From ba0fc4fa20067528effd4802e53ceeb959640825 Mon Sep 17 00:00:00 2001
From: Pierre Schmitz <pierre@archlinux.de>
Date: Thu, 12 Jan 2012 13:42:29 +0100
Subject: Update to MediaWiki 1.18.1

---
 includes/AjaxDispatcher.php              |   9 ++-
 includes/DefaultSettings.php             |   6 +-
 includes/OutputPage.php                  |  70 +++++++++++++------
 includes/RequestContext.php              |  25 +++++++
 includes/Skin.php                        |  21 +++++-
 includes/SkinTemplate.php                |  24 +++++--
 includes/SpecialPage.php                 |   9 +++
 includes/Title.php                       |   5 +-
 includes/User.php                        |   3 +-
 includes/UserMailer.php                  | 116 ++++++++++++-------------------
 includes/Wiki.php                        |  20 +++++-
 includes/api/ApiQueryRevisions.php       |   2 +-
 includes/db/Database.php                 |  13 ++++
 includes/db/DatabaseMysql.php            |   2 +-
 includes/db/DatabaseOracle.php           |   4 +-
 includes/filerepo/File.php               |  12 ++--
 includes/installer/CliInstaller.php      |   8 +++
 includes/installer/Installer.php         |   9 ++-
 includes/installer/MysqlInstaller.php    |   2 +-
 includes/installer/OracleUpdater.php     |  32 +++++++++
 includes/installer/PostgresUpdater.php   |   2 +
 includes/media/Bitmap.php                |   8 +--
 includes/media/GIF.php                   |  12 ++--
 includes/media/Generic.php               |  18 ++---
 includes/objectcache/DBABagOStuff.php    |  11 +--
 includes/parser/Parser.php               |  22 +++---
 includes/parser/StripState.php           |   7 +-
 includes/search/SearchUpdate.php         |   2 +-
 includes/specials/SpecialAllmessages.php |  10 +--
 includes/specials/SpecialBlockList.php   |   6 +-
 includes/specials/SpecialLinkSearch.php  |  32 +++++----
 includes/specials/SpecialMovepage.php    |   2 +-
 32 files changed, 340 insertions(+), 184 deletions(-)

(limited to 'includes')

diff --git a/includes/AjaxDispatcher.php b/includes/AjaxDispatcher.php
index 17b154d6..5bc9f067 100644
--- a/includes/AjaxDispatcher.php
+++ b/includes/AjaxDispatcher.php
@@ -68,7 +68,7 @@ class AjaxDispatcher {
 	 * request.
 	 */
 	function performAction() {
-		global $wgAjaxExportList, $wgOut;
+		global $wgAjaxExportList, $wgOut, $wgUser;
 
 		if ( empty( $this->mode ) ) {
 			return;
@@ -84,6 +84,13 @@ class AjaxDispatcher {
 				'Bad Request',
 				"unknown function " . (string) $this->func_name
 			);
+		} elseif ( !in_array( 'read', User::getGroupPermissions( array( '*' ) ), true ) 
+			&& !$wgUser->isAllowed( 'read' ) )
+		{
+			wfHttpError(
+				403,
+				'Forbidden',
+				'You must log in to view pages.' );
 		} else {
 			wfDebug( __METHOD__ . ' dispatching ' . $this->func_name . "\n" );
 
diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index 4248add7..9d387fb5 100644
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -33,7 +33,7 @@ $wgConf = new SiteConfiguration;
 /** @endcond */
 
 /** MediaWiki version number */
-$wgVersion = '1.18.0';
+$wgVersion = '1.18.1';
 
 /** Name of the site. It must be changed in LocalSettings.php */
 $wgSitename         = 'MediaWiki';
@@ -1410,6 +1410,8 @@ $wgQueryCacheLimit = 1000;
 $wgWantedPagesThreshold = 1;
 /** Enable slow parser functions */
 $wgAllowSlowParserFunctions = false;
+/** Allow schema updates */
+$wgAllowSchemaUpdates = true;
 
 /**
  * Do DELETE/INSERT for link updates instead of incremental
@@ -1511,6 +1513,8 @@ $wgParserCacheType = CACHE_ANYTHING;
  * given, giving a callable function which will generate a suitable cache object.
  *
  * The other parameters are dependent on the class used.
+ * - CACHE_DBA uses $wgTmpDirectory by default. The 'dir' parameter let you
+ *   overrides that.
  */
 $wgObjectCaches = array(
 	CACHE_NONE => array( 'class' => 'EmptyBagOStuff' ),
diff --git a/includes/OutputPage.php b/includes/OutputPage.php
index 419bbdf7..a3a9592d 100644
--- a/includes/OutputPage.php
+++ b/includes/OutputPage.php
@@ -1223,6 +1223,7 @@ class OutputPage extends ContextSource {
 	public function parserOptions( $options = null ) {
 		if ( !$this->mParserOptions ) {
 			$this->mParserOptions = new ParserOptions;
+			$this->mParserOptions->setEditSection( false );
 		}
 		return wfSetVar( $this->mParserOptions, $options );
 	}
@@ -1799,27 +1800,34 @@ class OutputPage extends ContextSource {
 		if ( $this->mRedirect != '' ) {
 			# Standards require redirect URLs to be absolute
 			$this->mRedirect = wfExpandUrl( $this->mRedirect, PROTO_CURRENT );
-			if( $this->mRedirectCode == '301' || $this->mRedirectCode == '303' ) {
-				if( !$wgDebugRedirects ) {
-					$message = HttpStatus::getMessage( $this->mRedirectCode );
-					$response->header( "HTTP/1.1 {$this->mRedirectCode} $message" );
+
+			$redirect = $this->mRedirect;
+			$code = $this->mRedirectCode;
+
+			if( wfRunHooks( "BeforePageRedirect", array( $this, &$redirect, &$code ) ) ) {
+				if( $code == '301' || $code == '303' ) {
+					if( !$wgDebugRedirects ) {
+						$message = HttpStatus::getMessage( $code );
+						$response->header( "HTTP/1.1 $code $message" );
+					}
+					$this->mLastModified = wfTimestamp( TS_RFC2822 );
+				}
+				if ( $wgVaryOnXFP ) {
+					$this->addVaryHeader( 'X-Forwarded-Proto' );
+				}
+				$this->sendCacheControl();
+
+				$response->header( "Content-Type: text/html; charset=utf-8" );
+				if( $wgDebugRedirects ) {
+					$url = htmlspecialchars( $redirect );
+					print "<html>\n<head>\n<title>Redirect</title>\n</head>\n<body>\n";
+					print "<p>Location: <a href=\"$url\">$url</a></p>\n";
+					print "</body>\n</html>\n";
+				} else {
+					$response->header( 'Location: ' . $redirect );
 				}
-				$this->mLastModified = wfTimestamp( TS_RFC2822 );
-			}
-			if ( $wgVaryOnXFP ) {
-				$this->addVaryHeader( 'X-Forwarded-Proto' );
-			}
-			$this->sendCacheControl();
-
-			$response->header( "Content-Type: text/html; charset=utf-8" );
-			if( $wgDebugRedirects ) {
-				$url = htmlspecialchars( $this->mRedirect );
-				print "<html>\n<head>\n<title>Redirect</title>\n</head>\n<body>\n";
-				print "<p>Location: <a href=\"$url\">$url</a></p>\n";
-				print "</body>\n</html>\n";
-			} else {
-				$response->header( 'Location: ' . $this->mRedirect );
 			}
+
 			wfProfileOut( __METHOD__ );
 			return;
 		} elseif ( $this->mStatusCode ) {
@@ -1959,6 +1967,8 @@ class OutputPage extends ContextSource {
 	 * Produce the stock "please login to use the wiki" page
 	 */
 	public function loginToUse() {
+		global $wgRequest;
+
 		if( $this->getUser()->isLoggedIn() ) {
 			throw new PermissionsError( 'read' );
 		}
@@ -1968,12 +1978,18 @@ class OutputPage extends ContextSource {
 		$this->setRobotPolicy( 'noindex,nofollow' );
 		$this->setArticleRelated( false );
 
