21 files changed, 172 insertions, 49 deletions

diff --git a/views/default/admin/settings/advanced/site_secret.php b/views/default/admin/settings/advanced/site_secret.php
new file mode 100644
index 000000000..e70ac7ab6
--- /dev/null
+++ b/views/default/admin/settings/advanced/site_secret.php
@@ -0,0 +1,11 @@
+<?php
+/**
+ * Elgg administration site secret settings
+ *
+ * @package Elgg
+ * @subpackage Core
+ */
+
+echo elgg_view_form('admin/site/regenerate_secret', array(), array(
+	'strength' => _elgg_get_site_secret_strength(),
+));
diff --git a/views/default/css/admin.php b/views/default/css/admin.php
index ceeac71a2..c435621b2 100644
--- a/views/default/css/admin.php
+++ b/views/default/css/admin.php
@@ -446,7 +446,8 @@ input {
 .elgg-input-text,
 .elgg-input-tags,
 .elgg-input-url,
-.elgg-input-plaintext {
+.elgg-input-plaintext,
+.elgg-input-longtext {
 	width: 98%;
 }
 textarea {
@@ -1003,7 +1004,7 @@ a.elgg-button {
 	ENTITY MENU
 *************************************** */
 <?php // height depends on line height/font size ?>
-.elgg-menu-entity, elgg-menu-annotation {
+.elgg-menu-entity, .elgg-menu-annotation {
 	float: right;
 	margin-left: 15px;
 	font-size: 90%;
@@ -1543,6 +1544,26 @@ table.mceLayout {
 }
 
 /* ***************************************
+    SITE SECRET
+*************************************** */
+.elgg-form-admin-site-regenerate-secret table {
+	width: 60%;
+	margin: 1em auto;
+}
+td.elgg-strength-strong,
+td.elgg-strength-strong h4 {
+	background: #DFF0D8; color: #468847;
+}
+td.elgg-strength-moderate,
+td.elgg-strength-moderate h4 {
+	background: #FCF8E3; color: #C09853;
+}
+td.elgg-strength-weak,
+td.elgg-strength-weak h4 {
+	background: #F2DEDE; color: #B94A48;
+}
+
+/* ***************************************
 	HELPERS
 *************************************** */
 .hidden {
diff --git a/views/default/css/elements/forms.php b/views/default/css/elements/forms.php
index f55e57fb4..068cc8fd6 100644
--- a/views/default/css/elements/forms.php
+++ b/views/default/css/elements/forms.php
@@ -69,6 +69,7 @@ input[type="radio"] {
 	margin:0 3px 0 0;
 	padding:0;
 	border:none;
+	border-radius:0;
 	width:auto;
 }
 .elgg-input-checkboxes.elgg-horizontal li,
diff --git a/views/default/css/elements/navigation.php b/views/default/css/elements/navigation.php
index 62f370069..6b29e4c19 100644
--- a/views/default/css/elements/navigation.php
+++ b/views/default/css/elements/navigation.php
@@ -16,7 +16,7 @@
 	text-align: center;
 }
 .elgg-pagination li {
-	display: inline;
+	display: inline-block;
 	margin: 0 6px 0 0;
 	text-align: center;
 }
@@ -24,7 +24,8 @@
 	-webkit-border-radius: 4px;
 	-moz-border-radius: 4px;
 	border-radius: 4px;
-	
+
+	display: block;
 	padding: 2px 6px;
 	color: #4690d6;
 	border: 1px solid #4690d6;
@@ -449,7 +450,7 @@
 	ENTITY AND ANNOTATION
 *************************************** */
 <?php // height depends on line height/font size ?>
-.elgg-menu-entity, elgg-menu-annotation {
+.elgg-menu-entity, .elgg-menu-annotation {
 	float: right;
 	margin-left: 15px;
 	font-size: 90%;
diff --git a/views/default/css/ie.php b/views/default/css/ie.php
index 4bddd4d55..34ececa89 100644
--- a/views/default/css/ie.php
+++ b/views/default/css/ie.php
@@ -6,3 +6,11 @@
 .elgg-avatar {
 	display: block;
 }
+
+/* ie8 adds space to the top of .elgg-gallery which causes jumpiness if this is display: block; */
+.elgg-gallery .elgg-avatar > a > img {
+    display: inline-block;
+}
+.elgg-gallery .elgg-avatar > .elgg-icon-hover-menu {
+    bottom: 4px;
+}
diff --git a/views/default/css/ie7.php b/views/default/css/ie7.php
index 229df8431..90274797d 100644
--- a/views/default/css/ie7.php
+++ b/views/default/css/ie7.php
@@ -24,6 +24,7 @@
 .elgg-menu-footer > li > a,
 .elgg-menu-footer li,
 .elgg-menu-general > li > a,
+.elgg-pagination li,
 .elgg-menu-general li {
 	display: inline;
 }
diff --git a/views/default/forms/admin/site/regenerate_secret.php b/views/default/forms/admin/site/regenerate_secret.php
new file mode 100644
index 000000000..af269b801
--- /dev/null
+++ b/views/default/forms/admin/site/regenerate_secret.php
@@ -0,0 +1,24 @@
+<?php
+
+$strength = $vars['strength'];
+
+?>
+<p><?php echo elgg_echo('admin:site:secret:intro'); ?></p>
+
+<table class="elgg-table">
+	<tr>
+		<th><?php echo elgg_echo('site_secret:current_strength'); ?></th>
+		<td class="elgg-strength-<?php echo $strength; ?>">
+			<h4><?php echo elgg_echo("site_secret:strength:$strength"); ?></h4>
+			<div><?php echo elgg_echo("site_secret:strength_msg:$strength"); ?></div>
+		</td>
+	</tr>
+</table>
+
+<div class="elgg-foot">
+	<?php echo elgg_view('input/submit', array(
+			'value' => elgg_echo('admin:site:secret:regenerate'),
+			'class' => 'elgg-requires-confirmation elgg-button elgg-button-submit',
+		)); ?>
+	<p class="elgg-text-help mts"><?php echo elgg_echo('admin:site:secret:regenerate:help'); ?></p>
+</div>
diff --git a/views/default/forms/plugins/settings/save.php b/views/default/forms/plugins/settings/save.php
index dc7b2fef7..116529905 100644
--- a/views/default/forms/plugins/settings/save.php
+++ b/views/default/forms/plugins/settings/save.php
@@ -17,11 +17,11 @@ if ($type != 'user') {
 	$type = '';
 }
 
