Kristina Hoeppner authored Mar 31, 2016 and Robert Lyon committed Mar 31, 2016

behatnotneeded

Change-Id: I82dcce85a26722d6466b87e2b039bac28710ee6c

To stop unwarrented access to the lib/cron.php page
and to the admin/upgrade.php page

behatnotneeded

Change-Id: I9eef9e2ddf85bdf8a2424bb9d0972ea4970dfa86
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>

Bug 1523499: Old wiki.mahara.org links without the "/wiki",
and HTTP links that should be HTTPS.

Also updated the installer release notes link to point to
the base "Release_Notes" page in the wiki, because we no
longer maintain separate wiki pages for each release.

behatnotneeded: Covered by existing tests

Change-Id: I02e80eb4d8df5adddee88e77156e8e103ca24c51

Change-Id: I5c147bf0ab19e02718666d16ee52f58a74e926b7
behatnotneeded: Covered by existing tests

Kristina Hoeppner authored Sep 06, 2015 and Robert Lyon committed Sep 08, 2015

incl. in a couple of places simply changing the
lang string ID so that it shows up for the
translators.

behatnotneeded

Change-Id: Ifbee0345d00078ffe99367f2f3e2bae4ecab2b69
Signed-off-by: Kristina D.C. Hoeppner <kristina@catalyst.net.nz>

To allow us to show a more detailed error message if site admin (not
belonging to the group) goes to review an objectionable group page
or group forum topic that has already been sorted out.

Change-Id: If4785528bfe29736542972adce7609cdb0522248
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>

Add support for getting multiple artefacts from an array
of IDs, all at once. The main saving is that we then do
one SQL query for the whole array instead of one for each
element in the array.

In testing admin/users/bulkexport.php, this reduced
execution time for an export of 1000 users by 12 seconds
(approx 10 percent).

Change-Id: I51867cd4693a7572dd609b98b6503251e473078a
Signed-off-by: Nigel Cunningham <nigelc@catalyst-au.net>

The errors language file had incorrect string [blockinstancednotfound].
Corrected to [blockinstancenotfound].

Change-Id: I7f2d00bb63581c0b766f3a18af820afe9a55eca1

Bug 1250256

Change-Id: Iefd489adb4f7d458d1e8b45727fab5509c61398b

- have updated copyright for the pages that had existing copyright
notices (except for the lib/pieforms/ section as i'm not too sure if
that needs changing as it is a different Catalyst IT product)

Change-Id: I11c65ad26cb9cd856cf16b1dccbd4223ba086645
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>
Signed-off-by: Aaron Wells <aaronw@catalyst.net.nz>

Bug1237721

Change-Id: I219334cff3082cab7c28e66f7518c77860897fc0

Fixing small language string problems prior to
the RC for 1.8.

Change-Id: Iadf84c061a8de55b67f1ae6bdc97dc650b067cee
Signed-off-by: Kristina D.C. Hoeppner <kristina@catalyst.net.nz>

Upgrade our ADODB driver from the long-obsolete mysql driver to the actively developed mysqli driver

Bug 1187964: The biggest improvement is that the ADODB mysqli driver actually supports transactions!

Change-Id: I8e55ea28cd6e6b8ed5c883646c1172d318af5554

- Bugs #1201258, #1181010, #1199563

As these are all integrated together it is easier to test them as
one patchset.

Change-Id: I5ce68a4ea2de1de8b9deeb7d95380fcdcae095a0
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>

no ID changes because not necessary to retranslate

Change-Id: I65855be719e00942738f5f688970951b49dcfdfb
Signed-off-by: Kristina D.C. Hoeppner <kristina@catalyst.net.nz>

If possible use mb_strtolower rather than strtolower as it
might not convert UTF-8 characters properly.

Change-Id: I91a78e74b9154362d1c631db24a6d5e5ddeccb14
Signed-off-by: Christopher Tombleson <christopher@catalyst.net.nz>

Bug #1006634, part 2

Reads new query parameters on user/view.php, group/view.php, and
view/view.php, which are expected to contain valid urlid values, and
finds the appropriate view based on these instead of an id.

Change-Id: I6bff25311afb3c80bdd2c4f1f2d736b92434a92a
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

Change-Id: I8523ec5c780e1e55a4e6cf82904da44036c07ca7
Signed-off-by: Hugh Davenport <hugh@catalyst.net.nz>

If the MySQL user doesn't have trigger permission, an SQLException was
thrown along with an unhelpful generic error message.  This privilege
is now checked before beginning the install/upgrade, and the message
is now informative.