+		$returnto = Title::newFromURL( $wgRequest->getVal( 'title', '' ) );
+		$returntoquery = array();
+		if( $returnto ) {
+			$returntoquery = array( 'returnto' => $returnto->getPrefixedText() );
+		}
+
 		$loginTitle = SpecialPage::getTitleFor( 'Userlogin' );
 		$loginLink = Linker::linkKnown(
 			$loginTitle,
 			wfMsgHtml( 'loginreqlink' ),
 			array(),
-			array( 'returnto' => $this->getTitle()->getPrefixedText() )
+			$returntoquery
 		);
 		$this->addHTML( wfMessage( 'loginreqpagetext' )->rawParams( $loginLink )->parse() .
 			"\n<!--" . $this->getTitle()->getPrefixedUrl() . '-->' );
@@ -2387,7 +2403,8 @@ $templates
 		foreach ( (array) $modules as $name ) {
 			$module = $resourceLoader->getModule( $name );
 			# Check that we're allowed to include this module on this page
-			if ( ( $module->getOrigin() > $this->getAllowedModules( ResourceLoaderModule::TYPE_SCRIPTS )
+			if ( !$module
+				|| ( $module->getOrigin() > $this->getAllowedModules( ResourceLoaderModule::TYPE_SCRIPTS )
 					&& $only == ResourceLoaderModule::TYPE_SCRIPTS )
 				|| ( $module->getOrigin() > $this->getAllowedModules( ResourceLoaderModule::TYPE_STYLES )
 					&& $only == ResourceLoaderModule::TYPE_STYLES )
@@ -2603,12 +2620,15 @@ $templates
 	/**
 	 * Get an array containing the variables to be set in mw.config in JavaScript.
 	 *
+	 * DO NOT CALL THIS FROM OUTSIDE OF THIS CLASS OR Skin::makeGlobalVariablesScript().
+	 * This is only public until that function is removed. You have been warned.
+	 *
 	 * Do not add things here which can be evaluated in ResourceLoaderStartupScript
 	 * - in other words, page-indendent/site-wide variables (without state).
 	 * You will only be adding bloat to the html page and causing page caches to
 	 * have to be purged on configuration changes.
 	 */
-	protected function getJSVars() {
+	public function getJSVars() {
 		global $wgUseAjax, $wgEnableMWSuggest, $wgContLang;
 
 		$title = $this->getTitle();
@@ -2955,7 +2975,11 @@ $templates
 		$styles = array( 'other' => array(), 'user' => array(), 'site' => array(), 'private' => array(), 'noscript' => array() );
 		$resourceLoader = $this->getResourceLoader();
 		foreach ( $this->getModuleStyles() as $name ) {
-			$group = $resourceLoader->getModule( $name )->getGroup();
+			$module = $resourceLoader->getModule( $name );
+			if ( !$module ) {
+				continue;
+			}
+			$group = $module->getGroup();
 			// Modules in groups named "other" or anything different than "user", "site" or "private"
 			// will be placed in the "other" group
 			$styles[isset( $styles[$group] ) ? $group : 'other'][] = $name;
diff --git a/includes/RequestContext.php b/includes/RequestContext.php
index 37617457..441a9aec 100644
--- a/includes/RequestContext.php
+++ b/includes/RequestContext.php
@@ -64,6 +64,13 @@ interface IContextSource {
 	 */
 	public function getLang();
 
+	/**
+	 * Get the Language object
+	 *
+	 * @return Language
+	 */
+	public function getLanguage();
+
 	/**
 	 * Get the Skin object
 	 *
@@ -233,6 +240,15 @@ class RequestContext implements IContextSource {
 		return $this->lang;
 	}
 
+	/**
+	 * Get the Language object
+	 *
+	 * @return Language
+	 */
+	public function getLanguage() {
+		return $this->getLang();
+	}
+
 	/**
 	 * Set the Skin object
 	 *
@@ -378,6 +394,15 @@ abstract class ContextSource implements IContextSource {
 		return $this->getContext()->getLang();
 	}
 
+	/**
+	 * Get the Language object
+	 *
+	 * @return Language
+	 */
+	public function getLanguage() {
+		return $this->getContext()->getLang();
+	}
+
 	/**
 	 * Get the Skin object
 	 *
diff --git a/includes/Skin.php b/includes/Skin.php
index a713660c..62a63ebe 100644
--- a/includes/Skin.php
+++ b/includes/Skin.php
@@ -402,6 +402,20 @@ abstract class Skin extends ContextSource {
 		wfProfileOut( __METHOD__ );
 	}
 
+	/**
+	 * Make a <script> tag containing global variables
+	 *
+	 * @param $unused Unused
+	 * @return string HTML fragment
+	 */
+	public static function makeGlobalVariablesScript( $unused ) {
+		global $wgOut;
+
+		wfDeprecated( __METHOD__, '1.19' );
+
+		return self::makeVariablesScript( $wgOut->getJSVars() );
+	}
+
 	/**
 	 * Get the query to generate a dynamic stylesheet
 	 *
@@ -1244,6 +1258,12 @@ abstract class Skin extends ContextSource {
 				if ( strpos( $line, '|' ) !== false ) { // sanity check
 					$line = MessageCache::singleton()->transform( $line, false, null, $this->getTitle() );
 					$line = array_map( 'trim', explode( '|', $line, 2 ) );
+					if ( count( $line ) !== 2 ) {
+						// Second sanity check, could be hit by people doing
+						// funky stuff with parserfuncs... (bug 3321)
+						continue;
+					}
+
 					$extraAttribs = array();
 
 					$msgLink = wfMessage( $line[0] )->inContentLanguage();
@@ -1255,7 +1275,6 @@ abstract class Skin extends ContextSource {
 					} else {
 						$link = $line[0];
 					}
-
 					$msgText = wfMessage( $line[1] );
 					if ( $msgText->exists() ) {
 						$text = $msgText->text();
diff --git a/includes/SkinTemplate.php b/includes/SkinTemplate.php
index 373daa9d..ef104bd7 100644
--- a/includes/SkinTemplate.php
+++ b/includes/SkinTemplate.php
@@ -480,7 +480,9 @@ class SkinTemplate extends Skin {
 						'text' => ( $wgContLang->getLanguageName( $nt->getInterwiki() ) != '' ?
 									$wgContLang->getLanguageName( $nt->getInterwiki() ) : $l ),
 						'title' => $nt->getText(),
-						'class' => $class
+						'class' => $class,
+						'lang' => $nt->getInterwiki(),
+						'hreflang' => $nt->getInterwiki(),
 					);
 				}
 			}
@@ -580,11 +582,19 @@ class SkinTemplate extends Skin {
 		/* set up the default links for the personal toolbar */
 		$personal_urls = array();
 		
