--- mahara-1.0.4.orig/REPO_HAS_MOVED
+++ mahara-1.0.4/REPO_HAS_MOVED
@@ -0,0 +1,27 @@
+Oh hai. Just so you know, the git repository for Mahara is now at
+git.mahara.org. You can do one of two things to update to using the new
+repository:
+
+1. edit the file .git/config. It will have a block something like (not
+   necessarily exactly like) this:
+
+       [remote "origin"]
+           url = http://git.catalyst.net.nz/mahara.git
+           fetch = +refs/heads/*:refs/remotes/origin/*
+
+   Change the url line to read:
+
+       url = http://git.mahara.org/git/mahara.git
+
+Then run 'git fetch origin' or 'git pull' as you'd normally do and see if you
+get new stuff.
+
+(ps: I don't know what will happen if you change the protocol from http to git,
+but it's probably better if you can use the git protocol, it's smarter and will
+result in you downloading less stuff)
+
+2. Remove this repository and clone afresh:
+
+       git clone git://git.mahara.org/mahara.git
+
+kthxbye
--- mahara-1.0.4.orig/debian/mahara.dirs
+++ mahara-1.0.4/debian/mahara.dirs
@@ -0,0 +1,5 @@
+etc/mahara
+usr/share/mahara
+var/lib/mahara
+var/lib/mahara/smarty/cache
+var/lib/mahara/smarty/compile
--- mahara-1.0.4.orig/debian/mahara.templates
+++ mahara-1.0.4/debian/mahara.templates
@@ -0,0 +1,48 @@
+Template: mahara/db_type
+Type: select
+Default: postgres8
+Choices: postgres8, mysql5
+_Description: Database type:
+ What type of database should be used for the Mahara site
+
+Template: mahara/db_host
+Type: string
+Default:
+_Description: Database host:
+ Which database host should be used for the Mahara site
+ You can leave this blank to connect via UNIX sockets
+
+Template: mahara/db_port
+Type: string
+Default:
+_Description: Database port:
+ Which database port should be used for the Mahara site
+ You can leave this blank for the default
+
+Template: mahara/db_name
+Type: string
+Default: mahara
+_Description: Database name (not username):
+ Which database should be used for the Mahara site
+
+Template: mahara/db_user
+Type: string
+Default: mahara
+_Description: Database username:
+ Which username should be used to connect to the Mahara database
+
+Template: mahara/db_pass
+Type: string
+Default:
+_Description: Database password:
+ Which password is associated with the given username
+ You can leave this blank if you are not using password authentication.
+
+Template: mahara/smtphosts
+Type: string
+Default:
+_Description: SMTP Hosts:
+ Comma separated list of SMTP servers to use to send mail
+ .
+ If you leave this blank, the system mailer will be used. Generally, this will
+ work fine
--- mahara-1.0.4.orig/debian/mahara-apache2.dirs
+++ mahara-1.0.4/debian/mahara-apache2.dirs
@@ -0,0 +1,2 @@
+etc/mahara
+usr/share/mahara
--- mahara-1.0.4.orig/debian/mahara.logrotate
+++ mahara-1.0.4/debian/mahara.logrotate
@@ -0,0 +1,7 @@
+/var/log/mahara/cron.log {
+     create 644 www-data www-data
+     rotate 12
+     weekly
+     compress
+     missingok
+}
--- mahara-1.0.4.orig/debian/rules
+++ mahara-1.0.4/debian/rules
@@ -0,0 +1,90 @@
+#!/usr/bin/make -f
+
+# Uncomment this to turn on verbose mode.
+#export DH_VERBOSE=1
+
+include /usr/share/dpatch/dpatch.make
+
+# This has to be exported to make some magic below work.
+export DH_OPTIONS
+
+configure: configure-stamp
+configure-stamp:
+	dh_testdir
+	touch configure-stamp
+
+build: configure-stamp
+
+install: configure-stamp patch-stamp
+	dh_testdir
+	dh_testroot
+	dh_installdirs
+
+	# Main Mahara files
+	cp -r $(CURDIR)/htdocs/* $(CURDIR)/debian/mahara/usr/share/mahara
+
+	# Exclude common files
+	find $(CURDIR)/debian/mahara/usr/share/mahara/ -name "readme.txt" -exec rm {} \;
+	find $(CURDIR)/debian/mahara/usr/share/mahara/ -name "license.txt" -exec rm {} \;
+	find $(CURDIR)/debian/mahara/usr/share/mahara/ -name "COPYING*" -exec rm {} \;
+	find $(CURDIR)/debian/mahara/usr/share/mahara/ -name "README" -exec rm {} \;
+	find $(CURDIR)/debian/mahara/usr/share/mahara/ -name "LICENSE*" -exec rm {} \;
+
+	# Exclude specific files/directories
+	rm -f $(CURDIR)/debian/mahara/usr/share/mahara/theme/default/static/captcha.ttf
+	rm -f $(CURDIR)/debian/mahara/usr/share/mahara/theme/schoolmyportfolio/static/captcha.ttf
+	rm -f $(CURDIR)/debian/mahara/usr/share/mahara/robots.txt
+	rm -f $(CURDIR)/debian/mahara/usr/share/mahara/lib/phpmailer/ChangeLog.txt
+	rm -rf $(CURDIR)/debian/mahara/usr/share/mahara/lib/adodb/docs/
+	rm -rf $(CURDIR)/debian/mahara/usr/share/mahara/lib/adodb/tests/
+	rm -f $(CURDIR)/debian/mahara/usr/share/mahara/lib/adodb/pear/readme.Auth.txt
+	rm -rf $(CURDIR)/debian/mahara/usr/share/mahara/lib/snoopy/
+	rm -rf $(CURDIR)/debian/mahara/usr/share/mahara/lib/pear/File
+	rm -f $(CURDIR)/debian/mahara/usr/share/mahara/lib/pear/File.php
+	rm -rf $(CURDIR)/debian/mahara/usr/share/mahara/lib/pear/PEAR
+	rm -f $(CURDIR)/debian/mahara/usr/share/mahara/lib/pear/PEAR.php
+	rm -rf $(CURDIR)/debian/mahara/usr/share/mahara/lib/smarty/libs/
+
+	# Config files (common package)
+	cp $(CURDIR)/debian/config.php $(CURDIR)/debian/mahara/etc/mahara/
+	cp $(CURDIR)/htdocs/robots.txt $(CURDIR)/debian/mahara/etc/mahara/
+
+	# Config file (-apache2)
+	cp $(CURDIR)/htdocs/.htaccess $(CURDIR)/debian/mahara-apache2/usr/share/mahara
+	cp $(CURDIR)/debian/apache.conf $(CURDIR)/debian/mahara-apache2/etc/mahara/apache.conf
+
+clean: clean1 unpatch
+clean1:
+	dh_testdir
+	dh_testroot
+	rm -f configure-stamp
+	dh_clean 
+	debconf-updatepo
+
+# Build architecture-dependent files here.
+binary-arch: build install
+# We have nothing to do by default.
+
+# Build architecture-independent files here.
+binary-indep: build install
+	dh_testdir
+	dh_testroot
+	dh_installchangelogs 
+	dh_installdocs
+	dh_installdebconf
+	dh_installcron
+	dh_installlogrotate
+	dh_compress 
+	dh_fixperms
+
+	dh_installdeb
+
+	dh_link
+
+	dh_gencontrol
+	dh_md5sums
+
+	dh_builddeb -- -Z bzip2
+
+binary: binary-indep binary-arch
+.PHONY: build clean binary-indep binary-arch install patch unpatch configure
--- mahara-1.0.4.orig/debian/mahara.preinst
+++ mahara-1.0.4/debian/mahara.preinst
@@ -0,0 +1,35 @@
+#! /bin/sh
+# preinst script for mahara
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <new-preinst> `install'
+#        * <new-preinst> `install' <old-version>
+#        * <new-preinst> `upgrade' <old-version>
+#        * <old-preinst> `abort-upgrade' <new-version>
+#
+# for details, see http://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+case "$1" in
+    upgrade)
+        rm -rf /var/lib/mahara/smarty/compile/*
+    ;;
+    install|abort-upgrade)
+    ;;
+
+    *)
+        echo "preinst called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
--- mahara-1.0.4.orig/debian/mahara.docs
+++ mahara-1.0.4/debian/mahara.docs
@@ -0,0 +1 @@
+README
--- mahara-1.0.4.orig/debian/mahara.links
+++ mahara-1.0.4/debian/mahara.links
@@ -0,0 +1,4 @@
+usr/share/mahara/js/MochiKit/Packed.js  usr/share/mahara/js/MochiKit/setup.js
+etc/mahara/config.debconf.php           usr/share/mahara/config.debconf.php
+etc/mahara/config.php                   usr/share/mahara/config.php
+etc/mahara/robots.txt                   usr/share/mahara/robots.txt
--- mahara-1.0.4.orig/debian/mahara.postinst
+++ mahara-1.0.4/debian/mahara.postinst
@@ -0,0 +1,88 @@
+#!/bin/sh
+# postinst script for mahara-apache
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postinst> `configure' <most-recently-configured-version>
+#        * <old-postinst> `abort-upgrade' <new version>
+#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
+#          <new-version>
+#        * <postinst> `abort-remove'
+#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
+#          <failed-install-package> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see http://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+#DEBHELPER#
+
+. /usr/share/debconf/confmodule
+
+CONFIG_DEBCONF_PHP=/etc/mahara/config.debconf.php
+
+case "$1" in
+    configure)
+        # Configure Mahara
+        echo "<?php" > $CONFIG_DEBCONF_PHP
+        echo "// WARNING: DO NOT EDIT THIS FILE!" >> $CONFIG_DEBCONF_PHP
+        echo "//"  >> $CONFIG_DEBCONF_PHP
+        echo "// It is automatically generated by debconf and will be overwritten" >> $CONFIG_DEBCONF_PHP
+        echo "// everytime the mahara Debian package is upgraded." >> $CONFIG_DEBCONF_PHP
+        echo "// Use 'dpkg-reconfigure mahara' instead." >> $CONFIG_DEBCONF_PHP
+        echo "//"  >> $CONFIG_DEBCONF_PHP
+        echo "// Your local customizations should go into /etc/mahara/config.php" >> $CONFIG_DEBCONF_PHP
+        echo "if (!defined('CRON')) {" >> $CONFIG_DEBCONF_PHP
+        echo "    \$cfg->wwwroot = (isset(\$_SERVER['HTTPS']) ? 'https://' : 'http://') . \$_SERVER['SERVER_NAME'] . '/mahara/';" >> $CONFIG_DEBCONF_PHP
+        echo "}" >> $CONFIG_DEBCONF_PHP
+        db_get mahara/db_type
+        echo "\$cfg->dbtype   = '${RET}';" >> $CONFIG_DEBCONF_PHP
+        db_get mahara/db_host
+        echo "\$cfg->dbhost   = '${RET}';" >> $CONFIG_DEBCONF_PHP
+        db_get mahara/db_port
+        echo "\$cfg->dbport   = '${RET}';" >> $CONFIG_DEBCONF_PHP
+        db_get mahara/db_name
+        echo "\$cfg->dbname   = '${RET}';" >> $CONFIG_DEBCONF_PHP
+        db_get mahara/db_user
+        echo "\$cfg->dbuser   = '${RET}';" >> $CONFIG_DEBCONF_PHP
+        db_get mahara/db_pass
+        echo "\$cfg->dbpass   = '${RET}';" >> $CONFIG_DEBCONF_PHP
+        db_reset mahara/db_pass
+        db_get mahara/smtphosts
+        if [ -n "${RET}" ]; then
+            echo "\$cfg->smtphosts = '${RET}';" >> $CONFIG_DEBCONF_PHP
+        fi
+
+        # Set Dataroot
+        chown www-data:www-data /var/lib/mahara
+        chown www-data:www-data /var/lib/mahara/smarty
+        chown www-data:www-data /var/lib/mahara/smarty/cache
+        chown www-data:www-data /var/lib/mahara/smarty/compile
+        echo "\$cfg->dataroot = '/var/lib/mahara';" >> $CONFIG_DEBCONF_PHP
+        echo "?>" >> $CONFIG_DEBCONF_PHP
+
+        # Touch cron log
+        mkdir -p /var/log/mahara
+        touch /var/log/mahara/cron.log
+        chown www-data:www-data /var/log/mahara/cron.log
+
+        # Link to captcha font
+        [ ! -h /usr/share/mahara/theme/default/static/captcha.ttf ] && ln -s /usr/share/fonts/truetype/freefont/FreeMono.ttf /usr/share/mahara/theme/default/static/captcha.ttf
+
+        # Link to libphp-snoopy
+        [ ! -h /usr/share/mahara/lib/snoopy ] && ln -s /usr/share/php/libphp-snoopy/ /usr/share/mahara/lib/snoopy
+    ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+    ;;
+
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+db_stop
+exit 0
--- mahara-1.0.4.orig/debian/apache.conf
+++ mahara-1.0.4/debian/apache.conf
@@ -0,0 +1,42 @@
+# Read README.Debian for instructions on setting up the apache config
+
+# Uncomment this to add an alias.
+#Alias /mahara /usr/share/mahara
+
+# Uncomment this if you want to use a vhost. Remember to set $cfg->wwwroot in
+# /etc/mahara/config.php!
+#<VirtualHost *>
+#    ServerName your-server-name-here
+#    DocumentRoot /usr/share/mahara
+#</VirtualHost>
+
+# There should be little need for you to touch the directives below this line
+
+<Directory /usr/share/mahara/lib>
+    Order allow,deny
+    Deny from all
+</Directory>
+
+<Directory /usr/share/mahara/lib/pieforms/static>
+    Order deny,allow
+    Allow from all
+</Directory>
+
+<Directory /usr/share/mahara>
+    Options -Indexes
+    AllowOverride all
+</Directory>
+
+<Directory /usr/share/mahara/js>
+    <IfModule mod_expires.c>
+        ExpiresActive On
+        ExpiresDefault "access plus 1 hour"
+    </IfModule>
+</Directory>
+
+<Directory /usr/share/mahara/theme/default/static/style>
+    <IfModule mod_expires.c>
+        ExpiresActive On
+        ExpiresDefault "access plus 1 hour"
+    </IfModule>
+</Directory>
--- mahara-1.0.4.orig/debian/mahara-apache2.links
+++ mahara-1.0.4/debian/mahara-apache2.links
@@ -0,0 +1 @@
+etc/mahara/apache.conf                  etc/apache2/conf.d/mahara
--- mahara-1.0.4.orig/debian/mahara.cron.d
+++ mahara-1.0.4/debian/mahara.cron.d
@@ -0,0 +1,5 @@
+#
+# Mahara implements its own cron to cater for people who need to run it in
+# situations where normal unixy cron isn't available.
+#
+* * * * *   www-data     if [ -r /usr/share/mahara/lib/cron.php ] ; then /usr/bin/php5 /usr/share/mahara/lib/cron.php >>/var/log/mahara/cron.log 2>&1 ; fi
--- mahara-1.0.4.orig/debian/README.Debian
+++ mahara-1.0.4/debian/README.Debian
@@ -0,0 +1,60 @@
+Setting up Mahara
+-----------------
+
+There are two steps involved in setting up Mahara:
+
+1. Create the database, and grant a user access to it
+2. Set up the apache configuration
+
+Setting up the database for Mahara
+-----------------------------------
+
+Mahara assumes that you have properly created the database and the user account
+before you connect to the site for the first time.
+
+Here's how to create a 'maharauser' account on Postgres:
+
+  $ sudo -u postgres createuser -SRDP maharauser
+  Enter password for new role: ********
+  Enter it again: ********
+  CREATE ROLE
+
+and how to create a new 'maharadb' database:
+
+  $ sudo -u postgres createdb -O maharauser -E utf8 maharadb
+  CREATE DATABASE
+
+Here's how to create a 'mahara' database on MySQL:
+
+  $ mysql -u root -p
+  Enter password:
+  > CREATE DATABASE mahara;
+  Query OK, 1 row affected (0.00 sec)
+
+and how to create a 'maharauser' user account:
+
+  > GRANT ALL ON mahara.* to maharauser IDENTIFIED BY 'password';
+  Query OK, 0 rows affected (0.00 sec)
+  > FLUSH PRIVILEGES;
+  Query OK, 0 rows affected (0.00 sec)
+  > exit
+  Bye
+
+Set up the apache configuration
+-------------------------------
+
+You have two options. One is to use an alias, the other is to use a virtual
+host.
+
+By default, Mahara is set up to be run at http://localhost/mahara/. In order to
+enable this:
+
+1. Edit /etc/mahara/apache.conf and uncomment the 'Alias' line
+2. Reload apache with /etc/init.d/apache2 reload
+
+If you want to run Mahara as a virtualhost:
+
+1. Uncomment the virtualhost block in /etc/mahara/apache.conf
+2. Edit /etc/mahara/config.php and set the wwwroot to what you set the
+   ServerName to in the virtualhost conf
+3. Reload apache with /etc/init.d/apache2 reload
--- mahara-1.0.4.orig/debian/mahara-apache2.postrm
+++ mahara-1.0.4/debian/mahara-apache2.postrm
@@ -0,0 +1,42 @@
+#!/bin/sh
+# postrm script for mahara
+#
+# see: dh_installdeb(1)
+
+set -e
+
+#DEBHELPER#
+
+# summary of how this script can be called:
+#        * <postrm> `remove'
+#        * <postrm> `purge'
+#        * <old-postrm> `upgrade' <new-version>
+#        * <new-postrm> `failed-upgrade' <old-version>
+#        * <new-postrm> `abort-install'
+#        * <new-postrm> `abort-install' <old-version>
+#        * <new-postrm> `abort-upgrade' <old-version>
+#        * <disappearer's-postrm> `disappear' <overwriter>
+#          <overwriter-version>
+# for details, see http://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+case "$1" in
+    purge)
+    ;;
+    upgrade|remove)
+        # These scripts were installed by previous versions of packaging
+        rm -f /etc/mahara/servername.conf
+        rm -f /etc/mahara/serverredirects.conf
+    ;;
+    failed-upgrade|abort-install|abort-upgrade|disappear|upgrade)
+    ;;
+    *)
+        echo "postrm called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+exit 0
+
+
+
--- mahara-1.0.4.orig/debian/changelog
+++ mahara-1.0.4/debian/changelog
@@ -0,0 +1,191 @@
+mahara (1.0.4-4+lenny6) stable-security; urgency=high
+
+  * SECURITY UPDATE: multiple cross-site scripting vulnerabilities
+    - debian/patches/CVE-2010-1667.dpatch: upstream patch
+    - CVE-2010-1667
+
+  * SECURITY UPDATE: multiple cross-site request forgery vulnerabilities
+    - debian/patches/CVE-2010-1668.dpatch: upstream patch
+    - CVE-2010-1668
+
+  * SECURITY UPDATE: unsafe auth plugins configuration options
+    - debian/patches/CVE-2010-1670.dpatch: upstream patch
+    - CVE-2010-1670
+
+  * SECURITY UPDATE: IE-only cross-site scripting bug in HTML Purifier
+    - debian/patches/CVE-2010-2479.dpatch: upstream patch
+    - CVE-2010-2479
+
+ -- Francois Marier <francois@debian.org>  Thu, 01 Jul 2010 17:00:56 +1200
+
+mahara (1.0.4-4+lenny5) stable-security; urgency=high
+
+  * Non-maintainer upload by the Security Team.
+  * Fix possible sql injection on generating a random user name
+    similar to a desired one (CVE-2010-0400).
+
+ -- Nico Golde <nion@debian.org>  Fri, 02 Apr 2010 13:51:02 +0000
+
+mahara (1.0.4-4+lenny4) stable-security; urgency=high
+
+  * Fix privilege escalation for institution admins (CVE-2009-3298)
+  * Fix XSS vulnerability in the resume blocktype (CVE-2009-3299)
+
+ -- Francois Marier <francois@debian.org>  Thu, 29 Oct 2009 16:47:11 +1300
+
+mahara (1.0.4-4+lenny3) stable-security; urgency=high
+
+  * Fix XSS vulnerabilities
+
+ -- Francois Marier <francois@debian.org>  Mon, 22 Jun 2009 14:29:29 +1200
+
+mahara (1.0.4-4+lenny2) stable-security; urgency=high
+
+  * Fix XSS vulnerabilities (CVE-2009-0664)
+  * Escape the clamav path provided by the admin
+
+ -- Francois Marier <francois@debian.org>  Wed, 22 Apr 2009 14:18:55 +1200
+
+mahara (1.0.4-4+lenny1) stable-security; urgency=high
+
+  * Fix multiple XSS vulnerabilities (CVE-2009-0660)
+  * Add dpatch support
+
+ -- Francois Marier <francois@debian.org>  Thu, 05 Mar 2009 18:47:55 +1300
+
+mahara (1.0.4-4) testing-proposed-updates; urgency=low
+
+  * Fix XSS issues in forum descriptions and posts, backported from
+    these upstream commits:
+      a3a3824aadcaebd6e416d5b18b1f1129c0f30cac
+      b86d471361456a9b7c58492121feb1ae85222ada
+
+ -- Francois Marier <francois@debian.org>  Wed, 04 Feb 2009 14:51:32 +1300
+
+mahara (1.0.4-3) testing-proposed-updates; urgency=high
+
+  * Depend on libphp-snoopy instead of using the embedded copy shipped
+    with Mahara (CVE-2008-4796, closes: #504170)
+  * Backport upstream's patch (41189c30d198153dc66dc867e160dab948929458)
+    to phpmailer (CVE-2007-3125, closes: #504253)
+
+ -- Francois Marier <francois@debian.org>  Tue, 04 Nov 2008 12:46:14 +1300
+
+mahara (1.0.4-2) unstable; urgency=low
+
+  * Compress the package using bzip2
+  * Remove non-userdata directories in /var/lib/mahara when purging
+  * Clarify the MySQL instructions in README.Debian
+
+  * Add Galician debconf translation (closes: #488185). Thanks Jacobo!
+  * Add Japanese debconf translation (closes: #488338). Thanks Tsunoda!
+  * Add Czech debconf translation (closes: #488368). Thanks Miroslav!
+  * Add Turkish debconf translation (closes: #488507). Thanks Mert!
+  * Add Russian debconf translation (closes: #489168). Thanks Yuri!
+  * Add Finnish debconf translation (closes: #489121). Thanks Esko!
+  * Add Vietnamese debconf translation (closes: #489402). Thanks Clytie! 
+
+ -- Francois Marier <francois@debian.org>  Mon, 07 Jul 2008 11:23:15 +1200
+
+mahara (1.0.4-1) unstable; urgency=low
+
+  [ Francois Marier ]
+  * Add Swedish debconf translation (closes: #487724). Thanks Martin!
+  * Remove outdated NEWS file
+
+  [ Nigel McNie ]
+  * New Upstream Version
+
+ -- Francois Marier <francois@debian.org>  Wed, 25 Jun 2008 16:52:34 +1200
+
+mahara (1.0.3-1) unstable; urgency=low
+
+  [ Nigel McNie ]
+  * New Upstream Version
+  * Tweak apache rules to give access to some required files (closes: #479858)
+
+  [ Francois Marier ]
+  * Bump Standards-Version up to 3.8.0
+  * Bump the Postgres version number to 8.3 to match the latest version in sid
+
+ -- Francois Marier <francois@debian.org>  Fri, 13 Jun 2008 14:18:13 +1200
+
+mahara (1.0.2-1) unstable; urgency=low
+
+  * New Upstream Version
+
+ -- Nigel McNie <nigel@catalyst.net.nz>  Tue, 29 Apr 2008 11:15:39 +1200
+
+mahara (1.0.1-1) unstable; urgency=low
+
+  [ Francois Marier ]
+  * debian/copyright: Bump the copyright year for Mahara and remove the
+    reference to Smarty since we are no longer shipping it.
+  * Revised French translation thanks to Christian Perrier (closes: #472770)
+  * Updated Portugese translation thanks to Américo Monteiro (closes: #471952)
+
+  [ Nigel McNie ]
+  * Don't chmod -R the dataroot directory in the postinst. It takes ages and
+    is completely unnecessary.
+  * Update the Vcs- control fields to point at the new location for the debian
+    packaging
+  * Removed a whole bunch of configuration questions from the mahara-apache2
+    package that are now unnecessary
+  * Support running the site under an apache alias; by default when installed
+    the package won't clobber other sites (closes: #464726)
+  * Set Mahara Debian Packaging Team as maintainer, set myself, Penny and
+    Francois as uploaders.
+  * Add MySQL howto instructions to README.Debian (closes: #475278)
+
+ -- Francois Marier <francois@debian.org>  Fri, 11 Apr 2008 16:40:01 +1200
+
+mahara (0.9.2-2) unstable; urgency=low
+
+  [ Nigel McNie ]
+  * Removed recommends on php5-openssl and postgresql-8.1
+  * Changed default server name to mahara; moved asking about the servername
+    to mahara-apache2 so running `dpkg-reconfigure -plow mahara-apache2'
+    changes it (Closes: #464726)
+  * Removed the restart_apache helper function
+  * Re-ran debconf-updatepo
+  * Depend on the smarty debian package rather than bundling our own,
+    cherry-picked 21b81a5c4c4bfd0408410fdfdd6a8f0217e8f9ff from 0.9_STABLE to
+    assist with this (Closes: #471201)
+
+  [ Francois Marier ]
+  * Bump debhelper compatibility to 6
+
+ -- Nigel McNie <nigel@catalyst.net.nz>  Tue, 18 Mar 2008 12:26:31 +1300
+
+mahara (0.9.2-1) unstable; urgency=low
+
+  * New upstream release
+  * Removed copyright notices for KSES and validateurlsyntax.php, both of
+    which are no longer included in Mahara.
+  * Reset the database password field after using it to write out the config
+    file. This allows people to reconfigure the package to remove the
+    password, at the expense of having to type in the password every time they
+    reconfigure.
+
+ -- Nigel McNie <nigel@catalyst.net.nz>  Wed, 30 Jan 2008 15:52:43 +1300
+
+mahara (0.9.1-1) unstable; urgency=low
+
+  [ Francois Marier ]
+  * Add Portugese debconf translation (closes: #457978).  Thanks to Traduz!
+  * Add Spanish debconf translation (closes: #460236).  Thanks Germana!
+
+  [ Nigel McNie ]
+  * New upstream release
+  * Set myself as maintainer
+  * Backported patch 8ffa8b55da108d0ab79d2200a14b152b7d37b0fe, which makes
+    Mahara respect the system include path. This allows Mahara to use the
+    system PEAR libraries instead of crashing when it can't find them.
+
+ -- Nigel McNie <nigel@catalyst.net.nz>  Wed, 16 Jan 2008 15:28:33 +1300
+
+mahara (0.9.0-1) unstable; urgency=low
+
+  * Initial upload to unstable (closes: #447203)
+
+ -- Francois Marier <francois@debian.org>  Mon, 17 Dec 2007 09:36:53 +1300
--- mahara-1.0.4.orig/debian/watch
+++ mahara-1.0.4/debian/watch
@@ -0,0 +1,3 @@
+version=3
+opts=dversionmangle=s/~.*// \
+  http://eduforge.org/frs/?group_id=176 /frs/download.php/\d+/mahara-([\d.]+).tar.bz2
--- mahara-1.0.4.orig/debian/mahara.postrm
+++ mahara-1.0.4/debian/mahara.postrm
@@ -0,0 +1,49 @@
+#!/bin/sh
+# postrm script for mahara
+#
+# see: dh_installdeb(1)
+
+set -e
+
+#DEBHELPER#
+
+# summary of how this script can be called:
+#        * <postrm> `remove'
+#        * <postrm> `purge'
+#        * <old-postrm> `upgrade' <new-version>
+#        * <new-postrm> `failed-upgrade' <old-version>
+#        * <new-postrm> `abort-install'
+#        * <new-postrm> `abort-install' <old-version>
+#        * <new-postrm> `abort-upgrade' <old-version>
+#        * <disappearer's-postrm> `disappear' <overwriter>
+#          <overwriter-version>
+# for details, see http://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+case "$1" in
+    purge)
+        rm -rf /var/log/mahara/
+        rm -rf /var/lib/mahara/sessions/
+        rm -rf /var/lib/mahara/htmlpurifier/
+        rm -rf /var/lib/mahara/smarty/
+        rm -rf /var/lib/mahara/quarantine/
+        [ -d /var/lib/mahara ] && echo "NOTE: purge does _not_ remove /var/lib/mahara, you must do this yourself if you really want to!"
+        rm -f /etc/mahara/config.debconf.php
+    ;;
+    remove)
+        rm -f /usr/share/mahara/theme/default/static/captcha.ttf
+        rm -rf /var/lib/mahara/smarty/compile/*
+        rm -rf /var/lib/mahara/smarty/cache/*
+    ;;
+    failed-upgrade|abort-install|abort-upgrade|disappear|upgrade)
+    ;;
+    *)
+        echo "postrm called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+exit 0
+
+
+
--- mahara-1.0.4.orig/debian/config.php
+++ mahara-1.0.4/debian/config.php
@@ -0,0 +1,127 @@
+<?php
+/**
+ * Mahara: Electronic portfolio, weblog, resume builder and social networking
+ * Copyright (C) 2006-2007 Catalyst IT Ltd (http://www.catalyst.net.nz)
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @package    mahara
+ * @subpackage core
+ * @author     Penny Leach <penny@catalyst.net.nz>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL
+ * @copyright  (C) 2006,2007 Catalyst IT Ltd http://catalyst.net.nz
+ *
+ */
+
+$cfg = new StdClass;
+
+require('config.debconf.php');
+
+// database connection details
+//$cfg->dbtype   = 'postgres8';
+//$cfg->dbhost   = 'localhost';
+//$cfg->dbport   = '';
+//$cfg->dbname   = 'mahara';
+//$cfg->dbuser   = 'mahara';
+//$cfg->dbpass   = '';
+//$cfg->dbprefix = '';
+
+// wwwroot - the web-visible path to your Mahara installation
+// Normally, this is automatically detected - if it doesn't work for you
+// then try specifying it here
+//$cfg->wwwroot = 'http://myhost.com/mahara/';
+
+// dataroot - uploaded files are stored here
+// must be writable by the webserver and outside document root.
+// Mahara will NOT RUN if this is inside your document root, because
+// this is a big security hole.
+//$cfg->dataroot = '/path/to/uploaddir';
+
+// system mail address. emails out come from this address.
+// if not specified, will default to noreply@ automatically detected host.
+// if that doesn't work or you want something else, then specify it here.
+// $cfg->noreplyaddress = 'noreply@myhost.com'
+
+// Logging configuration
+// For each log level, you can specify where the messages are displayed.
+// LOG_TARGET_SCREEN makes the error messages go to the screen - useful
+// when debugging but not on a live site!
+// LOG_TARGET_ERRORLOG makes the error messages go to the log as specified
+// by the apache ErrorLog directive. It's probably useful to have this on
+// for all log levels.
+// You can combine them with bitwise operations,
+// e.g. LOG_TARGET_SCREEN | LOG_TARGET_ERRORLOG
+//
+// This configuration is suitable for people running Mahara for the first
+// time. You will immediately see environment errors, and so can correct
+// them. You will be able to see other debugging information in your error
+// logs. Once your site is up and running you might want to remove the
+// environment level logging completely, and just log everything else to
+// the error log.
+$cfg->log_dbg_targets     = LOG_TARGET_ERRORLOG;
+$cfg->log_info_targets    = LOG_TARGET_ERRORLOG;
+$cfg->log_warn_targets    = LOG_TARGET_ERRORLOG;
+$cfg->log_environ_targets = LOG_TARGET_SCREEN | LOG_TARGET_ERRORLOG;
+// This configuration is suitable for developers. You will see all errors
+// and they will also be in the logs.
+//$cfg->log_dbg_targets     = LOG_TARGET_SCREEN | LOG_TARGET_ERRORLOG;
+//$cfg->log_info_targets    = LOG_TARGET_SCREEN | LOG_TARGET_ERRORLOG;
+//$cfg->log_warn_targets    = LOG_TARGET_SCREEN | LOG_TARGET_ERRORLOG;
+//$cfg->log_environ_targets = LOG_TARGET_SCREEN | LOG_TARGET_ERRORLOG;
+
+// The log levels that will generate backtraces. Useful for development,
+// but probably only warnings are useful on a live site.
+//$cfg->log_backtrace_levels = LOG_LEVEL_WARN | LOG_LEVEL_ENVIRON;
+$cfg->log_backtrace_levels = LOG_LEVEL_WARN;
+
+// Developer mode
+// When set, the following things (among others) will happen:
+//
+// * 'debug.js' will be included on each page. You can edit this file to add 
+//   debugging javascript at your discretion
+// * 'debug.css' will be included on each page. You can edit this file to add 
+//   debugging CSS at your discretion
+// * firebuglite will be included, if you are not using Firefox
+// * the unpacked version of MochiKit will be used
+//
+// These options are a performance hit otherwise, enable when you are 
+// developing for Mahara
+$cfg->developermode = false;
+
+// capture performance information and print it
+// $cfg->perftofoot = true; // needs a call to mahara_performance_info (smarty callback) - see default theme's footer.tpl
+// $cfg->perftolog = true;
+// if neither are set, performance info wont be captured.
+
+// mail handling
+// if you want mahara to use smtp servers to send mail, enter one or more here
+// blank means mahara will use the default PHP method.
+// $cfg->smtphosts = 'mail.a.com;mail.b.com';
+// If you have specified an smtp server above, and the server requires authentication, 
+// enter them here
+// $cfg->smtpuser = '';
+// $cfg->smtppass = '';
+
+// xmlrpc
+// if you're running in a configuration where the host contacting you will be
+// using an IP address that is not the same as the IP address that is registered
+// for its host name, then you should change the value below to 'true'.
+$cfg->xmlrpc_allow_masquerading = false;
+
+// maximum allowed size of uploaded images
+// NOTE: the scalable resize might result in images with one dimesion larger than one of these sizes, but not both
+$cfg->imagemaxwidth = 1024;
+$cfg->imagemaxheight = 1024;
+
+?>
--- mahara-1.0.4.orig/debian/mahara.config
+++ mahara-1.0.4/debian/mahara.config
@@ -0,0 +1,22 @@
+#!/bin/sh -e
+
+# Source debconf library.
+. /usr/share/debconf/confmodule
+
+# Decide how important it is for the user to see this message
+PRIORITY=high
+
+db_input $PRIORITY mahara/db_type || true
+db_go
+db_input $PRIORITY mahara/db_host || true
+db_go
+db_input medium mahara/db_port || true
+db_go
+db_input $PRIORITY mahara/db_name || true
+db_go
+db_input $PRIORITY mahara/db_user || true
+db_go
+db_input $PRIORITY mahara/db_pass|| true
+db_go
+db_input medium mahara/smtphosts || true
+db_go
--- mahara-1.0.4.orig/debian/compat
+++ mahara-1.0.4/debian/compat
@@ -0,0 +1 @@
+6
--- mahara-1.0.4.orig/debian/copyright
+++ mahara-1.0.4/debian/copyright
@@ -0,0 +1,153 @@
+This package was debianized by Martyn Smith <martyn@catalyst.net.nz> on
+Tue,  9 Jan 2007 10:47:50 +1300.
+
+It was downloaded from http://mahara.eduforge.org
+
+Upstream Authors:
+    Martyn Smith <martyn@catalyst.net.nz>
+    Penny Leach <penny@catalyst.net.nz>
+    Nigel McNie <nigel@catalyst.net.nz>
+    Richard Mansfield <richard.mansfield@catalyst.net.nz>
+    Alastair Pharo <alastair@catalyst.net.nz>
+    Francois Marier <francois@catalyst.net.nz>
+    Clare Lenihan <clare@catalyst.net.nz>
+
+Copyright: (C) 2006-2008 Catalyst IT Ltd http://catalyst.net.nz
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+ 
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+ 
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+You are free to distribute this software under the terms of the GNU General
+Public License. On Debian systems, the complete text of the GNU General
+Public License can be found in /usr/share/common-licenses/GPL-3 file.
+
+The Debian packaging is (C) 2007-2008, Catalyst IT <dev@mahara.org> and is
+licensed under the GPL, see `/usr/share/common-licenses/GPL'.
+
+This package also includes the following code:
+
+  htdocs/js/tinymce/:
+  Copyright (C) 2004-2007 Moxiecode Systems AB
+  Released under the GNU Lesser General Public License 2.1+
+
+  htdocs/js/tinymce/plugins/devkit/jscripts/diff.js:
+  Copyright (C) 2006 Neil Fraser
+  Released under the GNU General Public License
+
+  htdocs/lib/adodb/:
+  Copyright (c) 2000-2004 John Lim
+  Released under both the GNU Lesser General Public License 2.1+
+  and a Modified BSD license
+
+  htdocs/lib/phpmailer/:
+  Copyright (C) 2001-2005 Brent R. Matzelle
+  Released under the GNU Lesser General Public License 2.1+
+
+  htdocs/lib/pear/XML/:
+  Copyright (C) 2005 James Stewart <james@jystewart.net>
+  Released under the GNU Lesser General Public License 2.1+
+
+  htdocs/lib/snoopy/:
+  Copyright (C) 1999-2000 ispi
+  Released under the GNU Lesser General Public License 2.1+
+
+  htdocs/lib/pieforms/static/jscalendar/:
+  Copyright (C) 2002-2005 Mihai Bazon
+  Released under the GNU Lesser General Public License 2.1+
+
+  htdocs/js/MochiKit/Style.js:
+  Copyright (c) 2006 Yahoo! Inc.
+  Released under the Modified BSD license
+
+  htdocs/lib/constants.php, searchlib.php, dml.php, ddl.php, 
+  uploadmanager.php, mahara.php, web.php, file.php, xmldb/:
+  Copyright (C) 2006-2007 Catalyst IT Ltd
+  Copyright (C) 1999-2007 Martin Dougiamas
+  Released under the GNU General Public License 2+
+
+  htdocs/lib/xmldb/:
+  Copyright (C) 2006-2007 Catalyst IT Ltd
+  Copyright (C) 2001-2007 Martin Dougiamas
+  Copyright (C) 2001-2007 Eloy Lafuente
+  Released under the GNU General Public License 3+
+
+  htdocs/lib/pieforms/static/core/pieforms.js:
+  Copyright (C) 2006 Nigel McNie
+  Copyright (C) 2006 Drupal
+  Released under the GNU General Public License 2+
+
+  htdocs/search/internal/lib.php:
+  Copyright (C) 2006-2007 Catalyst IT
+  Copyright (C) 2007 Drupal
+  Released under the GNU General Public License
+
+  htdocs/lib/htmlpurifier/:
+  Copyright (C) 2006-2008 Edward Z. Yang
+  Released under the GNU General Public License 2.1+
+
+On Debian systems, the complete text of the GNU Lesser General
+Public License can be found in `/usr/share/common-licenses/LGPL-2.1'.
+The complete text of the Modified BSD license can be found in
+`/usr/share/common-licenses/BSD'.
+
+  htdocs/lib/pieforms/static/core/MochiKit/ and
+  htdocs/js/MochiKit/:
+  Copyright (C) 2005-2006 Bob Ippolito
+  Released under the MIT License:
+
+  Permission is hereby granted, free of charge, to any person obtaining a 
+  copy of this software and associated documentation files (the "Software"),
+  to deal in the Software without restriction, including without limitation
+  the rights to use, copy, modify, merge, publish, distribute, sublicense,
+  and/or sell copies of the Software, and to permit persons to whom the
+  Software is furnished to do so, subject to the following conditions:
+
+  The above copyright notice and this permission notice shall be included 
+  in all copies or substantial portions of the Software.
+
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+  OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+  FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+  DEALINGS IN THE SOFTWARE.
+
+  htdocs/js/MochiKit/Controls.js, DragAndDrop.js, Sortable.js:
+  Copyright (C) 2005 Thomas Fuchs
+  Released under the MIT License (see above)
+
+  htdocs/lib/pieforms/JSON/:
+  Copyright (C) 2005 Michal Migurski
+
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions are
+  met:
+
+  Redistributions of source code must retain the above copyright notice,
+  this list of conditions and the following disclaimer.
+
+  Redistributions in binary form must reproduce the above copyright
+  notice, this list of conditions and the following disclaimer in the
+  documentation and/or other materials provided with the distribution.
+
+  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+  NO EVENT SHALL CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+  NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+  USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+  ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
--- mahara-1.0.4.orig/debian/control
+++ mahara-1.0.4/debian/control
@@ -0,0 +1,37 @@
+Source: mahara
+Section: web
+Priority: optional
+Maintainer: Mahara Debian Packaging Team <pkg-debian@mahara.org>
+Uploaders: Nigel McNie <nigel@catalyst.net.nz>, Penny Leach <penny@she.geek.nz>, Francois Marier <francois@debian.org>
+Build-Depends: debhelper (>= 6), po-debconf, dpatch
+Standards-Version: 3.8.0
+Homepage: http://www.mahara.org
+Vcs-Git: git://git.debian.org/git/collab-maint/mahara.git
+Vcs-Browser: http://git.debian.org/?p=collab-maint/mahara.git;a=summary
+
+Package: mahara
+Architecture: all
+Depends: ${misc:Depends}, php5-pgsql | php5-mysql, php5-cli, php5-gd, file, cron, perl, ttf-freefont, php-file, php-pear, smarty, libphp-snoopy
+Recommends: mahara-apache2, postgresql | postgresql-8.3 | mysql-server | mysql-server-5.0, clamav, clamav-daemon, php5-curl, php5-xmlrpc, php5-imagick, libfile-slurp-perl, libtext-diff-perl
+Description: Electronic portfolio, weblog, and resume builder
+ Mahara is a fully featured electronic portfolio, weblog, resume builder and
+ social networking system, connecting users and  creating online communities.
+ .
+ Mahara is designed to provide users with the tools to create a personal and
+ professional learning and development environment.
+ .
+ This is the core Mahara package, it does not include any of the web server
+ configuration.
+
+Package: mahara-apache2
+Architecture: all
+Depends: ${misc:Depends}, mahara (>= 1.0.1-1), apache2, libapache2-mod-php5
+Conflicts: mahara-apache
+Description: Electronic portfolio, weblog, and resume builder - apache2 configuration
+ Mahara is a fully featured electronic portfolio, weblog, resume builder and
+ social networking system, connecting users and  creating online communities.
+ .
+ Mahara is designed to provide users with the tools to create a personal and
+ professional learning and development environment.
+ .
+ This package configures Mahara for the Apache 2.x web server.
--- mahara-1.0.4.orig/debian/patches/CVE-2009-3299.dpatch
+++ mahara-1.0.4/debian/patches/CVE-2009-3299.dpatch
@@ -0,0 +1,18 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## CVE-2009-3299.dpatch by Francois Marier <francois@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: XSS vulnerability in the resume blocktype
+
+@DPATCH@
+--- a/htdocs/artefact/resume/lib.php
++++ b/htdocs/artefact/resume/lib.php
+@@ -115,7 +115,7 @@ class ArtefactTypeResume extends ArtefactType {
+      * Default render method for resume fields - show their description
+      */
+     public function render_self($options) {
+-        return array('html' => $this->description);
++        return array('html' => clean_text($this->description));
+     }
+ 
+     /**
--- mahara-1.0.4.orig/debian/patches/CVE-2010-1667.dpatch
+++ mahara-1.0.4/debian/patches/CVE-2010-1667.dpatch
@@ -0,0 +1,110 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## CVE-2010-1667.dpatch by Francois Marier <francois@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Multiple XSS vulnerabilities
+
+@DPATCH@
+diff --git a/htdocs/lib/pieforms/pieform/elements/select.php b/htdocs/lib/pieforms/pieform/elements/select.php
+index ab9f7f2..2d87241 100644
+--- a/htdocs/lib/pieforms/pieform/elements/select.php
++++ b/htdocs/lib/pieforms/pieform/elements/select.php
+@@ -51,7 +51,7 @@ function pieform_element_select(Pieform $form, $element) {/*{{{*/
+             if (is_array($value)) {
+                 $value = $value['value'];
+             }
+-            $result = $value . '<input type="hidden" name="' . $element['name'] . '" value="' . $key . '">';
++            $result = hsc($value) . '<input type="hidden" name="' . $element['name'] . '" value="' . $key . '">';
+         }
+         return $result;
+     }
+diff --git a/htdocs/lib/searchlib.php b/htdocs/lib/searchlib.php
+index 0c947f5..2b6098b 100644
+--- a/htdocs/lib/searchlib.php
++++ b/htdocs/lib/searchlib.php
+@@ -299,7 +299,7 @@ function build_admin_user_search_results($search, $offset, $limit, $sortby, $sor
+     $institutions = get_records_assoc('institution', '', '', '', 'name,displayname');
+     if (count($institutions) > 1) {
+         $cols['institution'] = array('name'     => get_string('institution'),
+-                                     'template' => '{if empty($r.institutions)}{$institutions.mahara->displayname}{else}{foreach from=$r.institutions item=i}<div>{$institutions[$i]->displayname}</div>{/foreach}{/if}{if !empty($r.requested)}{foreach from=$r.requested item=i}<div class="pending">{str tag=requestto section=admin} {$institutions[$i]->displayname}{if $USER->is_institutional_admin("$i")} (<a href="{$WWWROOT}admin/users/addtoinstitution.php?id={$r.id}&institution={$i}">{str tag=confirm section=admin}</a>){/if}</div>{/foreach}{/if}{if !empty($r.invitedby)}{foreach from=$r.invitedby item=i}<div class="pending">{str tag=invitedby section=admin} {$institutions[$i]->displayname}</div>{/foreach}{/if}');
++                                     'template' => '{if empty($r.institutions)}{$institutions.mahara->displayname|escape}{else}{foreach from=$r.institutions item=i}<div>{$institutions[$i]->displayname|escape}</div>{/foreach}{/if}{if !empty($r.requested)}{foreach from=$r.requested item=i}<div class="pending">{str tag=requestto section=admin} {$institutions[$i]->displayname|escape}{if $USER->is_institutional_admin("$i")} (<a href="{$WWWROOT}admin/users/addtoinstitution.php?id={$r.id}&institution={$i}">{str tag=confirm section=admin}</a>){/if}</div>{/foreach}{/if}{if !empty($r.invitedby)}{foreach from=$r.invitedby item=i}<div class="pending">{str tag=invitedby section=admin} {$institutions[$i]->displayname|escape}</div>{/foreach}{/if}');
+     }
+ 
+     $smarty = smarty_core();
+diff --git a/htdocs/lib/web.php b/htdocs/lib/web.php
+index f9456b2..d11aeed 100644
+--- a/htdocs/lib/web.php
++++ b/htdocs/lib/web.php
+@@ -443,7 +443,7 @@ EOF;
+             $smarty->assign('masqueradedetails', get_string('youaremasqueradingas', 'mahara', hsc(display_name($USER))));
+             $smarty->assign('becomeyouagain',
+                 ' <a href="' . hsc($wwwroot) . 'admin/users/changeuser.php?restore=1">'
+-                . get_string('becomeadminagain', 'admin', $USER->get('parentuser')->name)
++                . get_string('becomeadminagain', 'admin', hsc($USER->get('parentuser')->name))
+                 . '</a>');
+         }
+     }
+@@ -2019,7 +2019,7 @@ function clean_text($text) {
+ function display_cleaned_html($html, $filename, $params) {
+     $smarty = smarty_core();
+     $smarty->assign('params', $params);
+-    $smarty->assign('htmlremovedmessage', get_string('htmlremovedmessage', 'artefact.file', $filename, get_config('wwwroot') . 'user/view.php?id=' . $params['owner'], display_name($params['owner'])));
++    $smarty->assign('htmlremovedmessage', get_string('htmlremovedmessage', 'artefact.file', hsc($filename), get_config('wwwroot') . 'user/view.php?id=' . (int) $params['owner'], hsc(display_name($params['owner']))));
+     $smarty->assign('content', clean_text($html));
+     $smarty->display('cleanedhtml.tpl');
+     exit;
+diff --git a/htdocs/search/internal/lib.php b/htdocs/search/internal/lib.php
+index 5453c6f..1e8504d 100644
+--- a/htdocs/search/internal/lib.php
++++ b/htdocs/search/internal/lib.php
+@@ -748,6 +748,7 @@ class PluginSearchInternal extends PluginSearch {
+                 else {
+                     $newresult['summary'] = $newresult['description'];
+                 }
++                $newresult['summary'] = clean_text($newresult['summary']);
+                 $result = $newresult;
+             }
+ 
+diff --git a/htdocs/theme/default/templates/admin/users/notifications.tpl b/htdocs/theme/default/templates/admin/users/notifications.tpl
+index a39c1ac..c981d3b 100644
+--- a/htdocs/theme/default/templates/admin/users/notifications.tpl
++++ b/htdocs/theme/default/templates/admin/users/notifications.tpl
+@@ -13,10 +13,10 @@
+ {foreach from=$users item='user' key='userid'}
+                 <tr class="{cycle values="r0,r1"}">
+                     <td class='center'><img src="{$WWWROOT}thumb.php?type=profileicon&maxwidth=40&maxheight=40&id={$userid}" alt="profile icon"/></td>
+-                    <td>{display_name user=$user.user}</td>
