Moodle release 3.3.4

weekly release 3.3.3+
Merge branch 'MDL-61177-33' of git://github.com/andrewnicols/moodle into MOODLE_33_STABLE
2018-01-12 20:35:41 +01:00 · 2018-01-12 02:12:39 +01:00 · 2018-01-11 09:23:42 +08:00 · 2018-01-10 15:23:50 +08:00 · 2018-01-10 08:13:58 +08:00 · 2018-01-09 11:34:51 +01:00
401 changed files with 6365 additions and 1501 deletions
@@ -1,4 +1,5 @@
 **/yui/build/** -diff
 **/amd/build/** -diff
+lib/dml/oci_native_moodle_package.sql text eol=lf
 theme/bootstrapbase/style/editor.css -diff
 theme/bootstrapbase/style/moodle.css -diff
@@ -17,7 +17,7 @@ php:
    - 5.6

 addons:
-  postgresql: "9.3"
+  postgresql: "9.6"
  packages:
    - mysql-server-5.6
    - mysql-client-core-5.6
@@ -53,12 +53,9 @@ matrix:
    fast_finish: true

    include:
-          # Run grunt/npm install on lowest supported npm version
-        - php: 7.1
-          env: DB=none     TASK=GRUNT   NVM_VERSION='4'
          # Run grunt/npm install on highest version ('node' is an alias for the latest node.js version.)
        - php: 7.1
-          env: DB=none     TASK=GRUNT   NVM_VERSION='node'
+          env: DB=none     TASK=GRUNT   NVM_VERSION='8.9'

    exclude:
        # MySQL - it's just too slow.
@@ -95,7 +92,7 @@ install:
            sudo service postgresql stop
            sudo mv /var/lib/postgresql /mnt/ramdisk
            sudo ln -s /mnt/ramdisk/postgresql /var/lib/postgresql
-            sudo service postgresql start 9.3
+            sudo service postgresql start 9.6
        fi
    - >
        if [ "$TASK" = 'PHPUNIT' ];
@@ -165,6 +165,12 @@ function print_auth_lock_options($auth, $user_fields, $helptext, $retrieveopts,
            // If custom field then pick name from database.
            $fieldshortname = str_replace('profile_field_', '', $fieldname);
            $fieldname = $customfieldname[$fieldshortname]->name;
+            if (core_text::strlen($fieldshortname) > 67) {
+                // If custom profile field name is longer than 67 characters we will not be able to store the setting
+                // such as 'field_updateremote_profile_field_NOTSOSHORTSHORTNAME' in the database because the character
+                // limit for the setting name is 100.
+                continue;
+            }
        } elseif ($fieldname == 'url') {
            $fieldname = get_string('webpage');
        } else {
@@ -54,14 +54,16 @@ $statusmsg = '';
 $errormsg  = '';

 if ($data = data_submitted() and confirm_sesskey()) {
-    if (admin_write_settings($data)) {
-        $statusmsg = get_string('changessaved');
-    }
-
+    $count = admin_write_settings($data);
    if (empty($adminroot->errors)) {
-        switch ($return) {
-            case 'site': redirect("$CFG->wwwroot/");
-            case 'admin': redirect("$CFG->wwwroot/$CFG->admin/");
+        // No errors. Did we change any setting?  If so, then indicate success.
+        if ($count) {
+            $statusmsg = get_string('changessaved');
+        } else {
+            switch ($return) {
+                case 'site': redirect("$CFG->wwwroot/");
+                case 'admin': redirect("$CFG->wwwroot/$CFG->admin/");
+            }
        }
    } else {
        $errormsg = get_string('errorwithsettings', 'admin');
@@ -1754,6 +1754,7 @@
      <VENDOR name="oracle" version="10.2" />
    </DATABASE>
    <PHP version="5.6.5" level="required">
+      <RESTRICT function="restrict_php_version_72" message="unsupportedphpversion72" />
    </PHP>
    <PCREUNICODE level="optional">
      <FEEDBACK>
@@ -1919,6 +1920,7 @@
      <VENDOR name="oracle" version="10.2" />
    </DATABASE>
    <PHP version="5.6.5" level="required">
+      <RESTRICT function="restrict_php_version_72" message="unsupportedphpversion72" />
    </PHP>
    <PCREUNICODE level="optional">
      <FEEDBACK>
@@ -2257,4 +2259,180 @@
      </CUSTOM_CHECK>
    </CUSTOM_CHECKS>
  </MOODLE>
+  <MOODLE version="3.5" requires="3.1">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mariadb" version="5.5.31" />
+      <VENDOR name="mysql" version="5.5.31" />
+      <VENDOR name="postgres" version="9.3" />
+      <VENDOR name="mssql" version="10.0" />
+      <VENDOR name="oracle" version="10.2" />
+    </DATABASE>
+    <PHP version="7.0.0" level="required">
+    </PHP>
+    <PCREUNICODE level="optional">
+      <FEEDBACK>
+        <ON_CHECK message="pcreunicodewarning" />
+      </FEEDBACK>
+    </PCREUNICODE>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="opensslrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zlib" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="gdrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlreader" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="intlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="hash" level="required"/>
+      <PHP_EXTENSION name="fileinfo" level="required"/>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="96M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="opcache.enable" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opcacherecommended" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+    <CUSTOM_CHECKS>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_storage_engine" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbstorageengine" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="question/engine/upgrade/upgradelib.php" function="quiz_attempts_upgraded" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="quizattemptsupgradedmessage" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_slasharguments" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="slashargumentswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_tables_row_format" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unsupporteddbtablerowformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_unoconv_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unoconvwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_libcurl_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="libcurlwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_format" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfileformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_per_table" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfilepertable" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_large_prefix" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddblargeprefix" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_is_https" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="ishttpswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_incomplete_unicode_support" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="incompleteunicodesupport" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+    </CUSTOM_CHECKS>
+  </MOODLE>
 </COMPATIBILITY_MATRIX>
@@ -29,9 +29,10 @@ require_once($CFG->libdir.'/adminlib.php');
 $confirm = optional_param('confirm', 0, PARAM_BOOL);
 $returnurl = optional_param('returnurl', null, PARAM_LOCALURL);

+admin_externalpage_setup('purgecaches');
+
 // If we have got here as a confirmed aciton, do it.
-if ($confirm && isloggedin() && confirm_sesskey()) {
-    require_capability('moodle/site:config', context_system::instance());
+if ($confirm && confirm_sesskey()) {

    // Valid request. Purge, and redirect the user back to where they came from.
    purge_all_caches();
@@ -45,8 +46,6 @@ if ($confirm && isloggedin() && confirm_sesskey()) {
 }

 // Otherwise, show a button to actually purge the caches.
-admin_externalpage_setup('purgecaches');
-
 $actionurl = new moodle_url('/admin/purgecaches.php', array('sesskey'=>sesskey(), 'confirm'=>1));
 if ($returnurl) {
    $actionurl->param('returnurl', $returnurl);
@@ -183,9 +183,14 @@ abstract class core_role_capability_table_with_risks extends core_role_capabilit
    public function get_risk_icon($type) {
        global $OUTPUT;

-        $text = $OUTPUT->pix_icon('i/' . str_replace('risk', 'risk_', $type), get_string($type . 'short', 'admin'));
+        $alt = get_string("{$type}short", "admin");
+        $title = get_string($type, "admin");
+
+        $text = $OUTPUT->pix_icon('i/' . str_replace('risk', 'risk_', $type), $alt, 'moodle', [
+                'title' => $title,
+            ]);
        $action = new popup_action('click', $this->risksurl, 'docspopup');
-        $riskicon = $OUTPUT->action_link($this->risksurl, $text, $action, array('title'=>get_string($type, 'admin')));
+        $riskicon = $OUTPUT->action_link($this->risksurl, $text, $action);

        return $riskicon;
    }
@@ -5,11 +5,19 @@
 require_once('../config.php');
 require_once($CFG->libdir.'/adminlib.php');

+redirect_if_major_upgrade_required();
+
 $query = trim(optional_param('query', '', PARAM_NOTAGS));  // Search string

 $context = context_system::instance();
 $PAGE->set_context($context);

+$hassiteconfig = has_capability('moodle/site:config', $context);
+
+if ($hassiteconfig && moodle_needs_upgrading()) {
+    redirect(new moodle_url('/admin/index.php'));
+}
+
 admin_externalpage_setup('search', '', array('query' => $query)); // now hidden page

 $adminroot = admin_get_root(); // need all settings here
@@ -21,15 +29,16 @@ $focus = '';
 // now we'll deal with the case that the admin has submitted the form with changed settings
 if ($data = data_submitted() and confirm_sesskey() and isset($data->action) and $data->action == 'save-settings') {
    require_capability('moodle/site:config', $context);
-    if (admin_write_settings($data)) {
-        redirect($PAGE->url, get_string('changessaved'), null, \core\output\notification::NOTIFY_SUCCESS);
-    }
-
+    $count = admin_write_settings($data);
    if (!empty($adminroot->errors)) {
        $errormsg = get_string('errorwithsettings', 'admin');
        $firsterror = reset($adminroot->errors);
        $focus = $firsterror->id;
    } else {
+        // No errors. Did we change any setting? If so, then redirect with success.
+        if ($count) {
+            redirect($PAGE->url, get_string('changessaved'), null, \core\output\notification::NOTIFY_SUCCESS);
+        }
        redirect($PAGE->url);
    }
 }
@@ -55,7 +64,7 @@ if ($errormsg !== '') {

 $showsettingslinks = true;

-if (has_capability('moodle/site:config', $context)) {
+if ($hassiteconfig) {
    require_once("admin_settings_search_form.php");
    $form = new admin_settings_search_form();
    $form->display();
@@ -39,11 +39,15 @@ $statusmsg = '';
 $errormsg  = '';

 if ($data = data_submitted() and confirm_sesskey()) {
-    if (admin_write_settings($data)) {
-        redirect($PAGE->url, get_string('changessaved'), null, \core\output\notification::NOTIFY_SUCCESS);
-    }

+    $count = admin_write_settings($data);
+    // Regardless of whether any setting change was written (a positive count), check validation errors for those that didn't.
    if (empty($adminroot->errors)) {
+        // No errors. Did we change any setting? If so, then redirect with success.
+        if ($count) {
+            redirect($PAGE->url, get_string('changessaved'), null, \core\output\notification::NOTIFY_SUCCESS);
+        }
+        // We didn't change a setting.
        switch ($return) {
            case 'site': redirect("$CFG->wwwroot/");
            case 'admin': redirect("$CFG->wwwroot/$CFG->admin/");
@@ -398,7 +398,7 @@ function print_combined_install_output($processes) {
    // Show process name in first row.
    foreach ($processes as $name => $process) {
        // If we don't have enough space to show full run name then show runX.
-        if ($lengthofprocessline < strlen($name + 2)) {
+        if ($lengthofprocessline < strlen($name) + 2) {
            $name = substr($name, -5);
        }
        // One extra padding as we are adding | separator for rest of the data.
@@ -64,6 +64,7 @@
                                <li>
                                    <a href="#">{{#str}}edit{{/str}}</a><b class="caret"></b>
                                    <ul class="dropdown dropdown-menu">
+                                    {{#canmanage}}
                                    <li class="dropdown-item">
                                        <a href="#" data-action="edit">
                                            {{#pix}}t/edit{{/pix}} {{#str}}edit{{/str}}
@@ -89,11 +90,13 @@
                                            {{#pix}}t/down{{/pix}} {{#str}}movedown{{/str}}
                                        </a>
                                    </li>
+                                    {{/canmanage}}
                                    <li class="dropdown-item">
                                        <a href="#" data-action="linkedcourses">
                                            {{#pix}}t/viewdetails{{/pix}} {{#str}}linkedcourses, tool_lp{{/str}}
                                        </a>
                                    </li>
+                                    {{#canmanage}}
                                    <li class="dropdown-item">
                                        <a href="#" data-action="relatedcompetencies">
                                            {{#pix}}t/add{{/pix}} {{#str}}addcrossreferencedcompetency, tool_lp{{/str}}
@@ -104,6 +107,7 @@
                                            {{#pix}}t/edit{{/pix}} {{#str}}competencyrule, tool_lp{{/str}}
                                        </a>
                                    </li>
+                                    {{/canmanage}}
                                </ul>
                            </li>
                        </ul>
@@ -112,11 +116,11 @@
                <p data-region="competencyinfo">
                    {{#str}}nocompetencyselected, tool_lp{{/str}}
                </p>
-                {{#canmanage}}
                <div data-region="competencyactions">
+                    {{#canmanage}}
                    <button class="btn btn-secondary" data-action="add">{{#pix}}t/add{{/pix}} <span data-region="term"></span></button>
+                    {{/canmanage}}
                </div>
-                {{/canmanage}}
            </div>
        </div>
    </div>
@@ -128,7 +128,7 @@ class api {
            'rememberusername' => $CFG->rememberusername,
            'authloginviaemail' => $CFG->authloginviaemail,
            'registerauth' => $CFG->registerauth,
-            'forgottenpasswordurl' => $CFG->forgottenpasswordurl,
+            'forgottenpasswordurl' => clean_param($CFG->forgottenpasswordurl, PARAM_URL), // We may expect a mailto: here.
            'authinstructions' => $authinstructions,
            'authnoneenabled' => (int) is_enabled_auth('none'),
            'enablewebservices' => $CFG->enablewebservices,
@@ -152,10 +152,11 @@ class api {
        $url = new moodle_url("/$CFG->admin/tool/mobile/launch.php");
        $settings['launchurl'] = $url->out(false);

-        if ($logourl = $OUTPUT->get_logo_url()) {
+        // Check that we are receiving a moodle_url object, themes can override get_logo_url and may return incorrect values.
+        if (($logourl = $OUTPUT->get_logo_url()) && $logourl instanceof moodle_url) {
            $settings['logourl'] = $logourl->out(false);
        }
-        if ($compactlogourl = $OUTPUT->get_compact_logo_url()) {
+        if (($compactlogourl = $OUTPUT->get_compact_logo_url()) && $compactlogourl instanceof moodle_url) {
            $settings['compactlogourl'] = $compactlogourl->out(false);
        }

@@ -210,12 +211,17 @@ class api {
        }

        if (empty($section) or $section == 'sitepolicies') {
+            $settings->sitepolicy = $CFG->sitepolicy;
            $settings->disableuserimages = $CFG->disableuserimages;
        }

        if (empty($section) or $section == 'gradessettings') {
            require_once($CFG->dirroot . '/user/lib.php');
-            $settings->mygradesurl = user_mygrades_url()->out(false);
+            $settings->mygradesurl = user_mygrades_url();
+            // The previous function may return moodle_url instances or plain string URLs.
+            if ($settings->mygradesurl instanceof moodle_url) {
+                $settings->mygradesurl = $settings->mygradesurl->out(false);
+            }
        }

        if (empty($section) or $section == 'mobileapp') {
@@ -23,6 +23,7 @@
 */

 namespace tool_mobile;
+defined('MOODLE_INTERNAL') || die();

 require_once("$CFG->libdir/externallib.php");