-		$page = $wgRequest->getVal( 'returnto', $this->thispage );
-		$query = $wgRequest->getVal( 'returntoquery', $this->thisquery );
-		$a = array( 'returnto' => $page );
-		if( $query != '' ) {
-			$a['returntoquery'] = $query;
+		# Due to bug 32276, if a user does not have read permissions, 
+		# $this->getTitle() will just give Special:Badtitle, which is 
+		# not especially useful as a returnto parameter. Use the title 
+		# from the request instead, if there was one.
+		$page = Title::newFromURL( $wgRequest->getVal( 'title', '' ) );
+		$page = $wgRequest->getVal( 'returnto', $page );
+		$a = array();
+		if ( strval( $page ) !== '' ) {
+			$a['returnto'] = $page;
+			$query = $wgRequest->getVal( 'returntoquery', $this->thisquery );
+			if( $query != '' ) {
+				$a['returntoquery'] = $query;
+			}
 		}
 		$returnto = wfArrayToCGI( $a );
 		if( $this->loggedin ) {
@@ -843,7 +853,7 @@ class SkinTemplate extends Skin {
 		wfRunHooks( 'SkinTemplatePreventOtherActiveTabs', array( &$this, &$preventActiveTabs ) );
 
 		// Checks if page is some kind of content
-		if( $title->getNamespace() != NS_SPECIAL ) {
+		if( $title->canExist() ) {
 			// Gets page objects for the related namespaces
 			$subjectPage = $title->getSubjectPage();
 			$talkPage = $title->getTalkPage();
diff --git a/includes/SpecialPage.php b/includes/SpecialPage.php
index 0b21326a..022ef824 100644
--- a/includes/SpecialPage.php
+++ b/includes/SpecialPage.php
@@ -677,6 +677,15 @@ class SpecialPage {
 		return $this->getContext()->getLang();
 	}
 
+	/**
+	 * Shortcut to get user's language
+	 *
+	 * @return Language
+	 */
+	public function getLanguage() {
+		return $this->getContext()->getLang();
+	}
+
 	/**
 	 * Return the full title, including $par
 	 *
diff --git a/includes/Title.php b/includes/Title.php
index 33373b2c..02607496 100644
--- a/includes/Title.php
+++ b/includes/Title.php
@@ -1854,7 +1854,10 @@ class Title {
 
 			# Always grant access to the login page.
 			# Even anons need to be able to log in.
-			if ( $this->isSpecial( 'Userlogin' ) || $this->isSpecial( 'ChangePassword' ) ) {
+			if ( $this->isSpecial( 'Userlogin' )
+				|| $this->isSpecial( 'ChangePassword' )
+				|| $this->isSpecial( 'PasswordReset' )
+			) {
 				return true;
 			}
 
diff --git a/includes/User.php b/includes/User.php
index a584f39d..cebcf604 100644
--- a/includes/User.php
+++ b/includes/User.php
@@ -115,7 +115,6 @@ class User {
 		'deletedhistory',
 		'deletedtext',
 		'deleterevision',
-		'disableaccount',
 		'edit',
 		'editinterface',
 		'editusercssjs', #deprecated
@@ -2939,7 +2938,7 @@ class User {
 			return false;
 		}
 
-		return (bool)$userblock->doAutoblock( $this->getRequest()->getIP() );
+		return (bool)$userblock->doAutoblock( wfGetIP() );
 	}
 
 	/**
diff --git a/includes/UserMailer.php b/includes/UserMailer.php
index 5976c6fd..b1300367 100644
--- a/includes/UserMailer.php
+++ b/includes/UserMailer.php
@@ -119,22 +119,14 @@ class UserMailer {
 	 * @return Status object
 	 */
 	public static function send( $to, $from, $subject, $body, $replyto = null, $contentType = 'text/plain; charset=UTF-8') {
-		global $wgSMTP, $wgEnotifImpersonal;
-		global $wgEnotifMaxRecips, $wgAdditionalMailParams;
-
-		if ( is_array( $to ) ) {
-			$emails = '';
-			// This wouldn't be necessary if implode() worked on arrays of
-			// objects using __toString(). http://bugs.php.net/bug.php?id=36612
-			foreach ( $to as $t ) {
-				$emails .= $t->toString() . ",";
-			}
-			$emails = rtrim( $emails, ',' );
-			wfDebug( __METHOD__ . ': sending mail to ' . $emails . "\n" );
-		} else {
-			wfDebug( __METHOD__ . ': sending mail to ' . implode( ',', array( $to->toString() ) ) . "\n" );
+		global $wgSMTP, $wgEnotifMaxRecips, $wgAdditionalMailParams;
+
+		if ( !is_array( $to ) ) {
+			$to = array( $to );
 		}
 
+		wfDebug( __METHOD__ . ': sending mail to ' . implode( ', ', $to ) . "\n" );
+
 		if ( is_array( $wgSMTP ) ) {
 			if ( function_exists( 'stream_resolve_include_path' ) ) {
 				$found = stream_resolve_include_path( 'Mail.php' );
@@ -161,13 +153,13 @@ class UserMailer {
 			}
 
 			$headers['From'] = $from->toString();
-			$headers['Return-Path'] = $from->toString();
+			$headers['Return-Path'] = $from->address;
 
-			if ( $wgEnotifImpersonal ) {
+			if ( count( $to ) > 1 ) {
 				$headers['To'] = 'undisclosed-recipients:;';
 			}
 			else {
-				$headers['To'] = implode( ", ", (array )$dest );
+				$headers['To'] = $to[0]->toString();
 			}
 
 			if ( $replyto ) {
@@ -177,7 +169,7 @@ class UserMailer {
 			$headers['Date'] = date( 'r' );
 			$headers['MIME-Version'] = '1.0';
 			$headers['Content-type'] = ( is_null( $contentType ) ?
-					'text/plain; charset=UTF-8' : $contentType );
+				'text/plain; charset=UTF-8' : $contentType );
 			$headers['Content-transfer-encoding'] = '8bit';
 			// @todo FIXME
 			$headers['Message-ID'] = "<$msgid@" . $wgSMTP['IDHost'] . '>';
@@ -495,18 +487,11 @@ class EmailNotification {
 
 		$this->composed_common = true;
 
-		$summary = ( $this->summary == '' ) ? ' - ' : $this->summary;
-		$medit   = ( $this->minorEdit ) ? wfMsgForContent( 'minoredit' ) : '';
-
 		# You as the WikiAdmin and Sysops can make use of plenty of
 		# named variables when composing your notification emails while
 		# simply editing the Meta pages
 
-		$subject = wfMsgForContent( 'enotif_subject' );
-		$body    = wfMsgForContent( 'enotif_body' );
-		$from    = ''; /* fail safe */
-		$replyto = ''; /* fail safe */
-		$keys    = array();
+		$keys = array();
 
 		if ( $this->oldid ) {
 			$difflink = $this->title->getCanonicalUrl( 'diff=0&oldid=' . $this->oldid );
@@ -520,69 +505,54 @@ class EmailNotification {
 			$keys['$CHANGEDORCREATED'] = wfMsgForContent( 'created' );
 		}
 
