Merging changes from 2.5.1. Endpoint security, xmlservice.php security, upgrade logic fix.