- Patch #262920 by ainigma32: language selection for domain should look at HTTP_HOST not SERVER_NAME.

#245990 by Dave Reid, chx, dww: Look for the www.example.com page when a HTTP request seems to fail. Looking for the local page caused problems for people with interactive authentication, redirects, hosting added JavaScript code, and so on.

#345167 by JacobSingh, pwolanin, Heine: drupal_http_request() includes an extra CRLF, not conformant to HTTP specs

#276111 by pwolanin, meba and myself: disallow possibly dangerous submissions in locale translations and imports

#333060 by neclimdul, merlinofchaos, dvessel: child themes did not inherit patterns correctly, so more specific template files are not detected

#299582 by hass: Remove outdated items from robots.txt and fix ordering of items to make stuff easier to find.

#28776 by Uwe Hermann, Morbus Iff, jvandyk: Protect *.test files and SVN metafiles from being exposed under Drupal

#280934 follow up by pwolanin: harden the cookie handling in sess_regenerate() by setting our session cookie to be an HTTP only cookie, thus reducing the risk of session stealing via XSS

#324875 by pwolanin: improve HTTP_HOST checking, ensuring that the host is lowercased and only valid characters are allowed.

- Patch #335385 by Dave Reid: fixed maxlength of path alias fields to be consistent with the database.

#302638 by pwolanin: avoid running several no-op queries while the menu is being rebuilt; improves performance

#329660 by pwolanin: node_configure_validate() should be replaced with a #submit handler to conform to FormAPI rules

#255150 by dropcube, tested by catch, asimmonds: content type names were double escaped on create content page

#258089 by JohnAlbin, Arancaytar, merlinofchaos: themes cannot have a preprocess function without a corresponding .tpl.php file

#315739 by sun: The theme name is in arg(4) on the block admin page, so only redirect to theme specific page if that is set.