-		if ( $wgEnotifImpersonal && $this->oldid ) {
-			/**
-			 * For impersonal mail, show a diff link to the last
-			 * revision.
-			 */
-			$keys['$NEWPAGE'] = wfMsgForContent( 'enotif_lastdiff',
-					$this->title->getCanonicalUrl( "oldid={$this->oldid}&diff=next" ) );
+		$keys['$PAGETITLE'] = $this->title->getPrefixedText();
+		$keys['$PAGETITLE_URL'] = $this->title->getCanonicalUrl();
+		$keys['$PAGEMINOREDIT'] = $this->minorEdit ? wfMsgForContent( 'minoredit' ) : '';
+		$keys['$PAGESUMMARY'] = $this->summary == '' ? ' - ' : $this->summary;
+		$keys['$UNWATCHURL'] = $this->title->getCanonicalUrl( 'action=unwatch' );
+
+		if ( $this->editor->isAnon() ) {
+			# real anon (user:xxx.xxx.xxx.xxx)
+			$keys['$PAGEEDITOR'] = wfMsgForContent( 'enotif_anon_editor', $this->editor->getName() );
+			$keys['$PAGEEDITOR_EMAIL'] = wfMsgForContent( 'noemailtitle' );
+		} else {
+			$keys['$PAGEEDITOR'] = $wgEnotifUseRealName ? $this->editor->getRealName() : $this->editor->getName();
+			$emailPage = SpecialPage::getSafeTitleFor( 'Emailuser', $this->editor->getName() );
+			$keys['$PAGEEDITOR_EMAIL'] = $emailPage->getCanonicalUrl();
 		}
 
-		$body = strtr( $body, $keys );
-		$pagetitle = $this->title->getPrefixedText();
-		$keys['$PAGETITLE']          = $pagetitle;
-		$keys['$PAGETITLE_URL']      = $this->title->getCanonicalUrl();
+		$keys['$PAGEEDITOR_WIKI'] = $this->editor->getUserPage()->getCanonicalUrl();
 
-		$keys['$PAGEMINOREDIT']      = $medit;
-		$keys['$PAGESUMMARY']        = $summary;
-		$keys['$UNWATCHURL']         = $this->title->getCanonicalUrl( 'action=unwatch' );
+		# Now build message's subject and body
 
+		$subject = wfMsgExt( 'enotif_subject', 'content' );
 		$subject = strtr( $subject, $keys );
+		$this->subject = MessageCache::singleton()->transform( $subject, false, null, $this->title );
+
+		$body = wfMsgExt( 'enotif_body', 'content' );
+		$body = strtr( $body, $keys );
+		$body = MessageCache::singleton()->transform( $body, false, null, $this->title );
+		$this->body = wordwrap( $body, 72 );
 
 		# Reveal the page editor's address as REPLY-TO address only if
 		# the user has not opted-out and the option is enabled at the
 		# global configuration level.
-		$editor = $this->editor;
-		$name    = $wgEnotifUseRealName ? $editor->getRealName() : $editor->getName();
 		$adminAddress = new MailAddress( $wgPasswordSender, $wgPasswordSenderName );
-		$editorAddress = new MailAddress( $editor );
 		if ( $wgEnotifRevealEditorAddress
-			&& ( $editor->getEmail() != '' )
-			&& $editor->getOption( 'enotifrevealaddr' ) ) {
+			&& ( $this->editor->getEmail() != '' )
+			&& $this->editor->getOption( 'enotifrevealaddr' ) )
+		{
+			$editorAddress = new MailAddress( $this->editor );
 			if ( $wgEnotifFromEditor ) {
-				$from    = $editorAddress;
+				$this->from    = $editorAddress;
 			} else {
-				$from    = $adminAddress;
-				$replyto = $editorAddress;
+				$this->from    = $adminAddress;
+				$this->replyto = $editorAddress;
 			}
 		} else {
-			$from    = $adminAddress;
-			$replyto = new MailAddress( $wgNoReplyAddress );
-		}
-
-		if ( $editor->isAnon() ) {
-			# real anon (user:xxx.xxx.xxx.xxx)
-			$utext = wfMsgForContent( 'enotif_anon_editor', $name );
-			$subject = str_replace( '$PAGEEDITOR', $utext, $subject );
-			$keys['$PAGEEDITOR']       = $utext;
-			$keys['$PAGEEDITOR_EMAIL'] = wfMsgForContent( 'noemailtitle' );
-		} else {
-			$subject = str_replace( '$PAGEEDITOR', $name, $subject );
-			$keys['$PAGEEDITOR']          = $name;
-			$emailPage = SpecialPage::getSafeTitleFor( 'Emailuser', $name );
-			$keys['$PAGEEDITOR_EMAIL'] = $emailPage->getCanonicalUrl();
+			$this->from    = $adminAddress;
+			$this->replyto = new MailAddress( $wgNoReplyAddress );
 		}
-		$userPage = $editor->getUserPage();
-		$keys['$PAGEEDITOR_WIKI'] = $userPage->getCanonicalUrl();
-		$body = strtr( $body, $keys );
-		$body = wordwrap( $body, 72 );
-
-		# now save this as the constant user-independent part of the message
-		$this->from    = $from;
-		$this->replyto = $replyto;
-		$this->subject = $subject;
-		$this->body    = $body;
 	}
 
 	/**
diff --git a/includes/Wiki.php b/includes/Wiki.php
index 173fcd94..f535b981 100644
--- a/includes/Wiki.php
+++ b/includes/Wiki.php
@@ -78,7 +78,12 @@ class MediaWiki {
 			$ret = Title::newMainPage();
 		} else {
 			$ret = Title::newFromURL( $title );
-			// check variant links so that interwiki links don't have to worry
+			// Alias NS_MEDIA page URLs to NS_FILE...we only use NS_MEDIA
+			// in wikitext links to tell Parser to make a direct file link
+			if ( !is_null( $ret ) && $ret->getNamespace() == NS_MEDIA ) {
+				$ret = Title::makeTitle( NS_FILE, $ret->getDBkey() );
+			}
+			// Check variant links so that interwiki links don't have to worry
 			// about the possible different language variants
 			if ( count( $wgContLang->getVariants() ) > 1
 				&& !is_null( $ret ) && $ret->getArticleID() == 0 )
@@ -128,7 +133,7 @@ class MediaWiki {
 	 * @return void
 	 */
 	private function performRequest() {
-		global $wgServer, $wgUsePathInfo;
+		global $wgServer, $wgUsePathInfo, $wgTitle;
 
 		wfProfileIn( __METHOD__ );
 
@@ -145,7 +150,6 @@ class MediaWiki {
 
 		wfRunHooks( 'BeforeInitialize',
 			array( &$title, null, &$output, &$user, $request, $this ) );
-
 		// Invalid titles. Bug 21776: The interwikis must redirect even if the page name is empty.
 		if ( is_null( $title ) || ( $title->getDBkey() == '' && $title->getInterwiki() == '' ) ||
 			$title->isSpecial( 'Badtitle' ) )
@@ -157,6 +161,16 @@ class MediaWiki {
 		// the Read array in order for the user to see it. (We have to check here to
 		// catch special pages etc. We check again in Article::view())
 		} elseif ( !$title->userCanRead() ) {
+			// Bug 32276: allowing the skin to generate output with $wgTitle 
+			// set to the input title would allow anonymous users to 
+			// determine whether a page exists, potentially leaking private data. In fact, the 
+			// curid and oldid request  parameters would allow page titles to be enumerated even 
+			// when they are not guessable. So we reset the title to Special:Badtitle before the 
+			// permissions error is displayed.
+			$badtitle = SpecialPage::getTitleFor( 'Badtitle' );
+			$output->setTitle( $badtitle );
+			$wgTitle = $badtitle;
+
 			$output->loginToUse();
 		// Interwiki redirects
 		} elseif ( $title->getInterwiki() != '' ) {
diff --git a/includes/api/ApiQueryRevisions.php b/includes/api/ApiQueryRevisions.php
index e6b21a92..9a1f1ba0 100644
--- a/includes/api/ApiQueryRevisions.php
+++ b/includes/api/ApiQueryRevisions.php
@@ -136,7 +136,7 @@ class ApiQueryRevisions extends ApiQueryBase {
 				if ( !$difftoRev ) {
 					$this->dieUsageMsg( array( 'nosuchrevid', $params['diffto'] ) );
 				}
-				if ( !$difftoRev->userCan( Revision::DELETED_TEXT ) ) {
+				if ( $difftoRev->isDeleted( Revision::DELETED_TEXT ) ) {
 					$this->setWarning( "Couldn't diff to r{$difftoRev->getID()}: content is hidden" );
 					$params['diffto'] = null;
 				}
diff --git a/includes/db/Database.php b/includes/db/Database.php
index 75e6a91d..d1a3b2bd 100644
--- a/includes/db/Database.php
+++ b/includes/db/Database.php
@@ -589,6 +589,19 @@ abstract class DatabaseBase implements DatabaseType {
 		return new DatabaseMysql( $server, $user, $password, $dbName, $flags );
 	}
 
