Moodle release 3.3.3

Automatically generated installer lang files
weekly release 3.3.2+
2017-11-11 19:29:38 +01:00 · 2017-11-11 00:05:47 +00:00 · 2017-11-10 15:15:25 +01:00 · 2017-11-10 15:15:23 +01:00 · 2017-11-10 18:03:31 +13:00 · 2017-11-10 12:06:35 +08:00
818 changed files with 14147 additions and 4001 deletions
@@ -2,7 +2,7 @@
 # process (which uses our internal CI system) this file is here for the benefit
 # of community developers git clones - see MDL-51458.

-sudo: false
+sudo: required

 # We currently disable Travis notifications entirely until https://github.com/travis-ci/travis-ci/issues/4976
 # is fixed.
@@ -17,7 +17,11 @@ php:
    - 5.6

 addons:
-  postgresql: "9.3"
+  postgresql: "9.6"
+  packages:
+    - mysql-server-5.6
+    - mysql-client-core-5.6
+    - mysql-client-5.6

 services:
    - redis-server
@@ -49,12 +53,9 @@ matrix:
    fast_finish: true

    include:
-          # Run grunt/npm install on lowest supported npm version
-        - php: 7.1
-          env: DB=none     TASK=GRUNT   NVM_VERSION='4'
          # Run grunt/npm install on highest version ('node' is an alias for the latest node.js version.)
        - php: 7.1
-          env: DB=none     TASK=GRUNT   NVM_VERSION='node'
+          env: DB=none     TASK=GRUNT   NVM_VERSION='8.9'

    exclude:
        # MySQL - it's just too slow.
@@ -73,6 +74,26 @@ cache:
      - $HOME/.npm

 install:
+    - >
+        if [ "$DB" = 'mysqli' ];
+        then
+            sudo mkdir /mnt/ramdisk
+            sudo mount -t tmpfs -o size=1024m tmpfs /mnt/ramdisk
+            sudo stop mysql
+            sudo mv /var/lib/mysql /mnt/ramdisk
+            sudo ln -s /mnt/ramdisk/mysql /var/lib/mysql
+            sudo start mysql
+        fi
+    - >
+        if [ "$DB" = 'pgsql' ];
+        then
+            sudo mkdir /mnt/ramdisk
+            sudo mount -t tmpfs -o size=1024m tmpfs /mnt/ramdisk
+            sudo service postgresql stop
+            sudo mv /var/lib/postgresql /mnt/ramdisk
+            sudo ln -s /mnt/ramdisk/postgresql /var/lib/postgresql
+            sudo service postgresql start 9.6
+        fi
    - >
        if [ "$TASK" = 'PHPUNIT' ];
        then
@@ -338,7 +338,7 @@ module.exports = function(grunt) {
            opts: {stdio: 'inherit', env: process.env}
        }, function(error, result, code) {
            // Propagate the exit code.
-            done(code);
+            done(code === 0);
        });
    };

@@ -89,7 +89,7 @@ if ($PAGE->user_allowed_editing()) {
 $savebutton = false;
 $outputhtml = '';
 foreach ($settingspage->children as $childpage) {
-    if ($childpage->is_hidden()) {
+    if ($childpage->is_hidden() || !$childpage->check_access()) {
        continue;
    }
    if ($childpage instanceof admin_externalpage) {
@@ -53,7 +53,7 @@ Options:
 -h, --help            Print out this help

 Example:
-\$ sudo -u www-data /usr/bin/php admin/cli/mysql_collation.php --collation=utf8_general_ci
+\$ sudo -u www-data /usr/bin/php admin/cli/mysql_collation.php --collation=utf8mb4_unicode_ci
 ";

 if (!empty($options['collation'])) {
@@ -145,9 +145,22 @@ if (!empty($options['collation'])) {
            $skipped++;

        } else {
-            $DB->change_database_structure("ALTER TABLE $table->name DEFAULT CHARACTER SET $charset DEFAULT COLLATE = $collation");
-            echo "CONVERTED\n";
-            $converted++;
+            try {
+                $DB->change_database_structure("ALTER TABLE $table->name CONVERT TO CHARACTER SET $charset COLLATE $collation");
+                echo "CONVERTED\n";
+                $converted++;
+            } catch (ddl_exception $e) {
+                $result = mysql_set_row_format($table->name, $charset, $collation, $engine);
+                if ($result) {
+                    echo "CONVERTED\n";
+                    $converted++;
+                } else {
+                    // We don't know what the problem is. Stop the conversion.
+                    cli_error("Error: Tried to convert $table->name, but there was a problem. Please check the details of this
+                            table and try again.");
+                    die();
+                }
+            }
        }

        $sql = "SHOW FULL COLUMNS FROM $table->name WHERE collation IS NOT NULL";
@@ -190,7 +203,7 @@ if (!empty($options['collation'])) {
                $DB->change_database_structure($sql);
            } else {
                echo "ERROR (unknown column type: $column->type)\n";
-                $error++;
+                $errors++;
                continue;
            }
            echo "CONVERTED\n";
@@ -290,3 +303,26 @@ function mysql_get_column_collations($tablename) {
    $rs->close();
    return $collations;
 }
+
+function mysql_set_row_format($tablename, $charset, $collation, $engine) {
+    global $DB;
+
+    $sql = "SELECT row_format
+              FROM INFORMATION_SCHEMA.TABLES
+             WHERE table_schema = DATABASE() AND table_name = ?";
+    $rs = $DB->get_record_sql($sql, array($tablename));
+    if ($rs) {
+        if ($rs->row_format == 'Compact' || $rs->row_format == 'Redundant') {
+            $rowformat = $DB->get_row_format_sql($engine, $collation);
+            // Try to convert to compressed format and then try updating the collation again.
+            $DB->change_database_structure("ALTER TABLE $tablename $rowformat");
+            $DB->change_database_structure("ALTER TABLE $tablename CONVERT TO CHARACTER SET $charset COLLATE $collation");
+        } else {
+            // Row format may not be the problem. Can not diagnose problem. Send fail reply.
+            return false;
+        }
+    } else {
+        return false;
+    }
+    return true;
+}
@@ -1754,6 +1754,7 @@
      <VENDOR name="oracle" version="10.2" />
    </DATABASE>
    <PHP version="5.6.5" level="required">
+      <RESTRICT function="restrict_php_version_72" message="unsupportedphpversion72" />
    </PHP>
    <PCREUNICODE level="optional">
      <FEEDBACK>
@@ -1919,6 +1920,7 @@
      <VENDOR name="oracle" version="10.2" />
    </DATABASE>
    <PHP version="5.6.5" level="required">
+      <RESTRICT function="restrict_php_version_72" message="unsupportedphpversion72" />
    </PHP>
    <PCREUNICODE level="optional">
      <FEEDBACK>
@@ -2081,4 +2083,180 @@
      </CUSTOM_CHECK>
    </CUSTOM_CHECKS>
  </MOODLE>
+  <MOODLE version="3.4" requires="3.0">
+    <UNICODE level="required">
+      <FEEDBACK>
+        <ON_ERROR message="unicoderequired" />
+      </FEEDBACK>
+    </UNICODE>
+    <DATABASE level="required">
+      <VENDOR name="mariadb" version="5.5.31" />
+      <VENDOR name="mysql" version="5.5.31" />
+      <VENDOR name="postgres" version="9.3" />
+      <VENDOR name="mssql" version="10.0" />
+      <VENDOR name="oracle" version="10.2" />
+    </DATABASE>
+    <PHP version="7.0.0" level="required">
+    </PHP>
+    <PCREUNICODE level="optional">
+      <FEEDBACK>
+        <ON_CHECK message="pcreunicodewarning" />
+      </FEEDBACK>
+    </PCREUNICODE>
+    <PHP_EXTENSIONS>
+      <PHP_EXTENSION name="iconv" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="iconvrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="mbstring" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="mbstringrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="curl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="curlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="openssl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="opensslrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="tokenizer" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="tokenizerrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlrpc" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="xmlrpcrecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="soap" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="soaprecommended" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="ctype" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ctyperequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zip" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="ziprequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="zlib" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="gd" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="gdrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="simplexml" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="simplexmlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="spl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="splrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="pcre" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="dom" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xml" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="xmlreader" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="intl" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="intlrequired" />
+        </FEEDBACK>
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="json" level="required">
+      </PHP_EXTENSION>
+      <PHP_EXTENSION name="hash" level="required"/>
+      <PHP_EXTENSION name="fileinfo" level="required"/>
+    </PHP_EXTENSIONS>
+    <PHP_SETTINGS>
+      <PHP_SETTING name="memory_limit" value="96M" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="settingmemorylimit" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="file_uploads" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="settingfileuploads" />
+        </FEEDBACK>
+      </PHP_SETTING>
+      <PHP_SETTING name="opcache.enable" value="1" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="opcacherecommended" />
+        </FEEDBACK>
+      </PHP_SETTING>
+    </PHP_SETTINGS>
+    <CUSTOM_CHECKS>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_storage_engine" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbstorageengine" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="question/engine/upgrade/upgradelib.php" function="quiz_attempts_upgraded" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="quizattemptsupgradedmessage" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_slasharguments" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="slashargumentswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_database_tables_row_format" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unsupporteddbtablerowformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_unoconv_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="unoconvwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_libcurl_version" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="libcurlwarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_format" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfileformat" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_file_per_table" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddbfilepertable" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_large_prefix" level="required">
+        <FEEDBACK>
+          <ON_ERROR message="unsupporteddblargeprefix" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_is_https" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="ishttpswarning" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+      <CUSTOM_CHECK file="lib/upgradelib.php" function="check_mysql_incomplete_unicode_support" level="optional">
+        <FEEDBACK>
+          <ON_CHECK message="incompleteunicodesupport" />
+        </FEEDBACK>
+      </CUSTOM_CHECK>
+    </CUSTOM_CHECKS>
+  </MOODLE>
 </COMPATIBILITY_MATRIX>
@@ -869,10 +869,17 @@ $cachewarnings = cache_helper::warnings();
 $eventshandlers = $DB->get_records_sql('SELECT DISTINCT component FROM {events_handlers}');
 $themedesignermode = !empty($CFG->themedesignermode);

+// Check if a directory with development libraries exists.
+if (is_dir($CFG->dirroot.'/vendor') || is_dir($CFG->dirroot.'/node_modules')) {
+    $devlibdir = true;
+} else {
+    $devlibdir = false;
+}
+
 admin_externalpage_setup('adminnotifications');

 $output = $PAGE->get_renderer('core', 'admin');

 echo $output->admin_notifications_page($maturity, $insecuredataroot, $errorsdisplayed, $cronoverdue, $dbproblems,
                                       $maintenancemode, $availableupdates, $availableupdatesfetch, $buggyiconvnomb,
-                                       $registered, $cachewarnings, $eventshandlers, $themedesignermode);
+                                       $registered, $cachewarnings, $eventshandlers, $themedesignermode, $devlibdir);
@@ -128,7 +128,7 @@ class hub_selector_form extends moodleform {

        //remove moodle.org from the hub list
        foreach ($hubs as $key => $hub) {
-            if ($hub['url'] == HUB_MOODLEORGHUBURL) {
+            if ($hub['url'] == HUB_MOODLEORGHUBURL || $hub['url'] == HUB_OLDMOODLEORGHUBURL) {
                unset($hubs[$key]);
            }
        }
@@ -225,19 +225,25 @@ class site_registration_form extends moodleform {
        $imageurl = get_config('hub', 'site_imageurl_' . $cleanhuburl);
        $privacy = get_config('hub', 'site_privacy_' . $cleanhuburl);
        $address = get_config('hub', 'site_address_' . $cleanhuburl);
+        if ($address === false) {
+            $address = '';
+        }
        $region = get_config('hub', 'site_region_' . $cleanhuburl);
        $country = get_config('hub', 'site_country_' . $cleanhuburl);
-        if ($country === false) {
-            $country = $admin->country;
+        if (empty($country)) {
+            $country = $admin->country ?: $CFG->country;
        }
        $language = get_config('hub', 'site_language_' . $cleanhuburl);
        if ($language === false) {
-            $language = current_language();
+            $language = explode('_', current_language())[0];
        }
        $geolocation = get_config('hub', 'site_geolocation_' . $cleanhuburl);
+        if ($geolocation === false) {
+            $geolocation = '';
+        }
        $contactable = get_config('hub', 'site_contactable_' . $cleanhuburl);
        $emailalert = get_config('hub', 'site_emailalert_' . $cleanhuburl);
-        $emailalert = ($emailalert === 0) ? 0 : 1;
+        $emailalert = ($emailalert === false || $emailalert) ? 1 : 0;
        $coursesnumber = get_config('hub', 'site_coursesnumber_' . $cleanhuburl);
        $usersnumber = get_config('hub', 'site_usersnumber_' . $cleanhuburl);
        $roleassignmentsnumber = get_config('hub', 'site_roleassignmentsnumber_' . $cleanhuburl);
@@ -306,11 +312,12 @@ class site_registration_form extends moodleform {
        $mform->addElement('hidden', 'regioncode', '-');
        $mform->setType('regioncode', PARAM_ALPHANUMEXT);

-        $countries = get_string_manager()->get_list_of_countries();
+        $countries = ['' => ''] + get_string_manager()->get_list_of_countries();
        $mform->addElement('select', 'countrycode', get_string('sitecountry', 'hub'), $countries);
        $mform->setDefault('countrycode', $country);
        $mform->setType('countrycode', PARAM_ALPHANUMEXT);
        $mform->addHelpButton('countrycode', 'sitecountry', 'hub');
+        $mform->addRule('countrycode', $strrequired, 'required', null, 'client');

        $mform->addElement('text', 'geolocation', get_string('sitegeolocation', 'hub'),
                array('class' => 'registration_textfield'));
@@ -328,6 +335,7 @@ class site_registration_form extends moodleform {
        $mform->addElement('text', 'contactphone', get_string('sitephone', 'hub'),
                array('class' => 'registration_textfield'));
        $mform->setType('contactphone', PARAM_TEXT);
+        $mform->setDefault('contactphone', $contactphone);
        $mform->addHelpButton('contactphone', 'sitephone', 'hub');
        $mform->setForceLtr('contactphone');

@@ -181,13 +181,8 @@ if (empty($cancel) and $unregistration and !$confirm) {
    echo $OUTPUT->header();

    //check if the site is registered on Moodle.org and display a message about registering on MOOCH
-    $registered = $DB->count_records('registration_hubs', array('huburl' => HUB_MOODLEORGHUBURL, 'confirmed' => 1));
-    if (empty($registered)) {
-        $warningmsg = get_string('registermoochtips', 'hub');
-        $warningmsg .= $renderer->single_button(new moodle_url('register.php', array('huburl' => HUB_MOODLEORGHUBURL
-                    , 'hubname' => 'Moodle.org')), get_string('register', 'admin'));
-        echo $renderer->box($warningmsg, 'buttons mdl-align generalbox adminwarning');
-    }
+    $adminrenderer = $PAGE->get_renderer('core', 'admin');
+    echo $adminrenderer->warn_if_not_registered();