@@ -24,7 +24,7 @@

 $string['androidappid'] = 'Android app\'s unique identifier';
 $string['androidappid_desc'] = 'This setting may be left as default unless you have a custom Android app.';
-$string['autologinkeygenerationlockout'] = 'Auto-login key generation is blocked because of too many requests within an hour.';
+$string['autologinkeygenerationlockout'] = 'Auto-login key generation is blocked. You need to wait 6 minutes between requests.';
 $string['autologinnotallowedtoadmins'] = 'Auto-login is not allowed for site admins.';
 $string['cachedef_plugininfo'] = 'This stores the list of plugins with mobile addons';
 $string['clickheretolaunchtheapp'] = 'Click here if the app does not open automatically.';
@@ -97,11 +97,13 @@ class tool_mobile_external_testcase extends externallib_advanced_testcase {
        set_config('typeoflogin', api::LOGIN_VIA_BROWSER, 'tool_mobile');
        set_config('logo', 'mock.png', 'core_admin');
        set_config('logocompact', 'mock.png', 'core_admin');
+        set_config('forgottenpasswordurl', 'mailto:fake@email.zy'); // Test old hack.

        list($authinstructions, $notusedformat) = external_format_text($authinstructions, FORMAT_MOODLE, $context->id);
        $expected['registerauth'] = 'email';
        $expected['authinstructions'] = $authinstructions;
        $expected['typeoflogin'] = api::LOGIN_VIA_BROWSER;
+        $expected['forgottenpasswordurl'] = ''; // Expect empty when it's not an URL.

        if ($logourl = $OUTPUT->get_logo_url()) {
            $expected['logourl'] = $logourl->out(false);
@@ -123,6 +125,10 @@ class tool_mobile_external_testcase extends externallib_advanced_testcase {
        require_once($CFG->dirroot . '/course/format/lib.php');

        $this->resetAfterTest(true);
+
+        $mysitepolicy = 'http://mysite.is/policy/';
+        set_config('sitepolicy', $mysitepolicy);
+
        $result = external::get_config();
        $result = external_api::clean_returnvalue(external::get_config_returns(), $result);

@@ -143,6 +149,7 @@ class tool_mobile_external_testcase extends externallib_advanced_testcase {
            array('name' => 'numsections', 'value' => course_get_format($SITE)->get_last_section_number()),
            array('name' => 'newsitems', 'value' => $SITE->newsitems),
            array('name' => 'commentsperpage', 'value' => $CFG->commentsperpage),
+            array('name' => 'sitepolicy', 'value' => $mysitepolicy),
            array('name' => 'disableuserimages', 'value' => $CFG->disableuserimages),
            array('name' => 'mygradesurl', 'value' => user_mygrades_url()->out(false)),
            array('name' => 'tool_mobile_forcelogout', 'value' => 0),
@@ -78,6 +78,10 @@ class issuer extends persistent {
        $mform->addRule('clientsecret', get_string('maximumchars', '', 255), 'maxlength', 255, 'client');
        $mform->addHelpButton('clientsecret', 'issuerclientsecret', 'tool_oauth2');

+        // Use basic authentication.
+        $mform->addElement('checkbox', 'basicauth', get_string('usebasicauth', 'tool_oauth2'));
+        $mform->addHelpButton('basicauth', 'usebasicauth', 'tool_oauth2');
+
        // Login scopes.
        $mform->addElement('text', 'loginscopes', get_string('issuerloginscopes', 'tool_oauth2'));
        $mform->addRule('loginscopes', null, 'required', null, 'client');
@@ -93,6 +93,8 @@ $string['systemaccountconnected_help'] = 'System accounts are used to provide ad
 $string['systemaccountconnected'] = 'System account connected';
 $string['systemaccountnotconnected'] = 'System account not connected';
 $string['systemauthstatus'] = 'System account connected';
+$string['usebasicauth'] = 'Authenticate token requests via HTTP headers';
+$string['usebasicauth_help'] = 'Utilise the HTTP Basic authentication scheme when sending client ID and password with a refresh token request. Recommended by the OAuth 2 standard, but may not be available with some issuers.';
 $string['userfieldexternalfield'] = 'External field name';
 $string['userfieldexternalfield_help'] = 'Name of the field provided by the external OAuth system.';
 $string['userfieldinternalfield_help'] = 'Name of the Moodle user field that should be mapped from the external field.';
@@ -9,6 +9,7 @@ Feature: Basic recycle bin functionality
      | username | firstname | lastname | email |
      | teacher1 | Teacher | 1 | teacher@asd.com |
      | student1 | Student | 1 | student@asd.com |
+      | student2 | Student | 2 | student2@asd.com |
    And the following "courses" exist:
      | fullname | shortname |
      | Course 1 | C1 |
@@ -16,6 +17,23 @@ Feature: Basic recycle bin functionality
    And the following "course enrolments" exist:
      | user | course | role |
      | teacher1 | C1 | editingteacher |
+      | student1 | C1 | student |
+      | student2 | C1 | student |
+      | teacher1 | C2 | editingteacher |
+      | student1 | C2 | student |
+      | student2 | C2 | student |
+    And the following "groups" exist:
+      | name | course | idnumber |
+      | Group A | C2 | G1 |
+      | Group B | C2 | G2 |
+      | Group C | C2 | G3 |
+    And the following "group members" exist:
+      | user | group |
+      | teacher1 | G1 |
+      | teacher1 | G2 |
+      | student1 | G1 |
+      | student2 | G1 |
+      | student2 | G2 |
    And the following config values are set as admin:
      | coursebinenable | 1 | tool_recyclebin |
      | categorybinenable | 1 | tool_recyclebin |
@@ -58,6 +76,12 @@ Feature: Basic recycle bin functionality
    And I wait to be redirected
    And I go to the courses management page
    And I should see "Course 2" in the "#course-listing" "css_element"
+    And I am on "Course 2" course homepage
+    And I navigate to "Groups" node in "Course administration > Users"
+    And I follow "Overview"
+    And "Student 1" "text" should exist in the "Group A" "table_row"
+    And "Student 2" "text" should exist in the "Group A" "table_row"
+    And "Student 2" "text" should exist in the "Group B" "table_row"

  @javascript
  Scenario: Deleting a single item from the recycle bin
@@ -22,6 +22,7 @@
 * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
 */
 namespace tool_templatelibrary;
+defined('MOODLE_INTERNAL') || die();

 require_once("$CFG->libdir/externallib.php");

@@ -358,7 +358,7 @@ if ($formdata = $mform2->is_cancelled()) {

        // add default values for remaining fields
        $formdefaults = array();
-        if ($updatetype != UU_UPDATE_FILEOVERRIDE && $updatetype != UU_UPDATE_NOCHANGES) {
+        if (!$existinguser || ($updatetype != UU_UPDATE_FILEOVERRIDE && $updatetype != UU_UPDATE_NOCHANGES)) {
            foreach ($STD_FIELDS as $field) {
                if (isset($user->$field)) {
                    continue;
@@ -38,6 +38,31 @@ Feature: Upload users
    And I set the field "groups" to "Section 1 (1)"
    And the "members" select box should contain "Tom Jones"

+  @javascript
+  Scenario: Upload users enrolling them on courses and groups applying defaults
+    Given the following "courses" exist:
+      | fullname | shortname | category |
+      | Maths | math102 | 0 |
+    And the following "groups" exist:
+      | name | course | idnumber |
+      | Section 1 | math102 | S1 |
+      | Section 3 | math102 | S3 |
+    And I log in as "admin"
+    And I navigate to "Upload users" node in "Site administration > Users > Accounts"
+    When I upload "lib/tests/fixtures/upload_users.csv" file to "File" filemanager
+    And I press "Upload users"
+    And I set the following fields to these values:
+      | City/town  | Brighton   |
+      | Department | Purchasing |
+    And I press "Upload users"
+    And I press "Continue"
+    And I navigate to "Users > Accounts > Browse list of users" in site administration
+    And I should see "Tom Jones"
+    And I follow "Tom Jones"
+    And I follow "Edit profile"
+    And the field "City/town" matches value "Brighton"
+    And the field "Department" matches value "Purchasing"
+
  @javascript
  Scenario: Upload users with custom profile fields
    # Create user profile field.
@@ -619,26 +619,43 @@ Tour.prototype.addEventHandler = function (eventName, handler) {
 */
 Tour.prototype.processStepListeners = function (stepConfig) {
    this.listeners.push(
-    // Next/Previous buttons.
-    {
-        node: this.currentStepNode,
-        args: ['click', '[data-role="next"]', $.proxy(this.next, this)]
-    }, {
-        node: this.currentStepNode,
-        args: ['click', '[data-role="previous"]', $.proxy(this.previous, this)]
-    },
+        // Next/Previous buttons.
+        {
+            node: this.currentStepNode,
+            args: ['click', '[data-role="next"]', $.proxy(this.next, this)]
+        }, {
+            node: this.currentStepNode,
+            args: ['click', '[data-role="previous"]', $.proxy(this.previous, this)]
+        },

-    // Close and end tour buttons.
-    {
-        node: this.currentStepNode,
-        args: ['click', '[data-role="end"]', $.proxy(this.endTour, this)]
-    },
+        // Close and end tour buttons.
+        {
+            node: this.currentStepNode,
+            args: ['click', '[data-role="end"]', $.proxy(this.endTour, this)]
+        },

-    // Keypresses.
-    {
-        node: $('body'),
-        args: ['keydown', $.proxy(this.handleKeyDown, this)]
-    });
+        // Click backdrop and hide tour.
+        {
+            node: $('[data-flexitour="backdrop"]'),
+            args: ['click', $.proxy(this.hide, this)]
+        },
+
+        // Click out and hide tour without backdrop.
+        {
+            node: $('body'),
+            args: ['click', $.proxy(function (e) {
+                // Handle click in or click out tour content,
+                // if click out, hide tour.
+                if (!this.currentStepNode.is(e.target) && $(e.target).closest('[data-role="flexitour-step"]').length === 0) {
+                    this.hide();
+                }}, this)]
+        },
+
+        // Keypresses.
+        {
+            node: $('body'),
+            args: ['keydown', $.proxy(this.handleKeyDown, this)]
+        });

    if (stepConfig.moveOnClick) {
        var targetNode = this.getStepTarget(stepConfig);
@@ -904,7 +921,7 @@ Tour.prototype.announceStep = function (stepConfig) {
 * @param   {EventFacade} e
 */
 Tour.prototype.handleKeyDown = function (e) {
-    var tabbableSelector = 'a[href], link[href], [draggable=true], [contenteditable=true], :input:enabled, [tabindex], button';
+    var tabbableSelector = 'a[href], link[href], [draggable=true], [contenteditable=true], :input:enabled, [tabindex], button:enabled';
    switch (e.keyCode) {
        case 27:
            this.endTour();
@@ -923,8 +940,17 @@ Tour.prototype.handleKeyDown = function (e) {
                var activeElement = $(document.activeElement);
                var stepTarget = this.getStepTarget(this.currentStepConfig);
                var tabbableNodes = $(tabbableSelector);
+                var dialogContainer = $('span[data-flexitour="container"]');
                var currentIndex = void 0;
-                tabbableNodes.filter(function (index, element) {
+                // Filter out element which is not belong to target section or dialogue.
+                if (stepTarget) {
+                    tabbableNodes = tabbableNodes.filter(function (index, element) {
+                        return stepTarget != null && (stepTarget.has(element).length || dialogContainer.has(element).length || stepTarget.is(element) || dialogContainer.is(element));
+                    });
+                }
+
+                // Find index of focusing element.
+                tabbableNodes.each(function (index, element) {
                    if (activeElement.is(element)) {
                        currentIndex = index;
                        return false;
@@ -934,7 +960,7 @@ Tour.prototype.handleKeyDown = function (e) {
                var nextIndex = void 0;
                var nextNode = void 0;
                var focusRelevant = void 0;
-                if (currentIndex) {
+                if (currentIndex != void 0) {
                    var direction = 1;
                    if (e.shiftKey) {
                        direction = -1;
@@ -1090,6 +1116,16 @@ Tour.prototype.hide = function (transition) {
        $(this).remove();
    });

+    // Remove aria-describedby and tabindex attributes.
+    if (this.currentStepNode && this.currentStepNode.length) {
+        var stepId = this.currentStepNode.attr('id');
+        if (stepId) {
+            var currentStepElement = '[aria-describedby="' + stepId + '-body"]';
+            $(currentStepElement).removeAttr('tabindex');
+            $(currentStepElement).removeAttr('aria-describedby');
+        }
+    }
+
    // Reset the listeners.
    this.resetStepListeners();