+	/**
+	 * Same as new factory( ... ), kept for backward compatibility
+	 * @deprecated since 1.18
+	 * @see Database::factory()
+	 */
+	public final static function newFromType( $dbType, $p = array() ) {
+		wfDeprecated( __METHOD__ );
+		if ( isset( $p['tableprefix'] ) ) {
+			$p['tablePrefix'] = $p['tableprefix'];
+		}
+		return self::factory( $dbType, $p );
+	}
+
 	/**
 	 * Given a DB type, construct the name of the appropriate child class of
 	 * DatabaseBase. This is designed to replace all of the manual stuff like:
diff --git a/includes/db/DatabaseMysql.php b/includes/db/DatabaseMysql.php
index 9cbd455e..6a81f234 100644
--- a/includes/db/DatabaseMysql.php
+++ b/includes/db/DatabaseMysql.php
@@ -709,7 +709,7 @@ class DatabaseMysql extends DatabaseBase {
 	protected function getDefaultSchemaVars() {
 		$vars = parent::getDefaultSchemaVars();
 		$vars['wgDBTableOptions'] = str_replace( 'TYPE', 'ENGINE', $GLOBALS['wgDBTableOptions'] );
-		$vars['wgDBTableOptions'] = str_replace( 'CHARSET=mysql4', 'CHARSET=binary', $GLOBALS['wgDBTableOptions'] );
+		$vars['wgDBTableOptions'] = str_replace( 'CHARSET=mysql4', 'CHARSET=binary', $vars['wgDBTableOptions'] );
 		return $vars;
 	}
 
diff --git a/includes/db/DatabaseOracle.php b/includes/db/DatabaseOracle.php
index b64e66c2..9d51cf07 100644
--- a/includes/db/DatabaseOracle.php
+++ b/includes/db/DatabaseOracle.php
@@ -1175,9 +1175,7 @@ class DatabaseOracle extends DatabaseBase {
 		// a hack for deleting pages, users and images (which have non-nullable FKs)
 		// all deletions on these tables have transactions so final failure rollbacks these updates
 		$table = $this->tableName( $table );
-		if ( $table == $this->tableName( 'page' ) ) {
-				$this->update( 'recentchanges', array( 'rc_cur_id' => 0 ), array( 'rc_cur_id' => $conds['page_id'] ), $fname );
-		} elseif ( $table == $this->tableName( 'user' )  ) {
+		if ( $table == $this->tableName( 'user' )  ) {
 				$this->update( 'archive', array( 'ar_user' => 0 ), array( 'ar_user' => $conds['user_id'] ), $fname );
 				$this->update( 'ipblocks', array( 'ipb_user' => 0 ), array( 'ipb_user' => $conds['user_id'] ), $fname );
 				$this->update( 'image', array( 'img_user' => 0 ), array( 'img_user' => $conds['user_id'] ), $fname );
diff --git a/includes/filerepo/File.php b/includes/filerepo/File.php
index 6b35102b..1fd6d452 100644
--- a/includes/filerepo/File.php
+++ b/includes/filerepo/File.php
@@ -117,7 +117,7 @@ abstract class File {
 	 *
 	 * @param $old File Old file
 	 * @param $new string New name
-	 * 
+	 *
 	 * @return bool|null
 	 */
 	static function checkExtensionCompatibility( File $old, $new ) {
@@ -217,7 +217,7 @@ abstract class File {
 	public function getFullUrl() {
 		return wfExpandUrl( $this->getUrl(), PROTO_RELATIVE );
 	}
-	
+
 	public function getCanonicalUrl() {
 		return wfExpandUrl( $this->getUrl(), PROTO_CANONICAL );
 	}
@@ -475,7 +475,7 @@ abstract class File {
 
 	/**
 	 * Accessor for __get()
-	 * 
+	 *
 	 * @return bool
 	 */
 	protected function getIsSafeFile() {
@@ -891,10 +891,10 @@ abstract class File {
 
 	/**
 	 * Get the relative path for an archived file
-	 * 
+	 *
 	 * @param $suffix bool|string if not false, the name of an archived thumbnail file
 	 *
-	 * @return string 
+	 * @return string
 	 */
 	function getArchiveRel( $suffix = false ) {
 		$path = 'archive/' . $this->getHashPath();
@@ -909,7 +909,7 @@ abstract class File {
 	/**
 	 * Get the relative path for an archived file's thumbs directory
 	 * or a specific thumb if the $suffix is given.
-	 * 
+	 *
 	 * @param $archiveName string the timestamped name of an archived image
 	 * @param $suffix bool|string if not false, the name of a thumbnail file
 	 */
diff --git a/includes/installer/CliInstaller.php b/includes/installer/CliInstaller.php
index 2ae9d143..41392207 100644
--- a/includes/installer/CliInstaller.php
+++ b/includes/installer/CliInstaller.php
@@ -31,6 +31,7 @@ class CliInstaller extends Installer {
 		'dbpass' => 'wgDBpassword',
 		'dbschema' => 'wgDBmwschema',
 		'dbpath' => 'wgSQLiteDataDir',
+		'server' => 'wgServer',
 		'scriptpath' => 'wgScriptPath',
 	);
 
@@ -183,6 +184,13 @@ class CliInstaller extends Installer {
 		return parent::envCheckPath();
 	}
 
