door een aantal makkelijk te volgen stappen om <strong>Moodle</strong> te installeren op je computer. Je kunt de standaardinstellingen overnemen of, optioneel, ze aanpassen aan je noden.';
 $string['welcomep70'] = 'Klik op de "volgende"-knop om verder te gaan met de installatie van <strong>Moodle</strong>';
 $string['wwwroot'] = 'Web adres';
@@ -66,7 +66,9 @@ $string['pathshead'] = 'Bekreft stier';
 $string['pathsrodataroot'] = 'Dataroot katalog er ikke skrivbar.';
 $string['pathsroparentdataroot'] = 'Overordnet katalog ({$a->parent}) er ikke skrivbar. Datakatalogen ({$a->dataroot}) kan ikke opprettes av installasjonsprogrammet.';
 $string['pathssubadmindir'] = 'Noen ganske få webhoteller bruker  /admin som en egen url for å få tilgang til et kontrollpanel. Dessverre kommer det i konflikt med standard lokalisering av Moodle sine admin-sider. Du kan fikse dette ved å endre navn på admin-mappen og deretter oppgi dette navnet her. F.eks. <em>moodleadmin</em>.  Dette vil fikse adminlenkene i Moodle.';
-$string['pathssubdataroot'] = 'Du trenger et sted hvor Moodle kan lagre opplastede filer. Denne mappen må være med lese og skriverettigheter for webserver-brukeren (veldig ofte \'nobody\' eller \'apache\'), men denne mappen må IKKE være direkte tilgjengelig via web. Installasjonsprogrammet vil forsøke å opprette den om den ikke finnes fra før.';
+$string['pathssubdataroot'] = '<p>En mappe der Moodle vil lagre alle filer lastet opp av brukerne.</p>
+<p>Denne mappen må være med lese og skriverettigheter for webserver-brukeren (vanligvis \'www-data\', \'nobody\' eller \'apache\').</p>
+<p>Denne mappen må IKKE være direkte tilgjengelig via web.</p> <p>Installasjonsprogrammet vil forsøke å opprette den om den ikke finnes fra før.</p>';
 $string['pathssubdirroot'] = '<p>Full sti til mappen som inneholder Moodlekoden.</p>';
 $string['pathssubwwwroot'] = 'Full webadresse til der hvor Moodle skal vises. Det er ikke mulig å bruke Moodle med mer enn en adresse. Dersom portalen din har flere webadresser må du bruke videresending for til den webadressen du oppgir her. Dersom portalen din er tilgjengelig både fra intranett og internett, skal du oppgi den offentlige internettadressen her og sette opp DNS slik at intranettbrukerne også benytter denne offisielle adressen.
 Dersom adressen ikke er korrekt, vennligst endre URL i nettleseren slik at at installasjonen restartes med andre verdier.';
@@ -34,8 +34,8 @@ $string['admindirname'] = 'Katalog admin';
 $string['availablelangs'] = 'Dostępne paczki językowe';
 $string['chooselanguagehead'] = 'Wybierz język';
 $string['chooselanguagesub'] = 'Proszę wybrać język do instalacji. Ten język będzie również użyty jako domyślny język witryny, przy czym może być później zmieniony.';
-$string['clialreadyconfigured'] = 'Plik config.php już istnieje, użyj admin/cli/install_database.php jeśli chcesz zainstalować tę witrynę.';
-$string['clialreadyinstalled'] = 'Plik config.php już istnieje, użyj admin/cli/upgrade.php, jeśli chcesz uaktualnić witrynę.';
+$string['clialreadyconfigured'] = 'Plik config.php już istnieje. Użyj admin/cli/install_database.php jeśli chcesz zainstalować Moodle dla tej strony.';
+$string['clialreadyinstalled'] = 'Plik config.php już istnieje. Użyj admin/cli/install_database.php jeśli chcesz zaktualizować Moodle dla tej strony.';
 $string['cliinstallheader'] = 'Program instalacyjny Moodle {$a} z linii poleceń';
 $string['databasehost'] = 'Host bazy danych';
 $string['databasename'] = 'Nazwa bazy danych';
@@ -54,6 +54,10 @@ $string['paths'] = 'Căi';
 $string['pathserrcreatedataroot'] = 'Data directory ({$a->dataroot}) nu poate fi creat de către installer.';
 $string['pathshead'] = 'Confirmare căi';
 $string['pathsrodataroot'] = 'Directorul dataroot nu poate fi scris.';
+$string['pathssubdataroot'] = '<p>Un director unde Moodle va stoca tot conținutul unui fișier încărcat de către utilizatori.</p>
+<p>Acest director trebuie să poată fi citit și scris de către utilizatrii serverului web (de obicei \'www-data\', \'nobody\', or \'apache\').</p>
+<p>Nu trebuie să fie direct accesibil de pe web.</p>
+<p>Dacă directorul nu există în prezent, procesul de instalare va încerca să îl creeze.</p>';
 $string['pathssubdirroot'] = '<p>Calea completă către directorul care conține codul Moodle .</p>';
 $string['pathsunsecuredataroot'] = 'Locația dataroot nu este sigură';
 $string['pathswrongadmindir'] = 'Directorul admin nu există';
@@ -65,5 +69,8 @@ $string['phpversionhelp'] = '<p>Moodle necesită o versiune PHP de cel puțin  4
 (În cazul 5.0.x puteți, de asemenea, să downgradați la versiunea 4.4.x)</p>';
 $string['welcomep10'] = '{$a->installername} ({$a->installerversion})';
 $string['welcomep20'] = 'Vedeți această pagină deoarece ați instalat și lansat cu succes pachetul  <strong>{$a->packname} {$a->packversion}</strong> în computerul dumneavoastră. Felicitări!';
+$string['welcomep30'] = 'Lansarea <strong>{$a->installername}</strong> include aplicațiile
+    pentru a crea un mediu în care <strong>Moodle</strong> va funcționa, și anume:';
 $string['welcomep40'] = 'Pachetul include și <strong>Moodle {$a->moodlerelease} ({$a->moodleversion})</strong>.';
+$string['welcomep70'] = 'Click pe butonul "Next" de mai jos pentru a continua setarea <strong>Moodle</strong>.';
 $string['wwwroot'] = 'Adresă Web';
@@ -30,6 +30,9 @@

 defined('MOODLE_INTERNAL') || die();

