Add security target for Makefile

It will push a draft patch, and add the security team to the reviewers
list.

Change-Id: Icdc4672abaae327db2066c74ff7b484623de5a4f
Signed-off-by: Hugh Davenport <hugh@catalyst.net.nz>
Makefile: Add a test for security keywords to securitycheck

Currently checks for cve or security.

Change-Id: I69ae3a2a721bf0179d7b914c8f40f612e71a6204
Signed-off-by: Hugh Davenport <hugh@catalyst.net.nz>
Makefile: check mergebase of remote not local branch

Change-Id: I62c48bfc55e7bc80dca97a34592d6e8fbd00a465
Signed-off-by: Hugh Davenport <hugh@catalyst.net.nz>
Check originals directory before iterator in upgrade (Bug #1080498)

If no "original" files had been created via uploads yet, the base
directory was absent, causing the directoryiterator to fail.

Change-Id: I77741f5f8c154a4afdb7b26846dd1aac4356ac72
Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>
Bug #1079498: Fix XSS in pagination URL

Currently, the url of a pagination (used for the prev/next links as
well as the numbered pages) was not santized on output.  This was
discovered from the group member search page which passed in the query
as a GET paramter in the URL for the pages. This required that the
search query returns more results than the limit (10) to trigger the
bug. This also may affect other places that use a pagination setup.

This patch fixes this by sanitizing the url on output, in prev/next and
numbered links.

CVE-2012-2253
Signed-off-by: Hugh Davenport <hugh@catalyst.net.nz>
Change-Id: Id9ed08ef5e61b12580e28f4b18975b2c409b594d
Fix the rss image exceptions preventing updating (Bug #1081431)

Check the image data is a string (eg url) or array before
proceeding, and set data to null if not.

Serialising is the only way to check if a value can be unserialised
so @ is suppressing the warnings thrown by non-unserialisable data.

Prevent the issue happening in future installs, and fix current
installs.

Change-Id: I05c88f95e2f511e491bcbd5fa40d3c41949eff7f
Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>
Merge "Check originals directory before iterator in upgrade (Bug #1080498)" into 1.5_STABLE
Merge "Bug #1079498: Fix XSS in pagination URL" into 1.5_STABLE
Version bump for 1.5.7

Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>
Version bump for 1.5.8testing

Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>
Remove useragent from sso session check (Bug #1082416)

Due to an override for moodle sites in Firefox 17 the useragent
in moodle and mahara cannot match, therefore jumping is broken.
This does not remove the useragent data storage, just the check
when the query for the sessions occurs in transfer and logout.

Change-Id: I59a2e3fb1aea20027ce6cf24338440c866b56f58
Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>
Merge "Remove useragent from sso session check (Bug #1082416)" into 1.5_STABLE
Fix pagination double encoding (bug #1089282)

Change-Id: Iee6a362c264eed24dea92ea7b86b9b29fab2e9ee
Signed-off-by: Ruslan Kabalin <r.kabalin@lancaster.ac.uk>
Fix double encoding of &amp; in 'url' for a pagination (Bug #1090203)

Make sure the string '&amp;' does NOT passed to 'url' of a pagination.

All values of 'url' passed to build_pagination were well investigated
and fixed.
All strings of '&amp;' were also well investigated

Change-Id: Id35837459e9dcfc42d2d6133720123e85758aac1
Signed-off-by: Son Nguyen <son.nguyen@catalyst.net.nz>