Makefile: fetch before getting mergebase

Change-Id: I947acea1d79f22b3fca796153afd898d0f317b37
Merge "Makefile: fetch before getting mergebase" into 1.6_STABLE
Refactor the URL and embedded code format of Google apps

(Bug #1141446)

Update new format for google apps:
1. Presentation
2. Document
3. Drawing
4. Spreadsheet
5. Form
6. Document viewer

Change-Id: I3caff706eb35867b7760576bb65b1470922ea33d
Fix stored XSS in TinyMCE editor (Bug #1153423)

This patch fixes a stored XSS in the TinyMCE editor, which could be
reproduced where the editor was present. The input was stored which
meant that any future collaborators could be affected by any malicious
payload in the XSS.

The patch works by escaping the defaultvalue of the wsyiwyg form
element, which is the value stored the database.

CVE 2013-1426

Change-Id: Iecf5f1e520e6499db5a0f78493ce119a352b6a91
Signed-off-by: Aaron Wells <aaronw@catalyst.net.nz>
Merge "Fix stored XSS in TinyMCE editor (Bug #1153423)" into 1.6_STABLE
Version bump for 1.6.4

Signed-off-by: Aaron Wells <aaronw@catalyst.net.nz>
Version bump for 1.6.5testing

Signed-off-by: Aaron Wells <aaronw@catalyst.net.nz>
Allow moderation of anonymous comments (Bug #1088609)

Adding the Make Public button visible when author id is
not set (anonymous user) only when owner of artefact is
also viewer of page.

Signed-off-by: rlyon <rlyon@paradise.net.nz>
(cherry picked from commit 845da9e80e6000d74274997da32e93b6336305a4)

Change-Id: I19ba2ab6ffabd3849ba4f6be7be5cb2c0656eaa1
Signed-off-by: Aaron Wells <aaronw@catalyst.net.nz>
Fix uninitialized loop variable that can cause RSS data loss

Bug #1171714

Change-Id: Iba18d590bc6f012708b6927e09ac930994bb3371
Signed-off-by: Aaron Wells <aaronw@catalyst.net.nz>
Bug #1168617: Include "Manage" title for icon

"Manage" tooltip was missing from "Manage" icon
which now shows up.

Change-Id: Id6dea4cc541b2edde72856081e99662aed7b40d3
Signed-off-by: Kristina D.C. Hoeppner <kristina@catalyst.net.nz>
Fixes edge-case bug in group form submission function.
This changes the condition under which a group URL name is filtered out from NULL to "empty string".
It will prevent empty strings from being stored as "urlid" values the database.
For more details please see bug report 1173440.

Change-Id: Icc830b4132d9a2160b02d9f7504fe3311eb89469
Signed-off-by: Stefan Topfstedt <Stefan.Topfstedt@ucsf.edu>
Merge "Fixes edge-case bug in group form submission function. This changes the condition under which a group URL name is filtered out from NULL to "empty string". It will prevent empty strings from being stored as "urlid" values the database. For more details please see bug report 1173440." into 1.6_STABLE
Merge "Fix uninitialized loop variable that can cause RSS data loss" into 1.6_STABLE
Don't include plaintext RSS password in Leap2A archives

Bug #1016253

Signed-off-by: Aaron Wells <aaronw@catalyst.net.nz>
Change-Id: I949173697e03344c498d9a8fe0580beb7b359547
Fix terminal error when there's a mistake in an authenticated RSS feed

Bug 1016253: The instance_config_save() function was relying on
instance_config_validate() having actually parsed the RSS feed. But if
the URL didn't change (even if the username & password did), validate()
wouldn't parse the feed, and so save() would get an uncaught exception
and die.

Signed-off-by: Aaron Wells <aaronw@catalyst.net.nz>
Change-Id: I74f6230d91a725754644d7a709c44b5a8001190e
Don't send RSS block passwords to browser in plaintext

Bug 1016253: Instead of sending the password back to the
browser, we give them a link that says "Change password?"
and if they click it they get an empty password input.

Signed-off-by: Aaron Wells <aaronw@catalyst.net.nz>
Change-Id: I02b33b638f0ca8a5dfcd7c346f2e601351c08f26
If the URL of an RSS feed block is changed, re-enter password

Bug #1172096

Signed-off-by: Aaron Wells <aaronw@catalyst.net.nz>
Change-Id: Ief7bdc1d3746f16b5f725597d54aa1b3c78b2eed
Updating youtube video icon (Bug #1165587)

Change-Id: I4b9e69b11b77e3cba591b5b5fec0aac457f02fd8
Signed-off-by: rlyon <rlyon@paradise.net.nz>
Fix to allow decompression of zip files with subdirectories (Bug #788882)

For zip decompression with subdirectories the folders are created first
then the files added later so needed to get any child subfolders to be added
to their correct parent folder.
Also needed to correctly check if folder existed to stop making extra
empty folders.

Change-Id: Ie6c5b8d130488914542a46cfcf355ee00785fb14
Signed-off-by: rlyon <rlyon@paradise.net.nz>
Fix the remote username warning (Bug #1051792)

Trying to pass stdClass Object rather than the wanted username string

Change-Id: Ide5323d239854fa0d131c3941731432e81c7d0d7
Signed-off-by: rlyon <rlyon@paradise.net.nz>