++                    <td>{$user.user|display_name|escape}</td>
+                     <td>
+                     {foreach from=$user.user->institutions item=i}
+-                        <div>{$i}</div>
++                        <div>{$i|escape}</div>
+                     {/foreach}
+                     </td>
+ {foreach from=$types key='type' item='name'}
+diff --git a/htdocs/theme/default/templates/sideblocks/linksandresources.tpl b/htdocs/theme/default/templates/sideblocks/linksandresources.tpl
+index 32743ef..b3da2a4 100644
+--- a/htdocs/theme/default/templates/sideblocks/linksandresources.tpl
++++ b/htdocs/theme/default/templates/sideblocks/linksandresources.tpl
+@@ -3,7 +3,7 @@
+ {if $data}
+     <ul>
+ {foreach from=$data item=item}
+-    	<li><strong><a href="{$item.link|escape}">{$item.name}</a></strong></li>
++      <li><strong><a href="{$item.link|escape}">{$item.name|escape}</a></strong></li>
+ {/foreach}
+     </ul>
+ {/if}
+diff --git a/htdocs/view/index.php b/htdocs/view/index.php
+index f4b94fa..1cdaf97 100644
+--- a/htdocs/view/index.php
++++ b/htdocs/view/index.php
+@@ -197,7 +197,7 @@ else {
+             ));
+         }
+         else {
+-            $view['submittedto'] = get_string('viewsubmittedtogroup', 'view', $view['submittedto']['id'], $view['submittedto']['name']);
++            $view['submittedto'] = get_string('viewsubmittedtogroup', 'view', $view['submittedto']['id'], hsc($view['submittedto']['name']));
+         }
+     }
+ }
--- mahara-1.0.4.orig/debian/patches/00list
+++ mahara-1.0.4/debian/patches/00list
@@ -0,0 +1,11 @@
+CVE-2009-0660.dpatch
+CVE-2010-0400.dpatch
+CVE-2009-0664.dpatch
+clamav_escaping.dpatch
+XSS_escaping.dpatch
+CVE-2009-3298.dpatch
+CVE-2009-3299.dpatch
+CVE-2010-1667.dpatch
+CVE-2010-1668.dpatch
+CVE-2010-1670.dpatch
+CVE-2010-2479.dpatch
--- mahara-1.0.4.orig/debian/patches/CVE-2009-3298.dpatch
+++ mahara-1.0.4/debian/patches/CVE-2009-3298.dpatch
@@ -0,0 +1,58 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## CVE-2009-3298.dpatch by Francois Marier <francois@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: privilege escalation from institution admin to site admin
+
+@DPATCH@
+--- a/htdocs/auth/user.php
++++ b/htdocs/auth/user.php
+@@ -438,6 +438,14 @@ class User {
+         return $this->get('admin') || $this->is_institutional_admin($institution);
+     }
+ 
++    /**
++     * Returns whether this user is allowed to perform administration type
++     * actions on another user.
++     *
++     * @param mixed $user The user to check we can perform actions on. Can
++     *                    either be a User object, a row from the usr table or
++     *                    an ID
++     */
+     public function is_admin_for_user($user) {
+         if ($this->get('admin')) {
+             return true;
+@@ -445,12 +453,29 @@ class User {
+         if (!$this->is_institutional_admin()) {
+             return false;
+         }
++
++        // Check privileges for institutional admins now
+         if ($user instanceof User) {
+-            $userinstitutions = $user->get('institutions');
+-        } else {
+-            $userinstitutions = load_user_institutions($user->id);
++            $userobj = $user;
+         }
+-        foreach ($userinstitutions as $i) {
++        else if (is_numeric($user)) {
++            $userobj = new User;
++            $userobj->find_by_id($user);
++        }
++        else if (is_object($user)) {
++            // Should be a row from the usr table
++            $userobj = new User;
++            $userobj->find_by_id($user->id);
++        }
++        else {
++            throw new SystemException("Invalid argument pass to is_admin_for_user method");
++        }
++
++        if ($userobj->get('admin')) {
++            return false;
++        }
++
++        foreach ($userobj->get('institutions') as $i) {
+             if ($this->is_institutional_admin($i->institution)) {
+                 return true;
+             }
--- mahara-1.0.4.orig/debian/patches/CVE-2010-1670.dpatch
+++ mahara-1.0.4/debian/patches/CVE-2010-1670.dpatch
@@ -0,0 +1,36 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## CVE-2010-1670.dpatch by Francois Marier <francois@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Improvement to auth plugin configuration
+
+@DPATCH@
+diff --git a/htdocs/auth/internal/lib.php b/htdocs/auth/internal/lib.php
+index c14ecc9..534c8bc 100644
+--- a/htdocs/auth/internal/lib.php
++++ b/htdocs/auth/internal/lib.php
+@@ -170,7 +170,10 @@ class AuthInternal extends Auth {
+             // This allows "plaintext" passwords, which are eaiser for an admin to
+             // create by hacking in the database directly. The application does not
+             // create passwords in this form.
+-            return $theysent == $wehave;
++            // We don't allow empty passwords here to prevent anyone logging in to
++            // user accounts that were created by some other passwordless auth
++            // method and subsequently changed to internal.
++            return $wehave != '' && $theysent == $wehave;
+         }
+ 
+         if ($salt == '*') {
+diff --git a/htdocs/auth/xmlrpc/lib.php b/htdocs/auth/xmlrpc/lib.php
+index b261e84..89ee7a1 100644
+--- a/htdocs/auth/xmlrpc/lib.php
++++ b/htdocs/auth/xmlrpc/lib.php
+@@ -619,7 +619,7 @@ class PluginAuthXmlrpc extends PluginAuth {
+         $options = array('None');
+         if (is_array($instances)) {
+             foreach($instances as $someinstance) {
+-                if ($someinstance->requires_parent == 1) {
++                if ($someinstance->requires_parent == 1 || $someinstance->authname == 'none') {
+                     continue;
+                 }
+                 $options[$someinstance->id] = $someinstance->instancename;
--- mahara-1.0.4.orig/debian/patches/CVE-2010-0400.dpatch
+++ mahara-1.0.4/debian/patches/CVE-2010-0400.dpatch
@@ -0,0 +1,20 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## CVE-2010-0400.dpatch by Nico Golde <nion@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Fix for SQL Injection (CVE-2010-0400)
+
+@DPATCH@
+diff -urNad mahara-1.0.4~/htdocs/lib/user.php mahara-1.0.4/htdocs/lib/user.php
+--- mahara-1.0.4~/htdocs/lib/user.php	2010-04-02 13:35:30.000000000 +0000
++++ mahara-1.0.4/htdocs/lib/user.php	2010-04-02 13:48:29.000000000 +0000
+@@ -811,7 +811,8 @@
+     $desired = substr($desired, 0, $maxlen);
+     $taken = get_column_sql('
+         SELECT username FROM {usr}
+-        WHERE username ' . db_ilike() . " '" . substr($desired, 0, $maxlen - 6) . "%'");
++        WHERE username ' . db_ilike() . " ?",
++	array(substr($desired, 0, $maxlen - 6) . '%'));
+     if (!$taken) {
+         return $desired;
+     }
--- mahara-1.0.4.orig/debian/patches/CVE-2009-0660.dpatch
+++ mahara-1.0.4/debian/patches/CVE-2009-0660.dpatch
@@ -0,0 +1,287 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## CVE-2009-0660.dpatch by Francois Marier <francois@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Multiple XSS vulnerabilities
+
+@DPATCH@
+diff --git a/htdocs/admin/users/edit.php b/htdocs/admin/users/edit.php
+index 7f791d9..fa0a143 100644
+--- a/htdocs/admin/users/edit.php
++++ b/htdocs/admin/users/edit.php
+@@ -431,7 +431,7 @@ $smarty->assign('institutions', count($allinstitutions) > 1);
+ $smarty->assign('institutionform', $institutionform);
+ 
+ if ($id != $USER->get('id') && is_null($USER->get('parentuser'))) {
+-    $loginas = get_string('loginasuser', 'admin', $user->username);
++    $loginas = get_string('loginasuser', 'admin', hsc($user->username));
+ } else {
+     $loginas = null;
+ }
+diff --git a/htdocs/artefact/blog/lib.php b/htdocs/artefact/blog/lib.php
+index b029c9d..70f820b 100644
+--- a/htdocs/artefact/blog/lib.php
++++ b/htdocs/artefact/blog/lib.php
+@@ -210,10 +210,10 @@ class ArtefactTypeBlog extends ArtefactType {
+         if (isset($options['viewid'])) {
+             $smarty->assign('artefacttitle', '<a href="' . get_config('wwwroot') . 'view/artefact.php?artefact='
+                                              . $this->get('id') . '&view=' . $options['viewid']
+-                                             . '">' . $this->get('title') . '</a>');
++                                             . '">' . hsc($this->get('title')) . '</a>');
+         }
+         else {
+-            $smarty->assign('artefacttitle', $this->get('title'));
++            $smarty->assign('artefacttitle', hsc($this->get('title')));
+         }
+ 
+         $smarty->assign('blockid', $blockid);
+@@ -221,7 +221,7 @@ class ArtefactTypeBlog extends ArtefactType {
+         $smarty->assign('enc_id', json_encode($this->id));
+         $smarty->assign('limit', self::pagination);
+         $smarty->assign('loading_img', theme_get_url('images/loading.gif'));
+-        $smarty->assign('description', $this->get('description'));
++        $smarty->assign('description', clean_text($this->get('description')));
+ 
+         // Remove unnecessary options for blog posts
+         unset($options['hidetitle']);
+@@ -415,15 +415,15 @@ class ArtefactTypeBlogPost extends ArtefactType {
+             if (isset($options['viewid'])) {
+                 $smarty->assign('artefacttitle', '<a href="' . get_config('wwwroot') . 'view/artefact.php?artefact='
+                      . $this->get('id') . '&view=' . $options['viewid']
+-                     . '">' . $this->get('title') . '</a>');
++                     . '">' . hsc($this->get('title')) . '</a>');
+             }
+             else {
+-                $smarty->assign('artefacttitle', $this->get('title'));
++                $smarty->assign('artefacttitle', hsc($this->get('title')));
+             }
+         }
+ 
+         // We need to make sure that the images in the post have the right viewid associated with them
+-        $postcontent = $this->get('description');
++        $postcontent = clean_text($this->get('description'));
+         if (isset($options['viewid'])) {
+             $postcontent = preg_replace('#(<img[^>]+src="[^>]+artefact/file/download\.php\?file=\d+)#', '\1&amp;view=' . $options['viewid'], $postcontent);
+         }
+@@ -552,6 +552,9 @@ class ArtefactTypeBlogPost extends ArtefactType {
+                     $result[$file->blogpost]->files[] = $file;
+                 }
+             }
++            foreach ($result as &$post) {
++                $post->description = clean_text($post->description);
++            }
+         }
+ 
+         return array($count, array_values($result));
+diff --git a/htdocs/artefact/blog/theme/default/editpost.tpl b/htdocs/artefact/blog/theme/default/editpost.tpl
+index 9b1120e..dec5ec5 100644
+--- a/htdocs/artefact/blog/theme/default/editpost.tpl
++++ b/htdocs/artefact/blog/theme/default/editpost.tpl
+@@ -9,7 +9,7 @@
+ {include file="sidebar.tpl"}
+ 
+ {include file="columnleftstart.tpl"}
+-        <h2>{$pagetitle}</h2>
++        <h2>{$pagetitle|escape}</h2>
+         {$textinputform}
+         <div id='uploader'></div>
+         <div id='browsebuttonstuff'>
+diff --git a/htdocs/artefact/blog/theme/default/render/blogpost_renderfull.tpl b/htdocs/artefact/blog/theme/default/render/blogpost_renderfull.tpl
+index bc2f23d..1754212 100644
+--- a/htdocs/artefact/blog/theme/default/render/blogpost_renderfull.tpl
++++ b/htdocs/artefact/blog/theme/default/render/blogpost_renderfull.tpl
+@@ -11,7 +11,7 @@
+   {foreach from=$attachments item=item}
+       <tr class="r{cycle values=1,0}">
+         <td style="width: 22px;"><img src="{$item->iconpath|escape}" alt=""></td>
+-        <td><a href="{$item->viewpath|escape}">{$item->title}</a> ({$item->size}) - <strong><a href="{$item->downloadpath|escape}">{str tag=Download section=artefact.file}</a></strong>
++        <td><a href="{$item->viewpath|escape}">{$item->title|escape}</a> ({$item->size}) - <strong><a href="{$item->downloadpath|escape}">{str tag=Download section=artefact.file}</a></strong>
+         <br><strong>{$item->description|escape}</strong></td>
+       </tr>
+   {/foreach}
+diff --git a/htdocs/artefact/file/blocktype/image/lib.php b/htdocs/artefact/file/blocktype/image/lib.php
+index f5baa53..108feb8 100644
+--- a/htdocs/artefact/file/blocktype/image/lib.php
++++ b/htdocs/artefact/file/blocktype/image/lib.php
+@@ -71,7 +71,7 @@ class PluginBlocktypeImage extends PluginBlocktype {
+ 
+             $description = (is_a($image, 'ArtefacttypeImage')) ? $image->get('description') : $image->get('title');
+             if (!empty($configdata['showdescription']) && $description) {
+-                $result .= '<p>' . $description . '</p>';
++                $result .= '<p>' . hsc($description) . '</p>';
+             }
+             $result .= '</div>';
+         }
+diff --git a/htdocs/artefact/file/theme/default/file_render_self.tpl b/htdocs/artefact/file/theme/default/file_render_self.tpl
+index 1ea07c8..86d27e6 100644
+--- a/htdocs/artefact/file/theme/default/file_render_self.tpl
++++ b/htdocs/artefact/file/theme/default/file_render_self.tpl
+@@ -6,7 +6,7 @@
+ <table class="filedata">
+     <tr><th>{str tag=Type section=artefact.file}:</th><td>{$filetype}</td></tr>
+     <tr><th>{str tag=Description section=artefact.file}:</th><td>{$description|escape}</td></tr>
+-    <tr><th>{str tag=Owner section=artefact.file}:</th><td>{$owner}</td></tr>
++    <tr><th>{str tag=Owner section=artefact.file}:</th><td>{$owner|escape}</td></tr>
+     <tr><th>{str tag=Created section=artefact.file}:</th><td>{$created}</td></tr>
+     <tr><th>{str tag=lastmodified section=artefact.file}:</th><td>{$modified}</td></tr>
+     <tr><th>{str tag=Size section=artefact.file}:</th><td>{$size|escape}</td></tr>
+diff --git a/htdocs/artefact/file/theme/default/folder_render_self.tpl b/htdocs/artefact/file/theme/default/folder_render_self.tpl
+index 3e9427a..1a5cfbc 100644
+--- a/htdocs/artefact/file/theme/default/folder_render_self.tpl
++++ b/htdocs/artefact/file/theme/default/folder_render_self.tpl
+@@ -20,7 +20,7 @@
+       <tr class="{cycle values=r1,r0}">
+         <td><img src="{$child->iconsrc}" border="0" alt="{$child->artefacttype|escape}"></td>
+         <td><a href="{$WWWROOT}view/artefact.php?artefact={$child->id|escape}&amp;view={$viewid|escape}" title="{$child->hovertitle}">{$child->title}</a></td>
+-        <td>{$child->description}</td>
++        <td>{$child->description|escape}</td>
+         {if !$simpledisplay}<td>{$child->date}</td>{/if}
+       </tr>
+     {/foreach}
+diff --git a/htdocs/artefact/resume/theme/default/fragments/personalinformation.tpl b/htdocs/artefact/resume/theme/default/fragments/personalinformation.tpl
+index 1953c21..8f56c78 100644
+--- a/htdocs/artefact/resume/theme/default/fragments/personalinformation.tpl
++++ b/htdocs/artefact/resume/theme/default/fragments/personalinformation.tpl
+@@ -1,8 +1,8 @@
+ <table>
+ {foreach from=$fields key='field' item='value'}
+     <tr>
+-        <td>{$field}</td>
+-        <td>{$value}</td>
++        <td>{$field|escape}</td>
++        <td>{$value|escape}</td>
+     </tr>
+ {/foreach}
+ </table>
+diff --git a/htdocs/lib/web.php b/htdocs/lib/web.php
+index ee043e4..7120d48 100644
+--- a/htdocs/lib/web.php
++++ b/htdocs/lib/web.php
+@@ -439,7 +439,7 @@ EOF;
+ 
+         if ($USER->get('parentuser')) {
+             $smarty->assign('USERMASQUERADING', true);
+-            $smarty->assign('masqueradedetails', get_string('youaremasqueradingas', 'mahara', display_name($USER)));
++            $smarty->assign('masqueradedetails', get_string('youaremasqueradingas', 'mahara', hsc(display_name($USER))));
+             $smarty->assign('becomeyouagain',
+                 ' <a href="' . hsc($wwwroot) . 'admin/users/changeuser.php?restore=1">'
+                 . get_string('becomeadminagain', 'admin', $USER->get('parentuser')->name)
+diff --git a/htdocs/theme/default/templates/admin/users/edit.tpl b/htdocs/theme/default/templates/admin/users/edit.tpl
+index 028f753..aef9ed5 100644
+--- a/htdocs/theme/default/templates/admin/users/edit.tpl
++++ b/htdocs/theme/default/templates/admin/users/edit.tpl
+@@ -2,7 +2,7 @@
+ 
+ {include file="columnfullstart.tpl"}
+ <div id="edituser">
+-    <h2><a href="{$WWWROOT}user/view.php?id={$user->id}">{$user->firstname} {$user->lastname} ({$user->username})</a></h2>
++    <h2><a href="{$WWWROOT}user/view.php?id={$user->id}">{$user|display_name|escape}</a></h2>
+     {if !empty($loginas)}
+       <div><a href="{$WWWROOT}admin/users/changeuser.php?id={$user->id}">{$loginas}</a></div>
+     {/if}
+diff --git a/htdocs/theme/default/templates/searchresulttable.tpl b/htdocs/theme/default/templates/searchresulttable.tpl
+index 1031502..8b62df9 100644
+--- a/htdocs/theme/default/templates/searchresulttable.tpl
++++ b/htdocs/theme/default/templates/searchresulttable.tpl
+@@ -26,7 +26,7 @@
+         {foreach from=$results.data item=r}
+           <tr class="{cycle values="r0,r1"}">
+           {foreach from=$cols key=f item=c}
+-            <td{if (!empty($c.class))} class="{$c.class}"{/if}>{if empty($c.template)}{$r[$f]}{else}{eval var=$c.template}{/if}</td> 
++            <td{if (!empty($c.class))} class="{$c.class}"{/if}>{if empty($c.template)}{$r[$f]|escape}{else}{eval var=$c.template}{/if}</td>
+           {/foreach}
+           </tr>
+         {/foreach}
+diff --git a/htdocs/theme/default/templates/user/view.tpl b/htdocs/theme/default/templates/user/view.tpl
+index 34820cb..0cbc9c4 100644
+--- a/htdocs/theme/default/templates/user/view.tpl
++++ b/htdocs/theme/default/templates/user/view.tpl
+@@ -10,7 +10,7 @@
+             {/if}
+             </h2>
+             <div>
+-                {$introduction}
++                {$introduction|clean_text}
+                 <div class="fr user-icon">
+                     <img src="{$WWWROOT}thumb.php?type=profileicon&amp;maxwidth=100&amp;maxheight=100&amp;id={$USERID}" alt="">
+                     <div>
+@@ -39,12 +39,12 @@
+                 </div>
+ 				<ul id="user-info">
+                 {foreach from=$USERFIELDS name=userfields key=key item=item}
+-                    <li><label>{str section=artefact.internal tag=$key}:</label> {$item}</li>
++                    <li><label>{str section=artefact.internal tag=$key}:</label> {$item|escape}</li>
+                 {/foreach}
+ 				</ul>
+                 {if $relationship == 'pending'}
+                     <div class="message">
+-                        {str tag='whymakemeyourfriend' section='group'} {$reason}
++                        {str tag='whymakemeyourfriend' section='group'} {$reason|escape}
+                         {$requestform}
+                     </div>
+                 {/if}
+@@ -57,7 +57,7 @@
+                                 <h4><a href="{$WWWROOT}view/view.php?id={$item->id}">{$item->title|escape}</a></h4>
+                                 <span>
+                                 {if $item->description}
+-                                    {$item->description}
++                                    {$item->description|clean_text}
+                                 {/if}
+                                 {if $item->description && $item->artefacts}<br>{/if}
+                                 {if $item->artefacts}
+@@ -80,7 +80,7 @@
+                         <td class="r{cycle values=0,1}">
+                             <h4><a href="{$WWWROOT}group/view.php?id={$item->id}">{$item->name|escape}</a> - {str tag=$item->type section=group}</h4>
+                             {if $item->description}
+-                                {$item->description}
++                                {$item->description|clean_text}
+                             {/if}
+                         </td>
+                     </tr>
+diff --git a/htdocs/user/view.php b/htdocs/user/view.php
+index 0b9c2e7..763a008 100644
+--- a/htdocs/user/view.php
++++ b/htdocs/user/view.php
+@@ -332,7 +332,7 @@ if ($loggedinid != $userid) {
+ }
+ 
+ if ($userid != $USER->get('id') && is_null($USER->get('parentuser'))) {
+-    $loginas = get_string('loginasuser', 'admin', $user->username);
++    $loginas = get_string('loginasuser', 'admin', hsc($user->username));
+ } else {
+     $loginas = null;
+ }
+diff --git a/htdocs/view/artefact.php b/htdocs/view/artefact.php
+index 9094632..8559742 100644
+--- a/htdocs/view/artefact.php
++++ b/htdocs/view/artefact.php
+@@ -87,13 +87,13 @@ $artefactpath[] = array(
+     'title' => $artefact->display_title(),
+ );
+ 
+-$heading = '<a href="' . get_config('wwwroot') . 'view/view.php?id=' . $view->get('id') .'">' . hsc($view->get('title')) . '</a> ' . get_string('by', 'view') . ' <a href="' . get_config('wwwroot') .'user/view.php?id=' . $view->get('owner'). '">' . $view->formatted_owner() . '</a>';
++$heading = '<a href="' . get_config('wwwroot') . 'view/view.php?id=' . $view->get('id') .'">' . hsc($view->get('title')) . '</a> ' . get_string('by', 'view') . ' <a href="' . get_config('wwwroot') .'user/view.php?id=' . $view->get('owner'). '">' . hsc($view->formatted_owner()) . '</a>';
+ foreach ($artefactpath as $item) {
+ 	if (empty($item['url'])) {
+-	    $heading .= ': ' . $item['title'];
++            $heading .= ': ' . hsc($item['title']);
+ 	}
+ 	else {
+-        $heading .= ': <a href="' . $item['url'] . '">' . $item['title'] . '</a>';
++            $heading .= ': <a href="' . $item['url'] . '">' . hsc($item['title']) . '</a>';
+ 	}
+ }
+ 
+diff --git a/htdocs/view/view.php b/htdocs/view/view.php
+index ebe6fde..4113f28 100644
+--- a/htdocs/view/view.php
++++ b/htdocs/view/view.php
+@@ -49,7 +49,7 @@ if ($new) {
+ else {
+     $heading = '<a href="' . get_config('wwwroot') . 'view/view.php?id=' . $view->get('id') .'">' . hsc($view->get('title')) . '</a>';
+ }
+-$heading .= ' ' . get_string('by', 'view') . ' <a href="' . get_config('wwwroot') .'user/view.php?id=' . $view->get('owner'). '">' . $view->formatted_owner() . '</a>';
++$heading .= ' ' . get_string('by', 'view') . ' <a href="' . get_config('wwwroot') .'user/view.php?id=' . $view->get('owner'). '">' . hsc($view->formatted_owner()) . '</a>';
+ 
+ 
+ $tutorfilefeedbackformrow = '';
--- mahara-1.0.4.orig/debian/patches/CVE-2010-2479.dpatch
+++ mahara-1.0.4/debian/patches/CVE-2010-2479.dpatch
@@ -0,0 +1,138 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## CVE-2010-2479.dpatch by Francois Marier <francois@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Fix IE-only XSS in HTML Purifier
+
+@DPATCH@
+diff --git a/library/HTMLPurifier/AttrDef.php b/library/HTMLPurifier/AttrDef.php
+index f29c933..2b76992 100644
+--- a/htdocs/lib/htmlpurifier/HTMLPurifier/AttrDef.php
++++ b/htdocs/lib/htmlpurifier/HTMLPurifier/AttrDef.php
+@@ -75,6 +75,42 @@ abstract class HTMLPurifier_AttrDef
+         // object (usually by instantiating a new copy) and return that
+         return $this;
+     }
+-    
++
++    /**
++     * Parses a possibly escaped CSS string and returns the "pure" 
++     * version of it.
++     */
++    protected function expandCSSEscape($string) {
++        // flexibly parse it
++        $ret = '';
++        for ($i = 0, $c = strlen($string); $i < $c; $i++) {
++            if ($string[$i] === '\\') {
++                $i++;
++                if ($i >= $c) {
++                    $ret .= '\\';
++                    break;
++                }
++                if (ctype_xdigit($string[$i])) {
++                    $code = $string[$i];
++                    for ($a = 1, $i++; $i < $c && $a < 6; $i++, $a++) {
++                        if (!ctype_xdigit($string[$i])) break;
++                        $code .= $string[$i];
++                    }
++                    // We have to be extremely careful when adding
++                    // new characters, to make sure we're not breaking
++                    // the encoding.
++                    $char = HTMLPurifier_Encoder::unichr(hexdec($code));
++                    if (HTMLPurifier_Encoder::cleanUTF8($char) === '') continue;
++                    $ret .= $char;
++                    if ($i < $c && trim($string[$i]) !== '') $i--;
++                    continue;
++                }
++                if ($string[$i] === "\n") continue;
++            }
++            $ret .= $string[$i];
++        }
++        return $ret;
++    }
++
+ }
+ 
+diff --git a/library/HTMLPurifier/AttrDef/CSS/FontFamily.php b/library/HTMLPurifier/AttrDef/CSS/FontFamily.php
+index 827dd4d..884371f 100644
+--- a/htdocs/lib/htmlpurifier/HTMLPurifier/AttrDef/CSS/FontFamily.php
++++ b/htdocs/lib/htmlpurifier/HTMLPurifier/AttrDef/CSS/FontFamily.php
+@@ -38,10 +38,10 @@ class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef
+                 $quote = $font[0];
+                 if ($font[$length - 1] !== $quote) continue;
+                 $font = substr($font, 1, $length - 2);
+-                // double-backslash processing is buggy
+-                $font = str_replace("\\$quote", $quote, $font); // de-escape quote
+-                $font = str_replace("\\\n", "\n", $font);       // de-escape newlines
+             }
++
++            $font = $this->expandCSSEscape($font);
++
+             // $font is a pure representation of the font name
+             
+             if (ctype_alnum($font)) {
+@@ -49,13 +49,22 @@ class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef
+                 $final .= $font . ', ';
+                 continue;
+             }
+-            
++
++            // bugger out on whitespace.  form feed (0C) really
++            // shouldn't show up regardless
++            $font = str_replace(array("\n", "\t", "\r", "\x0C"), ' ', $font);
++
++            // These ugly transforms don't pose a security
++            // risk (as \\ and \" might).  We could try to be clever and
++            // use single-quote wrapping when there is a double quote
++            // present, but I have choosen not to implement that.
++            // (warning: this code relies on the selection of quotation
++            // mark below)
++            $font = str_replace('\\', '\\5C ', $font);
++            $font = str_replace('"',  '\\22 ', $font);
++
+             // complicated font, requires quoting
+-            
+-            // armor single quotes and new lines
+-            $font = str_replace("'", "\\'", $font);
+-            $font = str_replace("\n", "\\\n", $font);
+-            $final .= "'$font', ";
++            $final .= "\"$font\", "; // note that this will later get turned into &quot;
+         }
+         $final = rtrim($final, ', ');
+         if ($final === '') return false;
+diff --git a/library/HTMLPurifier/AttrDef/CSS/URI.php b/library/HTMLPurifier/AttrDef/CSS/URI.php
+index ea1d0ad..11c554d 100644
+--- a/htdocs/lib/htmlpurifier/HTMLPurifier/AttrDef/CSS/URI.php
++++ b/htdocs/lib/htmlpurifier/HTMLPurifier/AttrDef/CSS/URI.php
+@@ -35,22 +35,18 @@ class HTMLPurifier_AttrDef_CSS_URI extends HTMLPurifier_AttrDef_URI
+             if ($uri[$new_length] !== $quote) return false;
+             $uri = substr($uri, 1, $new_length - 1);
+         }
+-        
+-        $keys   = array(  '(',   ')',   ',',   ' ',   '"',   "'");
+-        $values = array('\\(', '\\)', '\\,', '\\ ', '\\"', "\\'");
+-        $uri = str_replace($values, $keys, $uri);
+-        
++
++        $uri = $this->expandCSSEscape($uri);
++
+         $result = parent::validate($uri, $config, $context);
+         
+         if ($result === false) return false;
+-        
+-        // escape necessary characters according to CSS spec
+-        // except for the comma, none of these should appear in the
+-        // URI at all
+-        $result = str_replace($keys, $values, $result);
+-        
+-        return "url($result)";
+-        
++
++        // extra sanity check; should have been done by URI
++        $result = str_replace(array('"', "\\", "\n", "\x0c", "\r"), "", $result);
++
++        return "url(\"$result\")";
++
+     }
+     
+ }
--- mahara-1.0.4.orig/debian/patches/clamav_escaping.dpatch
+++ mahara-1.0.4/debian/patches/clamav_escaping.dpatch
@@ -0,0 +1,29 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## clamav_escaping.dpatch by Francois Marier <francois@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Escape the clamav path provided by the admin
+
+@DPATCH@
+diff --git a/htdocs/lib/uploadmanager.php b/htdocs/lib/uploadmanager.php
+index d95bfc8..aa0bef6 100644
+--- a/htdocs/lib/uploadmanager.php
++++ b/htdocs/lib/uploadmanager.php
+@@ -265,7 +265,7 @@ function clam_scan_file(&$file) {
+         return get_string('unknownerror'); 
+     }
+ 
+-    $pathtoclam = trim(get_config('pathtoclam'));
++    $pathtoclam = escapeshellcmd(trim(get_config('pathtoclam')));
+ 
+     if (!$pathtoclam || !file_exists($pathtoclam) || !is_executable($pathtoclam)) {
+         clam_mail_admins(get_string('clamlost', 'mahara', $pathtoclam));
+@@ -273,7 +273,7 @@ function clam_scan_file(&$file) {
+         return get_string('clambroken');
+     }
+ 
+-    $cmd = $pathtoclam .' '. $fullpath ." 2>&1";
++    $cmd = $pathtoclam .' '. escapeshellarg($fullpath) ." 2>&1";
+ 
+     // before we do anything we need to change perms so that clamscan
+     // can read the file (clamdscan won't work otherwise)
--- mahara-1.0.4.orig/debian/patches/CVE-2010-1668.dpatch
+++ mahara-1.0.4/debian/patches/CVE-2010-1668.dpatch
@@ -0,0 +1,140 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## CVE-2010-1668.dpatch by Francois Marier <francois@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Multiple CSRF vulnerabilities
+
+@DPATCH@
+diff --git a/htdocs/admin/users/addauthority.php b/htdocs/admin/users/addauthority.php
+index b147895..fa68d45 100644
+--- a/htdocs/admin/users/addauthority.php
++++ b/htdocs/admin/users/addauthority.php
+@@ -55,6 +55,16 @@ if ($institution && $plugin) {
+         // We've been asked to add an instance of an auth plugin that has no
+         // config options. We've been called by an AJAX request, so we just
+         // add the instance and generate an acknowledgement.
++
++        // The session key has not been checked yet, because this page doesn't
++        // define JSON
++        try {
++            form_validate(param_alphanum('sesskey', null));
++        }
++        catch (UserException $e) {
++            json_reply(true, $e->getMessage());
++        }
++
+         $authinstance = new stdClass();
+ 
+         // Get the auth instance with the highest priority number (which is
+diff --git a/htdocs/interaction/forum/theme/default/view.tpl b/htdocs/interaction/forum/theme/default/view.tpl
+index 9be13ac..aed0b37 100644
+--- a/htdocs/interaction/forum/theme/default/view.tpl
++++ b/htdocs/interaction/forum/theme/default/view.tpl
+@@ -101,6 +101,7 @@
+         {contextualhelp plugintype='interaction' pluginname='forum' section='update'}
+     {/if}
+     {/if}
++    <input type="hidden" name="sesskey" value="{$SESSKEY}">
+ </form>
+ 
+ <h4>{str tag="Key" section="interaction.forum"}:</h4>
+diff --git a/htdocs/interaction/forum/view.php b/htdocs/interaction/forum/view.php
+index ca77c8e..213ff4d 100644
+--- a/htdocs/interaction/forum/view.php
++++ b/htdocs/interaction/forum/view.php
+@@ -86,6 +86,7 @@ if (isset($_POST['checked'])) {
+     // check that user is only messing with topics from this forum
+     $alltopics = get_column('interaction_forum_topic', 'id', 'forum', $forumid, 'deleted', 0);
+     if ($checked == array_intersect($checked, $alltopics)) { // $checked is a subset of the topics in this forum
++        form_validate(param_variable('sesskey', null));
+         if ($moderator && $type == 'sticky') {
+             set_field_select('interaction_forum_topic', 'sticky', 1, 'id IN (' . implode($checked, ',') . ')', array());
+             $SESSION->add_ok_msg(get_string('topicstickysuccess', 'interaction.forum'));
+diff --git a/htdocs/lib/mahara.php b/htdocs/lib/mahara.php
+index 05578d9..e8eeaeb 100644
+--- a/htdocs/lib/mahara.php
++++ b/htdocs/lib/mahara.php
+@@ -1238,12 +1238,12 @@ function pieform_configure() {
+     );
+ }
+ 
+-function pieform_validate(Pieform $form, $values) {
++function form_validate($sesskey) {
+     global $USER;
+-    if (!isset($values['sesskey'])) {
++    if (is_null($sesskey)) {
+         throw new UserException('No session key');
+     }
+-    if ($USER && $USER->is_logged_in() && $USER->get('sesskey') != $values['sesskey']) {
++    if ($USER && $USER->is_logged_in() && $USER->get('sesskey') != $sesskey) {
+         throw new UserException('Invalid session key');
+     }
+ 
+@@ -1259,6 +1259,13 @@ function pieform_validate(Pieform $form, $values) {
+     }
+ }
+ 
++function pieform_validate(Pieform $form, $values) {
++    if (!isset($values['sesskey'])) {
++        throw new UserException('No session key');
++    }
++    form_validate($values['sesskey']);
++}
++
+ function pieform_reply($code, $data) {
+     global $SESSION;
+     if (isset($data['message'])) {
+diff --git a/htdocs/lib/view.php b/htdocs/lib/view.php
+index 3f3bb1b..18ebe57 100644
+--- a/htdocs/lib/view.php
++++ b/htdocs/lib/view.php
+@@ -508,6 +508,8 @@ class View {
+         if (empty($action)) {
+             return;
+         }
++
++        form_validate(param_alphanum('sesskey', null));
+     
+         $actionstring = $action;
+         $action = substr($action, 0, strpos($action, '_'));
+@@ -531,7 +533,7 @@ class View {
+             case 'removeblockinstance': // requires action_removeblockinstance_id_\d
+                 if (!defined('JSON')) {
+                     if (!$sure = param_boolean('sure')) {
+-                        $yeslink = get_config('wwwroot') . '/view/blocks.php?id=' . $this->get('id') . '&c=file&new=' . $new . '&action_' . $action . '_' .  $actionstring . '=1&sure=true';
++                        $yeslink = get_config('wwwroot') . '/view/blocks.php?id=' . $this->get('id') . '&c=file&new=' . $new . '&action_' . $action . '_' .  $actionstring . '=1&sure=true&sesskey=' . $USER->get('sesskey');
+                         $baselink = '/view/blocks.php?id=' . $this->get('id') . '&c=' . $category . '&new=' . $new;
+                         $SESSION->add_info_msg(get_string('confirmdeleteblockinstance', 'view') 
+                             . ' <a href="' . $yeslink . '">' . get_string('yes') . '</a>'
+diff --git a/htdocs/theme/default/templates/view/blocks.tpl b/htdocs/theme/default/templates/view/blocks.tpl
+index 425f0a9..fac8d5c 100644
+--- a/htdocs/theme/default/templates/view/blocks.tpl
++++ b/htdocs/theme/default/templates/view/blocks.tpl
+@@ -9,6 +9,7 @@
+         <input type="hidden" id="viewid" name="id" value="{$view}">
+         <input type="hidden" name="change" value="1">
+         <input type="hidden" id="category" name="c" value="{$category}">
++        <input type="hidden" name="sesskey" value="{$SESSKEY}">
+         {if $new}<input type="hidden" name="new" value="1">{/if}
+         <div id="page">
+             <div id="top-pane">
+@@ -51,6 +52,7 @@
+             <input type="hidden" name="id" value="{$view}">
+             <input type="hidden" name="new" value="1">
+             <input type="submit" name="cancel" class="submit" value="{str tag='cancel'}" onclick="return confirm('{str tag='confirmcancelcreatingview' section='view'}');">
++            <input type="hidden" name="sesskey" value="{$SESSKEY}">
+         </form>
+         <form action="{$WWWROOT}view/edit.php" method="GET">
+             <input type="hidden" name="id" value="{$view}">
+diff --git a/htdocs/view/blocks.php b/htdocs/view/blocks.php
+index 3a3ea30..c642d23 100644
+--- a/htdocs/view/blocks.php
++++ b/htdocs/view/blocks.php
+@@ -51,6 +51,7 @@ else {
+ 
+ // check if cancel was selected
+ if ($new && isset($_POST['cancel'])) {
++    form_validate(param_variable('sesskey', null));
+     $view->delete();
+     redirect(get_config('wwwroot') . '/view/');
+ }
--- mahara-1.0.4.orig/debian/patches/XSS_escaping.dpatch
+++ mahara-1.0.4/debian/patches/XSS_escaping.dpatch
@@ -0,0 +1,46 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## XSS_escaping.dpatch by Francois Marier <francois@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Multiple XSS vulnerabilities
+
+@DPATCH@
+diff --git a/htdocs/artefact/file/theme/default/folder_render_self.tpl b/htdocs/artefact/file/theme/default/folder_render_self.tpl
+index 3e9427a..3f50753 100644
+--- a/htdocs/artefact/file/theme/default/folder_render_self.tpl
++++ b/htdocs/artefact/file/theme/default/folder_render_self.tpl
+@@ -18,8 +18,8 @@
+     <tbody>
+     {foreach from=$children item=child}
+       <tr class="{cycle values=r1,r0}">
+-        <td><img src="{$child->iconsrc}" border="0" alt="{$child->artefacttype|escape}"></td>
+-        <td><a href="{$WWWROOT}view/artefact.php?artefact={$child->id|escape}&amp;view={$viewid|escape}" title="{$child->hovertitle}">{$child->title}</a></td>
++        <td><img src="{$child->iconsrc|escape}" border="0" alt="{$child->artefacttype|escape}"></td>
++        <td><a href="{$WWWROOT}view/artefact.php?artefact={$child->id|escape}&amp;view={$viewid|escape}" title="{$child->hovertitle|escape}">{$child->title|escape}</a></td>
+         <td>{$child->description|escape}</td>
+         {if !$simpledisplay}<td>{$child->date}</td>{/if}
+       </tr>
+diff --git a/htdocs/artefact/resume/theme/default/artefactchooser-element.tpl b/htdocs/artefact/resume/theme/default/artefactchooser-element.tpl
+index 56f5d21..ef18052 100644
+--- a/htdocs/artefact/resume/theme/default/artefactchooser-element.tpl
++++ b/htdocs/artefact/resume/theme/default/artefactchooser-element.tpl
+@@ -5,5 +5,5 @@
+         <th><label for="{$elementname}_{$artefact->id}" title="{$artefact->title|strip_tags|substr:0:60|escape}">{str tag=$artefact->artefacttype section=artefact.resume}</label></th>
+     </tr>
+     <tr>
+-        <td>{if $artefact->description}{$artefact->description}{/if}</td>
++        <td>{$artefact->description|str_shorten}</td>
+     </tr>
+diff --git a/htdocs/theme/default/templates/view/submit.tpl b/htdocs/theme/default/templates/view/submit.tpl
+index fa24eb4..f0bd075 100644
+--- a/htdocs/theme/default/templates/view/submit.tpl
++++ b/htdocs/theme/default/templates/view/submit.tpl
+@@ -4,7 +4,7 @@
+ {include file="columnleftstart.tpl"}
+ <h2>{$heading|escape}</h2>
+ <div class="message">
+-<p>{$message}</p>
++<p>{$message|escape}</p>
+ {$form}
+ </div>
+ {include file="columnleftend.tpl"}
--- mahara-1.0.4.orig/debian/patches/CVE-2009-0664.dpatch
+++ mahara-1.0.4/debian/patches/CVE-2009-0664.dpatch
@@ -0,0 +1,31 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## CVE-2009-0664.dpatch by Francois Marier <francois@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: XSS vulnerabilities
+
+@DPATCH@
+diff --git a/htdocs/artefact/internal/blocktype/profileinfo/theme/default/content.tpl b/htdocs/artefact/internal/blocktype/profileinfo/theme/default/content.tpl
+index 64235c9..5cb0d3b 100644
+--- a/htdocs/artefact/internal/blocktype/profileinfo/theme/default/content.tpl
++++ b/htdocs/artefact/internal/blocktype/profileinfo/theme/default/content.tpl
+@@ -1,5 +1,5 @@
+ {if $profileiconpath}<div class="fr"><img src="{$profileiconpath|escape}" alt=""></div>{/if}
+-<p>{$profileinfo.introduction}</p>
++<p>{$profileinfo.introduction|clean_text}</p>
+ 
+ <ul>
+ {foreach from=$profileinfo key=key item=item}
+diff --git a/htdocs/blocktype/textbox/lib.php b/htdocs/blocktype/textbox/lib.php
+index 4d6b109..9e50085 100644
+--- a/htdocs/blocktype/textbox/lib.php
++++ b/htdocs/blocktype/textbox/lib.php
+@@ -43,7 +43,7 @@ class PluginBlocktypeTextbox extends SystemBlocktype {
+     public static function render_instance(BlockInstance $instance) {
+         $configdata = $instance->get('configdata');
+         $text = (isset($configdata['text'])) ? $configdata['text'] : '';
+-        return $text;
++        return clean_text($text);
+     }
+ 
+     public static function has_instance_config() {
--- mahara-1.0.4.orig/debian/po/fi.po
+++ mahara-1.0.4/debian/po/fi.po
@@ -0,0 +1,122 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: mahara\n"
+"Report-Msgid-Bugs-To: mahara@packages.debian.org\n"
+"POT-Creation-Date: 2008-03-28 14:33+1300\n"
+"PO-Revision-Date: 2008-07-03 09:15-0000\n"
+"Last-Translator: Esko Arajärvi <edu@iki.fi>\n"
+"Language-Team: Finnish <debian-l10n-finnish@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=utf-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Poedit-Language: Finnish\n"
+"X-Poedit-Country: FINLAND\n"
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "Database type:"
+msgstr "Tietokannan tyyppi:"
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "What type of database should be used for the Mahara site"
+msgstr "Valitse minkä tyyppistä tietokantaa Mahara-sivuston tulisi käyttää."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid "Database host:"
+msgstr "Tietokantapalvelin:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid ""
+"Which database host should be used for the Mahara site You can leave this "
+"blank to connect via UNIX sockets"
+msgstr ""
+"Anna tietokantapalvelin, jota Mahara-sivuston tulisi käyttää. Käytettäessä "
+"UNIX-pistokkeita tämä voidaan jättää tyhjäksi."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid "Database port:"
+msgstr "Tietokantaportti:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid ""
+"Which database port should be used for the Mahara site You can leave this "
+"blank for the default"
+msgstr ""
+"Anna tietokantaportti, jota Mahara-sivuston tulisi käyttää. Jos tämä "
+"jätetään tyhjäksi, käytetään oletusporttia."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Database name (not username):"
+msgstr "Tietokannan nimi (ei käyttäjätunnus):"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Which database should be used for the Mahara site"
+msgstr "Anna käytettävän Mahara-sivuston tietokannan nimi."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Database username:"
+msgstr "Tietokannan käyttäjätunnus:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Which username should be used to connect to the Mahara database"
+msgstr ""
+"Anna käyttäjätunnus, jota käytetään otettaessa yhteys Mahara-tietokantaan."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid "Database password:"
+msgstr "Tietokannan salasana:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid ""
+"Which password is associated with the given username You can leave this "
+"blank if you are not using password authentication."
+msgstr ""
+"Anna annetun käyttäjätunnuksen salasana. Jätä kenttä tyhjäksi, jos "
+"tunnistautumisessa ei käytetä salasanoja."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "SMTP Hosts:"
+msgstr "SMTP-palvelimet:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "Comma separated list of SMTP servers to use to send mail"
+msgstr ""
+"Anna pilkuin eroteltuna lista SMTP-palvelimista, joiden kautta sähköposti "
+"lähetetään."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid ""
+"If you leave this blank, the system mailer will be used. Generally, this "
+"will work fine"
+msgstr ""
+"Jos tämä jätetään tyhjäksi, käytetään järjestelmän postijärjestelmää. Tämä "
+"toimii yleensä hyvin."
--- mahara-1.0.4.orig/debian/po/es.po
+++ mahara-1.0.4/debian/po/es.po
@@ -0,0 +1,171 @@
+# Mahara translation to Spanish	
+# Copyright (C) 2007
+# This file is distributed under the same license as the mahara package.
+# Changes:
+# 	- Initial translation
+# 		Maria Germana Oliveira <germanaoliveirab@gmail.com>, 2007.
+#
+# Traductores, si no conoce el formato PO, merece la pena leer la 
+# documentación de gettext, especialmente las secciones dedicadas a este
+#  formato, por ejemplo ejecutando:
+#          info -n '(gettext)PO Files'
+#          info -n '(gettext)Header Entry'
+#
+# Equipo de traducción al español, por favor lean antes de traducir
+# los siguientes documentos:
+#  
+# - El proyecto de traducción de Debian al español
+# http://www.debian.org/intl/spanish/coordinacion
