Merge branch 'master' into multi_app_dir

Conflicts:
	apps/bookmarks/ajax/addBookmark.php
	config/config.sample.php
	lib/app.php
	remote.php

6 files changed, 26 insertions, 10 deletions

diff --git a/core/js/multiselect.js b/core/js/multiselect.js
index 541dddf0f70..5f339006d26 100644
--- a/core/js/multiselect.js
+++ b/core/js/multiselect.js
@@ -57,8 +57,11 @@
 				element=$(element);
 				var item=element.val();
 				var id='ms'+multiSelectId+'-option-'+item;
-				var input=$('<input id="'+id+'" type="checkbox"/>');
-				var label=$('<label for="'+id+'">'+item+'</label>');
+				var input=$('<input type="checkbox"/>');
+				input.attr('id',id);
+				var label=$('<label/>');
+				label.attr('for',id);
+				label.text(item);
 				if(settings.checked.indexOf(item)!=-1 || checked){
 					input.attr('checked',true);
 				}
@@ -130,7 +133,10 @@
 							li.text('+ '+settings.createText);
 							li.before(createItem(this));
 							var select=button.parent().next();
-							select.append($('<option selected="selected" value="'+$(this).val()+'">'+$(this).val()+'</option>'));
+							var option=$('<option selected="selected"/>');
+							option.attr('value',$(this).val());
+							option.text($(this).val());
+							select.append(optione);
 							li.prev().children('input').trigger('click');
 							button.parent().data('preventHide',false);
 							if(settings.createCallback){
diff --git a/core/lostpassword/index.php b/core/lostpassword/index.php
index 6bed7bdd93f..bd2a3e897e5 100644
--- a/core/lostpassword/index.php
+++ b/core/lostpassword/index.php
@@ -17,7 +17,7 @@ if (isset($_POST['user'])) {
 		OC_Preferences::setValue($_POST['user'], 'owncloud', 'lostpassword', $token);
 		$email = OC_Preferences::getValue($_POST['user'], 'settings', 'email', '');
 		if (!empty($email) and isset($_POST['sectoken']) and isset($_SESSION['sectoken']) and ($_POST['sectoken']==$_SESSION['sectoken']) ) {
-			$link = OC_Helper::linkToAbsolute('core/lostpassword', 'resetpassword.php').'?user='.$_POST['user'].'&token='.$token;
+			$link = OC_Helper::linkToAbsolute('core/lostpassword', 'resetpassword.php').'?user='.urlencode($_POST['user']).'&token='.$token;
 			$tmpl = new OC_Template('core/lostpassword', 'email');
 			$tmpl->assign('link', $link);
 			$msg = $tmpl->fetchPage();
diff --git a/core/templates/404.php b/core/templates/404.php
index cd4f2b40bb2..13a81010343 100644
--- a/core/templates/404.php
+++ b/core/templates/404.php
@@ -10,6 +10,6 @@ if(!isset($_)){//also provide standalone error page
 <ul>
 	<li class='error'>
 		<?php echo $l->t( 'Cloud not found' ); ?><br/>
-		<p class='hint'><?php if(isset($_['file'])) echo htmlentities($_['file'])?></p>
+		<p class='hint'><?php if(isset($_['file'])) echo $_['file']?></p>
 	</li>
 </ul>
diff --git a/core/templates/layout.guest.php b/core/templates/layout.guest.php
index 7a968917718..4cdbfd16e52 100644
--- a/core/templates/layout.guest.php
+++ b/core/templates/layout.guest.php
@@ -4,7 +4,7 @@
 		<title>ownCloud</title>
 		<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
 		<link rel="shortcut icon" href="<?php echo image_path('', 'favicon.png'); ?>" /><link rel="apple-touch-icon-precomposed" href="<?php echo image_path('', 'favicon-touch.png'); ?>" />
