Moodle release 3.1.12

MDL-62469 qtype_calculated: check remaining placeholders, see MDL-62275
Amended for phpunit 4.x exception expectations.
2018-05-16 18:42:02 +02:00 · 2018-05-16 18:04:59 +02:00 · 2018-05-15 09:42:19 +02:00 · 2018-05-15 09:42:18 +02:00 · 2018-05-15 00:07:06 +00:00 · 2018-05-13 00:07:23 +00:00
592 changed files with 14505 additions and 3248 deletions
@@ -77,9 +77,6 @@ cache:
      - $HOME/.npm

 install:
-    # Disable xdebug. We aren't generating code coverage, and it has a huge impact upon test performance.
-    - rm /home/travis/.phpenv/versions/$(phpenv version-name)/etc/conf.d/xdebug.ini
-
    - >
        if [ "$TASK" = 'PHPUNIT' ];
        then
@@ -102,6 +99,7 @@ install:
        fi

 before_script:
+    - phpenv config-rm xdebug.ini
    - >
      if [ "$TASK" = 'PHPUNIT' -o "$TASK" = 'UPGRADE' ];
      then
@@ -139,11 +137,13 @@ before_script:
          sed -i \
            -e "s%= 'pgsql'%= 'mysqli'%" \
            -e "s%= 'username'%= 'travis'%" \
+            -e "s%=> 'utf8mb4_unicode_ci'%=> 'utf8mb4_bin'%" \
            config.php;

          mysql -u root -e 'SET GLOBAL innodb_file_format=barracuda;' ;
          mysql -u root -e 'SET GLOBAL innodb_file_per_table=ON;' ;
-          mysql -e 'CREATE DATABASE travis_ci_test DEFAULT CHARACTER SET utf8 DEFAULT COLLATE utf8_bin;' ;
+          mysql -u root -e 'SET GLOBAL innodb_large_prefix=ON;' ;
+          mysql -e 'CREATE DATABASE travis_ci_test DEFAULT CHARACTER SET utf8mb4 DEFAULT COLLATE utf8mb4_bin;' ;
        fi
      fi

@@ -36,6 +36,7 @@
            print_error('blockdoesnotexist', 'error');
        }
        $DB->set_field('block', 'visible', '0', array('id'=>$block->id));      // Hide block
+        add_to_config_log('block_visibility', $block->visible, '0', $block->name);
        core_plugin_manager::reset_caches();
        admin_get_root(true, false);  // settings not required - only pages
    }
@@ -45,6 +46,7 @@
            print_error('blockdoesnotexist', 'error');
        }
        $DB->set_field('block', 'visible', '1', array('id'=>$block->id));      // Show block
+        add_to_config_log('block_visibility', $block->visible, '1', $block->name);
        core_plugin_manager::reset_caches();
        admin_get_root(true, false);  // settings not required - only pages
    }
@@ -64,6 +66,7 @@
        if (!in_array($block->name, $undeletableblocktypes)) {
            $undeletableblocktypes[] = $block->name;
            set_config('undeletableblocktypes', implode(',', $undeletableblocktypes));
+            add_to_config_log('block_protect', $unprotect, $protect, $block->name);
        }
        admin_get_root(true, false);  // settings not required - only pages
    }
@@ -75,6 +78,7 @@
        if (in_array($block->name, $undeletableblocktypes)) {
            $undeletableblocktypes = array_diff($undeletableblocktypes, array($block->name));
            set_config('undeletableblocktypes', implode(',', $undeletableblocktypes));
+            add_to_config_log('block_protect', $unprotect, $protect, $block->name);
        }
        admin_get_root(true, false);  // settings not required - only pages
    }
@@ -89,7 +89,7 @@ if ($PAGE->user_allowed_editing()) {
 $savebutton = false;
 $outputhtml = '';
 foreach ($settingspage->children as $childpage) {
-    if ($childpage->is_hidden()) {
+    if ($childpage->is_hidden() || !$childpage->check_access()) {
        continue;
    }
    if ($childpage instanceof admin_externalpage) {
@@ -64,6 +64,71 @@ if (!empty($options['collation'])) {
        cli_error("Error: collation '$collation' is not available on this server!");
    }

+    $collationinfo = explode('_', $collation);
+    $charset = reset($collationinfo);
+
+    $engine = strtolower($DB->get_dbengine());
+
+    // Do checks for utf8mb4.
+    if (strpos($collation, 'utf8mb4') === 0) {
+        // Do we have the right engine?
+        if ($engine !== 'innodb' && $engine !== 'xtradb') {
+            cli_error("Error: '$collation' requires InnoDB or XtraDB set as the engine.");
+        }
+        // Are we using Barracuda?
+        if ($DB->get_row_format() != 'Barracuda') {
+            // Try setting it here.
+            try {
+                $DB->execute("SET GLOBAL innodb_file_format=Barracuda");
+            } catch (dml_exception $e) {
+                cli_error("Error: '$collation' requires the file format to be set to Barracuda.
+                        An attempt was made to change the format, but it failed. Please try doing this manually.");
+            }
+            echo "GLOBAL SETTING: innodb_file_format changed to Barracuda\n";
+        }
+        // Is one file per table being used?
+        if (!$DB->is_file_per_table_enabled()) {
+            try {
+                $DB->execute("SET GLOBAL innodb_file_per_table=1");
+            } catch (dml_exception $e) {
+                cli_error("Error: '$collation' requires the setting 'innodb_file_per_table' be set to 'ON'.
+                        An attempt was made to change the format, but it failed. Please try doing this manually.");
+            }
+            echo "GLOBAL SETTING: innodb_file_per_table changed to 1\n";
+        }
+        // Is large prefix set?
+        if (!$DB->is_large_prefix_enabled()) {
+            try {
+                $DB->execute("SET GLOBAL innodb_large_prefix=1");
+            } catch (dml_exception $e) {
+                cli_error("Error: '$collation' requires the setting 'innodb_large_prefix' be set to 'ON'.
+                        An attempt was made to change the format, but it failed. Please try doing this manually.");
+            }
+            echo "GLOBAL SETTING: innodb_large_prefix changed to 1\n";
+        }
+    }
+
+    $sql = "SHOW VARIABLES LIKE 'collation_database'";
+    if (!$dbcollation = $DB->get_record_sql($sql)) {
+        cli_error("Error: Could not access collation information on the database.");
+    }
+    $sql = "SHOW VARIABLES LIKE 'character_set_database'";
+    if (!$dbcharset = $DB->get_record_sql($sql)) {
+        cli_error("Error: Could not access character set information on the database.");
+    }
+    if ($dbcollation->value !== $collation || $dbcharset->value !== $charset) {
+        // Try to convert the DB.
+        echo "Converting database to '$collation' for $CFG->wwwroot:\n";
+        $sql = "ALTER DATABASE $CFG->dbname DEFAULT CHARACTER SET $charset DEFAULT COLLATE = $collation";
+        try {
+            $DB->change_database_structure($sql);
+        } catch (exception $e) {
+            cli_error("Error: Tried to alter the database with no success. Please try manually changing the database
+                    to the new collation and character set and then run this script again.");
+        }
+        echo "DATABASE CONVERTED\n";
+    }
+
    echo "Converting tables and columns to '$collation' for $CFG->wwwroot:\n";
    $prefix = $DB->get_prefix();
    $prefix = str_replace('_', '\\_', $prefix);
@@ -80,7 +145,7 @@ if (!empty($options['collation'])) {
            $skipped++;

        } else {
-            $DB->change_database_structure("ALTER TABLE $table->name DEFAULT COLLATE = $collation");
+            $DB->change_database_structure("ALTER TABLE $table->name DEFAULT CHARACTER SET $charset DEFAULT COLLATE = $collation");
            echo "CONVERTED\n";
            $converted++;
        }
@@ -96,18 +161,32 @@ if (!empty($options['collation'])) {
                continue;
            }

+            // Check for utf8mb4 collation.
+            $rowformat = $DB->get_row_format_sql($engine, $collation);
+
            if ($column->type === 'tinytext' or $column->type === 'mediumtext' or $column->type === 'text' or $column->type === 'longtext') {
                $notnull = ($column->null === 'NO') ? 'NOT NULL' : 'NULL';
                $default = (!is_null($column->default) and $column->default !== '') ? "DEFAULT '$column->default'" : '';
                // primary, unique and inc are not supported for texts
-                $sql = "ALTER TABLE $table->name MODIFY COLUMN $column->field $column->type COLLATE $collation $notnull $default";
+                $sql = "ALTER TABLE $table->name
+                        MODIFY COLUMN $column->field $column->type
+                        CHARACTER SET $charset
+                        COLLATE $collation $notnull $default";
                $DB->change_database_structure($sql);

            } else if (strpos($column->type, 'varchar') === 0) {
                $notnull = ($column->null === 'NO') ? 'NOT NULL' : 'NULL';
                $default = !is_null($column->default) ? "DEFAULT '$column->default'" : '';
-                // primary, unique and inc are not supported for texts
-                $sql = "ALTER TABLE $table->name MODIFY COLUMN $column->field $column->type COLLATE $collation $notnull $default";
+
+                if ($rowformat != '') {
+                    $sql = "ALTER TABLE $table->name $rowformat";
+                    $DB->change_database_structure($sql);
+                }
+
+                $sql = "ALTER TABLE $table->name
+                        MODIFY COLUMN $column->field $column->type
+                        CHARACTER SET $charset
+                        COLLATE $collation $notnull $default";
                $DB->change_database_structure($sql);
            } else {
                echo "ERROR (unknown column type: $column->type)\n";
@@ -180,7 +259,9 @@ function mysql_get_collations() {
    global $DB;

    $collations = array();
-    $sql = "SHOW COLLATION WHERE Collation LIKE 'utf8\_%' AND Charset = 'utf8'";
+    $sql = "SHOW COLLATION
+            WHERE Collation LIKE 'utf8\_%' AND Charset = 'utf8'
+               OR Collation LIKE 'utf8mb4\_%' AND Charset = 'utf8mb4'";
    $rs = $DB->get_recordset_sql($sql);
    foreach ($rs as $collation) {
        $collations[$collation->collation] = $collation->collation;
@@ -47,6 +47,7 @@ switch ($action) {
        // remove from enabled list
        $key = array_search($editor, $active_editors);
        unset($active_editors[$key]);
+        add_to_config_log('editor_visibility', '1', '0', $editor);
        break;

    case 'enable':
@@ -54,6 +55,7 @@ switch ($action) {
        if (!in_array($editor, $active_editors)) {
            $active_editors[] = $editor;
            $active_editors = array_unique($active_editors);
+            add_to_config_log('editor_visibility', '0', '1', $editor);
        }
        break;

@@ -66,6 +68,7 @@ switch ($action) {
                $fsave = $active_editors[$key];
                $active_editors[$key] = $active_editors[$key + 1];
                $active_editors[$key + 1] = $fsave;
+                add_to_config_log('editor_position', $key, $key + 1, $editor);
            }
        }
        break;
@@ -79,6 +82,7 @@ switch ($action) {
                $fsave = $active_editors[$key];
                $active_editors[$key] = $active_editors[$key - 1];
                $active_editors[$key - 1] = $fsave;
+                add_to_config_log('editor_position', $key, $key - 1, $editor);
            }
        }
        break;
@@ -1723,6 +1723,21 @@
          <ON_CHECK message="libcurlwarning" />
        </FEEDBACK>
      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_format" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfileformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_per_table" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfilepertable" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_large_prefix" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddblargeprefix" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
    </CUSTOM_CHECKS>
  </MOODLE>
  <MOODLE version="3.2" requires="2.7">
@@ -1739,6 +1754,7 @@
      <VENDOR name="oracle" version="10.2" />
    </DATABASE>
    <PHP version="5.6.5" level="required">
+      <RESTRICT function="restrict_php_version_72" message="unsupportedphpversion72" />
    </PHP>
    <PCREUNICODE level="optional">
      <FEEDBACK>
@@ -1873,6 +1889,550 @@
          <ON_CHECK message="libcurlwarning" />
        </FEEDBACK>
      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_format" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfileformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_per_table" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfilepertable" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_large_prefix" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddblargeprefix" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+    </CUSTOM_CHECKS>
+  </MOODLE>
+  <MOODLE version="3.3" requires="2.7">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mariadb" version="5.5.31" />
+      <VENDOR name="mysql" version="5.5.31" />
+      <VENDOR name="postgres" version="9.3" />
+      <VENDOR name="mssql" version="10.0" />
+      <VENDOR name="oracle" version="10.2" />
+    </DATABASE>
+    <PHP version="5.6.5" level="required">
+      <RESTRICT function="restrict_php_version_72" message="unsupportedphpversion72" />
+    </PHP>
+    <PCREUNICODE level="optional">
+      <FEEDBACK>
+        <ON_CHECK message="pcreunicodewarning" />
+      </FEEDBACK>
+    </PCREUNICODE>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="opensslrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zlib" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="gdrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlreader" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="intlrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="hash" level="required"/>
+      <PHP_EXTENSION name="fileinfo" level="required"/>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="96M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="opcache.enable" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opcacherecommended" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+    <CUSTOM_CHECKS>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_storage_engine" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbstorageengine" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="question/engine/upgrade/upgradelib.php" function="quiz_attempts_upgraded" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="quizattemptsupgradedmessage" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_slasharguments" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="slashargumentswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_tables_row_format" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unsupporteddbtablerowformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_unoconv_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unoconvwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_libcurl_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="libcurlwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_format" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfileformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_per_table" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfilepertable" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_large_prefix" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddblargeprefix" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_is_https" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="ishttpswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_incomplete_unicode_support" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="incompleteunicodesupport" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+    </CUSTOM_CHECKS>
+  </MOODLE>
+  <MOODLE version="3.4" requires="3.0">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mariadb" version="5.5.31" />
+      <VENDOR name="mysql" version="5.5.31" />
+      <VENDOR name="postgres" version="9.3" />
+      <VENDOR name="mssql" version="10.0" />
+      <VENDOR name="oracle" version="10.2" />
+    </DATABASE>
+    <PHP version="7.0.0" level="required">
+    </PHP>
+    <PCREUNICODE level="optional">
+      <FEEDBACK>
+        <ON_CHECK message="pcreunicodewarning" />
+      </FEEDBACK>
+    </PCREUNICODE>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="opensslrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zlib" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="gdrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlreader" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="intlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="hash" level="required"/>
+      <PHP_EXTENSION name="fileinfo" level="required"/>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="96M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="opcache.enable" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opcacherecommended" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+    <CUSTOM_CHECKS>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_storage_engine" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbstorageengine" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="question/engine/upgrade/upgradelib.php" function="quiz_attempts_upgraded" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="quizattemptsupgradedmessage" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_slasharguments" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="slashargumentswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_tables_row_format" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unsupporteddbtablerowformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_unoconv_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unoconvwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_libcurl_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="libcurlwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_format" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfileformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_per_table" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfilepertable" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_large_prefix" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddblargeprefix" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_is_https" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="ishttpswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_incomplete_unicode_support" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="incompleteunicodesupport" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+    </CUSTOM_CHECKS>
+  </MOODLE>
+  <MOODLE version="3.5" requires="3.1">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mariadb" version="5.5.31" />
+      <VENDOR name="mysql" version="5.5.31" />
+      <VENDOR name="postgres" version="9.3" />
+      <VENDOR name="mssql" version="10.0" />
+      <VENDOR name="oracle" version="10.2" />
+    </DATABASE>
+    <PHP version="7.0.0" level="required">
+    </PHP>
+    <PCREUNICODE level="optional">
+      <FEEDBACK>
+        <ON_CHECK message="pcreunicodewarning" />
+      </FEEDBACK>
+    </PCREUNICODE>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="opensslrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zlib" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="gdrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlreader" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="intlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="hash" level="required"/>
+      <PHP_EXTENSION name="fileinfo" level="required"/>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="96M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="opcache.enable" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opcacherecommended" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+    <CUSTOM_CHECKS>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_storage_engine" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbstorageengine" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="question/engine/upgrade/upgradelib.php" function="quiz_attempts_upgraded" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="quizattemptsupgradedmessage" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_slasharguments" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="slashargumentswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_tables_row_format" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unsupporteddbtablerowformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_unoconv_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unoconvwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_libcurl_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="libcurlwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_format" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfileformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_per_table" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfilepertable" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_large_prefix" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddblargeprefix" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_is_https" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="ishttpswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_incomplete_unicode_support" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="incompleteunicodesupport" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
    </CUSTOM_CHECKS>
  </MOODLE>
 </COMPATIBILITY_MATRIX>
@@ -852,10 +852,17 @@ $cachewarnings = cache_helper::warnings();
 // Check if there are events 1 API handlers.
 $eventshandlers = $DB->get_records_sql('SELECT DISTINCT component FROM {events_handlers}');

+// Check if a directory with development libraries exists.
+if (is_dir($CFG->dirroot.'/vendor') || is_dir($CFG->dirroot.'/node_modules')) {
+    $devlibdir = true;
+} else {
+    $devlibdir = false;
+}
+
 admin_externalpage_setup('adminnotifications');

 $output = $PAGE->get_renderer('core', 'admin');

 echo $output->admin_notifications_page($maturity, $insecuredataroot, $errorsdisplayed, $cronoverdue, $dbproblems,
                                       $maintenancemode, $availableupdates, $availableupdatesfetch, $buggyiconvnomb,
-                                       $registered, $cachewarnings, $eventshandlers);
+                                       $registered, $cachewarnings, $eventshandlers, null, $devlibdir);
@@ -421,12 +421,12 @@ class site_registration_form extends moodleform {
            $mform->addElement('checkbox', 'badges', '',
                    " " . get_string('badgesnumber', 'hub', $badges));
            $mform->setDefault('badges', $badgesnumber != -1);
-            $mform->setType('resources', PARAM_INT);
+            $mform->setType('badges', PARAM_INT);

            $mform->addElement('checkbox', 'issuedbadges', '',
                    " " . get_string('issuedbadgesnumber', 'hub', $issuedbadges));
            $mform->setDefault('issuedbadges', $issuedbadgesnumber != -1);
-            $mform->setType('resources', PARAM_INT);
+            $mform->setType('issuedbadges', PARAM_INT);

