Merge remote-tracking branch 'origin/3.1' into 3.2

Conflicts:
	admin/code/GroupImportForm.php
	admin/code/MemberImportForm.php
	tests/model/DataListTest.php

dev/install/config-form.html

@@ -201,14 +201,14 @@
 									<div class="field">	
 										<label for="admin_username">Email:</label>
 										<span class="middleColumn">
-											<input type="text" class="text configured-by-env" name="admin[username]" id="admin_username" value="<?php echo $adminConfig['username']; ?>" <?php if($usingEnv && defined('SS_DEFAULT_ADMIN_USERNAME')) echo 'disabled="disabled"' ?>>
+											<input type="text" class="text configured-by-env" name="admin[username]" id="admin_username" value="<?php echo htmlspecialchars($adminConfig['username'], ENT_QUOTES, 'UTF-8'); ?>" <?php if($usingEnv && defined('SS_DEFAULT_ADMIN_USERNAME')) echo 'disabled="disabled"' ?>>
 										</span>
 									</div>
 									
 									<div class="field">
 										<label for="admin_password">Password:</label>
 										<span class="middleColumn">
-											<input type="password" class="text configured-by-env" name="admin[password]" id="admin_password" value="<?php echo $adminConfig['password']; ?>" <?php if($usingEnv && defined('SS_DEFAULT_ADMIN_PASSWORD')) echo 'disabled="disabled"' ?>>
+											<input type="password" class="text configured-by-env" name="admin[password]" id="admin_password" value="<?php echo htmlspecialchars($adminConfig['password'], ENT_QUOTES, 'UTF-8'); ?>" <?php if($usingEnv && defined('SS_DEFAULT_ADMIN_PASSWORD')) echo 'disabled="disabled"' ?>>
 										</span>
 									</div>
 								</div>