+	protected function envCheckServer( $srv = null ) {
+		if ( $this->getVar( 'wgServer' ) ) {
+			$srv = $this->getVar( 'wgServer' );
+		}
+		return parent::envCheckServer( $srv );
+	}
+
 	public function dirIsExecutable( $dir, $url ) {
 		$this->showMessage( 'config-no-cli-uploads-check', $dir );
 		return false;
diff --git a/includes/installer/Installer.php b/includes/installer/Installer.php
index 8101f7d6..ef484a8f 100644
--- a/includes/installer/Installer.php
+++ b/includes/installer/Installer.php
@@ -842,8 +842,13 @@ abstract class Installer {
 	/**
 	 * Environment check for the server hostname.
 	 */
-	protected function envCheckServer() {
-		$server = WebRequest::detectServer();
+	protected function envCheckServer( $srv = null ) {
+		if ( $srv ) {
+			// wgServer was pre-defined, perhaps by the cli installer
+			$server = $srv;
+		} else {
+			$server = WebRequest::detectServer();
+		}
 		$this->showMessage( 'config-using-server', $server );
 		$this->setVar( 'wgServer', $server );
 	}
diff --git a/includes/installer/MysqlInstaller.php b/includes/installer/MysqlInstaller.php
index 3bb8c114..0c197e6b 100644
--- a/includes/installer/MysqlInstaller.php
+++ b/includes/installer/MysqlInstaller.php
@@ -168,7 +168,7 @@ class MysqlInstaller extends DatabaseInstaller {
 				$existingEngine = false;
 			} else {
 				if ( preg_match( '/^latin1/', $row->Collation ) ) {
-					$existingSchema = 'mysql4';
+					$existingSchema = 'latin1';
 				} elseif ( preg_match( '/^utf8/', $row->Collation ) ) {
 					$existingSchema = 'utf8';
 				} elseif ( preg_match( '/^binary/', $row->Collation ) ) {
diff --git a/includes/installer/OracleUpdater.php b/includes/installer/OracleUpdater.php
index fb8032f5..964660c5 100644
--- a/includes/installer/OracleUpdater.php
+++ b/includes/installer/OracleUpdater.php
@@ -36,6 +36,9 @@ class OracleUpdater extends DatabaseUpdater {
 			array( 'addIndex',	'user',          'i02',       'patch-user_email_index.sql' ),
 			array( 'modifyField', 'user_properties', 'up_property', 'patch-up_property.sql' ),
 			array( 'addTable', 'uploadstash', 'patch-uploadstash.sql' ),
+			array( 'doRecentchangesFK2Cascade' ),
+
+			// KEEP THIS AT THE BOTTOM!!
 			array( 'doRebuildDuplicateFunction' ),
 			
 		);
@@ -134,6 +137,24 @@ class OracleUpdater extends DatabaseUpdater {
 		$this->output( "ok\n" );
 	}
 
+	/**
+	 * Removed forcing of invalid state on recentchanges_fk2.
+	 * cascading taken in account in the deleting function
+	 */
+	protected function doRecentchangesFK2Cascade() {
+		$this->output( "Altering RECENTCHANGES_FK2 ... " );
+
+		$meta = $this->db->query( 'SELECT 1 FROM all_constraints WHERE owner = \''.strtoupper($this->db->getDBname()).'\' AND constraint_name = \''.$this->db->tablePrefix().'RECENTCHANGES_FK2\' AND delete_rule = \'CASCADE\'' );
+		$row = $meta->fetchRow();
+		if ( $row ) {
+			$this->output( "FK up to date\n" );
+			return;
+		}
+
+		$this->applyPatch( 'patch_recentchanges_fk2_cascade.sql', false );
+		$this->output( "ok\n" );
+	}
+
 	/**
 	 * rebuilding of the function that duplicates tables for tests
 	 */
@@ -154,4 +175,15 @@ class OracleUpdater extends DatabaseUpdater {
 		$this->db->query( 'BEGIN fill_wiki_info; END;' );
 	}
 
+	/**
+	 * Overload: because of the DDL_MODE tablename escaping is a bit dodgy
+	 */
+	protected function purgeCache() {
+		# We can't guarantee that the user will be able to use TRUNCATE,
+		# but we know that DELETE is available to us
+		$this->output( "Purging caches..." );
+		$this->db->delete( '/*Q*/'.$this->db->tableName( 'objectcache' ), '*', __METHOD__ );
+		$this->output( "done.\n" );
+	}
+
 }
diff --git a/includes/installer/PostgresUpdater.php b/includes/installer/PostgresUpdater.php
index 2c9c0595..ade46ac8 100644
--- a/includes/installer/PostgresUpdater.php
+++ b/includes/installer/PostgresUpdater.php
@@ -33,6 +33,7 @@ class PostgresUpdater extends DatabaseUpdater {
 			array( 'renameSequence', 'rc_rc_id_seq',        'recentchanges_rc_id_seq'     ),
 			array( 'renameSequence', 'log_log_id_seq',      'logging_log_id_seq'          ),
 			array( 'renameSequence', 'pr_id_val',           'page_restrictions_pr_id_seq' ),
+			array( 'renameSequence', 'us_id_seq',           'uploadstash_us_id_seq' ),
 
 			# new tables
 			array( 'addTable', 'category',          'patch-category.sql' ),
@@ -54,6 +55,7 @@ class PostgresUpdater extends DatabaseUpdater {
 			array( 'addTable', 'msg_resource',      'patch-msg_resource.sql' ),
 			array( 'addTable', 'msg_resource_links','patch-msg_resource_links.sql' ),
 			array( 'addTable', 'module_deps',       'patch-module_deps.sql' ),
+			array( 'addTable', 'uploadstash',		'patch-uploadstash.sql' ),
 
 			# Needed before new field
 			array( 'convertArchive2' ),
diff --git a/includes/media/Bitmap.php b/includes/media/Bitmap.php
index 5f796095..3a66d8c9 100644
--- a/includes/media/Bitmap.php
+++ b/includes/media/Bitmap.php
@@ -42,7 +42,7 @@ class BitmapHandler extends ImageHandler {
 				return true;
 			}
 		}
-		
+
 		# Don't thumbnail an image so big that it will fill hard drives and send servers into swap
 		# JPEG has the handy property of allowing thumbnailing without full decompression, so we make
 		# an exception for it.
@@ -55,10 +55,10 @@ class BitmapHandler extends ImageHandler {
 
 		return true;
 	}
-	
+
 	/**
 	 * Extracts the width/height if the image will be scaled before rotating
-	 * 
+	 *
 	 * This will match the physical size/aspect ratio of the original image
 	 * prior to application of the rotation -- so for a portrait image that's
 	 * stored as raw landscape with 90-degress rotation, the resulting size
@@ -305,7 +305,7 @@ class BitmapHandler extends ImageHandler {
 		if ( strval( $wgImageMagickTempDir ) !== '' ) {
 			$env['MAGICK_TMPDIR'] = $wgImageMagickTempDir;
 		}
-		
+
 		$rotation = $this->getRotation( $image );
 		list( $width, $height ) = $this->extractPreRotationDimensions( $params, $rotation );
 
diff --git a/includes/media/GIF.php b/includes/media/GIF.php
index 325ceb9a..3bfa45a1 100644
--- a/includes/media/GIF.php
+++ b/includes/media/GIF.php
@@ -14,7 +14,7 @@
 class GIFHandler extends BitmapHandler {
 
 	const BROKEN_FILE = '0'; // value to store in img_metadata if error extracting metadata.
-	
+
 	function getMetadata( $image, $filename ) {
 		try {
 			$parsedGIFMetadata = BitmapMetadataHandler::GIF( $filename );
@@ -118,7 +118,7 @@ class GIFHandler extends BitmapHandler {
 		wfSuppressWarnings();
 		$metadata = unserialize($image->getMetadata());
 		wfRestoreWarnings();
-		
+
 		if (!$metadata || $metadata['frameCount'] <=  1) {
 			return $original;
 		}
@@ -126,19 +126,19 @@ class GIFHandler extends BitmapHandler {
 		/* Preserve original image info string, but strip the last char ')' so we can add even more */
 		$info = array();
 		$info[] = $original;
-		
+
 		if ( $metadata['looped'] ) {
 			$info[] = wfMsgExt( 'file-info-gif-looped', 'parseinline' );
 		}
-		
+
 		if ( $metadata['frameCount'] > 1 ) {
 			$info[] = wfMsgExt( 'file-info-gif-frames', 'parseinline', $metadata['frameCount'] );
 		}
-		
+
 		if ( $metadata['duration'] ) {
 			$info[] = $wgLang->formatTimePeriod( $metadata['duration'] );
 		}
-		
+
 		return $wgLang->commaList( $info );
 	}
 }
diff --git a/includes/media/Generic.php b/includes/media/Generic.php
index 48735ebf..6ef21e1e 100644
--- a/includes/media/Generic.php
+++ b/includes/media/Generic.php
@@ -570,43 +570,43 @@ abstract class ImageHandler extends MediaHandler {
 
