- Narrow the set of allowed usernames to prevent people from messing with it.

- Bugfix: made request_uri() rewrite ( and ) with their entity equivalents
  to avoid XSS attacks!  Patch by Al, Moshe, Marco, Kjartan and me.

- Fixed a warning. Patch by Jacobo Tarrio.

Back-ported to the DRUPAL-4-1-0 branch:

- Only export the "who is online" block when the access log is enabled.
  Patch by Al.  Fixed bug #1692.

- Only export the "top nodes" block when the node counters are enabled.

- Back-ported the stripslashes patch.  By Kobus and Gerhard. This needs a
  bit of testing but if all works well, please close bug #1495.

    -    case t("whatever");
    +    case t("whatever"):

- Backported patch from Al.  Removed 'width="100%"' attributes from
  table tags.

  "IE has a bug with tables inside divs with width=100%. I see no reason why
  the forum tables should be 100% - they are pretty much naturally padded to
  100% as soon as anyone puts any content in them. Removing them doesn't
  affect functionality and improves layout compatibility on IE."

- Display the user roles on the user listing pages.  Patch by Shane with some
  modification(s) by Ax.

- Refactored the import module: it will now use PHP's built-in XML parser
rather then a set of regular expressions.  Solves Debian bug #184252:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=184252

- Fixes some invalid db_query_range() queries.  This solves bug #1287:
http://drupal.org/node/view/1387

- Fixed the use of '%d' and '%s' in some queries.

- Fixed some translation bugs.

- Improved error/status reporting.

- Another improvement to the e-mail address validation code.  Fixed Debian
  bug #185217.  Patch by Gerhard.

- Rollback: do not initialize the theme before initializing the user.

- When loading a theme that is obviously broken, fall back onto the example
  theme instead of /showing/ a blank page.

- Fixed typo: 'writeable' -> 'writable'

- Fixed typo: 'offtopic' -> 'off topic'

- Fixed a CSS glitch.  Thanks Al.

- The name of a forum node is a "forum topic", not a "discussion forum".

- Fixed off by one error.  A forgotten patch.

- Use "AND" instead of "&&" in SQL queries to make Drupal work on
  PostgreSQL.  Based on a patch by Neil Ernst.

- Patch by Neil Ernst: 4.1.0 produces a PostgreSQL error when trying to insert into the statistics table.  The problem is detailed on the pgsql docs "A column can be referenced in the form: correlation.columnname `['subscript`]' where correlation is either the name of a table, an alias for a table defined by means of a FROM clause, or the key words NEW or OLD."  The old version merely used the column name without qualification.

(Fixed some additional directives.)

- Fixed "SELECT lid, FROM locales WHERE string = 'Reset to defaults'" problem:
  invoke module_init() *after* the locale module has been initialized.  The
  system module was translating string from within its init hook which is now
  possible/allowed.

- Bugfix: there was an errant </a> tag with no opening tag.  Patch by Al.
  Backported from CVS to stable 4.1.0 branch.

- Bugfix: transparent session ID handling wasn't working properly with
  drupal_goto().  Patch by Al.  Backported from CVS to stable 4.1.0 branch.

  consisting of hyphens only.  Patch by Zbynek.

- Changed '%s' into '%d' such that an empty $user->uid is converted to 0.  Required for Drupal to work on new versions of PostgreSQL.  Patch by James.

- Changed '%s' into '%d' such that an empty $user->uid is converted to 0.  Requi
red for Drupal to work on new versions of PostgreSQL.  Patch by James.

- Changed '%s' into '%d' such that an empty $user->uid is converted to 0.  Required for Drupal to work on new versions of PostgreSQL.  Patch by James.

- Small patch by James.

- Fixed bug #1133: disabled comments are no longer shown.  Thanks Gerhard.

- Removed redundant code.

- Fixed typo: '$node->nide' -> '$node->nid'.  Patch by Alastair.

- Changed "Allow HTML tags" to "Filter HTML tags" for clarity.  Reported by
  Ax.

- Corrected misplaced quote.  Reported by Gerhard.

- Fixed bug #893.  Patch by Ax.

- Fixed bug #698: initialize $output.