-if (elgg_view_exists("{$type}settings/$plugin_id/edit")) {
+if (elgg_view_exists("plugins/$plugin_id/{$type}settings")) {
+	echo elgg_view("plugins/$plugin_id/{$type}settings", $vars);
+} elseif (elgg_view_exists("{$type}settings/$plugin_id/edit")) {
 	elgg_deprecated_notice("{$type}settings/$plugin_id/edit was deprecated in favor of plugins/$plugin_id/{$type}settings", 1.8);
 	echo elgg_view("{$type}settings/$plugin_id/edit", $vars);
-} else {
-	echo elgg_view("plugins/$plugin_id/{$type}settings", $vars);
 }
 
 echo '<div class="elgg-foot">';
diff --git a/views/default/forms/profile/edit.php b/views/default/forms/profile/edit.php
index 9538b779e..cb0a37ca4 100644
--- a/views/default/forms/profile/edit.php
+++ b/views/default/forms/profile/edit.php
@@ -13,6 +13,8 @@
 </div>
 <?php
 
+$sticky_values = elgg_get_sticky_values('profile:edit');
+
 $profile_fields = elgg_get_config('profile_fields');
 if (is_array($profile_fields) && count($profile_fields) > 0) {
 	foreach ($profile_fields as $shortname => $valtype) {
@@ -40,6 +42,14 @@ if (is_array($profile_fields) && count($profile_fields) > 0) {
 			$access_id = ACCESS_DEFAULT;
 		}
 
+		// sticky form values take precedence over saved ones
+		if (isset($sticky_values[$shortname])) {
+			$value = $sticky_values[$shortname];
+		}
+		if (isset($sticky_values['accesslevel'][$shortname])) {
+			$access_id = $sticky_values['accesslevel'][$shortname];
+		}
+
 ?>
 <div>
 	<label><?php echo elgg_echo("profile:{$shortname}") ?></label>
@@ -59,6 +69,9 @@ if (is_array($profile_fields) && count($profile_fields) > 0) {
 <?php
 	}
 }
+
+elgg_clear_sticky_form('profile:edit');
+
 ?>
 <div class="elgg-foot">
 <?php
diff --git a/views/default/input/userpicker.php b/views/default/input/userpicker.php
index 91a397e37..8b64d7df5 100644
--- a/views/default/input/userpicker.php
+++ b/views/default/input/userpicker.php
@@ -63,11 +63,13 @@ foreach ($vars['value'] as $user_id) {
 ?>
 <div class="elgg-user-picker">
 	<input type="text" class="elgg-input-user-picker" size="30"/>
-	<input type="checkbox" name="match_on" value="true" />
-	<label><?php echo elgg_echo('userpicker:only_friends'); ?></label>
+	<label>
+		<input type="checkbox" name="match_on" value="true" />
+		<?php echo elgg_echo('userpicker:only_friends'); ?>
+	</label>
 	<ul class="elgg-user-picker-list"><?php echo $user_list; ?></ul>
 </div>
 <script type="text/javascript">
 	// @todo grab the values in the init function rather than using inline JS
 	elgg.userpicker.userList = <?php echo $json_values ?>;
-</script>
\ No newline at end of file
+</script>
diff --git a/views/default/js/elgg.php b/views/default/js/elgg.php
index 6fe03484d..c3b56e398 100644
--- a/views/default/js/elgg.php
+++ b/views/default/js/elgg.php
@@ -43,7 +43,7 @@ $libs = array(
 
