GitLab

(cherry picked from commit c017258e)

Corrected & to & in URL for internalmedia (Fixes #3438).

These settings are insufficient for a real production site and
only work on Apache.

Given they could interfere with a well configured webserver, let's
remove them until we come up with a more complete solution.
Signed-off-by: Francois Marier <francois@catalyst.net.nz>

Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>

This is version 1.5 of the upstream code. (Version 2.2 is the latest.)
Signed-off-by: Francois Marier <francois@catalyst.net.nz>

This is pretty much the same code but without the formatting
customisations we had.
Signed-off-by: Francois Marier <francois@catalyst.net.nz>

This is based on the proposal in the Appendix of this page:

  http://www.gnu.org/philosophy/javascript-trap.html



We now explicitly give permission to minify/compress the Mahara
javascript files.
Signed-off-by: Francois Marier <francois@catalyst.net.nz>

Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>

Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>

Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>

Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>

Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>

Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>

Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>

Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>

Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>

Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>

Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>

Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>

Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>

Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>

This was not exploitable, but will reduce the risk that a SQL injection
will be accidentally introduced in the future.
Signed-off-by: Francois Marier <francois@catalyst.net.nz>

Signed-off-by: Francois Marier <francois@catalyst.net.nz>

Signed-off-by: Francois Marier <francois@catalyst.net.nz>

Signed-off-by: Francois Marier <francois@catalyst.net.nz>

All HTML output (i.e. all echo/print statements going to the browser) should
now be in this file.

This is so that we can easily review all areas of Mahara where XSS bugs could
hide (other than templates and PHP pieforms).

Note that lib/errors.php echo statements can't be moved here since we want
that file to always work and can't include other code/files.
Signed-off-by: Francois Marier <francois@catalyst.net.nz>

We will remove it in each template once we've added |escape or |safe to every variable.
Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>

Much of the help text was out of date or confusing, and some language strings lacked
clarity or conciseness.
Signed-off-by: Evan Goldenberg <evang@catalyst.net.nz>

Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>

The Leap2A specification has rebranded and thus we should reflect that
change in the next Mahara release.

I also updated a few URLs.
Signed-off-by: Francois Marier <francois@catalyst.net.nz>

Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>

Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>

Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>

Signed-off-by: Richard Mansfield <richardm@catalyst.net.nz>

Signed-off-by: Penny Leach <penny@mjollnir.org>