Added output encoding to prevent potential XSS vulnerability in admin's micro thesauri module
Created an argument encoder class to white list and encode allowed GET params for pagination, sorting and filtering. Persons browsing is fixed now, other modules browsing not yet.
Now Events Module uses ArgumentEncoder to cleanse GET params and avoid XSS.
Now Documents Module uses ArgumentEncoder to cleanse GET params and avoid XSS.
Now Analysis Module uses ArgumentEncoder to cleanse GET params and avoid XSS.
phpCAS updated to version 1.3.3
Added a password policy filter in the UI (no server validation) in order to enforce users to use stronger (complex) passwords.
Added password complecity validation to new user's creation form. Extracted away some code duplication.
Slighty changed cookie check strategy to avoid setting an extra cookie. Now the check is performed on regular session cookie
Added session name sanitisation prev to session start to avoid a potential SQL injection vulnerability.
Merge pull request #8 from txau/bug-xss-mt-customization

Added output encoding to prevent potential XSS vulnerability in admin's ...
Merge pull request #9 from txau/bug-paginator-xss

Bug paginator xss
Merge pull request #10 from txau/bug-php-session-sql-injection

Added session name sanitisation prev to session start to avoid a potenti...
Merge pull request #11 from txau/fix-cookie-check

Slighty changed cookie check strategy to avoid setting an extra cookie. ...
Merge pull request #13 from txau/feature-password-policy

Feature password policy
Merge pull request #14 from txau/update-phpCAS

phpCAS updated to version 1.3.3