            $mform->addElement('checkbox', 'participantnumberaverage', '',
                    " " . get_string('participantnumberaverage', 'hub', $participantnumberaverage));
@@ -276,12 +276,15 @@ class core_admin_renderer extends plugin_renderer_base {
     * @param int|null $availableupdatesfetch timestamp of the most recent updates fetch or null (unknown)
     * @param string[] $cachewarnings An array containing warnings from the Cache API.
     * @param array $eventshandlers Events 1 API handlers.
+     * @param bool $ignored Forward-compatible placeholder for the themedesignermode.
+     * @param bool $devlibdir Warn about development libs directory presence.
     *
     * @return string HTML to output.
     */
    public function admin_notifications_page($maturity, $insecuredataroot, $errorsdisplayed,
            $cronoverdue, $dbproblems, $maintenancemode, $availableupdates, $availableupdatesfetch,
-            $buggyiconvnomb, $registered, array $cachewarnings = array(), $eventshandlers = 0) {
+            $buggyiconvnomb, $registered, array $cachewarnings = array(), $eventshandlers = 0,
+            $ignored = false, $devlibdir = false) {
        global $CFG;
        $output = '';

@@ -290,6 +293,7 @@ class core_admin_renderer extends plugin_renderer_base {
        $output .= $this->legacy_log_store_writing_error();
        $output .= empty($CFG->disableupdatenotifications) ? $this->available_updates($availableupdates, $availableupdatesfetch) : '';
        $output .= $this->insecure_dataroot_warning($insecuredataroot);
+        $output .= $this->development_libs_directories_warning($devlibdir);
        $output .= $this->display_errors_warning($errorsdisplayed);
        $output .= $this->buggy_iconv_warning($buggyiconvnomb);
        $output .= $this->cron_overdue_warning($cronoverdue);
@@ -519,6 +523,24 @@ class core_admin_renderer extends plugin_renderer_base {
        }
    }

+    /**
+     * Render a warning that a directory with development libs is present.
+     *
+     * @param bool $devlibdir True if the warning should be displayed.
+     * @return string
+     */
+    protected function development_libs_directories_warning($devlibdir) {
+
+        if ($devlibdir) {
+            $moreinfo = new moodle_url('/report/security/index.php');
+            $warning = get_string('devlibdirpresent', 'core_admin', ['moreinfourl' => $moreinfo->out()]);
+            return $this->warning($warning, 'error');
+
+        } else {
+            return '';
+        }
+    }
+
    /**
     * Render an appropriate message if dataroot is insecure.
     * @param bool $errorsdisplayed
@@ -1598,7 +1620,7 @@ class core_admin_renderer extends plugin_renderer_base {
                $row = new html_table_row();
                $row->attributes['class'] = 'type-' . $plugin->type . ' name-' . $plugin->type . '_' . $plugin->name;

-                if ($this->page->theme->resolve_image_location('icon', $plugin->type . '_' . $plugin->name)) {
+                if ($this->page->theme->resolve_image_location('icon', $plugin->type . '_' . $plugin->name, null)) {
                    $icon = $this->output->pix_icon('icon', '', $plugin->type . '_' . $plugin->name, array('class' => 'icon pluginicon'));
                } else {
                    $icon = $this->output->pix_icon('spacer', '', 'moodle', array('class' => 'icon pluginicon noicon'));
@@ -32,7 +32,9 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
    $ADMIN->add('development', $temp);

    // "Profiling" settingpage (conditionally if the 'xhprof' extension is available only).
-    $xhprofenabled = extension_loaded('xhprof') || extension_loaded('tideways');
+    $xhprofenabled = extension_loaded('tideways_xhprof');
+    $xhprofenabled = $xhprofenabled || extension_loaded('tideways');
+    $xhprofenabled = $xhprofenabled || extension_loaded('xhprof');
    $temp = new admin_settingpage('profiling', new lang_string('profiling', 'admin'), 'moodle/site:config', !$xhprofenabled);
    // Main profiling switch.
    $temp->add(new admin_setting_configcheckbox('profilingenabled', new lang_string('profilingenabled', 'admin'), new lang_string('profilingenabled_help', 'admin'), false));
@@ -28,9 +28,12 @@ if ($primaryadmin) {
    $primaryadminemail = NULL;
    $primaryadminname  = NULL;
 }
-$temp->add(new admin_setting_configtext('supportname', new lang_string('supportname', 'admin'), new lang_string('configsupportname', 'admin'), $primaryadminname, PARAM_NOTAGS));
-$temp->add(new admin_setting_configtext('supportemail', new lang_string('supportemail', 'admin'), new lang_string('configsupportemail', 'admin'), $primaryadminemail, PARAM_NOTAGS));
-$temp->add(new admin_setting_configtext('supportpage', new lang_string('supportpage', 'admin'), new lang_string('configsupportpage', 'admin'), '', PARAM_URL));
+$temp->add(new admin_setting_configtext('supportname', new lang_string('supportname', 'admin'),
+    new lang_string('configsupportname', 'admin'), $primaryadminname, PARAM_NOTAGS));
+$temp->add(new admin_setting_configtext('supportemail', new lang_string('supportemail', 'admin'),
+    new lang_string('configsupportemail', 'admin'), $primaryadminemail, PARAM_EMAIL));
+$temp->add(new admin_setting_configtext('supportpage', new lang_string('supportpage', 'admin'),
+    new lang_string('configsupportpage', 'admin'), '', PARAM_URL));
 $ADMIN->add('server', $temp);


@@ -26,7 +26,6 @@ if (isset($_SERVER['REMOTE_ADDR'])) {
    die(); // No access from web!
 }

-define('BEHAT_UTIL', true);
 define('CLI_SCRIPT', true);
 define('ABORT_AFTER_CONFIG', true);
 define('CACHE_DISABLE_ALL', true);
@@ -0,0 +1,42 @@
+@tool @tool_behat
+Feature: Backported behat step definitions
+  In order to provide feature file compatibility between multiple Moodle versions
+  As a developer
+  I need to be able to use backported steps from newer Moodle versiosn
+
+  Background:
+    Given the following "users" exist:
+      | username | firstname | lastname | email |
+      | student1 | Student | 1 | student1@example.com |
+      | teacher1 | Teacher | 1 | teacher1@example.com |
+    And the following "courses" exist:
+      | fullname | shortname | format |
+      | Course 1 | C101 | topics |
+    And the following "course enrolments" exist:
+      | user | course | role |
+      | student1 | C101 | student |
+      | teacher1 | C101 | editingteacher |
+
+  Scenario: I am on the course homepage
+    When I log in as "student1"
+    And I am on "Course 1" course homepage
+    Then I should see "Topic 1"
+
+  @javascript
+  Scenario: I am on the course homepage with JS
+    When I log in as "teacher1"
+    And I am on "Course 1" course homepage
+    Then I should see "Topic 1"
+
+  Scenario: I am on the course homepage with editing
+    When I log in as "teacher1"
+    And I am on "Course 1" course homepage with editing mode on
+    Then I should see "Topic 1"
+    And I should see "Add an activity or resource"
+
+  @javascript
+  Scenario: I am on the course homepage with editing and JS
+    When I log in as "teacher1"
+    And I am on "Course 1" course homepage with editing mode on
+    Then I should see "Topic 1"
+    And I should see "Add an activity or resource"
@@ -7,8 +7,7 @@ Feature: Forms manipulation
  @javascript
  Scenario: Basic forms manipulation
    Given I log in as "admin"
-    And I follow "Preferences" in the user menu
-    And I follow "Edit profile"
+    And I open my profile in edit mode
    When I set the field "First name" to "Field value"
    And I set the field "Select a country" to "Japan"
    And I set the field "Unmask" to "1"
@@ -10,8 +10,7 @@ Feature: Transform steps arguments
      | fullname | shortname | category |
      | Course 1 | C1 | 0 |
    And I log in as "admin"
-    And I follow "Preferences" in the user menu
-    And I follow "Edit profile"
+    And I open my profile in edit mode

  Scenario: Use nasty strings on steps arguments
    When I set the field "Surname" to "$NASTYSTRING1"
@@ -50,7 +50,8 @@ class cohort_summary_exporter extends \core_competency\external\exporter {
            ),
            'idnumber' => array(
                'type' => PARAM_RAW,        // ID numbers are plain text.
-                'default' => ''
+                'default' => '',
+                'null' => NULL_ALLOWED
            ),
            'visible' => array(
                'type' => PARAM_BOOL,
@@ -99,7 +99,7 @@ class competency extends persistent {
        // Description.
        $mform->addElement('editor', 'description',
                           get_string('description', 'tool_lp'), array('rows' => 4));
-        $mform->setType('description', PARAM_RAW);
+        $mform->setType('description', PARAM_CLEANHTML);
        // ID number.
        $mform->addElement('text', 'idnumber', get_string('idnumber', 'tool_lp'), 'maxlength="100"');
        $mform->setType('idnumber', PARAM_RAW);
@@ -62,7 +62,7 @@ class competency_framework extends persistent {
        // Description.
        $mform->addElement('editor', 'description',
                           get_string('description', 'tool_lp'), array('rows' => 4));
-        $mform->setType('description', PARAM_RAW);
+        $mform->setType('description', PARAM_CLEANHTML);
        // ID number.
        $mform->addElement('text', 'idnumber', get_string('idnumber', 'tool_lp'), 'maxlength="100"');
        $mform->setType('idnumber', PARAM_RAW);
@@ -184,8 +184,14 @@ abstract class persistent extends moodleform {
        $data = $this->get_persistent()->to_record();
        $class = static::$persistentclass;
        $properties = $class::get_formatted_properties();
+        $allproperties = $class::properties_definition();

        foreach ($data as $field => $value) {
+            // Clean data if it is to be displayed in a form.
+            if (isset($allproperties[$field]['type'])) {
+                $data->$field = clean_param($data->$field, $allproperties[$field]['type']);
+            }
+
            // Convert formatted properties.
            if (isset($properties[$field])) {
                $data->$field = array(
@@ -59,7 +59,7 @@ class plan extends persistent {
        $mform->addRule('name', get_string('maximumchars', '', 100), 'maxlength', 100, 'client');
        // Description.
        $mform->addElement('editor', 'description', get_string('plandescription', 'tool_lp'), array('rows' => 4));
-        $mform->setType('description', PARAM_RAW);
+        $mform->setType('description', PARAM_CLEANHTML);

        $mform->addElement('date_time_selector', 'duedate', get_string('duedate', 'tool_lp'), array('optional' => true));
        $mform->addHelpButton('duedate', 'duedate', 'tool_lp');
@@ -58,7 +58,7 @@ class template extends persistent {
        // Description.
        $mform->addElement('editor', 'description',
                           get_string('description', 'tool_lp'), array('rows' => 4));
-        $mform->setType('description', PARAM_RAW);
+        $mform->setType('description', PARAM_CLEANHTML);
        $mform->addElement('selectyesno', 'visible',
                           get_string('visible', 'tool_lp'));
        $mform->addElement('date_time_selector',
@@ -54,7 +54,7 @@ class user_evidence extends persistent {
        $mform->addRule('name', get_string('maximumchars', '', 100), 'maxlength', 100, 'client');
        // Description.
        $mform->addElement('editor', 'description', get_string('userevidencedescription', 'tool_lp'), array('rows' => 10));
-        $mform->setType('description', PARAM_RAW);
+        $mform->setType('description', PARAM_CLEANHTML);

        $mform->addElement('url', 'url', get_string('userevidenceurl', 'tool_lp'), array(), array('usefilepicker' => false));
        $mform->setType('url', PARAM_RAW_TRIMMED);      // Can not use PARAM_URL, it silently converts bad URLs to ''.
@@ -92,7 +92,7 @@ require(['core/str'], function(Str) {
        { key: 'comments', component: 'moodle' },
        { key: 'commentscount', component: 'moodle' },
        { key: 'commentsrequirelogin', component: 'moodle' },
-        { key: 'deletecomment', component: 'moodle' },
+        { key: 'deletecommentbyon', component: 'moodle' },
    ]).then(function() {
        // Kick off when strings are loaded.
        Y.use('core_comment', function(Y) {
@@ -396,12 +396,8 @@ class tool_lpmigrate_framework_processor_testcase extends advanced_testcase {
    }

    public function test_permission_exception() {
-        global $DB;
-        if ($DB->get_dbfamily() === 'postgres' or $DB->get_dbfamily() === 'mssql') {
-            $this->markTestSkipped('The processor is having issues with the transaction initialised in '
-                . 'advanced_testcase::runBare().');
-            return;
-        }
+
+        $this->preventResetByRollback(); // Test uses transactions, so we cannot use them for speedy reset.

        $dg = $this->getDataGenerator();
        $u = $dg->create_user();
@@ -125,9 +125,7 @@ class manager {

        } catch (\Horde_Imap_Client_Exception $e) {
            $message = $e->getMessage();
-            mtrace("Unable to connect to IMAP server. Failed with '{$message}'");
-
-            return false;
+            throw new \moodle_exception('imapconnectfailure', 'tool_messageinbound', '', null, $message);
        }
    }

@@ -45,6 +45,13 @@ class api {
        global $CFG;
        require_once($CFG->libdir . '/adminlib.php');

+        // Check if we can return this from cache.
+        $cache = \cache::make('tool_mobile', 'plugininfo');
+        $pluginsinfo = $cache->get('mobileplugins');
+        if ($pluginsinfo !== false) {
+            return (array)$pluginsinfo;
+        }
+
        $pluginsinfo = [];
        $plugintypes = core_component::get_plugin_types();

@@ -56,7 +63,7 @@ class api {
                $component = $plugintype . '_' . $plugin;
                $version = get_component_version($component);

-                require_once("$path/db/mobile.php");
+                require("$path/db/mobile.php");
                foreach ($addons as $addonname => $addoninfo) {
                    $plugininfo = array(
                        'component' => $component,
@@ -69,7 +76,7 @@ class api {
                    );

                    // All the mobile packages must be under the plugin mobile directory.
-                    $package = $path . DIRECTORY_SEPARATOR . 'mobile' . DIRECTORY_SEPARATOR . $addonname . '.zip';
+                    $package = $path . '/mobile/' . $addonname . '.zip';
                    if (file_exists($package)) {
                        $plugininfo['fileurl'] = $CFG->wwwroot . '' . str_replace($CFG->dirroot, '', $package);
                        $plugininfo['filehash'] = sha1_file($package);
@@ -79,6 +86,9 @@ class api {
                }
            }
        }
+
+        $cache->set('mobileplugins', $pluginsinfo);
+
        return $pluginsinfo;
    }

@@ -0,0 +1,34 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Mobile cache definitions.
+ *
+ * @package    tool_mobile
+ * @copyright  2017 Skylar Kelty <S.Kelty@kent.ac.uk>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die;
+
+$definitions = array(
+    'plugininfo' => array(
+        'mode' => cache_store::MODE_APPLICATION,
+        'simplekeys' => true,
+        'staticacceleration' => true,
+        'staticaccelerationsize' => 1
+    )
+);
@@ -23,3 +23,4 @@
 */

 $string['pluginname'] = 'Moodle Mobile tools';
+$string['cachedef_plugininfo'] = 'This stores the list of plugins with mobile addons';
@@ -53,10 +53,13 @@ class eventobservers {
     * @param \core\event\course_deleted $event The course deleted event.
     */
    public static function course_deleted(\core\event\course_deleted $event) {
+        // Delete rules defined inside this course and associated subscriptions.
        $rules = rule_manager::get_rules_by_courseid($event->courseid, 0, 0, false);
        foreach ($rules as $rule) {
            rule_manager::delete_rule($rule->id, $event->get_context());
        }
+        // Delete remaining subscriptions inside this course (from site-wide rules).
+        subscription_manager::remove_all_subscriptions_in_course($event->get_context());
    }

    /**
@@ -176,8 +176,12 @@ class subscription {
        if (empty($courseid)) {
            return get_string('site');
        } else {
-            $course = get_course($courseid);
-            return format_string($course->fullname, true, array('context' => $context));
+            try {
+                $course = get_course($courseid);
+                return format_string($course->fullname, true, array('context' => $context));
+            } catch (\dml_exception $e) {
+                return '-';
+            }
        }
    }

@@ -118,9 +118,10 @@ class subscription_manager {

        // If successful trigger a subscription_deleted event.
        if ($success) {
-            if (!empty($subscription->courseid)) {
+            if (!empty($subscription->courseid) &&
+                    ($coursecontext = \context_course::instance($subscription->courseid, IGNORE_MISSING))) {
                $courseid = $subscription->courseid;
-                $context = \context_course::instance($subscription->courseid);
+                $context = $coursecontext;
            } else {
                $courseid = 0;
                $context = \context_system::instance();
@@ -222,6 +223,31 @@ class subscription_manager {
        return $success;
    }

+    /**
+     * Delete all subscriptions in a course.
+     *
+     * This is called after a course was deleted, context no longer exists but we kept the object
+     *
+     * @param \context_course $coursecontext the context of the course
+     */
+    public static function remove_all_subscriptions_in_course($coursecontext) {
+        global $DB;
+
+        // Store all the subscriptions we have to delete.
+        if ($subscriptions = $DB->get_records('tool_monitor_subscriptions', ['courseid' => $coursecontext->instanceid])) {
+            // Delete subscriptions in bulk.
+            $DB->delete_records('tool_monitor_subscriptions', ['courseid' => $coursecontext->instanceid]);
+
+            // Trigger events one by one.
+            foreach ($subscriptions as $subscription) {
+                $params = ['objectid' => $subscription->id, 'context' => $coursecontext];
+                $event = \tool_monitor\event\subscription_deleted::create($params);
+                $event->add_record_snapshot('tool_monitor_subscriptions', $subscription);
+                $event->trigger();
+            }
+        }
+    }
+
    /**
     * Get a subscription instance for an given subscription id.
     *
@@ -77,5 +77,22 @@ function xmldb_tool_monitor_upgrade($oldversion) {
        upgrade_plugin_savepoint(true, 2016052305, 'tool', 'monitor');
    }