@@ -57,3 +57,23 @@ Feature: Apply tour filters to a tour
    And I log in as "teacher1"
    And I am on "Course 1" course homepage
    And I should see "Welcome to your course tour."
+
+  @javascript
+  Scenario: Aria tags should not exist
+    Given I log in as "admin"
+    And I open the User tour settings page
+    # Turn on default tour for boost theme.
+    And I click on "Enable" "link" in the "Boost - administrator" "table_row"
+    And I am on site homepage
+    When I click on "Next" "button"
+    Then "button[aria-describedby^='tour-step-tool_usertours']" "css_element" should exist
+    And "button[tabindex]" "css_element" should exist
+    When I click on "Next" "button"
+    Then "button[aria-describedby^='tour-step-tool_usertours']" "css_element" should not exist
+    And "button[tabindex]" "css_element" should not exist
+    When I click on "Previous" "button"
+    Then "button[aria-describedby^='tour-step-tool_usertours']" "css_element" should exist
+    And "button[tabindex]" "css_element" should exist
+    When I click on "End tour" "button"
+    Then "button[aria-describedby^='tour-step-tool_usertours']" "css_element" should not exist
+    And "button[tabindex]" "css_element" should not exist
@@ -4,7 +4,7 @@
    <location>amd/src/tour.js</location>
    <name>Flexitour</name>
    <license>GPLv3</license>
-    <version>0.10.0</version>
+    <version>0.12.0</version>
    <licenseversion>3</licenseversion>
  </library>
  <library>
@@ -262,11 +262,17 @@
                $users[$key]->country = $countries[$user->country];
            }
        }
-        if ($sort == "country") {  // Need to resort by full country name, not code
+        if ($sort == "country") {
+            // Need to resort by full country name, not code.
            foreach ($users as $user) {
                $susers[$user->id] = $user->country;
            }
-            asort($susers);
+            // Sort by country name, according to $dir.
+            if ($dir === 'DESC') {
+                arsort($susers);
+            } else {
+                asort($susers);
+            }
            foreach ($susers as $key => $value) {
                $nusers[] = $users[$key];
            }
@@ -45,7 +45,7 @@ $string['auth_dbname'] = 'Name of the database itself. Leave empty if using an O
 $string['auth_dbname_key'] = 'DB name';
 $string['auth_dbpass'] = 'Password matching the above username';
 $string['auth_dbpass_key'] = 'Password';
-$string['auth_dbpasstype'] = '<p>Specify the format that the password field is using. MD5 hashing is useful for connecting to other common web applications like PostNuke.</p> <p>Use \'internal\' if you want the external database to manage usernames and email addresses, but Moodle to manage passwords. If you use \'internal\', you <i>must</i> provide a populated email address field in the external database, and you must execute both admin/cron.php and auth/db/cli/sync_users.php regularly. Moodle will send an email to new users with a temporary password.</p>';
+$string['auth_dbpasstype'] = '<p>Specify the format that the password field is using.</p> <p>Use \'internal\' if you want the external database to manage usernames and email addresses, but Moodle to manage passwords. If you use \'internal\', you <i>must</i> provide a populated email address field in the external database, and you must execute both admin/cron.php and auth/db/cli/sync_users.php regularly. Moodle will send an email to new users with a temporary password.</p>';
 $string['auth_dbpasstype_key'] = 'Password format';
 $string['auth_dbreviveduser'] = 'Revived user {$a->name} id {$a->id}';
 $string['auth_dbrevivedusererror'] = 'Error reviving user {$a}';
@@ -137,7 +137,7 @@ class auth_email_external extends external_api {
                     new external_value(PARAM_NOTAGS, 'The order of the name fields')
                ),
                'passwordpolicy' => new external_value(PARAM_RAW, 'Password policy', VALUE_OPTIONAL),
-                'sitepolicy' => new external_value(PARAM_URL, 'Site policy url', VALUE_OPTIONAL),
+                'sitepolicy' => new external_value(PARAM_RAW, 'Site policy', VALUE_OPTIONAL),
                'defaultcity' => new external_value(PARAM_NOTAGS, 'Default city', VALUE_OPTIONAL),
                'country' => new external_value(PARAM_ALPHA, 'Default country', VALUE_OPTIONAL),
                'profilefields' => new external_multiple_structure(
@@ -836,23 +836,7 @@ class auth_plugin_ldap extends auth_plugin_base {
 /// User Updates - time-consuming (optional)
        if ($do_updates) {
            // Narrow down what fields we need to update
-            $all_keys = array_keys(get_object_vars($this->config));
-            $updatekeys = array();
-            foreach ($all_keys as $key) {
-                if (preg_match('/^field_updatelocal_(.+)$/', $key, $match)) {
-                    // If we have a field to update it from
-                    // and it must be updated 'onlogin' we
-                    // update it on cron
-                    if (!empty($this->config->{'field_map_'.$match[1]})
-                         and $this->config->{$match[0]} === 'onlogin') {
-                        array_push($updatekeys, $match[1]); // the actual key name
-                    }
-                }
-            }
-            if ($this->config->suspended_attribute && $this->config->sync_suspended) {
-                $updatekeys[] = 'suspended';
-            }
-            unset($all_keys); unset($key);
+            $updatekeys = $this->get_profile_keys();

        } else {
            print_string('noupdatestobedone', 'auth_ldap');
@@ -960,6 +944,9 @@ class auth_plugin_ldap extends auth_plugin_base {
                    role_assign($creatorrole->id, $id, $sitecontext->id, $this->roleauth);
                }

+                // Save custom profile fields.
+                $updatekeys = $this->get_profile_keys(true);
+                $this->update_user_record($user->username, $updatekeys, false);
            }
            $transaction->allow_commit();
            unset($add_users); // free mem
@@ -990,6 +977,8 @@ class auth_plugin_ldap extends auth_plugin_base {
    function update_user_record($username, $updatekeys = false, $triggerevent = false) {
        global $CFG, $DB;

+        require_once($CFG->dirroot.'/user/profile/lib.php');
+
        // Just in case check text case
        $username = trim(core_text::strtolower($username));

@@ -1004,6 +993,8 @@ class auth_plugin_ldap extends auth_plugin_base {
        // Protect the userid from being overwritten
        $userid = $user->id;

+        $needsupdate = false;
+
        if ($newinfo = $this->get_userinfo($username)) {
            $newinfo = truncate_userinfo($newinfo);

@@ -1016,6 +1007,9 @@ class auth_plugin_ldap extends auth_plugin_base {
                $newuser->id = $userid;
                // The cast to int is a workaround for MDL-53959.
                $newuser->suspended = (int)$this->is_user_suspended((object) $newinfo);
+                // Get all custom fields.
+                $profilefields = (array) profile_user_record($user->id, false);
+                $newprofilefields = [];

                foreach ($updatekeys as $key) {
                    if (isset($newinfo[$key])) {
@@ -1025,18 +1019,50 @@ class auth_plugin_ldap extends auth_plugin_base {
                    }

                    if (!empty($this->config->{'field_updatelocal_' . $key})) {
-                        // Only update if it's changed.
-                        if ($user->{$key} != $value) {
+                        if (preg_match('/^profile_field_(.*)$/', $key, $match)) {
+                            // Custom field.
+                            $field = $match[1];
+                            $currentvalue = isset($profilefields[$field]) ? $profilefields[$field] : null;
+                            $newprofilefields[$field] = $value;
+                        } else {
+                            // Standard field.
+                            $currentvalue = isset($user->$key) ? $user->$key : null;
                            $newuser->$key = $value;
                        }
                    }
+
+                    // Only update if it's changed.
+                    if ($currentvalue !== $value) {
+                        $needsupdate = true;
+                    }
                }
-                user_update_user($newuser, false, $triggerevent);
            }
-        } else {
-            return false;
+
+            if ($needsupdate) {
+                user_update_user($newuser, false, $triggerevent);
+
+                // Now, save the profile fields if the user has any.
+                if ($fields = $DB->get_records('user_info_field')) {
+                    foreach ($fields as $field) {
+                        if (isset($newprofilefields[$field->shortname])) {
+                            $conditions = array('fieldid' => $field->id, 'userid' => $newuser->id);
+                            $id = $DB->get_field('user_info_data', 'id', $conditions);
+                            $data = $newprofilefields[$field->shortname];
+                            if ($id) {
+                                $DB->set_field('user_info_data', 'data', $data, array('id' => $id));
+                            } else {
+                                $record = array('fieldid' => $field->id, 'userid' => $newuser->id, 'data' => $data);
+                                $DB->insert_record('user_info_data', $record);
+                            }
+                        }
+                    }
+                }
+
+                return $DB->get_record('user', array('id' => $userid, 'deleted' => 0));
+            }
        }
-        return $DB->get_record('user', array('id'=>$userid, 'deleted'=>0));
+
+        return false;
    }

    /**
@@ -1186,6 +1212,14 @@ class auth_plugin_ldap extends auth_plugin_base {
            return false;
        }

+        // Load old custom fields.
+        $olduserprofilefields = (array) profile_user_record($olduser->id, false);
+
+        $fields = array();
+        foreach (profile_get_custom_fields(false) as $field) {
+            $fields[$field->shortname] = $field;
+        }
+
        $success = true;
        $user_info_result = ldap_read($ldapconnection, $user_dn, '(objectClass=*)', $search_attribs);
        if ($user_info_result) {
@@ -1204,19 +1238,24 @@ class auth_plugin_ldap extends auth_plugin_base {
            $user_entry = $user_entry[0];

            foreach ($attrmap as $key => $ldapkeys) {
-                $profilefield = '';
-                // Only process if the moodle field ($key) has changed and we
-                // are set to update LDAP with it
-                $customprofilefield = 'profile_field_' . $key;
-                if (isset($olduser->$key) and isset($newuser->$key)
-                    and ($olduser->$key !== $newuser->$key)) {
-                    $profilefield = $key;
-                } else if (isset($olduser->$customprofilefield) && isset($newuser->$customprofilefield)
-                    && $olduser->$customprofilefield !== $newuser->$customprofilefield) {
-                    $profilefield = $customprofilefield;
+                if (preg_match('/^profile_field_(.*)$/', $key, $match)) {
+                    // Custom field.
+                    $fieldname = $match[1];
+                    if (isset($fields[$fieldname])) {
+                        $class = 'profile_field_' . $fields[$fieldname]->datatype;
+                        $formfield = new $class($fields[$fieldname]->id, $olduser->id);
+                        $oldvalue = isset($olduserprofilefields[$fieldname]) ? $olduserprofilefields[$fieldname] : null;
+                    } else {
+                        $oldvalue = null;
+                    }
+                    $newvalue = $formfield->edit_save_data_preprocess($newuser->{$formfield->inputname}, new stdClass);
+                } else {
+                    // Standard field.
+                    $oldvalue = isset($olduser->$key) ? $olduser->$key : null;
+                    $newvalue = isset($newuser->$key) ? $newuser->$key : null;
                }

-                if (!empty($profilefield) && !empty($this->config->{'field_updateremote_' . $key})) {
+                if ($newvalue !== null and $newvalue !== $oldvalue and !empty($this->config->{'field_updateremote_' . $key})) {
                    // For ldap values that could be in more than one
                    // ldap key, we will do our best to match
                    // where they came from
@@ -1229,9 +1268,9 @@ class auth_plugin_ldap extends auth_plugin_base {
                        $ambiguous = false;
                    }

-                    $nuvalue = core_text::convert($newuser->$profilefield, 'utf-8', $this->config->ldapencoding);
+                    $nuvalue = core_text::convert($newvalue, 'utf-8', $this->config->ldapencoding);
                    empty($nuvalue) ? $nuvalue = array() : $nuvalue;
-                    $ouvalue = core_text::convert($olduser->$profilefield, 'utf-8', $this->config->ldapencoding);
+                    $ouvalue = core_text::convert($oldvalue, 'utf-8', $this->config->ldapencoding);

                    foreach ($ldapkeys as $ldapkey) {
                        $ldapkey   = $ldapkey;
@@ -2151,4 +2190,30 @@ class auth_plugin_ldap extends auth_plugin_base {
            echo $OUTPUT->notification(get_string('ldapnotconfigured', 'auth_ldap'), \core\output\notification::NOTIFY_INFO);
        }
    }
+
+    /**
+     * Get the list of profile fields.
+     *
+     * @param   bool    $fetchall   Fetch all, not just those for update.
+     * @return  array
+     */
+    protected function get_profile_keys($fetchall = false) {
+        $keys = array_keys(get_object_vars($this->config));
+        $updatekeys = [];
+        foreach ($keys as $key) {
+            if (preg_match('/^field_updatelocal_(.+)$/', $key, $match)) {
+                // If we have a field to update it from and it must be updated 'onlogin' we update it on cron.
+                if (!empty($this->config->{'field_map_'.$match[1]})) {
+                    if ($fetchall || $this->config->{$match[0]} === 'onlogin') {
+                        array_push($updatekeys, $match[1]); // the actual key name
+                    }
+                }
+            }
+        }
+        if ($this->config->suspended_attribute && $this->config->sync_suspended) {
+            $updatekeys[] = 'suspended';
+        }
+
+        return $updatekeys;
+    }
 } // End of the class
@@ -43,12 +43,12 @@ $string['auth_ldapdescription'] = 'This method provides authentication against a
                                  entry in its database. This module can read user attributes from LDAP and prefill
                                  wanted fields in Moodle.  For following logins only the username and
                                  password are checked.';
-$string['auth_ldap_expiration_desc'] = 'Select No to disable expired password checking or LDAP to read passwordexpiration time directly from LDAP';
-$string['auth_ldap_expiration_key'] = 'Expiration';
-$string['auth_ldap_expiration_warning_desc'] = 'Number of days before password expiration warning is issued.';
-$string['auth_ldap_expiration_warning_key'] = 'Expiration warning';
-$string['auth_ldap_expireattr_desc'] = 'Optional: Overrides the LDAP attribute that stores password expiration time.';
-$string['auth_ldap_expireattr_key'] = 'Expiration attribute';
+$string['auth_ldap_expiration_desc'] = 'Select \'{$a->no}\' to disable expired password checking or \'{$a->ldapserver}\' to read the password expiry time directly from the LDAP server.';
+$string['auth_ldap_expiration_key'] = 'Expiry';
+$string['auth_ldap_expiration_warning_desc'] = 'Number of days before password expiry warning is issued.';
+$string['auth_ldap_expiration_warning_key'] = 'Expiry warning';
+$string['auth_ldap_expireattr_desc'] = 'Optional: Overrides the LDAP attribute that stores password expiry time.';
+$string['auth_ldap_expireattr_key'] = 'Expiry attribute';
 $string['auth_ldapextrafields'] = 'These fields are optional.  You can choose to pre-fill some Moodle user fields with information from the <b>LDAP fields</b> that you specify here. <p>If you leave these fields blank, then nothing will be transferred from LDAP and Moodle defaults will be used instead.</p><p>In either case, the user will be able to edit all of these fields after they log in.</p>';
 $string['auth_ldap_graceattr_desc'] = 'Optional: Overrides  gracelogin attribute';
 $string['auth_ldap_gracelogin_key'] = 'Grace login attribute';
@@ -77,7 +77,7 @@ $string['auth_ldap_opt_deref'] = 'Determines how aliases are handled during sear
 $string['auth_ldap_opt_deref_key'] = 'Dereference aliases';
 $string['auth_ldap_passtype'] = 'Specify the format of new or changed passwords in LDAP server.';
 $string['auth_ldap_passtype_key'] = 'Password format';
-$string['auth_ldap_passwdexpire_settings'] = 'LDAP password expiration settings';
+$string['auth_ldap_passwdexpire_settings'] = 'LDAP password expiry settings';
 $string['auth_ldap_preventpassindb'] = 'Select yes to prevent passwords from being stored in Moodle\'s DB.';
 $string['auth_ldap_preventpassindb_key'] = 'Prevent password caching';
 $string['auth_ldap_search_sub'] = 'Search users from subcontexts.';
@@ -91,7 +91,7 @@ $string['auth_ldap_suspended_attribute'] = 'Optional: When provided this attribu
 $string['auth_ldap_suspended_attribute_key'] = 'Suspended attribute';
 $string['auth_ldap_user_exists'] = 'LDAP username already exists.';
 $string['auth_ldap_user_settings'] = 'User lookup settings';
-$string['auth_ldap_user_type'] = 'Select how users are stored in LDAP. This setting also specifies how login expiration, grace logins and user creation will work.';
+$string['auth_ldap_user_type'] = 'Select how users are stored in LDAP. This setting also specifies how login expiry, grace logins and user creation will work.';
 $string['auth_ldap_user_type_key'] = 'User type';
 $string['auth_ldap_usertypeundefined'] = 'config.user_type not defined or function ldap_expirationtime2unix does not support selected type!';
 $string['auth_ldap_usertypeundefined2'] = 'config.user_type not defined or function ldap_unixi2expirationtime does not support selected type!';
@@ -121,7 +121,7 @@ $string['didntgetusersfromldap'] = "Did not get any users from LDAP -- error? --
 $string['gotcountrecordsfromldap'] = "Got {\$a} records from LDAP\n";
 $string['ldapnotconfigured'] = 'The LDAP host url is currently not configured';
 $string['morethanoneuser'] = 'Strange! More than one user record found in ldap. Only using the first one.';
-$string['needbcmath'] = 'You need the BCMath extension to use grace logins with Active Directory';
+$string['needbcmath'] = 'You need the BCMath extension to use expired password checking with Active Directory.';
 $string['needmbstring'] = 'You need the mbstring extension to change passwords in Active Directory';
 $string['nodnforusername'] = 'Error in user_update_password(). No DN for: {$a->username}';
 $string['noemail'] = 'Tried to send you an email but failed!';
@@ -147,7 +147,7 @@ $string['start_tls_key'] = 'Use TLS';
 $string['updateremfail'] = 'Error updating LDAP record. Error code: {$a->errno}; Error string: {$a->errstring}<br/>Key ({$a->key}) - old moodle value: \'{$a->ouvalue}\' new value: \'{$a->nuvalue}\'';
 $string['updateremfailamb'] = 'Failed to update LDAP with ambiguous field {$a->key}; old moodle value: \'{$a->ouvalue}\', new value: \'{$a->nuvalue}\'';
 $string['updatepasserror'] = 'Error in user_update_password(). Error code: {$a->errno}; Error string: {$a->errstring}';
-$string['updatepasserrorexpire'] = 'Error in user_update_password() when reading password expiration time. Error code: {$a->errno}; Error string: {$a->errstring}';
+$string['updatepasserrorexpire'] = 'Error in user_update_password() when reading password expiry time. Error code: {$a->errno}; Error string: {$a->errstring}';
 $string['updatepasserrorexpiregrace'] = 'Error in user_update_password() when modifying expirationtime and/or gracelogins. Error code: {$a->errno}; Error string: {$a->errstring}';
 $string['updateusernotfound'] = 'Could not find user while updating externally. Details follow: search base: \'{$a->userdn}\'; search filter: \'(objectClass=*)\'; search attributes: {$a->attribs}';
 $string['user_activatenotsupportusertype'] = 'auth: ldap user_activate() does not support selected usertype: {$a}';
@@ -185,12 +185,24 @@ if ($ADMIN->fulltree) {
                new lang_string('auth_ldap_passwdexpire_settings', 'auth_ldap'), ''));