    //do not check sesskey if confirm = false because this script is linked into email message
    if (!empty($errormessage)) {
@@ -180,17 +180,19 @@ if (!empty($error)) {

 // Some Moodle.org registration explanation.
 if ($huburl == HUB_MOODLEORGHUBURL) {
+    $notificationtype = \core\output\notification::NOTIFY_ERROR;
    if (!empty($registeredhub->token)) {
        if ($registeredhub->timemodified == 0) {
            $registrationmessage = get_string('pleaserefreshregistrationunknown', 'admin');
        } else {
            $lastupdated = userdate($registeredhub->timemodified, get_string('strftimedate', 'langconfig'));
            $registrationmessage = get_string('pleaserefreshregistration', 'admin', $lastupdated);
+            $notificationtype = \core\output\notification::NOTIFY_INFO;
        }
    } else {
        $registrationmessage = get_string('registrationwarning', 'admin');
    }
-    echo $OUTPUT->notification($registrationmessage);
+    echo $OUTPUT->notification($registrationmessage, $notificationtype);

    echo $OUTPUT->heading(get_string('registerwithmoodleorg', 'admin'));
    $renderer = $PAGE->get_renderer('core', 'register');
@@ -276,12 +276,15 @@ class core_admin_renderer extends plugin_renderer_base {
     * @param int|null $availableupdatesfetch timestamp of the most recent updates fetch or null (unknown)
     * @param string[] $cachewarnings An array containing warnings from the Cache API.
     * @param array $eventshandlers Events 1 API handlers.
+     * @param bool $themedesignermode Warn about the theme designer mode.
+     * @param bool $devlibdir Warn about development libs directory presence.
     *
     * @return string HTML to output.
     */
    public function admin_notifications_page($maturity, $insecuredataroot, $errorsdisplayed,
            $cronoverdue, $dbproblems, $maintenancemode, $availableupdates, $availableupdatesfetch,
-            $buggyiconvnomb, $registered, array $cachewarnings = array(), $eventshandlers = 0, $themedesignermode = false) {
+            $buggyiconvnomb, $registered, array $cachewarnings = array(), $eventshandlers = 0,
+            $themedesignermode = false, $devlibdir = false) {
        global $CFG;
        $output = '';

@@ -290,6 +293,7 @@ class core_admin_renderer extends plugin_renderer_base {
        $output .= $this->legacy_log_store_writing_error();
        $output .= empty($CFG->disableupdatenotifications) ? $this->available_updates($availableupdates, $availableupdatesfetch) : '';
        $output .= $this->insecure_dataroot_warning($insecuredataroot);
+        $output .= $this->development_libs_directories_warning($devlibdir);
        $output .= $this->themedesignermode_warning($themedesignermode);
        $output .= $this->display_errors_warning($errorsdisplayed);
        $output .= $this->buggy_iconv_warning($buggyiconvnomb);
@@ -520,6 +524,24 @@ class core_admin_renderer extends plugin_renderer_base {
        }
    }

+    /**
+     * Render a warning that a directory with development libs is present.
+     *
+     * @param bool $devlibdir True if the warning should be displayed.
+     * @return string
+     */
+    protected function development_libs_directories_warning($devlibdir) {
+
+        if ($devlibdir) {
+            $moreinfo = new moodle_url('/report/security/index.php');
+            $warning = get_string('devlibdirpresent', 'core_admin', ['moreinfourl' => $moreinfo->out()]);
+            return $this->warning($warning, 'error');
+
+        } else {
+            return '';
+        }
+    }
+
    /**
     * Render an appropriate message if dataroot is insecure.
     * @param bool $errorsdisplayed
@@ -782,17 +804,37 @@ class core_admin_renderer extends plugin_renderer_base {

        if (!$registered) {

-            $registerbutton = $this->single_button(new moodle_url('/admin/registration/register.php',
-                    array('huburl' =>  HUB_MOODLEORGHUBURL, 'hubname' => 'Moodle.org')),
+            if (has_capability('moodle/site:config', context_system::instance())) {
+                $registerbutton = $this->single_button(new moodle_url('/admin/registration/register.php',
+                    array('huburl' =>  HUB_MOODLEORGHUBURL, 'hubname' => 'Moodle.net')),
                    get_string('register', 'admin'));
+                $str = 'registrationwarning';
+            } else {
+                $registerbutton = '';
+                $str = 'registrationwarningcontactadmin';
+            }

-            return $this->warning( get_string('registrationwarning', 'admin')
-                    . '&nbsp;' . $this->help_icon('registration', 'admin') . $registerbutton );
+            return $this->warning( get_string($str, 'admin')
+                    . '&nbsp;' . $this->help_icon('registration', 'admin') . $registerbutton ,
+                'error alert alert-danger');
        }

        return '';
    }

+    /**
+     * Return an admin page warning if site is not registered with moodle.org
+     *
+     * @since Moodle 3.3.2
+     * @return string
+     */
+    public function warn_if_not_registered() {
+        global $CFG;
+        require_once($CFG->dirroot . '/' . $CFG->admin . '/registration/lib.php');
+        $registrationmanager = new registration_manager();
+        return $this->registration_warning($registrationmanager->get_registeredhub(HUB_MOODLEORGHUBURL) ? true : false);
+    }
+
    /**
     * Helper method to render the information about the available Moodle update
     *
@@ -183,9 +183,14 @@ abstract class core_role_capability_table_with_risks extends core_role_capabilit
    public function get_risk_icon($type) {
        global $OUTPUT;

-        $text = $OUTPUT->pix_icon('i/' . str_replace('risk', 'risk_', $type), get_string($type . 'short', 'admin'));
+        $alt = get_string("{$type}short", "admin");
+        $title = get_string($type, "admin");
+
+        $text = $OUTPUT->pix_icon('i/' . str_replace('risk', 'risk_', $type), $alt, 'moodle', [
+                'title' => $title,
+            ]);
        $action = new popup_action('click', $this->risksurl, 'docspopup');
-        $riskicon = $OUTPUT->action_link($this->risksurl, $text, $action, array('title'=>get_string($type, 'admin')));
+        $riskicon = $OUTPUT->action_link($this->risksurl, $text, $action);

        return $riskicon;
    }
@@ -193,8 +193,8 @@ function print_report_tree($contextid, $contexts, $systemcontext, $fullname, $al
                $strgoto = get_string('gotoassignroles', 'core_role', $a);
                $strcheck = get_string('checkuserspermissionshere', 'core_role', $a);
            }
-            echo ' <a title="' . $strgoto . '" href="' . $raurl . '">' . $OUTPUT->pix_icon('t/edit', 'core', $stredit) . '</a> ';
-            echo ' <a title="' . $strcheck . '" href="' . $churl . '">' . $OUTPUT->pix_icon('t/preview', 'core', $strcheckpermissions) . '</a> ';
+            echo ' <a title="' . $strgoto . '" href="' . $raurl . '">' . $OUTPUT->pix_icon('t/edit', $stredit) . '</a> ';
+            echo ' <a title="' . $strcheck . '" href="' . $churl . '">' . $OUTPUT->pix_icon('t/preview', $strcheckpermissions) . '</a> ';
            echo "</p>\n";
        }
    }
@@ -5,11 +5,19 @@
 require_once('../config.php');
 require_once($CFG->libdir.'/adminlib.php');

+redirect_if_major_upgrade_required();
+
 $query = trim(optional_param('query', '', PARAM_NOTAGS));  // Search string

 $context = context_system::instance();
 $PAGE->set_context($context);

+$hassiteconfig = has_capability('moodle/site:config', $context);
+
+if ($hassiteconfig && moodle_needs_upgrading()) {
+    redirect(new moodle_url('/admin/index.php'));
+}
+
 admin_externalpage_setup('search', '', array('query' => $query)); // now hidden page

 $adminroot = admin_get_root(); // need all settings here
@@ -38,6 +46,12 @@ if ($data = data_submitted() and confirm_sesskey() and isset($data->action) and
 // to modify them
 echo $OUTPUT->header($focus);

+// Display a warning if site is not registered.
+if (empty($query)) {
+    $adminrenderer = $PAGE->get_renderer('core', 'admin');
+    echo $adminrenderer->warn_if_not_registered();
+}
+
 echo $OUTPUT->heading(get_string('administrationsite'));

 if ($errormsg !== '') {
@@ -49,7 +63,7 @@ if ($errormsg !== '') {

 $showsettingslinks = true;

-if (has_capability('moodle/site:config', $context)) {
+if ($hassiteconfig) {
    require_once("admin_settings_search_form.php");
    $form = new admin_settings_search_form();
    $form->display();
@@ -179,10 +179,11 @@ preferences,moodle|/user/preferences.php|preferences',
        'idnumber' => new lang_string('sort_idnumber', 'admin'),
    );
    $temp->add(new admin_setting_configselect('navsortmycoursessort', new lang_string('navsortmycoursessort', 'admin'), new lang_string('navsortmycoursessort_help', 'admin'), 'sortorder', $sortoptions));
-    $temp->add(new admin_setting_configtext('navcourselimit',new lang_string('navcourselimit','admin'),new lang_string('confignavcourselimit', 'admin'),20,PARAM_INT));
+    $temp->add(new admin_setting_configtext('navcourselimit', new lang_string('navcourselimit', 'admin'),
+        new lang_string('confignavcourselimit', 'admin'), 10, PARAM_INT));
    $temp->add(new admin_setting_configcheckbox('usesitenameforsitepages', new lang_string('usesitenameforsitepages', 'admin'), new lang_string('configusesitenameforsitepages', 'admin'), 0));
    $temp->add(new admin_setting_configcheckbox('linkadmincategories', new lang_string('linkadmincategories', 'admin'), new lang_string('linkadmincategories_help', 'admin'), 1));
-    $temp->add(new admin_setting_configcheckbox('linkcoursesections', new lang_string('linkcoursesections', 'admin'), new lang_string('linkcoursesections_help', 'admin'), 0));
+    $temp->add(new admin_setting_configcheckbox('linkcoursesections', new lang_string('linkcoursesections', 'admin'), new lang_string('linkcoursesections_help', 'admin'), 1));
    $temp->add(new admin_setting_configcheckbox('navshowfrontpagemods', new lang_string('navshowfrontpagemods', 'admin'), new lang_string('navshowfrontpagemods_help', 'admin'), 1));
    $temp->add(new admin_setting_configcheckbox('navadduserpostslinks', new lang_string('navadduserpostslinks', 'admin'), new lang_string('navadduserpostslinks_help', 'admin'), 1));

@@ -232,7 +232,7 @@ if ($hassiteconfig) {

    // Convert plugins.
    $ADMIN->add('modules', new admin_category('fileconverterplugins', new lang_string('type_fileconverter_plural', 'plugin')));
-    $temp = new admin_settingpage('managefileconverterplugins', new lang_string('type_fileconverter', 'plugin'));
+    $temp = new admin_settingpage('managefileconverterplugins', new lang_string('type_fileconvertermanage', 'plugin'));
    $temp->add(new admin_setting_manage_fileconverter_plugins());
    $ADMIN->add('fileconverterplugins', $temp);

@@ -55,9 +55,6 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page
    $optionalsubsystems->add(new admin_setting_configcheckbox('enableglobalsearch', new lang_string('enableglobalsearch', 'admin'),
        new lang_string('enableglobalsearch_desc', 'admin'), 0, 1, 0));

-    $choices = array();
-    $choices[0] = new lang_string('no');
-    $choices[1] = new lang_string('yes');
-    $optionalsubsystems->add(new admin_setting_configselect('allowstealth', new lang_string('allowstealthmodules'),
-        new lang_string('allowstealthmodules_help'), 0, $choices));
+    $optionalsubsystems->add(new admin_setting_configcheckbox('allowstealth', new lang_string('allowstealthmodules'),
+        new lang_string('allowstealthmodules_help'), 0, 1, 0));
 }
@@ -11,7 +11,7 @@ $hassiteconfig = has_capability('moodle/site:config', $systemcontext);
 $ADMIN->add('root', new admin_externalpage('adminnotifications', new lang_string('notifications'), "$CFG->wwwroot/$CFG->admin/index.php"));

 $ADMIN->add('root', new admin_externalpage('registrationmoodleorg', new lang_string('registration', 'admin'),
-        "$CFG->wwwroot/$CFG->admin/registration/register.php?huburl=" . HUB_MOODLEORGHUBURL . "&hubname=Moodle.org&sesskey=" . sesskey()));
+        "$CFG->wwwroot/$CFG->admin/registration/register.php?huburl=" . HUB_MOODLEORGHUBURL . "&hubname=Moodle.net&sesskey=" . sesskey()));
 $ADMIN->add('root', new admin_externalpage('registrationhub', new lang_string('registerwith', 'hub'),
        "$CFG->wwwroot/$CFG->admin/registration/register.php", 'moodle/site:config', true));
 $ADMIN->add('root', new admin_externalpage('registrationhubs', new lang_string('hubs', 'admin'),
@@ -24,9 +24,6 @@

 defined('MOODLE_INTERNAL') || die();

-global $CFG;
-require_once($CFG->libdir . '/behat/classes/behat_selectors.php');
-
 /**
 * Renderer for behat tool web features
 *
@@ -44,6 +41,8 @@ class tool_behat_renderer extends plugin_renderer_base {
     * @return string HTML code
     */
    public function render_stepsdefinitions($stepsdefinitions, $form) {
+        global $CFG;
+        require_once($CFG->libdir . '/behat/classes/behat_selectors.php');

        $html = $this->generic_info();

@@ -44,5 +44,8 @@ function xmldb_tool_customlang_upgrade($oldversion) {
    // Automatically generated Moodle v3.2.0 release upgrade line.
    // Put any upgrade step following this.

+    // Automatically generated Moodle v3.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
    return true;
 }
@@ -31,7 +31,7 @@ $string['delete_confirmation'] = 'Are you absolutely sure you want to remove <st
 $string['deletea'] = 'Delete {$a}';
 $string['deletefiletypes'] = 'Delete a file type';
 $string['description'] = 'Custom description';
-$string['description_help'] = 'Simple file type description, e.g. &lsquo;Kindle ebook&rsquo;. If your site supports multiple languages and uses the multi-language filter, you can enter multi-language tags in this field to supply a description in different languages.';
+$string['description_help'] = 'Simple file type description, e.g. \'Kindle ebook\'. If your site supports multiple languages and uses the multi-language filter, you can enter multi-language tags in this field to supply a description in different languages.';
 $string['descriptiontype'] = 'Description type';
 $string['descriptiontype_help'] = 'There are three possible ways to specify a description.