+    if ($oldversion < 2016052306) {
+
+        // Delete "orphaned" subscriptions.
+        $sql = "SELECT DISTINCT s.courseid
+                  FROM {tool_monitor_subscriptions} s
+       LEFT OUTER JOIN {course} c ON c.id = s.courseid
+                 WHERE s.courseid <> 0 and c.id IS NULL";
+        $deletedcourses = $DB->get_field_sql($sql);
+        if ($deletedcourses) {
+            list($sql, $params) = $DB->get_in_or_equal($deletedcourses);
+            $DB->execute("DELETE FROM {tool_monitor_subscriptions} WHERE courseid " . $sql, $params);
+        }
+
+        // Monitor savepoint reached.
+        upgrade_plugin_savepoint(true, 2016052306, 'tool', 'monitor');
+    }
+
    return true;
 }
@@ -41,7 +41,7 @@ if (empty($courseid)) {
    // check system level capability.
    if (!has_capability('tool/monitor:subscribe', $context)) {
        // If not system level then check to see if they have access to any course level rules.
-        if (tool_monitor_get_user_courses()){
+        if (tool_monitor_can_subscribe()) {
            // Make them choose a course.
            $choose = true;
        } else {
@@ -75,12 +75,20 @@ function tool_monitor_extend_navigation_frontpage($navigation, $course, $context
 * @param context         $coursecontext     The context of the course
 */
 function tool_monitor_extend_navigation_user_settings($navigation, $user, $usercontext, $course, $coursecontext) {
-    global $USER, $SITE;
+    global $USER, $PAGE;
+
+    // Don't bother doing needless calculations unless we are on the relevant pages.
+    $onpreferencepage = $PAGE->url->compare(new moodle_url('/user/preferences.php'), URL_MATCH_BASE);
+    $onmonitorpage = $PAGE->url->compare(new moodle_url('/admin/tool/monitor/index.php'), URL_MATCH_BASE);
+    if (!$onpreferencepage && !$onmonitorpage) {
+        return null;
+    }

    // Don't show the setting if the event monitor isn't turned on. No access to other peoples subscriptions.
    if (get_config('tool_monitor', 'enablemonitor') && $USER->id == $user->id) {
        // Now let's check to see if the user has any courses / site rules that they can subscribe to.
-        if ($courses = tool_monitor_get_user_courses()) {
+        // We skip doing a check here if we are on the event monitor page as the check is done internally on that page.
+        if ($onmonitorpage || tool_monitor_can_subscribe()) {
            $url = new moodle_url('/admin/tool/monitor/index.php');
            $subsnode = navigation_node::create(get_string('managesubscriptions', 'tool_monitor'), $url,
                    navigation_node::TYPE_SETTING, null, 'monitor', new pix_icon('i/settings', ''));
@@ -92,6 +100,19 @@ function tool_monitor_extend_navigation_user_settings($navigation, $user, $userc
    }
 }

+/**
+ * Check if the user has the capacity to subscribe to an event monitor anywhere.
+ *
+ * @return bool True if a capability in a course is found. False otherwise.
+ */
+function tool_monitor_can_subscribe() {
+    if (has_capability('tool/monitor:subscribe', context_system::instance())) {
+        return true;
+    }
+    $courses = get_user_capability_course('tool/monitor:subscribe', null, true, '', '', 1);
+    return empty($courses) ? false : true;
+}
+
 /**
 * Get a list of courses and also include 'Site' for site wide rules.
 *
@@ -103,8 +124,11 @@ function tool_monitor_get_user_courses() {
    if (has_capability('tool/monitor:subscribe', context_system::instance())) {
        $options[0] = get_string('site');
    }
-    if ($courses = get_user_capability_course('tool/monitor:subscribe', null, true, 'fullname, visible', $orderby)) {
+
+    $fields = 'fullname, visible, ctxid, ctxpath, ctxdepth, ctxlevel, ctxinstance';
+    if ($courses = get_user_capability_course('tool/monitor:subscribe', null, true, $fields, $orderby)) {
        foreach ($courses as $course) {
+            context_helper::preload_from_record($course);
            $coursectx = context_course::instance($course->id);
            if ($course->visible || has_capability('moodle/course:viewhiddencourses', $coursectx)) {
                $options[$course->id] = format_string($course->fullname, true, array('context' => $coursectx));
@@ -26,6 +26,6 @@

 defined('MOODLE_INTERNAL') || die;

-$plugin->version   = 2016052305;     // The current plugin version (Date: YYYYMMDDXX).
+$plugin->version   = 2016052306;     // The current plugin version (Date: YYYYMMDDXX).
 $plugin->requires  = 2016051900;     // Requires this Moodle version.
 $plugin->component = 'tool_monitor'; // Full name of the plugin (used for diagnostics).
@@ -25,8 +25,12 @@

 defined('MOODLE_INTERNAL') || die;

-// profiling tool, added to development
-if ((extension_loaded('xhprof') || extension_loaded('tideways')) && (!empty($CFG->profilingenabled) || !empty($CFG->earlyprofilingenabled))) {
+// Profiling tool, added to development.
+$hasextension = extension_loaded('tideways_xhprof');
+$hasextension = $hasextension || extension_loaded('tideways');
+$hasextension = $hasextension || extension_loaded('xhprof');
+$isenabled = !empty($CFG->profilingenabled) || !empty($CFG->earlyprofilingenabled);
+if ($hasextension && $isenabled) {
    $ADMIN->add('development', new admin_externalpage('toolprofiling', get_string('pluginname', 'tool_profiling'),
            "$CFG->wwwroot/$CFG->admin/tool/profiling/index.php", 'moodle/site:config'));
 }
@@ -75,7 +75,7 @@ if (!empty($delall) && confirm_sesskey()) {
    exit;
 }

-if (!empty($ignore)) {
+if (!empty($ignore) && confirm_sesskey()) {
    unset($SESSION->users_result[$id]);
    echo json_encode(true);
    exit;
@@ -358,38 +358,40 @@ if ($formdata = $mform2->is_cancelled()) {

        // add default values for remaining fields
        $formdefaults = array();
-        foreach ($STD_FIELDS as $field) {
-            if (isset($user->$field)) {
-                continue;
-            }
-            // all validation moved to form2
-            if (isset($formdata->$field)) {
-                // process templates
-                $user->$field = uu_process_template($formdata->$field, $user);
-                $formdefaults[$field] = true;
-                if (in_array($field, $upt->columns)) {
-                    $upt->track($field, s($user->$field), 'normal');
+        if ($updatetype != UU_UPDATE_FILEOVERRIDE && $updatetype != UU_UPDATE_NOCHANGES) {
+            foreach ($STD_FIELDS as $field) {
+                if (isset($user->$field)) {
+                    continue;
+                }
+                // all validation moved to form2
+                if (isset($formdata->$field)) {
+                    // process templates
+                    $user->$field = uu_process_template($formdata->$field, $user);
+                    $formdefaults[$field] = true;
+                    if (in_array($field, $upt->columns)) {
+                        $upt->track($field, s($user->$field), 'normal');
+                    }
                }
            }
-        }
-        foreach ($PRF_FIELDS as $field) {
-            if (isset($user->$field)) {
-                continue;
-            }
-            if (isset($formdata->$field)) {
-                // process templates
-                $user->$field = uu_process_template($formdata->$field, $user);
-
-                // Form contains key and later code expects value.
-                // Convert key to value for required profile fields.
-                require_once($CFG->dirroot.'/user/profile/field/'.$proffields[$field]->datatype.'/field.class.php');
-                $profilefieldclass = 'profile_field_'.$proffields[$field]->datatype;
-                $profilefield = new $profilefieldclass($proffields[$field]->id);
-                if (method_exists($profilefield, 'convert_external_data')) {
-                    $user->$field = $profilefield->edit_save_data_preprocess($user->$field, null);
+            foreach ($PRF_FIELDS as $field) {
+                if (isset($user->$field)) {
+                    continue;
                }
+                if (isset($formdata->$field)) {
+                    // process templates
+                    $user->$field = uu_process_template($formdata->$field, $user);

-                $formdefaults[$field] = true;
+                    // Form contains key and later code expects value.
+                    // Convert key to value for required profile fields.
+                    require_once($CFG->dirroot.'/user/profile/field/'.$proffields[$field]->datatype.'/field.class.php');
+                    $profilefieldclass = 'profile_field_'.$proffields[$field]->datatype;
+                    $profilefield = new $profilefieldclass($proffields[$field]->id);
+                    if (method_exists($profilefield, 'convert_external_data')) {
+                        $user->$field = $profilefield->edit_save_data_preprocess($user->$field, null);
+                    }
+
+                    $formdefaults[$field] = true;
+                }
            }
        }

@@ -33,6 +33,7 @@ $string['deleteerrors'] = 'Delete errors';
 $string['encoding'] = 'Encoding';
 $string['errormnetadd'] = 'Can not add remote users';
 $string['errors'] = 'Errors';
+$string['invalidupdatetype'] = 'You can not select this option with the chosen \'Upload type\'';
 $string['invaliduserdata'] = 'Invalid data detected for user {$a} and it has been automatically cleaned.';
 $string['nochanges'] = 'No changes';
 $string['pluginname'] = 'User upload';
@@ -345,6 +345,7 @@ class admin_uploaduser_form2 extends moodleform {
        $errors = parent::validation($data, $files);
        $columns = $this->_customdata['columns'];
        $optype  = $data['uutype'];
+        $updatetype = $data['uuupdatetype'];

        // detect if password column needed in file
        if (!in_array('password', $columns)) {
@@ -377,6 +378,12 @@ class admin_uploaduser_form2 extends moodleform {
             }
        }

+        // If the 'Existing user details' value is set we need to ensure that the
+        // 'Upload type' is not set to something invalid.
+        if (!empty($updatetype) && ($optype == UU_USER_ADDNEW || $optype == UU_USER_ADDINC)) {
+            $errors['uuupdatetype'] = get_string('invalidupdatetype', 'tool_uploaduser');
+        }
+
        // look for other required data
        if ($optype != UU_USER_UPDATE) {
            $requiredusernames = useredit_get_required_name_fields();
@@ -49,7 +49,7 @@ It\'s highly recommended to be running the latest (+ version) available of your
 This functionality doesn\'t perform any action against the DB (just reads from it), so can be safely executed at any moment.';
 $string['confirmcheckforeignkeys'] = 'This functionality will search for potential violations of the foreign keys defined in the install.xml definitions. (Moodle does not currently generate actual foreign key constraints in the database, which is why invalid data may be present.)

-It\'s highly recommended to be running the latest (+ version) available of your Moodle release before executing the search of missing indexes.
+It\'s highly recommended to be running the latest (+ version) available of your Moodle release before executing the search for potential violations of the foreign keys.

 This functionality doesn\'t perform any action against the DB (just reads from it), so can be safely executed at any moment.';
 $string['confirmcheckindexes'] = 'This functionality will search for potential missing indexes in your Moodle server, generating (but not executing!) automatically the needed SQL statements to keep everything updated.
@@ -3187,6 +3187,18 @@ class CAS_Client
                false/*$no_response*/, true/*$bad_response*/, $text_response
            );
            $result = false;
+        } else if ( $tree_response->getElementsByTagName("authenticationFailure")->length != 0) {
+            // authentication failed, extract the error code and message and throw exception
+            $auth_fail_list = $tree_response
+                ->getElementsByTagName("authenticationFailure");
+            throw new CAS_AuthenticationException(
+                $this, 'Ticket not validated', $validate_url,
+                false/*$no_response*/, false/*$bad_response*/,
+                $text_response,
+                $auth_fail_list->item(0)->getAttribute('code')/*$err_code*/,
+                trim($auth_fail_list->item(0)->nodeValue)/*$err_msg*/
+            );
+            $result = false;
        } else if ($tree_response->getElementsByTagName("authenticationSuccess")->length != 0) {
            // authentication succeded, extract the user name
            $success_elements = $tree_response
@@ -3227,18 +3239,6 @@ class CAS_Client
                    $result = true;
                }
            }
-        } else if ( $tree_response->getElementsByTagName("authenticationFailure")->length != 0) {
-            // authentication succeded, extract the error code and message
-            $auth_fail_list = $tree_response
-                ->getElementsByTagName("authenticationFailure");
-            throw new CAS_AuthenticationException(
-                $this, 'Ticket not validated', $validate_url,
-                false/*$no_response*/, false/*$bad_response*/,
-                $text_response,
-                $auth_fail_list->item(0)->getAttribute('code')/*$err_code*/,
-                trim($auth_fail_list->item(0)->nodeValue)/*$err_msg*/
-            );
-            $result = false;
        } else {
            throw new CAS_AuthenticationException(
                $this, 'Ticket not validated', $validate_url,
@@ -2,3 +2,4 @@ Description of phpCAS 1.3.4 library import

 * downloaded from http://downloads.jasig.org/cas-clients/php/current/

+* MDL-59456 phpCAS library has been patched because of an authentication bypass security vulnerability.
@@ -99,9 +99,31 @@ if (!isset($config->removeuser)) {
 $yesno = array( get_string('no'), get_string('yes') );

 $disabled = '';
-if (!ldap_paged_results_supported($config->ldap_version)) {
+$pagedresultssupported = false;
+if ($config->host_url !== '') {
+    /**
+     * We try to connect each and every time we open the config, because we want to set the Page
+     * Size setting as enabled or disabled depending on the configured LDAP server supporting
+     * pagination or not, and to notify the user about it. If the user changed the LDAP server (or
+     * the LDAP protocol version) last time, it might happen that paged results are no longer
+     * available and we want to show that to the user the next time she goes to the settings page.
+     */
+    try {
+        $ldapconn = $this->ldap_connect();
+        $pagedresultssupported = ldap_paged_results_supported($config->ldap_version, $ldapconn);
+    } catch (Exception $e) {
+        // If we couldn't connect and get the supported options, we can only assume we don't support paged results.
+        $pagedresultssupported = false;
+    }
+}
+/* Make sure we only disable the paged result size setting and show the notification about it if
+ * there is a configured server that we tried to contact.  Othersiwe, if someone's LDAP server does
+ * support paged results, they won't be able to turn it on the first time they set it up (because
+ * the field will be disabled).
+ */
+if (($config->host_url !== '') && (!$pagedresultssupported)) {
    $disabled = ' disabled="disabled"';
-    echo $OUTPUT->notification(get_string('pagedresultsnotsupp', 'auth_ldap'));
+    echo $OUTPUT->notification(get_string('pagedresultsnotsupp', 'auth_ldap'), \core\output\notification::NOTIFY_INFO);
 }

 ?>
@@ -302,18 +302,24 @@ class auth_plugin_db extends auth_plugin_base {

            // Find obsolete users.
            if (count($userlist)) {
-                $remove_users = array();
-                // All the drivers can cope with chunks of 10,000. See line 4491 of lib/dml/tests/dml_est.php
-                $userlistchunks = array_chunk($userlist , 10000);
-                foreach($userlistchunks as $userlistchunk) {
-                    list($notin_sql, $params) = $DB->get_in_or_equal($userlistchunk, SQL_PARAMS_NAMED, 'u', false);
-                    $params['authtype'] = $this->authtype;
-                    $sql = "SELECT u.id, u.username
+                $removeusers = array();
+                $params['authtype'] = $this->authtype;
+                $sql = "SELECT u.id, u.username
                          FROM {user} u
-                         WHERE u.auth=:authtype AND u.deleted=0 AND u.mnethostid=:mnethostid $suspendselect AND u.username $notin_sql";
-                    $params['mnethostid'] = $CFG->mnet_localhost_id;
-                    $remove_users = $remove_users + $DB->get_records_sql($sql, $params);
+                         WHERE u.auth=:authtype
+                           AND u.deleted=0
+                           AND u.mnethostid=:mnethostid
+                           $suspendselect";
+                $params['mnethostid'] = $CFG->mnet_localhost_id;
+                $internalusersrs = $DB->get_recordset_sql($sql, $params);
+
+                $usernamelist = array_flip($userlist);
+                foreach ($internalusersrs as $internaluser) {
+                    if (!array_key_exists($internaluser->username, $usernamelist)) {
+                        $removeusers[] = $internaluser;
+                    }
                }
+                $internalusersrs->close();
            } else {
                $sql = "SELECT u.id, u.username
                          FROM {user} u
@@ -321,13 +327,13 @@ class auth_plugin_db extends auth_plugin_base {
                $params = array();
                $params['authtype'] = $this->authtype;
                $params['mnethostid'] = $CFG->mnet_localhost_id;
-                $remove_users = $DB->get_records_sql($sql, $params);
+                $removeusers = $DB->get_records_sql($sql, $params);
            }

-            if (!empty($remove_users)) {
-                $trace->output(get_string('auth_dbuserstoremove','auth_db', count($remove_users)));
+            if (!empty($removeusers)) {
+                $trace->output(get_string('auth_dbuserstoremove', 'auth_db', count($removeusers)));

-                foreach ($remove_users as $user) {
+                foreach ($removeusers as $user) {
                    if ($this->config->removeuser == AUTH_REMOVEUSER_FULLDELETE) {
                        delete_user($user);
                        $trace->output(get_string('auth_dbdeleteuser', 'auth_db', array('name'=>$user->username, 'id'=>$user->id)), 1);
@@ -340,7 +346,7 @@ class auth_plugin_db extends auth_plugin_base {
                    }
                }
            }
-            unset($remove_users);
+            unset($removeusers);
        }

        if (!count($userlist)) {
@@ -934,5 +940,3 @@ class auth_plugin_db extends auth_plugin_base {
        return core_user::clean_data($user);
    }
 }
-
-
@@ -31,6 +31,9 @@ class auth_db_testcase extends advanced_testcase {
    /** @var string Original error log */
    protected $oldlog;

+    /** @var int The amount of users to create for the large user set deletion test  */
+    protected $largedeletionsetsize = 128;
+
    protected function init_auth_database() {
        global $DB, $CFG;
        require_once("$CFG->dirroot/auth/db/auth.php");
@@ -445,4 +448,56 @@ class auth_db_testcase extends advanced_testcase {