+# especialmente las notas de traducción en
+# http://www.debian.org/intl/spanish/notas
+#
+# - La guía de traducción de po's de debconf:
+# /usr/share/doc/po-debconf/README-trans
+# o http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: mahara 0.9.0-1\n"
+"Report-Msgid-Bugs-To: mahara@packages.debian.org\n"
+"POT-Creation-Date: 2008-03-28 14:33+1300\n"
+"PO-Revision-Date: 2008-01-09 14:27-0430\n"
+"Last-Translator: Maria Germana Oliveira Blazetic <germanaoliveirab@gmail."
+"com>\n"
+"Language-Team: Spanish <debian-l10n-spanish@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "Database type:"
+msgstr "Tipo de base de datos:"
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "What type of database should be used for the Mahara site"
+msgstr "¿Qué tipo de base de datos debería usarse para el sitio de Mahara?"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid "Database host:"
+msgstr "Servidor de base de datos:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid ""
+"Which database host should be used for the Mahara site You can leave this "
+"blank to connect via UNIX sockets"
+msgstr ""
+"¿Qué servidor de base de datos debería usarse para el sitio de Mahara? Puede "
+"dejar esto en blanco para conectarse a través de puertos de UNIX"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid "Database port:"
+msgstr "Puerto de conexión de la base de datos:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid ""
+"Which database port should be used for the Mahara site You can leave this "
+"blank for the default"
+msgstr ""
+"¿Qué puerto de base de datos debería usarse para el sitio de Mahara? Puede "
+"dejar esto en blanco para usar el predeterminado"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Database name (not username):"
+msgstr "Nombre de la base de datos (no el nombre de usuario):"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Which database should be used for the Mahara site"
+msgstr "¿Qué base de datos debería usarse para el sitio de Mahara?"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Database username:"
+msgstr "Nombre de usuario de la base de datos:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Which username should be used to connect to the Mahara database"
+msgstr ""
+"¿Qué nombre de usuario debería usarse para conectarse a la base de datos del "
+"sitio de Mahara?"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid "Database password:"
+msgstr "Contraseña de la base de datos:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid ""
+"Which password is associated with the given username You can leave this "
+"blank if you are not using password authentication."
+msgstr ""
+"¿Qué contraseña estará asociada con el nombre de usuario dado anteriormente? "
+"Puede dejar esto en blanco si no está usando la autenticación por contraseña."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "SMTP Hosts:"
+msgstr "Servidores SMTP:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "Comma separated list of SMTP servers to use to send mail"
+msgstr ""
+"Lista de servidores SMTP, separada por comas, usados para enviar correo "
+"electrónico"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid ""
+"If you leave this blank, the system mailer will be used. Generally, this "
+"will work fine"
+msgstr ""
+"Si deja esto en blanco, se usará el servidor de correo del sistema. "
+"Generalmente esto debería funcionar bien"
+
+#~ msgid "Server name:"
+#~ msgstr "Nombre del Servidor:"
+
+#~ msgid "This is the servername of the Mahara site."
+#~ msgstr "Este será el nombre de servidor del sitio de Mahara."
+
+#~ msgid ""
+#~ "Note that this is just the domain name, so for \"http://my.site.com\" you "
+#~ "only need to enter \"my.site.com\""
+#~ msgstr ""
+#~ "Note, que esto es solo el nombre de dominio, por lo tanto para «http://mi."
+#~ "sitio.com» solo necesita introducir «mi.sitio.com»"
+
+#~ msgid "Server redirects:"
+#~ msgstr "Redireccionamientos del servidor:"
+
+#~ msgid ""
+#~ "Comma separated list of domain names that the server should permanently "
+#~ "redirect to the server name."
+#~ msgstr ""
+#~ "Lista de nombres de dominio, separada por comas, que el servidor deberá "
+#~ "redirigir permanentemente al nombre de servidor."
--- mahara-1.0.4.orig/debian/po/POTFILES.in
+++ mahara-1.0.4/debian/po/POTFILES.in
@@ -0,0 +1 @@
+[type: gettext/rfc822deb] mahara.templates
--- mahara-1.0.4.orig/debian/po/gl.po
+++ mahara-1.0.4/debian/po/gl.po
@@ -0,0 +1,122 @@
+# Galician translation of mahara's debconf templates
+# This file is distributed under the same license as the mahara package.
+# Jacobo Tarrio <jtarrio@debian.org>, 2008.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: mahara\n"
+"Report-Msgid-Bugs-To: mahara@packages.debian.org\n"
+"POT-Creation-Date: 2008-03-28 14:33+1300\n"
+"PO-Revision-Date: 2008-06-26 21:03+0100\n"
+"Last-Translator: Jacobo Tarrio <jtarrio@debian.org>\n"
+"Language-Team: Galician <proxecto@trasno.net>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "Database type:"
+msgstr "Tipo da base de datos:"
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "What type of database should be used for the Mahara site"
+msgstr "Que tipo de base de datos se debe empregar para o sitio de Mahara."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid "Database host:"
+msgstr "Servidor da base de datos:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid ""
+"Which database host should be used for the Mahara site You can leave this "
+"blank to connect via UNIX sockets"
+msgstr ""
+"Que servidor de bases de datos se debe empregar para o sitio de Mahara. Pode "
+"deixalo en branco para se conectar mediante sockets UNIX."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid "Database port:"
+msgstr "Porto da base de datos:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid ""
+"Which database port should be used for the Mahara site You can leave this "
+"blank for the default"
+msgstr ""
+"Que porto da base de datos se debe empregar para o sitio de Mahara. Pode "
+"deixalo en branco para empregar o valor por defecto."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Database name (not username):"
+msgstr "Nome da base de datos (non o usuario):"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Which database should be used for the Mahara site"
+msgstr "Que base de datos se debe empregar para o sitio de Mahara."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Database username:"
+msgstr "Nome do usuario da base de datos:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Which username should be used to connect to the Mahara database"
+msgstr "Cal é o usuario a empregar para se conectar á base de datos de Mahara."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid "Database password:"
+msgstr "Contrasinal da base de datos:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid ""
+"Which password is associated with the given username You can leave this "
+"blank if you are not using password authentication."
+msgstr ""
+"Que contrasinal está asociado co nome de usuario fornecido. Pode deixalo en "
+"branco se non emprega autenticación por contrasinais."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "SMTP Hosts:"
+msgstr "Servidores SMTP:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "Comma separated list of SMTP servers to use to send mail"
+msgstr ""
+"Lista de servidores SMTP separados por comas a empregar para enviar correo."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid ""
+"If you leave this blank, the system mailer will be used. Generally, this "
+"will work fine"
+msgstr ""
+"Se deixa isto baleiro, hase empregar o sistema de correo do sistema. Isto "
+"adoita funcionar correctamente."
--- mahara-1.0.4.orig/debian/po/cs.po
+++ mahara-1.0.4/debian/po/cs.po
@@ -0,0 +1,123 @@
+# Czech translation of mahara debconf messages.
+# Copyright (C) 2008 Miroslav Kure <kurem@debian.cz>
+# This file is distributed under the same license as the mahara package.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: mahara\n"
+"Report-Msgid-Bugs-To: mahara@packages.debian.org\n"
+"POT-Creation-Date: 2008-03-28 14:33+1300\n"
+"PO-Revision-Date: 2008-06-28 13:21+0200\n"
+"Last-Translator: Miroslav Kure <kurem@debian.cz>\n"
+"Language-Team: Czech <debian-l10n-czech@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "Database type:"
+msgstr "Typ databáze:"
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "What type of database should be used for the Mahara site"
+msgstr "Typ databáze, který se má použít pro systém Mahara."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid "Database host:"
+msgstr "Server s databází:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid ""
+"Which database host should be used for the Mahara site You can leave this "
+"blank to connect via UNIX sockets"
+msgstr ""
+"Na kterém serveru se nachází databáze pro systém Mahara. Pro připojení pomocí "
+"Unixových socketů můžete ponechat prázdné."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid "Database port:"
+msgstr "Port databáze:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid ""
+"Which database port should be used for the Mahara site You can leave this "
+"blank for the default"
+msgstr ""
+"Databázový port, který se má použít pro systém Mahara. Pro výchozí hodnotu "
+"můžete ponechat prázdné."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Database name (not username):"
+msgstr "Jméno databáze:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Which database should be used for the Mahara site"
+msgstr "Databáze, která se má použít pro systém Mahara."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Database username:"
+msgstr "Uživatelské jméno do databáze:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Which username should be used to connect to the Mahara database"
+msgstr ""
+"Uživatelské jméno, které se má použít pro připojení k databázi systému Mahara."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid "Database password:"
+msgstr "Heslo do databáze:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid ""
+"Which password is associated with the given username You can leave this "
+"blank if you are not using password authentication."
+msgstr ""
+"Heslo, které se má použít s dříve zadaným uživatelským jménem pro připojení "
+"k databázi systému Mahara. Pokud nepoužíváte ověřování heslem, můžete "
+"ponechat prázdné."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "SMTP Hosts:"
+msgstr "SMTP servery:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "Comma separated list of SMTP servers to use to send mail"
+msgstr "Čárkami oddělený seznam SMTP serverů pro odesílání pošty"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid ""
+"If you leave this blank, the system mailer will be used. Generally, this "
+"will work fine"
+msgstr ""
+"Ponecháte-li prázdné, použije se poštovní server nastavený v systému. "
+"Obvykle to bude fungovat bez problémů."
--- mahara-1.0.4.orig/debian/po/tr.po
+++ mahara-1.0.4/debian/po/tr.po
@@ -0,0 +1,106 @@
+# Copyright (C) 2008 Mert Dirik <mertdirik@gmail.com>
+# This file is distributed under the same license as the mahara package.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: mahara 1.0.3-1\n"
+"Report-Msgid-Bugs-To: mahara@packages.debian.org\n"
+"POT-Creation-Date: 2008-03-28 14:33+1300\n"
+"PO-Revision-Date: 2008-06-25 14:04+0200\n"
+"Last-Translator: Mert Dirik <mertdirik@gmail.com>\n"
+"Language-Team: Debian L10n Turkish <debian-l10n-turkish@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=1; plural=0;\n"
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "Database type:"
+msgstr "Veritabanı türü:"
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "What type of database should be used for the Mahara site"
+msgstr "Mahara sitesinde ne tür bir veritabanı kullanılsın?"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid "Database host:"
+msgstr "Veritabanı makinesi:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid "Which database host should be used for the Mahara site You can leave this blank to connect via UNIX sockets"
+msgstr "Mahara sitesinde hangi veritabanı makinesi kullanılsın? UNIX soketleri yoluyla bağlanmak için bu alanı boş bırakabilirsiniz."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid "Database port:"
+msgstr "Veritabanı portu:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid "Which database port should be used for the Mahara site You can leave this blank for the default"
+msgstr "Mahara sitesinde hangi veritabanı portu kullanılsın? Öntanımlı değeri kullanmak için bu alanı boş bırakabilirsiniz."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Database name (not username):"
+msgstr "Veritabanı adı (kullanıcı adı değil):"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Which database should be used for the Mahara site"
+msgstr "Mahara sitesinde hangi veritabanı kullanılsın?"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Database username:"
+msgstr "Veritabanı kullanıcı adı:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Which username should be used to connect to the Mahara database"
+msgstr "Mahara veritabanına bağlanmak için hangi kullanıcı adı kullanılsın?"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid "Database password:"
+msgstr "Veritabanı parolası:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid "Which password is associated with the given username You can leave this blank if you are not using password authentication."
+msgstr "Verilen kullanıcı hesabının parolası nedir? Eğer parolayla kimlik doğrulama kullanmıyorsanız bu alanı boş bırakabilirsiniz."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "SMTP Hosts:"
+msgstr "SMTP Sunucuları:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "Comma separated list of SMTP servers to use to send mail"
+msgstr "Posta göndermek için kullanılacak SMTP sunucularının virgülle ayrılmış listesi"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "If you leave this blank, the system mailer will be used. Generally, this will work fine"
+msgstr "Eğer bu alanı boş bırakırsanız, sistemin posta sunucusu kullanılacak. Bu genellikle sorun çıkarmaz."
+
--- mahara-1.0.4.orig/debian/po/sv.po
+++ mahara-1.0.4/debian/po/sv.po
@@ -0,0 +1,114 @@
+# translation of mahara_1.0.3-1_templates.po to swedish
+# Copyright (C) 2008 Martin Bagge <martin.bagge@bthstudent.se>
+# This file is distributed under the same license as the mahara package.
+msgid ""
+msgstr ""
+"Project-Id-Version: mahara_1.0.3-1_templates\n"
+"Report-Msgid-Bugs-To: mahara@packages.debian.org\n"
+"POT-Creation-Date: 2008-03-28 14:33+1300\n"
+"PO-Revision-Date: 2008-06-23 21:41+0200\n"
+"Last-Translator: Martin Bagge <martin.bagge@bthstudent.se>\n"
+"Language-Team: swedish <debian-l10n-swedish@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "Database type:"
+msgstr "Databastyp:"
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "What type of database should be used for the Mahara site"
+msgstr "Vilken sorts databas ska användas för Mahara"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid "Database host:"
+msgstr "Databasvärd:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid ""
+"Which database host should be used for the Mahara site You can leave this "
+"blank to connect via UNIX sockets"
+msgstr "Vilken databasvärd ska användas för Mahara. Du kan lämna detta fält blankt för att ansluta via UNIX-socket."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid "Database port:"
+msgstr "Databas-port:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid ""
+"Which database port should be used for the Mahara site You can leave this "
+"blank for the default"
+msgstr "Vilken databasport ska användas för Mahara? Lämnas detta fält tomt för att använda standardvärdet."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Database name (not username):"
+msgstr "Namn på databasen:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Which database should be used for the Mahara site"
+msgstr "Vilken databas ska användas för Mahara"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Database username:"
+msgstr "Användarnamn för databasen:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Which username should be used to connect to the Mahara database"
+msgstr "Vilket användarnamn ska användas för att ansluta till Maharadatabasen"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid "Database password:"
+msgstr "Lösenord för databasen:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid ""
+"Which password is associated with the given username You can leave this "
+"blank if you are not using password authentication."
+msgstr "Ange lösenordet för att ansluta till Maharadatabasen. Lämna fältet tomt om du inte använder lösenord för att ansluta till databasen."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "SMTP Hosts:"
+msgstr "Värd för utgående e-post(SMTP):"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "Comma separated list of SMTP servers to use to send mail"
+msgstr "Ange servrar för utgående e-post(SMTP), avskilj med komma för flera olika."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid ""
+"If you leave this blank, the system mailer will be used. Generally, this "
+"will work fine"
+msgstr "Om du lämnar detta fält blankt så används systemets meddelandehantering. Detta är en fullgod lösning."
+
--- mahara-1.0.4.orig/debian/po/ru.po
+++ mahara-1.0.4/debian/po/ru.po
@@ -0,0 +1,125 @@
+# translation of ru.po to Russian
+# This file is distributed under the same license as the mahara package.
+#
+# Yuri Kozlov <kozlov.y@gmail.com>, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: mahara 1.0.3-1\n"
+"Report-Msgid-Bugs-To: mahara@packages.debian.org\n"
+"POT-Creation-Date: 2008-03-28 14:33+1300\n"
+"PO-Revision-Date: 2008-07-03 21:15+0400\n"
+"Last-Translator: Yuri Kozlov <kozlov.y@gmail.com>\n"
+"Language-Team: Russian <debian-l10n-russian@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+"Plural-Forms:  nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n"
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "Database type:"
+msgstr "Тип базы данных:"
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "What type of database should be used for the Mahara site"
+msgstr "Укажите, какой тип базы данных нужно использовать для сайта Mahara"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid "Database host:"
+msgstr "Хост базы данных:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid ""
+"Which database host should be used for the Mahara site You can leave this "
+"blank to connect via UNIX sockets"
+msgstr ""
+"Укажите хост базы данных, который нужно использовать для сайта Mahara. "
+"Чтобы использовать сокеты UNIX, оставьте поле пустым."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid "Database port:"
+msgstr "Порт базы данных:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid ""
+"Which database port should be used for the Mahara site You can leave this "
+"blank for the default"
+msgstr ""
+"Укажите порт базы данных, который нужно использовать для сайта Mahara. "
+"Чтобы использовать значение по умолчанию, оставьте поле пустым."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Database name (not username):"
+msgstr "Имя базы данных (не имя пользователя):"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Which database should be used for the Mahara site"
+msgstr "Укажите имя базы данных, которое нужно использовать для сайта Mahara."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Database username:"
+msgstr "Имя пользователя для подключения к базе данных:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Which username should be used to connect to the Mahara database"
+msgstr "Укажите имя пользователя для подключения к базе данных Mahara."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid "Database password:"
+msgstr "Пароль к базе данных:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid ""
+"Which password is associated with the given username You can leave this "
+"blank if you are not using password authentication."
+msgstr ""
+"Укажите пароль для подключения к базе данных Mahara. "
+"Если аутентификация по паролю не используется, оставьте поле "
+"пустым."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "SMTP Hosts:"
+msgstr "Хосты SMTP:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "Comma separated list of SMTP servers to use to send mail"
+msgstr "Введите список SMTP-серверов (через запятую) для отправки почты."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid ""
+"If you leave this blank, the system mailer will be used. Generally, this "
+"will work fine"
+msgstr ""
+"Чтобы использовать системный почтовый сервер, оставьте поле пустым. "
+"Обычно, это отлично работает."
+
--- mahara-1.0.4.orig/debian/po/pt.po
+++ mahara-1.0.4/debian/po/pt.po
@@ -0,0 +1,157 @@
+# translation of mahara debconf to Portuguese
+# Mahara debconf questions
+# Copyright (C) 2007 Américo Monteiro
+# This file is distributed under the same license as the mahara package.
+#
+# Américo Monteiro <a_monteiro@netcabo.pt>, 2007, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: mahara 0.9.2-2\n"
+"Report-Msgid-Bugs-To: mahara@packages.debian.org\n"
+"POT-Creation-Date: 2008-03-28 14:33+1300\n"
+"PO-Revision-Date: 2008-03-19 23:08+0000\n"
+"Last-Translator: Américo Monteiro <a_monteiro@netcabo.pt>\n"
+"Language-Team: Portuguese <traduz@debianpt.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "Database type:"
+msgstr "Tipo de base de dados:"
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "What type of database should be used for the Mahara site"
+msgstr "Que tipo de base de dados deverá ser usada para o site Mahara?"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid "Database host:"
+msgstr "Máquina da base de dados:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid ""
+"Which database host should be used for the Mahara site You can leave this "
+"blank to connect via UNIX sockets"
+msgstr ""
+"Qual a máquina, com a base de dados, que deverá ser usada para o site "
+"Mahara? Você pode deixar este campo vazio para ligação via sockets UNIX."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid "Database port:"
+msgstr "Porto da base de dados:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid ""
+"Which database port should be used for the Mahara site You can leave this "
+"blank for the default"
+msgstr ""
+"Qual o porto da base de dados que deverá ser usado para o site Mahara? Você "
+"pode deixar este campo vazio para usar a pré-definição."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Database name (not username):"
+msgstr "Nome da base de dados (não é o nome de utilizador):"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Which database should be used for the Mahara site"
+msgstr "Qual base de dados deverá ser usada para o site Mahara?"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Database username:"
+msgstr "Nome de utilizador da base de dados:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Which username should be used to connect to the Mahara database"
+msgstr ""
+"Qual nome de utilizador deve ser usado para ligar à base de dados Mahara?"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid "Database password:"
+msgstr "Palavra-chave da base de dados:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid ""
+"Which password is associated with the given username You can leave this "
+"blank if you are not using password authentication."
+msgstr ""
+"Que palavra-chave está associada com o nome de utilizador dado? Você pode "
+"deixar este campo vazio se você não está a usar autenticação por password."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "SMTP Hosts:"
+msgstr "Máquinas SMTP:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "Comma separated list of SMTP servers to use to send mail"
+msgstr ""
+"Lista de servidores SMTP, separados por vírgulas, a usar para enviar mail."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid ""
+"If you leave this blank, the system mailer will be used. Generally, this "
+"will work fine"
+msgstr ""
+"Se você deixar este campo vazio, o 'mailer' do sistema irá ser usado. De "
+"modo geral, isto irá funcionar bem."
+
+#~ msgid "Server name:"
+#~ msgstr "Nome do servidor:"
+
+#~ msgid "This is the servername of the Mahara site."
+#~ msgstr "Isto é o nome de servidor do site Mahara."
+
+#~ msgid ""
+#~ "It is up to you to ensure your chosen hostname resolves to this machine. "
+#~ "See /usr/share/doc/mahara/README.Debian for more information."
+#~ msgstr ""
+#~ "Cabe-lhe a si assegurar-se que o nome de máquina escolhido endereça a "
+#~ "esta máquina. Veja /usr/share/doc/mahara/README.Debian para mais "
+#~ "informação."
+
+#~ msgid ""
+#~ "Note that this is just the domain name, so for \"http://my.site.com\" you "
+#~ "only need to enter \"my.site.com\""
+#~ msgstr ""
+#~ "Note que isto é apenas o nome de domínio, então para  \"http://meu.site."
+#~ "com\" você apenas precisa de indicar \"meu.site.com\"."
+
+#~ msgid "Server redirects:"
+#~ msgstr "Redireccionamentos do servidor:"
+
+#~ msgid ""
+#~ "Comma separated list of domain names that the server should permanently "
+#~ "redirect to the server name."
+#~ msgstr ""
+#~ "Lista de nomes de domínio, separada por vírgulas, que o servidor deverá "
+#~ "permanentemente redireccionar para o nome de servidor."
--- mahara-1.0.4.orig/debian/po/templates.pot
+++ mahara-1.0.4/debian/po/templates.pot
@@ -0,0 +1,115 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: PACKAGE VERSION\n"
+"Report-Msgid-Bugs-To: mahara@packages.debian.org\n"
+"POT-Creation-Date: 2008-03-28 14:33+1300\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=CHARSET\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "Database type:"
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "What type of database should be used for the Mahara site"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid "Database host:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid ""
+"Which database host should be used for the Mahara site You can leave this "
+"blank to connect via UNIX sockets"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid "Database port:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid ""
+"Which database port should be used for the Mahara site You can leave this "
+"blank for the default"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Database name (not username):"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Which database should be used for the Mahara site"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Database username:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Which username should be used to connect to the Mahara database"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid "Database password:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid ""
+"Which password is associated with the given username You can leave this "
+"blank if you are not using password authentication."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "SMTP Hosts:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "Comma separated list of SMTP servers to use to send mail"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid ""
+"If you leave this blank, the system mailer will be used. Generally, this "
+"will work fine"
+msgstr ""
--- mahara-1.0.4.orig/debian/po/de.po
+++ mahara-1.0.4/debian/po/de.po
@@ -0,0 +1,149 @@
+# Mahara debconf questions
+# Copyright (C) 2007
+# This file is distributed under the same license as the mahara package.
+# Heinz Krettek <Heinz.Krettek@ewiesion.com>
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: \n"
+"Report-Msgid-Bugs-To: mahara@packages.debian.org\n"
+"POT-Creation-Date: 2008-03-28 14:33+1300\n"
+"PO-Revision-Date: 2007-12-03 16:53+0100\n"
+"Last-Translator: Heinz Krettek <Heinz.Krettek@ewiesion.com>\n"
+"Language-Team: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "Database type:"
+msgstr "Datenbanktyp:"
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "What type of database should be used for the Mahara site"
+msgstr "Welche Datenbank soll für die Mahara Site benutzt werden"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid "Database host:"
+msgstr "Datenbank Host:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid ""
+"Which database host should be used for the Mahara site You can leave this "
+"blank to connect via UNIX sockets"
+msgstr ""
+"Welcher Datenbank Host soll für die Mahara Site benutzt werden Wenn Sie das "
+"Feld leer lassen, wird die Verbindung über UNIX Sockets hergestellt"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid "Database port:"
+msgstr "Datenbank Port:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid ""
+"Which database port should be used for the Mahara site You can leave this "
+"blank for the default"
+msgstr ""
+"Welcher Datenbank Port soll für die Mahara Site benutzt werden Wenn Sie das "
+"Feld leer lassen, wird die Standardeinstellung benutzt"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Database name (not username):"
+msgstr "Datenbank Name (das ist nicht der Benutzername):"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Which database should be used for the Mahara site"
+msgstr "Welche Datenbank soll für die Mahara Site benutzt werden"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Database username:"
+msgstr "Datenbank Benutzername:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Which username should be used to connect to the Mahara database"
+msgstr ""
+"Welcher Benutzername soll für die Verbindung zur Mahara Datenbank benutzt "
+"werden"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid "Database password:"
+msgstr "Datenbank Passwort:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid ""
+"Which password is associated with the given username You can leave this "
+"blank if you are not using password authentication."
+msgstr ""
+"Das Passwort für den gewählten Benutzernamen. Wenn keine Passwort-"
+"Authentifizierung benutzt wird, können Sie das Feld leer lassen"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "SMTP Hosts:"
+msgstr "SMTP Server:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "Comma separated list of SMTP servers to use to send mail"
+msgstr ""
+"Geben Sie hier den vollen Namen von einem oder mehreren lokalen SMTP-Servern "
+"(getrennt durch Kommata) an, die Mahara für den E-Mail-Versand benutzen soll"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid ""
+"If you leave this blank, the system mailer will be used. Generally, this "
+"will work fine"
+msgstr ""
+"Wenn Sie dieses Feld frei lassen, wird Mahara die Standard-Methode von PHP "
+"zum Senden von E-Mails verwenden"
+
+#~ msgid "Server name:"
+#~ msgstr "Servername:"
+
+#~ msgid "This is the servername of the Mahara site."
+#~ msgstr "Der Servername der Mahara Site."
+
+#~ msgid ""
+#~ "Note that this is just the domain name, so for \"http://my.site.com\" you "
+#~ "only need to enter \"my.site.com\""
+#~ msgstr ""
+#~ "Beachten Sie, dass dies der Domainname ist, Sie müssen deshalb für "
+#~ "\"http://meine.seite.com\" nur \"meine.seite.com\" eingeben"
+
+#~ msgid "Server redirects:"
+#~ msgstr "Server Weiterleitungen:"
+
+#~ msgid ""
+#~ "Comma separated list of domain names that the server should permanently "
+#~ "redirect to the server name."
+#~ msgstr ""
+#~ "Geben Sie hier eine Liste (getrennt durch Kommata) der Domainnamen ein, "
+#~ "die der Server permanent weiterleiten soll."
--- mahara-1.0.4.orig/debian/po/vi.po
+++ mahara-1.0.4/debian/po/vi.po
@@ -0,0 +1,115 @@
+# Vietnamese translation for Mahara.
+# Copyright © 2008 Free Software Foundation, Inc.
+# Clytie Siddall <clytie@riverland.net.au>, 2008.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: mahara 1.0.3-1\n"
+"Report-Msgid-Bugs-To: mahara@packages.debian.org\n"
+"POT-Creation-Date: 2008-03-28 14:33+1300\n"
+"PO-Revision-Date: 2008-07-05 22:48+0930\n"
+"Last-Translator: Clytie Siddall <clytie@riverland.net.au>\n"
+"Language-Team: Vietnamese <vi-VN@googlegroups.com>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=1; plural=0;\n"
+"X-Generator: LocFactoryEditor 1.7b3\n"
+
+#: ../mahara.templates:1001
+#. Type: select
+#. Description
+msgid "Database type:"
+msgstr "Kiểu cơ sở dữ liệu :"
+
+#: ../mahara.templates:1001
+#. Type: select
+#. Description
+msgid "What type of database should be used for the Mahara site"
+msgstr "Đối với chỗ Web Mahara, có nên dùng cơ sở dữ liệu kiểu nào?"
+
+#: ../mahara.templates:2001
+#. Type: string
+#. Description
+msgid "Database host:"
+msgstr "Máy chủ cơ sở dữ liệu :"
+
+#: ../mahara.templates:2001
+#. Type: string
+#. Description
+msgid ""
+"Which database host should be used for the Mahara site You can leave this "
+"blank to connect via UNIX sockets"
+msgstr "Đối với chỗ Web Mahara, có nên dùng máy chủ cơ sở dữ liệu nào? Cũng có thể bỏ trống trường này để kết nối thông qua ổ cắm UNIX."
+
+#: ../mahara.templates:3001
+#. Type: string
+#. Description
+msgid "Database port:"
+msgstr "Cổng cơ sở dữ liệu :"
+
+#: ../mahara.templates:3001
+#. Type: string
+#. Description
+msgid ""
+"Which database port should be used for the Mahara site You can leave this "
+"blank for the default"
+msgstr "Đối với chỗ Web Mahara, có nên dùng cổng cơ sở dữ liệu nào? Bỏ trống thì dùng giá trị mặc định."
+
+#: ../mahara.templates:4001
+#. Type: string
+#. Description
+msgid "Database name (not username):"
+msgstr "Tên cơ sở dữ liệu (không phải tên người dùng):"
+
+#: ../mahara.templates:4001
+#. Type: string
+#. Description
+msgid "Which database should be used for the Mahara site"
+msgstr "Đối với chỗ Web Mahara, có nên dùng cơ sở dữ liệu gì?"
+
+#: ../mahara.templates:5001
+#. Type: string
+#. Description
+msgid "Database username:"
+msgstr "Tên người dùng cơ sở dữ liệu :"
+
+#: ../mahara.templates:5001
+#. Type: string
+#. Description
+msgid "Which username should be used to connect to the Mahara database"
+msgstr "Để kết nối tới cơ sở dữ liệu Mahara, có nên dùng tên người dùng gì?"
+
+#: ../mahara.templates:6001
+#. Type: string
+#. Description
+msgid "Database password:"
+msgstr "Mật khẩu cơ sở dữ liệu :"
+
+#: ../mahara.templates:6001
+#. Type: string
+#. Description
+msgid ""
+"Which password is associated with the given username You can leave this "
+"blank if you are not using password authentication."
+msgstr "Bạn đã nhập tên người dùng liên quan đến mật khẩu gì? Có thể bỏ trống nếu không dùng chức năng xác thực bằng mật khẩu."
+
+#: ../mahara.templates:7001
+#. Type: string
+#. Description
+msgid "SMTP Hosts:"
+msgstr "Máy chủ SMTP:"
+
+#: ../mahara.templates:7001
+#. Type: string
+#. Description
+msgid "Comma separated list of SMTP servers to use to send mail"
+msgstr "Danh sách định giới bằng dấu phẩy chứa các máy phục vụ SMTP được dùng để gửi thư tín."
+
+#: ../mahara.templates:7001
+#. Type: string
+#. Description
+msgid ""
+"If you leave this blank, the system mailer will be used. Generally, this "
+"will work fine"
+msgstr "Bỏ trống trường này thì dùng trình phục vụ thư tín của hệ thộng. Bình thường, nó cũng được."
--- mahara-1.0.4.orig/debian/po/fr.po
+++ mahara-1.0.4/debian/po/fr.po
@@ -0,0 +1,168 @@
+# Translation of mahara debconf templates to French
+# Copyright (C) 2008 Christian Perrier <bubulle@debian.org>
+# This file is distributed under the same license as the mahara package.
+#
+# Christian Perrier <bubulle@debian.org>, 2008.
+# Francois Marier <francois@catalyst.net.nz>, 2007.
+msgid ""
+msgstr ""
+"Project-Id-Version: \n"
+"Report-Msgid-Bugs-To: mahara@packages.debian.org\n"
+"POT-Creation-Date: 2008-03-28 14:33+1300\n"
+"PO-Revision-Date: 2008-03-20 09:12+0100\n"
+"Last-Translator: Christian Perrier <bubulle@debian.org>\n"
+"Language-Team: French <debian-l10n-french@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "Database type:"
+msgstr "Type de serveur de bases de données :"
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "What type of database should be used for the Mahara site"
+msgstr ""
+"Veuillez indiquer le type de serveur de bases de données à utiliser pour ce "
+"site Mahara."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid "Database host:"
+msgstr "Nom d'hôte du serveur de bases de données :"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid ""
+"Which database host should be used for the Mahara site You can leave this "
+"blank to connect via UNIX sockets"
+msgstr ""
+"Veuillez indiquer le nom d'hôte du serveur de bases de données à utiliser "
+"pour ce site Mahara. Ce champ peut être laissé vide pour utiliser les "
+"« sockets » UNIX."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid "Database port:"
+msgstr "Port d'écoute du serveur de bases de données :"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid ""
+"Which database port should be used for the Mahara site You can leave this "
+"blank for the default"
+msgstr ""
+"Veuillez indiquer le port d'écoute du serveur de bases de données à utiliser "
+"pour ce site Mahara. Ce champ peut être laissé vide pour utiliser le port "
+"par défaut."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Database name (not username):"
+msgstr "Nom de la base de données :"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Which database should be used for the Mahara site"
+msgstr ""
+"Veuillez indiquer le nom de la base de données à utiliser pour ce site "
+"Mahara. Ce nom n'est pas l'identifiant de connexion."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Database username:"
+msgstr "Identifiant de connexion à la base de données :"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Which username should be used to connect to the Mahara database"
+msgstr ""
+"Veuillez indiquer l'identifiant à utiliser pour les connexions à la base de "
+"données de ce site Mahara."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid "Database password:"
+msgstr "Mot de passe de connexion à la base de données :"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid ""
+"Which password is associated with the given username You can leave this "
+"blank if you are not using password authentication."
+msgstr ""
+"Veuillez indiquer le mot de passe de l'identifiant de connexion à la base de "
+"données. Ce champ peut être laissé vide si vous n'utilisez pas "
+"l'authentification par mot de passe."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "SMTP Hosts:"
+msgstr "Hôtes SMTP :"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "Comma separated list of SMTP servers to use to send mail"
+msgstr ""
+"Veuillez indiquer la liste des serveurs SMTP à utiliser pour envoyer des "
+"courriels. Les entrées multiples doivent être séparées par des virgules."
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid ""
+"If you leave this blank, the system mailer will be used. Generally, this "
+"will work fine"
+msgstr "Si ce champ est vide, le serveur de messagerie local sera utilisé. "
+
+#~ msgid "Server name:"
+#~ msgstr "Nom du serveur :"
+
+#~ msgid "This is the servername of the Mahara site."
+#~ msgstr ""
+#~ "Veuillez indiquer le nom qui sera utilisé par ce site Mahara (directive "
+#~ "« ServerName » d'Apache)."
+
+#~ msgid ""
+#~ "It is up to you to ensure your chosen hostname resolves to this machine. "
+#~ "See /usr/share/doc/mahara/README.Debian for more information."
+#~ msgstr ""
+#~ "Il est indispensable que ce nom puisse être résolut sur le réseau. "
+#~ "Veuillez lire le fichier /usr/share/doc/mahara/README.Debian pour plus "
+#~ "d'informations."
+
+#~ msgid ""
+#~ "Note that this is just the domain name, so for \"http://my.site.com\" you "
+#~ "only need to enter \"my.site.com\""
+#~ msgstr ""
+#~ "Veuillez noter que ce champ ne doit contenir que le nom de domaine, par "
+#~ "exemple « mon.site.com » pour un serveur qui sera joignable à l'adresse "
+#~ "« http://mon.site.com »."
+
+#~ msgid "Server redirects:"
+#~ msgstr "Redirection du serveur :"
+
+#~ msgid ""
+#~ "Comma separated list of domain names that the server should permanently "
+#~ "redirect to the server name."
+#~ msgstr ""
+#~ "Veuillez indiquer une liste des noms de domaine que le serveur doit "
+#~ "rediriger de façon permanente vers le nom de serveur indiqué. Les entrées "
+#~ "multiples doivent être séparées par des virgules."
--- mahara-1.0.4.orig/debian/po/ja.po
+++ mahara-1.0.4/debian/po/ja.po
@@ -0,0 +1,119 @@
+# Copyright (C) 2008 shinichi tsunoda <stsunoda@gmail.com>
+# This file is distributed under the same license as the mahara package.
+msgid ""
+msgstr ""
+"Project-Id-Version: mahara\n"
+"Report-Msgid-Bugs-To: mahara@packages.debian.org\n"
+"POT-Creation-Date: 2008-03-28 14:33+1300\n"
+"PO-Revision-Date: 2008-06-25 11:10+0900\n"
+"Last-Translator: shinichi tsunoda <stsunoda@gmail.com>\n"
+"Language-Team: japanese\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "Database type:"
+msgstr "データベースの種類:"
+
+#. Type: select
+#. Description
+#: ../mahara.templates:1001
+msgid "What type of database should be used for the Mahara site"
+msgstr "Mahara サイトで利用するデータベースの種類"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid "Database host:"
+msgstr "データベースのホスト名:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:2001
+msgid ""
+"Which database host should be used for the Mahara site You can leave this "
+"blank to connect via UNIX sockets"
+msgstr ""
+"Mahara サイトで利用するデータベースのホスト名。\n"
+"UNIX ソケット経由で接続する場合、ブランクでかまいません"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid "Database port:"
+msgstr "データベースのポート番号:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:3001
+msgid ""
+"Which database port should be used for the Mahara site You can leave this "
+"blank for the default"
+msgstr ""
+"Mahara サイト利用するデータベースのポート番号。\n"
+"デフォルトではブランクのままでかまいません"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Database name (not username):"
+msgstr "データベース名 (ユーザ名ではありません):"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:4001
+msgid "Which database should be used for the Mahara site"
+msgstr "Mahara サイトで利用するデータベース"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Database username:"
+msgstr "データベースのユーザ名:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:5001
+msgid "Which username should be used to connect to the Mahara database"
+msgstr "Mahara データベースに接続する際のユーザ名"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid "Database password:"
+msgstr "データベースのパスワード"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:6001
+msgid ""
+"Which password is associated with the given username You can leave this "
+"blank if you are not using password authentication."
+msgstr ""
+"指定したユーザ名に関連付けるパスワード。\n"
+"パスワード認証を使わない場合、ブランク。"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "SMTP Hosts:"
+msgstr "SMTP ホスト:"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid "Comma separated list of SMTP servers to use to send mail"
+msgstr "メール送信に使用する SMTP サーバをコンマ区切りで列挙"
+
+#. Type: string
+#. Description
+#: ../mahara.templates:7001
+msgid ""
+"If you leave this blank, the system mailer will be used. Generally, this "
+"will work fine"
+msgstr ""
+"この欄をブランクにしておくと、システムのデフォルトのメール\n"
+"送信プログラムが利用されます。一般的には、これでいいはずです"
--- mahara-1.0.4.orig/htdocs/.htaccess
+++ mahara-1.0.4/htdocs/.htaccess
@@ -16,3 +16,15 @@
     Order deny,allow
     deny from all
 </Files>
+
+# HTTP performance. This stuff tested in apache2 only.
+# Enable mod_expires, mod_headers and mod_deflate!
+
+<IfModule mod_deflate.c>
+    AddOutputFilterByType DEFLATE text/html text/css application/x-javascript
+</IfModule>
+
+<IfModule mod_headers.c>
+    Header unset ETag
+</IfModule>
+FileETag None
--- mahara-1.0.4.orig/htdocs/register.php
+++ mahara-1.0.4/htdocs/register.php
@@ -299,7 +299,7 @@
         $form->set_error('username', get_string('usernameinvalidform', 'auth.internal'));
     }
 