Change-Id: If35750610cdc84e97bf8f2974d496dea43b8b991
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

Modifies the message to include a link to a wiki page.

See the comments on https://reviews.mahara.org/1108



Change-Id: I370fa2584943849ccf70a1a60a3aa64c78a06972
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

Change-Id: I44aedd0612a9057a06f54875a0241d1e43b95184
Signed-off-by: Kristina D.C. Hoeppner <kristina@catalyst.net.nz>

This salt is used to add an extra layer of salting that
isn't visible from the database. This requires attackers
to obtain both the database, and the config.php file to
get the true salt value that is passed to crypt.

Bug #843568

See http://docs.moodle.org/20/en/Password_salting



Change-Id: Iaa575a4724e387104f9e436c07b336ef8c7ebef5
Signed-off-by: Hugh Davenport <hugh@catalyst.net.nz>
Signed-off-by: Francois Marier <francois@catalyst.net.nz>

Change-Id: Ib9a72a9e36bb24da5907720242b23e991bb7bf9a
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

Currently there's no warning if the PHP GD library has been
compiled without one support for a file type. When a user attempts
to upload an image of an unsupported type, it will fail.

Change-Id: I682a39aeaba2d06494868210b9ef9d8f46f1b136
Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>

Trying to set this option fails when an open_basedir restriction is in
effect.  This patch also checks open_basedir and adds a warning to the
admin area, and in the sanity check for an unwritable dataroot, the
open_basedir directories are listed on the screen as a hint for
installation.

Change-Id: Ic394517f436955b038f321b06011b818d4967026
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

Amended the error string only, FreeType GD extension is still required.

Change-Id: I3cab1eeebc1f3be85c31f69a147bd68194ca7a22
Signed-off-by: Ruslan Kabalin <ruslan.kabalin@luns.net.uk>

Add a check to ensure the address is valid, and direct user to the
config section with a link in the error message.

Change-Id: I205351c71447a21e3c8441a861e7febb6c71de80
Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>

This is based on an OWASP recommendation and corresponds to 128
bits of entropy.

https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Session_ID_Properties



Change-Id: Ie47779d586c39bc339728e4772467407fac90ee4
Signed-off-by: Francois Marier <francois@catalyst.net.nz>

Change-Id: I3cf628b84dec10d80ce3a859d342f0c37e6c5f58
Signed-off-by: Francois Marier <francois@catalyst.net.nz>

Currently, copying journal does not ensure that the multipleblogs
setting is set. This means that the user must manually do this to
see their copied journal entries. This patch ensures that the
setting is set on, and reloads the session. It also notifies the
user that the journal has been made.

Change-Id: Ief724d0bb7f2aaf489b995e53194afa8382819c0
Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>

Currently use of a proxy such as nginx to force https usage results
in a bit of loopiness. This patch adds the sslproxy setting and when
this is set, mandates that the wwwroot be a https address.

Change-Id: Ic4cfe048202cea60098e60e57adb99a0cb594619
Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>

Leap2A is the official name of the standard. LEAP2A is the old
name.

Change-Id: I3fe1ba48923da21fee991508b23338da9713772c
Signed-off-by: Francois Marier <francois@catalyst.net.nz>

These closing tags are unnecessary and against our coding
guidelines. Let's get rid of them all in one go.

Change-Id: Ia94f103e525185597ee3780a3839d7577cdd0c29
Signed-off-by: Francois Marier <francois@catalyst.net.nz>

Mention that %z is a PHP formatting code, and that
the problem is usually due to running PHP on windows.

Change-Id: Ice010d59826aa99965ced045cd82a883be349603
Signed-off-by: Hugh Davenport <hugh@catalyst.net.nz>

Change-Id: I0ce9180f187e5f94b95b2d16afc9bc9c23fa2557
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

Bug #771597 - This appears to be only for Windows hosts, which
return a full string identifier (eg New Zealand Standard Time)
where others return +1200.

Also, modified the format string to have better compatibility
with more hosts for hour:minute:second formatting.

Change-Id: I979f2b6f1d5e0d08ac3aa6dec05036b718bb8ee1
Signed-off-by: Darryl Hamilton <darrylh@catalyst.net.nz>

Signed-off-by: Eugene Venter <eugene@catalyst.net.nz>
Change-Id: I45996d777528a9720eb0d9150ada6a6b66fe4288

Change-Id: I25214a83290a1948a6cedcadb5937fa6fcdbaff6
Signed-off-by: Darryl Hamilton <darrylh@catalyst.net.nz>

Signed-off-by: Francois Marier <francois@catalyst.net.nz>

Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>