@@ -49,15 +49,15 @@ $string['error_defaulticon'] = 'Another file extension with the same MIME type i
 $string['error_extension'] = 'The file type extension <strong>{$a}</strong> already exists or is invalid. File extensions must be unique and must not contain special characters.';
 $string['error_notfound'] = 'The file type with extension {$a} cannot be found.';
 $string['extension'] = 'Extension';
-$string['extension_help'] = 'File name extension without the dot, e.g. &lsquo;mobi&rsquo;';
+$string['extension_help'] = 'File name extension without the dot, e.g. \'mobi\'';
 $string['groups'] = 'Type groups';
-$string['groups_help'] = 'Optional list of file type groups that this type belongs to. These are generic categories such as &lsquo;document&rsquo; and &lsquo;image&rsquo;.';
+$string['groups_help'] = 'Optional list of file type groups that this type belongs to. These are generic categories such as \'document\' and \'image\'.';
 $string['icon'] = 'File icon';
 $string['icon_help'] = 'Icon filename.

 The list of icons is taken from the /pix/f directory inside your Moodle installation. You can add custom icons to this folder if required.';
 $string['mimetype'] = 'MIME type';
-$string['mimetype_help'] = 'MIME type associated with this file type, e.g. &lsquo;application/x-mobipocket-ebook&rsquo;';
+$string['mimetype_help'] = 'MIME type associated with this file type, e.g. \'application/x-mobipocket-ebook\'';
 $string['pluginname'] = 'File types';
 $string['revert'] = 'Restore {$a} to Moodle defaults';
 $string['revert_confirmation'] = 'Are you sure you want to restore <strong>.{$a}</strong> to Moodle defaults, discarding your changes?';
@@ -40,7 +40,7 @@ if (empty($CFG->langotherroot)) {
 $mode               = optional_param('mode', 0, PARAM_INT);              // action
 $pack               = optional_param_array('pack', array(), PARAM_SAFEDIR);    // pack to install
 $uninstalllang      = optional_param_array('uninstalllang', array(), PARAM_LANG);// installed pack to uninstall
-$confirmtounistall  = optional_param('confirmtouninstall', '', PARAM_ALPHAEXT);  // uninstallation confirmation
+$confirmtounistall  = optional_param('confirmtouninstall', '', PARAM_SAFEPATH);  // uninstallation confirmation
 $purgecaches        = optional_param('purgecaches', false, PARAM_BOOL);  // explicit caches reset

 if ($purgecaches) {
@@ -74,7 +74,7 @@ if ($mode == DELETION_OF_SELECTED_LANG and (!empty($uninstalllang) or !empty($co
    // Actually deleting languages, languages to delete are passed as GET parameter as string
    // ...need to populate them to array.
    if (empty($uninstalllang)) {
-        $uninstalllang = explode('-', $confirmtounistall);
+        $uninstalllang = explode('/', $confirmtounistall);
    }

    if (in_array('en', $uninstalllang)) {
@@ -84,8 +84,10 @@ if ($mode == DELETION_OF_SELECTED_LANG and (!empty($uninstalllang) or !empty($co
    } else if (empty($confirmtounistall) and confirm_sesskey()) { // User chose langs to be deleted, show confirmation.
        echo $OUTPUT->header();
        echo $OUTPUT->confirm(get_string('uninstallconfirm', 'tool_langimport', implode(', ', $uninstalllang)),
-                     'index.php?mode='.DELETION_OF_SELECTED_LANG.'&confirmtouninstall='.implode('-', $uninstalllang),
-                     'index.php');
+            new moodle_url($PAGE->url, array(
+                'mode' => DELETION_OF_SELECTED_LANG,
+                'confirmtouninstall' => implode('/', $uninstalllang),
+            )), $PAGE->url);
        echo $OUTPUT->footer();
        die;

@@ -84,8 +84,7 @@ abstract class restore_tool_log_logstore_subplugin extends restore_subplugin {
            }
        }

-        // Roll dates.
-        $data->timecreated = $this->apply_date_offset($data->timecreated);
+        // There is no need to roll dates. Logs are supposed to be immutable. See MDL-44961.

        // Revert other to its original php way.
        $data->other = unserialize(base64_decode($data->other));
@@ -48,5 +48,8 @@ function xmldb_tool_log_upgrade($oldversion) {
    // Automatically generated Moodle v3.2.0 release upgrade line.
    // Put any upgrade step following this.

+    // Automatically generated Moodle v3.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
    return true;
 }
@@ -88,6 +88,7 @@ class store implements \tool_log\log\writer, \core\log\sql_reader {
        $dboptions['dbport'] = $this->get_config('dbport', '');
        $dboptions['dbschema'] = $this->get_config('dbschema', '');
        $dboptions['dbcollation'] = $this->get_config('dbcollation', '');
+        $dboptions['dbhandlesoptions'] = $this->get_config('dbhandlesoptions', false);
        try {
            $db->connect($this->get_config('dbhost'), $this->get_config('dbuser'), $this->get_config('dbpass'),
                $this->get_config('dbname'), false, $dboptions);
@@ -42,5 +42,8 @@ function xmldb_logstore_database_upgrade($oldversion) {
    // Automatically generated Moodle v3.2.0 release upgrade line.
    // Put any upgrade step following this.

+    // Automatically generated Moodle v3.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
    return true;
 }
@@ -31,6 +31,8 @@ $string['databasesettings_help'] = 'Connection details for the external log data
 $string['databasepersist'] = 'Persistent database connections';
 $string['databaseschema'] = 'Database schema';
 $string['databasecollation'] = 'Database collation';
+$string['databasehandlesoptions'] = 'Database handles options';
+$string['databasehandlesoptions_help'] = 'Does the remote database handle its own options.';
 $string['databasetable'] = 'Database table';
 $string['databasetable_help'] = 'Name of the table where logs will be stored. This table should have a structure identical to the one used by logstore_standard (mdl_logstore_standard_log).';
 $string['includeactions'] = 'Include actions of these types';
@@ -54,6 +54,8 @@ if ($hassiteconfig) {
        'logstore_database'), '', ''));
    $settings->add(new admin_setting_configtext('logstore_database/dbcollation', get_string('databasecollation',
        'logstore_database'), '', ''));
+    $settings->add(new admin_setting_configcheckbox('logstore_database/dbhandlesoptions', get_string('databasehandlesoptions',
+        'logstore_database'), get_string('databasehandlesoptions_help', 'logstore_database'), '0'));
    $settings->add(new admin_setting_configtext('logstore_database/buffersize', get_string('buffersize',
        'logstore_database'), get_string('buffersize_help', 'logstore_database'), 50));

@@ -64,6 +64,7 @@ $dboptions['dbsocket'] = get_config('logstore_database', 'dbsocket');
 $dboptions['dbport'] = get_config('logstore_database', 'dbport');
 $dboptions['dbschema'] = get_config('logstore_database', 'dbschema');
 $dboptions['dbcollation'] = get_config('logstore_database', 'dbcollation');
+$dboptions['dbhandlesoptions'] = get_config('logstore_database', 'dbhandlesoptions');

 try {
    $db->connect(get_config('logstore_database', 'dbhost'), get_config('logstore_database', 'dbuser'),
@@ -83,6 +83,11 @@ class logstore_database_store_testcase extends advanced_testcase {
        } else {
            set_config('dbcollation', '', 'logstore_database');
        }
+        if (!empty($CFG->dboptions['dbhandlesoptions'])) {
+            set_config('dbhandlesoptions', $CFG->dboptions['dbhandlesoptions'], 'logstore_database');
+        } else {
+            set_config('dbhandlesoptions', false, 'logstore_database');
+        }

        // Enable logging plugin.
        set_config('enabled_stores', 'logstore_database', 'tool_log');
@@ -0,0 +1,11 @@
+This files describes API changes in the logstore_database code.
+
+=== 3.3.1 ===
+* PostgreSQL connections now use advanced options to reduce connection overhead.  These options are not compatible
+  with some connection poolers.  The dbhandlesoptions parameter has been added to allow the database to configure the
+  required defaults. The parameters that are required in the database are;
+    ALTER DATABASE moodle SET client_encoding = UTF8;
+    ALTER DATABASE moodle SET standard_conforming_strings = on;
+    ALTER DATABASE moodle SET search_path = 'moodle,public';  -- Optional, if you wish to use a custom schema.
+  You can set these options against the database or the moodle user who connects.
+
@@ -24,6 +24,6 @@

 defined('MOODLE_INTERNAL') || die();

-$plugin->version = 2017051500; // The current plugin version (Date: YYYYMMDDXX).
+$plugin->version = 2017051501; // The current plugin version (Date: YYYYMMDDXX).
 $plugin->requires = 2017050500; // Requires this Moodle version.
 $plugin->component = 'logstore_database'; // Full name of the plugin (used for diagnostics).
@@ -59,5 +59,8 @@ function xmldb_logstore_standard_upgrade($oldversion) {
    // Automatically generated Moodle v3.2.0 release upgrade line.
    // Put any upgrade step following this.

+    // Automatically generated Moodle v3.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
    return true;
 }
@@ -51,7 +51,7 @@
            </div>
        </div>
        <div data-region="footer" class="pull-xs-right">
-            <input type="button" data-action="rate" value="{{#str}}rate, tool_lp{{/str}}" class="btn btn-primary">
+            <button data-action="rate" class="btn btn-primary">{{#str}}rate, tool_lp{{/str}}</button>
            <button data-action="cancel" class="btn btn-secondary">{{#str}}cancel{{/str}}</button>
        </div>
        <div class="clearfix"></div>
@@ -60,7 +60,7 @@
        <div data-region="rule-base" class="form">
            <div data-region="rule-outcome" class="form-group">
                <label>{{#str}}outcome, tool_lp{{/str}}</label>
-                <select name="outcome" class="custom-select" ng-label="{{#str}}outcome, tool_lp{{/str}}">
+                <select name="outcome" class="custom-select">
                    {{#outcomes}}
                    <option value="{{code}}" {{#selected}}selected{{/selected}}>{{name}}</option>
                    {{/outcomes}}
@@ -68,7 +68,7 @@
            </div>
            <div data-region="rule-type" class="form-group">
                <label>{{#str}}when, tool_lp{{/str}}</label>
-                <select name="rule" class="custom-select" ng-label="{{#str}}when, tool_lp{{/str}}">
+                <select name="rule" class="custom-select">
                    <option value="-1">{{#str}}choosedots{{/str}}</option>
                    {{#rules}}
                    <option value="{{type}}" {{#selected}}selected{{/selected}}>{{name}}</option>
@@ -81,10 +81,11 @@
        {{/config}}
    </div>

-    <div data-region="footer" class="pull-xs-right">
+    <div data-region="footer" class="pull-xs-right m-t-1">
        {{#config}}
        <input type="button" class="btn btn-primary" data-action="save" value="{{#str}}savechanges{{/str}}"/>
        {{/config}}
        <input type="button" class="btn btn-secondary" data-action="cancel" value="{{#str}}cancel{{/str}}"/>
    </div>
+    <div class="clearfix"></div>
 </div>
@@ -128,7 +128,7 @@ class api {
            'rememberusername' => $CFG->rememberusername,
            'authloginviaemail' => $CFG->authloginviaemail,
            'registerauth' => $CFG->registerauth,
-            'forgottenpasswordurl' => $CFG->forgottenpasswordurl,
+            'forgottenpasswordurl' => clean_param($CFG->forgottenpasswordurl, PARAM_URL), // We may expect a mailto: here.
            'authinstructions' => $authinstructions,
            'authnoneenabled' => (int) is_enabled_auth('none'),
            'enablewebservices' => $CFG->enablewebservices,
@@ -152,10 +152,11 @@ class api {
        $url = new moodle_url("/$CFG->admin/tool/mobile/launch.php");
        $settings['launchurl'] = $url->out(false);

-        if ($logourl = $OUTPUT->get_logo_url()) {
+        // Check that we are receiving a moodle_url object, themes can override get_logo_url and may return incorrect values.
+        if (($logourl = $OUTPUT->get_logo_url()) && $logourl instanceof moodle_url) {
            $settings['logourl'] = $logourl->out(false);
        }
-        if ($compactlogourl = $OUTPUT->get_compact_logo_url()) {
+        if (($compactlogourl = $OUTPUT->get_compact_logo_url()) && $compactlogourl instanceof moodle_url) {
            $settings['compactlogourl'] = $compactlogourl->out(false);
        }

@@ -210,12 +211,17 @@ class api {
        }

        if (empty($section) or $section == 'sitepolicies') {
+            $settings->sitepolicy = $CFG->sitepolicy;
            $settings->disableuserimages = $CFG->disableuserimages;
        }

        if (empty($section) or $section == 'gradessettings') {
            require_once($CFG->dirroot . '/user/lib.php');
-            $settings->mygradesurl = user_mygrades_url()->out(false);
+            $settings->mygradesurl = user_mygrades_url();
+            // The previous function may return moodle_url instances or plain string URLs.
+            if ($settings->mygradesurl instanceof moodle_url) {
+                $settings->mygradesurl = $settings->mygradesurl->out(false);
+            }
        }

        if (empty($section) or $section == 'mobileapp') {
@@ -23,6 +23,7 @@
 */

 namespace tool_mobile;
+defined('MOODLE_INTERNAL') || die();

 require_once("$CFG->libdir/externallib.php");