        $this->cleanup_auth_database();
    }
+
+    /**
+     * Testing the deletion of a user when there are many users in the external DB.
+     */
+    public function test_deleting_with_many_users() {
+        global $DB;
+
+        $this->resetAfterTest(true);
+        $this->preventResetByRollback();
+        $this->init_auth_database();
+        $auth = get_auth_plugin('db');
+        $auth->db_init();
+
+        // Set to delete from moodle when missing from DB.
+        set_config('removeuser', AUTH_REMOVEUSER_FULLDELETE, 'auth/db');
+        $auth->config->removeuser = AUTH_REMOVEUSER_FULLDELETE;
+
+        // Create users.
+        $users = [];
+        for ($i = 0; $i < $this->largedeletionsetsize; $i++) {
+            $user = (object)array('username' => "u$i", 'name' => "u$i", 'pass' => 'heslo', 'email' => "u$i@example.com");
+            $user->id  = $DB->insert_record('auth_db_users', $user);
+            $users[] = $user;
+        }
+
+        // Sync to moodle.
+        $trace = new null_progress_trace();
+        $auth->sync_users($trace, true);
+
+        // Check user is there.
+        $user = array_shift($users);
+        $moodleuser = $DB->get_record('user', array('email' => $user->email, 'auth' => 'db'));
+        $this->assertNotNull($moodleuser);
+        $this->assertEquals($user->username, $moodleuser->username);
+
+        // Delete a user.
+        $DB->delete_records('auth_db_users', array('id' => $user->id));
+
+        // Sync again.
+        $auth->sync_users($trace, true);
+
+        // Check user is no longer there.
+        $moodleuser = $DB->get_record('user', array('id' => $moodleuser->id));
+        $this->assertFalse($auth->user_login($user->username, 'heslo'));
+        $this->assertEquals(1, $moodleuser->deleted);
+
+        // Make sure it was the only user deleted.
+        $numberdeleted = $DB->count_records('user', array('deleted' => 1, 'auth' => 'db'));
+        $this->assertEquals(1, $numberdeleted);
+
+        $this->cleanup_auth_database();
+    }
 }
@@ -695,7 +695,7 @@ class auth_plugin_ldap extends auth_plugin_base {
            array_push($contexts, $this->config->create_context);
        }

-        $ldap_pagedresults = ldap_paged_results_supported($this->config->ldap_version);
+        $ldap_pagedresults = ldap_paged_results_supported($this->config->ldap_version, $ldapconnection);
        $ldap_cookie = '';
        foreach ($contexts as $context) {
            $context = trim($context);
@@ -1540,7 +1540,7 @@ class auth_plugin_ldap extends auth_plugin_base {
        }

        $ldap_cookie = '';
-        $ldap_pagedresults = ldap_paged_results_supported($this->config->ldap_version);
+        $ldap_pagedresults = ldap_paged_results_supported($this->config->ldap_version, $ldapconnection);
        foreach ($contexts as $context) {
            $context = trim($context);
            if (empty($context)) {
@@ -117,9 +117,31 @@ $fastpathoptions = array(AUTH_NTLM_FASTPATH_YESFORM => get_string('auth_ntlmsso_
                         AUTH_NTLM_FASTPATH_ATTEMPT => get_string('auth_ntlmsso_ie_fastpath_attempt', 'auth_ldap'));

 $disabled = '';
-if (!ldap_paged_results_supported($config->ldap_version)) {
+$pagedresultssupported = false;
+if ($config->host_url !== '') {
+    /**
+     * We try to connect each and every time we open the config, because we want to set the Page
+     * Size setting as enabled or disabled depending on the configured LDAP server supporting
+     * pagination or not, and to notify the user about it. If the user changed the LDAP server (or
+     * the LDAP protocol version) last time, it might happen that paged results are no longer
+     * available and we want to show that to the user the next time she goes to the settings page.
+     */
+    try {
+        $ldapconn = $this->ldap_connect();
+        $pagedresultssupported = ldap_paged_results_supported($config->ldap_version, $ldapconn);
+    } catch (Exception $e) {
+        // If we couldn't connect and get the supported options, we can only assume we don't support paged results.
+        $pagedresultssupported = false;
+    }
+}
+/* Make sure we only disable the paged result size setting and show the notification about it if
+ * there is a configured server that we tried to contact.  Othersiwe, if someone's LDAP server does
+ * support paged results, they won't be able to turn it on the first time they set it up (because
+ * the field will be disabled).
+ */
+if (($config->host_url !== '') && (!$pagedresultssupported)) {
    $disabled = ' disabled="disabled"';
-    echo $OUTPUT->notification(get_string('pagedresultsnotsupp', 'auth_ldap'));
+    echo $OUTPUT->notification(get_string('pagedresultsnotsupp', 'auth_ldap'), \core\output\notification::NOTIFY_INFO);
 }

 ?>
@@ -132,7 +132,7 @@ $string['ntlmsso_attempting'] = 'Attempting Single Sign On via NTLM...';
 $string['ntlmsso_failed'] = 'Auto-login failed, try the normal login page...';
 $string['ntlmsso_isdisabled'] = 'NTLM SSO is disabled.';
 $string['ntlmsso_unknowntype'] = 'Unknown ntlmsso type!';
-$string['pagedresultsnotsupp'] = 'LDAP paged results not supported (either your PHP version lacks support or you have configured Moodle to use LDAP protocol version 2)';
+$string['pagedresultsnotsupp'] = 'LDAP paged results not supported (either your PHP version lacks support, you have configured Moodle to use LDAP protocol version 2 or Moodle cannot contact your LDAP server to see if paged support is available.)';
 $string['pagesize'] = 'Make sure this value is smaller than your LDAP server result set size limit (the maximum number of entries that can be returned in a single query)';
 $string['pagesize_key'] = 'Page Size';
 $string['pluginname'] = 'LDAP server';
@@ -23,6 +23,6 @@
 */

 $string['auth_pamdescription'] = 'This method uses PAM to access the native usernames on this server. You have to install <a href="http://www.math.ohio-state.edu/~ccunning/pam_auth/">PHP4 PAM Authentication</a> in order to use this module.';
-$string['auth_passwordisexpired'] = 'Your password is expired. Do you want change your password now?';
-$string['auth_passwordwillexpire'] = 'Your password will expire in {$a} days. Do you want change your password now?';
+$string['auth_passwordisexpired'] = 'Your password has expired. Do you want to change your password now?';
+$string['auth_passwordwillexpire'] = 'Your password will expire in {$a} days. Do you want to change your password now?';
 $string['pluginname'] = 'PAM (Pluggable Authentication Modules)';
@@ -26,13 +26,14 @@ if (!is_enabled_auth('shibboleth')) {
 $inputstream = file_get_contents("php://input");
 if ($action == 'logout' && !empty($redirect)) {

-    if ($USER->auth == 'shibboleth') {
-        // Logout out user from application.
+    if (isloggedin($USER) && $USER->auth == 'shibboleth') {
+        // Logout user from application.
        require_logout();
-         // Finally, send user to the return URL.
-        redirect($redirect);
    }

+    // Finally, send user to the return URL.
+    redirect($redirect);
+
 } else if (!empty($inputstream)) {

    // Back channel logout.
@@ -0,0 +1,55 @@
+@core @core_auth
+Feature: Test the 'showlogfailures' feature works.
+  In order to see my recent login failures when logging in
+  As a user
+  I need to have at least one failed login attempt and then log in
+
+  Background:
+    Given the following "users" exist:
+      | username |
+      | teacher1 |
+    And the following config values are set as admin:
+      | displayloginfailures | 1 |
+
+  # Given the user has at least one failed login attempt, when they login, then they should see both header and footer notices.
+  Scenario: Check that 'displayloginfailures' works without javascript for teachers.
+    # Simulate a log in failure for the teacher.
+    Given I am on homepage
+    And I click on "Log in" "link" in the ".logininfo" "css_element"
+    And I set the field "Username" to "teacher1"
+    And I set the field "Password" to "wrongpass"
+    And I press "Log in"
+    And I should see "Invalid login, please try again"
+    # Now, log in with the correct credentials.
+    When I set the field "Username" to "teacher1"
+    And I set the field "Password" to "teacher1"
+    And I press "Log in"
+    # Confirm the notices are displayed.
+    Then I should see "1 failed logins since your last login" in the "header.navbar" "css_element"
+    And I should see "1 failed logins since your last login" in the "page-footer" "region"
+    # Confirm the notices disappear when navigating to another page.
+    And I am on homepage
+    And I should not see "1 failed logins since your last login" in the "header.navbar" "css_element"
+    And I should not see "1 failed logins since your last login" in the "page-footer" "region"
+
+  # Given the user has at least one failed login attempt, when they login, then they should see both header and footer notices.
+  Scenario: Check that 'displayloginfailures' works without javascript for admins.
+    # Simulate a log in failure for the teacher.
+    Given I am on homepage
+    And I click on "Log in" "link" in the ".logininfo" "css_element"
+    And I set the field "Username" to "admin"
+    And I set the field "Password" to "wrongpass"
+    And I press "Log in"
+    And I should see "Invalid login, please try again"
+    # Now, log in with the correct credentials.
+    When I set the field "Username" to "admin"
+    And I set the field "Password" to "admin"
+    And I press "Log in"
+    # Confirm the notices are displayed.
+    Then I should see "1 failed logins since your last login" in the "header.navbar" "css_element"
+    And I should see "1 failed logins since your last login (Logs)" in the "page-footer" "region"
+    # Confirm that the link works and that the notices disappear when navigating to another page.
+    And I click on "Logs" "link" in the "page-footer" "region"
+    And I should see "User login failed" in the "table.reportlog" "css_element"
+    And I should not see "1 failed logins since your last login" in the "header.navbar" "css_element"
+    And I should not see "1 failed logins since your last login (Logs)" in the "page-footer" "region"
@@ -0,0 +1,50 @@
+@core @core_auth
+Feature: Test the 'remember username' feature works.
+  In order to see my saved username on the login form
+  As a user
+  I need to have logged in once before and clicked 'Remember username'
+
+  Background:
+    Given the following "users" exist:
+      | username |
+      | teacher1 |
+
+  # Given the user has logged in and selected 'Remember username', when they log in again, then their username should be remembered.
+  Scenario: Check that 'remember username' works without javascript for teachers.
+    # Log in the first time and check the 'remember username' box.
+    Given I am on homepage
+    And I click on "Log in" "link" in the ".logininfo" "css_element"
+    And I set the field "Username" to "teacher1"
+    And I set the field "Password" to "teacher1"
+    And I set the field "Remember username" to "1"
+    And I press "Log in"
+    And I log out
+    # Log out and check that the username was remembered.
+    When I am on homepage
+    And I click on "Log in" "link" in the ".logininfo" "css_element"
+    Then the field "username" matches value "teacher1"
+    And the field "Remember username" matches value "1"
+
+  # Given the user has logged in before and selected 'Remember username', when they log in again and unset 'Remember username', then
+  # their username should be forgotten for future log in attempts.
+  Scenario: Check that 'remember username' unsetting works without javascript for teachers.
+    # Log in the first time and check the 'remember username' box.
+    Given I am on homepage
+    And I click on "Log in" "link" in the ".logininfo" "css_element"
+    And I set the field "Username" to "teacher1"
+    And I set the field "Password" to "teacher1"
+    And I set the field "Remember username" to "1"
+    And I press "Log in"
+    And I log out
+    # Log in again, unsetting the 'remember username' field.
+    When I am on homepage
+    And I click on "Log in" "link" in the ".logininfo" "css_element"
+    And I set the field "Password" to "teacher1"
+    And I set the field "Remember username" to "0"
+    And I press "Log in"
+    And I log out
+    # Check username has been forgotten.
+    Then I am on homepage
+    And I click on "Log in" "link" in the ".logininfo" "css_element"
+    Then the field "username" matches value ""
+    And the field "Remember username" matches value "0"
@@ -2666,7 +2666,7 @@ class restore_calendarevents_structure_step extends restore_structure_step {
                'courseid'       => $this->get_courseid(),
                'groupid'        => $data->groupid,
                'userid'         => $data->userid,
-                'repeatid'       => $data->repeatid,
+                'repeatid'       => $this->get_mappingid('event', $data->repeatid),
                'modulename'     => $data->modulename,
                'eventtype'      => $data->eventtype,
                'timestart'      => $this->apply_date_offset($data->timestart),
@@ -2684,18 +2684,27 @@ class restore_calendarevents_structure_step extends restore_structure_step {
                  FROM {event}
                 WHERE " . $DB->sql_compare_text('name', 255) . " = " . $DB->sql_compare_text('?', 255) . "
                   AND courseid = ?
-                   AND repeatid = ?
                   AND modulename = ?
                   AND timestart = ?
                   AND timeduration = ?
                   AND " . $DB->sql_compare_text('description', 255) . " = " . $DB->sql_compare_text('?', 255);
-        $arg = array ($params['name'], $params['courseid'], $params['repeatid'], $params['modulename'], $params['timestart'], $params['timeduration'], $params['description']);
+        $arg = array ($params['name'], $params['courseid'], $params['modulename'], $params['timestart'], $params['timeduration'], $params['description']);
        $result = $DB->record_exists_sql($sql, $arg);
        if (empty($result)) {
            $newitemid = $DB->insert_record('event', $params);
            $this->set_mapping('event', $oldid, $newitemid);
            $this->set_mapping('event_description', $oldid, $newitemid, $restorefiles);
        }
+        // With repeating events, each event has the repeatid pointed at the first occurrence.
+        // Since the repeatid will be empty when the first occurrence is restored,
+        // Get the repeatid from the second occurrence of the repeating event and use that to update the first occurrence.
+        // Then keep a list of repeatids so we only perform this update once.
+        static $repeatids = array();
+        if (!empty($params['repeatid']) && !in_array($params['repeatid'], $repeatids)) {
+            // This entry is repeated so the repeatid field must be set.
+            $DB->set_field('event', 'repeatid', $params['repeatid'], array('id' => $params['repeatid']));
+            $repeatids[] = $params['repeatid'];
+        }

    }
    protected function after_execute() {
@@ -4327,6 +4336,14 @@ class restore_create_categories_and_questions extends restore_structure_step {
        }
        $data->contextid = $mapping->parentitemid;

+        // Before 3.1, the 'stamp' field could be erroneously duplicated.
+        // From 3.1 onwards, there's a unique index of (contextid, stamp).
+        // If we encounter a duplicate in an old restore file, just generate a new stamp.
+        // This is the same as what happens during an upgrade to 3.1+ anyway.
+        if ($DB->record_exists('question_categories', ['stamp' => $data->stamp, 'contextid' => $data->contextid])) {
+            $data->stamp = make_unique_id_code();
+        }
+
        // Let's create the question_category and save mapping
        $newitemid = $DB->insert_record('question_categories', $data);
        $this->set_mapping('question_category', $oldid, $newitemid);
@@ -635,7 +635,9 @@ abstract class backup_controller_dbops extends backup_dbops {
            $locked = (get_config('backup', $config.'_locked') == true);
            if ($plan->setting_exists($settingname)) {
                $setting = $plan->get_setting($settingname);
-                if ($setting->get_value() != $value || 1==1) {
+                // We can only update the setting if it isn't already locked by config or permission.
+                if ($setting->get_status() !== base_setting::LOCKED_BY_CONFIG
+                        && $setting->get_status() !== base_setting::LOCKED_BY_PERMISSION) {
                    $setting->set_value($value);
                    if ($locked) {
                        $setting->set_status(base_setting::LOCKED_BY_CONFIG);
@@ -740,10 +740,12 @@ class core_backup_renderer extends plugin_renderer_base {
                if (!$category->visible) {
                    $row->attributes['class'] .= ' dimmed';
                }
+                $context = context_coursecat::instance($category->id);
                $row->cells = array(
                    html_writer::empty_tag('input', array('type' => 'radio', 'name' => 'targetid', 'value' => $category->id)),
                    format_string($category->name, true, array('context' => context_coursecat::instance($category->id))),
-                    format_text($category->description, $category->descriptionformat, array('overflowdiv' => true))
+                    format_text(file_rewrite_pluginfile_urls($category->description, 'pluginfile.php', $context->id,
+                        'coursecat', 'description', null), $category->descriptionformat, array('overflowdiv' => true))
                );
                $table->data[] = $row;
            }
@@ -46,23 +46,6 @@ class edit_backpack_form extends moodleform {
        $mform->addElement('header', 'backpackheader', get_string('backpackconnection', 'badges'));
        $mform->addHelpButton('backpackheader', 'backpackconnection', 'badges');
        $mform->addElement('static', 'url', get_string('url'), BADGE_BACKPACKURL);
-        $status = html_writer::tag('span', get_string('notconnected', 'badges'),
-            array('class' => 'notconnected', 'id' => 'connection-status'));
-        $mform->addElement('static', 'status', get_string('status'), $status);
-
-        $nojs = html_writer::tag('noscript', get_string('error:personaneedsjs', 'badges'),
-            array('class' => 'notconnected'));
-        $personadiv = $OUTPUT->container($nojs, null, 'persona-container');
-
-        $mform->addElement('static', 'persona', '', $personadiv);
-        $mform->addHelpButton('persona', 'personaconnection', 'badges');
-
-        $PAGE->requires->js(new moodle_url('https://login.persona.org/include.js'));
-        $PAGE->requires->js('/badges/backpack.js');
-        $PAGE->requires->js_init_call('badges_init_persona_login_button', null, false);
-        $PAGE->requires->strings_for_js(array('error:backpackloginfailed', 'signinwithyouremail',
-            'error:noassertion', 'error:connectionunknownreason', 'error:badjson', 'connecting',
-            'notconnected'), 'badges');

        $mform->addElement('hidden', 'userid', $USER->id);
        $mform->setType('userid', PARAM_INT);
@@ -70,23 +53,57 @@ class edit_backpack_form extends moodleform {
        $mform->addElement('hidden', 'backpackurl', BADGE_BACKPACKURL);
        $mform->setType('backpackurl', PARAM_URL);

