Security: avoid $GLOBALS overwrite
Security: sanitize parameter to fix a local file inclusion vulnerability
Merge branch 'QA_4_0' into QA_4_0-security
- port security commit (unsafe usage of preg_replace()) from the 3.5
  branch
- make the feature work (missing globalization of required $_POST params
Prevent null-byte injection in preg_replace()
Security: block another case of remote execution vulnerability
Translated using Weblate (Portuguese)

Currently translated at 50.8% (1323 of 2605)
Translated using Weblate (Portuguese (Brazil))

Currently translated at 100.0% (2605 of 2605)
Translated using Weblate (Uzbek)

Currently translated at 49.9% (1299 of 2605)
Translated using Weblate (Uzbek (latin))

Currently translated at 49.1% (1279 of 2605)
Merge remote-tracking branch 'origin/QA_4_0' into QA_4_0
Merge remote branch 'security/QA_4_0-security' into QA_4_0
ChangeLog entries for security fixes
Fix merge conflicts