@@ -24,7 +24,7 @@

 $string['androidappid'] = 'Android app\'s unique identifier';
 $string['androidappid_desc'] = 'This setting may be left as default unless you have a custom Android app.';
-$string['autologinkeygenerationlockout'] = 'Auto-login key generation is blocked because of too many requests within an hour.';
+$string['autologinkeygenerationlockout'] = 'Auto-login key generation is blocked. You need to wait 6 minutes between requests.';
 $string['autologinnotallowedtoadmins'] = 'Auto-login is not allowed for site admins.';
 $string['cachedef_plugininfo'] = 'This stores the list of plugins with mobile addons';
 $string['clickheretolaunchtheapp'] = 'Click here if the app does not open automatically.';
@@ -37,18 +37,20 @@ mm.user.student|Aprendiz|es
 </pre>
 For a complete list of string identifiers, see the documentation.';
 $string['custommenuitems'] = 'Custom menu items';
-$string['custommenuitems_desc'] = 'Additional items can be added to the app\'s main menu by specifying them here. Enter each custom menu item on a new line with format: item text, link URL, link-opening method (inappbrowser, browser or embedded) and language code (optional, for displaying the item to users of the specified language only), separated by pipe characters. For example:
+$string['custommenuitems_desc'] = 'Additional items can be added to the app\'s main menu by specifying them here. Enter each custom menu item on a new line with format: item text, link URL, link-opening method and language code (optional, for displaying the item to users of the specified language only), separated by pipe characters.
+
+Link-opening methods are: app (for linking to an activity supported by the app), inappbrowser (for opening a link in a browser without leaving the app), browser (for opening the link in the device default browser outside the app) and embedded (for displaying the link in an iframe in a new page in the app).
+
+For example:
 <pre>
-App\'s help | https://someurl.xyz/help | inappbrowser | en
-Visit our SIS | https://someurl.xyz | browser | en
-My grades | https://someurl.xyz/local/mygrades/index.php | embedded | en
-Mis calificaciones | https://someurl.xyz/local/mygrades/index.php | embedded | es
-</pre>
-Use inappbrowser when you want to open the link in a browser without leaving the app, use browser for opening the link in the device default browser and embedded if you want to display the link embedded in a new page in the app.';
+App help|https://someurl.xyz/help|inappbrowser
+My grades|https://someurl.xyz/local/mygrades/index.php|embedded|en
+Mis calificaciones|https://someurl.xyz/local/mygrades/index.php|embedded|es
+</pre>';
 $string['disabledfeatures'] = 'Disabled features';
 $string['disabledfeatures_desc'] = 'Select here the features you want to disable in the Mobile app for your site. Please note that some features listed here could be already disabled via other site settings. You will have to log out and log in again in the app to see the changes.';
 $string['enablesmartappbanners'] = 'Enable App Banners';
-$string['enablesmartappbanners_desc'] = 'This will display a banner promoting the Moodle Mobile app when visiting the site in a Mobile browser.';
+$string['enablesmartappbanners_desc'] = 'If enabled, a banner promoting the mobile app will be displayed when accessing the site using a mobile browser.';
 $string['forcedurlscheme'] = 'If you want to allow only your custom branded app to be opened via a browser window, then specify its URL scheme here; otherwise leave the field empty.';
 $string['forcedurlscheme_key'] = 'URL scheme';
 $string['forcelogout'] = 'Force log out';
@@ -97,11 +97,13 @@ class tool_mobile_external_testcase extends externallib_advanced_testcase {
        set_config('typeoflogin', api::LOGIN_VIA_BROWSER, 'tool_mobile');
        set_config('logo', 'mock.png', 'core_admin');
        set_config('logocompact', 'mock.png', 'core_admin');
+        set_config('forgottenpasswordurl', 'mailto:fake@email.zy'); // Test old hack.

        list($authinstructions, $notusedformat) = external_format_text($authinstructions, FORMAT_MOODLE, $context->id);
        $expected['registerauth'] = 'email';
        $expected['authinstructions'] = $authinstructions;
        $expected['typeoflogin'] = api::LOGIN_VIA_BROWSER;
+        $expected['forgottenpasswordurl'] = ''; // Expect empty when it's not an URL.

        if ($logourl = $OUTPUT->get_logo_url()) {
            $expected['logourl'] = $logourl->out(false);
@@ -123,6 +125,10 @@ class tool_mobile_external_testcase extends externallib_advanced_testcase {
        require_once($CFG->dirroot . '/course/format/lib.php');

        $this->resetAfterTest(true);
+
+        $mysitepolicy = 'http://mysite.is/policy/';
+        set_config('sitepolicy', $mysitepolicy);
+
        $result = external::get_config();
        $result = external_api::clean_returnvalue(external::get_config_returns(), $result);

@@ -143,6 +149,7 @@ class tool_mobile_external_testcase extends externallib_advanced_testcase {
            array('name' => 'numsections', 'value' => course_get_format($SITE)->get_last_section_number()),
            array('name' => 'newsitems', 'value' => $SITE->newsitems),
            array('name' => 'commentsperpage', 'value' => $CFG->commentsperpage),
+            array('name' => 'sitepolicy', 'value' => $mysitepolicy),
            array('name' => 'disableuserimages', 'value' => $CFG->disableuserimages),
            array('name' => 'mygradesurl', 'value' => user_mygrades_url()->out(false)),
            array('name' => 'tool_mobile_forcelogout', 'value' => 0),
@@ -97,5 +97,8 @@ function xmldb_tool_monitor_upgrade($oldversion) {
        upgrade_plugin_savepoint(true, 2017021300, 'tool', 'monitor');
    }

+    // Automatically generated Moodle v3.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
    return true;
 }
@@ -72,15 +72,15 @@ $string['issuerimage'] = 'Logo URL';
 $string['issuerloginparams'] = 'Additional parameters included in a login request.';
 $string['issuerloginparams_help'] = 'Some systems require additional parameters for a login request in order to read the user\'s basic profile.';
 $string['issuerloginparamsoffline'] = 'Additional parameters included in a login request for offline access.';
-$string['issuerloginparamsoffline_help'] = 'Each OAuth system defines a different way to request offline access. E.g. Google requires the additional params: "access_type=offline&prompt=consent" these parameters should be in url query parameter format.';
-$string['issuerloginscopes_help'] = 'Some systems require additional scopes for a login request in order to read the users basic profile. The standard scopes for an OpenID Connect compliant system are "openid profile email".';
-$string['issuerloginscopesoffline_help'] = 'Each OAuth system defines a different way to request offline access. E.g. Microsoft requires an additional scope "offline_access"';
+$string['issuerloginparamsoffline_help'] = 'Each OAuth system defines a different way to request offline access. E.g. Google requires the additional params: "access_type=offline&prompt=consent". These parameters should be in URL query parameter format.';
+$string['issuerloginscopes_help'] = 'Some systems require additional scopes for a login request in order to read the user\'s basic profile. The standard scopes for an OpenID Connect compliant system are "openid profile email".';
+$string['issuerloginscopesoffline_help'] = 'Each OAuth system defines a different way to request offline access. E.g. Microsoft requires an additional scope "offline_access".';
 $string['issuerloginscopesoffline'] = 'Scopes included in a login request for offline access.';
 $string['issuerloginscopes'] = 'Scopes included in a login request.';
 $string['issuername_help'] = 'Name of the identity issuer. May be displayed on login page.';
 $string['issuername'] = 'Name';
-$string['issuershowonloginpage_help'] = 'If the OpenID Connect Authentication plugin is enabled, this login issuer will be listed on the login page to allow users to log in with accounts from this issuer.';
-$string['issuershowonloginpage'] = 'Show on login page.';
+$string['issuershowonloginpage_help'] = 'If the OAuth 2 authentication plugin is enabled, this login issuer will be listed on the login page to allow users to log in with accounts from this issuer.';
+$string['issuershowonloginpage'] = 'Show on login page';
 $string['issuers'] = 'Issuers';
 $string['loginissuer'] = 'Allow login';
 $string['notconfigured'] = 'Not configured';
@@ -31,7 +31,7 @@ $string['default'] = 'Default';
 $string['disabled'] = 'Disabled';
 $string['disabled_help'] = 'Disabled scheduled tasks are not executed from cron, however they can still be executed manually via the CLI tool.';
 $string['edittaskschedule'] = 'Edit task schedule: {$a}';
-$string['enablerunnow'] = 'Allow &lsquo;Run now&rsquo; for scheduled tasks';
+$string['enablerunnow'] = 'Allow \'Run now\' for scheduled tasks';
 $string['enablerunnow_desc'] = 'Allows administrators to run a single scheduled task immediately, rather than waiting for it to run as scheduled. The task runs on the web server, so some sites may wish to disable this feature to avoid potential performance issues.';
 $string['faildelay'] = 'Fail delay';
 $string['lastruntime'] = 'Last run';
@@ -41,7 +41,7 @@ $string['pluginname'] = 'Scheduled task configuration';
 $string['resettasktodefaults'] = 'Reset task schedule to defaults';
 $string['resettasktodefaults_help'] = 'This will discard any local changes and revert the schedule for this task back to its original settings.';
 $string['runnow'] = 'Run now';
-$string['runnow_confirm'] = 'Are you sure you want to run this task &lsquo;{$a}&rsquo; now? The task will run on the web server and may take some time to complete.';
+$string['runnow_confirm'] = 'Are you sure you want to run this task \'{$a}\' now? The task will run on the web server and may take some time to complete.';
 $string['scheduledtasks'] = 'Scheduled tasks';
 $string['scheduledtaskchangesdisabled'] = 'Modifications to the list of scheduled tasks have been prevented in Moodle configuration';
 $string['taskdisabled'] = 'Task disabled';
@@ -22,6 +22,7 @@
 * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
 */
 namespace tool_templatelibrary;
+defined('MOODLE_INTERNAL') || die();

 require_once("$CFG->libdir/externallib.php");

@@ -95,7 +95,7 @@ class tool_uploadcourse_course {
    /** @var array fields allowed as course data. */
    static protected $validfields = array('fullname', 'shortname', 'idnumber', 'category', 'visible', 'startdate', 'enddate',
        'summary', 'format', 'theme', 'lang', 'newsitems', 'showgrades', 'showreports', 'legacyfiles', 'maxbytes',
-        'groupmode', 'groupmodeforce', 'groupmodeforce', 'enablecompletion');
+        'groupmode', 'groupmodeforce', 'enablecompletion');

    /** @var array fields required on course creation. */
    static protected $mandatoryfields = array('fullname', 'category');
@@ -676,6 +676,17 @@ class tool_uploadcourse_course {
            return false;
        }

+        // TODO MDL-59259 allow to set course format options for the current course format.
+
+        // Special case, 'numsections' is not a course format option any more but still should apply from defaults.
+        if (!$exists || !array_key_exists('numsections', $coursedata)) {
+            if (isset($this->rawdata['numsections']) && is_numeric($this->rawdata['numsections'])) {
+                $coursedata['numsections'] = (int)$this->rawdata['numsections'];
+            } else {
+                $coursedata['numsections'] = get_config('moodlecourse', 'numsections');
+            }
+        }
+
        // Saving data.
        $this->data = $coursedata;
        $this->enrolmentdata = tool_uploadcourse_helper::get_enrolment_data($this->rawdata);
@@ -166,6 +166,13 @@ class tool_uploadcourse_step2_form extends tool_uploadcourse_base_form {
        $mform->addHelpButton('defaults[groupmodeforce]', 'groupmodeforce', 'group');
        $mform->setDefault('defaults[groupmodeforce]', $courseconfig->groupmodeforce);

+        // Completion tracking.
+        if (!empty($CFG->enablecompletion)) {
+            $mform->addElement('selectyesno', 'defaults[enablecompletion]', get_string('enablecompletion', 'completion'));
+            $mform->setDefault('defaults[enablecompletion]', $courseconfig->enablecompletion);
+            $mform->addHelpButton('defaults[enablecompletion]', 'enablecompletion', 'completion');
+        }
+
        // Hidden fields.
        $mform->addElement('hidden', 'importid');
        $mform->setType('importid', PARAM_INT);
@@ -166,6 +166,7 @@ $defaults['groupmode'] = $courseconfig->groupmode;
 $defaults['groupmodeforce'] = $courseconfig->groupmodeforce;
 $defaults['visible'] = $courseconfig->visible;
 $defaults['lang'] =  $courseconfig->lang;
+$defaults['enablecompletion'] = $courseconfig->enablecompletion;

 // Course template.
 if (isset($options['templatecourse'])) {
@@ -120,6 +120,36 @@ class tool_uploadcourse_course_testcase extends advanced_testcase {
        $this->assertTrue($DB->record_exists('course', array('shortname' => 'c2')));
    }

+    public function test_create_with_sections() {
+        global $DB;
+        $this->resetAfterTest(true);
+        $updatemode = tool_uploadcourse_processor::UPDATE_NOTHING;
+        $defaultnumsections = get_config('moodlecourse', 'numsections');
+
+        // Add new course, make sure default number of sections is created.
+        $mode = tool_uploadcourse_processor::MODE_CREATE_NEW;
+        $data = array('shortname' => 'newcourse1', 'fullname' => 'New course1', 'format' => 'topics', 'category' => 1);
+        $co = new tool_uploadcourse_course($mode, $updatemode, $data);
+        $this->assertTrue($co->prepare());
+        $co->proceed();
+        $courseid = $DB->get_field('course', 'id', array('shortname' => 'newcourse1'));
+        $this->assertNotEmpty($courseid);
+        $this->assertEquals($defaultnumsections + 1,
+            $DB->count_records('course_sections', ['course' => $courseid]));
+
+        // Add new course specifying number of sections.
+        $mode = tool_uploadcourse_processor::MODE_CREATE_NEW;
+        $data = array('shortname' => 'newcourse2', 'fullname' => 'New course2', 'format' => 'topics', 'category' => 1,
+            'numsections' => 15);
+        $co = new tool_uploadcourse_course($mode, $updatemode, $data);
+        $this->assertTrue($co->prepare());
+        $co->proceed();
+        $courseid = $DB->get_field('course', 'id', array('shortname' => 'newcourse2'));
+        $this->assertNotEmpty($courseid);
+        $this->assertEquals(15 + 1,
+            $DB->count_records('course_sections', ['course' => $courseid]));
+    }
+
    public function test_delete() {
        global $DB;
        $this->resetAfterTest(true);
@@ -45,5 +45,8 @@ function xmldb_tool_usertours_upgrade($oldversion) {
    // Automatically generated Moodle v3.2.0 release upgrade line.
    // Put any upgrade step following this.