+$string['cannotcreatedboninstall'] = '<p>无法建立数据库</p>
+<p>指定数据库不存在。使用者没有权限建立数据库</p>
+<p>网站管理员需查明数据库状态.</p>';
 $string['cannotcreatelangdir'] = '无法创建 lang 目录。';
 $string['cannotcreatetempdir'] = '无法创建 temp 目录。';
 $string['cannotdownloadcomponents'] = '无法下载组件';
@@ -610,6 +610,7 @@ $string['legacyfilesaddallowed'] = 'Allow adding to legacy course files';
 $string['legacyfilesaddallowed_help'] = 'If a course has legacy course files, allow new files and folders to be added to it.';
 $string['legacyfilesinnewcourses'] = 'Legacy course files in new courses';
 $string['legacyfilesinnewcourses_help'] = 'By default, legacy course files areas are available in upgraded courses only. Please note that some features such as activity backup and restore are not compatible with this setting.';
+$string['libcurlwarning'] = 'Libcurl with CURLOPT_PROTOCOL support has not been detected. It is recommended to have an up to date libcurl installation for security reasons.';
 $string['licensesettings'] = 'Licence settings';
 $string['linkadmincategories'] = 'Link admin categories';
 $string['linkadmincategories_help'] = 'If enabled admin setting categories will be displayed as links in the navigation and will lead to the admin category pages.';
@@ -761,6 +762,7 @@ $string['numberofmissingstrings'] = 'Number of missing strings: {$a}';
 $string['numberofstrings'] = 'Total number of strings: {$a->strings}<br />Missing: {$a->missing} ({$a->missingpercent}&nbsp;%)';
 $string['opcacherecommended'] = 'PHP opcode caching improves performance and lowers memory requirements, OPcache extension is recommended and fully supported.';
 $string['opensslrecommended'] = 'Installing the optional OpenSSL library is highly recommended -- it enables Moodle Networking functionality.';
+$string['opensslrequired'] = 'The OpenSSL PHP extension is now required by Moodle to provide stronger cryptographic services.';
 $string['opentogoogle'] = 'Open to Google';
 $string['optionalmaintenancemessage'] = 'Optional maintenance message';
 $string['order1'] = 'First';
@@ -1056,6 +1058,7 @@ $string['unsupported'] = 'Unsupported';
 $string['unsupporteddbstorageengine'] = 'The database storage engine being used is no longer supported.';
 $string['unsupporteddbtablerowformat'] = 'Your database has tables using Antelope as the file format. You are recommended to convert the tables to the Barracuda file format. See the documentation <a href="https://docs.moodle.org/en/cli">Administration via command line</a> for details of a tool for converting InnoDB tables to Barracuda.';
 $string['unsupportedphpversion7'] = 'PHP version 7 is not supported.';
+$string['unsupportedphpversion71'] = 'PHP version 7.1 is not supported.';
 $string['unsuspenduser'] = 'Activate user account';
 $string['updateaccounts'] = 'Update existing accounts';
 $string['updatecomponent'] = 'Update component';
@@ -180,6 +180,7 @@ $string['viewmyentriesaboutcourse'] = 'View my entries about this course';
 $string['viewsiteentries'] = 'View all entries';
 $string['viewuserentries'] = 'View all entries by {$a}';
 $string['worldblogs'] = 'The world can read entries set to be world-accessible';
+$string['wrongexternalid'] = 'Wrong external blog id';
 $string['wrongpostid'] = 'Wrong blog post id';
 $string['page-blog-edit'] = 'Blog editing pages';
 $string['page-blog-index'] = 'Blog listing pages';
@@ -111,6 +111,9 @@ class behat_util extends testing_util {
        // Disable some settings that are not wanted on test sites.
        set_config('noemailever', 1);

+        // Set noreplyaddress to an example domain, as it should be valid email address and test site can be a localhost.
+        set_config('noreplyaddress', 'noreply@example.com');
+
        // Keeps the current version of database and dataroot.
        self::store_versions_hash();

@@ -1547,3 +1547,14 @@ function restrict_php_version(&$result, $version) {
        return true;
    }
 }
+
+/**
+ * Check if the current PHP version is greater than or equal to
+ * PHP version 7.1.
+ *
+ * @param object $result an environment_results instance
+ * @return bool result of version check
+ */
+function restrict_php_version_71(&$result) {
+    return restrict_php_version($result, '7.1');
+}
@@ -4745,6 +4745,7 @@ function hash_internal_user_password($password, $fasthash = false) {
 *
 * Updating the password will modify the $user object and the database
 * record to use the current hashing algorithm.
+ * It will remove Web Services user tokens too.
 *
 * @param stdClass $user User object (password property may be updated).
 * @param string $password Plain text password.
@@ -4792,6 +4793,10 @@ function update_internal_user_password($user, $password, $fasthash = false) {
        // Trigger event.
        $user = $DB->get_record('user', array('id' => $user->id));
        \core\event\user_password_updated::create_from_user($user)->trigger();
+
+        // Remove WS user tokens.
+        require_once($CFG->dirroot.'/webservice/lib.php');
+        webservice::delete_user_ws_tokens($user->id);
    }

    return true;
@@ -5833,6 +5838,18 @@ function email_to_user($user, $from, $subject, $messagetext, $messagehtml = '',
    $tempreplyto = array();

    $supportuser = core_user::get_support_user();
+    $noreplyaddressdefault = 'noreply@' . get_host_from_url($CFG->wwwroot);
+    $noreplyaddress = empty($CFG->noreplyaddress) ? $noreplyaddressdefault : $CFG->noreplyaddress;
+
+    if (!validate_email($noreplyaddress)) {
+        debugging('email_to_user: Invalid noreply-email '.s($noreplyaddress));
+        $noreplyaddress = $noreplyaddressdefault;
+    }
+
+    if (!validate_email($supportuser->email)) {
+        debugging('email_to_user: Invalid support-email '.s($supportuser->email));
+        $supportuser->email = $noreplyaddress;
+    }

    // Make up an email address for handling bounces.
    if (!empty($CFG->handlebounces)) {
@@ -5850,17 +5867,28 @@ function email_to_user($user, $from, $subject, $messagetext, $messagehtml = '',
        }
    }

+    // Make sure that the explicit replyto is valid, fall back to the implicit one.
+    if (!empty($replyto) && !validate_email($replyto)) {
+        debugging('email_to_user: Invalid replyto-email '.s($replyto));
+        $replyto = $noreplyaddress;
+    }
+
    if (is_string($from)) { // So we can pass whatever we want if there is need.
-        $mail->From     = $CFG->noreplyaddress;
+        $mail->From     = $noreplyaddress;
        $mail->FromName = $from;
    } else if ($usetrueaddress and $from->maildisplay) {
+        if (!validate_email($from->email)) {
+            debugging('email_to_user: Invalid from-email '.s($from->email).' - not sending');
+            // Better not to use $noreplyaddress in this case.
+            return false;
+        }
        $mail->From     = $from->email;
        $mail->FromName = fullname($from);
    } else {
-        $mail->From     = $CFG->noreplyaddress;
+        $mail->From     = $noreplyaddress;
        $mail->FromName = fullname($from);
        if (empty($replyto)) {
-            $tempreplyto[] = array($CFG->noreplyaddress, get_string('noreplyname'));
+            $tempreplyto[] = array($noreplyaddress, get_string('noreplyname'));
        }
    }

@@ -9642,6 +9670,58 @@ function get_course_display_name_for_list($course) {
    }
 }

