Cameron Ball authored Feb 11, 2016 and Eloy Lafuente committed Mar 08, 2016

Thank you to Zachary Durber for originally working on this issue.

Krista Koivisto authored Feb 04, 2016 and Eloy Lafuente committed Mar 08, 2016

When getting the navigation branch data through AJAX, require
login if forcelogin is set.

Travis Noll authored Dec 02, 2015 and Eloy Lafuente committed Mar 07, 2016

Singleview users must have Manage Grade permission to modify the
Exclude grade attribute.

David Mudrák authored Jan 12, 2016 and Eloy Lafuente committed Mar 07, 2016

This issue mostly affects the search form fields. Submitted values for
these fields are typically obtained via optional_param() with
PARAM_NOTAGS specified as the parameter type - see parse_search_field()
methods. Such values themselves are not safe enough to be printed back
directly into the HTML as they might contain malicious code.

While working on the patch, some other places with weak protection were
detected and fixed.

In case of the itemid parameters, explicit clean_param() is added to
make sure we cast the value as an integer. That should make the s()
unnecessary but it was added anyway as an extra protection (just in case
the code flow changes or the parts of the code are re-used elsewhere).

Merge branch 'install_29_STABLE' of https://git.in.moodle.com/amosbot/moodle-install into MOODLE_29_STABLE

This is a backport of a number of commits from MDL-49817  which
in general are about simplifying and moving to standard 'grunt' things.

jQuery ajax requests containing multiple '?' get replaced with a
string similar to jQuery152330039032_1231231, this is because it
is processing a stringified data object as jsonp and thinks its a url.
 workaround is to add contenttype
see https://github.com/jquery/jquery/issues/1799

Merge branch 'MDL-53214-29-category-feedback' of git://github.com/cameron1729/moodle into MOODLE_29_STABLE