+    // Automatically generated Moodle v3.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
    return true;
 }
@@ -3187,6 +3187,18 @@ class CAS_Client
                false/*$no_response*/, true/*$bad_response*/, $text_response
            );
            $result = false;
+	} else if ( $tree_response->getElementsByTagName("authenticationFailure")->length != 0) {
+            // authentication failed, extract the error code and message and throw exception
+            $auth_fail_list = $tree_response
+                ->getElementsByTagName("authenticationFailure");
+            throw new CAS_AuthenticationException(
+                $this, 'Ticket not validated', $validate_url,
+                false/*$no_response*/, false/*$bad_response*/,
+                $text_response,
+                $auth_fail_list->item(0)->getAttribute('code')/*$err_code*/,
+                trim($auth_fail_list->item(0)->nodeValue)/*$err_msg*/
+            );
+            $result = false;
        } else if ($tree_response->getElementsByTagName("authenticationSuccess")->length != 0) {
            // authentication succeded, extract the user name
            $success_elements = $tree_response
@@ -3227,18 +3239,6 @@ class CAS_Client
                    $result = true;
                }
            }
-        } else if ( $tree_response->getElementsByTagName("authenticationFailure")->length != 0) {
-            // authentication succeded, extract the error code and message
-            $auth_fail_list = $tree_response
-                ->getElementsByTagName("authenticationFailure");
-            throw new CAS_AuthenticationException(
-                $this, 'Ticket not validated', $validate_url,
-                false/*$no_response*/, false/*$bad_response*/,
-                $text_response,
-                $auth_fail_list->item(0)->getAttribute('code')/*$err_code*/,
-                trim($auth_fail_list->item(0)->nodeValue)/*$err_msg*/
-            );
-            $result = false;
        } else {
            throw new CAS_AuthenticationException(
                $this, 'Ticket not validated', $validate_url,
@@ -2,3 +2,4 @@ Description of phpCAS 1.3.4 library import

 * downloaded from http://downloads.jasig.org/cas-clients/php/current/

+* MDL-59456 phpCAS library has been patched because of an authentication bypass security vulnerability.
@@ -66,5 +66,8 @@ function xmldb_auth_cas_upgrade($oldversion) {
        upgrade_plugin_savepoint(true, 2017020700, 'auth', 'cas');
    }

+    // Automatically generated Moodle v3.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
    return true;
 }
@@ -171,7 +171,7 @@ class auth_plugin_db extends auth_plugin_base {
    }

    /**
-     * Returns user attribute mappings between moodle and ldap.
+     * Returns user attribute mappings between moodle and the external database.
     *
     * @return array
     */
@@ -215,8 +215,12 @@ class auth_plugin_db extends auth_plugin_base {
        // If at least one field is mapped from external db, get that mapped data.
        if ($selectfields) {
            $select = array();
+            $fieldcount = 0;
            foreach ($selectfields as $localname=>$externalname) {
-                $select[] = "$externalname";
+                // Without aliasing, multiple occurrences of the same external
+                // name can coalesce in only occurrence in the result.
+                $select[] = "$externalname AS F".$fieldcount;
+                $fieldcount++;
            }
            $select = implode(', ', $select);
            $sql = "SELECT $select
@@ -42,5 +42,8 @@ function xmldb_auth_db_upgrade($oldversion) {
        upgrade_plugin_savepoint(true, 2017032800, 'auth', 'db');
    }

+    // Automatically generated Moodle v3.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
    return true;
 }
@@ -137,7 +137,7 @@ class auth_email_external extends external_api {
                     new external_value(PARAM_NOTAGS, 'The order of the name fields')
                ),
                'passwordpolicy' => new external_value(PARAM_RAW, 'Password policy', VALUE_OPTIONAL),
-                'sitepolicy' => new external_value(PARAM_URL, 'Site policy url', VALUE_OPTIONAL),
+                'sitepolicy' => new external_value(PARAM_RAW, 'Site policy', VALUE_OPTIONAL),
                'defaultcity' => new external_value(PARAM_NOTAGS, 'Default city', VALUE_OPTIONAL),
                'country' => new external_value(PARAM_ALPHA, 'Default country', VALUE_OPTIONAL),
                'profilefields' => new external_multiple_structure(
@@ -42,5 +42,8 @@ function xmldb_auth_email_upgrade($oldversion) {
        upgrade_plugin_savepoint(true, 2017020700, 'auth', 'email');
    }

+    // Automatically generated Moodle v3.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
    return true;
 }
@@ -42,5 +42,8 @@ function xmldb_auth_fc_upgrade($oldversion) {
        upgrade_plugin_savepoint(true, 2017020700, 'auth', 'fc');
    }

+    // Automatically generated Moodle v3.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
    return true;
 }
@@ -42,5 +42,8 @@ function xmldb_auth_imap_upgrade($oldversion) {
        upgrade_plugin_savepoint(true, 2017020700, 'auth', 'imap');
    }

+    // Automatically generated Moodle v3.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
    return true;
 }
@@ -276,7 +276,7 @@ class auth_plugin_ldap extends auth_plugin_base {
            }
            $ldapval = NULL;
            foreach ($values as $value) {
-                $entry = array_change_key_case($user_entry[0], CASE_LOWER);
+                $entry = $user_entry[0];
                if (($value == 'dn') || ($value == 'distinguishedname')) {
                    $result[$key] = $user_dn;
                    continue;
@@ -634,7 +634,7 @@ class auth_plugin_ldap extends auth_plugin_base {
        if ($sr)  {
            $info = ldap_get_entries_moodle($ldapconnection, $sr);
            if (!empty ($info)) {
-                $info = array_change_key_case($info[0], CASE_LOWER);
+                $info = $info[0];
                if (isset($info[$this->config->expireattr][0])) {
                    $expiretime = $this->ldap_expirationtime2unix($info[$this->config->expireattr][0], $ldapconnection, $user_dn);
                    if ($expiretime != 0) {
@@ -1201,7 +1201,7 @@ class auth_plugin_ldap extends auth_plugin_base {
                return false;
            }

-            $user_entry = array_change_key_case($user_entry[0], CASE_LOWER);
+            $user_entry = $user_entry[0];

            foreach ($attrmap as $key => $ldapkeys) {
                $profilefield = '';
@@ -1369,7 +1369,7 @@ class auth_plugin_ldap extends auth_plugin_base {
                $sr = ldap_read($ldapconnection, $user_dn, '(objectClass=*)', $search_attribs);
                if ($sr) {
                    $entry = ldap_get_entries_moodle($ldapconnection, $sr);
-                    $info = array_change_key_case($entry[0], CASE_LOWER);
+                    $info = $entry[0];
                    $newattrs = array();
                    if (!empty($info[$this->config->expireattr][0])) {
                        // Set expiration time only if passwordExpirationInterval is defined
@@ -1844,7 +1844,7 @@ class auth_plugin_ldap extends auth_plugin_base {
        }

        $entry = ldap_get_entries_moodle($ldapconn, $sr);
-        $info = array_change_key_case($entry[0], CASE_LOWER);
+        $info = $entry[0];
        $useraccountcontrol = $info['useraccountcontrol'][0];
        if ($useraccountcontrol & UF_DONT_EXPIRE_PASSWD) {
            // Password doesn't expire.
@@ -1889,17 +1889,17 @@ class auth_plugin_ldap extends auth_plugin_base {
        }

        $entry = ldap_get_entries_moodle($ldapconn, $sr);
-        $info = array_change_key_case($entry[0], CASE_LOWER);
+        $info = $entry[0];
        $domaindn = $info['defaultnamingcontext'][0];

        $sr = ldap_read ($ldapconn, $domaindn, '(objectClass=*)',
                         array('maxPwdAge'));
        $entry = ldap_get_entries_moodle($ldapconn, $sr);
-        $info = array_change_key_case($entry[0], CASE_LOWER);
+        $info = $entry[0];
        $maxpwdage = $info['maxpwdage'][0];
        if ($sr = ldap_read($ldapconn, $user_dn, '(objectClass=*)', array('msDS-ResultantPSO'))) {
            if ($entry = ldap_get_entries_moodle($ldapconn, $sr)) {
-                $info = array_change_key_case($entry[0], CASE_LOWER);
+                $info = $entry[0];
                $userpso = $info['msds-resultantpso'][0];

                // If a PSO exists, FGPP is being utilized.
@@ -1907,7 +1907,7 @@ class auth_plugin_ldap extends auth_plugin_base {
                if (!empty($userpso)) {
                    $sr = ldap_read($ldapconn, $userpso, '(objectClass=*)', array('msDS-MaximumPasswordAge'));
                    if ($entry = ldap_get_entries_moodle($ldapconn, $sr)) {
-                        $info = array_change_key_case($entry[0], CASE_LOWER);
+                        $info = $entry[0];
                        // Default value of msds-maximumpasswordage is 42 and is always set.
                        $maxpwdage = $info['msds-maximumpasswordage'][0];
                    }
@@ -66,5 +66,8 @@ function xmldb_auth_ldap_upgrade($oldversion) {
        upgrade_plugin_savepoint(true, 2017020700, 'auth', 'ldap');
    }

+    // Automatically generated Moodle v3.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
    return true;
 }
@@ -121,7 +121,7 @@ $string['didntgetusersfromldap'] = "Did not get any users from LDAP -- error? --
 $string['gotcountrecordsfromldap'] = "Got {\$a} records from LDAP\n";
 $string['ldapnotconfigured'] = 'The LDAP host url is currently not configured';
 $string['morethanoneuser'] = 'Strange! More than one user record found in ldap. Only using the first one.';
-$string['needbcmath'] = 'You need the BCMath extension to use grace logins with Active Directory';
+$string['needbcmath'] = 'You need the BCMath extension to use expired password checking with Active Directory.';
 $string['needmbstring'] = 'You need the mbstring extension to change passwords in Active Directory';
 $string['nodnforusername'] = 'Error in user_update_password(). No DN for: {$a->username}';
 $string['noemail'] = 'Tried to send you an email but failed!';
@@ -54,5 +54,8 @@ function xmldb_auth_manual_upgrade($oldversion) {
        upgrade_plugin_savepoint(true, 2017020700, 'auth', 'manual');
    }

+    // Automatically generated Moodle v3.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
    return true;
 }
@@ -53,5 +53,8 @@ function xmldb_auth_mnet_upgrade($oldversion) {
        upgrade_plugin_savepoint(true, 2017020700, 'auth', 'mnet');
    }

+    // Automatically generated Moodle v3.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
    return true;
 }
@@ -42,5 +42,8 @@ function xmldb_auth_nntp_upgrade($oldversion) {
        upgrade_plugin_savepoint(true, 2017020700, 'auth', 'nntp');
    }

+    // Automatically generated Moodle v3.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
    return true;
 }
@@ -42,5 +42,8 @@ function xmldb_auth_none_upgrade($oldversion) {
        upgrade_plugin_savepoint(true, 2017020700, 'auth', 'none');
    }

+    // Automatically generated Moodle v3.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
    return true;
 }
@@ -192,10 +192,10 @@ class api {
        ];
        $confirmationurl = new moodle_url('/auth/oauth2/confirm-linkedlogin.php', $params);

-        // Remove data parameter just in case it was included in the confirmation so we can add it manually later.
-        $data->link = $confirmationurl->out();
+        $data->link = $confirmationurl->out(false);
+        $message = get_string('confirmlinkedloginemail', 'auth_oauth2', $data);

-        $message     = get_string('confirmlinkedloginemail', 'auth_oauth2', $data);
+        $data->link = $confirmationurl->out();
        $messagehtml = text_to_html(get_string('confirmlinkedloginemail', 'auth_oauth2', $data), false, false, true);

        $user->mailformat = 1;  // Always send HTML version as well.
@@ -303,9 +303,10 @@ class api {
        ];
        $confirmationurl = new moodle_url('/auth/oauth2/confirm-account.php', $params);

-        $data->link = $confirmationurl->out();
+        $data->link = $confirmationurl->out(false);
+        $message = get_string('confirmaccountemail', 'auth_oauth2', $data);

-        $message     = get_string('confirmaccountemail', 'auth_oauth2', $data);
+        $data->link = $confirmationurl->out();
        $messagehtml = text_to_html(get_string('confirmaccountemail', 'auth_oauth2', $data), false, false, true);

        $user->mailformat = 1;  // Always send HTML version as well.
@@ -247,6 +247,10 @@ class auth extends \auth_plugin_base {
        if (!empty($user->picture)) {
            return false;
        }
+        if (!empty($CFG->enablegravatar)) {
+            return false;
+        }
+
        $picture = $this->get_static_user_picture();
        if (empty($picture)) {
            return false;
@@ -342,7 +346,7 @@ class auth extends \auth_plugin_base {
     * Complete the login process after oauth handshake is complete.
     * @param \core\oauth2\client $client
     * @param string $redirecturl
-     * @return none Either redirects or throws an exception
+     * @return void Either redirects or throws an exception
     */
    public function complete_login(client $client, $redirecturl) {
        global $CFG, $SESSION, $PAGE;
@@ -352,7 +356,7 @@ class auth extends \auth_plugin_base {
        if (!$userinfo) {
            // Trigger login failed event.
            $failurereason = AUTH_LOGIN_NOUSER;
-            $event = \core\event\user_login_failed::create(['other' => ['username' => $userinfo['username'],
+            $event = \core\event\user_login_failed::create(['other' => ['username' => 'unknown',
                                                                        'reason' => $failurereason]]);
            $event->trigger();

@@ -364,7 +368,7 @@ class auth extends \auth_plugin_base {
        if (empty($userinfo['username']) || empty($userinfo['email'])) {
            // Trigger login failed event.
            $failurereason = AUTH_LOGIN_NOUSER;
-            $event = \core\event\user_login_failed::create(['other' => ['username' => $userinfo['username'],
+            $event = \core\event\user_login_failed::create(['other' => ['username' => 'unknown',
                                                                        'reason' => $failurereason]]);
            $event->trigger();

@@ -38,5 +38,8 @@ function xmldb_auth_oauth2_upgrade($oldversion) {
    // Automatically generated Moodle v3.2.0 release upgrade line.
    // Put any upgrade step following this.

+    // Automatically generated Moodle v3.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
    return true;
 }
@@ -42,5 +42,8 @@ function xmldb_auth_pam_upgrade($oldversion) {
        upgrade_plugin_savepoint(true, 2017020700, 'auth', 'pam');
    }

+    // Automatically generated Moodle v3.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
    return true;
 }
@@ -42,5 +42,8 @@ function xmldb_auth_pop3_upgrade($oldversion) {
        upgrade_plugin_savepoint(true, 2017020700, 'auth', 'pop3');
    }

+    // Automatically generated Moodle v3.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
    return true;
 }
@@ -42,5 +42,8 @@ function xmldb_auth_shibboleth_upgrade($oldversion) {
        upgrade_plugin_savepoint(true, 2017020700, 'auth', 'shibboleth');
    }

+    // Automatically generated Moodle v3.3.0 release upgrade line.
+    // Put any upgrade step following this.
+
    return true;
 }
@@ -65,8 +65,9 @@ class frontend extends \core_availability\frontend {
                // Add each course-module if it has completion turned on and is not
                // the one currently being edited.
                if ($othercm->completion && (empty($cm) || $cm->id != $id) && !$othercm->deletioninprogress) {
-                    $cms[] = (object)array('id' => $id, 'name' =>
-                            format_string($othercm->name, true, array('context' => $context)));
+                    $cms[] = (object)array('id' => $id,
+                        'name' => format_string($othercm->name, true, array('context' => $context)),
+                        'completiongradeitemnumber' => $othercm->completiongradeitemnumber);
                }
            }

@@ -24,6 +24,7 @@

 $string['description'] = 'Require students to complete (or not complete) another activity.';
 $string['error_selectcmid'] = 'You must select an activity for the completion condition.';
+$string['error_selectcmidpassfail'] = 'You must select an activity with "Require grade" completion condition set.';
 $string['label_cm'] = 'Activity or resource';
 $string['label_completion'] = 'Required completion status';
 $string['missing'] = '(Missing activity)';
@@ -78,6 +78,16 @@ M.availability_completion.form.fillErrors = function(errors, node) {
    if (cmid === 0) {
        errors.push('availability_completion:error_selectcmid');
    }
+    var e = parseInt(node.one('select[name=e]').get('value'), 10);
+    if (((e === 2) || (e === 3))) {
+        this.cms.forEach(function(cm) {
+            if (cm.id === cmid) {
+                if (cm.completiongradeitemnumber === null) {
+                    errors.push('availability_completion:error_selectcmidpassfail');
+                }
+            }
+        });
+    }
 };