        // Password Expiration.
+
+        // Create the description lang_string object.
+        $strno = get_string('no');
+        $strldapserver = get_string('pluginname', 'auth_ldap');
+        $langobject = new stdClass();
+        $langobject->no = $strno;
+        $langobject->ldapserver = $strldapserver;
+        $description = new lang_string('auth_ldap_expiration_desc', 'auth_ldap', $langobject);
+
+        // Now create the options.
        $expiration = array();
-        $expiration['0'] = 'no';
-        $expiration['1'] = 'LDAP';
+        $expiration['0'] = $strno;
+        $expiration['1'] = $strldapserver;
+
+        // Add the setting.
        $settings->add(new admin_setting_configselect('auth_ldap/expiration',
                new lang_string('auth_ldap_expiration_key', 'auth_ldap'),
-                new lang_string('auth_ldap_expiration_desc', 'auth_ldap'), 0 , $expiration));
+                $description, 0 , $expiration));

        // Password Expiration warning.
        $settings->add(new admin_setting_configtext('auth_ldap/expiration_warning',
@@ -141,6 +141,15 @@ abstract class backup implements checksumable {
     * Usually same than major release zero version, mainly for informative/historic purposes.
     */
    const RELEASE = '3.3';
+
+    /**
+     * Cipher to be used in backup and restore operations.
+     */
+    const CIPHER = 'aes-256-cbc';
+    /**
+     * Bytes enforced for key, using the cypher above. Restrictive? Yes, but better than unsafe lengths
+     */
+    const CIPHERKEYLEN = 32;
 }

 /*
@@ -112,7 +112,7 @@ class cc_forum extends entities {

    public function get_topic_data ($instance) {

-        $topic_data = '';
+        $topic_data = array();

        $topic_file = $this->get_external_xml($instance['resource_indentifier']);

@@ -68,7 +68,7 @@ class cc_quiz extends entities {
        $last_question_id = 0;
        $last_answer_id = 0;

-        $instances = '';
+        $instances = array();

        $types = array(MOODLE_TYPE_QUIZ, MOODLE_TYPE_QUESTION_BANK);

@@ -87,7 +87,7 @@ class cc11_basiclti extends entities11 {

    public function get_basiclti_data($instance) {

-        $topic_data = '';
+        $topic_data = array();

        $basiclti_file = $this->get_external_xml($instance['resource_indentifier']);

@@ -111,7 +111,7 @@ class cc11_forum extends entities11 {

    public function get_topic_data ($instance) {

-        $topic_data = '';
+        $topic_data = array();

        $topic_file = $this->get_external_xml($instance['resource_indentifier']);

@@ -82,7 +82,7 @@ class cc11_lti extends entities11 {

    public function get_basiclti_data($instance) {

-        $topic_data = '';
+        $topic_data = array();

        $basiclti_file = $this->get_external_xml($instance['resource_indentifier']);

@@ -68,7 +68,7 @@ class cc11_quiz extends entities11 {
        $last_question_id = 0;
        $last_answer_id = 0;

-        $instances = '';
+        $instances = array();

        $types = array(MOODLE_TYPE_QUIZ, MOODLE_TYPE_QUESTION_BANK);

@@ -99,7 +99,7 @@ class cc11_resource extends entities11 {
                                $link = 'http://invalidurldetected/';
                            }
                        } else {
-                            $link = $rawlink;
+                            $link = htmlspecialchars(trim($rawlink), ENT_COMPAT, 'UTF-8', false);
                        }
                    }
                }
@@ -97,6 +97,138 @@ class base64_encode_final_element extends backup_final_element {
    }
 }

+/**
+ * Implementation of {@link backup_final_element} that provides symmetric-key AES-256 encryption of contents.
+ *
+ * This final element transparently encrypts, for secure storage and transport, any content
+ * that shouldn't be shown normally in plain text. Usually, passwords or keys that cannot use
+ * hashing algorithms, although potentially can encrypt any content. All information is encoded
+ * using base64.
+ *
+ * Features:
+ *   - requires openssl extension to work. Without it contents are completely omitted.
+ *   - automatically creates an appropriate default key for the site and stores it into backup_encryptkey config (bas64 encoded).
+ *   - uses a different appropriate init vector for every operation, which is transmited with the encrypted contents.
+ *   - all generated data is base64 encoded for safe transmission.
+ *   - automatically adds "encrypted" attribute for easier detection.
+ *   - implements HMAC for providing integrity.
+ *
+ * @copyright 2017 onwards Eloy Lafuente (stronk7) {@link http://stronk7.com}
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class encrypted_final_element extends backup_final_element {
+
+    /** @var string cypher appropiate raw key for backups in the site. Defaults to backup_encryptkey config. */
+    protected $key = null;
+
+    /**
+     * Constructor - instantiates a encrypted_final_element, specifying its basic info.
+     *
+     * Overridden to automatically add the 'encrypted' attribute if missing.
+     *
+     * @param string $name name of the element
+     * @param array  $attributes attributes this element will handle (optional, defaults to null)
+     */
+    public function __construct($name, $attributes = null) {
+        parent::__construct($name, $attributes);
+        if (! $this->get_attribute('encrypted')) {
+            $this->add_attributes('encrypted');
+        }
+    }
+
+    /**
+     * Set the encryption key manually, overriding default backup_encryptkey config.
+     *
+     * @param string $key key to be used for encrypting. Required to be 256-bit key.
+     *               Use a safe generation technique. See self::generate_encryption_random_key() below.
+     */
+    protected function set_key($key) {
+        $bytes = strlen($key); // Get key length in bytes.
+
+        // Only accept keys with the expected (backup::CIPHERKEYLEN) key length. There are a number of hashing,
+        // random generators to achieve this esasily, like the one shown below to create the default
+        // site encryption key and ivs.
+        if ($bytes !== backup::CIPHERKEYLEN) {
+            $info = (object)array('expected' => backup::CIPHERKEYLEN, 'found' => $bytes);
+            throw new base_element_struct_exception('encrypted_final_element incorrect key length', $info);
+        }
+        // Everything went ok, store the key.
+        $this->key = $key;
+    }
+
+    /**
+     * Set the value of the field.
+     *
+     * This method sets the value of the element, encrypted using the specified key for it,
+     * defaulting to (and generating) backup_encryptkey config. HMAC is used for integrity.
+     *
+     * @param string $value plain-text content the will be stored encrypted and encoded.
+     */
+    public function set_value($value) {
+
+        // No openssl available, skip this field completely.
+        if (!function_exists('openssl_encrypt')) {
+            return;
+        }
+
+        // No hmac available, skip this field completely.
+        if (!function_exists('hash_hmac')) {
+            return;
+        }
+
+        // Cypher not available, skip this field completely.
+        if (!in_array(backup::CIPHER, openssl_get_cipher_methods())) {
+            return;
+        }
+
+        // Ensure we have a good key, manual or default.
+        if (empty($this->key)) {
+            // The key has not been set manually, look for it at config (base64 encoded there).
+            $enckey = get_config('backup', 'backup_encryptkey');
+            if ($enckey === false) {
+                // Has not been set, calculate and save an appropiate random key automatically.
+                $enckey = base64_encode(self::generate_encryption_random_key(backup::CIPHERKEYLEN));
+                set_config('backup_encryptkey', $enckey, 'backup');
+            }
+            $this->set_key(base64_decode($enckey));
+        }
+
+        // Now we need an iv for this operation.
+        $iv = self::generate_encryption_random_key(openssl_cipher_iv_length(backup::CIPHER));
+
+        // Everything is ready, let's encrypt and prepend the 1-shot iv.
+        $value = $iv . openssl_encrypt($value, backup::CIPHER, $this->key, OPENSSL_RAW_DATA, $iv);
+
+        // Calculate the hmac of the value (iv + encrypted) and prepend it.
+        $hmac = hash_hmac('sha256', $value, $this->key, true);
+        $value = $hmac . $value;
+
+        // Ready, set the encoded value.
+        parent::set_value(base64_encode($value));
+
+        // Finally, if the field has an "encrypted" attribute, set it to true.
+        if ($att = $this->get_attribute('encrypted')) {
+            $att->set_value('true');
+        }
+    }
+
+    /**
+     * Generate an appropiate random key to be used for encrypting backup information.
+     *
+     * Normally used as site default encryption key (backup_encryptkey config) and also
+     * for calculating the init vectors.
+     *
+     * Note that until PHP 5.6.12 openssl_random_pseudo_bytes() did NOT
+     * use a "cryptographically strong algorithm" {@link https://bugs.php.net/bug.php?id=70014}
+     * But it's beyond my crypto-knowledge when it's worth finding a *real* better alternative.
+     *
+     * @param int $bytes Number of bytes to determine the key length expected.
+     */
+    protected static function generate_encryption_random_key($bytes) {
+        return openssl_random_pseudo_bytes($bytes);
+    }
+}
+
 /**
 * Implementation of backup_nested_element that provides special handling of files
 *
@@ -529,7 +529,7 @@ class backup_enrolments_structure_step extends backup_structure_step {
        $enrol->annotate_ids('role', 'roleid');

        // Add enrol plugin structure.
-        $this->add_plugin_structure('enrol', $enrol, false);
+        $this->add_plugin_structure('enrol', $enrol, true);