 foreach ($libs as $file) {
 	include("{$CONFIG->path}js/lib/$file.js");
-	// putting a new line between the files to address http://trac.elgg.org/ticket/3081
+	// putting a new line between the files to address https://github.com/elgg/elgg/issues/3081
 	echo "\n";
 }
 
diff --git a/views/default/js/languages.php b/views/default/js/languages.php
index c51d7bcb2..fcf903d4b 100644
--- a/views/default/js/languages.php
+++ b/views/default/js/languages.php
@@ -1,15 +1,33 @@
 <?php
 /**
  * @uses $vars['language']
+ * @uses $vars['lc'] if present, client will be sent long expires headers
  */
-global $CONFIG;
 
 $language = $vars['language'];
+$lastcache = elgg_extract('lc', $vars, 0);
 
-$translations = $CONFIG->translations['en'];
+// @todo add server-side caching
+if ($lastcache) {
+	// we're relying on lastcache changes to predict language changes
+	$etag = '"' . md5("$language|$lastcache") .  '"';
+
+	header('Expires: ' . gmdate('D, d M Y H:i:s \G\M\T', strtotime("+6 months")), true);
+	header("Pragma: public", true);
+	header("Cache-Control: public", true);
+	header("ETag: $etag");
+
+	if (isset($_SERVER['HTTP_IF_NONE_MATCH']) && trim($_SERVER['HTTP_IF_NONE_MATCH']) === $etag) {
+		header("HTTP/1.1 304 Not Modified");
+		exit;
+	}
+}
+
+$all_translations = elgg_get_config('translations');
+$translations = $all_translations['en'];
 
 if ($language != 'en') {
-	$translations = array_merge($translations, $CONFIG->translations[$language]);
+	$translations = array_merge($translations, $all_translations[$language]);
 }
 
 echo json_encode($translations);
\ No newline at end of file
diff --git a/views/default/js/walled_garden.php b/views/default/js/walled_garden.php
index 7a482fe23..e228df507 100644
--- a/views/default/js/walled_garden.php
+++ b/views/default/js/walled_garden.php
@@ -5,12 +5,11 @@
  * @since 1.8
  */
 
-// note that this assumes the button view is not using single quotes
 $cancel_button = elgg_view('input/button', array(
 	'value' => elgg_echo('cancel'),
 	'class' => 'elgg-button-cancel mlm',
 ));
-$cancel_button = trim($cancel_button);
+$cancel_button = json_encode($cancel_button);
 
 if (0) { ?><script><?php }
 ?>
@@ -23,10 +22,11 @@ elgg.walled_garden.init = function () {
 	$('.registration_link').click(elgg.walled_garden.load('register'));
 