+/**
+ * Safe analogue of unserialize() that can only parse arrays
+ *
+ * Arrays may contain only integers or strings as both keys and values. Nested arrays are allowed.
+ * Note: If any string (key or value) has semicolon (;) as part of the string parsing will fail.
+ * This is a simple method to substitute unnecessary unserialize() in code and not intended to cover all possible cases.
+ *
+ * @param string $expression
+ * @return array|bool either parsed array or false if parsing was impossible.
+ */
+function unserialize_array($expression) {
+    $subs = [];
+    // Find nested arrays, parse them and store in $subs , substitute with special string.
+    while (preg_match('/([\^;\}])(a:\d+:\{[^\{\}]*\})/', $expression, $matches) && strlen($matches[2]) < strlen($expression)) {
+        $key = '--SUB' . count($subs) . '--';
+        $subs[$key] = unserialize_array($matches[2]);
+        if ($subs[$key] === false) {
+            return false;
+        }
+        $expression = str_replace($matches[2], $key . ';', $expression);
+    }
+
+    // Check the expression is an array.
+    if (!preg_match('/^a:(\d+):\{([^\}]*)\}$/', $expression, $matches1)) {
+        return false;
+    }
+    // Get the size and elements of an array (key;value;key;value;....).
+    $parts = explode(';', $matches1[2]);
+    $size = intval($matches1[1]);
+    if (count($parts) < $size * 2 + 1) {
+        return false;
+    }
+    // Analyze each part and make sure it is an integer or string or a substitute.
+    $value = [];
+    for ($i = 0; $i < $size * 2; $i++) {
+        if (preg_match('/^i:(\d+)$/', $parts[$i], $matches2)) {
+            $parts[$i] = (int)$matches2[1];
+        } else if (preg_match('/^s:(\d+):"(.*)"$/', $parts[$i], $matches3) && strlen($matches3[2]) == (int)$matches3[1]) {
+            $parts[$i] = $matches3[2];
+        } else if (preg_match('/^--SUB\d+--$/', $parts[$i])) {
+            $parts[$i] = $subs[$parts[$i]];
+        } else {
+            return false;
+        }
+    }
+    // Combine keys and values.
+    for ($i = 0; $i < $size * 2; $i += 2) {
+        $value[$parts[$i]] = $parts[$i+1];
+    }
+    return $value;
+}
+
 /**
 * The lang_string class
 *
@@ -2949,4 +2949,57 @@ class core_moodlelib_testcase extends advanced_testcase {
        $this->assertSame('', $result);
        $this->assertDebuggingCalled();
    }
+
+    /**
+     * Test that generate_email_processing_address() returns valid email address.
+     */
+    public function test_generate_email_processing_address() {
+        global $CFG;
+        $this->resetAfterTest();
+
+        $data = (object)[
+            'id' => 42,
+            'email' => 'my.email+from_moodle@example.com',
+        ];
+
+        $modargs = 'B'.base64_encode(pack('V', $data->id)).substr(md5($data->email), 0, 16);
+
+        $CFG->maildomain = 'example.com';
+        $CFG->mailprefix = 'mdl+';
+        $this->assertEquals(1, validate_email(generate_email_processing_address(0, $modargs)));
+
+        $CFG->maildomain = 'mail.example.com';
+        $CFG->mailprefix = 'mdl-';
+        $this->assertEquals(1, validate_email(generate_email_processing_address(23, $modargs)));
+    }
+
+    /**
+     * Test safe method unserialize_array().
+     */
+    public function test_unserialize_array() {
+        $a = [1, 2, 3];
+        $this->assertEquals($a, unserialize_array(serialize($a)));
+        $this->assertEquals($a, unserialize_array(serialize($a)));
+        $a = ['a' => 1, 2 => 2, 'b' => 'cde'];
+        $this->assertEquals($a, unserialize_array(serialize($a)));
+        $this->assertEquals($a, unserialize_array(serialize($a)));
+        $a = ['a' => 1, 2 => 2, 'b' => 'c"d"e'];
+        $this->assertEquals($a, unserialize_array(serialize($a)));
+        $a = ['a' => 1, 2 => ['c' => 'd', 'e' => 'f'], 'b' => 'cde'];
+        $this->assertEquals($a, unserialize_array(serialize($a)));
+
+        // Can not unserialize if any string contains semicolons.
+        $a = ['a' => 1, 2 => 2, 'b' => 'c"d";e'];
+        $this->assertEquals(false, unserialize_array(serialize($a)));
+
+        // Can not unserialize if there are any objects.
+        $a = (object)['a' => 1, 2 => 2, 'b' => 'cde'];
+        $this->assertEquals(false, unserialize_array(serialize($a)));
+        $a = ['a' => 1, 2 => 2, 'b' => (object)['a' => 'cde']];
+        $this->assertEquals(false, unserialize_array(serialize($a)));
+
+        // Array used in the grader report.
+        $a = array('aggregatesonly' => [51, 34], 'gradesonly' => [21, 45, 78]);
+        $this->assertEquals($a, unserialize_array(serialize($a)));
+    }
 }
@@ -351,4 +351,20 @@ class core_upgradelib_testcase extends advanced_testcase {
                    (object)array('userfield' => 'email', 'shortname' => null, 'operator' => 'isempty'),
                )));
    }
+
+    /**
+     * Test libcurl custom check api.
+     */
+    public function test_check_libcurl_version() {
+        $supportedversion = 0x071304;
+        $curlinfo = curl_version();
+        $currentversion = $curlinfo['version_number'];
+
+        $result = new environment_results("custom_checks");
+        if ($currentversion < $supportedversion) {
+            $this->assertFalse(check_libcurl_version($result)->getStatus());
+        } else {
+            $this->assertNull(check_libcurl_version($result));
+        }
+    }
 }
@@ -567,4 +567,19 @@ EXPECTED;
        $this->assertSame($expected, strip_pluginfile_content($source));
    }

+    /**
+     * Tests for validate_email() function.
+     */
+    public function test_validate_email() {
+
+        $this->assertEquals(1, validate_email('moodle@example.com'));
+        $this->assertEquals(1, validate_email('moodle@localhost.local'));
+        $this->assertEquals(1, validate_email('verp_email+is=mighty@moodle.org'));
+        $this->assertEquals(1, validate_email("but_potentially'dangerous'too@example.org"));
+        $this->assertEquals(1, validate_email('posts+AAAAAAAAAAIAAAAAAAAGQQAAAAABFSXz1eM/P/lR2bYyljM+@posts.moodle.org'));
+
+        $this->assertEquals(0, validate_email('moodle@localhost'));
+        $this->assertEquals(0, validate_email('"attacker\\" -oQ/tmp/ -X/var/www/vhost/moodle/backdoor.php  some"@email.com'));
+        $this->assertEquals(0, validate_email("moodle@example.com>\r\nRCPT TO:<victim@example.com"));
+    }
 }
@@ -2266,3 +2266,38 @@ function check_database_tables_row_format(environment_results $result) {

