9 files changed, 67 insertions, 20 deletions
diff --git a/phpBB/phpbb/avatar/driver/upload.php b/phpBB/phpbb/avatar/driver/upload.php
index e44157294c..cb8dfcad4f 100644
--- a/phpBB/phpbb/avatar/driver/upload.php
+++ b/phpBB/phpbb/avatar/driver/upload.php
@@ -167,17 +167,29 @@ class upload extends \phpbb\avatar\driver\driver
 			$destination = '';
 		}
 
+		$filedata = array(
+			'filename'			=> $file->get('filename'),
+			'filesize'			=> $file->get('filesize'),
+			'mimetype'			=> $file->get('mimetype'),
+			'extension'			=> $file->get('extension'),
+			'physical_filename'	=> $file->get('realname'),
+			'real_filename'		=> $file->get('uploadname'),
+		);
+
 		/**
 		* Before moving new file in place (and eventually overwriting the existing avatar with the newly uploaded avatar)
 		*
 		* @event core.avatar_driver_upload_move_file_before
+		* @var	array	filedata			Array containing uploaded file data
 		* @var	string	destination			Destination directory where the file is going to be moved
 		* @var	string	prefix				Prefix for the avatar filename
 		* @var	array	row					Array with avatar row data
 		* @var	array	error				Array of errors, if filled in by this event file will not be moved
 		* @since 3.1.6-RC1
+		* @changed 3.1.9-RC1 Added filedata
 		*/
 		$vars = array(
+			'filedata',
 			'destination',
 			'prefix',
 			'row',
@@ -185,6 +197,8 @@ class upload extends \phpbb\avatar\driver\driver
 		);
 		extract($this->dispatcher->trigger_event('core.avatar_driver_upload_move_file_before', compact($vars)));
 
+		unset($filedata);
+
 		if (!sizeof($error))
 		{
 			// Move file and overwrite any existing image
diff --git a/phpBB/phpbb/captcha/plugins/qa.php b/phpBB/phpbb/captcha/plugins/qa.php
index 2771369e57..8f2da838c5 100644
--- a/phpBB/phpbb/captcha/plugins/qa.php
+++ b/phpBB/phpbb/captcha/plugins/qa.php
@@ -100,6 +100,28 @@ class qa
 			$db->sql_freeresult($result);
 		}
 
+		// final fallback to any language
+		if (!sizeof($this->question_ids))
+		{
+			$this->question_lang = '';
+
+			$sql = 'SELECT q.question_id, q.lang_iso
+				FROM ' . $this->table_captcha_questions . ' q, ' . $this->table_captcha_answers . ' a
+				WHERE q.question_id = a.question_id
+				GROUP BY lang_iso';
+			$result = $db->sql_query($sql, 7200);
+
+			while ($row = $db->sql_fetchrow($result))
+			{
+				if (empty($this->question_lang))
+				{
+					$this->question_lang = $row['lang_iso'];
+				}
+				$this->question_ids[$row['question_id']] = $row['question_id'];
+			}
+			$db->sql_freeresult($result);
+		}
+
 		// okay, if there is a confirm_id, we try to load that confirm's state. If not, we try to find one
 		if (!$this->load_answer() && (!$this->load_confirm_id() || !$this->load_answer()))
 		{
@@ -198,10 +220,12 @@ class qa
 	*/
 	function get_template()
 	{
-		global $template;
+		global $phpbb_log, $template, $user;
 
-		if ($this->is_solved())
+		if ($this->is_solved() || empty($this->question_text) || !count($this->question_ids))
 		{
+			/** @var \phpbb\log\log_interface $phpbb_log */
+			$phpbb_log->add('critical', $user->data['user_id'], $user->ip, 'LOG_ERROR_CAPTCHA', time(), array($user->lang('CONFIRM_QUESTION_MISSING')));
 			return false;
 		}
 		else
@@ -364,13 +388,15 @@ class qa
 	*/
 	function validate()
 	{
-		global $user;
+		global $phpbb_log, $user;
 