 	$('input.elgg-button-cancel').live('click', function(event) {
-		if ($('.elgg-walledgarden-single').is(':visible')) {
+		var $wgs = $('.elgg-walledgarden-single');
+		if ($wgs.is(':visible')) {
 			$('.elgg-walledgarden-double').fadeToggle();
-			$('.elgg-walledgarden-single').fadeToggle();
-			$('.elgg-walledgarden-single').remove();
+			$wgs.fadeToggle();
+			$wgs.remove();
 		}
 		event.preventDefault();
 	});
@@ -42,12 +42,22 @@ elgg.walled_garden.load = function(view) {
 	return function(event) {
 		var id = '#elgg-walledgarden-' + view;
 		id = id.replace('_', '-');
+		//@todo display some visual element that indicates that loading of content is running
 		elgg.get('walled_garden/' + view, {
 			'success' : function(data) {
-				$('.elgg-body-walledgarden').append(data);
-				$(id).find('input.elgg-button-submit').after('<?php echo $cancel_button; ?>');
-				$('#elgg-walledgarden-login').fadeToggle();
-				$(id).fadeToggle();
+				var $wg = $('.elgg-body-walledgarden');
+				$wg.append(data);
+				$(id).find('input.elgg-button-submit').after(<?php echo $cancel_button; ?>);
+
+				if (view == 'register' && $wg.hasClass('hidden')) {
+					// this was a failed register, display the register form ASAP
+					$('#elgg-walledgarden-login').toggle(false);
+					$(id).toggle();
+					$wg.removeClass('hidden');
+				} else {
+					$('#elgg-walledgarden-login').fadeToggle();
+					$(id).fadeToggle();
+				}
 			}
 		});
 		event.preventDefault();
diff --git a/views/default/object/default.php b/views/default/object/default.php
index 110648304..70e098742 100644
--- a/views/default/object/default.php
+++ b/views/default/object/default.php
@@ -41,7 +41,6 @@ $params = array(
 	'title' => $title,
 	'metadata' => $metadata,
 	'subtitle' => $subtitle,
-	'tags' => $vars['entity']->tags,
 );
 $params = $params + $vars;
 $body = elgg_view('object/elements/summary', $params);
diff --git a/views/default/object/elements/full.php b/views/default/object/elements/full.php
index 9b89f9706..b4634fe7e 100644
--- a/views/default/object/elements/full.php
+++ b/views/default/object/elements/full.php
@@ -22,9 +22,9 @@ $summary = elgg_extract('summary', $vars);
 $body = elgg_extract('body', $vars);
 $class = elgg_extract('class', $vars);
 if ($class) {
-	$class = "elgg-content $class";
+	$class = "elgg-content clearfix $class";
 } else {
-	$class = "elgg-content";
+	$class = "elgg-content clearfix";
 }
 
 $header = elgg_view_image_block($icon, $summary);
diff --git a/views/default/object/elements/summary.php b/views/default/object/elements/summary.php
index c0f3ad340..63ab8f816 100644
--- a/views/default/object/elements/summary.php
+++ b/views/default/object/elements/summary.php
@@ -27,7 +27,7 @@ if ($title_link === '') {
 		$text = $entity->name;
 	}
 	$params = array(
-		'text' => $text,
+		'text' => elgg_get_excerpt($text, 100),
 		'href' => $entity->getURL(),
 		'is_trusted' => true,
 	);
diff --git a/views/default/output/access.php b/views/default/output/access.php
index 91c5c721e..5c8d62c4d 100644
--- a/views/default/output/access.php
+++ b/views/default/output/access.php
@@ -11,7 +11,7 @@ if (isset($vars['entity']) && elgg_instanceof($vars['entity'])) {
 	$access_id = $vars['entity']->access_id;
 	$access_class = 'elgg-access';
 	$access_id_string = get_readable_access_level($access_id);
-	$access_id_string = htmlentities($access_id_string, ENT_QUOTES, 'UTF-8');
+	$access_id_string = htmlspecialchars($access_id_string, ENT_QUOTES, 'UTF-8', false);
 
 	// if within a group or shared access collection display group name and open/closed membership status
 	// @todo have a better way to do this instead of checking against subtype / class.
diff --git a/views/default/output/tag.php b/views/default/output/tag.php
index 3e1f1c320..6bd9a72a7 100644
--- a/views/default/output/tag.php
+++ b/views/default/output/tag.php
@@ -8,25 +8,25 @@
  *
  */
 
+if (!empty($vars['type'])) {
+	$type = "&type=" . rawurlencode($vars['type']);
+} else {
+	$type = "";
+}
 if (!empty($vars['subtype'])) {
-	$subtype = "&subtype=" . urlencode($vars['subtype']);
+	$subtype = "&subtype=" . rawurlencode($vars['subtype']);
 } else {
 	$subtype = "";
 }
 if (!empty($vars['object'])) {
-	$object = "&object=" . urlencode($vars['object']);
+	$object = "&object=" . rawurlencode($vars['object']);
 } else {
 	$object = "";
 }
 
 if (isset($vars['value'])) {
+	$url = elgg_get_site_url() . 'search?q=' . rawurlencode($vars['value']) . "&search_type=tags{$type}{$subtype}{$object}";
 	$vars['value'] = htmlspecialchars($vars['value'], ENT_QUOTES, 'UTF-8', false);
-	if (!empty($vars['type'])) {
-		$type = "&type={$vars['type']}";
-	} else {
-		$type = "";
-	}
-	$url = elgg_get_site_url() . 'search?q=' . urlencode($vars['value']) . "&search_type=tags{$type}{$subtype}{$object}";
 	echo elgg_view('output/url', array(
 		'href' => $url,
 		'text' => $vars['value'],
diff --git a/views/default/output/tags.php b/views/default/output/tags.php
index 41fd5f168..db096a3be 100644
--- a/views/default/output/tags.php
+++ b/views/default/output/tags.php
@@ -17,13 +17,18 @@ if (isset($vars['entity'])) {
 	unset($vars['entity']);
 }
 