 		$srcWidth = $image->getWidth( $params['page'] );
 		$srcHeight = $image->getHeight( $params['page'] );
-		
+
 		if ( isset( $params['height'] ) && $params['height'] != -1 ) {
 			# Height & width were both set
 			if ( $params['width'] * $srcHeight > $params['height'] * $srcWidth ) {
 				# Height is the relative smaller dimension, so scale width accordingly
 				$params['width'] = wfFitBoxWidth( $srcWidth, $srcHeight, $params['height'] );
-				
+
 				if ( $params['width'] == 0 ) {
 					# Very small image, so we need to rely on client side scaling :(
 					$params['width'] = 1;
 				}
-				
+
 				$params['physicalWidth'] = $params['width'];
 			} else {
 				# Height was crap, unset it so that it will be calculated later
 				unset( $params['height'] );
 			}
 		}
-		
+
 		if ( !isset( $params['physicalWidth'] ) ) {
 			# Passed all validations, so set the physicalWidth
 			$params['physicalWidth'] = $params['width'];
 		}
-		
+
 		# Because thumbs are only referred to by width, the height always needs
 		# to be scaled by the width to keep the thumbnail sizes consistent,
 		# even if it was set inside the if block above
-		$params['physicalHeight'] = File::scaleHeight( $srcWidth, $srcHeight, 
+		$params['physicalHeight'] = File::scaleHeight( $srcWidth, $srcHeight,
 			$params['physicalWidth'] );
 
-		# Set the height if it was not validated in the if block higher up 
+		# Set the height if it was not validated in the if block higher up
 		if ( !isset( $params['height'] ) || $params['height'] == -1 ) {
 			$params['height'] = $params['physicalHeight'];
 		}
 
-		
-		if ( !$this->validateThumbParams( $params['physicalWidth'], 
+
+		if ( !$this->validateThumbParams( $params['physicalWidth'],
 				$params['physicalHeight'], $srcWidth, $srcHeight, $mimeType ) ) {
 			return false;
 		}
diff --git a/includes/objectcache/DBABagOStuff.php b/includes/objectcache/DBABagOStuff.php
index 783cd22b..a273a4f7 100644
--- a/includes/objectcache/DBABagOStuff.php
+++ b/includes/objectcache/DBABagOStuff.php
@@ -6,20 +6,23 @@
  * writer locks. Intended for development use only,  as a memcached workalike
  * for systems that don't have it.
  *
+ * On construction you can pass array( 'dir' => '/some/path' ); as a parameter
+ * to override the default DBA files directory (wgTmpDirectory).
+ *
  * @ingroup Cache
  */
 class DBABagOStuff extends BagOStuff {
 	var $mHandler, $mFile, $mReader, $mWriter, $mDisabled;
 
-	public function __construct( $dir = false ) {
+	public function __construct( $params ) {
 		global $wgDBAhandler;
 
-		if ( $dir === false ) {
+		if ( !isset( $params['dir'] ) ) {
 			global $wgTmpDirectory;
-			$dir = $wgTmpDirectory;
+			$params['dir'] = $wgTmpDirectory;
 		}
 
-		$this->mFile = "$dir/mw-cache-" . wfWikiID();
+		$this->mFile = $params['dir']."/mw-cache-" . wfWikiID();
 		$this->mFile .= '.db';
 		wfDebug( __CLASS__ . ": using cache file {$this->mFile}\n" );
 		$this->mHandler = $wgDBAhandler;
diff --git a/includes/parser/Parser.php b/includes/parser/Parser.php
index 8d4c60df..b6443fdb 100644
--- a/includes/parser/Parser.php
+++ b/includes/parser/Parser.php
@@ -5207,20 +5207,18 @@ class Parser {
 		if ( is_null( $this->mRevisionTimestamp ) ) {
 			wfProfileIn( __METHOD__ );
 
-			$revObject = $this->getRevisionObject();
-			$timestamp = $revObject ? $revObject->getTimestamp() : false;
+			global $wgContLang;
 
-			if( $timestamp !== false ) {
-				global $wgContLang;
+			$revObject = $this->getRevisionObject();
+			$timestamp = $revObject ? $revObject->getTimestamp() : wfTimestampNow();
 
-				# The cryptic '' timezone parameter tells to use the site-default
-				# timezone offset instead of the user settings.
-				#
-				# Since this value will be saved into the parser cache, served
-				# to other users, and potentially even used inside links and such,
-				# it needs to be consistent for all visitors.
-				$this->mRevisionTimestamp = $wgContLang->userAdjust( $timestamp, '' );
-			}
+			# The cryptic '' timezone parameter tells to use the site-default
+			# timezone offset instead of the user settings.
+			#
+			# Since this value will be saved into the parser cache, served
+			# to other users, and potentially even used inside links and such,
+			# it needs to be consistent for all visitors.
+			$this->mRevisionTimestamp = $wgContLang->userAdjust( $timestamp, '' );
 
 			wfProfileOut( __METHOD__ );
 		}
diff --git a/includes/parser/StripState.php b/includes/parser/StripState.php
index c7bd1e77..357dc2c8 100644
--- a/includes/parser/StripState.php
+++ b/includes/parser/StripState.php
@@ -90,10 +90,13 @@ class StripState {
 
 		wfProfileIn( __METHOD__ );
 		$this->tempType = $type;
-		$out = preg_replace_callback( $this->regex, array( $this, 'unstripCallback' ), $text );
+		do {
+			$oldText = $text;
+			$text = preg_replace_callback( $this->regex, array( $this, 'unstripCallback' ), $text );
+		} while ( $text !== $oldText );
 		$this->tempType = null;
 		wfProfileOut( __METHOD__ );
-		return $out;
+		return $text;
 	}
 
 	/**
diff --git a/includes/search/SearchUpdate.php b/includes/search/SearchUpdate.php
index 77146ebb..f79092cb 100644
--- a/includes/search/SearchUpdate.php
+++ b/includes/search/SearchUpdate.php
@@ -62,7 +62,7 @@ class SearchUpdate {
 		  "\\1\\2 \\2 \\2\\3", $text ); # Emphasize headings
 
 		# Strip external URLs
-		$uc = "A-Za-z0-9_\\/:.,~%\\-+&;#?!=()@\\xA0-\\xFF";
+		$uc = "A-Za-z0-9_\\/:.,~%\\-+&;#?!=()@\\x80-\\xFF";
 		$protos = "http|https|ftp|mailto|news|gopher";
 		$pat = "/(^|[^\\[])({$protos}):[{$uc}]+([^{$uc}]|$)/";
 		$text = preg_replace( $pat, "\\1 \\3", $text );
diff --git a/includes/specials/SpecialAllmessages.php b/includes/specials/SpecialAllmessages.php
index 2214b4ab..24815825 100644
--- a/includes/specials/SpecialAllmessages.php
+++ b/includes/specials/SpecialAllmessages.php
@@ -62,9 +62,6 @@ class SpecialAllmessages extends SpecialPage {
 
