Merge remote-tracking branch 'origin/3.0' into 3.1

Conflicts:
	docs/en/changelogs/3.0.6.md
	forms/Form.php
	forms/FormField.php
	forms/TreeDropdownField.php

docs/en/changelogs/3.0.6.md

@@ -1,4 +1,4 @@
-# 3.0.6 (Not yet released)
+# 3.0.6
 
 ## Overview
 
@@ -23,6 +23,10 @@ See [announcement](http://www.silverstripe.org/ss-2013-004-privilege-escalation-
 
 See [announcement](http://www.silverstripe.org/ss-2013-005-privilege-escalation-through-apply-roles-assignment/)
 
+### Security: Information disclosure in Versioned.php (SS-2013-006)
+
+See [announcement](http://www.silverstripe.org/ss-2013-006-information-disclosure-in-versioned/)
+
 ### Security: Privilege escalation through Group hierarchy setting (SS-2013-003)
 
 See [announcement](http://www.silverstripe.org/ss-2013-003-privilege-escalation-through-group-hierarchy-setting/)

docs/en/changelogs/3.0.7.md

@@ -0,0 +1,17 @@
+# 3.0.7
+
+## Overview
+
+### Security: XSS in form validation errors (SS-2013-008)
+
+See [announcement](http://www.silverstripe.org/ss-2013-008-xss-in-numericfield-validation/)
+
+### Security: XSS in CMS "Pages" section (SS-2013-009)
+
+See [announcement](http://www.silverstripe.org/ss-2013-009-xss-in-cms-pages-section/)
+
+### API: Form validation message no longer allow HTML
+
+Due to cross-site scripting concerns when user data is used for form messages,
+it is no longer possible to use HTML in `Form->sessionMessage()`, and consequently
+in the `FormField->validate()` API.

docs/en/changelogs/rc/3.0.7-rc1.md

@@ -0,0 +1,17 @@
+# 3.0.7-rc1
+
+## Overview
+
+### Security: XSS in form validation errors (SS-2013-008)
+
+See [announcement](http://www.silverstripe.org/ss-2013-008-xss-in-numericfield-validation/)
+
+### Security: XSS in CMS "Pages" section (SS-2013-009)
+
+See [announcement](http://www.silverstripe.org/ss-2013-009-xss-in-cms-pages-section/)
+
+### API: Form validation message no longer allow HTML
+
+Due to cross-site scripting concerns when user data is used for form messages,
+it is no longer possible to use HTML in `Form->sessionMessage()`, and consequently
+in the `FormField->validate()` API.

docs/en/topics/versioning.md

@@ -81,7 +81,7 @@ but also include information about when and how a record was published.
 	:::php
 	$record = MyRecord::get()->byID(99); // stage doesn't matter here
 	$versions = $record->allVersions();
-	echo $versions->First()->Version; // instance of Versioned_Versoin
+	echo $versions->First()->Version; // instance of Versioned_Version
 
 ### Writing Versions and Changing Stages
 

forms/CreditCardField.php

@@ -35,6 +35,9 @@ class CreditCardField extends TextField {
 	 * @return string
 	 */
 	protected function getTabIndexHTML($increment = 0) {
+		// we can't add a tabindex if there hasn't been one set yet.
+		if($this->getAttribute('tabindex') === null) return false;
+
 		$tabIndex = (int)$this->getAttribute('tabindex') + (int)$increment;
 		return (is_numeric($tabIndex)) ? ' tabindex = "' . $tabIndex . '"' : '';
 	}