+        if (isset($this->_customdata['email'])) {
+            // Email will be passed in when we're in the process of verifying the user's email address,
+            // so set the connection status, lock the email field, and provide options to resend the verification
+            // email or cancel the verification process entirely and start over.
+            $status = html_writer::tag('span', get_string('backpackemailverificationpending', 'badges'),
+                array('class' => 'notconnected', 'id' => 'connection-status'));
+            $mform->addElement('static', 'status', get_string('status'), $status);
+            $mform->addElement('hidden', 'email', $this->_customdata['email']);
+            $mform->setType('email', PARAM_RAW_TRIMMED);
+            $mform->hardFreeze(['email']);
+            $status = html_writer::tag('span', $this->_customdata['email'], []);
+            $mform->addElement('static', 'emailverify', get_string('email'), $status);
+            $buttonarray = [];
+            $buttonarray[] = &$mform->createElement('submit', 'submitbutton',
+                                                    get_string('backpackconnectionresendemail', 'badges'));
+            $buttonarray[] = &$mform->createElement('submit', 'revertbutton',
+                                                    get_string('backpackconnectioncancelattempt', 'badges'));
+            $mform->addGroup($buttonarray, 'buttonar', '', [''], false);
+            $mform->closeHeaderBefore('buttonar');
+        } else {
+            // Email isn't present, so provide an input element to get it and a button to start the verification process.
+            $status = html_writer::tag('span', get_string('notconnected', 'badges'),
+                array('class' => 'notconnected', 'id' => 'connection-status'));
+            $mform->addElement('static', 'status', get_string('status'), $status);
+            $mform->addElement('text', 'email', get_string('email'), 'maxlength="100" size="30"');
+            $mform->addHelpButton('email', 'backpackemail', 'badges');
+            $mform->addRule('email', get_string('required'), 'required', null, 'client');
+            $mform->setType('email', PARAM_RAW_TRIMMED);
+            $this->add_action_buttons(false, get_string('backpackconnectionconnect', 'badges'));
+        }
    }

    /**
     * Validates form data
     */
    public function validation($data, $files) {
-        global $DB;
        $errors = parent::validation($data, $files);

-        $check = new stdClass();
-        $check->backpackurl = $data['backpackurl'];
-        $check->email = $data['email'];
+        // We don't need to verify the email address if we're clearing a pending email verification attempt.
+        if (!isset($data['revertbutton'])) {
+            $check = new stdClass();
+            $check->backpackurl = $data['backpackurl'];
+            $check->email = $data['email'];

-        $bp = new OpenBadgesBackpackHandler($check);
-        $request = $bp->curl_request('user');
-        if (isset($request->status) && $request->status == 'missing') {
-            $errors['email'] = get_string('error:nosuchuser', 'badges');
+            $bp = new OpenBadgesBackpackHandler($check);
+            $request = $bp->curl_request('user');
+            if (isset($request->status) && $request->status == 'missing') {
+                $errors['email'] = get_string('error:nosuchuser', 'badges');
+            } else if (!isset($request->status) || $request->status !== 'okay') {
+                $errors['email'] = get_string('backpackconnectionunexpectedresult', 'badges');
+            }
        }
        return $errors;
    }
@@ -0,0 +1,78 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Endpoint for the verification email link.
+ *
+ * @package    core
+ * @subpackage badges
+ * @copyright  2016 Jake Dallimore <jrhdallimore@gmail.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+require_once(__DIR__ . '/../config.php');
+require_once($CFG->libdir . '/badgeslib.php');
+require_once(__DIR__ . '/lib/backpacklib.php');
+
+$data = optional_param('data', '', PARAM_RAW);
+require_login();
+$PAGE->set_url('/badges/openbackpackemailverify.php');
+$PAGE->set_context(context_user::instance($USER->id));
+$redirect = '/badges/mybackpack.php';
+
+// Confirm the secret and create the backpack connection.
+$storedsecret = get_user_preferences('badges_email_verify_secret');
+if (!is_null($storedsecret)) {
+    if ($data === $storedsecret) {
+        $storedemail = get_user_preferences('badges_email_verify_address');
+
+        $data = new stdClass();
+        $data->backpackurl = BADGE_BACKPACKURL;
+        $data->email = $storedemail;
+        $bp = new OpenBadgesBackpackHandler($data);
+
+        // Make sure we have all the required information before trying to save the connection.
+        $backpackuser = $bp->curl_request('user');
+        if (isset($backpackuser->status) && $backpackuser->status === 'okay' && isset($backpackuser->userId)) {
+            $backpackuid = $backpackuser->userId;
+        } else {
+            redirect(new moodle_url($redirect), get_string('backpackconnectionunexpectedresult', 'badges'),
+                null, \core\output\notification::NOTIFY_ERROR);
+        }
+
+        $obj = new stdClass();
+        $obj->userid = $USER->id;
+        $obj->email = $data->email;
+        $obj->backpackurl = $data->backpackurl;
+        $obj->backpackuid = $backpackuid;
+        $obj->autosync = 0;
+        $obj->password = '';
+        $DB->insert_record('badge_backpack', $obj);
+
+        // Remove the verification vars and redirect to the mypackpack page.
+        unset_user_preference('badges_email_verify_secret');
+        unset_user_preference('badges_email_verify_address');
+        redirect(new moodle_url($redirect), get_string('backpackemailverifysuccess', 'badges'),
+            null, \core\output\notification::NOTIFY_SUCCESS);
+    } else {
+        // Stored secret doesn't match the supplied secret. Take user back to the mybackpack page and present a warning message.
+        redirect(new moodle_url($redirect), get_string('backpackemailverifytokenmismatch', 'badges'),
+            null, \core\output\notification::NOTIFY_ERROR);
+    }
+} else {
+    // Stored secret is null. Either the email address has already been verified, or there is no record of a verification attempt
+    // for the current user. Either way, just redirect to the mybackpack page.
+    redirect(new moodle_url($redirect));
+}
@@ -117,3 +117,45 @@ class OpenBadgesBackpackHandler {
        return $this->backpack;
    }
 }
+
+/**
+ * Create and send a verification email to the email address supplied.
+ *
+ * Since we're not sending this email to a user, email_to_user can't be used
+ * but this function borrows largely the code from that process.
+ *
+ * @param string $email the email address to send the verification email to.
+ * @return true if the email was sent successfully, false otherwise.
+ */
+function send_verification_email($email) {
+    global $DB, $USER;
+
+    // Store a user secret (badges_email_verify_secret) and the address (badges_email_verify_address) as users prefs.
+    // The address will be used by edit_backpack_form for display during verification and to facilitate the resending
+    // of verification emails to said address.
+    $secret = random_string(15);
+    set_user_preference('badges_email_verify_secret', $secret);
+    set_user_preference('badges_email_verify_address', $email);
+
+    // To, from.
+    $tempuser = $DB->get_record('user', array('id' => $USER->id), '*', MUST_EXIST);
+    $tempuser->email = $email;
+    $noreplyuser = core_user::get_noreply_user();
+
+    // Generate the verification email body.
+    $verificationurl = '/badges/backpackemailverify.php';
+    $verificationurl = new moodle_url($verificationurl);
+    $verificationpath = $verificationurl->out(false);
+
+    $site = get_site();
+    $args = new stdClass();
+    $args->link = $verificationpath . '?data='. $secret;
+    $args->sitename = $site->fullname;
+    $args->admin = generate_email_signoff();
+
+    $messagesubject = get_string('backpackemailverifyemailsubject', 'badges', $site->fullname);
+    $messagetext = get_string('backpackemailverifyemailbody', 'badges', $args);
+    $messagehtml = text_to_html($messagetext, false, false, true);
+
+    return email_to_user($tempuser, $noreplyuser, $messagesubject, $messagetext, $messagehtml);
+}
@@ -110,23 +110,39 @@ if ($backpack) {
    }
 } else {
    // If backpack is not connected, need to connect first.
-    $form = new edit_backpack_form();
+    // To create a new connection to the backpack, first we need to verify the user's email address:
+    // 1. User enters email and clicks 'Connect to backpack'.
+    // 2. After cross-checking the email address against the backpack provider, an email is sent to the specified address,
+    // and the email and secret are stored in user preferences. These will be cleared upon successful verification.
+    // 3. User clicks verification link in the email to confirm the backpack connection.
+    // 4. User redirected to the mybackpack page.
+    // While the verification process is pending, the edit_backpack_form form will present the user with options to resend the
+    // verification email, and to cancel the current verification attempt and start over.

+    // To pass through the current state of the verification attempt to the form.
+    $params['email'] = get_user_preferences('badges_email_verify_address');
+
+    $form = new edit_backpack_form(new moodle_url('/badges/mybackpack.php'), $params);
    if ($form->is_cancelled()) {
        redirect(new moodle_url('/badges/mybadges.php'));
    } else if ($data = $form->get_data()) {
-        $bp = new OpenBadgesBackpackHandler($data);
-
-        $obj = new stdClass();
-        $obj->userid = $data->userid;
-        $obj->email = $data->email;
-        $obj->backpackurl = $data->backpackurl;
-        $obj->backpackuid = $bp->curl_request('user')->userId;
-        $obj->autosync = 0;
-        $obj->password = '';
-        $DB->insert_record('badge_backpack', $obj);
-
-        redirect(new moodle_url('/badges/mybackpack.php'));
+        // The form may have been submitted under one of the following circumstances:
+        // 1. After clicking 'Connect to backpack'. We'll have $data->email.
+        // 2. After clicking 'Resend verification email'. We'll have $data->email.
+        // 3. After clicking 'Connect using a different email' to cancel the verification process. We'll have $data->revertbutton.
+        if (isset($data->revertbutton)) {
+            unset_user_preference('badges_email_verify_secret');
+            unset_user_preference('badges_email_verify_address');
+            redirect(new moodle_url('/badges/mybackpack.php'));
+        } else if (isset($data->email)) {
+            if (send_verification_email($data->email)) {
+                redirect(new moodle_url('/badges/mybackpack.php'),
+                    get_string('backpackemailverifypending', 'badges', $data->email),
+                    null, \core\output\notification::NOTIFY_INFO);
+            } else {
+                print_error ('backpackcannotsendverification', 'badges');
+            }
+        }
    }
 }

@@ -31,8 +31,7 @@ Feature: Award badges
    And I press "Enable access"
    And I press "Continue"
    And I click on "Admin User" "link"
-    And I follow "Profile" in the open menu
-    And I follow "Edit profile"
+    And I open my profile in edit mode
    And I expand all fieldsets
    And I set the field "Phone" to "123456789"
    And I press "Update profile"
@@ -673,7 +673,7 @@ class block_activity_results extends block_base {

        $o = html_writer::start_tag('h3');
        $o .= html_writer::link(new moodle_url('/mod/'.$activity->itemmodule.'/view.php',
-        array('id' => $cm->id)), $activity->itemname);
+        array('id' => $cm->id)), format_string(($activity->itemname), true, ['context' => context_module::instance($cm->id)]));
        $o .= html_writer::end_tag('h3');
        return $o;
    }
@@ -690,4 +690,4 @@ class block_activity_results extends block_base {
        return $scale;

    }
-}
+}
@@ -49,6 +49,7 @@ class block_activity_results_edit_form extends block_edit_form {
        $sql = 'SELECT id, itemname FROM {grade_items} WHERE courseid = ? and itemtype = ? and (gradetype = ? or gradetype = ?)';
        $params = array($this->page->course->id, 'mod', GRADE_TYPE_VALUE, GRADE_TYPE_SCALE);
        $activities = $DB->get_records_sql_menu($sql, $params);
+        core_collator::asort($activities);

        if (empty($activities)) {
            $mform->addElement('static', 'noactivitieswarning', get_string('config_select_activity', 'block_activity_results'),
@@ -153,7 +153,8 @@ class block_community_renderer extends plugin_renderer_base {
                                array('class' => 'hubcourseuserinfo'));

                //create course content related information html
-                $course->subject = get_string($course->subject, 'edufields');
+                $course->subject = (get_string_manager()->string_exists($course->subject, 'edufields')) ?
+                        get_string($course->subject, 'edufields') : get_string('none');
                $course->audience = get_string('audience' . $course->audience, 'hub');
                $course->educationallevel = get_string('edulevel' . $course->educationallevel, 'hub');
                $coursecontentinfo = '';
@@ -64,7 +64,7 @@ class block_course_overview extends block_base {
        $content = array();

        $updatemynumber = optional_param('mynumber', -1, PARAM_INT);
-        if ($updatemynumber >= 0) {
+        if ($updatemynumber >= 0 && optional_param('sesskey', '', PARAM_RAW) && confirm_sesskey()) {
            block_course_overview_update_mynumber($updatemynumber);
        }

@@ -86,7 +86,7 @@ function block_course_overview_get_myorder() {
    // If preference was not found, look in the old location and convert if found.
    $order = array();
    if ($value = get_user_preferences('course_overview_course_order')) {
-        $order = unserialize($value);
+        $order = unserialize_array($value);
        block_course_overview_update_myorder($order);
        unset_user_preference('course_overview_course_order');
    }
@@ -213,7 +213,7 @@ class block_course_overview_renderer extends plugin_renderer_base {
        for ($i = 1; $i <= $max; $i++) {
            $options[$i] = $i;
        }
-        $url = new moodle_url('/my/index.php');
+        $url = new moodle_url('/my/index.php', ['sesskey' => sesskey()]);
        $select = new single_select($url, 'mynumber', $options, block_course_overview_get_max_user_courses(), array());
        $select->set_label(get_string('numtodisplay', 'block_course_overview'));
        $output .= $this->output->render($select);
@@ -50,6 +50,12 @@ class block_edit_form extends moodleform {
     */
    public $page;

+    /**
+     * Defaults set in set_data() that need to be returned in get_data() if form elements were not created
+     * @var array
+     */
+    protected $defaults = [];
+
    function __construct($actionurl, $block, $page) {
        global $CFG;
        $this->block = $block;
@@ -92,9 +98,6 @@ class block_edit_form extends moodleform {
        }

        $parentcontext = context::instance_by_id($this->block->instance->parentcontextid);
-        $mform->addElement('hidden', 'bui_parentcontextid', $parentcontext->id);
-        $mform->setType('bui_parentcontextid', PARAM_INT);
-
        $mform->addElement('static', 'bui_homecontext', get_string('createdat', 'block'), $parentcontext->get_context_name());
        $mform->addHelpButton('bui_homecontext', 'createdat', 'block');

@@ -109,21 +112,9 @@ class block_edit_form extends moodleform {
        // implies one (and only one) harcoded page-type that will be set later
        // when processing the form data at {@link block_manager::process_url_edit()}

-        // There are some conditions to check related to contexts
-        $ctxconditions = $this->page->context->contextlevel == CONTEXT_COURSE &&
-                         $this->page->context->instanceid == get_site()->id;
-        // And also some pagetype conditions
-        $pageconditions = isset($bits[0]) && isset($bits[1]) && $bits[0] == 'site' && $bits[1] == 'index';
-        // So now we can be 100% sure if edition is happening at frontpage
-        $editingatfrontpage = $ctxconditions && $pageconditions;
-
-        // Let the form to know about that, can be useful later
-        $mform->addElement('hidden', 'bui_editingatfrontpage', (int)$editingatfrontpage);
-        $mform->setType('bui_editingatfrontpage', PARAM_INT);
-
        // Front page, show the page-contexts element and set $pagetypelist to 'any page' (*)
        // as unique option. Processign the form will do any change if needed
-        if ($editingatfrontpage) {
+        if ($this->is_editing_the_frontpage()) {
            $contextoptions = array();
            $contextoptions[BUI_CONTEXTS_FRONTPAGE_ONLY] = get_string('showonfrontpageonly', 'block');
            $contextoptions[BUI_CONTEXTS_FRONTPAGE_SUBS] = get_string('showonfrontpageandsubs', 'block');
@@ -135,16 +126,13 @@ class block_edit_form extends moodleform {
        // Any other system context block, hide the page-contexts element,
        // it's always system-wide BUI_CONTEXTS_ENTIRE_SITE
        } else if ($parentcontext->contextlevel == CONTEXT_SYSTEM) {
-            $mform->addElement('hidden', 'bui_contexts', BUI_CONTEXTS_ENTIRE_SITE);

        } else if ($parentcontext->contextlevel == CONTEXT_COURSE) {
            // 0 means display on current context only, not child contexts
            // but if course managers select mod-* as pagetype patterns, block system will overwrite this option
            // to 1 (display on current context and child contexts)
-            $mform->addElement('hidden', 'bui_contexts', BUI_CONTEXTS_CURRENT);
        } else if ($parentcontext->contextlevel == CONTEXT_MODULE or $parentcontext->contextlevel == CONTEXT_USER) {
            // module context doesn't have child contexts, so display in current context only
-            $mform->addElement('hidden', 'bui_contexts', BUI_CONTEXTS_CURRENT);
        } else {
            $parentcontextname = $parentcontext->get_context_name();
            $contextoptions[BUI_CONTEXTS_CURRENT]      = get_string('showoncontextonly', 'block', $parentcontextname);
@@ -181,8 +169,6 @@ class block_edit_form extends moodleform {
        } else {
            $values = array_keys($pagetypelist);
            $value = array_pop($values);
-            $mform->addElement('hidden', 'bui_pagetypepattern', $value);
-            $mform->setType('bui_pagetypepattern', PARAM_RAW);
            // Now we are really hiding a lot (both page-contexts and page-type-patterns),
            // specially in some systemcontext pages having only one option (my/user...)
            // so, until it's decided if we are going to add the 'bring-back' pattern to
@@ -191,7 +177,7 @@ class block_edit_form extends moodleform {
            // TODO: Revisit this once MDL-30574 has been decided and implemented, although
            // perhaps it's not bad to always show this statically when only one pattern is
            // available.
-            if (!$editingatfrontpage) {
+            if (!$this->is_editing_the_frontpage()) {
                // Try to beautify it
                $strvalue = $value;
                $strkey = 'page-'.str_replace('*', 'x', $strvalue);
@@ -205,10 +191,7 @@ class block_edit_form extends moodleform {
        }

        if ($this->page->subpage) {
-            if ($parentcontext->contextlevel == CONTEXT_USER) {
-                $mform->addElement('hidden', 'bui_subpagepattern', '%@NULL@%');
-                $mform->setType('bui_subpagepattern', PARAM_RAW);
-            } else {
+            if ($parentcontext->contextlevel != CONTEXT_USER) {
                $subpageoptions = array(
                    '%@NULL@%' => get_string('anypagematchingtheabove', 'block'),
                    $this->page->subpage => get_string('thisspecificpage', 'block', $this->page->subpage),
@@ -252,6 +235,19 @@ class block_edit_form extends moodleform {
        $this->add_action_buttons();
    }