 		$error = '';
 
 		if (!sizeof($this->question_ids))
 		{
-			return false;
+			/** @var \phpbb\log\log_interface $phpbb_log */
+			$phpbb_log->add('critical', $user->data['user_id'], $user->ip, 'LOG_ERROR_CAPTCHA', time(), array($user->lang('CONFIRM_QUESTION_MISSING')));
+			return $user->lang('CONFIRM_QUESTION_MISSING');
 		}
 
 		if (!$this->confirm_id)
diff --git a/phpBB/phpbb/controller/helper.php b/phpBB/phpbb/controller/helper.php
index 79378c2434..08a63639b9 100644
--- a/phpBB/phpbb/controller/helper.php
+++ b/phpBB/phpbb/controller/helper.php
@@ -102,12 +102,13 @@ class helper
 	* @param bool $display_online_list Do we display online users list
 	* @param int $item_id Restrict online users to item id
 	* @param string $item Restrict online users to a certain session item, e.g. forum for session_forum_id
+	* @param bool $send_headers Whether headers should be sent by page_header(). Defaults to false for controllers.
 	*
 	* @return Response object containing rendered page
 	*/
-	public function render($template_file, $page_title = '', $status_code = 200, $display_online_list = false, $item_id = 0, $item = 'forum')
+	public function render($template_file, $page_title = '', $status_code = 200, $display_online_list = false, $item_id = 0, $item = 'forum', $send_headers = false)
 	{
-		page_header($page_title, $display_online_list, $item_id, $item);
+		page_header($page_title, $display_online_list, $item_id, $item, $send_headers);
 
 		$this->template->set_filenames(array(
 			'body'	=> $template_file,
@@ -115,7 +116,9 @@ class helper
 
 		page_footer(true, false, false);
 
-		return new Response($this->template->assign_display('body'), $status_code);
+		$headers = !empty($this->user->data['is_bot']) ? array('X-PHPBB-IS-BOT' => 'yes') : array();
+
+		return new Response($this->template->assign_display('body'), $status_code, $headers);
 	}
 
 	/**
diff --git a/phpBB/phpbb/db/driver/driver.php b/phpBB/phpbb/db/driver/driver.php
index 1b49775b32..01dd66cd6e 100644
--- a/phpBB/phpbb/db/driver/driver.php
+++ b/phpBB/phpbb/db/driver/driver.php
@@ -897,6 +897,7 @@ abstract class driver implements driver_interface
 					<html dir="ltr">
 					<head>
 						<meta charset="utf-8">
+						<meta http-equiv="X-UA-Compatible" content="IE=edge">
 						<title>SQL Report</title>
 						<link href="' . htmlspecialchars($phpbb_path_helper->update_web_root_path($phpbb_root_path) . $phpbb_path_helper->get_adm_relative_path()) . 'style/admin.css" rel="stylesheet" type="text/css" media="screen" />
 					</head>
diff --git a/phpBB/phpbb/db/migration/data/v310/passwords_convert_p1.php b/phpBB/phpbb/db/migration/data/v310/passwords_convert_p1.php
index aad8e44681..295f2d2a14 100644
--- a/phpBB/phpbb/db/migration/data/v310/passwords_convert_p1.php
+++ b/phpBB/phpbb/db/migration/data/v310/passwords_convert_p1.php
@@ -56,19 +56,16 @@ class passwords_convert_p1 extends \phpbb\db\migration\migration
 			{
 				// Use $CP$ prefix for passwords that need to
 				// be converted and set pass convert to false.
-				$update_users[$user_id] = array(
-					'user_password'		=> '$CP$' . $row['user_password'],
-					'user_pass_convert'	=> 0,
-				);
+				$update_users[$user_id] = '$CP$' . $row['user_password'];
 			}
 		}
 		$this->db->sql_freeresult($result);
 
-		foreach ($update_users as $user_id => $user_data)
+		foreach ($update_users as $user_id => $user_password)
 		{
-			$sql = 'UPDATE ' . $this->table_prefix . 'users
-				SET ' . $this->db->sql_build_array('UPDATE', $user_data) . '
-				WHERE user_id = ' . $user_id;
+			$sql = 'UPDATE ' . $this->table_prefix . "users
+				SET user_password = '" . $this->db->sql_escape($user_password) . "'
+				WHERE user_id = $user_id";
 			$this->sql_query($sql);
 		}
 
diff --git a/phpBB/phpbb/notification/manager.php b/phpBB/phpbb/notification/manager.php
index db92170dd8..222d9fe9e6 100644
--- a/phpBB/phpbb/notification/manager.php
+++ b/phpBB/phpbb/notification/manager.php
@@ -186,6 +186,7 @@ class manager
 		if (!$options['count_total'] || $total_count)
 		{
 			$rowset = array();
+			$selected_unread_count = 0;
 