-		<?php if (!defined('DEBUG') || !DEBUG): ?>
+		<?php if (!empty(OC_Util::$core_styles)): ?>
 		<link rel="stylesheet" href="<?php echo OC_Helper::linkToRemote('core.css', false) ?>" type="text/css" media="screen" />
 		<?php endif ?>
 		<?php foreach($_['cssfiles'] as $cssfile): ?>
@@ -14,7 +14,7 @@
 			var oc_webroot = '<?php echo OC::$WEBROOT; ?>';
 			var oc_appswebroots = <?php echo $_['apps_paths'] ?>;
 		</script>
-		<?php if (!defined('DEBUG') || !DEBUG): ?>
+		<?php if (!empty(OC_Util::$core_scripts)): ?>
 		<script type="text/javascript" src="<?php echo OC_Helper::linkToRemote('core.js', false) ?>"></script>
 		<?php endif ?>
 		<?php foreach($_['jsfiles'] as $jsfile): ?>
diff --git a/core/templates/layout.user.php b/core/templates/layout.user.php
index 91cfa1a87a1..fabc28f6637 100644
--- a/core/templates/layout.user.php
+++ b/core/templates/layout.user.php
@@ -4,7 +4,7 @@
 		<title><?php echo isset($_['application']) && !empty($_['application'])?$_['application'].' | ':'' ?>ownCloud <?php echo OC_User::getUser()?' ('.OC_User::getUser().') ':'' ?></title>
 		<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
 		<link rel="shortcut icon" href="<?php echo image_path('', 'favicon.png'); ?>" /><link rel="apple-touch-icon-precomposed" href="<?php echo image_path('', 'favicon-touch.png'); ?>" />
-		<?php if (!defined('DEBUG') || !DEBUG): ?>
+		<?php if (!empty(OC_Util::$core_styles)): ?>
 		<link rel="stylesheet" href="<?php echo OC_Helper::linkToRemote('core.css', false) ?>" type="text/css" media="screen" />
 		<?php endif ?>
 		<?php foreach($_['cssfiles'] as $cssfile): ?>
@@ -15,7 +15,7 @@
 			var oc_appswebroots = <?php echo $_['apps_paths'] ?>;
 			var oc_current_user = '<?php echo OC_User::getUser() ?>';
 		</script>
-		<?php if (!defined('DEBUG') || !DEBUG): ?>
+		<?php if (!empty(OC_Util::$core_scripts)): ?>
 		<script type="text/javascript" src="<?php echo OC_Helper::linkToRemote('core.js', false) ?>"></script>
 		<?php endif ?>
 		<?php foreach($_['jsfiles'] as $jsfile): ?>
@@ -30,6 +30,16 @@
 				echo '/>';
 			?>
 		<?php endforeach; ?>
+		<script type="text/javascript">
+			$(function() {
+				requesttoken = '<?php echo $_['requesttoken']; ?>';
+				$(document).bind('ajaxSend', function(elm, xhr, s){
+					if(requesttoken) {
+						xhr.setRequestHeader('requesttoken', requesttoken);
+					}
+				});
+			});
+		</script>
 	</head>
 
 	<body id="<?php echo $_['bodyid'];?>">
diff --git a/core/templates/login.php b/core/templates/login.php
index 41d6ba41ef8..a40bf5c330a 100644
--- a/core/templates/login.php
+++ b/core/templates/login.php
@@ -1,7 +1,7 @@
 <!--[if IE 8]><style>input[type="checkbox"]{padding:0;}</style><![endif]-->
 <form action="index.php" method="post">
 	<fieldset>
-		<?php if(!empty($_['redirect'])) { echo '<input type="hidden" name="redirect_url" value="'.htmlentities($_['redirect']).'" />'; } ?>
+		<?php if(!empty($_['redirect'])) { echo '<input type="hidden" name="redirect_url" value="'.$_['redirect'].'" />'; } ?>
 		<?php if($_['error']): ?>
 			<a href="./core/lostpassword/"><?php echo $l->t('Lost your password?'); ?></a>
 		<?php endif; ?>