 		$out->addModuleStyles( 'mediawiki.special' );
 
-		$this->filter = $request->getVal( 'filter', 'all' );
-		$this->prefix = $request->getVal( 'prefix', '' );
-
 		$this->table = new AllmessagesTablePager(
 			$this,
 			array(),
@@ -118,10 +115,13 @@ class AllmessagesTablePager extends TablePager {
 		$this->langcode = $this->lang->getCode();
 		$this->foreign  = $this->langcode != $wgContLang->getCode();
 
-		if( $wgRequest->getVal( 'filter', 'all' ) === 'all' ){
+		$request = $wgRequest;
+
+		$this->filter = $request->getVal( 'filter', 'all' );
+		if( $this->filter === 'all' ){
 			$this->custom = null; // So won't match in either case
 		} else {
-			$this->custom = ($wgRequest->getVal( 'filter' ) == 'unmodified');
+			$this->custom = ($this->filter == 'unmodified');
 		}
 
 		$prefix = $wgLang->ucfirst( $wgRequest->getVal( 'prefix', '' ) );
diff --git a/includes/specials/SpecialBlockList.php b/includes/specials/SpecialBlockList.php
index ebeb5874..04787a65 100644
--- a/includes/specials/SpecialBlockList.php
+++ b/includes/specials/SpecialBlockList.php
@@ -426,7 +426,11 @@ class HTMLBlockedUsersItemSelect extends HTMLSelectField {
 			return true;
 		}
 
-		if ( !in_array( $value, $this->mParams['options'] ) ) {
+		// Let folks pick an explicit limit not from our list, as long as it's a real numbr.
+		if ( !in_array( $value, $this->mParams['options'] ) && $value == intval( $value ) && $value > 0 ) {
+			// This adds the explicitly requested limit value to the drop-down,
+			// then makes sure it's sorted correctly so when we output the list
+			// later, the custom option doesn't just show up last.
 			$this->mParams['options'][ $this->mParent->getLanguage()->formatNum( $value ) ] = intval($value);
 			asort( $this->mParams['options'] );
 		}
diff --git a/includes/specials/SpecialLinkSearch.php b/includes/specials/SpecialLinkSearch.php
index bef859a2..53db6f87 100644
--- a/includes/specials/SpecialLinkSearch.php
+++ b/includes/specials/SpecialLinkSearch.php
@@ -43,14 +43,20 @@ class LinkSearchPage extends QueryPage {
 	}
 
 	function execute( $par ) {
-		global $wgOut, $wgRequest, $wgUrlProtocols, $wgMiserMode, $wgLang;
+		global $wgUrlProtocols, $wgMiserMode;
+
 		$this->setHeaders();
-		$wgOut->allowClickjacking();
+		$this->outputHeader();
+
+		$out = $this->getOutput();
+		$out->allowClickjacking();
 
-		$target = $wgRequest->getVal( 'target', $par );
-		$namespace = $wgRequest->getIntorNull( 'namespace', null );
+		$request = $this->getRequest();
+		$target = $request->getVal( 'target', $par );
+		$namespace = $request->getIntorNull( 'namespace', null );
 
 		$protocols_list = array();
+
 		foreach( $wgUrlProtocols as $prot ) {
 			if ( $prot !== '//' ) {
 				$protocols_list[] = $prot;
@@ -79,9 +85,10 @@ class LinkSearchPage extends QueryPage {
 			$protocol = '';
 		}
 
-		$out->addWikiMsg( 'linksearch-text', '<nowiki>' . $this->getLanguage()->commaList( $protocols_list ) . '</nowiki>' );
+		$out->addWikiMsg( 'linksearch-text', '<nowiki>' . $this->getLang()->commaList( $wgUrlProtocols ) . '</nowiki>' );
+
 		$s = Xml::openElement( 'form', array( 'id' => 'mw-linksearch-form', 'method' => 'get', 'action' => $GLOBALS['wgScript'] ) ) .
-			Html::hidden( 'title', $self->getPrefixedDbKey() ) .
+			Html::hidden( 'title', $this->getTitle()->getPrefixedDbKey() ) .
 			'<fieldset>' .
 			Xml::element( 'legend', array(), wfMsg( 'linksearch' ) ) .
 			Xml::inputLabel( wfMsg( 'linksearch-pat' ), 'target', 'target', 50, $target ) . ' ';
@@ -92,7 +99,7 @@ class LinkSearchPage extends QueryPage {
 		$s .=	Xml::submitButton( wfMsg( 'linksearch-ok' ) ) .
 			'</fieldset>' .
 			Xml::closeElement( 'form' );
-		$wgOut->addHTML( $s );
+		$out->addHTML( $s );
 
 		if( $target != '' ) {
 			$this->setParams( array(
@@ -101,7 +108,7 @@ class LinkSearchPage extends QueryPage {
 				'protocol' => $protocol ) );
 			parent::execute( $par );
 			if( $this->mMungedQuery === false )
-				$wgOut->addWikiMsg( 'linksearch-error' );
+				$out->addWikiMsg( 'linksearch-error' );
 		}
 	}
 
@@ -172,8 +179,8 @@ class LinkSearchPage extends QueryPage {
 	function formatResult( $skin, $result ) {
 		$title = Title::makeTitle( $result->namespace, $result->title );
 		$url = $result->url;
-		$pageLink = $skin->linkKnown( $title );
-		$urlLink = $skin->makeExternalLink( $url, $url );
+		$pageLink = Linker::linkKnown( $title );
+		$urlLink = Linker::makeExternalLink( $url, $url );
 
 		return wfMsgHtml( 'linksearch-line', $urlLink, $pageLink );
 	}
@@ -182,14 +189,13 @@ class LinkSearchPage extends QueryPage {
 	 * Override to check query validity.
 	 */
 	function doQuery( $offset = false, $limit = false ) {
-		global $wgOut;
 		list( $this->mMungedQuery,  ) = LinkSearchPage::mungeQuery( $this->mQuery, $this->mProt );
 		if( $this->mMungedQuery === false ) {
-			$wgOut->addWikiMsg( 'linksearch-error' );
+			$this->getOutput()->addWikiMsg( 'linksearch-error' );
 		} else {
 			// For debugging
 			// Generates invalid xhtml with patterns that contain --
-			//$wgOut->addHTML( "\n<!-- " . htmlspecialchars( $this->mMungedQuery ) . " -->\n" );
+			//$this->getOutput()->addHTML( "\n<!-- " . htmlspecialchars( $this->mMungedQuery ) . " -->\n" );
 			parent::doQuery( $offset, $limit );
 		}
 	}
diff --git a/includes/specials/SpecialMovepage.php b/includes/specials/SpecialMovepage.php
index 7ac7eba4..ec7f4024 100644
--- a/includes/specials/SpecialMovepage.php
+++ b/includes/specials/SpecialMovepage.php
@@ -75,7 +75,7 @@ class MovePageForm extends UnlistedSpecialPage {
 		$permErrors = $this->oldTitle->getUserPermissionsErrors( 'move', $wgUser );
 		if( !empty( $permErrors ) ) {
 			// Auto-block user's IP if the account was "hard" blocked
-			$user->spreadAnyEditBlock();
+			$wgUser->spreadAnyEditBlock();
 			$this->getOutput()->showPermissionsErrorPage( $permErrors );
 			return;
 		}
-- 
cgit v1.2.2