        return $enrolments;
    }
@@ -0,0 +1,116 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Tests for the handling of encrypted contents in backup and restore.
+ *
+ * @package core_backup
+ * @copyright 2016 onwards Eloy Lafuente (stronk7) {@link http://stronk7.com}
+ * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+global $CFG;
+require_once($CFG->dirroot . '/backup/util/includes/backup_includes.php');
+require_once($CFG->dirroot . '/backup/util/includes/restore_includes.php');
+require_once($CFG->dirroot . '/backup/moodle2/backup_custom_fields.php');
+
+class core_backup_encrypted_content_testscase extends advanced_testcase {
+
+    public function setUp() {
+        if (!function_exists('openssl_encrypt')) {
+            $this->markTestSkipped('OpenSSL extension is not loaded.');
+
+        } else if (!function_exists('hash_hmac')) {
+            $this->markTestSkipped('Hash extension is not loaded.');
+
+        } else if (!in_array(backup::CIPHER, openssl_get_cipher_methods())) {
+            $this->markTestSkipped('Expected cipher not available: ' . backup::CIPHER);
+        }
+    }
+
+    public function test_encrypted_final_element() {
+
+        $this->resetAfterTest(true);
+
+        // Some basic verifications.
+        $efe = new encrypted_final_element('test', array('encrypted'));
+        $this->assertInstanceOf('encrypted_final_element', $efe);
+        $this->assertSame('test', $efe->get_name());
+        $atts = $efe->get_attributes();
+        $this->assertCount(1, $atts);
+        $att = reset($atts);
+        $this->assertInstanceOf('backup_attribute', $att);
+        $this->assertSame('encrypted', $att->get_name());
+
+        // Using a manually defined (incorrect length) key.
+        $efe = new encrypted_final_element('test', array('encrypted'));
+        $key = 'this_in_not_correct_32_byte_key';
+        try {
+            set_config('backup_encryptkey', base64_encode($key), 'backup');
+            $efe->set_value('tiny_secret');
+            $this->fail('Expecting base_element_struct_exception exception, none happened');
+        } catch (exception $e) {
+            $this->assertInstanceOf('base_element_struct_exception', $e);
+            $this->assertEquals('encrypted_final_element incorrect key length', $e->errorcode);
+
+        }
+
+        // Using a manually defined (correct length) key.
+        $efe = new encrypted_final_element('test', array('testattr', 'encrypted'));
+        $key = hash('md5', 'Moodle rocks and this is not secure key, who cares, it is a test');
+        set_config('backup_encryptkey', base64_encode($key), 'backup');
+        $this->assertEmpty($efe->get_value());
+        $secret = 'This is a secret message that nobody else will be able to read but me 💩 ';
+        $efe->set_value($secret);
+        $atts = $efe->get_attributes();
+        $this->assertCount(2, $atts);
+        $this->assertArrayHasKey('encrypted', $atts); // We added it explicitly.
+        $this->assertTrue($atts['encrypted']->is_set());
+        $this->assertSame('true', $atts['encrypted']->get_value());
+        $this->assertNotEmpty($efe->get_value());
+        $this->assertTrue($efe->is_set());
+        // Get the crypted content and decrypt it manually.
+        $ctext = $efe->get_value();
+        $hmaclen = 32; // SHA256 is 32 bytes.
+        $ivlen = openssl_cipher_iv_length(backup::CIPHER);
+        list($hmac, $iv, $text) = array_values(unpack("a{$hmaclen}hmac/a{$ivlen}iv/a*text", base64_decode($ctext)));
+        $this->assertSame(hash_hmac('sha256', $iv . $text, $key, true), $hmac);
+        $this->assertSame($secret, openssl_decrypt($text, backup::CIPHER, $key, OPENSSL_RAW_DATA, $iv));
+
+        // Using the default site-generated key.
+        $efe = new encrypted_final_element('test', array('testattr'));
+        $this->assertEmpty($efe->get_value());
+        $secret = 'This is a secret message that nobody else will be able to read but me 💩 ';
+        $efe->set_value($secret);
+        $atts = $efe->get_attributes();
+        $this->assertCount(2, $atts);
+        $this->assertArrayHasKey('encrypted', $atts); // Was added automatcally, we did not specify it.
+        $this->assertTrue($atts['encrypted']->is_set());
+        $this->assertSame('true', $atts['encrypted']->get_value());
+        $this->assertNotEmpty($efe->get_value());
+        $this->assertTrue($efe->is_set());
+        // Get the crypted content and decrypt it manually.
+        $ctext = $efe->get_value();
+        $hmaclen = 32; // SHA256 is 32 bytes.
+        $ivlen = openssl_cipher_iv_length(backup::CIPHER);
+        list($hmac, $iv, $text) = array_values(unpack("a{$hmaclen}hmac/a{$ivlen}iv/a*text", base64_decode($ctext)));
+        $key = base64_decode(get_config('backup', 'backup_encryptkey'));
+        $this->assertSame(hash_hmac('sha256', $iv . $text, $key, true), $hmac);
+        $this->assertSame($secret, openssl_decrypt($text, backup::CIPHER, $key, OPENSSL_RAW_DATA, $iv));
+    }
+}
@@ -94,6 +94,66 @@ abstract class restore_step extends base_step {
        // Return the passed value with cached offset applied.
        return $value + $cache[$this->get_restoreid()];
    }
+
+    /**
+     * Returns symmetric-key AES-256 decryption of base64 encoded contents.
+     *
+     * This method is used in restore operations to decrypt contents encrypted with
+     * {@link encrypted_final_element} automatically decoding (base64) and decrypting
+     * contents using the key stored in backup_encryptkey config.
+     *
+     * Requires openssl, cipher availability, and key existence (backup
+     * automatically sets it if missing). Integrity is provided via HMAC.
+     *
+     * @param string $value {@link encrypted_final_element} value to decode and decrypt.
+     * @return string|null decoded and decrypted value or null if the operation can not be performed.
+     */
+    public function decrypt($value) {
+
+        // No openssl available, skip this field completely.
+        if (!function_exists('openssl_encrypt')) {
+            return null;
+        }
+
+        // No hash available, skip this field completely.
+        if (!function_exists('hash_hmac')) {
+            return null;
+        }
+
+        // Cypher not available, skip this field completely.
+        if (!in_array(backup::CIPHER, openssl_get_cipher_methods())) {
+            return null;
+        }
+
+        // Get the decrypt key. Skip if missing.
+        $key = get_config('backup', 'backup_encryptkey');
+        if ($key === false) {
+            return null;
+        }
+
+        // And decode it.
+        $key = base64_decode($key);
+
+        // Arrived here, let's proceed with authentication (provides integrity).
+        $hmaclen = 32; // SHA256 is 32 bytes.
+        $ivlen = openssl_cipher_iv_length(backup::CIPHER);
+        list($hmac, $iv, $text) = array_values(unpack("a{$hmaclen}hmac/a{$ivlen}iv/a*text", base64_decode($value)));
+
+        // Verify HMAC matches expectations, skip if not (integrity failed).
+        if (!hash_equals($hmac, hash_hmac('sha256', $iv . $text, $key, true))) {
+            return null;
+        }
+
+        // Arrived here, integrity is ok, let's decrypt.
+        $result = openssl_decrypt($text, backup::CIPHER, $key, OPENSSL_RAW_DATA, $iv);
+
+        // For some reason decrypt failed (strange, HMAC check should have deteted it), skip this field completely.
+        if ($result === false) {
+            return null;
+        }
+
+        return $result;
+    }
 }

 /*
@@ -91,6 +91,52 @@ class backup_step_testcase extends advanced_testcase {
        $bc->destroy();
    }

+    /**
+     * test restore_step class, decrypt method
+     */
+    public function test_restore_step_decrypt() {
+
+        $this->resetAfterTest(true);
+
+        if (!function_exists('openssl_encrypt')) {
+            $this->markTestSkipped('OpenSSL extension is not loaded.');
+
+        } else if (!function_exists('hash_hmac')) {
+            $this->markTestSkipped('Hash extension is not loaded.');
+
+        } else if (!in_array(backup::CIPHER, openssl_get_cipher_methods())) {
+            $this->markTestSkipped('Expected cipher not available: ' . backup::CIPHER);
+        }
+
+        $bt = new mock_restore_task_basepath('taskname');
+        $bs = new mock_restore_structure_step('steptest', null, $bt);
+        $this->assertTrue(method_exists($bs, 'decrypt'));
+
+        // Let's prepare a string for being decrypted.
+        $secret = 'This is a secret message that nobody else will be able to read but me 💩  ';
+        $key = hash('md5', 'Moodle rocks and this is not secure key, who cares, it is a test');
+        $iv = openssl_random_pseudo_bytes(openssl_cipher_iv_length(backup::CIPHER));
+        $message = $iv . openssl_encrypt($secret, backup::CIPHER, $key, OPENSSL_RAW_DATA, $iv);
+        $hmac = hash_hmac('sha256', $message, $key, true);
+        $crypt = base64_encode($hmac . $message);
+
+        // Running it without a key configured, returns null.
+        $this->assertNull($bs->decrypt($crypt));
+
+        // Store the key into config.
+        set_config('backup_encryptkey', base64_encode($key), 'backup');
+
+        // Verify decrypt works and returns original.
+        $this->assertSame($secret, $bs->decrypt($crypt));
+
+        // Finally, test the integrity failure detection is working.
+        // (this can be caused by changed hmac, key or message, in
+        // this case we are just forcing it via changed hmac).
+        $hmac = md5($message);
+        $crypt = base64_encode($hmac . $message);
+        $this->assertNull($bs->decrypt($crypt));
+    }
+
    /**
     * test backup_structure_step class
     */
@@ -65,6 +65,7 @@ abstract class base_setting {

    protected $name;  // name of the setting
    protected $value; // value of the setting
+    protected $unlockedvalue; // Value to set after the setting is unlocked.
    protected $vtype; // type of value (setting_base::IS_BOOLEAN/setting_base::IS_INTEGER...)

    protected $visibility; // visibility of the setting (setting_base::VISIBLE/setting_base::HIDDEN)
@@ -118,6 +119,7 @@ abstract class base_setting {
        $this->value       = $value;
        $this->visibility  = $visibility;
        $this->status      = $status;
+        $this->unlockedvalue = $this->value;

        // Generate a default ui
        $this->uisetting = new base_setting_ui($this);
@@ -225,6 +227,11 @@ abstract class base_setting {
        $this->status = $status;
        if ($status !== $oldstatus) { // Status has changed, let's inform dependencies
            $this->inform_dependencies(self::CHANGED_STATUS, $oldstatus);
+
+            if ($status == base_setting::NOT_LOCKED) {
+                // When setting gets unlocked set it to the original value.
+                $this->set_value($this->unlockedvalue);
+            }
        }
    }

@@ -153,7 +153,7 @@ abstract class setting_dependency {
     */
    abstract public function get_moodleform_properties();
    /**
-     * Returns true if the dependent setting is locked.
+     * Returns true if the dependent setting is locked by this setting_dependency.
     * @return bool
     */
    abstract public function is_locked();
@@ -185,7 +185,7 @@ class setting_dependency_disabledif_equals extends setting_dependency {
        $this->value = ($value)?(string)$value:0;
    }
    /**
-     * Returns true if the dependent setting is locked.
+     * Returns true if the dependent setting is locked by this setting_dependency.
     * @return bool
     */
    public function is_locked() {
@@ -193,8 +193,8 @@ class setting_dependency_disabledif_equals extends setting_dependency {
        if ($this->setting->get_status() !== base_setting::NOT_LOCKED || $this->setting->get_value() == $this->value) {
            return true;
        }
-        // Else return based upon the dependent settings status
-        return ($this->dependentsetting->get_status() !== base_setting::NOT_LOCKED);
+        // Else the dependent setting is not locked by this setting_dependency.
+        return false;
    }
    /**
     * Processes a value change in the primary setting
@@ -343,7 +343,7 @@ class setting_dependency_disabledif_equals2 extends setting_dependency {
        $this->value = $value;
    }
    /**
-     * Returns true if the dependent setting is locked.
+     * Returns true if the dependent setting is locked by this setting_dependency.
     * @return bool
     */
    public function is_locked() {
@@ -351,8 +351,8 @@ class setting_dependency_disabledif_equals2 extends setting_dependency {
        if ($this->setting->get_status() !== base_setting::NOT_LOCKED || in_array($this->setting->get_value(), $this->value)) {
            return true;
        }
-        // Else return based upon the dependent settings status
-        return ($this->dependentsetting->get_status() !== base_setting::NOT_LOCKED);
+        // Else the dependent setting is not locked by this setting_dependency.
+        return false;
    }
    /**
     * Processes a value change in the primary setting
@@ -537,7 +537,7 @@ class setting_dependency_disabledif_not_empty extends setting_dependency_disable
    }

    /**
-     * Returns true if the dependent setting is locked.
+     * Returns true if the dependent setting is locked by this setting_dependency.
     * @return bool
     */
    public function is_locked() {
@@ -545,8 +545,8 @@ class setting_dependency_disabledif_not_empty extends setting_dependency_disable
        if ($this->setting->get_status() !== base_setting::NOT_LOCKED || !empty($value)) {
            return true;
        }
-        // Else return based upon the dependent settings status
-        return ($this->dependentsetting->get_status() !== base_setting::NOT_LOCKED);
+        // Else the dependent setting is not locked by this setting_dependency.
+        return false;
    }
 }

@@ -601,7 +601,7 @@ class setting_dependency_disabledif_empty extends setting_dependency_disabledif_
        return ($prevalue != $this->dependentsetting->get_value());
    }
    /**
-     * Returns true if the dependent setting is locked.
+     * Returns true if the dependent setting is locked by this setting_dependency.
     * @return bool
     */
    public function is_locked() {
@@ -609,7 +609,7 @@ class setting_dependency_disabledif_empty extends setting_dependency_disabledif_
        if ($this->setting->get_status() !== base_setting::NOT_LOCKED || empty($value)) {
            return true;
        }
-        // Else return based upon the dependent settings status
-        return ($this->dependentsetting->get_status() !== base_setting::NOT_LOCKED);
+        // Else the dependent setting is not locked by this setting_dependency.
+        return false;
    }
 }
@@ -122,6 +122,8 @@ class backup_confirmation_form extends backup_moodleform {
        if (!array_key_exists('setting_root_filename', $errors)) {
            if (trim($data['setting_root_filename']) == '') {
                $errors['setting_root_filename'] = get_string('errorfilenamerequired', 'backup');
+            } else if (strlen(trim($data['setting_root_filename'])) > 255) {
+                $errors['setting_root_filename'] = get_string('errorfilenametoolong', 'backup');
            } else if (!preg_match('#\.mbz$#i', $data['setting_root_filename'])) {
                $errors['setting_root_filename'] = get_string('errorfilenamemustbezip', 'backup');
            }
@@ -307,10 +307,12 @@ abstract class backup_setting_ui extends base_setting_ui {
     * 2. The setting is locked but only by settings that are of the same level (same page)
     *
     * Condition 2 is really why we have this function
-     *
+     * @param int $level Optional, if provided only depedency_settings below or equal to this level are considered,
+     *          when checking if the ui_setting is changeable. Although dependencies might cause a lock on this setting,
+     *          they could be changeable in the same view.
     * @return bool
     */
-    public function is_changeable() {
+    public function is_changeable($level = null) {
        if ($this->setting->get_status() === backup_setting::NOT_LOCKED) {
            // Its not locked so its chanegable.
            return true;
@@ -319,6 +321,9 @@ abstract class backup_setting_ui extends base_setting_ui {
            return false;
        } else if ($this->setting->has_dependencies_on_settings()) {
            foreach ($this->setting->get_settings_depended_on() as $dependency) {
+                if ($level && $dependency->get_setting()->get_level() >= $level) {
+                    continue;
+                }
                if ($dependency->is_locked() && $dependency->get_setting()->get_level() !== $this->setting->get_level()) {
                    // Its not changeable because one or more dependancies arn't changeable.
                    return false;
@@ -355,7 +360,8 @@ class backup_setting_ui_text extends backup_setting_ui {
     */
    public function get_element_properties(base_task $task = null, renderer_base $output = null) {
        $icon = $this->get_icon();
-        $label = $this->get_label($task);
+        $context = context_course::instance($task->get_courseid());
+        $label = format_string($this->get_label($task), true, array('context' => $context));
        if (!empty($icon)) {
            $label .= $output->render($icon);
        }
@@ -418,7 +424,8 @@ class backup_setting_ui_checkbox extends backup_setting_ui {
    public function get_element_properties(base_task $task = null, renderer_base $output = null) {
        // Name, label, text, attributes.
        $icon = $this->get_icon();
-        $label = $this->get_label($task);
+        $context = context_course::instance($task->get_courseid());
+        $label = format_string($this->get_label($task), true, array('context' => $context));
        if (!empty($icon)) {
            $label .= $output->render($icon);
        }
@@ -456,13 +463,16 @@ class backup_setting_ui_checkbox extends backup_setting_ui {

    /**
     * Returns true if the setting is changeable
+     * @param int $level Optional, if provided only depedency_settings below or equal to this level are considered,
+     *          when checking if the ui_setting is changeable. Although dependencies might cause a lock on this setting,
+     *          they could be changeable in the same view.
     * @return bool
     */
-    public function is_changeable() {
+    public function is_changeable($level = null) {
        if ($this->changeable === false) {
            return false;
        } else {
-            return parent::is_changeable();
+            return parent::is_changeable($level);
        }
    }