    return null;
 }
+
+/**
+ * Check if recommended version of libcurl is installed or not.
+ *
+ * @param environment_results $result object to update, if relevant.
+ * @return environment_results|null updated results or null.
+ */
+function check_libcurl_version(environment_results $result) {
+
+    if (!function_exists('curl_version')) {
+        $result->setInfo('cURL PHP extension is not installed');
+        $result->setStatus(false);
+        return $result;
+    }
+
+    // Supported version and version number.
+    $supportedversion = 0x071304;
+    $supportedversionstring = "7.19.4";
+
+    // Installed version.
+    $curlinfo = curl_version();
+    $currentversion = $curlinfo['version_number'];
+
+    if ($currentversion < $supportedversion) {
+        // Test fail.
+        // Set info, we want to let user know how to resolve the problem.
+        $result->setInfo('Libcurl version check');
+        $result->setNeededVersion($supportedversionstring);
+        $result->setCurrentVersion($curlinfo['version']);
+        $result->setStatus(false);
+        return $result;
+    }
+
+    return null;
+}
@@ -19,6 +19,14 @@
 *
 * Finds the user and calls the appropriate routine for their authentication type.
 *
+ * There are several pathways to/through this page, summarised below:
+ * 1. User clicks the 'forgotten your username or password?' link on the login page.
+ *  - No token is received, render the username/email search form.
+ * 2. User clicks the link in the forgot password email
+ *  - Token received as GET param, store the token in session, redirect to self
+ * 3. Redirected from (2)
+ *  - Fetch token from session, and continue to run the reset routine defined in 'core_login_process_password_set()'.
+ *
 * @package    core
 * @subpackage auth
 * @copyright  1999 onwards Martin Dougiamas  http://dougiamas.com
@@ -59,12 +67,27 @@ if (isloggedin() and !isguestuser()) {
    redirect($CFG->wwwroot.'/index.php', get_string('loginalready'), 5);
 }

+// Fetch the token from the session, if present, and unset the session var immediately.
+$tokeninsession = false;
+if (!empty($SESSION->password_reset_token)) {
+    $token = $SESSION->password_reset_token;
+    unset($SESSION->password_reset_token);
+    $tokeninsession = true;
+}
+
 if (empty($token)) {
    // This is a new password reset request.
    // Process the request; identify the user & send confirmation email.
    core_login_process_password_reset_request();
 } else {
-    // User clicked on confirmation link in email message
-    // validate the token & set new password
-    core_login_process_password_set($token);
+    // A token has been found, but not in the session, and not from a form post.
+    // This must be the user following the original rest link, so store the reset token in the session and redirect to self.
+    // The session var is intentionally used only during the lifespan of one request (the redirect) and is unset above.
+    if (!$tokeninsession && $_SERVER['REQUEST_METHOD'] === 'GET') {
+        $SESSION->password_reset_token = $token;
+        redirect($CFG->httpswwwroot . '/login/forgot_password.php');
+    } else {
+        // Continue with the password reset process.
+        core_login_process_password_set($token);
+    }
 }
@@ -31,7 +31,8 @@ if ($ADMIN->fulltree) {
    $settings->add(new admin_setting_configtext('smtpuser', get_string('smtpuser', 'message_email'), get_string('configsmtpuser', 'message_email'), '', PARAM_NOTAGS));
    $settings->add(new admin_setting_configpasswordunmask('smtppass', get_string('smtppass', 'message_email'), get_string('configsmtpuser', 'message_email'), ''));
    $settings->add(new admin_setting_configtext('smtpmaxbulk', get_string('smtpmaxbulk', 'message_email'), get_string('configsmtpmaxbulk', 'message_email'), 1, PARAM_INT));
-    $settings->add(new admin_setting_configtext('noreplyaddress', get_string('noreplyaddress', 'message_email'), get_string('confignoreplyaddress', 'message_email'), 'noreply@' . get_host_from_url($CFG->wwwroot), PARAM_NOTAGS));
+    $settings->add(new admin_setting_configtext('noreplyaddress', get_string('noreplyaddress', 'message_email'),
+            get_string('confignoreplyaddress', 'message_email'), 'noreply@' . get_host_from_url($CFG->wwwroot), PARAM_EMAIL));
    $settings->add(new admin_setting_configcheckbox('emailonlyfromnoreplyaddress',
            get_string('emailonlyfromnoreplyaddress', 'message_email'),
            get_string('configemailonlyfromnoreplyaddress', 'message_email'), 0));
@@ -780,7 +780,7 @@ class mod_assign_external extends external_api {
                            'locked'           => new external_value(PARAM_INT, 'locked', VALUE_OPTIONAL),
                            'mailed'           => new external_value(PARAM_INT, 'mailed', VALUE_OPTIONAL),
                            'extensionduedate' => new external_value(PARAM_INT, 'extension due date', VALUE_OPTIONAL),
-                            'workflowstate'    => new external_value(PARAM_TEXT, 'marking workflow state', VALUE_OPTIONAL),
+                            'workflowstate'    => new external_value(PARAM_ALPHA, 'marking workflow state', VALUE_OPTIONAL),
                            'allocatedmarker'  => new external_value(PARAM_INT, 'allocated marker', VALUE_OPTIONAL)
                        )
                    )
@@ -1036,7 +1036,7 @@ class mod_assign_external extends external_api {
                            'locked'           => new external_value(PARAM_INT, 'locked'),
                            'mailed'           => new external_value(PARAM_INT, 'mailed'),
                            'extensionduedate' => new external_value(PARAM_INT, 'extension due date'),
-                            'workflowstate'    => new external_value(PARAM_TEXT, 'marking workflow state', VALUE_OPTIONAL),
+                            'workflowstate'    => new external_value(PARAM_ALPHA, 'marking workflow state', VALUE_OPTIONAL),
                            'allocatedmarker'  => new external_value(PARAM_INT, 'allocated marker')
                        )
                    )
@@ -2212,7 +2212,7 @@ class assign {
        $o = '';

        $pluginsubtype = required_param('pluginsubtype', PARAM_ALPHA);
-        $plugintype = required_param('plugin', PARAM_TEXT);
+        $plugintype = required_param('plugin', PARAM_PLUGIN);
        $pluginaction = required_param('pluginaction', PARAM_ALPHA);

        $plugin = $this->get_plugin_by_type($pluginsubtype, $plugintype);
@@ -2268,7 +2268,7 @@ class assign {

        $submissionid = optional_param('sid', 0, PARAM_INT);
        $gradeid = optional_param('gid', 0, PARAM_INT);
-        $plugintype = required_param('plugin', PARAM_TEXT);
+        $plugintype = required_param('plugin', PARAM_PLUGIN);
        $item = null;
        if ($pluginsubtype == 'assignsubmission') {
            $plugin = $this->get_submission_plugin_by_type($plugintype);
@@ -5119,7 +5119,7 @@ class assign {
            $record->userid = $userid;
            if ($modified >= 0) {
                $record->grade = unformat_float(optional_param('quickgrade_' . $record->userid, -1, PARAM_TEXT));
-                $record->workflowstate = optional_param('quickgrade_' . $record->userid.'_workflowstate', false, PARAM_TEXT);
+                $record->workflowstate = optional_param('quickgrade_' . $record->userid.'_workflowstate', false, PARAM_ALPHA);
                $record->allocatedmarker = optional_param('quickgrade_' . $record->userid.'_allocatedmarker', false, PARAM_INT);
            } else {
                // This user was not in the grading table.
@@ -6213,7 +6213,7 @@ class assign {
        $mform->setType('userid', PARAM_INT);

