RemoteAPICore
- visibility methods
- getAttachmentInfo returns modification date of deleted files
- pageVersions returns only current revision (once) if $first=0.
Adresses issue mentioned at #1550
- added unittests
- updated API number

Fixes #714

Fixes #713

This `$conf['pluginmanager']` setting was especially for disabling of
pluginmanager in farms. (see also commit c45608df )

remaining folders with .disabled in the foldername are displayed in
extension manager with rename warning.

Close #1323

Textareas use CRLF, but internally we use LF.

@scrutinizer-notifier noticed that the $pageid might be false when
page_findnearest looks for it.

As in wikiFN cleaning the id should be optional, but still the default, in mediaFN as well.

when a form was submitted with an empty input, that data should still
overwrite the preset value.

This is a security measurement supported in Chrome and Opera (and
probably other browsers soonish)

See http://mathiasbynens.github.io/rel-noopener/ for rationale

This adds 3way merge functionality to our DifferenceEngine stack. The
code was taken from the PEAR Text_Diff3 package and adapted to work with
our implementation.

For the curious:
Here's a short Origin tree of the different versions of the Diff code to
make clear how our implementation is related to the PEAR package.

-- original code Geoffrey T. Dairiki
   `-- Adaption for the Horde project
       |-- Adaption for phpwiki
       |   `-- Adaption for MediaWiki
       |       `-- Adaption for DokuWiki
       `-- Creation of PEAR Text_Diff

This should fix the test problems errors in #1527. When requesting a
HTTPS URI from a HTTP only proxy, the initial connection is *not* TLS
secured. The URI scheme is only relevant when directly connecting.

This also changes the (wrong) assumption that everything on port 443 is
always TLS secured. Only the URI scheme should decide that.

This is to ensure that we use SSL/TLS if a custom port is defined an no
proxy is used.

Fixes #1526

The header() method of PHP is vulnerable to HTTP Response Splitting
attacks.

This change makes sure the URL passed to send_redirect (and thus to
header()) does not contain any control characters that would be needed
to execute such an attack.

Cleaning input is recommended anyway.

- handle all cases where not an old file exist, or when that old file is
zero size.
- When using old revision normally these files are compressed, use
uncompressed size.

A bz2-file doesn't contain information about the size of its
uncompressed content. Therefore it requires reading the whole file to
obtain the filesize.

New Python Django application default to PBKDF2 with SHA256 as a
password mechanism. This adds support for that mechanism in our
password hasher class. This will be needed in the tests for the new
PDO auth plugin.