fish_config: Listen on both IPv6 and IPv4.

A subclass of TCPServer was created to deny any non-local connections and to
listen using an IPv6 socket.
Check effective credentials of socket peers

Fix for CVE-2014-2905.

Code for getpeereid() on non-BSD systems imported from the PostgreSQL
project under a BSD-style license.
use mktemp(1) to generate temporary file names

Fix for CVE-2014-2906.

Closes a race condition in funced which would allow execution of
arbitrary code; closes a race condition in psub which would allow
alternation of the data stream.

Note that `psub -f` does not work (#1040); a fix should be committed
separately for ease of maintenance.
Revert "Check effective credentials of socket peers"

This reverts commit 8412c867a501e3a68e55fef6215e86d3ac9f617b.

Just checking the credentials of the peer turns out to be insufficient.
See https://github.com/fish-shell/fish-shell/issues/1436.
Fix for CVE-2014-2905 - fishd restart required.

 - Use a secure path for sockets (some code used under license from
   tmux).
 - Provide the secure path in the environment as $__fish_runtime_dir.
 - Link the new path to the old path to ease migration from earlier
   versions.

Closes #1359.

After installing fish built from or after this commit, you MUST
terminate all running fishd processes (`killall fishd`, `pkill fishd`
or similar). Distributors are encouraged to do this from within their
packaging scripts. fishd will restart automatically, and no data should
be lost.
Further fixes to universal variable server socket management

- Change fishd_path to std::string
- Warn, rather than exiting with an error, if the universal variable
  server path is not available, and provide more useful advice.
- Export the new __fishd_runtime_dir variable.
Documented Alt-Right to accept a single word of an autosuggestion

See https://github.com/fish-shell/fish-shell/issues/1262
Authenticate connections to web_config service

 - Require all requests to use a session path.
 - Use a redirect file to avoid exposing the URL on the command line, as
   it contains the session path.

Fix for CVE-2014-2914.
Closes #1438.
webconfig: Use a constant-time token comparison

This prevents a linear-time attack to recover the auth token.
webconfig: fixes for token security

 * Use 16-byte tokens
 * Use os.urandom (random.getrandbits shouldn't be used for security)
 * Convert to hex correctly
Kill fishd after installing fish for OS X, to pick up fishd changes
avoid symlink attacks in __fish_print_packages

 * use $XDG_CACHE_HOME for __fish_print_packages completion caches

Fix for CVE-2014-3219.

Closes #1440.
Bump osx/config.h version number to 2.1.1
Fix webconfig URL generation for python3

Closes #1677.

Signed-off-by: David Adam <zanchey@ucc.gu.uwa.edu.au>
Makefile/configure: detect and use sed from configure
Reset fish_bind_mode when changing fish_key_bindings

Also avoid resetting bindings if fish_key_bindings is "modified" without
actually changing.

Fixes #1638.
Updated license in lexicon_fiter.in
Expand abbreviations on semicolon per #731
Make redirections and pipes expand abbreviations too
Dump interactive logs on travis test failure

As far as I know we can't access the build artifacts from Travis, so we
can't check the interactive logs after a test failure. Add an
environment variable that causes the test runner to dump the logs
itself, and set that variable for Travis.