-    if (!$form->get_error('username') && record_exists('usr', 'username', $values['username'])) {
+    if (!$form->get_error('username') && record_exists_select('usr', 'LOWER(username) = ?', strtolower($values['username']))) {
         $form->set_error('username', get_string('usernamealreadytaken', 'auth.internal'));
     }
 
--- mahara-1.0.4.orig/htdocs/thumb.php
+++ mahara-1.0.4/htdocs/thumb.php
@@ -44,9 +44,24 @@
 
         if ($id) {
             if ($path = get_dataroot_image_path('artefact/internal/profileicons', $id, $size)) {
-                $type = get_mime_type($path);
-                if ($type) {
-                    header('Content-type: ' . $type);
+                $mimetype = get_mime_type($path);
+                if ($mimetype) {
+                    header('Content-type: ' . $mimetype);
+
+                    // We can't cache 'profileicon' for as long, because the 
+                    // user can change it at any time. But we can cache 
+                    // 'profileiconbyid' for quite a while, because it will 
+                    // never change
+                    if ($type == 'profileiconbyid') {
+                        $maxage = 604800; // 1 week
+                    }
+                    else {
+                        $maxage = 600; // 10 minutes
+                    }
+                    header('Expires: '. gmdate('D, d M Y H:i:s', time() + $maxage) .' GMT');
+                    header('Cache-Control: max-age=' . $maxage);
+                    header('Pragma: public');
+
                     readfile($path);
                     exit;
                 }
@@ -55,7 +70,13 @@
 
