Aaron Wells authored Feb 04, 2016 and Robert Lyon committed Mar 22, 2016

X-XSS-Protection: Tells the browser not to disable XSS protection

X-Content-Type-Options: Tells the browser not to try to guess at
mimetypes of downloads

X-Permitted-Cross-Domain-Policies: Tells Flash & PDF not to trust
alternate crossdomain.xml files (which set the permissions on whether
this site allows itself to be accessed by scripts in Flash & PDF).
Prevents an attacker from uploading a more permissive crossdomain.xml

X-Powered-By: PHP by default sends this header with the current full
PHP version.

behatnotneeded: Selenium can't examine HTTP response headers

Change-Id: Ia2a6de971fc62b7d8806ad010aa0fbe37c1a7357
(cherry picked from commit 29656f03)

Now that 'mahara' can have blog/blogpost artefacts we want to ignore
them from site menus options for logged in links

Change-Id: I8d1be32678ae97d93187181eb4aedcb331e543eb
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>
(cherry picked from commit 130890b2)

Pat Kira authored Mar 18, 2016 and Robert Lyon committed Mar 21, 2016

behatnotneeded

Change-Id: I6c59b9bb13384f0a4cdf71d1ab82fb219a9137ee
(cherry picked from commit df4492a0)

There was a setting to stop the login link (top right) from showing if
there were sidebars on logged out homepage. This became a problem if
the login box was turned off (not counted as a sidebar block for some
reason) via $cfg->showloginsideblock = false;

But the top right login link should always show when logged out
whether a sidebar is in play or not.

behatnotneeded

Change-Id: I8d6c1916f165285afb1f0210a0ae9b364f3a7a4f
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>
(cherry picked from commit 51910ec5)

* changes:
  Bug 1530613: Getting excluded tags to work with Select2 4.0.1
  Bug 1484781: Added aria-hidden=true to all icons
  Bug 1512528: The edit access 'Shared with' users fails to paginate
  Improve accessibility of select2 (Bug #1492081)
  Bug 1423410: eliminate bulk permission syncing on view/access.php page
  Bug 1533971: Adding v4.0.1

Aaron Wells authored Mar 16, 2016 and Robert Lyon committed Mar 19, 2016

Bug 1557896: When you first click in Select2, it fires off an
aqax request with no "q" value (because there's no query string
yet). We return a "required parameter missing" error message in
a JSON object, which causes a Javascript warning in the browser.

Better to just treat it like an empty q, instead of a missing q.

behatnotneeded - unable to test for issues in console

Change-Id: I81c4cfe77c51fce735cfd2628aaed1e40cc35940
(cherry picked from commit 28fcc277)

behatnotneeded existing tests should be enough

Change-Id: I6316c6301c703353928c9e6210e02cdfc25151a8
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>
Signed-off-by: Aaron Wells <aaronw@catalyst.net.nz>
(cherry picked from commit 1f9bbefe)

Liam Sharpe authored Dec 07, 2015 and Robert Lyon committed Mar 18, 2016

behatnotneeded

Change-Id: I01dc196e0c9931d5cb4be926e7d3c8ce17e06546

Normally it should load more options if they exist when one scrolls to
the bottom of the list, but was not working as the 'more' bits of code
were left out.

behatnotneeded: can't test a select2 that loads data via ajax yet

Change-Id: Ibc5682392d0006c66005a6da27904ed59b97417a
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>

Jono Mingard authored Sep 10, 2015 and Robert Lyon committed Mar 18, 2016

- Modify the AJAX data adapter and search box so that items are
  read out when moving up and down through them with the keyboard
- Link select2 instances to the label(s) of the original <select>
- Allow removing tags with the keyboard
- Hide original <select> completely instead of leaving it
  accessible to screen readers
- Keep focus position when loading more elements with infinite
  scrolling
- Add behat step to set select2 value(s)

behatnotneeded

Change-Id: I6b380f74525c2ca3c38070744d71d1812cec05b0

Also allow the default selected option (this view/collection) from
being removable in the select2 selector

Change-Id: I08187f8e8e131a508abafd3883a3c97e6df7922d
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>

behatnotneeded external library

Change-Id: I0f05181347916a328758e180efe0a2254b5b6c57
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>

Aaron Wells authored Mar 17, 2016 and Robert Lyon committed Mar 18, 2016

Bug 1558393

behatnotneeded: API change only

Change-Id: Iaa88093a12603db177dc475790b0b0bda8bda163

Aaron Wells authored Mar 17, 2016 and Robert Lyon committed Mar 18, 2016

Bug 1558387

With this, we don't have to remember to bump HTML.DefinitionRev in
html_clean(), or clear the htmlpurifier directory in dataroot.

behatnotneeded: API change only

Change-Id: I15cd291fd8e5d7d5c357f1595a89f34f44236e7d

Aaron Wells authored Nov 06, 2015 and Robert Lyon committed Mar 17, 2016

Since this blog post object wasn't committed after having its
description updated, it causes the destructor to try to save
the changes to the database, and that sometimes throws a fatal
error if PHP garbage-collects the global $db variable before it
calls this constructor.

behatnotneeded: Covered by existing "edit_journal.feature"

Change-Id: I5056ecce91b823b245cb5bd29f0676a35a6afd45
(cherry picked from commit 294fa9a4)

When displaying names for adding group members to groups

behatnotneeded

Change-Id: I0fb09eb1a17bd94c58533b8272db38e439897cbe
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>
(cherry picked from commit 564caacd)

behatnotneeded

Change-Id: I1b0c05d18d47dceff18c52c3af72e79078bd4e84
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>
(cherry picked from commit 62fe57ae)

When 'Staff report access' is set to 'no'. This is due to the column
being built from both the 'select' and 'icon' part of the $cols array.

So need to pass in a mostly blank 'select' column info rather than
unset it.

Also fixed up the missing right side line on button when viewing page as
staff with 'Staff report access' set to 'yes'

behatnotneeded

Change-Id: I97d77f0dc136967efa16945114bcd990e49754d0
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>
(cherry picked from commit b5bf4d5d)

For the instition statistics users tab

Also fixing up the display of size in bytes, added round() to output
as it's not useful to show anything less than whole bytes

behatnotneeded

Change-Id: I13a842c910463660299b2b92d5319a03eacb2cab
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>
(cherry picked from commit 2b74dec0)

behatnotneeded

Change-Id: I5c448ecb560a3315d5ff99c408894a0807603e05
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>
(cherry picked from commit 805b2f0d)

The check to exclude current user from results was checking wrong and
forcing the group/institution pages to be ignored as well.

behatnotneeded

Change-Id: Id1566b0ad202e667b8c68294967bc6bc99220659
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>
(cherry picked from commit 3d6807ea)

Bug 1556692: When used together, these can cause problems when
the ID field from Moodle gets truncated to the default
get_new_username() length of "30", when being inserted into
usr.username in Mahara.

behatnotneeded: Can't test Mnet in Behat

Change-Id: Icdeb78b5298e7d63a0610987b0d8fad34e58d036

Change-Id: I260db46eb83bb776f26790996b13fd0dcf555175
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>

This way we can avoid re-making it multiple times further down the
chain.

Most places where the get_owner_object() object was passed can handle
dealing with a User object vs a StdObject anyway.

behatnotneeded - existing tests should suffice

Change-Id: I2b92d9e408066a9c3b4c2f0bb87fbe8370bf9911
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>
(cherry picked from commit 2bcebcd4)

Change-Id: I563eb236711677ddc637f9cd8a4296fdaedde009
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>