+    /**
+     * Returns true if the user is editing a frontpage.
+     * @return bool
+     */
+    public function is_editing_the_frontpage() {
+        // There are some conditions to check related to contexts.
+        $ctxconditions = $this->page->context->contextlevel == CONTEXT_COURSE &&
+            $this->page->context->instanceid == get_site()->id;
+        $issiteindex = (strpos($this->page->pagetype, 'site-index') === 0);
+        // So now we can be 100% sure if edition is happening at frontpage.
+        return ($ctxconditions && $issiteindex);
+    }
+
    function set_data($defaults) {
        // Prefix bui_ on all the core field names.
        $blockfields = array('showinsubcontexts', 'pagetypepattern', 'subpagepattern', 'parentcontextid',
@@ -281,6 +277,13 @@ class block_edit_form extends moodleform {
            $defaults->bui_contexts = $defaults->bui_showinsubcontexts;
        }

+        // Some fields may not be editable, remember the values here so we can return them in get_data().
+        $this->defaults = [
+            'bui_parentcontextid' => $defaults->bui_parentcontextid,
+            'bui_contexts' => $defaults->bui_contexts,
+            'bui_pagetypepattern' => $defaults->bui_pagetypepattern,
+            'bui_subpagepattern' => $defaults->bui_subpagepattern,
+        ];
        parent::set_data($defaults);
    }

@@ -291,4 +294,20 @@ class block_edit_form extends moodleform {
    protected function specific_definition($mform) {
        // By default, do nothing.
    }
+
+    /**
+     * Return submitted data if properly submitted or returns NULL if validation fails or
+     * if there is no submitted data.
+     *
+     * @return object submitted data; NULL if not valid or not submitted or cancelled
+     */
+    public function get_data() {
+        if ($data = parent::get_data()) {
+            // Blocklib expects 'bui_editingatfrontpage' property to be returned from this form.
+            $data->bui_editingatfrontpage = $this->is_editing_the_frontpage();
+            // Some fields are non-editable and we need to populate them with the values from set_data().
+            return (object)((array)$data + $this->defaults);
+        }
+        return $data;
+    }
 }
@@ -1,4 +1,4 @@
-@block @block_private_files @file_upload @javascript
+@block @block_private_files @_file_upload @javascript
 Feature: The private files block allows users to store files privately in moodle
  In order to store a private file in moodle
  As a teacher
@@ -1,4 +1,4 @@
-@block @block_private_files @file_upload @javascript
+@block @block_private_files @_file_upload @javascript
 Feature: The private files block allows users to store files privately in moodle
  In order to store a private file in moodle
  As a teacher
@@ -24,6 +24,7 @@
 */

 // NOTE: no MOODLE_INTERNAL test here, this file may be required by behat before including /config.php.
+use Behat\Mink\Exception\ElementNotFoundException as ElementNotFoundException;

 require_once(__DIR__ . '/../../../lib/behat/behat_base.php');

@@ -56,6 +57,20 @@ class behat_blocks extends behat_base {
        }
    }

+    /**
+     * Adds the selected block if it is not already present. Editing mode must be previously enabled.
+     *
+     * @Given /^I add the "(?P<block_name_string>(?:[^"]|\\")*)" block if not present$/
+     * @param string $blockname
+     */
+    public function i_add_the_block_if_not_present($blockname) {
+        try {
+            $this->get_text_selector_node('block', $blockname);
+        } catch (ElementNotFoundException $e) {
+            $this->execute('behat_blocks::i_add_the_block', [$blockname]);
+        }
+    }
+
    /**
     * Docks a block. Editing mode should be previously enabled.
     *
@@ -52,11 +52,11 @@ $action = (empty($id)) ? 'add' : 'edit';

 $external = new stdClass();

-// Check that this id exists.
-if (!empty($id) && !$DB->record_exists('blog_external', array('id' => $id))) {
-    print_error('wrongexternalid', 'blog');
-} else if (!empty($id)) {
-    $external = $DB->get_record('blog_external', array('id' => $id));
+// Retrieve the external blog record.
+if (!empty($id)) {
+    if (!$external = $DB->get_record('blog_external', array('id' => $id, 'userid' => $USER->id))) {
+        print_error('wrongexternalid', 'blog');
+    }
    $external->autotags = core_tag_tag::get_item_tags_array('core', 'blog_external', $id);
 }

@@ -872,7 +872,7 @@ function blog_get_headers($courseid=null, $groupid=null, $userid=null, $tagid=nu
        }

        // Append Search info.
-        if (!empty($search)) {
+        if (!empty($search) && has_capability('moodle/blog:search', $sitecontext)) {
            $headers['filters']['search'] = $search;
            $blogurl->param('search', $search);
            $PAGE->navbar->add(get_string('searchterm', 'blog', $search), $blogurl->out());
@@ -213,7 +213,7 @@ class cache implements cache_loader {
        $this->definition = $definition;
        $this->store = $store;
        $this->storetype = get_class($store);
-        $this->perfdebug = !empty($CFG->perfdebug);
+        $this->perfdebug = (!empty($CFG->perfdebug) and $CFG->perfdebug > 7);
        if ($loader instanceof cache_loader) {
            $this->loader = $loader;
            // Mark the loader as a sub (chained) loader.
@@ -229,8 +229,60 @@ class cachestore_memcached extends cache_store implements cache_is_configurable
        $version = phpversion('memcached');
        $this->candeletemulti = ($version && version_compare($version, self::REQUIRED_VERSION, '>='));

-        // Test the connection to the main connection.
-        $this->isready = @$this->connection->set("ping", 'ping', 1);
+        $this->isready = $this->is_connection_ready();
+    }
+
+    /**
+     * Confirm whether the connection is ready and usable.
+     *
+     * @return boolean
+     */
+    public function is_connection_ready() {
+        if (!@$this->connection->set("ping", 'ping', 1)) {
+            // Test the connection to the server.
+            return false;
+        }
+
+        if ($this->isshared) {
+            // There is a bug in libmemcached which means that it is not possible to purge the cache in a shared cache
+            // configuration.
+            // This issue currently affects:
+            // - memcached 1.4.23+ with php-memcached <= 2.2.0
+            // The following combinations are not affected:
+            // - memcached <= 1.4.22 with any version of php-memcached
+            // - any version of memcached with php-memcached >= 3.0.1
+
+
+            // This check is cheapest as it does not involve connecting to the server at all.
+            $safecombination = false;
+            $extension = new ReflectionExtension('memcached');
+            if ((version_compare($extension->getVersion(), '3.0.1') >= 0)) {
+                // This is php-memcached version >= 3.0.1 which is a safe combination.
+                $safecombination = true;
+            }
+
+            if (!$safecombination) {
+                $allsafe = true;
+                foreach ($this->connection->getVersion() as $version) {
+                    $allsafe = $allsafe && (version_compare($version, '1.4.22') <= 0);
+                }
+                // All memcached servers connected are version <= 1.4.22 which is a safe combination.
+                $safecombination = $allsafe;
+            }
+
+            if (!$safecombination) {
+                // This is memcached 1.4.23+ and php-memcached < 3.0.1.
+                // The issue may have been resolved in a subsequent update to any of the three libraries.
+                // The only way to safely determine if the combination is safe is to call getAllKeys.
+                // A safe combination will return an array, whilst an affected combination will return false.
+                // This is the most expensive check.
+                if (!is_array($this->connection->getAllKeys())) {
+                    return false;
+                }
+            }
+        }
+
+        return true;
    }

    /**
@@ -286,6 +286,10 @@ class cachestore_memcached_test extends cachestore_tests {

        $definition = cache_definition::load_adhoc(cache_store::MODE_APPLICATION, 'cachestore_memcached', 'phpunit_test');
        $cachestore = $this->create_test_cache_with_config($definition, array('isshared' => true));
+        if (!$cachestore->is_connection_ready()) {
+            $this->markTestSkipped('Could not test cachestore_memcached. Connection is not ready.');
+        }
+
        $connection = new Memcached(crc32(__METHOD__));
        $connection->addServers($this->get_servers(TEST_CACHESTORE_MEMCACHED_TESTSERVERS));
        $connection->setOptions(array(
@@ -1784,6 +1784,12 @@ class core_cache_testcase extends advanced_testcase {
        $this->assertArrayHasKey('cache_is_searchable', $cache->phpunit_get_store_implements());
    }

+    /**
+     * Test static acceleration
+     *
+     * Note: All the assertGreaterThanOrEqual() in this test should be assertGreaterThan() be because of some microtime()
+     * resolution problems under some OSs / PHP versions, we are accepting equal as valid outcome. For more info see MDL-57147.
+     */
    public function test_static_acceleration() {
        $instance = cache_config_testing::instance();
        $instance->phpunit_add_definition('phpunit/accelerated', array(
@@ -1890,7 +1896,7 @@ class core_cache_testcase extends advanced_testcase {
        $this->assertTrue($cache->set('b', $cacheableobject2));
        $staticaccelerationreturntime = $cache->phpunit_static_acceleration_get('a')->propertytime;
        $staticaccelerationreturntimeb = $cache->phpunit_static_acceleration_get('b')->propertytime;
-        $this->assertGreaterThan($startmicrotime, $staticaccelerationreturntime, 'Restore time of static must be newer.');
+        $this->assertGreaterThanOrEqual($startmicrotime, $staticaccelerationreturntime, 'Restore time of static must be newer.');

        // Reset the static cache without resetting backing store.
        $cache->phpunit_static_acceleration_purge();
@@ -1898,12 +1904,12 @@ class core_cache_testcase extends advanced_testcase {
        // Get the value from the backend store, populating the static cache.
        $cachevalue = $cache->get('a');
        $this->assertInstanceOf('cache_phpunit_dummy_object', $cachevalue);
-        $this->assertGreaterThan($staticaccelerationreturntime, $cachevalue->propertytime);
+        $this->assertGreaterThanOrEqual($staticaccelerationreturntime, $cachevalue->propertytime);
        $backingstorereturntime = $cachevalue->propertytime;

        $results = $cache->get_many(array('b'));
        $this->assertInstanceOf('cache_phpunit_dummy_object', $results['b']);
-        $this->assertGreaterThan($staticaccelerationreturntimeb, $results['b']->propertytime);
+        $this->assertGreaterThanOrEqual($staticaccelerationreturntimeb, $results['b']->propertytime);
        $backingstorereturntimeb = $results['b']->propertytime;

        // Obtain the value again and confirm that static cache is using wake_from_cache.
@@ -1911,11 +1917,11 @@ class core_cache_testcase extends advanced_testcase {
        // value is stored serialized in the static acceleration cache.
        $cachevalue = $cache->phpunit_static_acceleration_get('a');
        $this->assertInstanceOf('cache_phpunit_dummy_object', $cachevalue);
-        $this->assertGreaterThan($backingstorereturntime, $cachevalue->propertytime);
+        $this->assertGreaterThanOrEqual($backingstorereturntime, $cachevalue->propertytime);

        $results = $cache->get_many(array('b'));
        $this->assertInstanceOf('cache_phpunit_dummy_object', $results['b']);
-        $this->assertGreaterThan($backingstorereturntimeb, $results['b']->propertytime);
+        $this->assertGreaterThanOrEqual($backingstorereturntimeb, $results['b']->propertytime);

        /** @var cache_phpunit_application $cache */
        $cache = cache::make('phpunit', 'accelerated2');
@@ -2164,4 +2170,57 @@ class core_cache_testcase extends advanced_testcase {
        $this->assertEquals(0, $endstats[$requestid]['stores']['cachestore_static']['sets'] -
            $startstats[$requestid]['stores']['cachestore_static']['sets']);
    }
+
+    public function test_performance_debug_off() {
+        global $CFG;
+        $this->resetAfterTest(true);
+        $CFG->perfdebug = 7;
+
+        $instance = cache_config_testing::instance();
+        $applicationid = 'phpunit/applicationperfoff';
+        $instance->phpunit_add_definition($applicationid, array(
+            'mode' => cache_store::MODE_APPLICATION,
+            'component' => 'phpunit',
+            'area' => 'applicationperfoff'
+        ));
+        $sessionid = 'phpunit/sessionperfoff';
+        $instance->phpunit_add_definition($sessionid, array(
+            'mode' => cache_store::MODE_SESSION,
+            'component' => 'phpunit',
+            'area' => 'sessionperfoff'
+        ));
+        $requestid = 'phpunit/requestperfoff';
+        $instance->phpunit_add_definition($requestid, array(
+            'mode' => cache_store::MODE_REQUEST,
+            'component' => 'phpunit',
+            'area' => 'requestperfoff'
+        ));
+
+        $application = cache::make('phpunit', 'applicationperfoff');
+        $session = cache::make('phpunit', 'sessionperfoff');
+        $request = cache::make('phpunit', 'requestperfoff');
+
+        // Check that no stats are recorded for these definitions yet.
+        $stats = cache_helper::get_stats();
+        $this->assertArrayNotHasKey($applicationid, $stats);
+        $this->assertArrayNotHasKey($sessionid, $stats);
+        $this->assertArrayNotHasKey($requestid, $stats);
+
+        // Trigger cache misses, cache sets and cache hits.
+        $this->assertFalse($application->get('missMe'));
+        $this->assertTrue($application->set('setMe', 1));
+        $this->assertEquals(1, $application->get('setMe'));
+        $this->assertFalse($session->get('missMe'));
+        $this->assertTrue($session->set('setMe', 3));
+        $this->assertEquals(3, $session->get('setMe'));
+        $this->assertFalse($request->get('missMe'));
+        $this->assertTrue($request->set('setMe', 4));
+        $this->assertEquals(4, $request->get('setMe'));
+
+        // Check that no stats are being recorded for these definitions.
+        $endstats = cache_helper::get_stats();
+        $this->assertArrayNotHasKey($applicationid, $endstats);
+        $this->assertArrayNotHasKey($sessionid, $endstats);
+        $this->assertArrayNotHasKey($requestid, $endstats);
+    }
 }
@@ -58,9 +58,11 @@ if (!$course) {
    $PAGE->set_context(context_system::instance()); //TODO: wrong
 }

+$title = get_string('deleteevent', 'calendar');
+
 // Check the user has the required capabilities to edit an event
-if (!calendar_edit_event_allowed($event)) {
-    print_error('nopermissions');
+if (!calendar_edit_event_allowed($event) || !empty($event->modulename)) {
+    print_error('nopermissions', 'error', $PAGE->url, $title);
 }

 // Count the repeats, do we need to consider the possibility of deleting repeats
@@ -88,7 +90,6 @@ if ($confirm) {
 }

 // Prepare the page to show the confirmation form
-$title = get_string('deleteevent', 'calendar');
 $strcalendar = get_string('calendar', 'calendar');

 $PAGE->navbar->add($strcalendar, $viewcalendarurl);
@@ -81,8 +81,9 @@ class core_calendar_external extends external_api {
            $eventobj = calendar_event::load($event['eventid']);

            // Let's check if the user is allowed to delete an event.
-            if (!calendar_edit_event_allowed($eventobj)) {
-                throw new moodle_exception("nopermissions");
+            if (!empty($eventobj->modulename) || !calendar_edit_event_allowed($eventobj)) {
+                throw new moodle_exception("nopermissions", 'error', '',
+                    get_string('deleteevent', 'calendar'));
            }
            // Time to do the magic.
            $eventobj->delete($event['repeat']);
@@ -411,7 +411,7 @@ function calendar_get_mini($courses, $groups, $users, $calmonth = false, $calyea
                        $name = format_string($event->name, true);
                    }
                }
-                $popupcontent .= html_writer::link($dayhref, $name);
+                $popupcontent .= html_writer::link($dayhref, clean_text($name));
                $popupcontent .= html_writer::end_tag('div');
            }

@@ -1741,10 +1741,11 @@ function calendar_format_event_time($event, $now, $linkparams = null, $usecommon
                $url = calendar_get_link_href(new moodle_url(CALENDAR_URL . 'view.php', $linkparams), 0, 0, 0, $endtime);
                $eventtime = $timestart . ' <strong>&raquo;</strong> ' . html_writer::link($url, $dayend) . $timeend;
            } else {
-                $url = calendar_get_link_href(new moodle_url(CALENDAR_URL . 'view.php', $linkparams), 0, 0, 0, $endtime);
+                // The event is in the future, print start and end  links.
+                $url = calendar_get_link_href(new moodle_url(CALENDAR_URL . 'view.php', $linkparams), 0, 0, 0, $starttime);
                $eventtime  = html_writer::link($url, $daystart) . $timestart . ' <strong>&raquo;</strong> ';

-                $url = calendar_get_link_href(new moodle_url(CALENDAR_URL . 'view.php', $linkparams),  0, 0, 0, $starttime);
+                $url = calendar_get_link_href(new moodle_url(CALENDAR_URL . 'view.php', $linkparams),  0, 0, 0, $endtime);
                $eventtime .= html_writer::link($url, $dayend) . $timeend;
            }
        }
@@ -3052,7 +3053,7 @@ function calendar_add_icalendar_event($event, $courseid, $subscriptionid, $timez
    $eventrecord->courseid = $sub->courseid;
    $eventrecord->eventtype = $sub->eventtype;