@@ -525,7 +535,8 @@ class backup_setting_ui_radio extends backup_setting_ui {
     */
    public function get_element_properties(base_task $task = null, renderer_base $output = null) {
        $icon = $this->get_icon();
-        $label = $this->get_label($task);
+        $context = context_course::instance($task->get_courseid());
+        $label = format_string($this->get_label($task), true, array('context' => $context));
        if (!empty($icon)) {
            $label .= $output->render($icon);
        }
@@ -602,7 +613,8 @@ class backup_setting_ui_select extends backup_setting_ui {
     */
    public function get_element_properties(base_task $task = null, renderer_base $output = null) {
        $icon = $this->get_icon();
-        $label = $this->get_label($task);
+        $context = context_course::instance($task->get_courseid());
+        $label = format_string($this->get_label($task), true, array('context' => $context));
        if (!empty($icon)) {
            $label .= $output->render($icon);
        }
@@ -635,13 +647,16 @@ class backup_setting_ui_select extends backup_setting_ui {
    /**
     * Returns true if the setting is changeable, false otherwise
     *
+     * @param int $level Optional, if provided only depedency_settings below or equal to this level are considered,
+     *          when checking if the ui_setting is changeable. Although dependencies might cause a lock on this setting,
+     *          they could be changeable in the same view.
     * @return bool
     */
-    public function is_changeable() {
+    public function is_changeable($level = null) {
        if (count($this->values) == 1) {
            return false;
        } else {
-            return parent::is_changeable();
+            return parent::is_changeable($level);
        }
    }

@@ -183,11 +183,22 @@ abstract class base_moodleform extends moodleform {
    public function add_settings(array $settingstasks) {
        global $OUTPUT;

+        // Determine highest setting level, which is displayed in this stage. This is relevant for considering only
+        // locks of dependency settings for parent settings, which are not displayed in this stage.
+        $highestlevel = backup_setting::ACTIVITY_LEVEL;
+        foreach ($settingstasks as $st) {
+            list($setting, $task) = $st;
+            if ($setting->get_level() < $highestlevel) {
+                $highestlevel = $setting->get_level();
+            }
+        }
+
        $defaults = array();
        foreach ($settingstasks as $st) {
            list($setting, $task) = $st;
            // If the setting cant be changed or isn't visible then add it as a fixed setting.
-            if (!$setting->get_ui()->is_changeable() || $setting->get_visibility() != backup_setting::VISIBLE) {
+            if (!$setting->get_ui()->is_changeable($highestlevel) ||
+                $setting->get_visibility() != backup_setting::VISIBLE) {
                $this->add_fixed_setting($setting, $task);
                continue;
            }
@@ -302,7 +313,8 @@ abstract class base_moodleform extends moodleform {
                    $icon = '';
                    break;
            }
-            $label = $settingui->get_label($task);
+            $context = context_course::instance($task->get_courseid());
+            $label = format_string($settingui->get_label($task), true, array('context' => $context));
            $labelicon = $settingui->get_icon();
            if (!empty($labelicon)) {
                $label .= '&nbsp;'.$OUTPUT->render($labelicon);
@@ -0,0 +1,125 @@
+@core @core_backup
+Feature: Restore Moodle 2 course backups with different user data settings
+  In order to decide upon including user data during backup and restore of courses
+  As a teacher and an admin
+  I need to be able to set and override backup and restore settings
+
+  Background:
+    Given the following "users" exist:
+      | username | firstname | lastname | email |
+      | student1 | Student | 1 | student1@example.com |
+      | teacher1 | Teacher | 1 | teacher1@example.com |
+    And the following "courses" exist:
+      | fullname | shortname | category |
+      | Course 1 | C1 | 0 |
+    And the following "course enrolments" exist:
+      | user | course | role |
+      | teacher1 | C1 | editingteacher |
+      | student1 | C1 | student |
+    And the following "activities" exist:
+      | activity | name               | intro | course | idnumber |
+      | data     | Test database name | n     | C1     | data1    |
+    And I log in as "teacher1"
+    And I am on "Course 1" course homepage
+    And I add a "Text input" field to "Test database name" database and I fill the form with:
+      | Field name | Test field name |
+      | Field description | Test field description |
+    And I follow "Templates"
+    And I wait until the page is ready
+    And I log out
+    And I log in as "student1"
+    And I am on "Course 1" course homepage
+    And I add an entry to "Test database name" database with:
+      | Test field name | Student entry |
+    And I press "Save and view"
+    And I log out
+    And I log in as "admin"
+    And I backup "Course 1" course using this options:
+      | Initial |  Include enrolled users | 1 |
+      | Confirmation | Filename | test_backup.mbz |
+
+  @javascript
+  Scenario: Restore a backup with user data
+    # "User data" marks the user data field for the section
+    # "-" marks the user data field for the data activity
+    When I restore "test_backup.mbz" backup into a new course using this options:
+      | Settings |  Include enrolled users | 1 |
+      | Schema | User data | 1 |
+      | Schema | - | 1 |
+    Then I should see "Test database name"
+    When I follow "Test database name"
+    Then I should see "Student entry"
+
+  @javascript
+  Scenario: Restore a backup without user data for data activity
+    # "User data" marks the user data field for the section
+    # "-" marks the user data field for the data activity
+    When I restore "test_backup.mbz" backup into a new course using this options:
+      | Settings |  Include enrolled users | 1 |
+      | Schema | User data | 1 |
+      | Schema | - | 0 |
+    Then I should see "Test database name"
+    When I follow "Test database name"
+    Then I should not see "Student entry"
+
+  @javascript
+  Scenario: Restore a backup without user data for section and data activity
+    # "User data" marks the user data field for the section
+    # "-" marks the user data field for the data activity
+    When I restore "test_backup.mbz" backup into a new course using this options:
+      | Settings |  Include enrolled users | 1 |
+      | Schema | User data | 0 |
+      | Schema | - | 0 |
+    Then I should see "Test database name"
+    When I follow "Test database name"
+    Then I should not see "Student entry"
+
+  @javascript
+  Scenario: Restore a backup without user data for section
+    # "User data" marks the user data field for the section
+    # "-" marks the user data field for the data activity
+    When I restore "test_backup.mbz" backup into a new course using this options:
+      | Settings |  Include enrolled users | 1 |
+      | Schema | - | 1 |
+      | Schema | User data | 0 |
+    Then I should see "Test database name"
+    When I follow "Test database name"
+    Then I should not see "Student entry"
+
+  @javascript
+  Scenario: Restore a backup with user data with local config for including users set to 0
+    And I restore "test_backup.mbz" backup into a new course using this options:
+      | Settings |  Include enrolled users | 0 |
+    Then I should see "Test database name"
+    When I follow "Test database name"
+    Then I should not see "Student entry"
+
+  @javascript
+  Scenario: Restore a backup with user data with site config for including users set to 0
+    Given I navigate to "General restore defaults" node in "Site administration > Courses > Backups"
+    And I set the field "s_restore_restore_general_users" to ""
+    And I press "Save changes"
+    And I am on "Course 1" course homepage
+    And I navigate to "Restore" node in "Course administration"
+    # "User data" marks the user data field for the section
+    # "-" marks the user data field for the data activity
+    And I restore "test_backup.mbz" backup into a new course using this options:
+      | Settings |  Include enrolled users | 1 |
+      | Schema | User data | 1 |
+      | Schema | - | 1 |
+    Then I should see "Test database name"
+    When I follow "Test database name"
+    Then I should see "Student entry"
+
+  @javascript
+  Scenario: Restore a backup with user data with local and site config config for including users set to 0
+    Given I navigate to "General restore defaults" node in "Site administration > Courses > Backups"
+    And I set the field "s_restore_restore_general_users" to ""
+    And I press "Save changes"
+    And I am on "Course 1" course homepage
+    And I navigate to "Restore" node in "Course administration"
+    When I restore "test_backup.mbz" backup into a new course using this options:
+      | Settings |  Include enrolled users | 0 |
+    Then I should see "Test database name"
+    When I follow "Test database name"
+    Then I should not see "Student entry"
@@ -27,18 +27,22 @@ function check_site_access() {
    var callback = {
            method: "GET",
            on: {
-                success: function(id, o, args) {
-                            var data = Y.JSON.parse(o.responseText);
-                            if (data.code == 'http-unreachable') {
-                                add.setHTML(data.response);
-                                add.removeClass('hide');
-                            }
-                        },
-                failure: function(o) { }
+                success: function(id, o) {
+                    var data = Y.JSON.parse(o.responseText);
+                    if (data.code == 'http-unreachable') {
+                        add.setHTML(data.response);
+                        add.removeClass('hide');
+                    }
+                    M.util.js_complete('badge/backpack::check_site_access');
+                },
+                failure: function() {
+                    M.util.js_complete('badge/backpack::check_site_access');
+                }
            }
        };

    Y.use('io-base', function(Y) {
+        M.util.js_pending('badge/backpack::check_site_access');
        Y.io('ajax.php', callback);
    });

@@ -48,8 +48,8 @@ class edit_details_form extends moodleform {

        $mform->addElement('header', 'badgedetails', get_string('badgedetails', 'badges'));
        $mform->addElement('text', 'name', get_string('name'), array('size' => '70'));
-        // Using PARAM_FILE to avoid problems later when downloading badge files.
-        $mform->setType('name', PARAM_FILE);
+        // When downloading badge, it will be necessary to clean the name as PARAM_FILE.
+        $mform->setType('name', PARAM_TEXT);
        $mform->addRule('name', null, 'required');
        $mform->addRule('name', get_string('maximumchars', '', 255), 'maxlength', 255, 'client');

@@ -72,6 +72,7 @@ if ($hide) {
    require_sesskey();
    $badge = new badge($download);
    $name = str_replace(' ', '_', $badge->name) . '.png';
+    $name = clean_param($name, PARAM_FILE);
    $filehash = badges_bake($hash, $download, $USER->id, true);
    $fs = get_file_storage();
    $file = $fs->get_file_by_hash($filehash);
@@ -74,12 +74,13 @@ class block_globalsearch extends block_base {
        // Input.
        $this->content->text .= html_writer::tag('label', get_string('search', 'search'),
            array('for' => 'searchform_search', 'class' => 'accesshide'));
-        $inputoptions = array('id' => 'searchform_search', 'name' => 'q', 'type' => 'text', 'size' => '15');
+        $inputoptions = array('id' => 'searchform_search', 'name' => 'q', 'class' => 'form-control',
+            'type' => 'text', 'size' => '15');
        $this->content->text .= html_writer::empty_tag('input', $inputoptions);

        // Search button.
        $this->content->text .= html_writer::tag('button', get_string('search', 'search'),
-            array('id' => 'searchform_button', 'type' => 'submit', 'title' => 'globalsearch'));
+            array('id' => 'searchform_button', 'type' => 'submit', 'title' => 'globalsearch', 'class' => 'btn btn-secondary'));
        $this->content->text .= html_writer::end_tag('fieldset');
        $this->content->text .= html_writer::end_tag('form');
        $this->content->text .= html_writer::end_tag('div');
@@ -50,7 +50,7 @@ class block_glossary_random extends block_base {
        if (empty($this->config->title)) {
            $this->title = get_string('pluginname','block_glossary_random');
        } else {
-            $this->title = $this->config->title;
+            $this->title = format_string($this->config->title, true, ['context' => $this->context]);
        }

        if (empty($this->config->glossary)) {
@@ -37,7 +37,11 @@ class block_html extends block_base {
    }

    function specialization() {
-        $this->title = isset($this->config->title) ? format_string($this->config->title) : format_string(get_string('newhtmlblock', 'block_html'));
+        if (isset($this->config->title)) {
+            $this->title = $this->title = format_string($this->config->title, true, ['context' => $this->context]);
+        } else {
+            $this->title = get_string('newhtmlblock', 'block_html');
+        }
    }

    function instance_allow_multiple() {
@@ -35,6 +35,7 @@ use core_competency\url;
 use renderable;
 use renderer_base;
 use templatable;
+use required_capability_exception;

 /**
 * Summary renderable class.
@@ -68,7 +69,11 @@ class summary implements renderable, templatable {
        $this->user = $user;

        // Get the plans.
-        $this->plans = api::list_user_plans($this->user->id);
+        try {
+            $this->plans = api::list_user_plans($this->user->id);
+        } catch (required_capability_exception $e) {
+            $this->plans = [];
+        }

        // Get the competencies to review.
        $this->compstoreview = api::list_user_competencies_to_review(0, 3);
@@ -61,9 +61,15 @@ class main implements renderable, templatable {
     * @return stdClass
     */
    public function export_for_template(renderer_base $output) {
-        global $USER;
+        global $CFG, $USER;

-        $courses = enrol_get_my_courses('*', 'fullname ASC');
+        if (empty($CFG->navsortmycoursessort)) {
+            $sort = 'visible DESC, sortorder ASC';
+        } else {
+            $sort = 'visible DESC, '.$CFG->navsortmycoursessort.' ASC';
+        }
+
+        $courses = enrol_get_my_courses('*', $sort);
        $coursesprogress = [];

        foreach ($courses as $course) {
@@ -45,7 +45,7 @@ class block_tags extends block_base {
        if (empty($this->config->title)) {
            $this->title = get_string('pluginname', 'block_tags');
        } else {
-            $this->title = $this->config->title;
+            $this->title = format_string($this->config->title, true, ['context' => $this->context]);
        }
    }

@@ -122,12 +122,16 @@ class repeat_event_collection implements event_collection_interface {
     * @param int $start Start offset.
     * @return \stdClass[]
     */
-    protected function load_event_records($start = 1) {
+    protected function load_event_records($start = 0) {
        global $DB;
-        while ($records = $DB->get_records(
+        while ($records = $DB->get_records_select(
            'event',
-            ['repeatid' => $this->parentid],
-            '',
+            'id <> :parentid AND repeatid = :repeatid',
+            [
+                'parentid' => $this->parentid,
+                'repeatid' => $this->parentid,
+            ],
+            'id ASC',
            '*',
            $start,
            self::DB_QUERY_LIMIT
@@ -1457,7 +1457,7 @@ function calendar_get_mini($courses, $groups, $users, $calmonth = false, $calyea
                        $name = format_string($event->name, true);
                    }
                }
-                $popupcontent .= \html_writer::link($dayhref, $name);
+                $popupcontent .= \html_writer::link($dayhref, clean_text($name));
                $popupcontent .= \html_writer::end_tag('div');
            }

@@ -2116,6 +2116,13 @@ function calendar_time_representation($time) {
        $timeformat = get_config(null, 'calendar_site_timeformat');
    }

