bump year
move www/DTD/ to common/DTD/ like I did in EvolvisForge

otherwise, this will merge-conflict in git Every. Single. Time. Gah!
merge fix from EvolvisForge

revno: 10310
committer: Thorsten Glaser <t.glaser@tarent.de>
branch nick: tarent-5.1
timestamp: Fri 2012-01-20 16:10:48 +0100
message:
  fix DTD: accidentally deleted a href too much
Fixed syntax error
Fixed permissions for Git repositories created before anonscm is enabled
revert most of the CVE patch and “do it right”

directly after creating the new group home directory, as root,
there is no race that can appear due to *users* creating stuff
inside, so do not account for it; also make this code legible
SudoEffectiveUser needs unix_name, not uid, of the target

unbreaks group homedir creation for the n-th time
merge from Evolvis: some more variables and compat functions
merge from Evolvis: group home permission changes

• fallback if /usr/share/gforge/lib/private_default_page.php does
  not exist
• change index file and incoming directory to be group-writable
  (with sgid bit set) by default, to be actually useful
emit a newline after the warning
merge from Evolvis: better session_redirect()
merge from Evolvis: for session_set_admin use the lowest-uid one
instead of impersonating a random person who’s got forge admin rights
make this closer to the code in EvolvisForge (should be no change)

everything that would change FF behaviour is commented out atm
SECURITY: use HMAC-SHA256 (for now) to protect the session cookie

NOTE: after installing this patch, it is *vital* to change your
forge_get_config('session_key') because you *MUST* assume that
the old value is insecure and/or has been leaked!
remove commented-out EvolvisForge compat stuff
oops, use raw octet HMAC output (for size reasons)

this does work as tested on CentOS 5 (php-cli-5.1.6-39.el5_8)…
(mostly) Merge branch 'Branch_5_1' into Branch_5_2

Conflicts:
	src/common/include/session.php
⇒ someone *MUST* look at this, I think this couldn’t really work
Merged from 5.1 (via 5.2)