        $mform->addElement('hidden', 'action', 'savesubmission');
-        $mform->setType('action', PARAM_TEXT);
+        $mform->setType('action', PARAM_ALPHA);
    }

    /**
@@ -28,7 +28,7 @@ require_once($CFG->dirroot . '/mod/assign/locallib.php');
 $id = required_param('id', PARAM_INT);

 $urlparams = array('id' => $id,
-                  'action' => optional_param('action', '', PARAM_TEXT),
+                  'action' => optional_param('action', '', PARAM_ALPHA),
                  'rownum' => optional_param('rownum', 0, PARAM_INT),
                  'useridlistid' => optional_param('action', 0, PARAM_INT));

@@ -50,4 +50,4 @@ $completion->set_module_viewed($cm);

 // Get the assign class to
 // render the page.
-echo $assign->view(optional_param('action', '', PARAM_TEXT));
+echo $assign->view(optional_param('action', '', PARAM_ALPHA));
@@ -218,9 +218,6 @@ class mod_forum_post_form extends moodleform {
        $mform->addElement('hidden', 'parent');
        $mform->setType('parent', PARAM_INT);

-        $mform->addElement('hidden', 'userid');
-        $mform->setType('userid', PARAM_INT);
-
        $mform->addElement('hidden', 'groupid');
        $mform->setType('groupid', PARAM_INT);

@@ -4483,41 +4483,55 @@ function forum_add_new_post($post, $mform, &$message) {
 * @global object
 * @global object
 * @global object
- * @param object $post
+ * @param object $newpost
 * @param mixed $mform
 * @param string $message
 * @return bool
 */
-function forum_update_post($post, $mform, &$message) {
+function forum_update_post($newpost, $mform, &$message) {
    global $USER, $CFG, $DB;

+    $post       = $DB->get_record('forum_posts', array('id' => $newpost->id));
    $discussion = $DB->get_record('forum_discussions', array('id' => $post->discussion));
    $forum      = $DB->get_record('forum', array('id' => $discussion->forum));
    $cm         = get_coursemodule_from_instance('forum', $forum->id);
    $context    = context_module::instance($cm->id);

+    // Allowed modifiable fields.
+    $modifiablefields = [
+        'subject',
+        'message',
+        'messageformat',
+        'messagetrust',
+        'timestart',
+        'timeend',
+        'attachments',
+    ];
+    foreach ($modifiablefields as $field) {
+        if (isset($newpost->{$field})) {
+            $post->{$field} = $newpost->{$field};
+        }
+    }
    $post->modified = time();

-    $DB->update_record('forum_posts', $post);
-
-    $discussion->timemodified = $post->modified; // last modified tracking
-    $discussion->usermodified = $post->userid;   // last modified tracking
+    // Last post modified tracking.
+    $discussion->timemodified = $post->modified;
+    $discussion->usermodified = $post->userid;

    if (!$post->parent) {   // Post is a discussion starter - update discussion title and times too
        $discussion->name      = $post->subject;
        $discussion->timestart = $post->timestart;
        $discussion->timeend   = $post->timeend;
    }
-    $post->message = file_save_draft_area_files($post->itemid, $context->id, 'mod_forum', 'post', $post->id,
+    $post->message = file_save_draft_area_files($newpost->itemid, $context->id, 'mod_forum', 'post', $post->id,
            mod_forum_post_form::editor_options($context, $post->id), $post->message);
-    $DB->set_field('forum_posts', 'message', $post->message, array('id'=>$post->id));
-
+    $DB->update_record('forum_posts', $post);
    $DB->update_record('forum_discussions', $discussion);

    forum_add_attachment($post, $forum, $cm, $mform, $message);

    if (forum_tp_can_track_forums($forum) && forum_tp_is_tracked($forum)) {
-        forum_tp_mark_post_read($post->userid, $post, $post->forum);
+        forum_tp_mark_post_read($USER->id, $post, $forum->id);
    }

    // Let Moodle know that assessable content is uploaded (eg for plagiarism detection)
@@ -940,4 +940,56 @@ class mod_forum_lib_testcase extends advanced_testcase {

    }

+    /**
+     * Test that {@link forum_update_post()} keeps correct forum_discussions usermodified.
+     */
+    public function test_forum_update_post_keeps_discussions_usermodified() {
+        global $DB;
+
+        $this->resetAfterTest();
+
+        // Let there be light.
+        $teacher = self::getDataGenerator()->create_user();
+        $student = self::getDataGenerator()->create_user();
+        $course = self::getDataGenerator()->create_course();
+
+        $forum = self::getDataGenerator()->create_module('forum', (object)[
+            'course' => $course->id,
+        ]);
+
+        $generator = self::getDataGenerator()->get_plugin_generator('mod_forum');
+
+        // Let the teacher start a discussion.
+        $discussion = $generator->create_discussion((object)[
+            'course' => $course->id,
+            'userid' => $teacher->id,
+            'forum' => $forum->id,
+        ]);
+
+        // On this freshly created discussion, the teacher is the author of the last post.
+        $this->assertEquals($teacher->id, $DB->get_field('forum_discussions', 'usermodified', ['id' => $discussion->id]));
+
+        // Let the student reply to the teacher's post.
+        $reply = $generator->create_post((object)[
+            'course' => $course->id,
+            'userid' => $student->id,
+            'forum' => $forum->id,
+            'discussion' => $discussion->id,
+            'parent' => $discussion->firstpost,
+        ]);
+        // The student should now be the last post's author.
+        $this->assertEquals($student->id, $DB->get_field('forum_discussions', 'usermodified', ['id' => $discussion->id]));
+
+        // Let the teacher edit the student's reply.
+        $this->setUser($teacher->id);
+        $newpost = (object)[
+            'id' => $reply->id,
+            'itemid' => 0,
+            'subject' => 'Amended subject',
+        ];
+        forum_update_post($newpost, null, $message);
+
+        // The student should be still the last post's author.
+        $this->assertEquals($student->id, $DB->get_field('forum_discussions', 'usermodified', ['id' => $discussion->id]));
+    }
 }
@@ -132,12 +132,13 @@ if ($courseid != SITEID) {
            $ccontext = context_course::instance($c->id);
            $cfullname = format_string($c->fullname, true, array('context' => $ccontext));
            $header = '<a href="' . $CFG->wwwroot . '/course/view.php?id=' . $c->id . '">' . $cfullname . '</a>';
-            if (has_capability('moodle/notes:manage', context_course::instance($c->id))) {
+            $viewcoursenotes = has_capability('moodle/notes:view', $ccontext);
+            if (has_capability('moodle/notes:manage', $ccontext)) {
                $addid = $c->id;
            } else {
                $addid = 0;
            }
-            note_print_notes($header, $addid, $view, $c->id, $userid, NOTES_STATE_PUBLIC, 0);
+            note_print_notes($header, $addid, $viewcoursenotes, $c->id, $userid, NOTES_STATE_PUBLIC, 0);
        }
    }
 }
@@ -139,7 +139,7 @@ class qtype_essay_question extends question_with_responses {
            return $this->responseformat === 'editorfilepicker';

