the new version of the validator is static. But it makes sense to use a
single point of entry anyway, so instead of adjusting the use of the new
class, prefer the function.

Various plugins access the form members directly currently.

Adjusted pattern for matching media links to properly handle a single '}' in the link text. Fixes #1587.

If an entry in the loop at `_tpl_metaheaders_action` has no content, skip this entry.

There are still some left in the DifferenceEngine code

This should fix some tests on PHP 7.1. The work is far from done, we
still have a lot of variables without proper accessibility defined.

This change breaks compatibility with php 5.3.7, but a standing
requirement for at least php 5.6 is declared in composer.json.

If the php documentation is to be believed, this change increases
security against pass-the-hash type attacks. (I do not have the knowledge
to assess the security differences between $2a$ and $2y$).

As a Sidenote: htpasswd shipped with apache2 2.4.10 (and probably,
other versions), when used with the -B (=bcrypt) option, produces hashes
marked with $2y$.

Nonewithstanding the actual support or non-support of $2a$ by the
apache2 'AuthUserFile' directive, the apache 2.4 documentation only
asserts support for the $2y$ bcrypt variant.
Therefore, this commit would make it possible for dokuwiki and apache2
basic authentication to share the same password file, in the case when
bcrypt is used.

I supplemented the existing comments on the methods in which there was not enough information to the standard phpDoc.

I supplemented the existing comments on the methods in which there was not enough information to the standard phpDoc.

I supplemented the existing comments on the methods in which there was not enough information to the standard phpDoc.

I supplemented the existing comments on the methods in which there was not enough information to the standard phpDoc.

squashed a whole bunch of PRs

closes #1907
closes #1908
closes #1909
closes #1910
closes #1911
closes #1912
closes #1913
closes #1914
closes #1915
closes #1916
closes #1917
closes #1918
closes #1919
closes #1920
closes #1921
closes #1922

The documentation says sessionIDs are between 22 and 256 chars long. A
quick test only showed 26 chars in common configurations, but this
should cover all possibilities.

When an invalid session ID is passed to PHP a warning is thrown, but the
session is still initialized with this invalid ID (throwing additional
warnings on save).

This makes sure such invalid IDs are removed from the cookie array
before initializing the session.

PHP bug references:

https://bugs.php.net/bug.php?id=68063
https://bugs.php.net/bug.php?id=73860

This partly fixes #1883