@@ -1 +1 @@
-YUI.add("moodle-availability_completion-form",function(e,t){M.availability_completion=M.availability_completion||{},M.availability_completion.form=e.Object(M.core_availability.plugin),M.availability_completion.form.initInner=function(e){this.cms=e},M.availability_completion.form.getNode=function(t){var n='<span class="col-form-label p-r-1"> '+M.util.get_string("title","availability_completion")+"</span>"+' <span class="availability-group form-group"><label>'+'<span class="accesshide">'+M.util.get_string("label_cm","availability_completion")+" </span>"+'<select class="custom-select" name="cm" title="'+M.util.get_string("label_cm","availability_completion")+'">'+'<option value="0">'+M.util.get_string("choosedots","moodle")+"</option>";for(var r=0;r<this.cms.length;r++){var i=this.cms[r];n+='<option value="'+i.id+'">'+i.name+"</option>"}n+='</select></label> <label><span class="accesshide">'+M.util.get_string("label_completion","availability_completion")+' </span><select class="custom-select" '+'name="e" title="'+M.util.get_string("label_completion","availability_completion")+'">'+'<option value="1">'+M.util.get_string("option_complete","availability_completion")+"</option>"+'<option value="0">'+M.util.get_string("option_incomplete","availability_completion")+"</option>"+'<option value="2">'+M.util.get_string("option_pass","availability_completion")+"</option>"+'<option value="3">'+M.util.get_string("option_fail","availability_completion")+"</option>"+"</select></label></span>";var s=e.Node.create('<span class="form-inline">'+n+"</span>");t.cm!==undefined&&s.one("select[name=cm] > option[value="+t.cm+"]")&&s.one("select[name=cm]").set("value",""+t.cm),t.e!==undefined&&s.one("select[name=e]").set("value",""+t.e);if(!M.availability_completion.form.addedEvents){M.availability_completion.form.addedEvents=!0;var o=e.one(".availability-field");o.delegate("change",function(){M.core_availability.form.update()},".availability_completion select")}return s},M.availability_completion.form.fillValue=function(e,t){e.cm=parseInt(t.one("select[name=cm]").get("value"),10),e.e=parseInt(t.one("select[name=e]").get("value"),10)},M.availability_completion.form.fillErrors=function(e,t){var n=parseInt(t.one("select[name=cm]").get("value"),10);n===0&&e.push("availability_completion:error_selectcmid")}},"@VERSION@",{requires:["base","node","event","moodle-core_availability-form"]});
+YUI.add("moodle-availability_completion-form",function(e,t){M.availability_completion=M.availability_completion||{},M.availability_completion.form=e.Object(M.core_availability.plugin),M.availability_completion.form.initInner=function(e){this.cms=e},M.availability_completion.form.getNode=function(t){var n='<span class="col-form-label p-r-1"> '+M.util.get_string("title","availability_completion")+"</span>"+' <span class="availability-group form-group"><label>'+'<span class="accesshide">'+M.util.get_string("label_cm","availability_completion")+" </span>"+'<select class="custom-select" name="cm" title="'+M.util.get_string("label_cm","availability_completion")+'">'+'<option value="0">'+M.util.get_string("choosedots","moodle")+"</option>";for(var r=0;r<this.cms.length;r++){var i=this.cms[r];n+='<option value="'+i.id+'">'+i.name+"</option>"}n+='</select></label> <label><span class="accesshide">'+M.util.get_string("label_completion","availability_completion")+' </span><select class="custom-select" '+'name="e" title="'+M.util.get_string("label_completion","availability_completion")+'">'+'<option value="1">'+M.util.get_string("option_complete","availability_completion")+"</option>"+'<option value="0">'+M.util.get_string("option_incomplete","availability_completion")+"</option>"+'<option value="2">'+M.util.get_string("option_pass","availability_completion")+"</option>"+'<option value="3">'+M.util.get_string("option_fail","availability_completion")+"</option>"+"</select></label></span>";var s=e.Node.create('<span class="form-inline">'+n+"</span>");t.cm!==undefined&&s.one("select[name=cm] > option[value="+t.cm+"]")&&s.one("select[name=cm]").set("value",""+t.cm),t.e!==undefined&&s.one("select[name=e]").set("value",""+t.e);if(!M.availability_completion.form.addedEvents){M.availability_completion.form.addedEvents=!0;var o=e.one(".availability-field");o.delegate("change",function(){M.core_availability.form.update()},".availability_completion select")}return s},M.availability_completion.form.fillValue=function(e,t){e.cm=parseInt(t.one("select[name=cm]").get("value"),10),e.e=parseInt(t.one("select[name=e]").get("value"),10)},M.availability_completion.form.fillErrors=function(e,t){var n=parseInt(t.one("select[name=cm]").get("value"),10);n===0&&e.push("availability_completion:error_selectcmid");var r=parseInt(t.one("select[name=e]").get("value"),10);(r===2||r===3)&&this.cms.forEach(function(t){t.id===n&&t.completiongradeitemnumber===null&&e.push("availability_completion:error_selectcmidpassfail")})}},"@VERSION@",{requires:["base","node","event","moodle-core_availability-form"]});
@@ -78,6 +78,16 @@ M.availability_completion.form.fillErrors = function(errors, node) {
    if (cmid === 0) {
        errors.push('availability_completion:error_selectcmid');
    }
+    var e = parseInt(node.one('select[name=e]').get('value'), 10);
+    if (((e === 2) || (e === 3))) {
+        this.cms.forEach(function(cm) {
+            if (cm.id === cmid) {
+                if (cm.completiongradeitemnumber === null) {
+                    errors.push('availability_completion:error_selectcmidpassfail');
+                }
+            }
+        });
+    }
 };


@@ -76,4 +76,14 @@ M.availability_completion.form.fillErrors = function(errors, node) {
    if (cmid === 0) {
        errors.push('availability_completion:error_selectcmid');
    }
+    var e = parseInt(node.one('select[name=e]').get('value'), 10);
+    if (((e === 2) || (e === 3))) {
+        this.cms.forEach(function(cm) {
+            if (cm.id === cmid) {
+                if (cm.completiongradeitemnumber === null) {
+                    errors.push('availability_completion:error_selectcmidpassfail');
+                }
+            }
+        });
+    }
 };
@@ -141,6 +141,15 @@ abstract class backup implements checksumable {
     * Usually same than major release zero version, mainly for informative/historic purposes.
     */
    const RELEASE = '3.3';
+
+    /**
+     * Cipher to be used in backup and restore operations.
+     */
+    const CIPHER = 'aes-256-cbc';
+    /**
+     * Bytes enforced for key, using the cypher above. Restrictive? Yes, but better than unsafe lengths
+     */
+    const CIPHERKEYLEN = 32;
 }

 /*
@@ -15,6 +15,17 @@
 // You should have received a copy of the GNU General Public License
 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.

+/**
+ * This script is used to configure and execute the backup proccess.
+ *
+ * @package    core
+ * @subpackage backup
+ * @copyright  Moodle
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+define('NO_OUTPUT_BUFFERING', true);
+
 require_once('../config.php');
 require_once($CFG->dirroot . '/backup/util/includes/backup_includes.php');
 require_once($CFG->dirroot . '/backup/moodle2/backup_plan_builder.class.php');
@@ -112,7 +112,7 @@ class cc_forum extends entities {

    public function get_topic_data ($instance) {

-        $topic_data = '';
+        $topic_data = array();

        $topic_file = $this->get_external_xml($instance['resource_indentifier']);

@@ -68,7 +68,7 @@ class cc_quiz extends entities {
        $last_question_id = 0;
        $last_answer_id = 0;

-        $instances = '';
+        $instances = array();

        $types = array(MOODLE_TYPE_QUIZ, MOODLE_TYPE_QUESTION_BANK);

@@ -87,7 +87,7 @@ class cc11_basiclti extends entities11 {

    public function get_basiclti_data($instance) {

-        $topic_data = '';
+        $topic_data = array();

        $basiclti_file = $this->get_external_xml($instance['resource_indentifier']);

@@ -111,7 +111,7 @@ class cc11_forum extends entities11 {

    public function get_topic_data ($instance) {

-        $topic_data = '';
+        $topic_data = array();

        $topic_file = $this->get_external_xml($instance['resource_indentifier']);

@@ -82,7 +82,7 @@ class cc11_lti extends entities11 {

    public function get_basiclti_data($instance) {

-        $topic_data = '';
+        $topic_data = array();

        $basiclti_file = $this->get_external_xml($instance['resource_indentifier']);

@@ -68,7 +68,7 @@ class cc11_quiz extends entities11 {
        $last_question_id = 0;
        $last_answer_id = 0;

-        $instances = '';
+        $instances = array();

        $types = array(MOODLE_TYPE_QUIZ, MOODLE_TYPE_QUESTION_BANK);

@@ -149,6 +149,32 @@ class core_backup_controller_testcase extends advanced_testcase {
        }
        $this->assertTrue($alltrue);
    }
+
+    /**
+     * Test restore of deadlock causing backup.
+     */
+    public function test_restore_of_deadlock_causing_backup() {
+        global $USER, $CFG;
+        $this->preventResetByRollback();
+
+        $foldername = 'deadlock';
+        $fp = get_file_packer('application/vnd.moodle.backup');
+        $tempdir = $CFG->dataroot . '/temp/backup/' . $foldername;
+        $files = $fp->extract_to_pathname($CFG->dirroot . '/backup/controller/tests/fixtures/deadlock.mbz', $tempdir);
+
+        $this->setAdminUser();
+        $controller = new restore_controller(
+            'deadlock',
+            $this->courseid,
+            backup::INTERACTIVE_NO,
+            backup::MODE_GENERAL,
+            $USER->id,
+            backup::TARGET_NEW_COURSE
+        );
+        $this->assertTrue($controller->execute_precheck());
+        $controller->execute_plan();
+        $controller->destroy();
+    }
 }


@@ -1,5 +1,31 @@
 <?php

+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * This script is used to configure and execute the import proccess.
+ *
+ * @package    core
+ * @subpackage backup
+ * @copyright  Moodle
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+define('NO_OUTPUT_BUFFERING', true);
+
 // Require both the backup and restore libs
 require_once('../config.php');
 require_once($CFG->dirroot . '/backup/util/includes/backup_includes.php');
@@ -167,15 +167,25 @@ class backup_course_task extends backup_task {
    /**
     * Helper method, used by encode_content_links.
     * @param string $content content in which to encode links.
-     * @param unknown_type $name the name of this type of encoded link.
-     * @param unknown_type $path the path that identifies this type of link, up
+     * @param string $name the name of this type of encoded link.
+     * @param string $path the path that identifies this type of link, up
     *      to the ?paramname= bit.
     * @return string content with one type of link encoded.
     */
    static private function encode_links_helper($content, $name, $path) {
        global $CFG;
-        $base = preg_quote($CFG->wwwroot . $path, '/');
-        return preg_replace('/(' . $base . ')([0-9]+)/', '$@' . $name . '*$2@$', $content);
+        // We want to convert both http and https links.
+        $root = $CFG->wwwroot;
+        $httpsroot = str_replace('http://', 'https://', $root);
+        $httproot = str_replace('https://', 'http://', $root);
+
+        $httpsbase = preg_quote($httpsroot . $path, '/');
+        $httpbase = preg_quote($httproot . $path, '/');
+
+        $return = preg_replace('/(' . $httpsbase . ')([0-9]+)/', '$@' . $name . '*$2@$', $content);
+        $return = preg_replace('/(' . $httpbase . ')([0-9]+)/', '$@' . $name . '*$2@$', $return);
+
+        return $return;
    }

 // Protected API starts here
@@ -97,6 +97,138 @@ class base64_encode_final_element extends backup_final_element {
    }
 }

+/**
+ * Implementation of {@link backup_final_element} that provides symmetric-key AES-256 encryption of contents.
+ *
+ * This final element transparently encrypts, for secure storage and transport, any content
+ * that shouldn't be shown normally in plain text. Usually, passwords or keys that cannot use
+ * hashing algorithms, although potentially can encrypt any content. All information is encoded
+ * using base64.
+ *
+ * Features:
+ *   - requires openssl extension to work. Without it contents are completely omitted.
+ *   - automatically creates an appropriate default key for the site and stores it into backup_encryptkey config (bas64 encoded).
+ *   - uses a different appropriate init vector for every operation, which is transmited with the encrypted contents.
+ *   - all generated data is base64 encoded for safe transmission.
+ *   - automatically adds "encrypted" attribute for easier detection.
+ *   - implements HMAC for providing integrity.
+ *
+ * @copyright 2017 onwards Eloy Lafuente (stronk7) {@link http://stronk7.com}
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class encrypted_final_element extends backup_final_element {
+
+    /** @var string cypher appropiate raw key for backups in the site. Defaults to backup_encryptkey config. */
+    protected $key = null;
+
+    /**
+     * Constructor - instantiates a encrypted_final_element, specifying its basic info.
+     *
+     * Overridden to automatically add the 'encrypted' attribute if missing.
+     *
+     * @param string $name name of the element
+     * @param array  $attributes attributes this element will handle (optional, defaults to null)
+     */
+    public function __construct($name, $attributes = null) {
+        parent::__construct($name, $attributes);
+        if (! $this->get_attribute('encrypted')) {
+            $this->add_attributes('encrypted');
+        }
+    }
+
+    /**
+     * Set the encryption key manually, overriding default backup_encryptkey config.
+     *
+     * @param string $key key to be used for encrypting. Required to be 256-bit key.
+     *               Use a safe generation technique. See self::generate_encryption_random_key() below.
+     */
+    protected function set_key($key) {
+        $bytes = strlen($key); // Get key length in bytes.
+
+        // Only accept keys with the expected (backup::CIPHERKEYLEN) key length. There are a number of hashing,
+        // random generators to achieve this esasily, like the one shown below to create the default
+        // site encryption key and ivs.
+        if ($bytes !== backup::CIPHERKEYLEN) {
+            $info = (object)array('expected' => backup::CIPHERKEYLEN, 'found' => $bytes);
+            throw new base_element_struct_exception('encrypted_final_element incorrect key length', $info);
+        }
+        // Everything went ok, store the key.
+        $this->key = $key;
+    }
+
+    /**
+     * Set the value of the field.
+     *
+     * This method sets the value of the element, encrypted using the specified key for it,
+     * defaulting to (and generating) backup_encryptkey config. HMAC is used for integrity.
+     *
+     * @param string $value plain-text content the will be stored encrypted and encoded.
+     */
+    public function set_value($value) {
+
+        // No openssl available, skip this field completely.
+        if (!function_exists('openssl_encrypt')) {
+            return;
+        }
+
+        // No hmac available, skip this field completely.
+        if (!function_exists('hash_hmac')) {
+            return;
+        }
+
+        // Cypher not available, skip this field completely.
+        if (!in_array(backup::CIPHER, openssl_get_cipher_methods())) {
+            return;
+        }
+
+        // Ensure we have a good key, manual or default.
+        if (empty($this->key)) {
+            // The key has not been set manually, look for it at config (base64 encoded there).
+            $enckey = get_config('backup', 'backup_encryptkey');
+            if ($enckey === false) {
+                // Has not been set, calculate and save an appropiate random key automatically.
+                $enckey = base64_encode(self::generate_encryption_random_key(backup::CIPHERKEYLEN));
+                set_config('backup_encryptkey', $enckey, 'backup');
+            }
+            $this->set_key(base64_decode($enckey));
+        }
+
+        // Now we need an iv for this operation.
+        $iv = self::generate_encryption_random_key(openssl_cipher_iv_length(backup::CIPHER));
+
+        // Everything is ready, let's encrypt and prepend the 1-shot iv.
+        $value = $iv . openssl_encrypt($value, backup::CIPHER, $this->key, OPENSSL_RAW_DATA, $iv);
+
+        // Calculate the hmac of the value (iv + encrypted) and prepend it.
+        $hmac = hash_hmac('sha256', $value, $this->key, true);
+        $value = $hmac . $value;
+
+        // Ready, set the encoded value.
+        parent::set_value(base64_encode($value));
+
+        // Finally, if the field has an "encrypted" attribute, set it to true.
+        if ($att = $this->get_attribute('encrypted')) {
+            $att->set_value('true');
+        }
+    }
+
+    /**
+     * Generate an appropiate random key to be used for encrypting backup information.
+     *
+     * Normally used as site default encryption key (backup_encryptkey config) and also
+     * for calculating the init vectors.
+     *
+     * Note that until PHP 5.6.12 openssl_random_pseudo_bytes() did NOT
+     * use a "cryptographically strong algorithm" {@link https://bugs.php.net/bug.php?id=70014}
+     * But it's beyond my crypto-knowledge when it's worth finding a *real* better alternative.
+     *
+     * @param int $bytes Number of bytes to determine the key length expected.
+     */
+    protected static function generate_encryption_random_key($bytes) {
+        return openssl_random_pseudo_bytes($bytes);
+    }
+}
+
 /**
 * Implementation of backup_nested_element that provides special handling of files
 *
@@ -529,7 +529,7 @@ class backup_enrolments_structure_step extends backup_structure_step {
        $enrol->annotate_ids('role', 'roleid');

