#28776 by Uwe Hermann, Morbus Iff, jvandyk: Protect *.test files and SVN metafiles from being exposed under Drupal

#280934 follow up by pwolanin: harden the cookie handling in sess_regenerate() by setting our session cookie to be an HTTP only cookie, thus reducing the risk of session stealing via XSS

#324875 by pwolanin: improve HTTP_HOST checking, ensuring that the host is lowercased and only valid characters are allowed.

- Patch #335385 by Dave Reid: fixed maxlength of path alias fields to be consistent with the database.

#302638 by pwolanin: avoid running several no-op queries while the menu is being rebuilt; improves performance

#329660 by pwolanin: node_configure_validate() should be replaced with a #submit handler to conform to FormAPI rules

#255150 by dropcube, tested by catch, asimmonds: content type names were double escaped on create content page

#258089 by JohnAlbin, Arancaytar, merlinofchaos: themes cannot have a preprocess function without a corresponding .tpl.php file

#315739 by sun: The theme name is in arg(4) on the block admin page, so only redirect to theme specific page if that is set.

#249571 by pwolanin: Primary/secondary links did not get the 'active-trail' class properly on the list items

- Patch #302518 by AlexisWilke: fixed problem with PostgreSQL users not being able to delete blocks.

#293612 by egfrith, Bart Jansens: let user_authenticate() be called without cookies previously set; allows web service modules to start a session with the authentication

#320146 by pwolanin: little usability tweak to link the site offline admin message to the maintenance settings page

#20527 by mpare, bdragon, mfb: file_transfer() should only call ob_end_clean() if there was an actual output buffer opened

#295626 by Damien Tournoud, wuf31, drewish: locale_block() generated incorrect paths for frontpage links

#319769 reported by Pasqualle, patch by Dave Reid: drupal_init_language() should be called before drupal_maintenance_theme() in _db_error_page() to ensure that the language object exists on DB error pages.