fixed information leakage in ACL plugin FS#1847
another fix for FS#1847 + msg increased
Added CRSF security token checks in ACL plugin
increased conf/msg for recent CSRF problem SA38205
Merge branch 'master' into stable

Conflicts:
	conf/msg
	lib/plugins/acl/ajax.php
Merge branch 'master' into stable
Merge branch 'master' into stable
Include VERSION file
Merge branch 'master' into stable
Merge branch 'master' into stable
Version upped to rc2010-10-27 "Busy Wednesday"
Merge branch 'master' into stable
Release 2010-11-07 "Anteater"
maintain the list of removed files in the repository

this is mainly for use with plugin:upgrade and thus will be
cherrypicked into the current stable branch as well.
preg_quote namespaces in auth_aclcheck

Like ids namespaces are now preg_quoted in the acl check (and therefore
the escaping of "*" has been removed). When plugins call the ACL check
function with strange ids the regex fails otherwise (in the case of the
include plugin errors like "Warning: preg_grep() [function.preg-grep]:
Compilation failed: missing terminating ] for character class at offset
47" have been reported by two users).

I've run the acl tests after this change and everything passes so this
shouldn't break anything but please test this especially with protected
wikis as this change modifies the code that handles namespace
permissions. Furthermore permissions for a namespace foobar are no
longer applied to namespaces with names like foo.ar, I hope nobody has
used that "feature".

When you are using per-user namespaces, user registration is open and
either write or read protection for these namespaces is important to
you this is a security fix for you: When someone wants to get access to
the namespace of a user "foo.bar" he can register as "fooxbar" (where
"x" is an arbitrary character) and will have access to the user
namespace of the user "foo.bar" as when a page in "foo.bar" is checked
it will match the rule for "fooxbar".
Fix several security issues in the XML-RPC interface

For locks and getRevisions there hasn't been any acl check. In many
other cases the id hadn't been cleaned before the acl check was done
which means that many acl rules that should be applied weren't applied.
So e.g. when you have read permissions for the root namespace but not
for a subnamespace you could add a leading ":" and the permissions for
the root namespace will be used instead of the permissions for the
subnamespace. This did not apply to writing pages and reading media
files, but writing and deleting media files have been concerned as well
as reading both plain and html versions of pages.

This only concerns installations where XML-RPC is enabled (default is
disabled) and XML-RPC is allowed for all or untrusted users.
increased msg count
2010-11-07a Security Fix

This security update fixes problems in the XMLRPC interface where
ACLs where not checked correctly sometimes, making it possible to access
information that should not have been accessible.

This only affects users who have enabled the XMLRPC interface (default
is off).

This update also includes a fix that caused errors in the general ACL
checking function under certain conditions. No exploits are known for
this problem though.
Release preparations
Merge branch 'master' into stable

Conflicts:
	data/deleted.files
	doku.php
	lib/exe/xmlrpc.php