        // Add enrol plugin structure.
-        $this->add_plugin_structure('enrol', $enrol, false);
+        $this->add_plugin_structure('enrol', $enrol, true);

        return $enrolments;
    }
@@ -878,13 +878,22 @@ class backup_calendarevents_structure_step extends backup_structure_step {
            $calendar_items_params = array('courseid'=>backup::VAR_COURSEID);
            $event->set_source_sql($calendar_items_sql, $calendar_items_params);
        } else if ($this->name == 'activity_calendar') {
-            $params = array('instance' => backup::VAR_ACTIVITYID, 'modulename' => backup::VAR_MODNAME);
+            // We don't backup action events.
+            $params = array('instance' => backup::VAR_ACTIVITYID, 'modulename' => backup::VAR_MODNAME,
+                'type' => array('sqlparam' => CALENDAR_EVENT_TYPE_ACTION));
            // If we don't want to include the userinfo in the backup then setting the courseid
            // will filter out all of the user override events (which have a course id of zero).
+            $coursewhere = "";
            if (!$this->get_setting_value('userinfo')) {
                $params['courseid'] = backup::VAR_COURSEID;
+                $coursewhere = " AND courseid = :courseid";
            }
-            $event->set_source_table('event', $params);
+            $calendarsql = "SELECT * FROM {event}
+                             WHERE instance = :instance
+                               AND type <> :type
+                               AND modulename = :modulename";
+            $calendarsql = $calendarsql . $coursewhere;
+            $event->set_source_sql($calendarsql, $params);
        } else {
            $event->set_source_table('event', array('courseid' => backup::VAR_COURSEID, 'instance' => backup::VAR_ACTIVITYID, 'modulename' => backup::VAR_MODNAME));
        }
@@ -78,6 +78,11 @@ class restore_final_task extends restore_task {
        // during backup/restore.
        $this->add_step(new restore_update_availability('update_availability'));

+        // Refresh action events conditionally.
+        if ($this->get_setting_value('activities')) {
+            $this->add_step(new restore_calendar_action_events('restoring_action_events'));
+        }
+
        // Decode all the interlinks
        $this->add_step(new restore_decode_interlinks('decode_interlinks'));

@@ -2653,13 +2653,21 @@ class restore_calendarevents_structure_step extends restore_structure_step {
        $data = (object)$data;
        $oldid = $data->id;
        $restorefiles = true; // We'll restore the files
+
+        // If this is a new action event, it will automatically be populated by the adhoc task.
+        // Nothing to do here.
+        if (isset($data->type) && $data->type == CALENDAR_EVENT_TYPE_ACTION) {
+            return;
+        }
+
        // User overrides for activities are identified by having a courseid of zero with
        // both a modulename and instance value set.
        $isuseroverride = !$data->courseid && $data->modulename && $data->instance;

        // If we don't want to include user data and this record is a user override event
-        // for an activity then we should not create it.
-        if (!$this->task->get_setting_value('userinfo') && $isuseroverride) {
+        // for an activity then we should not create it. (Only activity events can be user override events - which must have this
+        // setting).
+        if ($isuseroverride && $this->task->setting_exists('userinfo') && !$this->task->get_setting_value('userinfo')) {
            return;
        }

@@ -3082,7 +3090,8 @@ class restore_course_logs_structure_step extends restore_structure_step {

        $data = (object)($data);

-        $data->time = $this->apply_date_offset($data->time);
+        // There is no need to roll dates. Logs are supposed to be immutable. See MDL-44961.
+
        $data->userid = $this->get_mappingid('user', $data->userid);
        $data->course = $this->get_courseid();
        $data->cmid = 0;
@@ -3129,7 +3138,8 @@ class restore_activity_logs_structure_step extends restore_course_logs_structure

        $data = (object)($data);

-        $data->time = $this->apply_date_offset($data->time);
+        // There is no need to roll dates. Logs are supposed to be immutable. See MDL-44961.
+
        $data->userid = $this->get_mappingid('user', $data->userid);
        $data->course = $this->get_courseid();
        $data->cmid = $this->task->get_moduleid();
@@ -5529,3 +5539,22 @@ class restore_completion_defaults_structure_step extends restore_structure_step
        $this->set_mapping('course_completion_defaults', $oldid, $newid);
    }
 }
+/**
+ * Restore action events.
+ *
+ * @package     core_backup
+ * @copyright   2017 onwards Ankit Agarwal
+ * @license     http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class restore_calendar_action_events extends restore_execution_step {
+    /**
+     * What to do when this step is executed.
+     */
+    protected function define_execution() {
+        // We just queue the task here rather trying to recreate everything manually.
+        // The task will automatically populate all data.
+        $task = new \core\task\refresh_mod_calendar_events_task();
+        $task->set_custom_data(array('courseid' => $this->get_courseid()));
+        \core\task\manager::queue_adhoc_task($task, true);
+    }
+}
@@ -0,0 +1,116 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Tests for the handling of encrypted contents in backup and restore.
+ *
+ * @package core_backup
+ * @copyright 2016 onwards Eloy Lafuente (stronk7) {@link http://stronk7.com}
+ * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+global $CFG;
+require_once($CFG->dirroot . '/backup/util/includes/backup_includes.php');
+require_once($CFG->dirroot . '/backup/util/includes/restore_includes.php');
+require_once($CFG->dirroot . '/backup/moodle2/backup_custom_fields.php');
+
+class core_backup_encrypted_content_testscase extends advanced_testcase {
+
+    public function setUp() {
+        if (!function_exists('openssl_encrypt')) {
+            $this->markTestSkipped('OpenSSL extension is not loaded.');
+
+        } else if (!function_exists('hash_hmac')) {
+            $this->markTestSkipped('Hash extension is not loaded.');
+
+        } else if (!in_array(backup::CIPHER, openssl_get_cipher_methods())) {
+            $this->markTestSkipped('Expected cipher not available: ' . backup::CIPHER);
+        }
+    }
+
+    public function test_encrypted_final_element() {
+
+        $this->resetAfterTest(true);
+
+        // Some basic verifications.
+        $efe = new encrypted_final_element('test', array('encrypted'));
+        $this->assertInstanceOf('encrypted_final_element', $efe);
+        $this->assertSame('test', $efe->get_name());
+        $atts = $efe->get_attributes();
+        $this->assertCount(1, $atts);
+        $att = reset($atts);
+        $this->assertInstanceOf('backup_attribute', $att);
+        $this->assertSame('encrypted', $att->get_name());
+
+        // Using a manually defined (incorrect length) key.
+        $efe = new encrypted_final_element('test', array('encrypted'));
+        $key = 'this_in_not_correct_32_byte_key';
+        try {
+            set_config('backup_encryptkey', base64_encode($key), 'backup');
+            $efe->set_value('tiny_secret');
+            $this->fail('Expecting base_element_struct_exception exception, none happened');
+        } catch (exception $e) {
+            $this->assertInstanceOf('base_element_struct_exception', $e);
+            $this->assertEquals('encrypted_final_element incorrect key length', $e->errorcode);
+
+        }
+
+        // Using a manually defined (correct length) key.
+        $efe = new encrypted_final_element('test', array('testattr', 'encrypted'));
+        $key = hash('md5', 'Moodle rocks and this is not secure key, who cares, it is a test');
+        set_config('backup_encryptkey', base64_encode($key), 'backup');
+        $this->assertEmpty($efe->get_value());
+        $secret = 'This is a secret message that nobody else will be able to read but me 💩 ';
+        $efe->set_value($secret);
+        $atts = $efe->get_attributes();
+        $this->assertCount(2, $atts);
+        $this->assertArrayHasKey('encrypted', $atts); // We added it explicitly.
+        $this->assertTrue($atts['encrypted']->is_set());
+        $this->assertSame('true', $atts['encrypted']->get_value());
+        $this->assertNotEmpty($efe->get_value());
+        $this->assertTrue($efe->is_set());
+        // Get the crypted content and decrypt it manually.
+        $ctext = $efe->get_value();
+        $hmaclen = 32; // SHA256 is 32 bytes.
+        $ivlen = openssl_cipher_iv_length(backup::CIPHER);
+        list($hmac, $iv, $text) = array_values(unpack("a{$hmaclen}hmac/a{$ivlen}iv/a*text", base64_decode($ctext)));
+        $this->assertSame(hash_hmac('sha256', $iv . $text, $key, true), $hmac);
+        $this->assertSame($secret, openssl_decrypt($text, backup::CIPHER, $key, OPENSSL_RAW_DATA, $iv));
+
+        // Using the default site-generated key.
+        $efe = new encrypted_final_element('test', array('testattr'));
+        $this->assertEmpty($efe->get_value());
+        $secret = 'This is a secret message that nobody else will be able to read but me 💩 ';
+        $efe->set_value($secret);
+        $atts = $efe->get_attributes();
+        $this->assertCount(2, $atts);
+        $this->assertArrayHasKey('encrypted', $atts); // Was added automatcally, we did not specify it.
+        $this->assertTrue($atts['encrypted']->is_set());
+        $this->assertSame('true', $atts['encrypted']->get_value());
+        $this->assertNotEmpty($efe->get_value());
+        $this->assertTrue($efe->is_set());
+        // Get the crypted content and decrypt it manually.
+        $ctext = $efe->get_value();
+        $hmaclen = 32; // SHA256 is 32 bytes.
+        $ivlen = openssl_cipher_iv_length(backup::CIPHER);
+        list($hmac, $iv, $text) = array_values(unpack("a{$hmaclen}hmac/a{$ivlen}iv/a*text", base64_decode($ctext)));
+        $key = base64_decode(get_config('backup', 'backup_encryptkey'));
+        $this->assertSame(hash_hmac('sha256', $iv . $text, $key, true), $hmac);
+        $this->assertSame($secret, openssl_decrypt($text, backup::CIPHER, $key, OPENSSL_RAW_DATA, $iv));
+    }
+}
@@ -0,0 +1,99 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Tests for backup_xml_transformer class.
+ *
+ * @package     core_backup
+ * @subpackage  moodle2
+ * @category    backup
+ * @copyright   2017 Dmitrii Metelkin (dmitriim@catalyst-au.net)
+ * @license     http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+global $CFG;
+require_once($CFG->dirroot . '/backup/util/includes/backup_includes.php');
+require_once($CFG->dirroot . '/backup/moodle2/backup_plan_builder.class.php');
+
+/**
+ * Tests for backup_xml_transformer.
+ *
+ * @package core_backup
+ * @copyright 2017 Dmitrii Metelkin (dmitriim@catalyst-au.net)
+ * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class backup_xml_transformer_testcase extends advanced_testcase {
+
+    /**
+     * Initial set up.
+     */
+    public function setUp() {
+        parent::setUp();
+
+        $this->resetAfterTest(true);
+    }
+
+    /**
+     * Data provider for ::test_filephp_links_replace.
+     *
+     * @return array
+     */
+    public function filephp_links_replace_data_provider() {
+        return array(
+            array('http://test.test/', 'http://test.test/'),
+            array('http://test.test/file.php/1', 'http://test.test/file.php/1'),
+            array('http://test.test/file.php/2/1.jpg', 'http://test.test/file.php/2/1.jpg'),
+            array('http://test.test/file.php/2', 'http://test.test/file.php/2'),
+            array('http://test.test/file.php/1/1.jpg', '$@FILEPHP@$$@SLASH@$1.jpg'),
+            array('http://test.test/file.php/1//1.jpg', '$@FILEPHP@$$@SLASH@$$@SLASH@$1.jpg'),
+            array('http://test.test/file.php?file=/1', '$@FILEPHP@$'),
+            array('http://test.test/file.php?file=/2/1.jpg', 'http://test.test/file.php?file=/2/1.jpg'),
+            array('http://test.test/file.php?file=/2', 'http://test.test/file.php?file=/2'),
+            array('http://test.test/file.php?file=/1/1.jpg', '$@FILEPHP@$$@SLASH@$1.jpg'),
+            array('http://test.test/file.php?file=/1//1.jpg', '$@FILEPHP@$$@SLASH@$$@SLASH@$1.jpg'),
+            array('http://test.test/file.php?file=%2f1', '$@FILEPHP@$'),
+            array('http://test.test/file.php?file=%2f2%2f1.jpg', 'http://test.test/file.php?file=%2f2%2f1.jpg'),
+            array('http://test.test/file.php?file=%2f2', 'http://test.test/file.php?file=%2f2'),
+            array('http://test.test/file.php?file=%2f1%2f1.jpg', '$@FILEPHP@$$@SLASH@$1.jpg'),
+            array('http://test.test/file.php?file=%2f1%2f%2f1.jpg', '$@FILEPHP@$$@SLASH@$$@SLASH@$1.jpg'),
+            array('http://test.test/file.php?file=%2F1', '$@FILEPHP@$'),
+            array('http://test.test/file.php?file=%2F2%2F1.jpg', 'http://test.test/file.php?file=%2F2%2F1.jpg'),
+            array('http://test.test/file.php?file=%2F2', 'http://test.test/file.php?file=%2F2'),
+            array('http://test.test/file.php?file=%2F1%2F1.jpg', '$@FILEPHP@$$@SLASH@$1.jpg'),
+            array('http://test.test/file.php?file=%2F1%2F%2F1.jpg', '$@FILEPHP@$$@SLASH@$$@SLASH@$1.jpg'),
+        );
+    }
+
+    /**
+     * Test that backup_xml_transformer replaces file php links to $@FILEPHP@$.
+     *
+     * @dataProvider filephp_links_replace_data_provider
+     * @param string $content Testing content.
+     * @param string $expected Expected result.
+     */
+    public function test_filephp_links_replace($content, $expected) {
+        global $CFG;
+
+        $CFG->wwwroot = 'http://test.test';
+
+        $transformer = new backup_xml_transformer(1);
+
+        $this->assertEquals($expected, $transformer->process($content));
+    }
+
+}
@@ -1,5 +1,29 @@
 <?php
-    //This script is used to configure and execute the restore proccess.
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * This script is used to configure and execute the restore proccess.
+ *
+ * @package    core
+ * @subpackage backup
+ * @copyright  Moodle
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+define('NO_OUTPUT_BUFFERING', true);

