Added function for escaping query strings and fixed several XSRF vulnerabilities.
Disable loading external entities during XML parsing
Enhanced test
Emit notice if XXE can't be tested and skip test
Fix #6238 Return blank arrays 

I committed this simple change to return the empty array rather than false for empty settings result for ElggPlugin::getAllSettings and getAllUsersSettings. Put this into 1.8 branch.
fixes #3143 login part
Handle case if get_user_notification_settings() returns false
Merge pull request #6250 from edfactor/patch-1

Makes sure plugin settings functions return arrays
Fixes #6012: Gets correct client IP behind proxy (1.8)
Checks X-Real-Ip header as well when determining client IP
Code style fixes for recent PR
Makes sure all group pages respect the limited_groups setting
Merge pull request #6274 from juho-jaakkola/limited_groups

Makes sure all group pages respect the limited_groups setting
Fixed directions for going to the site secret generation page.
Merge pull request #6251 from jeabakker/3143-memcache-entity-cache-on-login

fixes #3143 login part
Added missing @deprecated tags
Preparing 1.8.17 release
Merged in csrf_fix (pull request #7)

Added function for escaping query strings and fixed several XSRF vulnerabilities.
Merged in libxml18 (pull request #8)

Disable loading external entities during XML parsing