        } else if ($component == 'qtype_essay' && $filearea == 'graderinfo') {
-            return $options->manualcomment;
+            return $options->manualcomment && $args[0] == $this->id;

        } else {
            return parent::check_file_access($qa, $options, $component,
@@ -413,11 +413,11 @@ abstract class question_definition {
     */
    public function check_file_access($qa, $options, $component, $filearea, $args, $forcedownload) {
        if ($component == 'question' && $filearea == 'questiontext') {
-            // Question text always visible.
-            return true;
+            // Question text always visible, but check it is the right question id.
+            return $args[0] == $this->id;

        } else if ($component == 'question' && $filearea == 'generalfeedback') {
-            return $options->generalfeedback;
+            return $options->generalfeedback && $args[0] == $this->id;

        } else {
            // Unrecognised component or filearea.
@@ -681,7 +681,8 @@ abstract class question_graded_automatically extends question_with_responses
            list($notused, $state) = $this->grade_response($response);
        }

-        return $options->feedback && $state->get_feedback_class() . 'feedback' == $filearea;
+        return $options->feedback && $state->get_feedback_class() . 'feedback' == $filearea &&
+                $args[0] == $this->id;
    }

    /**
@@ -203,8 +203,9 @@ class core_user_external extends external_api {

            // Preferences.
            if (!empty($user['preferences'])) {
+                $userobject = (object)$user;
                foreach ($user['preferences'] as $preference) {
-                    set_user_preference($preference['type'], $preference['value'], $user['id']);
+                    self::set_user_preference($preference['type'], $preference['value'], $userobject);
                }
            }

@@ -389,7 +390,7 @@ class core_user_external extends external_api {
     * @since Moodle 2.2
     */
    public static function update_users($users) {
-        global $CFG, $DB;
+        global $CFG, $DB, $USER;
        require_once($CFG->dirroot."/user/lib.php");
        require_once($CFG->dirroot."/user/profile/lib.php"); // Required for customfields related function.

@@ -403,6 +404,18 @@ class core_user_external extends external_api {
        $transaction = $DB->start_delegated_transaction();

        foreach ($params['users'] as $user) {
+            // First check the user exists.
+            if (!$existinguser = core_user::get_user($user['id'])) {
+                continue;
+            }
+            // Check if we are trying to update an admin.
+            if ($existinguser->id != $USER->id and is_siteadmin($existinguser) and !is_siteadmin($USER)) {
+                continue;
+            }
+            // Other checks (deleted, remote or guest users).
+            if ($existinguser->deleted or is_mnet_remote_user($existinguser) or isguestuser($existinguser->id)) {
+                continue;
+            }
            user_update_user($user, true, false);
            // Update user custom fields.
            if (!empty($user['customfields'])) {
@@ -421,7 +434,7 @@ class core_user_external extends external_api {
            // Preferences.
            if (!empty($user['preferences'])) {
                foreach ($user['preferences'] as $preference) {
-                    set_user_preference($preference['type'], $preference['value'], $user['id']);
+                    self::set_user_preference($preference['type'], $preference['value'], $existinguser);
                }
            }
        }
@@ -1164,6 +1177,35 @@ class core_user_external extends external_api {
        );
    }

+    /**
+     * Validates preference value and updates the user preference
+     *
+     * @param string $name
+     * @param string $value
+     * @param stdClass $user
+     */
+    protected static function set_user_preference($name, $value, $user) {
+        $preferences = array(
+            'auth_forcepasswordchange' => PARAM_BOOL,
+            'htmleditor' => PARAM_COMPONENT,
+            'usemodchooser' => PARAM_BOOL,
+            'badgeprivacysetting' => PARAM_BOOL,
+            'blogpagesize' => PARAM_INT,
+            'forum_markasreadonnotification' => PARAM_INT,
+            'calendar_timeformat' => PARAM_NOTAGS,
+            'calendar_startwday' => PARAM_INT,
+            'calendar_maxevents' => PARAM_INT,
+            'calendar_lookahead' => PARAM_INT,
+            'calendar_persistflt' => PARAM_INT
+        );
+        if (isset($preferences[$name])) {
+            $value = clean_param($value, $preferences[$name]);
+            if ($preferences[$name] == PARAM_BOOL) {
+                $value = (int)$value;
+            }
+            set_user_preference($name, $value, $user);
+        }
+    }
 }

 /**
@@ -478,7 +478,14 @@ class core_user_externallib_testcase extends externallib_advanced_testcase {
            'email' => 'usertest1@example.com',
            'description' => 'This is a description for user 1',
            'city' => 'Perth',
-            'country' => 'au'
+            'country' => 'au',
+            'preferences' => [[
+                'type' => 'htmleditor',
+                'value' => 'atto'
+            ], [
+                'type' => 'invalidpreference',
+                'value' => 'abcd'
+            ]]
            );

        $context = context_system::instance();
@@ -503,6 +510,8 @@ class core_user_externallib_testcase extends externallib_advanced_testcase {
            $this->assertEquals($dbuser->description, $user1['description']);
            $this->assertEquals($dbuser->city, $user1['city']);
            $this->assertEquals($dbuser->country, $user1['country']);
+            $this->assertEquals('atto', get_user_preferences('htmleditor', null, $dbuser));
+            $this->assertEquals(null, get_user_preferences('invalidpreference', null, $dbuser));
        }

        // Call without required capability
@@ -657,14 +666,39 @@ class core_user_externallib_testcase extends externallib_advanced_testcase {
            'email' => 'usertest1@example.com',
            'description' => 'This is a description for user 1',
            'city' => 'Perth',
-            'country' => 'au'
+            'country' => 'au',
+            'preferences' => [[
+                'type' => 'htmleditor',
+                'value' => 'atto'
+            ], [
+                'type' => 'invalidpreference',
+                'value' => 'abcd'
+            ]]
            );

        $context = context_system::instance();
        $roleid = $this->assignUserCapability('moodle/user:update', $context->id);

+        // Check we can't update deleted users, guest users, site admin.
+        $user2 = $user3 = $user4 = $user1;
+        $user2['id'] = $CFG->siteguest;
+
+        $siteadmins = explode(',', $CFG->siteadmins);
+        $user3['id'] = array_shift($siteadmins);
+
+        $userdeleted = self::getDataGenerator()->create_user();
+        $user4['id'] = $userdeleted->id;
+        user_delete_user($userdeleted);
+
        // Call the external function.
-        core_user_external::update_users(array($user1));
+        core_user_external::update_users(array($user1, $user2, $user3, $user4));
+
+        $dbuser2 = $DB->get_record('user', array('id' => $user2['id']));
+        $this->assertNotEquals($dbuser2->username, $user2['username']);
+        $dbuser3 = $DB->get_record('user', array('id' => $user3['id']));
+        $this->assertNotEquals($dbuser3->username, $user3['username']);
+        $dbuser4 = $DB->get_record('user', array('id' => $user4['id']));
+        $this->assertNotEquals($dbuser4->username, $user4['username']);