         // We couldn't find an image for this user. Attempt to use the 'no user 
         // photo' image for the current theme
-        //
+
+        // We can cache such images
+        $maxage = 604800;
+        header('Expires: '. gmdate('D, d M Y H:i:s', time() + $maxage) .' GMT');
+        header('Cache-Control: max-age=' . $maxage);
+        header('Pragma: public');
+
         // NOTE: the institutional admin branch allows the theme to be locked 
         // down. This means that $USER->get('theme') should be used here 
         // instead, when that branch is merged. And don't forget to change it 
@@ -98,6 +119,10 @@
             $basepath = 'artefact/' . $ap . '/' . $basepath;
         }
         header('Content-type: image/png');
+        $maxage = 604800;
+        header('Expires: '. gmdate('D, d M Y H:i:s', time() + $maxage) .' GMT');
+        header('Cache-Control: max-age=' . $maxage);
+        header('Pragma: public');
         $path = get_config('docroot') . $basepath . '/thumb.png';
         if (is_readable($path)) {
             readfile($path);
--- mahara-1.0.4.orig/htdocs/init.php
+++ mahara-1.0.4/htdocs/init.php
@@ -38,6 +38,11 @@
 }
 set_include_path($CFG->libroot . PATH_SEPARATOR . $CFG->libroot . 'pear/' . PATH_SEPARATOR . get_include_path());
 
