v2.0.4

Fourth patch release of Chamilo 2.0. Like 2.0.3, this is mostly a security-focused release, with seventy security fixes: the ONLYOFFICE editor and callback (documents of other courses could be read and saved, and unsigned callbacks were accepted), guessable password reset and confirmation tokens, SQL injection in the session, user and gradebook pages, stricter course and session scoping of resources (forums, assignments, learning paths, glossary, announcements, links, calendar), CSRF tokens and edit-rights checks on destructive actions (learning path items included), ownership checks on exercise attempts, tracking data and survey invitations, path confinement when restoring a course backup, hardening of the link checker (DNS rebinding, private ranges), xAPI LRS and LTI login, output escaping against XSS, neutralized formulas in CSV exports, random passwords for SSO/SCIM-provisioned accounts, and updated dependencies with security advisories. It also fixes forum grading on MySQL 8.4+ and when a thread is graded again, brings back the company reports for student bosses, fixes the saving of learning path progress and the editor's template list, fixes a few calendar and export bugs, makes the installer explain how to solve a server that forbids PCRE JIT (a frequent cause of an HTTP 500 error on start), and brings the automated test suite back in line with Chamilo 2.0.

Chamilo 2.0 is not an actively maintained branch anymore. People using Chamilo 2.0 should migrate as soon as possible to 3.0, which is better in every possible way.