        $dbuser = $DB->get_record('user', array('id' => $user1['id']));
        $this->assertEquals($dbuser->username, $user1['username']);
@@ -675,6 +709,8 @@ class core_user_externallib_testcase extends externallib_advanced_testcase {
        $this->assertEquals($dbuser->description, $user1['description']);
        $this->assertEquals($dbuser->city, $user1['city']);
        $this->assertEquals($dbuser->country, $user1['country']);
+        $this->assertEquals('atto', get_user_preferences('htmleditor', null, $dbuser));
+        $this->assertEquals(null, get_user_preferences('invalidpreference', null, $dbuser));

        // Call without required capability.
        $this->unassignUserCapability('moodle/user:update', $context->id, $roleid);
@@ -29,11 +29,11 @@

 defined('MOODLE_INTERNAL') || die();

-$version  = 2014051215.00;              // 20140512      = branching date YYYYMMDD - do not modify!
+$version  = 2014051220.00;              // 20140512      = branching date YYYYMMDD - do not modify!
                                        //         RR    = release increments - 00 in DEV branches.
                                        //           .XX = incremental changes.

-$release  = '2.7.15 (Build: 20160711)'; // Human-friendly version name
+$release  = '2.7.20 (Build: 20170508)'; // Human-friendly version name

 $branch   = '27';                       // This version's branch.
 $maturity = MATURITY_STABLE;             // This version's maturity level.
@@ -421,6 +421,16 @@ class webservice {
        $DB->delete_records('external_tokens', array('id'=>$tokenid));
    }

