bind security token to username

This makes the security token more robust agains session fixation
attacks. A CSRF warning will no longer abort a page save but lead to the
preview mode to avoid infor

bind security token to username

This makes the security token more robust agains session fixation
attacks. A CSRF warning will no longer abort a page save but lead to the
preview mode to avoid information loss when a user logs in during
editing (eg in another tab).

show more ...

fullscreen media manager

Check permissions + security token in lock + draft modification FS#2265

This disables lock and draft creation for pages the user can't edit. It
additionally adds a security token to the draft creati

Check permissions + security token in lock + draft modification FS#2265

This disables lock and draft creation for pages the user can't edit. It
additionally adds a security token to the draft creation and deletion
request so - at least for logged in users - drafts can't be created,
modified or deleted so easily anymore.

show more ...

execute edit action when draft was specified but no draft exists FS#2240

check manager/admin role earlier for admin plugins FS#2180

deleted redundant line

Change sitemap filename to sitemap.xml(.gz). Closes FS#2127

Delete superfluous assignment created by the last commit

Copy changes from ajax_lock to act_draftsave

Remove enc=utf-8 in VIM modeline as it is not allowed in VIM 7.3

As of VIM 7.3 it is no longer possible to specify the encoding in the
modeline. This gives an error message whenever such a file is o

Remove enc=utf-8 in VIM modeline as it is not allowed in VIM 7.3

As of VIM 7.3 it is no longer possible to specify the encoding in the
modeline. This gives an error message whenever such a file is opened,
thus this commit removes the enc setting from the modeline.

show more ...

Send 403 header for permission denied screens when send404 is enabled

Handle do=check before ACL checking

Merge remote branch 'origin/master' into sitemap

Add back globals for templates

Small fixes / cleanup

Action handler for sitemaps improved

The action handler for the sitemap now makes use of the sitemapper
methods for determining the filename and uses http conditional requests.

Transformed the sitemapper into a class

This makes it possible to autoload the sitemapper when needed.

Sitemap rewrite

make use of tpl_get_action in tpl_actiondropdown FS#2005

do not require special permissions to look at index FS#1720

check for user in act_subscription FS#1935

msgs are saved in send_redirect now, less code duplication needed

Let actionOK detect auth backend capabilities

Call act_edit for locked pages

50e988b accidentally stopped act_dispatch from calling act_edit for locked
pages, thus showing a generic »page not writable« message instead of a
page lock message.

Merge branch 'requireall'

Conflicts:
inc/fulltext.php