+// Ensure that, by default, the response is not cached
+header('Cache-Control: private, must-revalidate, pre-check=0, post-check=0, max-age=0');
+header('Expires: '. gmdate('D, d M Y H:i:s', 507686400) .' GMT');
+header('Pragma: no-cache');
+
 // Set up error handling
 require('errors.php');
 
--- mahara-1.0.4.orig/htdocs/theme/.htaccess
+++ mahara-1.0.4/htdocs/theme/.htaccess
@@ -0,0 +1,4 @@
+<IfModule mod_expires.c>
+    ExpiresActive On
+    ExpiresDefault "access plus 3 days"
+</IfModule>
--- mahara-1.0.4.orig/htdocs/theme/default/templates/header.tpl
+++ mahara-1.0.4/htdocs/theme/default/templates/header.tpl
@@ -31,6 +31,7 @@
     <link rel="shortcut icon" href="{$WWWROOT}favicon.ico" type="image/vnd.microsoft.icon">
 </head>
 <body>
+{if $USERMASQUERADING}<div id="masquerading-message"><img src="{theme_path location='images/icon_problem.gif'}" alt="">{$masqueradedetails} {$becomeyouagain}</div>{/if}
 <div id="container">
 	<div id="loading_box" class="hidden"></div>
 	<div id="topwrapper">
--- mahara-1.0.4.orig/htdocs/theme/default/templates/change_password.tpl
+++ mahara-1.0.4/htdocs/theme/default/templates/change_password.tpl
@@ -5,7 +5,9 @@
 	<h2>{str tag="changepassword"}</h2>
 			
 	<p>{str tag="changepasswordinfo"}</p>
-			
+
+    {if $loginasoverridepasswordchange}<div class="message">{$loginasoverridepasswordchange}</div>{/if}
+
 	{$change_password_form}
 	</div>
 </div>
--- mahara-1.0.4.orig/htdocs/theme/default/templates/sideblocks/profile.tpl
+++ mahara-1.0.4/htdocs/theme/default/templates/sideblocks/profile.tpl
@@ -1,5 +1,5 @@
     <h3><a href="{$WWWROOT}user/view.php?id={$data.id}">{$data.id|display_name|escape}</a></h3>
-    <div class="fr"><a href="{$WWWROOT}user/view.php?id={$data.id}"><div class="center" style="width: 50px; height: 50px;"><img src="{$WWWROOT}thumb.php?type=profileicon&amp;maxwidth=50&amp;maxheight=50&amp;id={$data.id}" alt=""></div></a></div>
+    <div class="fr"><a href="{$WWWROOT}user/view.php?id={$data.id}"><div class="center" style="width: 50px; height: 50px;"><img src="{$WWWROOT}thumb.php?type=profileiconbyid&amp;maxwidth=50&amp;maxheight=50&amp;id={$data.profileicon}" alt=""></div></a></div>
     <ul class="sidebar-ul-title">
         {if $data.unreadnotifications}
         <li>
@@ -65,10 +65,6 @@
     <a href="{$WWWROOT}?logout" id="btn-logout">{str tag="logout"}</a>
     <a href="{$WWWROOT}account/" id="btn-settings">{str tag="settings"}</a>
     </div>
-    {if $data.realuser}
-    <div id="changeuser">
-    <a href="{$WWWROOT}admin/users/changeuser.php?restore=1">{str tag=becomeadminagain section=admin args=$data.realuser}</a>
-    </div>
-    {/if}
+    {if $USERMASQUERADING}<div id="changeuser">{$becomeyouagain}</div>{/if}
     {* This makes sure the profile block still appears to contain the profile image, even if the profile block is pretty much empty otherwise *}
     <div class="cb"></div>
--- mahara-1.0.4.orig/htdocs/theme/default/templates/user/view.tpl
+++ mahara-1.0.4/htdocs/theme/default/templates/user/view.tpl
@@ -13,8 +13,11 @@
                 {$introduction}
                 <div class="fr user-icon">
                     <img src="{$WWWROOT}thumb.php?type=profileicon&amp;maxwidth=100&amp;maxheight=100&amp;id={$USERID}" alt="">
+                    <div>
+                    {if !empty($loginas)}
+                      <div class="center"><strong><a href="{$WWWROOT}admin/users/changeuser.php?id={$USERID}">{$loginas}</a></strong></div>
+                    {/if}
                     {if $canmessage}
-                        <br>
                         <a href="{$WWWROOT}user/sendmessage.php?id={$USERID}&amp;returnto=view" id="btn-sendmessage">{str tag='sendmessage' section='group'}</a>
                     {/if}
                     {if $relationship == 'existingfriend'}
@@ -32,6 +35,7 @@
                     {if $addform}
                         {$addform}
                     {/if}
+                    </div>
                 </div>
 				<ul id="user-info">
                 {foreach from=$USERFIELDS name=userfields key=key item=item}
--- mahara-1.0.4.orig/htdocs/theme/default/templates/view/index.tpl
+++ mahara-1.0.4/htdocs/theme/default/templates/view/index.tpl
@@ -13,7 +13,6 @@
     <td>
     {if !$view.submittedto}
         <a href="{$WWWROOT}view/delete.php?id={$view.id}" class="fr" id="btn-deletethisview">{str tag="deletethisview" section="view"}</a>
-        <a href="{$WWWROOT}view/blocks.php?id={$view.id}" class="fr" id="btn-editthisview">{str tag ="editthisview" section="view"}</a>
     {/if}
     <h3><a href="{$WWWROOT}view/view.php?id={$view.id}">{$view.title|escape}</a></h3>
     <div class="viewitem">
@@ -26,8 +25,9 @@
     {/if}
     </div>
     <div class="viewitem">
+        {if !$view.submittedto}<a href="{$WWWROOT}view/blocks.php?id={$view.id}" id="editthisview">{str tag ="editthisview" section="view"}</a><br>{/if}
     {if $view.artefacts}
-        <strong>{str tag="artefacts" section="view"}:</strong><br />
+        {str tag="artefacts" section="view"}:
         {foreach from=$view.artefacts item=artefact name=artefacts}<a href="{$WWWROOT}view/artefact.php?artefact={$artefact.id}&amp;view={$view.id}" id="link-artefacts">{$artefact.title|escape}</a>{if !$smarty.foreach.artefacts.last}, {/if}{/foreach}
     {/if}
     </div>
--- mahara-1.0.4.orig/htdocs/theme/default/static/style/print.css
+++ mahara-1.0.4/htdocs/theme/default/static/style/print.css
@@ -754,8 +754,7 @@
 	font-size: 12pt !important;
 	font-weight: bold;
 }
-#btn-edit,
-#btn-editthisview {
+#btn-edit {
 	padding-left: 12px;
 }
 #btn-reply {
@@ -1634,4 +1633,4 @@
 /* FOOTER */
 #footerwrap {
     display: none;
-}
\ No newline at end of file
+}
--- mahara-1.0.4.orig/htdocs/theme/default/static/style/style.css
+++ mahara-1.0.4/htdocs/theme/default/static/style/style.css
@@ -39,6 +39,17 @@
 	padding: 5px 10px;
 }
 
+#masquerading-message {
+    background-color: #f99;
+    font-weight: bold;
+    padding: .5em;
+}
+#masquerading-message img {
+    float: left;
+    margin-top: -1px;
+    padding-right: .5em;
+}
+
 .hidden {
     display: none;
 }
@@ -1386,18 +1397,19 @@
 	color: #3986c3 !important;
 }
 #myviewstable .viewitem a#editviewdetails,
+#myviewstable .viewitem a#editthisview,
 #myviewstable .viewitem a#editviewaccess {
 	color: #7f9d16 !important;
 }
 #editviewdetails,
+#editthisview,
 #editviewaccess {
 	padding-left: 15px;
 	background: url(../images/edit.gif) no-repeat left 2px;
 	font-size: 12px !important;
 	font-weight: bold;
 }
-#btn-edit,
-#btn-editthisview {
+#btn-edit {
 	padding-left: 12px;
 	font-size: 11px;
 	background: url(../images/icon-edit.gif) no-repeat left 4px;
@@ -1407,13 +1419,11 @@
 	font-size: 11px;
 	background: url(../images/icon-reply.gif) no-repeat left 4px;
 }
-#btn-editthisview:hover {
-	text-decoration: none;
-}
 #btn-deletethisview {
 	margin-left: 10px;
 	padding-left: 12px;
-	font-size: 11px;
+	font-size: 13px;
+    font-weight: bold;
 	background: url(../images/icon-delete.gif) no-repeat left 6px;
 }
 #btn-deletethisview:hover {
--- mahara-1.0.4.orig/htdocs/admin/users/changeuser.php
+++ mahara-1.0.4/htdocs/admin/users/changeuser.php
@@ -25,6 +25,7 @@
  */
 
 define('INTERNAL', 1);
+define('NOCHECKPASSWORDCHANGE', 1);
 require(dirname(dirname(dirname(__FILE__))) . '/init.php');
 
 if (param_integer('login_submitted', 0)) {
--- mahara-1.0.4.orig/htdocs/admin/users/admins.php
+++ mahara-1.0.4/htdocs/admin/users/admins.php
@@ -39,7 +39,7 @@
 