 require_once('../config.php');
 require_once($CFG->dirroot . '/backup/util/includes/restore_includes.php');
@@ -56,8 +56,10 @@ class backup_anonymizer_helper {
        if (preg_match('/^anon\d*$/', $user->username)) {
            $match = preg_match('/^anonfirstname\d*$/', $user->firstname);
            $match = $match && preg_match('/^anonlastname\d*$/', $user->lastname);
-            $match = $match && preg_match('/^anon\d*@doesntexist\.com$/', $user->email);
-            if ($match) {
+            // Check .com for backwards compatibility.
+            $emailmatch = preg_match('/^anon\d*@doesntexist\.com$/', $user->email) ||
+                preg_match('/^anon\d*@doesntexist\.invalid$/', $user->email);
+            if ($match && $emailmatch) {
                return true;
            }
        }
@@ -93,7 +95,7 @@ class backup_anonymizer_helper {
    public static function process_user_email($value) {
        static $counter = 0;
        $counter++;
-        return 'anon' . $counter . '@doesntexist.com'; // Just a counter
+        return 'anon' . $counter . '@doesntexist.invalid'; // Just a counter.
    }

    public static function process_user_icq($value) {
@@ -60,17 +60,26 @@ class restore_structure_parser_processor extends grouped_parser_processor {
        } else if (strpos($cdata, '$@FILEPHP@$') === false) { // No $@FILEPHP@$, nothing to convert
            return $cdata;
        }
+
+        if ($CFG->slasharguments) {
+            $slash = '/';
+            $forcedownload = '?forcedownload=1';
+        } else {
+            $slash = '%2F';
+            $forcedownload = '&amp;forcedownload=1';
+        }
+
+        // We have to remove trailing slashes, otherwise file URLs will be restored with an extra slash.
+        $basefileurl = rtrim(moodle_url::make_legacyfile_url($this->courseid, null)->out(true), $slash);
        // Decode file.php calls
        $search = array ("$@FILEPHP@$");
-        $replace = array(moodle_url::make_legacyfile_url($this->courseid, null));
+        $replace = array($basefileurl);
        $result = str_replace($search, $replace, $cdata);
+
        // Now $@SLASH@$ and $@FORCEDOWNLOAD@$ MDL-18799
        $search = array('$@SLASH@$', '$@FORCEDOWNLOAD@$');
-        if ($CFG->slasharguments) {
-            $replace = array('/', '?forcedownload=1');
-        } else {
-            $replace = array('%2F', '&amp;forcedownload=1');
-        }
+        $replace = array($slash, $forcedownload);
+
        return str_replace($search, $replace, $result);
    }

@@ -44,13 +44,33 @@ class backup_course_task_testcase extends basic_testcase {
     */
    public function test_course_encode_content_links() {
        global $CFG;
+        $httpsroot = "https://moodle.org";
+        $httproot = "http://moodle.org";
+        $oldroot = $CFG->wwwroot;
+
+        // HTTPS root and links of both types in content.
+        $CFG->wwwroot = $httpsroot;
        $encoded = backup_course_task::encode_content_links(
-                $CFG->wwwroot . '/course/view.php?id=123, ' .
-                $CFG->wwwroot . '/grade/index.php?id=123, ' .
-                $CFG->wwwroot . '/grade/report/index.php?id=123, ' .
-                $CFG->wwwroot . '/badges/view.php?type=2&id=123 and ' .
-                $CFG->wwwroot . '/user/index.php?id=123.');
-        $this->assertEquals('$@COURSEVIEWBYID*123@$, $@GRADEINDEXBYID*123@$, ' .
+                $httproot . '/course/view.php?id=123, ' .
+                $httpsroot . '/course/view.php?id=123, ' .
+                $httpsroot . '/grade/index.php?id=123, ' .
+                $httpsroot . '/grade/report/index.php?id=123, ' .
+                $httpsroot . '/badges/view.php?type=2&id=123 and ' .
+                $httpsroot . '/user/index.php?id=123.');
+        $this->assertEquals('$@COURSEVIEWBYID*123@$, $@COURSEVIEWBYID*123@$, $@GRADEINDEXBYID*123@$, ' .
                '$@GRADEREPORTINDEXBYID*123@$, $@BADGESVIEWBYID*123@$ and $@USERINDEXVIEWBYID*123@$.', $encoded);
+
+        // HTTP root and links of both types in content.
+        $CFG->wwwroot = $httproot;
+        $encoded = backup_course_task::encode_content_links(
+            $httproot . '/course/view.php?id=123, ' .
+            $httpsroot . '/course/view.php?id=123, ' .
+            $httproot . '/grade/index.php?id=123, ' .
+            $httproot . '/grade/report/index.php?id=123, ' .
+            $httproot . '/badges/view.php?type=2&id=123 and ' .
+            $httproot . '/user/index.php?id=123.');
+        $this->assertEquals('$@COURSEVIEWBYID*123@$, $@COURSEVIEWBYID*123@$, $@GRADEINDEXBYID*123@$, ' .
+            '$@GRADEREPORTINDEXBYID*123@$, $@BADGESVIEWBYID*123@$ and $@USERINDEXVIEWBYID*123@$.', $encoded);
+        $CFG->wwwroot = $oldroot;
    }
 }
@@ -0,0 +1,132 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Tests for restore_structure_parser_processor class.
+ *
+ * @package     core_backup
+ * @category    test
+ * @copyright   2017 Dmitrii Metelkin (dmitriim@catalyst-au.net)
+ * @license     http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+global $CFG;
+
+require_once($CFG->dirroot . '/backup/util/includes/backup_includes.php');
+require_once($CFG->dirroot . '/backup/util/helper/restore_structure_parser_processor.class.php');
+
+/**
+ * Tests for restore_structure_parser_processor class.
+ *
+ * @package core_backup
+ * @copyright 2017 Dmitrii Metelkin (dmitriim@catalyst-au.net)
+ * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class restore_structure_parser_processor_test extends advanced_testcase {
+
+    /**
+     * Initial set up.
+     */
+    public function setUp() {
+        parent::setUp();
+
+        $this->resetAfterTest(true);
+    }
+
+    /**
+     * Data provider for ::test_process_cdata.
+     *
+     * @return array
+     */
+    public function process_cdata_data_provider() {
+        return array(
+            array(null, null, true),
+            array("$@NULL@$", null, true),
+            array("$@NULL@$ ", "$@NULL@$ ", true),
+            array(1, 1, true),
+            array(" ", " ", true),
+            array("1", "1", true),
+            array("$@FILEPHP@$1.jpg", "$@FILEPHP@$1.jpg", true),
+            array(
+                "http://test.test/$@SLASH@$",
+                "http://test.test/$@SLASH@$",
+                true
+            ),
+            array(
+                "<a href='$@FILEPHP@$1.jpg'>Image</a>",
+                "<a href='http://test.test/file.php/11.jpg'>Image</a>",
+                true
+            ),
+            array(
+                "<a href='$@FILEPHP@$$@SLASH@$1.jpg'>Image</a>",
+                "<a href='http://test.test/file.php/1/1.jpg'>Image</a>",
+                true
+            ),
+            array(
+                "<a href='$@FILEPHP@$$@SLASH@$$@SLASH@$1.jpg'>Image</a>",
+                "<a href='http://test.test/file.php/1//1.jpg'>Image</a>",
+                true
+            ),
+            array(
+                "<a href='$@FILEPHP@$1.jpg'>Image</a>",
+                "<a href='http://test.test/file.php?file=%2F11.jpg'>Image</a>",
+                false
+            ),
+            array(
+                "<a href='$@FILEPHP@$$@SLASH@$1.jpg'>Image</a>",
+                "<a href='http://test.test/file.php?file=%2F1%2F1.jpg'>Image</a>",
+                false
+            ),
+            array(
+                "<a href='$@FILEPHP@$$@SLASH@$$@SLASH@$1.jpg'>Image</a>",
+                "<a href='http://test.test/file.php?file=%2F1%2F%2F1.jpg'>Image</a>",
+                false
+            ),
+            array(
+                "<a href='$@FILEPHP@$$@SLASH@$1.jpg$@FORCEDOWNLOAD@$'>Image</a>",
+                "<a href='http://test.test/file.php/1/1.jpg?forcedownload=1'>Image</a>",
+                true
+            ),
+            array(
+                "<a href='$@FILEPHP@$$@SLASH@$1.jpg$@FORCEDOWNLOAD@$'>Image</a>",
+                "<a href='http://test.test/file.php?file=%2F1%2F1.jpg&amp;forcedownload=1'>Image</a>",
+                false
+            ),
+        );
+    }
+
+    /**
+     * Test that restore_structure_parser_processor replaces $@FILEPHP@$ to correct file php links.
+     *
+     * @dataProvider process_cdata_data_provider
+     * @param string $content Testing content.
+     * @param string $expected Expected result.
+     * @param bool $slasharguments A value for $CFG->slasharguments setting.
+     */
+    public function test_process_cdata($content, $expected, $slasharguments) {
+        global $CFG;
+
+        $CFG->slasharguments = $slasharguments;
+        $CFG->wwwroot = 'http://test.test';
+
+        $processor = new restore_structure_parser_processor(1, 1);
+
+        $this->assertEquals($expected, $processor->process_cdata($content));
+    }
+
+}
@@ -94,6 +94,66 @@ abstract class restore_step extends base_step {
        // Return the passed value with cached offset applied.
        return $value + $cache[$this->get_restoreid()];
    }
+
+    /**
+     * Returns symmetric-key AES-256 decryption of base64 encoded contents.
+     *
+     * This method is used in restore operations to decrypt contents encrypted with
+     * {@link encrypted_final_element} automatically decoding (base64) and decrypting
+     * contents using the key stored in backup_encryptkey config.
+     *
+     * Requires openssl, cipher availability, and key existence (backup
+     * automatically sets it if missing). Integrity is provided via HMAC.
+     *
+     * @param string $value {@link encrypted_final_element} value to decode and decrypt.
+     * @return string|null decoded and decrypted value or null if the operation can not be performed.
+     */
+    public function decrypt($value) {
+
+        // No openssl available, skip this field completely.
+        if (!function_exists('openssl_encrypt')) {
+            return null;
+        }
+
+        // No hash available, skip this field completely.
+        if (!function_exists('hash_hmac')) {
+            return null;
+        }
+
+        // Cypher not available, skip this field completely.
+        if (!in_array(backup::CIPHER, openssl_get_cipher_methods())) {
+            return null;
+        }
+
+        // Get the decrypt key. Skip if missing.
+        $key = get_config('backup', 'backup_encryptkey');
+        if ($key === false) {
+            return null;
+        }
+
+        // And decode it.
+        $key = base64_decode($key);
+
+        // Arrived here, let's proceed with authentication (provides integrity).
+        $hmaclen = 32; // SHA256 is 32 bytes.
+        $ivlen = openssl_cipher_iv_length(backup::CIPHER);
+        list($hmac, $iv, $text) = array_values(unpack("a{$hmaclen}hmac/a{$ivlen}iv/a*text", base64_decode($value)));
+
+        // Verify HMAC matches expectations, skip if not (integrity failed).
+        if (!hash_equals($hmac, hash_hmac('sha256', $iv . $text, $key, true))) {
+            return null;
+        }
+
+        // Arrived here, integrity is ok, let's decrypt.
+        $result = openssl_decrypt($text, backup::CIPHER, $key, OPENSSL_RAW_DATA, $iv);
+
+        // For some reason decrypt failed (strange, HMAC check should have deteted it), skip this field completely.
+        if ($result === false) {
+            return null;
+        }
+
+        return $result;
+    }
 }

 /*
@@ -91,6 +91,52 @@ class backup_step_testcase extends advanced_testcase {
        $bc->destroy();
    }

+    /**
+     * test restore_step class, decrypt method
+     */
+    public function test_restore_step_decrypt() {
+
+        $this->resetAfterTest(true);
+
+        if (!function_exists('openssl_encrypt')) {
+            $this->markTestSkipped('OpenSSL extension is not loaded.');
+
+        } else if (!function_exists('hash_hmac')) {
+            $this->markTestSkipped('Hash extension is not loaded.');
+
+        } else if (!in_array(backup::CIPHER, openssl_get_cipher_methods())) {
+            $this->markTestSkipped('Expected cipher not available: ' . backup::CIPHER);
+        }
+
+        $bt = new mock_restore_task_basepath('taskname');
+        $bs = new mock_restore_structure_step('steptest', null, $bt);
+        $this->assertTrue(method_exists($bs, 'decrypt'));
+
+        // Let's prepare a string for being decrypted.
+        $secret = 'This is a secret message that nobody else will be able to read but me 💩  ';
+        $key = hash('md5', 'Moodle rocks and this is not secure key, who cares, it is a test');
+        $iv = openssl_random_pseudo_bytes(openssl_cipher_iv_length(backup::CIPHER));
+        $message = $iv . openssl_encrypt($secret, backup::CIPHER, $key, OPENSSL_RAW_DATA, $iv);
+        $hmac = hash_hmac('sha256', $message, $key, true);
+        $crypt = base64_encode($hmac . $message);
+
+        // Running it without a key configured, returns null.
+        $this->assertNull($bs->decrypt($crypt));
+
+        // Store the key into config.
+        set_config('backup_encryptkey', base64_encode($key), 'backup');
+
+        // Verify decrypt works and returns original.
+        $this->assertSame($secret, $bs->decrypt($crypt));
+
+        // Finally, test the integrity failure detection is working.
+        // (this can be caused by changed hmac, key or message, in
+        // this case we are just forcing it via changed hmac).
+        $hmac = md5($message);
+        $crypt = base64_encode($hmac . $message);
+        $this->assertNull($bs->decrypt($crypt));
+    }
+
    /**
     * test backup_structure_step class
     */
--- a/Show More
+++ b/Show More