Security: avoid $GLOBALS overwrite
Security: sanitize parameter to fix a local file inclusion vulnerability
Merge branch 'QA_4_0' into QA_4_0-security
- port security commit (unsafe usage of preg_replace()) from the 3.5
  branch
- make the feature work (missing globalization of required $_POST params
Prevent null-byte injection in preg_replace()
Security: block another case of remote execution vulnerability
Merge remote branch 'security/QA_4_0-security' into QA_4_0
ChangeLog entries for security fixes