+    // Allow language customization of selected time format.
+    if ($timeformat === CALENDAR_TF_12) {
+        $timeformat = get_string('strftimetime12', 'langconfig');
+    } else if ($timeformat === CALENDAR_TF_24) {
+        $timeformat = get_string('strftimetime24', 'langconfig');
+    }
+
    return userdate($time, empty($timeformat) ? $langtimeformat : $timeformat);
 }

@@ -872,7 +872,7 @@ class core_calendar_rrule_manager_testcase extends advanced_testcase {
        $records = $DB->get_records('event', ['repeatid' => $this->event->id], 'timestart ASC', 'id, repeatid, timestart');
        $expecteddate = new DateTime('first Monday of this month');
        // Move to the next interval's first Monday if the calculated start date is after this month's first Monday.
-        if ($expecteddate->getTimestamp() < $startdatetime->getTimestamp()) {
+        if ($expecteddate->getTimestamp() < $startdate->getTimestamp()) {
            $expecteddate->add($interval);
            $expecteddate->modify('first Monday of this month');
        }
@@ -23,6 +23,8 @@
 * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
 */

+defined('MOODLE_INTERNAL') || die();
+
 require_once("$CFG->libdir/externallib.php");

 class core_cohort_external extends external_api {
@@ -24,6 +24,8 @@
 * @since      Moodle 2.9
 */

+defined('MOODLE_INTERNAL') || die();
+
 require_once("$CFG->libdir/externallib.php");
 require_once("$CFG->dirroot/comment/lib.php");

@@ -165,7 +165,7 @@ class api {
        require_capability('moodle/competency:competencymanage', $competency->get_context());

        // Reset the sortorder, use reorder instead.
-        $competency->set('sortorder', null);
+        $competency->set('sortorder', 0);
        $competency->create();

        \core\event\competency_created::create_from_competency($competency)->trigger();
@@ -1349,7 +1349,8 @@ class api {
                  JOIN {user} u
                    ON u.id = uc.userid
                 WHERE (uc.status = :waitingforreview
-                    OR (uc.status = :inreview AND uc.reviewerid = :reviewerid))";
+                    OR (uc.status = :inreview AND uc.reviewerid = :reviewerid))
+                   AND u.deleted = 0";
        $ordersql = " ORDER BY c.shortname ASC";
        $params = array(
            'inreview' => user_competency::STATUS_IN_REVIEW,
@@ -76,7 +76,7 @@ class competency extends persistent {
                'default' => FORMAT_HTML
            ),
            'sortorder' => array(
-                'default' => null,
+                'default' => 0,
                'type' => PARAM_INT
            ),
            'parentid' => array(
@@ -841,10 +841,10 @@ class external extends external_api {
        $validcolumns = array('id', 'shortname', 'description', 'sortorder', 'idnumber',
            'parentid', 'competencyframeworkid');
        foreach ($params['filters'] as $filter) {
-            if (!in_array($filter->column, $validcolumns)) {
+            if (!in_array($filter['column'], $validcolumns)) {
                throw new invalid_parameter_exception('Filter column was invalid');
            }
-            $safefilters[$filter->column] = $filter->value;
+            $safefilters[$filter['column']] = $filter['value'];
        }

        $context = null;
@@ -53,7 +53,7 @@ class template_competency extends persistent {
            ),
            'sortorder' => array(
                'type' => PARAM_INT,
-                'default' => null,
+                'default' => 0,
            ),
        );
    }
@@ -282,7 +282,6 @@ class user_competency_course extends persistent {
              ORDER BY p.timesproficient ASC, c.id DESC';

        $results = $DB->get_records_sql($sql, $params, $skip, $limit);
-        $a = $DB->get_records_sql('SELECT * from {' . self::TABLE . '}');

        $comps = array();
        foreach ($results as $r) {
@@ -66,7 +66,7 @@ class user_competency_plan extends persistent {
            ),
            'sortorder' => array(
                'type' => PARAM_INT,
-                'default' => null,
+                'default' => 0,
            ),
        );
    }
@@ -4564,6 +4564,9 @@ class core_competency_api_testcase extends advanced_testcase {
    }

    public function test_list_user_competencies_to_review() {
+        global $CFG;
+        require_once($CFG->dirroot . '/user/lib.php');
+
        $dg = $this->getDataGenerator();
        $this->resetAfterTest();
        $ccg = $dg->get_plugin_generator('core_competency');
@@ -4580,10 +4583,12 @@ class core_competency_api_testcase extends advanced_testcase {

        $u1 = $dg->create_user();
        $u2 = $dg->create_user();
+        $u3 = $dg->create_user();
        $f1 = $ccg->create_framework();
        $c1 = $ccg->create_competency(['competencyframeworkid' => $f1->get('id')]);
        $c2 = $ccg->create_competency(['competencyframeworkid' => $f1->get('id')]);
        $c3 = $ccg->create_competency(['competencyframeworkid' => $f1->get('id')]);
+        $c4 = $ccg->create_competency(['competencyframeworkid' => $f1->get('id')]);
        $uc1a = $ccg->create_user_competency(['userid' => $u1->id, 'competencyid' => $c1->get('id'),
            'status' => user_competency::STATUS_IDLE]);
        $uc1b = $ccg->create_user_competency(['userid' => $u1->id, 'competencyid' => $c2->get('id'),
@@ -4596,14 +4601,23 @@ class core_competency_api_testcase extends advanced_testcase {
            'status' => user_competency::STATUS_IDLE]);
        $uc2c = $ccg->create_user_competency(['userid' => $u2->id, 'competencyid' => $c3->get('id'),
            'status' => user_competency::STATUS_IN_REVIEW]);
+        $uc3a = $ccg->create_user_competency(['userid' => $u3->id, 'competencyid' => $c4->get('id'),
+            'status' => user_competency::STATUS_WAITING_FOR_REVIEW]);

        // The reviewer can review all plans waiting for review, or in review where they are the reviewer.
        $this->setUser($reviewer);
        $result = api::list_user_competencies_to_review();
-        $this->assertEquals(3, $result['count']);
+        $this->assertEquals(4, $result['count']);
        $this->assertEquals($uc2a->get('id'), $result['competencies'][0]->usercompetency->get('id'));
        $this->assertEquals($uc1b->get('id'), $result['competencies'][1]->usercompetency->get('id'));
        $this->assertEquals($uc1c->get('id'), $result['competencies'][2]->usercompetency->get('id'));
+        $this->assertEquals($uc3a->get('id'), $result['competencies'][3]->usercompetency->get('id'));
+
+        // Now, let's delete user 3.
+        // It should not be listed on user competencies to review any more.
+        user_delete_user($u3);
+        $result = api::list_user_competencies_to_review();
+        $this->assertEquals(3, $result['count']);

        // The reviewer cannot view the plans when they do not have the permission in the user's context.
        role_assign($roleprohibit, $reviewer->id, context_user::instance($u2->id)->id);
@@ -281,8 +281,7 @@ class core_competency_external_testcase extends externallib_advanced_testcase {
            'idnumber' => 'idnumber' . $number,
            'description' => 'description' . $number,
            'descriptionformat' => FORMAT_HTML,
-            'competencyframeworkid' => $frameworkid,
-            'sortorder' => 0
+            'competencyframeworkid' => $frameworkid
        );
        $result = external::create_competency($competency);
        return (object) external_api::clean_returnvalue(external::create_competency_returns(), $result);
@@ -294,8 +293,7 @@ class core_competency_external_testcase extends externallib_advanced_testcase {
            'shortname' => 'shortname' . $number,
            'idnumber' => 'idnumber' . $number,
            'description' => 'description' . $number,
-            'descriptionformat' => FORMAT_HTML,
-            'sortorder' => 0
+            'descriptionformat' => FORMAT_HTML
        );
        $result = external::update_competency($competency);
        return external_api::clean_returnvalue(external::update_competency_returns(), $result);
@@ -2803,4 +2801,43 @@ class core_competency_external_testcase extends externallib_advanced_testcase {
        $result = external::update_course_competency_settings($course->id, array('pushratingstouserplans' => true));
    }

+    /**
+     * Test that we can list competencies with a filter.
+     *
+     * @return void
+     */
+    public function test_list_competencies_with_filter() {
+        $this->resetAfterTest(true);
+        $this->setAdminUser();
+        $dg = $this->getDataGenerator();
+        $lpg = $this->getDataGenerator()->get_plugin_generator('core_competency');
+
+        $framework = $lpg->create_framework();
+        $c1 = $lpg->create_competency(array('competencyframeworkid' => $framework->get('id')));
+        $c2 = $lpg->create_competency(array('competencyframeworkid' => $framework->get('id')));
+        $c3 = $lpg->create_competency(array('competencyframeworkid' => $framework->get('id')));
+        $c4 = $lpg->create_competency(array('competencyframeworkid' => $framework->get('id')));
+        $c5 = $lpg->create_competency(array('competencyframeworkid' => $framework->get('id')));
+
+        // Test if removing competency from plan don't create sortorder holes.
+        $filters = [];
+        $sort = 'id';
+        $order = 'ASC';
+        $skip = 0;
+        $limit = 0;
+        $result = external::list_competencies($filters, $sort, $order, $skip, $limit);
+        $this->assertCount(5, $result);
+
+        $result = external::list_competencies($filters, $sort, $order, 2, $limit);
+        $this->assertCount(3, $result);
+        $result = external::list_competencies($filters, $sort, $order, 2, 2);
+        $this->assertCount(2, $result);
+
+        $filter = $result[0]->shortname;
+        $filters[0] = ['column' => 'shortname', 'value' => $filter];
+        $result = external::list_competencies($filters, $sort, $order, $skip, $limit);
+        $this->assertCount(1, $result);
+        $this->assertEquals($filter, $result[0]->shortname);
+    }
+
 }
@@ -59,7 +59,10 @@ class api {
        if (is_object($instanceorid)) {
            $instance = $instanceorid;
        } else {
-            $instance = $DB->get_record($modulename, array('id' => $instanceorid), '*', MUST_EXIST);
+            $instance = $DB->get_record($modulename, array('id' => $instanceorid), '*', IGNORE_MISSING);
+        }
+        if (!$instance) {
+            return false;
        }
        $course = get_course($instance->course);

@@ -169,7 +169,7 @@ class core_completion_external extends external_api {

        $completion = new completion_info($course);
        $activities = $completion->get_activities();
-        $progresses = $completion->get_progress_all();
+        $progresses = $completion->get_progress_all('u.id = :uid', ['uid' => $params['userid']]);
        $userprogress = $progresses[$user->id];

        $results = array();
@@ -279,7 +279,8 @@ class completion_criteria_activity extends completion_criteria {
            $details['requirement'][] = get_string('markingyourselfcomplete', 'completion');
        } elseif ($cm->completion == COMPLETION_TRACKING_AUTOMATIC) {
            if ($cm->completionview) {
-                $details['requirement'][] = get_string('viewingactivity', 'completion', $this->module);
+                $modulename = core_text::strtolower(get_string('modulename', $this->module));
+                $details['requirement'][] = get_string('viewingactivity', 'completion', $modulename);
            }

            if (!is_null($cm->completiongradeitemnumber)) {
@@ -72,6 +72,13 @@ class core_completion_api_testcase extends advanced_testcase {
        $this->assertEquals(\core_completion\api::COMPLETION_EVENT_TYPE_DATE_COMPLETION_EXPECTED, $event->eventtype);
        $this->assertEquals($time, $event->timestart);
        $this->assertEquals($time, $event->timesort);
+
+        require_once($CFG->dirroot . '/course/lib.php');
+        // Delete the module.
+        course_delete_module($assign->cmid);
+
+        // Check we don't get a failure when called on a deleted module.
+        \core_completion\api::update_completion_date_event($assign->cmid, 'assign', null, $time);
    }

    public function test_update_completion_date_event_update() {
@@ -259,6 +259,8 @@ $CFG->admin = 'admin';
 //      $CFG->session_memcached_prefix = 'memc.sess.key.';
 //      $CFG->session_memcached_acquire_lock_timeout = 120;
 //      $CFG->session_memcached_lock_expire = 7200;       // Ignored if PECL memcached is below version 2.2.0
+//      $CFG->session_memcached_lock_retry_sleep = 150;   // Spin-lock retry sleeptime (msec). Only effective
+//                                                        // for tuning php-memcached 3.0.x (PHP 7)
 //
 //   Redis session handler (requires redis server and redis extension):
 //      $CFG->session_handler_class = '\core\session\redis';
@@ -88,7 +88,7 @@ class course_edit_form extends moodleform {
            }
        } else {
            if (has_capability('moodle/course:changecategory', $coursecontext)) {
-                $displaylist = coursecat::make_categories_list('moodle/course:create');
+                $displaylist = coursecat::make_categories_list('moodle/course:changecategory');
                if (!isset($displaylist[$course->category])) {
                    //always keep current
                    $displaylist[$course->category] = coursecat::get($course->category, MUST_EXIST, true)->get_formatted_name();
@@ -268,8 +268,9 @@ class core_course_external extends external_api {

                        if (!empty($cm->showdescription) or $cm->modname == 'label') {
                            // We want to use the external format. However from reading get_formatted_content(), $cm->content format is always FORMAT_HTML.
+                            $options = array('noclean' => true);
                            list($module['description'], $descriptionformat) = external_format_text($cm->content,
-                                FORMAT_HTML, $modcontext->id, $cm->modname, 'intro', $cm->id);
+                                FORMAT_HTML, $modcontext->id, $cm->modname, 'intro', $cm->id, $options);
                        }

                        //url of the module
@@ -503,10 +504,10 @@ class core_course_external extends external_api {
                $courseinfo['groupmode'] = $course->groupmode;
                $courseinfo['groupmodeforce'] = $course->groupmodeforce;
                $courseinfo['defaultgroupingid'] = $course->defaultgroupingid;
-                $courseinfo['lang'] = $course->lang;
+                $courseinfo['lang'] = clean_param($course->lang, PARAM_LANG);
                $courseinfo['timecreated'] = $course->timecreated;
                $courseinfo['timemodified'] = $course->timemodified;
-                $courseinfo['forcetheme'] = $course->theme;
+                $courseinfo['forcetheme'] = clean_param($course->theme, PARAM_THEME);
                $courseinfo['enablecompletion'] = $course->enablecompletion;
                $courseinfo['completionnotify'] = $course->completionnotify;
                $courseinfo['courseformatoptions'] = array();
@@ -1725,7 +1726,7 @@ class core_course_external extends external_api {
                        $categoryinfo['visible'] = $category->visible;
                        $categoryinfo['visibleold'] = $category->visibleold;
                        $categoryinfo['timemodified'] = $category->timemodified;
-                        $categoryinfo['theme'] = $category->theme;
+                        $categoryinfo['theme'] = clean_param($category->theme, PARAM_THEME);
                    }

