fixes Elgg#8898

fix(views): corrected syntax error in input/date

fix(core): Check existence of cache symlink without usage of readlink()

For string params, `serialize_parameters` outputs a string literal of PHP
code, and `addcslashes` was not appropriate for this task, particularly
around escapes in strings. While you can tell it to also escape escape
chars, a second pass would be needed.

The tests now `eval` the output just as the production code does, and
this also makes the tests easier to read.

ref Elgg#10465

chore: canComment inline with parent class

ref Elgg#10312
fixes Elgg#10607

fix(web_services): handle string params with proper escaping

chore(admin): fix plugin dependencies styling issue

When a plugin is (de)activated, the updated plugin list now correctly
shows/hides links to settings pages, and the admin menu is updated
according to the active plugins.

Fixes Elgg#10656

…dler

Without this patch, fetches that occur in a done() handler would not show
the spinner because jQuery's "complete" handler (which fires after) always
stopped the spinner.

The `elgg/Ajax` module was auto-converting any request with `options.data`
to use the `POST` method. This makes sense for things like actions, which
may send a large amount of form data, but it caused `$vars` to not be
populated as expected because only `GET` params are injected.

If you specified `options.data` with these methods before, note the server
will no longer receive this data as `$_POST` on the server.

Fixes Elgg#10667

Relative paths to files that contain special characters in the name
will now be encoded with base64 to avoid malformatted URLs and
HMAC mismatches resulting from unescaped characters.
URLs generated prior to this change will continue working.

Refs Elgg#10608

fix(files): mitigate issues with special chars in file names

fix(ajax): elgg/Ajax view() and form() set $vars as expected

Merge 2.2 into 2.3

…into release-2.3.0

chore(release): v2.3.0

…users

River items about new discussions are once again visible to logged out users.
Discussion replies (but not the form) will be visible as well.

Replaces Elgg#10685

Removes cruft for older PHP versions.

Fixes Elgg#10689

fix(html): elgg_normalize_url() handles tel: links

fix(discussions): river entries are once again visible to logged out …

Fixes Elgg#10696

Fixes Elgg#10699

fix(views): elgg_view_field no longer leaves #type in attributes

fix(views): in table lists, rows now have IDs

chore(license): updated license year to 2017

The new resize lib expects a valid image extension in order to resize an
image. Two problems existed, 1 when an image is uploaded it's stored in
a tmp file without a valid image extension and 2 if called when logged
out the file destination could not be created.

chore(release): v1.12.15

fixes Elgg#10707

Conflicts:
	CHANGELOG.md
	composer.json
	views/default/input/date.php

1.12.15 to 2.2

chore(release): v2.2.4

Detect the correct image format to use for resizing an image based on
supplied output format of mimetype of the source image

fixes Elgg#10686

Conflicts:
	CHANGELOG.md
	composer.json
	docs/locale/pot/about.pot
	docs/locale/pot/admin.pot
	docs/locale/pot/appendix.pot
	docs/locale/pot/contribute.pot
	docs/locale/pot/design.pot
	docs/locale/pot/guides.pot
	docs/locale/pot/index.pot
	docs/locale/pot/intro.pot
	docs/locale/pot/plugins.pot
	docs/locale/pot/tutorials.pot

Icon resize

… embedding images

chore(docs): update helper functions

fixed(uservalidationbyemail): unset emailsent after showing it once

chore(plugins): plugins page properly updates on ajax (de)activate

Problems can occur if a plugin order/activation change is requested while
another change is being executed. This places a semi-opaque cover over the
plugins list while an operation is executing so that the user cannot start
another operation.

This will not prevent the problem for users navigating via keyboard.

Fixes Elgg#10706

fix(admin): prevents simultaneous plugin (de)activation/reordering

chore(docs): updated the release docs

On some Windows systems, `microtime()` is of insufficient precision and
can yield the same value on multiple calls. In our algorithm this results
in a divide-by-zero error and a `$rounds` count of `0`, so a little extra
entropy is lost. There are numerous other entropy sources tapped, so this
isn't a serious flaw, but here we avoid the error and just fix `$rounds`
to a reasonable value to pick up a little more entropy.

This issue should affect few systems, as it's a fallback mechanism for
several better random sources.

This also adds PHP7's `random_bytes` as the first source.

Fixes Elgg#10750

fixes Elgg#10754

2.2 to 2.3

fix(security): random byte generation improved on some systems

This was accidentally changed in Elgg#9522, which overhauled menu creation
for Elgg 2.2.

Fixes Elgg#10737

fix(menus): return to default of sorting menus by text

fix(embed): Inserting medium thumbnail size again instead of small on embedding images

fixes Elgg#10710

fixed(comments): use elgg/Ajax to load inline comment form

fix(access): use ignore access only when querying the database

chore(composer): update dependencies and regenerate lock

chore(release): v2.3.1

…paces

Our use of `filter_var()`/`FILTER_VALIDATE_URL` can now handle multibyte chars.

Previous Elgg versions passed through invalid URLs that contained spaces. Since
even core code created these URLs, we compromise by auto-encoding spaces rather
than rejecting those URLs.

Fixes Elgg#10771

If the destination URL has a hash, and the whole URL is identical
to the current page, we must force `reload()`.

Documents current practice and legacy issue for older systems.

Fixes Elgg#10778

docs(security): explains current password hashing

…casting

Metadata/annotation casting is now explained in the docs.

Deprecates `detect_extender_valuetype()` and moves its logic to a static
`ElggExtender` method.

Fixes Elgg#10749

fixes Elgg#7740, fixes Elgg#9329

fix(install): explicitly allow .well-known in rewrite rules

Devs who refactor `elgg_delete_river()` code to use `elgg_get_river()`
may be surprised that it doesn't support this option.

Fixes Elgg#10791

chore(river): warn devs that elgg_get_river() has no "views" option

Now uses a temporary files to store raw icon bytes

Fixes 10686

fix(js): make sure elgg.forward() always reloads the page

fix(output): elgg_normalize_url() again handles multibyte chars and spaces

fixes: Elgg#10798

perf(db): improved performance of disable/delete of an entity

deprecate(logging): removes warnings about metadata/annotation value casting

fix(twitter_api): do not feed remote URLs to icon resize API

chore(release): v2.3.2