+if (!empty($vars['type'])) {
+	$type = "&type=" . rawurlencode($vars['type']);
+} else {
+	$type = "";
+}
 if (!empty($vars['subtype'])) {
-	$subtype = "&subtype=" . urlencode($vars['subtype']);
+	$subtype = "&subtype=" . rawurlencode($vars['subtype']);
 } else {
 	$subtype = "";
 }
 if (!empty($vars['object'])) {
-	$object = "&object=" . urlencode($vars['object']);
+	$object = "&object=" . rawurlencode($vars['object']);
 } else {
 	$object = "";
 }
@@ -53,16 +58,11 @@ if (!empty($vars['tags'])) {
 
 	$icon_class = elgg_extract('icon_class', $vars);
 	$list_items = '<li>' . elgg_view_icon('tag', $icon_class) . '</li>';
-
+		
 	foreach($vars['tags'] as $tag) {
-		$tag = htmlspecialchars($tag, ENT_QUOTES, 'UTF-8', false);
-		if (!empty($vars['type'])) {
-			$type = "&type={$vars['type']}";
-		} else {
-			$type = "";
-		}
-		$url = elgg_get_site_url() . 'search?q=' . urlencode($tag) . "&search_type=tags{$type}{$subtype}{$object}";
+		$url = elgg_get_site_url() . 'search?q=' . rawurlencode($tag) . "&search_type=tags{$type}{$subtype}{$object}";
 		if (is_string($tag)) {
+			$tag = htmlspecialchars($tag, ENT_QUOTES, 'UTF-8', false);
 			$list_items .= "<li class=\"$item_class\">";
 			$list_items .= elgg_view('output/url', array('href' => $url, 'text' => $tag, 'rel' => 'tag'));
 			$list_items .= '</li>';
diff --git a/views/default/page/walled_garden.php b/views/default/page/walled_garden.php
index ff8e317c7..b280cf6b2 100644
--- a/views/default/page/walled_garden.php
+++ b/views/default/page/walled_garden.php
@@ -5,6 +5,12 @@
  * Used for the walled garden index page
  */
 
+$is_sticky_register = elgg_is_sticky_form('register');
+$wg_body_class = 'elgg-body-walledgarden';
+if ($is_sticky_register) {
+	$wg_body_class .= ' hidden';
+}
+
 // Set the content type
 header("Content-type: text/html; charset=UTF-8");
 ?>
@@ -18,10 +24,17 @@ header("Content-type: text/html; charset=UTF-8");
 	<div class="elgg-page-messages">
 		<?php echo elgg_view('page/elements/messages', array('object' => $vars['sysmessages'])); ?>
 	</div>
-	<div class="elgg-body-walledgarden">
+	<div class="<?php echo $wg_body_class; ?>">
 		<?php echo $vars['body']; ?>
 	</div>
 </div>
+<?php if ($is_sticky_register): ?>
+<script type="text/javascript">
+elgg.register_hook_handler('init', 'system', function() {
+	$('.registration_link').trigger('click');
+});
+</script>
+<?php endif; ?>
 <?php echo elgg_view('page/elements/foot'); ?>
 </body>
 </html>
\ No newline at end of file
diff --git a/views/default/river/elements/summary.php b/views/default/river/elements/summary.php
index 416bc708b..d7bde51dd 100644
--- a/views/default/river/elements/summary.php
+++ b/views/default/river/elements/summary.php
@@ -18,9 +18,10 @@ $subject_link = elgg_view('output/url', array(
 	'is_trusted' => true,
 ));
 
+$object_text = $object->title ? $object->title : $object->name;
 $object_link = elgg_view('output/url', array(
 	'href' => $object->getURL(),
-	'text' => $object->title ? $object->title : $object->name,
+	'text' => elgg_get_excerpt($object_text, 100),
 	'class' => 'elgg-river-object',
 	'is_trusted' => true,
 ));