 // Get users who are currently administrators
 // @todo later, exclude the user with uid 1
-$adminusers = get_column('usr', 'id', 'admin', 1);
+$adminusers = get_column('usr', 'id', 'admin', 1, 'deleted', 0);
 
 $form = array(
     'name' => 'adminusers',
--- mahara-1.0.4.orig/htdocs/admin/users/institutionadmins.php
+++ mahara-1.0.4/htdocs/admin/users/institutionadmins.php
@@ -44,7 +44,12 @@
 }
 
 // Get users who are currently admins
-$adminusers = get_column('usr_institution', 'usr', 'admin', 1, 'institution', $institution);
+$adminusers = get_column_sql('SELECT ui.usr
+    FROM {usr_institution} ui
+    LEFT JOIN  {usr} u ON ui.usr = u.id
+    WHERE ui.admin = 1
+    AND ui.institution = ?
+    AND u.deleted = 0', array($institution));
 
 $form = array(
     'name' => 'adminusers',
--- mahara-1.0.4.orig/htdocs/admin/users/institutionstaff.php
+++ mahara-1.0.4/htdocs/admin/users/institutionstaff.php
@@ -44,7 +44,12 @@
 }
 
 // Get users who are currently staff
-$staffusers = get_column('usr_institution', 'usr', 'staff', 1, 'institution', $institution);
+$staffusers = get_column_sql('SELECT ui.usr
+    FROM {usr_institution} ui
+    LEFT JOIN  {usr} u ON ui.usr = u.id
+    WHERE ui.staff = 1
+    AND ui.institution = ?
+    AND u.deleted = 0', array($institution));
 
 $form = array(
     'name' => 'staffusers',
--- mahara-1.0.4.orig/htdocs/admin/users/staff.php
+++ mahara-1.0.4/htdocs/admin/users/staff.php
@@ -38,7 +38,7 @@
 $smarty = smarty();
 
 // Get users who are currently staff
-$staffusers = get_column('usr', 'id', 'staff', 1);
+$staffusers = get_column('usr', 'id', 'staff', 1, 'deleted', 0);
 
 $form = array(
     'name' => 'staffusers',
--- mahara-1.0.4.orig/htdocs/admin/users/uploadcsv.php
+++ mahara-1.0.4/htdocs/admin/users/uploadcsv.php
@@ -233,7 +233,7 @@
                 $form->set_error('file', get_string('uploadcsverrorinvalidusername', 'admin', $i));
                 return;
             }
-            if (record_exists('usr', 'username', $username)) {
+            if (record_exists_select('usr', 'LOWER(username) = ?', strtolower($username))) {
                 $form->set_error('file', get_string('uploadcsverroruseralreadyexists', 'admin', $i, $username));
                 return;
             }
@@ -389,12 +389,22 @@
 }
 $fields .= "</ul>\n";
 
+if ($USER->get('admin')) {
+    $uploadcsvpagedescription = get_string('uploadcsvpagedescription2', 'admin',
+        get_config('wwwroot') . 'admin/extensions/pluginconfig.php?plugintype=artefact&pluginname=internal&type=profile',
+        get_config('wwwroot') . 'admin/users/institutions.php',
+        $fields
+    );
+}
+else {
+    $uploadcsvpagedescription = get_string('uploadcsvpagedescription2institutionaladmin', 'admin',
+        get_config('wwwroot') . 'admin/users/institutions.php',
+        $fields
+    );
+}
+
 $smarty = smarty();
-$smarty->assign('uploadcsvpagedescription', get_string('uploadcsvpagedescription', 'admin',
-    get_config('wwwroot') . 'admin/extensions/pluginconfig.php?plugintype=artefact&pluginname=internal&type=profile',
-    get_config('wwwroot') . 'admin/users/institutions.php',
-    $fields
-));
+$smarty->assign('uploadcsvpagedescription', $uploadcsvpagedescription);
 $smarty->assign('uploadcsvform', pieform($form));
 $smarty->display('admin/users/uploadcsv.tpl');
 
--- mahara-1.0.4.orig/htdocs/admin/users/add.php
+++ mahara-1.0.4/htdocs/admin/users/add.php
@@ -161,7 +161,7 @@
         $form->set_error('username', get_string('addusererrorinvalidusername', 'admin'));
         return;
     }
-    if (record_exists('usr', 'username', $username)) {
+    if (!$form->get_error('username') && record_exists_select('usr', 'LOWER(username) = ?', strtolower($username))) {
         $form->set_error('username', get_string('usernamealreadytaken', 'auth.internal'));
         return;
     }
--- mahara-1.0.4.orig/htdocs/admin/users/institutions.php
+++ mahara-1.0.4/htdocs/admin/users/institutions.php
@@ -300,17 +300,33 @@
     }
     $institutions = get_records_sql_assoc('
         SELECT
-            i.name, i.displayname, i.maxuseraccounts, 
-            COUNT(ui.usr) AS members, SUM(ui.staff) AS staff, SUM(ui.admin) AS admins
-        FROM {institution} i
-        LEFT OUTER JOIN {usr_institution} ui ON (ui.institution = i.name)
-        LEFT OUTER JOIN {usr} u ON (u.id = ui.usr) 
-        WHERE (u.deleted = 0 OR u.id IS NULL) ' . $where . '
-        GROUP BY
-            i.name, i.displayname, i.maxuseraccounts
-        ORDER BY i.name = \'mahara\', i.displayname', array());
+            ii.name,
+            ii.displayname,
+            ii.maxuseraccounts,
+            COALESCE(a.members, 0) AS members,
+            COALESCE(a.staff, 0) AS staff,
+            COALESCE(a.admins, 0) AS admins
+        FROM
+            {institution} ii
+            LEFT JOIN
+                (SELECT
+                    i.name, i.displayname, i.maxuseraccounts,
+                    COUNT(ui.usr) AS members, SUM(ui.staff) AS staff, SUM(ui.admin) AS admins
+                FROM
+                    {institution} i
+                    LEFT OUTER JOIN {usr_institution} ui ON (ui.institution = i.name)
+                    LEFT OUTER JOIN {usr} u ON (u.id = ui.usr)
+                WHERE
+                    (u.deleted = 0 OR u.id IS NULL)' . $where . '
+                GROUP BY
+                    i.name, i.displayname, i.maxuseraccounts
+                ORDER BY
+                    i.name = \'mahara\', i.displayname
+             ) a ON (a.name = ii.name)', array());
     if (isset($defaultinstmembers)) {
         $institutions['mahara']->members = $defaultinstmembers;
+        $institutions['mahara']->staff   = '';
+        $institutions['mahara']->admins  = '';
     }
     $smarty->assign('institutions', $institutions);
 }
--- mahara-1.0.4.orig/htdocs/group/view.json.php
+++ mahara-1.0.4/htdocs/group/view.json.php
@@ -155,7 +155,7 @@
                  try {
                      switch ($v) {
                          case 'remove':
-                             if ($id == $group->id) {
+                             if ($user == $group->group) {
                                  json_reply(true, get_string('memberchangefailed', 'group'));
                              }
                              else {
--- mahara-1.0.4.orig/htdocs/group/edit.php
+++ mahara-1.0.4/htdocs/group/edit.php
@@ -89,7 +89,7 @@
     global $USER;
     global $SESSION;
 
-    $cid = get_field('group', 'id', 'owner', $USER->get('id'), 'name', $values['name']);
+    $cid = get_field('group', 'id', 'name', $values['name']);
 
     if ($cid && $cid != $values['id']) {
         $form->set_error('name', get_string('groupalreadyexists', 'group'));
--- mahara-1.0.4.orig/htdocs/group/leave.php
+++ mahara-1.0.4/htdocs/group/leave.php
@@ -50,7 +50,7 @@
 }
 
 $views = count_records_sql(
-    'SELECT COUNT(v.*)
+    'SELECT COUNT(*)
     FROM {view} v
     INNER JOIN {view_access_group} a
     ON a.group = ?
--- mahara-1.0.4.orig/htdocs/group/delete.php
+++ mahara-1.0.4/htdocs/group/delete.php
@@ -40,7 +40,7 @@
 define('TITLE', get_string('deletespecifiedgroup', 'group', $group->name));
 
 $views = count_records_sql(
-    'SELECT COUNT(a.*)
+    'SELECT COUNT(*)
     FROM {view_access_group} a
     WHERE a.group = ?',
     array($groupid)
--- mahara-1.0.4.orig/htdocs/auth/lib.php
+++ mahara-1.0.4/htdocs/auth/lib.php
@@ -755,7 +755,17 @@
  */
 function auth_check_password_change() {
     global $USER;
-    if (!$USER->get('passwordchange')) {
+    if (
+        !$USER->get('passwordchange')                                // User doesn't need to change their password
+        || ($USER->get('parentuser') && $USER->get('loginanyway'))   // User is masquerading and wants to log in anyway
+        || defined('NOCHECKPASSWORDCHANGE')                          // The page wants to skip this hassle
+        ) {
+        return;
+    }
+
+    // Check if the user wants to log in anyway
+    if ($USER->get('passwordchange') && $USER->get('parentuser') && isset($_GET['loginanyway'])) {
+        $USER->loginanyway = true;
         return;
     }
 
@@ -810,6 +820,11 @@
 
         $smarty = smarty();
         $smarty->assign('change_password_form', pieform($form));
+        if ($USER->get('parentuser')) {
+            $smarty->assign('loginasoverridepasswordchange',
+                get_string('loginasoverridepasswordchange', 'admin',
+                    '<a href="' . get_config('wwwroot') . '?loginanyway">', '</a>'));
+        }
         $smarty->display('change_password.tpl');
         exit;
     }
@@ -1340,6 +1355,19 @@
 
 }
 
+/**
+ * Clears out old session files
+ *
+ * This should be run once every now and then (once a day is good), to clean 
+ * out session files of users whose sessions have timed out.
+ */
+function auth_remove_old_session_files() {
+    // Note: read the manpage for find and xargs to understand what is going on 
+    // here. In particular, -mtime +1 means files older than about two days 
+    // will be removed
+    exec('find ' . escapeshellarg(get_config('dataroot') . 'sessions') . ' -type f -mtime +1 | xargs -n 1000 -r rm');
+}
+
 function auth_generate_login_form() {
     if (!get_config('installed')) {
         return;
--- mahara-1.0.4.orig/htdocs/auth/user.php
+++ mahara-1.0.4/htdocs/auth/user.php
@@ -86,6 +86,7 @@
             'admininstitutions' => array(),
             'staffinstitutions' => array(),
             'parentuser'       => null,
+            'loginanyway'       => false,
             'sesskey'          => ''
         );
         $this->attributes = array();
@@ -516,6 +517,10 @@
         $this->staffinstitutions  = $staffinstitutions;
     }
 
+    public function can_view_artefact($a) {
+        return $this->get('admin') || $this->get('id') == $a->get('owner');
+    }
+
 }
 
 
@@ -665,7 +670,7 @@
      */
     public function get($key) {
         if (!array_key_exists($key, $this->defaults)) {
-            throw new InvalidArgumentException($key);
+            throw new InvalidArgumentException("Invalid key: $key");
         }
         if (null !== ($value = $this->SESSION->get("user/$key"))) {
             return $value;
@@ -728,6 +733,7 @@
 
         $this->reloadLiveUser($olduser->id);
         $this->set('parentuser', null);
+        $this->set('loginanyway', false);
 
         return $id;
     }
--- mahara-1.0.4.orig/htdocs/auth/internal/lib.php
+++ mahara-1.0.4/htdocs/auth/internal/lib.php
@@ -114,10 +114,9 @@
     }
 
     /**
-     * For internal authentication, usernames can only contain alphanumeric
-     * characters, and the symbols underscore, full stop and the @ symbol.
-     *
-     * The username must also be between three and thirty characters in length.
+     * Internal authentication allows most standard us-keyboard-typable characters
+     * for username, as long as the username is between three and thirty 
+     * characters in length.
      *
      * This method is NOT part of the authentication API. Other authentication
      * methods never have to do anything regarding usernames being validated on
@@ -127,7 +126,7 @@
      * @return bool            Whether the username is valid
      */
     public function is_username_valid($username) {
-        return preg_match('/^[a-zA-Z0-9\._@]{3,30}$/', $username);
+        return preg_match('/^[a-zA-Z0-9!@#$%^&*()\-_=+\[{\]}\\|;:\'",<\.>\/?`]{3,30}$/', $username);
     }
 
     /*
--- mahara-1.0.4.orig/htdocs/blocktype/externalfeed/db/install.xml
+++ mahara-1.0.4/htdocs/blocktype/externalfeed/db/install.xml
@@ -16,6 +16,7 @@
                 <FIELD NAME="description" TYPE="text" NOTNULL="false" />
                 <FIELD NAME="content" TYPE="text" NOTNULL="false" />
                 <FIELD NAME="lastupdate" TYPE="datetime" NOTNULL="false" />
+                <FIELD NAME="image" TYPE="text" NOTNULL="false" />
             </FIELDS>
             <KEYS>
                 <KEY NAME="primary" TYPE="primary" FIELDS="id" />
--- mahara-1.0.4.orig/htdocs/artefact/lib.php
+++ mahara-1.0.4/htdocs/artefact/lib.php
@@ -245,6 +245,18 @@
         return get_record('artefact','id',$this->parent);
     }
 
+    /**
+     * Returns how much quota this artefact has used.
+     *
+     * It should try to not instantiate the artefact, because it is normally 
+     * called as part of an expensive cron job
+     *
+     * @return int Size in bytes that the artefact is taking up in quota
+     */
+    public static function get_quota_usage($artefact) {
+        return 0;
+    }
+
     public function get($field) {
         if (!property_exists($this, $field)) {
             throw new InvalidArgumentException("Field $field wasn't found in class " . get_class($this));
--- mahara-1.0.4.orig/htdocs/artefact/file/index.php
+++ mahara-1.0.4/htdocs/artefact/file/index.php
@@ -39,22 +39,24 @@
 if ($folder_id) {
     $folder_list = array();
 
-    $current_folder = get_record('artefact', 'id', $folder_id);
+    $current_folder = artefact_instance_from_id($folder_id);
 
-    if ($current_folder->artefacttype == 'folder') {
-        $folder_list[] = array(
-            'id'   => $current_folder->id,
-            'name' => $current_folder->title,
-        );
-    }
-
-    while ($current_folder->parent) {
-        $current_folder = get_record('artefact', 'id', $current_folder->parent);
-
-        $folder_list[] = array(
-            'id'   => $current_folder->id,
-            'name' => $current_folder->title,
-        );
+    if ($USER->can_view_artefact($current_folder)) {
+        if ($current_folder->get('artefacttype') == 'folder') {
+            $folder_list[] = array(
+                'id'   => $current_folder->get('id'),
+                'name' => $current_folder->get('title'),
+            );
+        }
+
+        while ($p = $current_folder->get('parent')) {
+            $current_folder = artefact_instance_from_id($p);
+
+            $folder_list[] = array(
+                'id'   => $current_folder->get('id'),
+                'name' => $current_folder->get('title'),
+            );
+        }
     }
 
     $enc_folders = json_encode(array_reverse($folder_list));
--- mahara-1.0.4.orig/htdocs/artefact/file/lib.php
+++ mahara-1.0.4/htdocs/artefact/file/lib.php
@@ -728,6 +728,10 @@
         }
         return false;
     }
+
+    public static function get_quota_usage($artefact) {
+        return get_field('artefact_file_files', 'size', 'artefact', $artefact);
+    }
 }
 
 class ArtefactTypeFolder extends ArtefactTypeFileBase {
--- mahara-1.0.4.orig/htdocs/artefact/file/js/.htaccess
+++ mahara-1.0.4/htdocs/artefact/file/js/.htaccess
@@ -0,0 +1,4 @@
+<IfModule mod_expires.c>
+    ExpiresActive On
+    ExpiresDefault "access plus 1 week"
+</IfModule>
--- mahara-1.0.4.orig/htdocs/artefact/internal/index.php
+++ mahara-1.0.4/htdocs/artefact/internal/index.php
@@ -167,7 +167,7 @@
     $return = array();
     $return["{$section}description"] = array(
         'type'  => 'html',
-        'labelhtml' => ($section == 'about') ? '<div id="profileicon"><a href="' . get_config('wwwroot') . 'artefact/internal/profileicons.php"><img src="' . get_config('wwwroot') . 'thumb.php?type=profileicon&maxsize=100&id=' . $USER->get('id') . '" alt=""></a></div>' : '',
+        'labelhtml' => ($section == 'about') ? '<div id="profileicon"><a href="' . get_config('wwwroot') . 'artefact/internal/profileicons.php"><img src="' . get_config('wwwroot') . 'thumb.php?type=profileiconbyid&maxsize=100&id=' . intval($USER->get('profileicon')) . '" alt=""></a></div>' : '',
         'value' => get_string("{$section}description", 'artefact.internal')
     );
     foreach ($desiredfields as $field) {
--- mahara-1.0.4.orig/htdocs/artefact/internal/lib.php
+++ mahara-1.0.4/htdocs/artefact/internal/lib.php
@@ -552,6 +552,11 @@
     public function in_view_list() {
         return true;
     }
+
+    public static function get_quota_usage($artefact) {
+        return filesize(get_config('dataroot') . 'artefact/internal/profileicons/originals/'
+            . ($artefact % 256) . '/' . $artefact);
+    }
 }
 
 
--- mahara-1.0.4.orig/htdocs/artefact/internal/js/.htaccess
+++ mahara-1.0.4/htdocs/artefact/internal/js/.htaccess
@@ -0,0 +1,4 @@
+<IfModule mod_expires.c>
+    ExpiresActive On
+    ExpiresDefault "access plus 1 week"
+</IfModule>
--- mahara-1.0.4.orig/htdocs/interaction/delete.php
+++ mahara-1.0.4/htdocs/interaction/delete.php
@@ -37,7 +37,7 @@
 
 $instance = interaction_instance_from_id($id);
 
-if (!$group = get_record('group', 'id', $id, 'deleted', 0)) {
+if (!$group = get_record('group', 'id', $instance->get('group'), 'deleted', 0)) {
     throw new GroupNotFoundException(get_string('groupnotfound', 'group', $id));
 }
 
--- mahara-1.0.4.orig/htdocs/interaction/forum/theme/default/view.tpl
+++ mahara-1.0.4/htdocs/interaction/forum/theme/default/view.tpl
@@ -8,7 +8,7 @@
 <div id="viewforum">
 <table id="forumdescription">
 <tr>
-	<td>{$forum->description}</td>
+	<td>{$forum->description|clean_text}</td>
 {if $admin}
 	<td align="right" class="nowrap">
 	<a href="{$WWWROOT}interaction/edit.php?id={$forum->id|escape}" class="btn-editdk">{str tag="edittitle" section="interaction.forum"}</a></td>
--- mahara-1.0.4.orig/htdocs/interaction/forum/theme/default/simplepost.tpl
+++ mahara-1.0.4/htdocs/interaction/forum/theme/default/simplepost.tpl
@@ -19,6 +19,6 @@
 {$post->poster|display_name|escape}</a></h5>
 	<div><img src="{$WWWROOT}thumb.php?type=profileicon&amp;maxsize=100&amp;id={$post->poster}" alt=""></div>
 	<h5>{$post->postcount}</h5></td>
-	<td>{$post->body}</td>
+	<td>{$post->body|clean_text}</td>
 </tr>
 </table>
\ No newline at end of file
--- mahara-1.0.4.orig/htdocs/lib/version.php
+++ mahara-1.0.4/htdocs/lib/version.php
@@ -27,8 +27,8 @@
 defined('INTERNAL') || die();
 
 $config = new StdClass;
-$config->version = 2008040202;
-$config->release = '1.0.2';
+$config->version = 2008040203;
+$config->release = '1.0.4';
 $config->minupgradefrom = 2007080700;
 $config->minupgraderelease = '0.8.0 (release tag 0.8.0_RELEASE)';
 $config->disablelogin = true;
--- mahara-1.0.4.orig/htdocs/lib/errors.php
+++ mahara-1.0.4/htdocs/lib/errors.php
@@ -765,7 +765,7 @@
     public function render_exception() {
         global $USER;
         if (defined('PUBLIC') && !$USER->is_logged_in()) {
-            $loginurl = $_SERVER['REQUEST_URI'];
+            $loginurl = substr($_SERVER['REQUEST_URI'], strlen(get_mahara_install_subdirectory()) - 1);
             $loginurl .= (false === strpos($loginurl, '?')) ? '?' : '&';
             $loginurl .= 'login';
             redirect($loginurl);
--- mahara-1.0.4.orig/htdocs/lib/upgrade.php
+++ mahara-1.0.4/htdocs/lib/upgrade.php
@@ -536,6 +536,15 @@
     set_config('searchplugin', 'internal');
 
     set_config('lang', 'en.utf8');
+
+    // PostgreSQL supports indexes over functions of columns, MySQL does not. 
+    // So we can improve the index on the username field of the usr table for 
+    // Postgres
+    if (is_postgres()) {
+        execute_sql('DROP INDEX {usr_use_uix}');
+        execute_sql('CREATE UNIQUE INDEX {usr_use_uix} ON {usr}(LOWER(username))');
+    }
+
     return $status;
 }
 
@@ -679,6 +688,8 @@
         'auth_clean_partial_registrations'       => array('5', '0', '*', '*', '*'),
         'auth_handle_account_expiries'           => array('5', '10', '*', '*', '*'),
         'activity_process_queue'                 => array('*/5', '*', '*', '*', '*'),
+        'auth_remove_old_session_files'          => array('30', '20', '*', '*', '*'),
+        'recalculate_quota'                      => array('15', '2', '*', '*', '*'),
     );
     foreach ($cronjobs as $callfunction => $times) {
         $cron = new StdClass;
--- mahara-1.0.4.orig/htdocs/lib/mahara.php
+++ mahara-1.0.4/htdocs/lib/mahara.php
@@ -59,8 +59,11 @@
     default:
         throw new ConfigSanityException(get_string('unknowndbtype', 'error'));
     }
+    if (!extension_loaded('xml')) {
+        throw new ConfigSanityException(get_string('xmlextensionnotloaded', 'error', 'xml'));
+    }
     if (!extension_loaded('libxml')) {
-        throw new ConfigSanityException(get_string('libxmlextensionnotloaded', 'error'));
+        throw new ConfigSanityException(get_string('xmlextensionnotloaded', 'error', 'libxml'));
     }
     if (!extension_loaded('gd')) {
         throw new ConfigSanityException(get_string('gdextensionnotloaded', 'error'));
@@ -302,11 +305,11 @@
     }
 
     // Define the locations of language strings for this section
-    $docroot = get_config('docroot');
-    $locations = array();
+    $langstringroot = get_language_root();
+    $langdirectory  = ''; // The directory in which the language file for this string should ideally reside, if the language has implemented it
     
     if (false === strpos($section, '.')) {
-        $locations[] = $docroot . 'lang/';
+        $langdirectory = 'lang/';
     }
     else {
         $extras = plugin_types(); // more later..
@@ -316,24 +319,21 @@
                 if ($tocheck == 'blocktype' && 
                     strpos($pluginname, '/') !== false) { // it belongs to an artefact plugin
                     $bits = explode('/', $pluginname);
-                    $locations[] = $docroot . 'artefact/' . $bits[0] . '/blocktype/' . $bits[1] . '/lang/';
+                    $langdirectory = 'artefact/' . $bits[0] . '/blocktype/' . $bits[1] . '/lang/';
                     $section = 'blocktype.' . $bits[1];
                 }
                 else {
-                    $locations[] = $docroot . $tocheck . '/' . $pluginname . '/lang/';
+                    $langdirectory = $tocheck . '/' . $pluginname . '/lang/';
                 }
             }
         }
     }
 