+    /**
+     * Delete all the tokens belonging to a user.
+     *
+     * @param int $userid the user id whose tokens must be deleted
+     */
+    public static function delete_user_ws_tokens($userid) {
+        global $DB;
+        $DB->delete_records('external_tokens', array('userid' => $userid));
+    }
+
    /**
     * Delete a service
     * Also delete function references and authorised user references.
Author	SHA1	Message	Date
Eloy Lafuente (stronk7)	54a393ab62	Moodle release 2.7.20	2017-05-07 21:32:36 +02:00
Marina Glancy	debff7fe73	MDL-58740 block_course_overview: check session key Thanks to Kukas Schmidt for initial patch	2017-05-04 08:55:16 +08:00
Marina Glancy	7ab7bd886d	MDL-58670 blog: respect capability to search entries	2017-05-04 08:55:16 +08:00
Marina Glancy	d4ece04082	MDL-58635 blogs: check edited blog belongs to current user	2017-05-04 08:55:16 +08:00
David Monllao	d463c79ec2	weekly release 2.7.19+	2017-05-03 10:27:36 +08:00
Andrew Nicols	6cfcfff118	MDL-58746 core: Simplify environment check	2017-05-03 09:20:29 +08:00
Andrew Nicols	7a142305cf	MDL-58746 core: Add environment check for finfo	2017-05-01 13:22:49 +08:00
Dan Poltawski	aa45fcf78e	Merge branch 'MDL-58672_27' of git://github.com/stronk7/moodle into MOODLE_27_STABLE	2017-04-29 09:01:14 +01:00
Eloy Lafuente (stronk7)	799f198aa1	MDL-58672 timezones: Updated to 2017b	2017-04-27 20:34:05 +02:00
Eloy Lafuente (stronk7)	13ba557a2b	MDL-54901 environment: pg93 & openssl	2017-04-18 04:04:18 +02:00
Eloy Lafuente (stronk7)	b25797ced3	MDL-54901 environment: 3.3 base information This is a direct copy of the 3.2 branch to have changes under control easier in next commits.	2017-04-18 03:11:24 +02:00
Eloy Lafuente (stronk7)	008248c5b1	Moodle release 2.7.19	2017-03-11 22:15:46 +01:00
Marina Glancy	b34eca2f9e	MDL-58010 user: allow to update only whitelisted preferences	2017-03-10 18:12:39 +00:00
Eloy Lafuente (stronk7)	1f2a60e458	weekly release 2.7.18+	2017-01-27 00:27:42 +01:00
Dan Poltawski	7f54185c69	Merge branch 'MDL-57639-27' of git://github.com/andrewnicols/moodle into MOODLE_27_STABLE	2017-01-24 10:11:25 +00:00
Dan Poltawski	54b3003c92	Merge branch 'MDL-57677-27-usermodified' of git://github.com/mudrd8mz/moodle into MOODLE_27_STABLE	2017-01-23 09:49:29 +00:00
Andrew Nicols	43235c6236	MDL-57639 mod_forum: Update to use correct variable name This addresses a regression where unnecessary attributes were removed from the old variable. This one was missed.	2017-01-19 13:49:03 +08:00
David Mudrák	3bb94d6919	MDL-57677 mod_forum: Fix wrong user displayed as the last post's author In the recent issue MDL-56225, we started to record the current user as the usermodified in the forum_discussions table when updating a forum post. It made sense but it was a mistake. Even if the current user really modifies the discussion by updating the post, the field usermodified has actually been always interpreted and displayed as the last post' author. Not as the last user who touched the discussion. This patch reverts that particular change to the previous behaviour and adds explicit unit test for it.	2017-01-17 21:16:56 +01:00
Eloy Lafuente (stronk7)	d6cf0e56d1	Moodle release 2.7.18	2017-01-08 11:04:13 +01:00
Eloy Lafuente (stronk7)	6ee6517142	Merge branch 'install_27_STABLE' of https://git.in.moodle.com/amosbot/moodle-install into MOODLE_27_STABLE	2017-01-08 11:04:10 +01:00
David Mudrák	d88aa76c77	MDL-57580 mod_assign: Fix the incorrect type of some input parameters The PARAM_TEXT has been misused in certain cases here. The 'action' parameter seems to always be alphabetic, with values like savesubmission, editsubmission and others as handled in assign::view(). Fixing the action handling fixes the reported XSS issue. While working on it, I spotted two more places where PARAM_TEXT does not seem appropriate. I include changes for them too, even if they are no strictly related to the reported bug and there are no known ways to abuse it. * The 'plugin' looks like PARAM_PLUGIN and is even declared as such in some other parts of the assignment code (such as feedback forms). * The 'workflowstate' is one of the ASSIGN_MARKING_WORKFLOW_STATE constants and is supposed to be alpha in external function input parameters handling, too.	2017-01-05 17:40:49 +01:00
Rajesh Taneja	3f3e62e4fc	MDL-57531 behat: Set noreplyaddress to valid address noreplyaddress should be a valid address, else it will not be saved. For behat we don't send email, so set it to noreply@example.com, to avoid failing validation on localhost	2017-01-05 06:55:52 +00:00
Dan Poltawski	7815c64b0c	Merge branch 'MDL-57531-27-phpmailer' of git://github.com/mudrd8mz/moodle into MOODLE_27_STABLE	2017-01-04 13:30:59 +00:00
David Mudrák	a444a47d14	MDL-57531 mail: Validate the sender's email address The patch adds validation for the noreplyaddress setting variable, for the explicit $replyto parameter and for the sender's email. In case of misconfigured noreplyaddress setting, it falls back to the default noreply address value. In case of invalid email in the user's record, the email is not sent. The patch also adds unit test for the value returned by the function generate_email_processing_address() so that it can be considered as a valid email, too. This is supposed to significantly minimise the risk of exploiting the vulnerability in PHPMailer's Sender field.	2017-01-04 13:30:52 +01:00
David Mudrák	9267c05fb1	MDL-57531 mail: Do not let admins set invalid email addresses The noreply and support emails should always be valid.	2017-01-04 13:26:58 +01:00
David Mudrák	172d31e9a5	MDL-56225 mod_forum: Fix inability to edit attachments The 'attachments' is not a real DB field here. It comes from the form's filepicker and holds the id of the attachments filearea. The function forum_add_attachment() expects it as a property of the first argument. There were two possible approaches here. Either to pass the raw $newpost to forum_add_attachment(), or add the attachments into the list modifiable fields. The second approach is safer.	2017-01-04 10:37:42 +00:00
Andrew Nicols	76523cdfa9	MDL-56225 mod_forum: Remove unnecessary attributes from update	2017-01-03 17:42:49 +00:00
AMOS bot	4733c7050b	Automatically generated installer lang files	2016-12-01 00:06:42 +08:00
AMOS bot	98bb032ead	Merge branch 'MOODLE_27_STABLE' into install_27_STABLE	2016-12-01 00:06:42 +08:00
AMOS bot	12eeadd914	Automatically generated installer lang files	2016-11-30 00:05:37 +08:00
Dan Poltawski	1504e9b81e	weekly release 2.7.17+	2016-11-29 13:36:11 +00:00
Dan Poltawski	7bef8b0693	Merge branch 'install_27_STABLE' of https://git.in.moodle.com/amosbot/moodle-install into MOODLE_27_STABLE	2016-11-29 13:36:10 +00:00
Vladimir Zhirov	4120362395	MDL-57163 installation: fixed "Call to undefined function curl_version"	2016-11-27 12:20:22 +04:00
AMOS bot	8c35f12a8f	Automatically generated installer lang files	2016-11-27 00:06:38 +08:00
AMOS bot	f81c6fdec8	Automatically generated installer lang files	2016-11-23 00:06:12 +08:00
AMOS bot	d92b0800d4	Automatically generated installer lang files	2016-11-17 00:05:45 +08:00
Eloy Lafuente (stronk7)	413f973528	Moodle release 2.7.17	2016-11-12 20:21:14 +01:00
Eloy Lafuente (stronk7)	9ebc70478c	Merge branch 'install_27_STABLE' of https://git.in.moodle.com/amosbot/moodle-install into MOODLE_27_STABLE	2016-11-12 20:21:11 +01:00
Andrew Nicols	ec452fbb5c	Merge branch 'MDL-55121-27' of git://github.com/lameze/moodle into MOODLE_27_STABLE	2016-11-11 15:15:41 +08:00
Simey Lameze	d37bb7c46b	MDL-55121 environment: check for unsuported php version 7.1	2016-11-11 12:36:29 +08:00
Dan Poltawski	8f4e115c4f	Merge branch 'MDL-55777-27' of git://github.com/ankitagarwal/moodle into MOODLE_27_STABLE	2016-11-10 13:46:52 +00:00
Ankit Agarwal	d4f9bdbcc1	MDL-55777 installation: Check libcurl version on install	2016-11-10 10:26:03 +05:30
AMOS bot	cc1614d05f	Automatically generated installer lang files	2016-11-07 00:05:43 +08:00
Simey Lameze	b163efd07f	MDL-51347 core_notes: check view notes capability by course context	2016-10-17 16:18:39 +08:00
AMOS bot	2678d6f078	Automatically generated installer lang files	2016-10-17 00:07:37 +08:00
AMOS bot	9d3e4f4340	Automatically generated installer lang files	2016-10-12 00:05:47 +08:00
Tim Hunt	2045bc333a	MDL-53744 question file access: fix access checks	2016-10-10 11:11:39 +08:00
AMOS bot	ecfb290941	Automatically generated installer lang files	2016-10-09 00:07:21 +08:00
AMOS bot	9ad7551401	Automatically generated installer lang files	2016-10-08 00:05:39 +08:00
AMOS bot	07c4ebe443	Automatically generated installer lang files	2016-10-05 00:07:20 +08:00
AMOS bot	dc3655f55a	Automatically generated installer lang files	2016-09-28 00:05:31 +08:00
Juan Leyva	e552a8c7a2	MDL-56065 user: Fix update_users Web Service Users won’t be updated if: - They are admins and the user updating is not - They are the guest user - They are mnet users - They are deleted users	2016-09-26 18:39:50 +02:00
AMOS bot	321e82a9a8	Automatically generated installer lang files	2016-09-17 00:05:36 +08:00
AMOS bot	feb2e0bebd	Automatically generated installer lang files	2016-09-16 00:06:01 +08:00
Dan Poltawski	bf44038b22	weekly release 2.7.16+	2016-09-15 11:15:14 +01:00
Jake Dallimore	607beb59b0	MDL-55945 login: fix https support for forgot_password.php	2016-09-15 09:24:24 +08:00
Eloy Lafuente (stronk7)	1f04e7c685	Moodle release 2.7.16	2016-09-10 22:50:03 +02:00
Eloy Lafuente (stronk7)	f9705ee40a	Merge branch 'install_27_STABLE' of https://git.in.moodle.com/amosbot/moodle-install into MOODLE_27_STABLE	2016-09-10 22:49:58 +02:00
AMOS bot	9a866e798c	Automatically generated installer lang files	2016-08-30 00:05:51 +08:00
Jake Dallimore	ab924a2bdb	MDL-50803 login: Remove token from URL in forgot password process Store the token value in the session and redirect to self, thus removing the token from the URL and eliminating the problem where the token is exposed via the http referer header.	2016-08-16 10:29:36 +01:00
AMOS bot	2cbc50c4f2	Automatically generated installer lang files	2016-08-10 00:05:49 +08:00
AMOS bot	ef1da08e16	Automatically generated installer lang files	2016-08-06 00:05:54 +08:00
Juan Leyva	53ae713302	MDL-49026 webservice: Remove tokens on password change	2016-08-02 09:35:12 +08:00
AMOS bot	686a1a8add	Automatically generated installer lang files	2016-08-02 00:05:17 +08:00
AMOS bot	9d613188bf	Automatically generated installer lang files	2016-07-20 00:06:10 +08:00
AMOS bot	64a011a163	Automatically generated installer lang files	2016-07-16 00:06:28 +08:00
AMOS bot	94e882e044	Automatically generated installer lang files	2016-07-13 00:05:40 +08:00
AMOS bot	e75204b50f	Automatically generated installer lang files	2016-07-11 00:06:48 +08:00