 			// Get the main notifications
 			$sql = 'SELECT n.*, nt.notification_type_name
@@ -200,11 +201,12 @@ class manager
 			while ($row = $this->db->sql_fetchrow($result))
 			{
 				$rowset[$row['notification_id']] = $row;
+				$selected_unread_count += (int) !$row['notification_read'];
 			}
 			$this->db->sql_freeresult($result);
 
 			// Get all unread notifications
-			if ($unread_count && $options['all_unread'] && !empty($rowset))
+			if ($selected_unread_count < $unread_count && $options['all_unread'] && !empty($rowset))
 			{
 				$sql = 'SELECT n.*, nt.notification_type_name
 				FROM ' . $this->notifications_table . ' n, ' . $this->notification_types_table . ' nt
@@ -923,6 +925,8 @@ class manager
 	{
 		$notification_type_ids = $this->cache->get('notification_type_ids');
 
+		$this->db->sql_transaction('begin');
+
 		if ($notification_type_ids === false)
 		{
 			$notification_type_ids = array();
@@ -957,6 +961,8 @@ class manager
 			$this->cache->put('notification_type_ids', $notification_type_ids);
 		}
 
+		$this->db->sql_transaction('commit');
+
 		return $notification_type_ids[$notification_type_name];
 	}
 
diff --git a/phpBB/phpbb/notification/method/messenger_base.php b/phpBB/phpbb/notification/method/messenger_base.php
index c3aee088f9..3c6d617c66 100644
--- a/phpBB/phpbb/notification/method/messenger_base.php
+++ b/phpBB/phpbb/notification/method/messenger_base.php
@@ -74,14 +74,14 @@ abstract class messenger_base extends \phpbb\notification\method\base
 				continue;
 			}
 
-			$messenger->template($template_dir_prefix . $notification->get_email_template(), $user['user_lang']);
+			$messenger->template($notification->get_email_template(), $user['user_lang'], '', $template_dir_prefix);
 
 			$messenger->set_addresses($user);
 
 			$messenger->assign_vars(array_merge(array(
 				'USERNAME'						=> $user['username'],
 
-				'U_NOTIFICATION_SETTINGS'		=> generate_board_url() . '/ucp.' . $this->php_ext . '?i=ucp_notifications',
+				'U_NOTIFICATION_SETTINGS'		=> generate_board_url() . '/ucp.' . $this->php_ext . '?i=ucp_notifications&amp;mode=notification_options',
 			), $notification->get_email_template_variables()));
 
 			$messenger->send($notify_method);
diff --git a/phpBB/phpbb/recursive_dot_prefix_filter_iterator.php b/phpBB/phpbb/recursive_dot_prefix_filter_iterator.php
index 2500ba0cf8..1446551b8b 100644
--- a/phpBB/phpbb/recursive_dot_prefix_filter_iterator.php
+++ b/phpBB/phpbb/recursive_dot_prefix_filter_iterator.php
@@ -25,6 +25,6 @@ class recursive_dot_prefix_filter_iterator extends \RecursiveFilterIterator
 	public function accept()
 	{
 		$filename = $this->current()->getFilename();
-		return !$this->current()->isDir() || $filename[0] !== '.';
+		return $filename[0] !== '.' || !$this->current()->isDir();
 	}
 }
diff --git a/phpBB/phpbb/user.php b/phpBB/phpbb/user.php
index f5ad5096bb..faedd79703 100644
--- a/phpBB/phpbb/user.php
+++ b/phpBB/phpbb/user.php
@@ -725,7 +725,7 @@ class user extends \phpbb\session
 			$utc = new \DateTimeZone('UTC');
 		}
 
-		$time = new $this->datetime($this, "@$gmepoch", $utc);
+		$time = new $this->datetime($this, '@' . (int) $gmepoch, $utc);
 		$time->setTimezone($this->timezone);
 
 		return $time->format($format, $forcedate);