     // First check all the normal locations for the string in the current language
-    foreach ($locations as $location) {
-        //if local directory not found, or particular string does not exist in local direcotry
-        $langfile = $location . $lang . '/' . $section . '.php';
-        if (is_readable($langfile)) {
-            if ($result = get_string_from_file($identifier, $langfile)) {
-                return $replacefunc($result, $variables);
-            }
+    $langfile = $langstringroot . $langdirectory . $lang . '/' . $section . '.php';
+    if (is_readable($langfile)) {
+        if ($result = get_string_from_file($identifier, $langfile)) {
+            return $replacefunc($result, $variables);
         }
     }
 
@@ -344,28 +344,23 @@
     }
 
     // Is a parent language defined?  If so, try to find this string in a parent language file
-    foreach ($locations as $location) {
-        $langfile = $location . $lang . '/langconfig.php';
-        if (is_readable($langfile)) {
-            if ($parentlang = get_string_from_file('parentlanguage', $langfile)) {
-                $langfile = $location . $parentlang . '/' . $section . '.php';
-                if (is_readable($langfile)) {
-                    if ($result = get_string_from_file($identifier, $langfile)) {
-                        return $replacefunc($result, $variables);
-                    }
+    $langfile = $langstringroot . 'lang/' . $lang . '/langconfig.php';
+    if (is_readable($langfile)) {
+        if ($parentlang = get_string_from_file('parentlanguage', $langfile)) {
+            $langfile = get_language_root($parentlang) . 'lang/' . $parentlang . '/' . $section . '.php';
+            if (is_readable($langfile)) {
+                if ($result = get_string_from_file($identifier, $langfile)) {
+                    return $replacefunc($result, $variables);
                 }
             }
         }
     }
 
     /// Our only remaining option is to try English
-    foreach ($locations as $location) {
-        //if local_en not found, or string not found in local_en
-        $langfile = $location . 'en.utf8/' . $section . '.php';
-        if (is_readable($langfile)) {
-            if ($result = get_string_from_file($identifier, $langfile)) {
-                return $replacefunc($result, $variables);
-            }
+    $langfile = get_config('docroot') . $langdirectory . 'en.utf8/' . $section . '.php';
+    if (is_readable($langfile)) {
+        if ($result = get_string_from_file($identifier, $langfile)) {
+            return $replacefunc($result, $variables);
         }
     }
 
@@ -379,19 +374,23 @@
  */
 function get_languages() {
     $langs = array();
-    $langbase = get_config('docroot') . 'lang/';
-    if (!$langdir = opendir($langbase)) {
-        throw new SystemException('Unable to read language directory '.$langbase);
-    }
-    while (false !== ($subdir = readdir($langdir))) {
-        $langfile = $langbase . $subdir . '/langconfig.php';
-        if ($subdir != "." && $subdir != ".." && is_readable($langfile)) {
-            if ($langname = get_string_from_file('thislanguage',$langfile)) {
-                $langs[$subdir] = $langname;
+
+    foreach (language_get_searchpaths() as $searchpath) {
+        $langbase = $searchpath . '/lang/';
+        if (!$langdir = opendir($langbase)) {
+            throw new SystemException('Unable to read language directory '.$langbase);
+        }
+        while (false !== ($subdir = readdir($langdir))) {
+            $langfile = $langbase . $subdir . '/langconfig.php';
+            if ($subdir != "." && $subdir != ".." && is_readable($langfile)) {
+                if ($langname = get_string_from_file('thislanguage',$langfile)) {
+                    $langs[$subdir] = $langname;
+                }
             }
         }
+        closedir($langdir);
     }
-    closedir($langdir);
+
     return $langs;
 }
 
@@ -400,9 +399,61 @@
 }
 
 /**
- * Return a list of available themes
- * Need to add the theme names sometime; for now use get_string().
+ * Returns a list of directories in which to search for language packs.
  *
+ * This is influenced by the configuration variable 'langpacksearchpaths'
+ */
+function language_get_searchpaths() {
+    static $searchpaths = array();
+
+    if (!$searchpaths) {
+        $searchpaths = array(get_config('docroot'));
+        if ($langpacksearchpaths = get_config('langpacksearchpaths')) {
+            foreach ($langpacksearchpaths as $path) {
+                $searchpaths[] = (substr($path, -1) == '/') ? $path : "$path/";
+            }
+        }
+    }
+
+    return $searchpaths;
+}
+
+/**
+ * Get the directory in which the specified language pack resides.
+ *
+ * Defaults to getting the directory for the current_language() - i.e. the 
+ * language the user is using
+ *
+ * Returns null if the language can't be found
+ *
+ * @param string $language The language to look for
+ */
+function get_language_root($language=null) {
+    static $language_root_cache = array();
+
+    if (!isset($language_root_cache[$language])) {
+        if ($language == null) {
+            $language = current_language();
+        }
+
+        foreach (language_get_searchpaths() as $path) {
+            if (is_dir("$path/lang/$language")) {
+                return $language_root_cache[$language] = $path;
+            }
+        }
+
+        // Oh noes, can't be found
+        $language_root_cache[$language] = null;
+
+    }
+
+    return $language_root_cache[$language];
+}
+
+/**
+ * Return a list of available themes.
+ *
+ * Themes _must_ have a config.php, and it should specify a theme name.
  */
 function get_themes() {
     $themes = array();
@@ -412,8 +463,6 @@
     }
     while (false !== ($subdir = readdir($themedir))) {
         if ($subdir != "." && $subdir != ".." && is_dir($themebase . $subdir)) {
-            $themes[$subdir] = $subdir;
-
             $config_path = $themebase . $subdir . '/config.php';
             if (is_readable($config_path)) {
                 require($config_path);
@@ -1740,11 +1789,8 @@
     require_once('group.php');
     $data = array(
         'id' => $USER->get('id'),
+        'profileicon' => $USER->get('profileicon') ? $USER->get('profileicon') : 0,
     );
-    $saveduser = $USER->get('parentuser');
-    if (!empty($saveduser) && $saveduser->name) {
-        $data['realuser'] = $saveduser->name;
-    }
     $data['unreadnotifications'] = call_static_method(generate_class_name('notification', 'internal'), 'unread_count', $USER->get('id'));
     $data['unreadnotificationsmessage'] = $data['unreadnotifications'] == 1 ? get_string('unreadmessage') : get_string('unreadmessages');
     $invitedgroups = get_invited_groups();
@@ -1772,4 +1818,38 @@
     return $data;
 }
 
+/**
+ * Cronjob to recalculate how much quota each user is using and update it as 
+ * appropriate.
+ *
+ * This gives a backstop for the possibility that there is a bug elsewhere that 
+ * has caused the quota count to get out of sync
+ */
+function recalculate_quota() {
+    if (!$artefacts = get_records_array('artefact', '', '', '', 'id, artefacttype, owner')) {
+        // Nothing to do
+        return;
+    }
+
+    $userquotas = array();
+
+    foreach ($artefacts as $artefact) {
+        safe_require('artefact', get_field('artefact_installed_type', 'plugin', 'name', $artefact->artefacttype));
+        if (!isset($userquotas[$artefact->owner])) {
+            $userquotas[$artefact->owner] = 0;
+        }
+        $userquotas[$artefact->owner] += call_static_method(generate_artefact_class_name($artefact->artefacttype), 'get_quota_usage', $artefact->id);
+    }
+
+    foreach ($userquotas as $user => $quota) {
+        $data = (object) array(
+            'quotaused' => $quota
+        );
+        $where = (object) array(
+            'id' => $user
+        );
+        update_record('usr', $data, $where);
+    }
+}
+
 ?>
--- mahara-1.0.4.orig/htdocs/lib/view.php
+++ mahara-1.0.4/htdocs/lib/view.php
@@ -386,8 +386,8 @@
         require_once('activity.php');
         activity_occurred('maharamessage', 
                   array('users'   => array($this->get('owner')),
-                  'subject' => get_string_from_language($ownerlang, 'viewreleasedsubject'),
-                  'message' => get_string_from_language($ownerlang, 'viewreleasedmessage', 'mahara', 
+                  'subject' => get_string_from_language($ownerlang, 'viewreleasedsubject', 'group'),
+                  'message' => get_string_from_language($ownerlang, 'viewreleasedmessage', 'group',
                        get_field('group', 'name', 'id', $groupid), 
                        display_name($releaseuser, $this->get_owner_object()))));
     }
--- mahara-1.0.4.orig/htdocs/lib/user.php
+++ mahara-1.0.4/htdocs/lib/user.php
@@ -270,7 +270,8 @@
 
     $mail = new phpmailer();
 
-    $mail->Version = 'Mahara ' . get_config('release'); 
+    // Leaving this commented out - there's no reason for people to know this
+    //$mail->Version = 'Mahara ' . get_config('release');
     $mail->PluginDir = get_config('libroot')  . 'phpmailer/';
     
     $mail->CharSet = 'UTF-8';
--- mahara-1.0.4.orig/htdocs/lib/web.php
+++ mahara-1.0.4/htdocs/lib/web.php
@@ -436,6 +436,15 @@
 
         $smarty->assign('userauthinstance', $USER->lastauthinstance);
         $smarty->assign('SIDEBLOCKS', $SIDEBLOCKS);
+
+        if ($USER->get('parentuser')) {
+            $smarty->assign('USERMASQUERADING', true);
+            $smarty->assign('masqueradedetails', get_string('youaremasqueradingas', 'mahara', display_name($USER)));
+            $smarty->assign('becomeyouagain',
+                ' <a href="' . hsc($wwwroot) . 'admin/users/changeuser.php?restore=1">'
+                . get_string('becomeadminagain', 'admin', $USER->get('parentuser')->name)
+                . '</a>');
+        }
     }
 
     return $smarty;
@@ -1818,7 +1827,7 @@
         'elements'            => array(
             'query' => array(
                 'type'           => 'text',
-                'defaultvalue'   => get_string('search'),
+                'defaultvalue'   => get_string('searchusers'),
                 'class'          => 'emptyonfocus'
             ),
             'submit' => array(
--- mahara-1.0.4.orig/htdocs/lib/pieforms/static/core/.htaccess
+++ mahara-1.0.4/htdocs/lib/pieforms/static/core/.htaccess
@@ -0,0 +1,4 @@
+<IfModule mod_expires.c>
+    ExpiresActive On
+    ExpiresDefault "access plus 1 week"
+</IfModule>
--- mahara-1.0.4.orig/htdocs/lib/phpmailer/class.phpmailer.php
+++ mahara-1.0.4/htdocs/lib/phpmailer/class.phpmailer.php
@@ -390,9 +390,9 @@
      */
     function SendmailSend($header, $body) {
         if ($this->Sender != "")
-            $sendmail = sprintf("%s -oi -f %s -t", $this->Sendmail, $this->Sender);
+            $sendmail = sprintf("%s -oi -f %s -t", escapeshellcmd($this->Sendmail), escapeshellarg($this->Sender));
         else
-            $sendmail = sprintf("%s -oi -t", $this->Sendmail);
+            $sendmail = sprintf("%s -oi -t", escapeshellcmd($this->Sendmail));
 
         if(!@$mail = popen($sendmail, "w"))
         {
--- mahara-1.0.4.orig/htdocs/lib/db/upgrade.php
+++ mahara-1.0.4/htdocs/lib/db/upgrade.php
@@ -875,6 +875,121 @@
         }
     }
 
+    // We discovered that username case insensitivity was not being enforced at 
+    // most of the entry points to the system at which users can be created. 
+    // This problem manifested itself as users who had the same LOWER(username) 
+    // as another not being able to log in. The fix is to implement the checks, 
+    // rename the "duplicate" users and add a constraint on the database so it 
+    // can't happen again
+    if ($oldversion < 2008040202) {
+        $renamed = $newusernames = $oldusernames = array();
+        $allusers = get_records_array('usr', '', '', 'id', 'id, username');
+
+        $usernamemapping = array();
+        foreach ($allusers as $user) {
+            $oldusernames[] = $user->username;
+            $usernamemapping[strtolower($user->username)][] = array('id' => $user->id, 'username' => $user->username);
+        }
+
+        foreach ($usernamemapping as $lcname => $users) {
+            if (count($users) == 1) {
+                continue;
+            }
+
+            // Uhohes. Rename the user(s) who were created last
+            $skippedfirst = false;
+            foreach ($users as $user) {
+                if (!$skippedfirst) {
+                    $skippedfirst = true;
+                    continue;
+                }
+
+                $userobj = new User();
+                $userobj->find_by_id($user['id']);
+
+                // Append digits keeping total length <= 30
+                $i = 1;
+                $newname = substr($user['username'], 0, 29) . $i;
+                while (isset($newusernames[$newname]) || isset($oldusernames[$newname])) {
+                    $i++;
+                    $newname = substr($user['username'], 0, 30 - floor(log10($i)+1)) . $i;
+                }
+                set_field('usr', 'username', $newname, 'id', $user['id']);
+                $newusernames[$newname] = true;
+
+                $renamed[$newname] = $userobj;
+                log_debug(" * Renamed {$user['username']} to $newname");
+            }
+        }
+
+        if (!empty($renamed)) {
+            // Notify changed usernames to administrator
+            $report = '# Each line in this file is in the form "old_username new_username"'."\n";
+            $message = "Mahara now requires usernames to be unique, case insensitively.\n";
+            $message .= "Some usernames on your site were changed during the upgrade:\n\n";
+            foreach ($renamed as $newname => $olduser) {
+                $report .= "$olduser->username $newname\n";
+                $message .= "Old username: $olduser->username\n"
+                    . "New username: $newname\n\n";
+            }
+            $sitename = get_config('sitename');
+            $file = get_config('dataroot') . 'user_migration_report_2.txt';
+            if (file_put_contents($file, $report)) {
+                $message .= "\n" . 'A copy of this list has been saved to the file ' . $file;
+            }
+            global $USER;
+            email_user($USER, null, $sitename . ': User migration', $message);
+            // Notify changed usernames to users
+            $usermessagestart = "Your username at $sitename has been changed:\n\n";
+            $usermessageend = "\n\nNext time you visit the site, please login using your new username.";
+            foreach ($renamed as $newname => $olduser) {
+                if ($olduser->email == '') {
+                    continue;
+                }
+                log_debug("Attempting to notify $newname ($olduser->email) of their new username...");
+                email_user($olduser, null, $sitename . ': User name changed', $usermessagestart
+                           . "Old username: $olduser->username\nNew username: $newname"
+                           . $usermessageend);
+            }
+        }
+
+        // Now we know all usernames are unique over their lowercase values, we 
+        // can put an index in so data doesn't get all inconsistent next time
+        if (is_postgres()) {
+            execute_sql('DROP INDEX {usr_use_uix}');
+            execute_sql('CREATE UNIQUE INDEX {usr_use_uix} ON {usr}(LOWER(username))');
+        }
+        else {
+            // MySQL cannot create indexes over functions of columns. Too bad 
+            // for it. We won't drop the existing index because that offers a 
+            // large degree of protection, but when MySQL finally supports this 
+            // we will be able to add it
+        }
+
+
+        // Install a cron job to delete old session files
+        $cron = new StdClass;
+        $cron->callfunction = 'auth_remove_old_session_files';
+        $cron->minute       = '30';
+        $cron->hour         = '20';
+        $cron->day          = '*';
+        $cron->month        = '*';
+        $cron->dayofweek    = '*';
+        insert_record('cron', $cron);
+    }
+
+    if ($oldversion < 2008040203) {
+        // Install a cron job to recalculate user quotas
+        $cron = new StdClass;
+        $cron->callfunction = 'recalculate_quota';
+        $cron->minute       = '15';
+        $cron->hour         = '2';
+        $cron->day          = '*';
+        $cron->month        = '*';
+        $cron->dayofweek    = '*';
+        insert_record('cron', $cron);
+    }
+
     return $status;
 
 }
--- mahara-1.0.4.orig/htdocs/lang/en.utf8/error.php
+++ mahara-1.0.4/htdocs/lang/en.utf8/error.php
@@ -33,7 +33,7 @@
 $string['mysqldbextensionnotloaded'] = 'Your server configuration does not include the mysql extension. Mahara requires this in order to store data in a relational database. Please make sure that it is loaded in php.ini, or install it if it is not installed.';
 $string['mysqldbtypedeprecated'] = 'You are using the dbtype "mysql" in your config file. Please change it to "mysql5" - "mysql" is deprecated.';
 $string['unknowndbtype'] = 'Your server configuration references an unknown database type. Valid values are "postgres8" and "mysql5". Please change the database type setting in config.php.';
-$string['libxmlextensionnotloaded'] = 'Your server configuration does not include the libxml extension. Mahara requires this in order to parse XML data for the installer and for backups. Please make sure that it is loaded in php.ini, or install it if it is not installed.';
+$string['xmlextensionnotloaded'] = 'Your server configuration does not include the %s extension. Mahara requires this in order to parse XML data from a variety of sources. Please make sure that it is loaded in php.ini, or install it if it is not installed.';
 $string['gdextensionnotloaded'] = 'Your server configuration does not include the gd extension. Mahara requires this in order to perform resizes and other operations on uploaded images. Please make sure that it is loaded in php.ini, or install it if it is not installed.';
 $string['sessionextensionnotloaded'] = 'Your server configuration does not include the session extension. Mahara requires this in order to support users logging in. Please make sure that it is loaded in php.ini, or install it if it is not installed.';
 $string['registerglobals'] = 'You have dangerous PHP settings, register_globals is on. Mahara is trying to work around this, but you should really fix it';
--- mahara-1.0.4.orig/htdocs/lang/en.utf8/admin.php
+++ mahara-1.0.4/htdocs/lang/en.utf8/admin.php
@@ -215,13 +215,24 @@
 $string['uploadcsverrormandatoryfieldnotspecified'] = 'Line %s of the file does not have the required "%s" field';
 $string['uploadcsverroruseralreadyexists'] = 'Line %s of the file specifies the username "%s" that already exists';
 $string['uploadcsverroremailaddresstaken'] = 'Line %s of the file specifies the e-mail address "%s" that is already taken by another user';
-$string['uploadcsvpagedescription'] = '<p>You may use this facility to upload new users via a <acronym title="Comma Separated Values">CSV</acronym> file.</p>
+$string['uploadcsvpagedescription2'] = '<p>You may use this facility to upload new users via a <acronym title="Comma Separated Values">CSV</acronym> file.</p>
    
 <p>The first row of your CSV file should specify the format of your CSV data. For example, it should look like this:</p>
 
 <pre>username,password,email,firstname,lastname,studentid</pre>
 
-<p>This row must include the <tt>username</tt>, <tt>password</tt>, <tt>email</tt>, <tt>firstname</tt> and <tt>lastname</tt> fields always, and then any fields that are both mandatory and locked for the institution you are uploading the users for. You can <a href="%s">configure the mandatory fields</a> for all institutions, or <a href="%s">configure the locked fields for each institution</a>.</p>
+<p>This row must include the <tt>username</tt>, <tt>password</tt>, <tt>email</tt>, <tt>firstname</tt> and <tt>lastname</tt> fields. It must also includes fields that you have made mandatory for all users to fill out, and any fields locked for the institution you are uploading the users for. You can <a href="%s">configure the mandatory fields</a> for all institutions, or <a href="%s">configure the locked fields for each institution</a>.</p>
+
+<p>Your CSV file may include any other profile fields as you require. The full list of fields is:</p>
+
+%s';
+$string['uploadcsvpagedescription2institutionaladmin'] = '<p>You may use this facility to upload new users via a <acronym title="Comma Separated Values">CSV</acronym> file.</p>
+
+<p>The first row of your CSV file should specify the format of your CSV data. For example, it should look like this:</p>
+
+<pre>username,password,email,firstname,lastname,studentid</pre>
+
+<p>This row must include the <tt>username</tt>, <tt>password</tt>, <tt>email</tt>, <tt>firstname</tt> and <tt>lastname</tt> fields. It must also include any fields that the site administrator has made mandatory, and any fields that are locked for your institution. You can <a href="%s">configure the locked fields</a> for the institution(s) you manage.</p>
 
 <p>Your CSV file may include any other profile fields as you require. The full list of fields is:</p>
 
@@ -301,6 +312,7 @@
 $string['loginasdenied'] = 'Attempt to login as another user without permission';
 $string['loginastwice'] = 'Attempt to login as another user when already logged in as another user';
 $string['loginasrestorenodata'] = 'No user data to restore';
+$string['loginasoverridepasswordchange'] = 'As you are masquerading as another user, you may choose to %slog in anyway%s, ignoring the password change screen.';
 
 // Institutions
 $string['admininstitutions'] = 'Admininster Institutions';
--- mahara-1.0.4.orig/htdocs/lang/en.utf8/mahara.php
+++ mahara-1.0.4/htdocs/lang/en.utf8/mahara.php
@@ -243,6 +243,7 @@
 $string['preferredname'] = 'Preferred Name';
 $string['usernamedescription'] = ' ';
 $string['usernamehelp'] = 'The username you have been given to access this system.';
+$string['youaremasqueradingas'] = 'You are masquerading as %s.';
 $string['yournewpassword'] = 'Your new password';
 $string['yournewpasswordagain'] = 'Your new password again';
 $string['invalidsesskey'] = 'Invalid session key';
@@ -461,6 +462,7 @@
 
 // Search
 $string['search'] = 'Search';
+$string['searchusers'] = 'Search Users';
 $string['Query'] = 'Query';
 $string['query'] = 'Query';
 $string['querydescription'] = 'The words to be searched for';
--- mahara-1.0.4.orig/htdocs/lang/en.utf8/help/forms/register.username.html
+++ mahara-1.0.4/htdocs/lang/en.utf8/help/forms/register.username.html
@@ -1,2 +1,2 @@
 <h3>Username</h3>
-<p>Your username must be between 3 and 30 characters long, and will not be case sensitive. Your username may be an email address, so it can include alphanumeric characters, full stops and @ symbols.</p>
+<p>Your username must be between 3 and 30 characters long, and will not be case sensitive. Letters, numbers and most standard symbols are allowed.</p>
--- mahara-1.0.4.orig/htdocs/user/view.php
+++ mahara-1.0.4/htdocs/user/view.php
@@ -331,6 +331,13 @@
 
 }
 
+if ($userid != $USER->get('id') && is_null($USER->get('parentuser'))) {
+    $loginas = get_string('loginasuser', 'admin', $user->username);
+} else {
+    $loginas = null;
+}
+$smarty->assign('loginas', $loginas);
+
 if (isset($introduction)) {
     $smarty->assign('introduction', $introduction);
 }
--- mahara-1.0.4.orig/htdocs/js/.htaccess
+++ mahara-1.0.4/htdocs/js/.htaccess
@@ -0,0 +1,4 @@
+<IfModule mod_expires.c>
+    ExpiresActive On
+    ExpiresDefault "access plus 3 days"
+</IfModule>
--- mahara-1.0.4.orig/scripts/debian_packages.sh
+++ mahara-1.0.4/scripts/debian_packages.sh
@@ -0,0 +1,46 @@
+#!/bin/bash
+#
+# Builds official debian packages of Mahara.
+#
+# Usage: ./scripts/debian_packages.sh $version [sponsor]
+#
+# Passing the optional "sponsor" second argument builds the packages signed
+# with the current sponsor's key. See the sponsor_keyid variable below
+#
+# Currently, $version should be space separated, e.g. 0.9 1. When release.sh is
+# upgraded then this will change
+set -e
+
+# This is currently Francois' Debian GPG key
+sponsor_keyid=19D03486
+
+if [ ! -x scripts/release.sh ] ; then
+  echo "You must run this script from the Mahara top directory"
+  exit 1
+fi
+
+if [ "$1" = "" ] || [ "$1" = "-h" ] || [ "$1" = "--help" ]; then
+    echo "Builds official debian packages of Mahara. Check the comment"
+    echo "at the top of the script for more information."
+    exit
+fi
+
+# Build the original tarball if it doesn't exist
+if [ ! -e ../mahara_$1.$2.orig.tar.gz ] ; then
+    scripts/release.sh $1 $2 || exit 1
+    rm -f mahara-*.tar.bz2 mahara-*.zip
+    mv mahara-$1.$2.tar.gz ../mahara_$1.$2.orig.tar.gz
+fi
+
+# Build the package and sign it
+if [ "$3" = "sponsor" ]; then
+    dpkg-buildpackage -rfakeroot -k${sponsor_keyid} -i'.git' -I.git -tc || exit 2
+else
+    dpkg-buildpackage -rfakeroot -us -uc -tc -i'.git' -I.git || exit 2
+fi
+
+# Run lintian on it
+lintian -i -I ../mahara_$1.$2*changes
+
+echo ""
+echo "Don't forget to tag the 'pkg-debian' git branch once you're done"
