Change-Id: I2a2ba2a54de22fb82c36ffd8ca807f7e237ceff1
Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>

As described in bug #884223, if an administator is masquerading as another
user, they should be prevented from jumping as that other user.

Change-Id: Ie07f3b807a61bbbb94c9051fb7c4b8df03d19f24
Signed-off-by: Andrew Robert Nicols <andrew.nicols@luns.net.uk>
Signed-off-by: Francois Marier <francois@catalyst.net.nz>

Change-Id: Ieb595b301b6319a5213a4012fe1b8c3a00e16223
Signed-off-by: Hugh Davenport <hugh@catalyst.net.nz>

To deter brute-forcing of passwords (and prevent ensuing DoS attacks),
this patch temporarily lock accounts after 5 tries, and every 5 minutes
counts above 0 get reset.

Change-Id: Iee9739a69b95b906b6f485f7d90041b50968dcc6
Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>

* changes:
  Fixes for javascript when first adding a plans block to a page
  Allow get_get_javascript_javascript to take a success callback

Add get_string support for the DoB field and descriptions. The
strings are strfdateofbirth for the date, and dateofbirthformatguide
for the description.

Change-Id: I2a5eb8cc7c17bff3a4298bc9776a7439fc4bd1f7
Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>

When a plans block is first dropped on a page, the javascript is not
loaded and initialised correctly.  This commit makes the following
changes:

- Rewrites the task title links after the callback from getScript
- Sets the block's artefactplugin so the js file is found correctly
- Removes any onclick from task titles before rewriting (in case
  there are two plans blocks on a page)
- Hides the pagination on first load, as the paginator object is not
  present at that point.

Change-Id: I40a04f66b3b8c2818f660c42b898b97cbdedb1f5
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

When fetching & evaluating js files using getScript, there's a time
delay, so it's better to pass initialisation js for each block as
a callback to getScript, otherwise the js from the file is not always
loaded in time.

Change-Id: I819f911acb2a729f4cf3c52b06a285a793ba819f
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

Commit 9496078b

 overwrote the $js variable in build_configure_form,
losing any inline javascript from the form's elements.

Change-Id: I541d510134b238789fbcea88512ed12889a2e7ab
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

* changes:
  Fix test for internal js files in block javascript
  Eval js to rewrite task titles after block configuration (bug #845534)
  Use function to process get_instance_config_javascript js (bug #845534)

Change-Id: I28d09af1c1048363c16b5b29621dacf5b3ce5509
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

Change-Id: I699fe4418e2c21ec227feb8fc5a5940f529c8f73
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

The test for whether a blocktype plugin's js file was internal (and
needed a wwwroot added) is case sensitive, and ignored https.

Change-Id: Idc81123d0367df739a698ab688b4d4a59e023da0
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

When running through the list of a user's groups for display in the
Share with my groups buttons, a group with a long name can cause
another group's button to have the long-named group's short name
displayed.  The php array pointer is not moved when items are added
to the array.

Change-Id: If90b63ec721bfbee2b2c1ad2c7d29d855c9ce1f2
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

When a plans block is first added to the page, the javascript overlay of
the task titles was not evaluated.  This is fixed by moving javascript
functions for the plans block into a new javascript file and pulling the
script onto the page with the same method used by the configuration form
javascript.  A new get_instance_inline_javascript method is added to
initialise the block when it's first configured.

Change-Id: I148a1e8a667c26fe58b3f915768ada4743718c5b
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

Moving this code into its own function will allow it to be used for
block instance rendering javascript as well as the configuration form.

Change-Id: I42dba8425a8455aaa9faae19d50414e33c5988db
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

Change-Id: Iab7aac11915b19d0c3e306949513dfc90e6a82c6
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

Change-Id: Ib2d1cd9068a48d7f199dd3d056ab52ef93a3d59b
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

Trying to access blocktype/wall/deletepost.php with a bad wallpost id
creates a new empty View object, and attempts to commit it to the db
when the View destructor is called.  This fails with an sql error, and
then a PHP Fatal error.

Change-Id: I7e462cc4ea6cda0611e432336839d153bbd0a42e
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

This was previously added in commit 80006487 but deleted again by
commit 1fec6736

.  See bug #597479.

Change-Id: If27ac8e9f5c7de0f72fce2c0306e40a046134ab2
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

Friend request notifications from deleted users stay in the inbox,
and contain a url to the deleted user's profile.  We should just
delete these notifications, because they're no longer useful.

Change-Id: I224197238e3d5ca2f90bd28514a07f6d5d6b9852
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

The artefact_access_role subselect can return a lot of rows when
artefact_access_role is joined to group_member without also going
through artefact.

Also, the artefact_access_role & artefact_access_usr checks are
moved in to subselects in the where clause, because that appears
to make the query run faster.

Change-Id: Ibba16c8db59213fe4861262a950d628937f5ec13
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

This seems to speed the query up, probably because there are usually
not many files inside the admin public folder.

Change-Id: I99a3eff6e4b52e4942f490331d6f2cc48a3a5b0d
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

Change-Id: Ied14a399ba2b5552187784b53ec5b8213979638d
Signed-off-by: Richard Mansfield <richard.mansfield@catalyst.net.nz>

Bug #872619

Regression from 79810c3d



Basically, a default parameter of null was given, then trim
was called, which made it into the string '' which then failed
the test is_null in the files it was used.

This reorders the functions so that the trim is called after
the test to see whether the default should be used. This means
that the default value is never trimmed, and can be null.

One exception to this, is the param_boolean which doesn't test
to see whether it is the default that is returned, so a check
is made first to see whether it is null.

Change-Id: I66d7253a8414dec7eb3ea67ebd363ea068a32012
Signed-off-by: Hugh Davenport <hugh@catalyst.net.nz>