-    if ($updaterecord = $DB->get_record('event', array('uuid' => $eventrecord->uuid))) {
+    if ($updaterecord = $DB->get_record('event', array('uuid' => $eventrecord->uuid, 'subscriptionid' => $eventrecord->subscriptionid))) {
        $eventrecord->id = $updaterecord->id;
        $return = CALENDAR_IMPORT_EVENT_UPDATED; // Update.
    } else {
@@ -506,4 +506,27 @@ class core_calendar_externallib_testcase extends externallib_advanced_testcase {
        $this->assertEquals(1, count($eventsret['events']));
        $this->assertEquals(2, count($eventsret['warnings']));
    }
+
+    /**
+     * Test for deleting module events.
+     */
+    public function test_delete_calendar_events_for_modules() {
+        $this->resetAfterTest();
+        $this->setAdminUser();
+        $course = $this->getDataGenerator()->create_course();
+        $nexttime = time() + DAYSECS;
+        $this->getDataGenerator()->create_module('assign', ['course' => $course->id, 'duedate' => $nexttime]);
+        $events = calendar_get_events(time(), $nexttime, true, true, true);
+        $this->assertCount(1, $events);
+        $params = [];
+        foreach($events as $event) {
+            $params[] = [
+                'eventid' => $event->id,
+                'repeat' => false
+            ];
+        }
+
+        $this->setExpectedException('moodle_exception');
+        core_calendar_external::delete_calendar_events($params);
+    }
 }
@@ -1,535 +0,0 @@
-<?php
-// This file is part of Moodle - http://moodle.org/
-//
-// Moodle is free software: you can redistribute it and/or modify
-// it under the terms of the GNU General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// Moodle is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License
-// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
-
-/**
- * Defines test class to test manage rrule during ical imports.
- *
- * @package core_calendar
- * @category test
- * @copyright 2014 onwards Ankit Agarwal <ankit.agrr@gmail.com>
- * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
- */
-class core_calendar_rrule_manager_testcase extends advanced_testcase {
-
-    /** @var stdClass a dummy event */
-    protected $event;
-
-    /**
-     * Set up method.
-     */
-    protected function setUp() {
-        global $DB, $CFG;
-        $this->resetAfterTest();
-
-        $this->setTimezone('Australia/Perth');
-
-        $user = $this->getDataGenerator()->create_user();
-        $sub = new stdClass();
-        $sub->url = '';
-        $sub->courseid = 0;
-        $sub->groupid = 0;
-        $sub->userid = $user->id;
-        $sub->pollinterval = 0;
-        $subid = $DB->insert_record('event_subscriptions', $sub, true);
-
-        $event = new stdClass();
-        $event->name = 'Event name';
-        $event->description = '';
-        $event->timestart = 1385913700; // A 2013-12-2 Monday event.
-        $event->timeduration = 3600;
-        $event->uuid = 'uuid';
-        $event->subscriptionid = $subid;
-        $event->userid = $user->id;
-        $event->groupid = 0;
-        $event->courseid = 0;
-        $event->eventtype = 'user';
-        $eventobj = calendar_event::create($event, false);
-        $DB->set_field('event', 'repeatid', $eventobj->id, array('id' => $eventobj->id));
-        $eventobj->repeatid = $eventobj->id;
-        $this->event = $eventobj;
-    }
-
-    /**
-     * Test parse_rrule() method.
-     */
-    public function test_parse_rrule() {
-
-        $rrule = "FREQ=DAILY;COUNT=3;INTERVAL=4;BYSECOND=20,40;BYMINUTE=2,30;BYHOUR=3,4;BYDAY=MO,TH;BYMONTHDAY=20,
-                30;BYYEARDAY=300,-20;BYWEEKNO=22,33;BYMONTH=3,4";
-        $mang = new core_tests_calendar_rrule_manager($rrule);
-        $mang->parse_rrule();
-        $this->assertEquals(\core_calendar\rrule_manager::FREQ_DAILY, $mang->freq);
-        $this->assertEquals(3, $mang->count);
-        $this->assertEquals(4, $mang->interval);
-        $this->assertEquals(array(20, 40), $mang->bysecond);
-        $this->assertEquals(array(2, 30), $mang->byminute);
-        $this->assertEquals(array(3, 4), $mang->byhour);
-        $this->assertEquals(array('MO', 'TH'), $mang->byday);
-        $this->assertEquals(array(20, 30), $mang->bymonthday);
-        $this->assertEquals(array(300, -20), $mang->byyearday);
-        $this->assertEquals(array(22, 33), $mang->byweekno);
-        $this->assertEquals(array(3, 4), $mang->bymonth);
-    }
-
-    /**
-     * Test exception is thrown for invalid property.
-     */
-    public function test_parse_rrule_validation() {
-
-        $rrule = "RANDOM=PROPERTY;";
-        $this->setExpectedException('moodle_exception');
-        $mang = new core_tests_calendar_rrule_manager($rrule);
-        $mang->parse_rrule();
-    }
-
-    /**
-     * Test exception is thrown for invalid frequency.
-     */
-    public function test_freq_validation() {
-
-        $rrule = "FREQ=RANDOMLY;";
-        $this->setExpectedException('moodle_exception');
-        $mang = new core_tests_calendar_rrule_manager($rrule);
-        $mang->parse_rrule();
-    }
-
-    /**
-     * Test recurrence rules for daily frequency.
-     */
-    public function test_daily_events() {
-        global $DB;
-
-        $rrule = 'FREQ=DAILY;COUNT=3'; // This should generate 2 child events + 1 parent.
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        $count = $DB->count_records('event', array('repeatid' => $this->event->id));
-        $this->assertEquals(3, $count);
-        $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                'timestart' => ($this->event->timestart + DAYSECS)));
-        $this->assertTrue($result);
-        $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                'timestart' => ($this->event->timestart + 2 * DAYSECS)));
-        $this->assertTrue($result);
-
-        $until = $this->event->timestart + DAYSECS * 2;
-        $until = date('Y-m-d', $until);
-        $rrule = "FREQ=DAILY;UNTIL=$until"; // This should generate 1 child event + 1 parent,since by then until bound would be hit.
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        $count = $DB->count_records('event', array('repeatid' => $this->event->id));
-        $this->assertEquals(2, $count);
-        $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                'timestart' => ($this->event->timestart + DAYSECS)));
-        $this->assertTrue($result);
-
-        $rrule = 'FREQ=DAILY;COUNT=3;INTERVAL=3'; // This should generate 2 child events + 1 parent, every 3rd day.
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        $count = $DB->count_records('event', array('repeatid' => $this->event->id));
-        $this->assertEquals(3, $count);
-        $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                'timestart' => ($this->event->timestart + 3 * DAYSECS)));
-        $this->assertTrue($result);
-        $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                'timestart' => ($this->event->timestart + 6 * DAYSECS)));
-        $this->assertTrue($result);
-
-        // Forever event. This should generate events for time() + 10 year period, every 300th day.
-        $rrule = 'FREQ=DAILY;INTERVAL=300';
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $until = time() + (YEARSECS * $mang::TIME_UNLIMITED_YEARS);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        for ($i = 0, $time = $this->event->timestart; $time < $until; $i++, $time = $this->event->timestart + 300 * DAYSECS * $i) {
-            $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                    'timestart' => ($time)));
-            $this->assertTrue($result);
-        }
-    }
-
-    /**
-     * Test recurrence rules for weekly frequency.
-     */
-    public function test_weekly_events() {
-        global $DB;
-
-        $rrule = 'FREQ=WEEKLY;COUNT=1'; // This should generate 7 events in total, one for each day.
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        $count = $DB->count_records('event', array('repeatid' => $this->event->id));
-        $this->assertEquals(7, $count);
-        for ($i = 0; $i < 7; $i++) {
-            $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                    'timestart' => ($this->event->timestart + $i * DAYSECS)));
-            $this->assertTrue($result);
-        }
-
-        // This should generate 4 child event + 1 parent, since by then until bound would be hit.
-        $until = $this->event->timestart + WEEKSECS * 4;
-        $until = date('YmdThis', $until);
-        $rrule = "FREQ=WEEKLY;BYDAY=MO;UNTIL=$until";
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        $count = $DB->count_records('event', array('repeatid' => $this->event->id));
-        $this->assertEquals(5, $count);
-        for ($i = 0; $i < 5; $i++) {
-            $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                    'timestart' => ($this->event->timestart + $i * WEEKSECS)));
-            $this->assertTrue($result);
-        }
-
-        // This should generate 4 events in total every monday and Wednesday of every 3rd week.
-        $rrule = 'FREQ=WEEKLY;INTERVAL=3;BYDAY=MO,WE;COUNT=2';
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        $count = $DB->count_records('event', array('repeatid' => $this->event->id));
-        $this->assertEquals(4, $count);
-        $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                'timestart' => ($this->event->timestart + 3 * WEEKSECS))); // Monday event.
-        $this->assertTrue($result);
-        $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                'timestart' => ($this->event->timestart + 2 * DAYSECS))); // Wednesday event.
-        $this->assertTrue($result);
-        $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                'timestart' => ($this->event->timestart + 3 * WEEKSECS + 2 * DAYSECS))); // Wednesday event.
-        $this->assertTrue($result);
-
-        // Forever event. This should generate events over time() + 10 year period, every 50th monday.
-        $rrule = 'FREQ=WEEKLY;BYDAY=MO;INTERVAL=50';
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $until = time() + (YEARSECS * $mang::TIME_UNLIMITED_YEARS);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        for ($i = 0, $time = $this->event->timestart; $time < $until; $i++, $time = $this->event->timestart + 50 * WEEKSECS * $i) {
-            $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                    'timestart' => ($time)));
-            $this->assertTrue($result);
-        }
-    }
-
-    /**
-     * Test recurrence rules for monthly frequency.
-     */
-    public function test_monthly_events() {
-        global $DB;
-        $rrule = 'FREQ=MONTHLY;COUNT=3;BYMONTHDAY=2'; // This should generate 3 events in total.
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        $count = $DB->count_records('event', array('repeatid' => $this->event->id));
-        $this->assertEquals(3, $count);
-        for ($i = 0; $i < 3; $i++) {
-            $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                    'timestart' => (strtotime("+$i month", $this->event->timestart))));
-            $this->assertTrue($result);
-        }
-
-        // This much seconds after the start of the day.
-        $offset = $this->event->timestart - mktime(0, 0, 0, date("n", $this->event->timestart), date("j", $this->event->timestart),
-                date("Y", $this->event->timestart));
-        $monthstart = mktime(0, 0, 0, date("n", $this->event->timestart), 1, date("Y", $this->event->timestart));
-
-        $rrule = 'FREQ=MONTHLY;COUNT=3;BYDAY=1MO'; // This should generate 3 events in total, first monday of the month.
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        $count = $DB->count_records('event', array('repeatid' => $this->event->id));
-        $this->assertEquals(3, $count);
-        $time = strtotime('1 Monday', strtotime("+1 months", $monthstart)) + $offset;
-        $result = $DB->record_exists('event', array('repeatid' => $this->event->id, 'timestart' => $time));
-        $this->assertTrue($result);
-        $time = strtotime('1 Monday', strtotime("+2 months", $monthstart)) + $offset;
-        $result = $DB->record_exists('event', array('repeatid' => $this->event->id, 'timestart' => $time));
-        $this->assertTrue($result);
-
-        // This should generate 10 child event + 1 parent, since by then until bound would be hit.
-        $until = strtotime('+1 day +10 months', $this->event->timestart);
-        $until = date('YmdThis', $until);
-        $rrule = "FREQ=MONTHLY;BYMONTHDAY=2;UNTIL=$until";
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        $count = $DB->count_records('event', array('repeatid' => $this->event->id));
-        $this->assertEquals(11, $count);
-        for ($i = 0; $i < 11; $i++) {
-            $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                    'timestart' => (strtotime("+$i month", $this->event->timestart))));
-            $this->assertTrue($result);
-        }
-
-        // This should generate 10 child event + 1 parent, since by then until bound would be hit.
-        $until = strtotime('+1 day +10 months', $this->event->timestart);
-        $until = date('YmdThis', $until);
-        $rrule = "FREQ=MONTHLY;BYDAY=1MO;UNTIL=$until";
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        $count = $DB->count_records('event', array('repeatid' => $this->event->id));
-        $this->assertEquals(10, $count);
-        for ($i = 0; $i < 10; $i++) {
-            $time = strtotime('1 Monday', strtotime("+$i months", $monthstart)) + $offset;
-            $result = $DB->record_exists('event', array('repeatid' => $this->event->id, 'timestart' => $time));
-            $this->assertTrue($result);
-        }
-
-        // This should generate 11 child event + 1 parent, since by then until bound would be hit.
-        $until = strtotime('+10 day +10 months', $this->event->timestart); // 12 oct 2014.
-        $until = date('YmdThis', $until);
-        $rrule = "FREQ=MONTHLY;INTERVAL=2;BYMONTHDAY=2,5;UNTIL=$until";
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        $count = $DB->count_records('event', array('repeatid' => $this->event->id));
-        $this->assertEquals(12, $count);
-        for ($i = 0; $i < 6; $i++) {
-            $moffset = $i * 2;
-            $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                    'timestart' => (strtotime("+$moffset month", $this->event->timestart))));
-            $this->assertTrue($result);
-            // Event on the 5th of a month.
-            $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                    'timestart' => (strtotime("+3 days +$moffset month", $this->event->timestart))));
-            $this->assertTrue($result);
-        }
-
-        // This should generate 11 child event + 1 parent, since by then until bound would be hit.
-        $until = strtotime('+20 day +10 months', $this->event->timestart); // 22 oct 2014.
-        $until = date('YmdTHis', $until);
-        $rrule = "FREQ=MONTHLY;INTERVAL=2;BYDAY=1MO,3WE;UNTIL=$until";
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        $count = $DB->count_records('event', array('repeatid' => $this->event->id));
-        $this->assertEquals(12, $count);
-        for ($i = 0; $i < 6; $i++) {
-            $moffset = $i * 2;
-            $time = strtotime("+$moffset month", $monthstart);
-            $time2 = strtotime("+1 Monday", $time) + $offset;
-            $result = $DB->record_exists('event', array('repeatid' => $this->event->id, 'timestart' => $time2));
-            $this->assertTrue($result);
-            $time2 = strtotime("+3 Wednesday", $time) + $offset;
-            $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                    'timestart' => $time2)); // Event on the 5th of a month.
-            $this->assertTrue($result);
-        }
-
-        // Forever event. This should generate events over 10 year period, on 2nd of every 12th month.
-        $rrule = 'FREQ=MONTHLY;INTERVAL=12;BYMONTHDAY=2';
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $until = time() + (YEARSECS * $mang::TIME_UNLIMITED_YEARS);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        for ($i = 0, $time = $this->event->timestart; $time < $until; $i++, $moffset = $i * 12,
-                $time = strtotime("+$moffset month", $this->event->timestart)) {
-            $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                    'timestart' => ($time)));
-            $this->assertTrue($result);
-        }
-
-        // Forever event. This should generate 10 child events + 1 parent over 10 year period, every 50th Monday.
-        $rrule = 'FREQ=MONTHLY;BYDAY=1MO;INTERVAL=12';
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $until = time() + (YEARSECS * $mang::TIME_UNLIMITED_YEARS);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        $count = $DB->count_records('event', array('repeatid' => $this->event->id));
-        $this->assertEquals(11, $count);
-        for ($i = 0, $moffset = 0, $time = $this->event->timestart; $time < $until; $i++, $moffset = $i * 12) {
-            $result = $DB->record_exists('event', array('repeatid' => $this->event->id, 'timestart' => ($time)));
-            $this->assertTrue($result);
-            $time = strtotime("+$moffset month", $monthstart);
-            $time = strtotime("+1 Monday", $time) + $offset;
-        }
-    }
-
-    /**
-     * Test recurrence rules for yearly frequency.
-     */
-    public function test_yearly_events() {
-        global $DB;
-
-        $rrule = 'FREQ=YEARLY;COUNT=3;BYMONTH=12'; // This should generate 3 events in total.
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        $count = $DB->count_records('event', array('repeatid' => $this->event->id));
-        $this->assertEquals(3, $count);
-        for ($i = 0, $time = $this->event->timestart; $i < 3; $i++, $time = strtotime("+$i years", $this->event->timestart)) {
-            $result = $DB->record_exists('event', array('repeatid' => $this->event->id, 'timestart' => $time));
-            $this->assertTrue($result);
-        }
-
-        // Create an event every december, until the time limit is hit.
-        $until = strtotime('+20 day +10 years', $this->event->timestart);
-        $until = date('YmdTHis', $until);
-        $rrule = "FREQ=YEARLY;BYMONTH=12;UNTIL=$until"; // Forever event.
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $until = time() + (YEARSECS * $mang::TIME_UNLIMITED_YEARS);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        $count = $DB->count_records('event', array('repeatid' => $this->event->id));
-        $this->assertEquals(11, $count);
-        for ($i = 0, $time = $this->event->timestart; $time < $until; $i++, $yoffset = $i * 2,
-            $time = strtotime("+$yoffset years", $this->event->timestart)) {
-            $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                    'timestart' => ($time)));
-            $this->assertTrue($result);
-        }
-
-        // This should generate 5 events in total, every second year in the month of december.
-        $rrule = 'FREQ=YEARLY;BYMONTH=12;INTERVAL=2;COUNT=5';
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        $count = $DB->count_records('event', array('repeatid' => $this->event->id));
-        $this->assertEquals(5, $count);
-        for ($i = 0, $time = $this->event->timestart; $i < 5; $i++, $yoffset = $i * 2,
-            $time = strtotime("+$yoffset years", $this->event->timestart)) {
-            $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                    'timestart' => ($time)));
-            $this->assertTrue($result);
-        }
-
-        $rrule = 'FREQ=YEARLY;BYMONTH=12;INTERVAL=2'; // Forever event.
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $until = time() + (YEARSECS * $mang::TIME_UNLIMITED_YEARS);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        $count = $DB->count_records('event', array('repeatid' => $this->event->id));
-        $this->assertEquals(6, $count);
-        for ($i = 0, $time = $this->event->timestart; $time < $until; $i++, $yoffset = $i * 2,
-            $time = strtotime("+$yoffset years", $this->event->timestart)) {
-            $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                    'timestart' => ($time)));
-            $this->assertTrue($result);
-        }
-
-        // This much seconds after the start of the day.
-        $offset = $this->event->timestart - mktime(0, 0, 0, date("n", $this->event->timestart), date("j", $this->event->timestart),
-                date("Y", $this->event->timestart));
-        $yearstart = mktime(0, 0, 0, 1, 1, date("Y", $this->event->timestart));
-
-        $rrule = 'FREQ=YEARLY;COUNT=3;BYMONTH=12;BYDAY=1MO'; // This should generate 3 events in total.
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        $count = $DB->count_records('event', array('repeatid' => $this->event->id));
-        $this->assertEquals(3, $count);
-        for ($i = 0; $i < 3; $i++) {
-            $time = strtotime("+11 months +$i years", $yearstart);
-            $time = strtotime("+1 Monday", $time) + $offset;
-            $result = $DB->record_exists('event', array('repeatid' => $this->event->id, 'timestart' => $time));
-            $this->assertTrue($result);
-        }
-
-        // Create an event every december, until the time limit is hit.
-        $until = strtotime('+20 day +10 years', $this->event->timestart);
-        $until = date('YmdTHis', $until);
-        $rrule = "FREQ=YEARLY;BYMONTH=12;UNTIL=$until;BYDAY=1MO";
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $until = time() + (YEARSECS * $mang::TIME_UNLIMITED_YEARS);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        $count = $DB->count_records('event', array('repeatid' => $this->event->id));
-        $this->assertEquals(11, $count);
-        for ($i = 0, $time = $this->event->timestart; $time < $until; $i++) {
-            $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                    'timestart' => ($time)));
-            $this->assertTrue($result);
-            $time = strtotime("+11 months +$i years", $yearstart);
-            $time = strtotime("+1 Monday", $time) + $offset;
-        }
-
-        // This should generate 5 events in total, every second year in the month of december.
-        $rrule = 'FREQ=YEARLY;BYMONTH=12;INTERVAL=2;COUNT=5;BYDAY=1MO';
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        $count = $DB->count_records('event', array('repeatid' => $this->event->id));
-        $this->assertEquals(5, $count);
-        for ($i = $yoffset = 0, $time = $this->event->timestart; $i < 5; $i++, $yoffset = $i * 2) {
-            $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                    'timestart' => ($time)));
-            $this->assertTrue($result);
-            $time = strtotime("+11 months +$yoffset years", $yearstart);
-            $time = strtotime("+1 Monday", $time) + $offset;
-        }
-
-        $rrule = 'FREQ=YEARLY;BYMONTH=12;INTERVAL=2;BYDAY=1MO'; // Forever event.
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $until = time() + (YEARSECS * $mang::TIME_UNLIMITED_YEARS);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        $count = $DB->count_records('event', array('repeatid' => $this->event->id));
-        $this->assertEquals(6, $count);
-        for ($i = 0, $time = $this->event->timestart; $time < $until; $i++, $yoffset = $i * 2) {
-            $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                    'timestart' => ($time)));
-            $this->assertTrue($result);
-            $time = strtotime("+11 months +$yoffset years", $yearstart);
-            $time = strtotime("+1 Monday", $time) + $offset;
-        }
-
-        $rrule = 'FREQ=YEARLY;INTERVAL=2'; // Forever event.
-        $mang = new \core_calendar\rrule_manager($rrule);
-        $until = time() + (YEARSECS * $mang::TIME_UNLIMITED_YEARS);
-        $mang->parse_rrule();
-        $mang->create_events($this->event);
-        $count = $DB->count_records('event', array('repeatid' => $this->event->id));
-        $this->assertEquals(6, $count);
-        for ($i = 0, $time = $this->event->timestart; $time < $until; $i++, $yoffset = $i * 2) {
-            $result = $DB->record_exists('event', array('repeatid' => $this->event->id,
-                    'timestart' => ($time)));
-            $this->assertTrue($result);
-            $time = strtotime("+11 months +$yoffset years", $yearstart);
-            $time = strtotime("+1 Monday", $time) + $offset;
-        }
-    }
-}
-
-/**
- * Class core_calendar_test_rrule_manager
- *
- * Wrapper to access protected vars for testing.
- *
- * @package core_calendar
- * @category test
- * @copyright 2014 onwards Ankit Agarwal <ankit.agrr@gmail.com>
- * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
- */
-class core_tests_calendar_rrule_manager extends \core_calendar\rrule_manager{
-
-    /**
-     * Magic method to get properties.
-     *
-     * @param $prop string property
-     *
-     * @return mixed
-     * @throws coding_exception
-     */
-    public function __get($prop) {
-        if (property_exists($this, $prop)) {
-            return $this->$prop;
-        }
-        throw new coding_exception('invalidproperty');
-    }
-}
@@ -57,6 +57,12 @@ M.core_comment = {
                        this.view(0);
                        return false;
                    }, this);
+                    // Also handle space/enter key.
+                    handle.on('key', function(e) {
+                        e.preventDefault();
+                        this.view(0);
+                        return false;
+                    }, '13,32', this);
                }
                scope.toggle_textarea(false);
            },
@@ -186,7 +192,17 @@ M.core_comment = {
                        val = val.replace('___name___', list[i].fullname);
                    }
                    if (list[i]['delete']||newcmt) {
-                        list[i].content = '<div class="comment-delete"><a href="#" id ="comment-delete-'+this.client_id+'-'+list[i].id+'" title="'+M.util.get_string('deletecomment', 'moodle')+'"><img alt="" src="'+M.util.image_url('t/delete', 'core')+'" /></a></div>' + list[i].content;
+                        var tokens = {
+                            user: list[i].fullname,
+                            time: list[i].time
+                        };
+                        var deleteStr = Y.Escape.html(M.util.get_string('deletecommentbyon', 'moodle', tokens));
+                        list[i].content = '<div class="comment-delete">' +
+                            '<a href="#" role="button" id ="comment-delete-' + this.client_id + '-' + list[i].id + '"' +
+                            '   title="' + deleteStr + '">' +
+                            '<img alt="' + deleteStr + '" src="' + M.util.image_url('t/delete', 'core') + '" />' +
+                            '</a>' +
+                            '</div>' + list[i].content;
                    }
                    val = val.replace('___time___', list[i].time);
                    val = val.replace('___picture___', list[i].avatar);
@@ -335,6 +351,7 @@ M.core_comment = {
                );
            },
            view: function(page) {
+                var commenttoggler = Y.one('#comment-link-' + this.client_id);
                var container = Y.one('#comment-ctrl-'+this.client_id);
                var ta = Y.one('#dlg-content-'+this.client_id);
                var img = Y.one('#comment-img-'+this.client_id);
@@ -351,6 +368,9 @@ M.core_comment = {
                    if (img) {
                        img.set('src', M.util.image_url('t/expanded', 'core'));
                    }
+                    if (commenttoggler) {
+                        commenttoggler.setAttribute('aria-expanded', 'true');
+                    }
                } else {
                    // hide
                    container.setStyle('display', 'none');
@@ -364,6 +384,9 @@ M.core_comment = {
                    if (ta) {
                        ta.set('value','');
                    }
+                    if (commenttoggler) {
+                        commenttoggler.setAttribute('aria-expanded', 'false');
+                    }
                }
                if (ta) {
                    //toggle_textarea.apply(ta, [false]);
@@ -410,19 +433,21 @@ M.core_comment = {
    },
    init_admin: function(Y) {
        var select_all = Y.one('#comment_select_all');
-        select_all.on('click', function(e) {
-            var comments = document.getElementsByName('comments');
-            var checked = false;
-            for (var i in comments) {
-                if (comments[i].checked) {
-                    checked=true;
+        if (select_all) {
+            select_all.on('click', function(e) {
+                var comments = document.getElementsByName('comments');
+                var checked = false;
+                for (var i in comments) {
+                    if (comments[i].checked) {
+                        checked=true;
+                    }
                }
-            }
-            for (i in comments) {
-                comments[i].checked = !checked;
-            }
-            this.set('checked', !checked);
-        });
+                for (i in comments) {
+                    comments[i].checked = !checked;
+                }
+                this.set('checked', !checked);
+            });
+        }