                    $categoriesinfo[] = $categoryinfo;
@@ -3067,6 +3068,14 @@ class core_course_external extends external_api {
            foreach ($coursefields as $field) {
                $coursesdata[$course->id][$field] = $course->{$field};
            }
+
+            // Clean lang and auth fields for external functions (it may content uninstalled themes or language packs).
+            if (isset($coursesdata[$course->id]['theme'])) {
+                $coursesdata[$course->id]['theme'] = clean_param($coursesdata[$course->id]['theme'], PARAM_THEME);
+            }
+            if (isset($coursesdata[$course->id]['lang'])) {
+                $coursesdata[$course->id]['lang'] = clean_param($coursesdata[$course->id]['lang'], PARAM_LANG);
+            }
        }

        return array(
@@ -3135,6 +3144,7 @@ class core_course_external extends external_api {
     */
    public static function check_updates($courseid, $tocheck, $filter = array()) {
        global $CFG, $DB;
+        require_once($CFG->dirroot . "/course/lib.php");

        $params = self::validate_parameters(
            self::check_updates_parameters(),
@@ -13,10 +13,6 @@
    padding: 0 6px;
 }

-.course-content ul.topics li.section .right img.icon {
-    padding: 0 0 4px 0;
-}
-
 .course-content ul.topics li.section .left {
    padding-top: 22px;
    text-align: right;
@@ -13,10 +13,6 @@
    padding: 0 6px;
 }

-.course-content ul.weeks li.section .right img.icon {
-    padding: 0 0 4px 0;
-}
-
 .course-content ul.weeks li.section .left {
    padding-top: 22px;
    text-align: right;
@@ -1403,7 +1403,9 @@ function course_module_update_calendar_events($modulename, $instance = null, $cm
        if (!isset($cm)) {
            $cm = get_coursemodule_from_instance($modulename, $instance->id, $instance->course);
        }
-        course_module_calendar_event_update_process($instance, $cm);
+        if (!empty($cm)) {
+            course_module_calendar_event_update_process($instance, $cm);
+        }
        return true;
    }
    return false;
@@ -1432,8 +1434,9 @@ function course_module_bulk_update_calendar_events($modulename, $courseid = 0) {
    }

    foreach ($instances as $instance) {
-        $cm = get_coursemodule_from_instance($modulename, $instance->id, $instance->course);
-        course_module_calendar_event_update_process($instance, $cm);
+        if ($cm = get_coursemodule_from_instance($modulename, $instance->id, $instance->course)) {
+            course_module_calendar_event_update_process($instance, $cm);
+        }
    }
    return true;
 }
@@ -636,7 +636,7 @@ class core_course_renderer extends plugin_renderer_base {
            }
        } else {
            $linkclasses .= ' dimmed';
-            $textclasses .= ' dimmed_text';
+            $textclasses .= ' dimmed dimmed_text';
        }
        return array($linkclasses, $textclasses);
    }
@@ -2209,6 +2209,21 @@ class core_course_externallib_testcase extends externallib_advanced_testcase {
        $this->assertCount(0, $result['courses']);
    }

+    /**
+     * Test get_courses_by_field_invalid_theme_and_lang
+     */
+    public function test_get_courses_by_field_invalid_theme_and_lang() {
+        $this->resetAfterTest(true);
+        $this->setAdminUser();
+
+        $course = self::getDataGenerator()->create_course(array('theme' => 'kkt', 'lang' => 'kkl'));
+        $result = core_course_external::get_courses_by_field('id', $course->id);
+        $result = external_api::clean_returnvalue(core_course_external::get_courses_by_field_returns(), $result);
+        $this->assertEmpty($result['courses']['0']['theme']);
+        $this->assertEmpty($result['courses']['0']['lang']);
+    }
+
+
    public function test_check_updates() {
        global $DB;
        $this->resetAfterTest(true);
@@ -25,4 +25,4 @@
 $string['category:config'] = 'Configure category enrol instances';
 $string['category:synchronised'] = 'Role assignments synchronised to course enrolment';
 $string['pluginname'] = 'Category enrolments';
-$string['pluginname_desc'] = 'Category enrolment plugin is a legacy solution for enrolments at the course category level via role assignments. It is recommended to use cohort synchronisation instead.';
+$string['pluginname_desc'] = 'The category enrolments plugin synchronises any role assignments in the category context for roles with the capability enrol/category:synchronised allowed.';
@@ -253,7 +253,7 @@ class core_enrol_external extends external_api {
                    'preferences' => new external_multiple_structure(
                        new external_single_structure(
                            array(
-                                'name'  => new external_value(PARAM_ALPHANUMEXT, 'The name of the preferences'),
+                                'name'  => new external_value(PARAM_RAW, 'The name of the preferences'),
                                'value' => new external_value(PARAM_RAW, 'The value of the custom field'),
                            )
                    ), 'User preferences', VALUE_OPTIONAL),
@@ -342,7 +342,7 @@ class core_enrol_external extends external_api {
                'summaryformat' => $course->summaryformat,
                'format' => $course->format,
                'showgrades' => $course->showgrades,
-                'lang' => $course->lang,
+                'lang' => clean_param($course->lang, PARAM_LANG),
                'enablecompletion' => $course->enablecompletion,
                'category' => $course->category,
                'progress' => $progress,
@@ -634,7 +634,7 @@ class core_enrol_external extends external_api {
                    'preferences' => new external_multiple_structure(
                        new external_single_structure(
                            array(
-                                'name'  => new external_value(PARAM_ALPHANUMEXT, 'The name of the preferences'),
+                                'name'  => new external_value(PARAM_RAW, 'The name of the preferences'),
                                'value' => new external_value(PARAM_RAW, 'The value of the custom field'),
                            )
                    ), 'User preferences', VALUE_OPTIONAL),
@@ -206,7 +206,7 @@ class enrol_imsenterprise_testcase extends advanced_testcase {
        $this->set_xml_file(array($imsuser));

        $this->imsplugin->cron();
-        $this->assertEquals(1, $DB->get_field('user', 'deleted', array('id' => $user->id), '*', MUST_EXIST));
+        $this->assertEquals(1, $DB->get_field('user', 'deleted', array('id' => $user->id), MUST_EXIST));
    }

    /**
@@ -227,7 +227,7 @@ class enrol_imsenterprise_testcase extends advanced_testcase {
        $this->set_xml_file(array($imsuser));

        $this->imsplugin->cron();
-        $this->assertEquals(0, $DB->get_field('user', 'deleted', array('id' => $user->id), '*', MUST_EXIST));
+        $this->assertEquals(0, $DB->get_field('user', 'deleted', array('id' => $user->id), MUST_EXIST));
    }

    /**
@@ -376,8 +376,12 @@ class core_enrol_externallib_testcase extends externallib_advanced_testcase {
            'enddate'          => $timenow + WEEKSECS
        );

+        $coursedata2 = array(
+            'lang'             => 'kk', // Check invalid language pack.
+        );
+
        $course1 = self::getDataGenerator()->create_course($coursedata1);
-        $course2 = self::getDataGenerator()->create_course();
+        $course2 = self::getDataGenerator()->create_course($coursedata2);
        $courses = array($course1, $course2);

        // Enrol $USER in the courses.
@@ -414,6 +418,9 @@ class core_enrol_externallib_testcase extends externallib_advanced_testcase {
                foreach ($coursedata1 as $fieldname => $value) {
                    $this->assertEquals($courseenrol[$fieldname], $course1->$fieldname);
                }
+            } else {
+                // Check language pack. Should be empty since an incorrect one was used when creating the course.
+                $this->assertEmpty($courseenrol['lang']);
            }
        }
    }
@@ -127,7 +127,7 @@ class converter {
        if ($status === conversion::STATUS_PENDING || $status === conversion::STATUS_FAILED) {
            // The current status is either pending or failed.
            // Attempt to pick up a new converter and convert the document.
-            $from = \core_filetypes::get_file_extension($file->get_mimetype());
+            $from = pathinfo($file->get_filename(), PATHINFO_EXTENSION);
            $converters = $this->get_document_converter_classes($from, $format);
            $currentconverter = $this->get_next_converter($converters, $conversion->get('converter'));

@@ -225,9 +225,9 @@ class converter {
            return false;
        }

-        $from = \core_filetypes::get_file_extension($file->get_mimetype());
+        $from = pathinfo($file->get_filename(), PATHINFO_EXTENSION);
        if (!$from) {
-            // No mime type could be found. Unable to determine converter.
+            // No file extension could be found. Unable to determine converter.
            return false;
        }

@@ -47,7 +47,8 @@ class converter implements \core_files\converter_interface {
        'xls' => 'application/vnd.google-apps.spreadsheet',
        'xlsx' => 'application/vnd.google-apps.spreadsheet',
        'ppt' => 'application/vnd.google-apps.presentation',
-        'pptx' => 'application/vnd.google-apps.presentation'
+        'pptx' => 'application/vnd.google-apps.presentation',
+        'html' => 'application/vnd.google-apps.document'
    ];

    /** @var array $export List of supported export file formats */
@@ -265,6 +266,6 @@ class converter implements \core_files\converter_interface {
     * @return  string
     */
    public function get_supported_conversions() {
-        return implode(', ', ['rtf', 'doc', 'xls', 'docx', 'xlsx', 'ppt', 'pptx', 'pdf']);
+        return implode(', ', ['rtf', 'doc', 'xls', 'docx', 'xlsx', 'ppt', 'pptx', 'pdf', 'html']);
    }
 }
@@ -24,6 +24,8 @@
 * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
 */

+defined('MOODLE_INTERNAL') || die();
+
 require_once("$CFG->libdir/externallib.php");
 require_once("$CFG->libdir/filelib.php");

@@ -341,7 +341,7 @@ class core_files_converter_testcase extends advanced_testcase {
    }

    /**
-     * Test the can_convert_storedfile_to function with a file with indistinguished mimetype.
+     * Test the can_convert_storedfile_to function with a file with a known mimetype and extension.
     */
    public function test_can_convert_storedfile_to_docx() {
        $returnvalue = (object) [];
@@ -352,8 +352,7 @@ class core_files_converter_testcase extends advanced_testcase {

        $types = \core_filetypes::get_types();

-        // A file with filename '.' is a directory.
-        $file = $this->get_stored_file('example content', 'example', [
+        $file = $this->get_stored_file('example content', 'example.docx', [
                'mimetype' => $types['docx']['type'],
            ]);

@@ -138,7 +138,8 @@ MathJax.Hub.Config({
        // setting. Since it is preferably to always load the secure resource.

        $httpurl = get_config('filter_mathjaxloader', 'httpurl');
-        if ($httpurl !== 'http://cdn.mathjax.org/mathjax/2.6-latest/MathJax.js') {
+        if ($httpurl !== 'http://cdn.mathjax.org/mathjax/2.6-latest/MathJax.js' &&
+            $httpurl !== 'http://cdn.mathjax.org/mathjax/2.6.1/MathJax.js') {
            // If the http setting has been changed, we make the admin choose the https setting because
            // it indicates some sort of custom setup. This will be supported by the release notes.
            unset_config('httpsurl', 'filter_mathjaxloader');
@@ -200,5 +201,15 @@ MathJax.Hub.Config({
    // Automatically generated Moodle v3.3.0 release upgrade line.
    // Put any upgrade step following this.

+    if ($oldversion < 2017051501) {
+
+        $httpsurl = get_config('filter_mathjaxloader', 'httpsurl');
+        if (empty($httpsurl)) {
+            // URL is empty, most likely because of bad upgrade path. See MDL-59780.
+            set_config('httpsurl', 'https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.1/MathJax.js', 'filter_mathjaxloader');
+        }
+        upgrade_plugin_savepoint(true, 2017051501, 'filter', 'mathjaxloader');
+    }
+
    return true;
 }
@@ -24,6 +24,6 @@

 defined('MOODLE_INTERNAL') || die();

-$plugin->version  = 2017051500;
+$plugin->version  = 2017051501;
 $plugin->requires = 2017050500;  // Requires this Moodle version.
 $plugin->component= 'filter_mathjaxloader';
@@ -185,8 +185,8 @@ class grading_manager {
        } else if ($this->get_context()->contextlevel >= CONTEXT_COURSE) {
            list($context, $course, $cm) = get_context_info_array($this->get_context()->id);

-            if (strval($cm->name) !== '') {
-                $title = $cm->name;
+            if ($cm && strval($cm->name) !== '') {
+                $title = format_string($cm->name, true, array('context' => $context));
            } else {
                debugging('Gradable areas are currently supported at the course module level only', DEBUG_DEVELOPER);
                $title = $this->get_component();
@@ -489,7 +489,7 @@ class grading_manager {
     * Returns the given method's controller in the gradable area
     *
     * @param string $method the method name, eg 'rubric' (must be available)
-     * @return grading_controller
+     * @return gradingform_controller
     */
    public function get_controller($method) {
        global $CFG, $DB;
@@ -534,7 +534,7 @@ class grading_manager {
    /**
     * Returns the controller for the active method if it is available
     *
-     * @return null|grading_controller
+     * @return null|gradingform_controller
     */
    public function get_active_controller() {
        if ($gradingmethod = $this->get_active_method()) {
@@ -17,7 +17,7 @@
 /**
 * Unit tests for grade/edit/tree/lib.php.
 *
- * @pacakge  core_grade
+ * @package  core_grades
 * @category phpunit
 * @author   Andrew Davis
 * @license  http://www.gnu.org/copyleft/gpl.html GNU Public License
@@ -17,7 +17,7 @@
 /**
 * Unit tests for grade/import/lib.php.
 *
- * @package   core_grade
+ * @package   core_grades
 * @category  phpunit
 * @copyright 2015 Adrian Greeve <adrian@moodle.com>
 * @license   http://www.gnu.org/copyleft/gpl.html GNU Public License
@@ -17,7 +17,7 @@
 /**
 * Unit tests for grade quering
 *
- * @pacakge   core_grade
+ * @package   core_grades
 * @category  phpunit
 * @copyright 2011 Petr Skoda {@link http://skodak.org}
 * @license   http://www.gnu.org/copyleft/gpl.html GNU Public License
@@ -17,7 +17,7 @@
 /**
 * Unit tests for grade/report/user/lib.php.
 *
- * @package  core_grade
+ * @package  core_grades
 * @category phpunit
 * @copyright 2012 Andrew Davis
 * @license  http://www.gnu.org/copyleft/gpl.html GNU Public License
@@ -17,7 +17,7 @@
 /**
 * Unit tests for grade/report/lib.php.
 *
- * @pacakge  core_grade
+ * @package  core_grades
 * @category phpunit
 * @author   Andrew Davis
 * @license  http://www.gnu.org/copyleft/gpl.html GNU Public License
--- a/Show More
+++ b/Show More