        var comments_delete = Y.one('#comments_delete');
        if (comments_delete) {
@@ -263,7 +263,7 @@ class comment {
                'comments',
                'commentscount',
                'commentsrequirelogin',
-                'deletecomment',
+                'deletecommentbyon',
            ),
            'moodle'
        );
@@ -460,7 +460,13 @@ class comment {
                } else {
                    $collapsedimage= 't/collapsed';
                }
-                $html .= html_writer::start_tag('a', array('class' => 'comment-link', 'id' => 'comment-link-'.$this->cid, 'href' => '#'));
+                $html .= html_writer::start_tag('a', array(
+                    'class' => 'comment-link',
+                    'id' => 'comment-link-'.$this->cid,
+                    'href' => '#',
+                    'role' => 'button',
+                    'aria-expanded' => 'false')
+                );
                $html .= html_writer::empty_tag('img', array('id' => 'comment-img-'.$this->cid, 'src' => $OUTPUT->pix_url($collapsedimage), 'alt' => $this->linktext, 'title' => $this->linktext));
                $html .= html_writer::tag('span', $this->linktext.' '.$countstring, array('id' => 'comment-link-text-'.$this->cid));
                $html .= html_writer::end_tag('a');
@@ -68,7 +68,7 @@ class competency extends persistent {
            ),
            'description' => array(
                'default' => '',
-                'type' => PARAM_RAW
+                'type' => PARAM_CLEANHTML
            ),
            'descriptionformat' => array(
                'choices' => array(FORMAT_HTML, FORMAT_MOODLE, FORMAT_PLAIN, FORMAT_MARKDOWN),
@@ -676,7 +676,8 @@ class competency extends persistent {
    public static function share_same_framework(array $ids) {
        global $DB;
        list($insql, $params) = $DB->get_in_or_equal($ids);
-        return $DB->count_records_select(self::TABLE, "id $insql", $params, "COUNT(DISTINCT(competencyframeworkid))") == 1;
+        $sql = "SELECT COUNT('x') FROM (SELECT DISTINCT(competencyframeworkid) FROM {" . self::TABLE . "} WHERE id {$insql}) f";
+        return $DB->count_records_sql($sql, $params) == 1;
    }

    /**
@@ -90,7 +90,7 @@ class competency_framework extends persistent {
                'type' => PARAM_RAW
            ),
            'description' => array(
-                'type' => PARAM_RAW,
+                'type' => PARAM_CLEANHTML,
                'default' => ''
            ),
            'descriptionformat' => array(
@@ -158,7 +158,7 @@ abstract class exporter {
            } else if ($definition['type'] === PARAM_TEXT) {
                if (!empty($definition['multiple'])) {
                    foreach ($data->$property as $key => $value) {
-                        $data->$property[$key] = external_format_string($value, $context->id);
+                        $data->{$property}[$key] = external_format_string($value, $context->id);
                    }
                } else {
                    $data->$property = external_format_string($data->$property, $context->id);
@@ -334,7 +334,8 @@ abstract class exporter {
     */
    final protected static function get_format_field($definitions, $property) {
        $formatproperty = $property . 'format';
-        if ($definitions[$property]['type'] == PARAM_RAW && isset($definitions[$formatproperty])
+        if (($definitions[$property]['type'] == PARAM_RAW || $definitions[$property]['type'] == PARAM_CLEANHTML)
+                && isset($definitions[$formatproperty])
                && $definitions[$formatproperty]['type'] == PARAM_INT) {
            return $formatproperty;
        }
@@ -451,7 +452,7 @@ abstract class exporter {
                // This is a nested array of more properties.
                $thisvalue = self::get_read_structure_from_properties($type, $proprequired, $propdefault);
            } else {
-                if ($definition['type'] == PARAM_TEXT) {
+                if ($definition['type'] == PARAM_TEXT || $definition['type'] == PARAM_CLEANHTML) {
                    // PARAM_TEXT always becomes PARAM_RAW because filters may be applied.
                    $type = PARAM_RAW;
                }
@@ -248,7 +248,8 @@ abstract class persistent {
        $formatted = array();
        foreach ($properties as $property => $definition) {
            $propertyformat = $property . 'format';
-            if ($definition['type'] == PARAM_RAW && array_key_exists($propertyformat, $properties)
+            if (($definition['type'] == PARAM_RAW || $definition['type'] == PARAM_CLEANHTML)
+                    && array_key_exists($propertyformat, $properties)
                    && $properties[$propertyformat]['type'] == PARAM_INT) {
                $formatted[$property] = $propertyformat;
            }
@@ -616,6 +617,10 @@ abstract class persistent {
                        // Validate_param() does not like false with PARAM_BOOL, better to convert it to int.
                        $value = 0;
                    }
+                    if ($definition['type'] === PARAM_CLEANHTML) {
+                        // We silently clean for this type. It may introduce changes even to valid data.
+                        $value = clean_param($value, PARAM_CLEANHTML);
+                    }
                    validate_param($value, $definition['type'], $definition['null']);
                } catch (invalid_parameter_exception $e) {
                    $errors[$property] = static::get_property_error_message($property);
@@ -71,7 +71,7 @@ class plan extends persistent {
                'type' => PARAM_TEXT,
            ),
            'description' => array(
-                'type' => PARAM_RAW,
+                'type' => PARAM_CLEANHTML,
                'default' => ''
            ),
            'descriptionformat' => array(
@@ -53,7 +53,7 @@ class template extends persistent {
            ),
            'description' => array(
                'default' => '',
-                'type' => PARAM_RAW,
+                'type' => PARAM_CLEANHTML,
            ),
            'descriptionformat' => array(
                'choices' => array(FORMAT_HTML, FORMAT_MOODLE, FORMAT_PLAIN, FORMAT_MARKDOWN),
@@ -53,7 +53,7 @@ class user_evidence extends persistent {
                'type' => PARAM_TEXT
            ),
            'description' => array(
-                'type' => PARAM_RAW,
+                'type' => PARAM_CLEANHTML,
                'default' => '',
            ),
            'descriptionformat' => array(
@@ -288,6 +288,7 @@ function core_competency_pluginfile($course, $cm, $context, $filearea, $args, $f
    if ($filearea == 'userevidence' && $context->contextlevel == CONTEXT_USER) {
        if (user_evidence::can_read_user($context->instanceid)) {
            $file = $fs->get_file($context->id, 'core_competency', $filearea, $itemid, $filepath, $filename);
+            $forcedownload = true;
        }
    }

@@ -107,6 +107,9 @@ class core_competency_exporter_testcase extends advanced_testcase {
        $output = $PAGE->get_renderer('tool_lp');

        $result = $exporter->export($output);
+
+        $this->assertSame('Another string', $result->otherstring);
+        $this->assertSame(array('String a', 'String b'), $result->otherstrings);
    }
 }

@@ -126,8 +129,8 @@ class core_competency_testable_exporter extends \core_competency\external\export

    protected function get_other_values(renderer_base $output) {
        return array(
-            'otherstring' => 'An other string',
-            'otherstrings' => array('String a', 'String b')
+            'otherstring' => 'Another <strong>string</strong>',
+            'otherstrings' => array('String a', 'String <strong>b</strong>')
        );
    }

@@ -213,4 +213,18 @@ class completion_criteria_date extends completion_criteria {
    public function get_icon($alt, array $attributes = null) {
        return new pix_icon('i/calendar', $alt, 'moodle', $attributes);
    }
+
+    /**
+     * Shift the date when resetting course.
+     *
+     * @param int $courseid the course id
+     * @param int $timeshift number of seconds to shift date
+     * @return boolean was the operation successful?
+     */
+    public static function update_date($courseid, $timeshift) {
+        if ($criteria = self::fetch(array('course' => $courseid))) {
+            $criteria->timeend = $criteria->timeend + $timeshift;
+            $criteria->update();
+        }
+    }
 }
@@ -121,12 +121,13 @@ class behat_completion extends behat_base {
    public function activity_marked_as_complete($activityname, $activitytype, $completiontype) {
        if ($completiontype == "manual") {
            $imgalttext = get_string("completion-alt-manual-y", 'core_completion', $activityname);
+            $xpathtocheck = "//input[@type='image'][contains(@alt, '$imgalttext')]";
        } else {
            $imgalttext = get_string("completion-alt-auto-y", 'core_completion', $activityname);
+            $xpathtocheck = "//img[contains(@alt, '$imgalttext')]";
        }
        $csselementforactivitytype = "li.modtype_".strtolower($activitytype);

-        $xpathtocheck = "//img[contains(@alt, '$imgalttext')]";
        $this->execute("behat_general::should_exist_in_the",
            array($xpathtocheck, "xpath_element", $csselementforactivitytype, "css_element")
        );
@@ -141,12 +142,13 @@ class behat_completion extends behat_base {
    public function activity_marked_as_not_complete($activityname, $activitytype, $completiontype) {
        if ($completiontype == "manual") {
            $imgalttext = get_string("completion-alt-manual-n", 'core_completion', $activityname);
+            $xpathtocheck = "//input[@type='image'][contains(@alt, '$imgalttext')]";
        } else {
            $imgalttext = get_string("completion-alt-auto-n", 'core_completion', $activityname);
+            $xpathtocheck = "//img[contains(@alt, '$imgalttext')]";
        }
        $csselementforactivitytype = "li.modtype_".strtolower($activitytype);

-        $xpathtocheck = "//img[contains(@alt, '$imgalttext')]";
        $this->execute("behat_general::should_exist_in_the",
            array($xpathtocheck, "xpath_element", $csselementforactivitytype, "css_element")
        );
@@ -25,15 +25,16 @@ Feature: Allow students to manually mark an activity as complete
    And I set the following fields to these values:
      | Enable completion tracking | Yes |
    And I press "Save and display"
-    When I add a "Forum" to section "1" and I fill the form with:
+    And I add a "Forum" to section "1" and I fill the form with:
      | Forum name | Test forum name |
      | Description | Test forum description |
-    Then "Student First" user has not completed "Test forum name" activity
+    And "Student First" user has not completed "Test forum name" activity
    And I log out
    And I log in as "student1"
    And I am on site homepage
    And I follow "Course 1"
-    And I press "Mark as complete: Test forum name"
+    When I press "Mark as complete: Test forum name"
+    Then the "Test forum name" "forum" activity with "manual" completion should be marked as complete
    And I log out
    And I log in as "teacher1"
    And I am on site homepage
@@ -1,7 +1,9 @@
 {
    "require-dev": {
-        "phpunit/phpunit": "4.8.*",
-        "phpunit/dbUnit": "1.4.*",
-        "moodlehq/behat-extension": "3.31.4"
+        "phpunit/phpunit": "4.8.27",
+        "phpunit/dbUnit": "1.4.1",
+        "sebastian/environment": "1.3.7",
+        "sebastian/recursion-context": "1.0.2",
+        "moodlehq/behat-extension": "3.31.7"
    }
 }
--- a/Show More
+++ b/Show More