docs/en/04_Changelogs/3.1.14.md

@@ -0,0 +1,49 @@
+# 3.1.14
+
+<!--- Changes below this line will be automatically regenerated -->
+
+## Change Log
+
+### Security
+
+ * 2015-09-07 [d8fd64c](https://github.com/silverstripe/silverstripe-framework/commit/d8fd64c3e25dbf500615ecbbe9580e234e1730d4) Fix XSS in install.php (Damian Mooyman) - See [ss-2015-016](http://www.silverstripe.org/software/download/security-releases/ss-2015-016)
+ * 2015-09-07 [7192932](https://github.com/silverstripe/silverstripe-framework/commit/7192932022510d830d1fc2373a9edb80fee24f48) Fix insecure returnURL in DatabaseAdmin (Damian Mooyman) - See [ss-2015-015](http://www.silverstripe.org/software/download/security-releases/ss-2015-015)
+ * 2015-09-07 [7367cf5](https://github.com/silverstripe/silverstripe-framework/commit/7367cf54c4069a8e296fafb511fb28e27a8efd7e) Prevent possible Privilege escalation (Damian Mooyman) - See [ss-2015-020](http://www.silverstripe.org/software/download/security-releases/ss-2015-020)
+
+### API Changes
+
+ * 2015-01-28 [782c4cb](https://github.com/silverstripe/silverstripe-framework/commit/782c4cbf6f5cde2fa4d45cdbd17552773a67f88f) Enable single-column fulltext filter search as fallback (Damian Mooyman)
+
+### Bugfixes
+
+ * 2015-09-07 [45b22c7](https://github.com/silverstripe/silverstripe-framework/commit/45b22c788eeb5d7501844ceb19395cc4e15e61b6) Fix missing framework/admin/tests (Damian Mooyman)
+ * 2015-08-27 [899eb0b](https://github.com/silverstripe/silverstripe-framework/commit/899eb0b235859c843890c790e99c03f4fd4b825c) Use complete fieldlist for extracting data (Daniel Hensby)
+ * 2015-08-26 [2d4b743](https://github.com/silverstripe/silverstripe-framework/commit/2d4b743090935e7c10bd95e00398df7bfb5763af) Members can access their own profiles in CMS (Daniel Hensby)
+ * 2015-08-26 [0943b3b](https://github.com/silverstripe/silverstripe-framework/commit/0943b3b1a06e6c9130500532fd979c720b65c761) Recursion errors when sorting objects with circular dependencies (fixes #4464) (Loz Calver)
+ * 2015-08-20 [fc212e0](https://github.com/silverstripe/silverstripe-framework/commit/fc212e030c474d966ffb1821423ddcb3ae361b72) Fix illegalExtensions breaking tests. (Damian Mooyman)
+ * 2015-08-18 [8b638f5](https://github.com/silverstripe/silverstripe-framework/commit/8b638f56fb737dac18126c291297c87469eb7d0f) Using undefined var in ModelAdmin (Loz Calver)
+ * 2015-07-26 [5f5ce8a](https://github.com/silverstripe/silverstripe-framework/commit/5f5ce8a82c2bb1a29f9f8b7011d5cd990c34f128) Disable cache to prevent caching of build target (Damian Mooyman)
+ * 2015-07-16 [a3201d6](https://github.com/silverstripe/silverstripe-framework/commit/a3201d6ed9967179aa020802e6fb88d2a6a0e37e) $callerClass is undefined (Christopher Darling)
+ * 2015-07-08 [c7bd504](https://github.com/silverstripe/silverstripe-framework/commit/c7bd50427a4e0ad446502547b81648d78d354062) Fix cookie errors when running in CLI (Damian Mooyman)
+ * 2015-07-07 [5ace490](https://github.com/silverstripe/silverstripe-framework/commit/5ace4905c90be1373f49dbb0e1a579b279786a1c) Fix issue when SS_ALLOWED_HOSTS is run in CLI (Damian Mooyman)
+ * 2015-07-05 [a556b48](https://github.com/silverstripe/silverstripe-framework/commit/a556b4854a44b9dfe86c40140ec03d781d354d19) Fix of multiple i18nTextCollector issues: #3797, #3798, #3417 (Damian Mooyman)
+ * 2015-07-01 [6fabd01](https://github.com/silverstripe/silverstripe-framework/commit/6fabd0122be37faa671923b534a74e5684d58220) Fix potential XSS injection (Damian Mooyman)
+ * 2015-06-26 [d78d325](https://github.com/silverstripe/silverstripe-cms/commit/d78d3250736c5d2f48c5cfc1690fba8b98cc222b) RedirectorPage_Controller shouldn't attempt redirection if the response is finished (fixes #1230) (Loz Calver)
+ * 2015-06-18 [f7f92b3](https://github.com/silverstripe/silverstripe-installer/commit/f7f92b32260f31a5969dde4b1d8c55d81c289056) Invalid comment syntax for web.config (Daniel Hensby)
+ * 2015-06-16 [6169bf2](https://github.com/silverstripe/silverstripe-framework/commit/6169bf2760366b0aebf255c973803621472ce1fb) No longer caching has_one after ID change (Daniel Hensby)
+ * 2015-06-11 [6be0488](https://github.com/silverstripe/silverstripe-framework/commit/6be04887315522e5b95b83be1e301691441b985c) TreeDropdownField doesnt change label on unselect (Daniel Hensby)
+ * 2015-05-28 [0319f78](https://github.com/silverstripe/silverstripe-framework/commit/0319f7855bc4e8a6eb71d2766ac24a7d760d502e) Incorrect env setting in 3.1.13 (Damian Mooyman)
+ * 2015-05-22 [e0710ae](https://github.com/silverstripe/silverstripe-framework/commit/e0710ae4e4a03c191b841cc45a6c103a0e21ec7f) Fix DirectorTest failing when run with sake (Damian Mooyman)
+ * 2015-05-20 [94f6a13](https://github.com/silverstripe/silverstripe-framework/commit/94f6a137297d6638065583c388dffeeb9eccb55b) Fixed setting LastEdited for DataObject with class ancestry (Gregory Smirnov)
+ * 2015-05-20 [869e69a](https://github.com/silverstripe/silverstripe-framework/commit/869e69a9b2c1352e1fa6246432d9180eb81cf7e3) Clicking icon in site tree link fails (Jonathon Menz)
+ * 2015-05-20 [f9bdf61](https://github.com/silverstripe/silverstripe-framework/commit/f9bdf61b6f4cdd2f55ff2729a5b6be0a200f876a) Fixed handling of numbers in certain locales (Gregory Smirnov)
+ * 2015-05-19 [dbe2ad4](https://github.com/silverstripe/silverstripe-cms/commit/dbe2ad4f9fe818fe21755eff2ecf8d359c578736) Folder expansion icons (Jonathon Menz)
+ * 2015-05-19 [a56d08b](https://github.com/silverstripe/silverstripe-framework/commit/a56d08b1aeeb0a2dfc16e134ddc3bd7b699bd606) TreeDropdownField Folder expansion (Jonathon Menz)
+ * 2015-05-16 [c6bcfea](https://github.com/silverstripe/silverstripe-framework/commit/c6bcfea3e36a4211d2f69ff5c73db2fcab474ba8) FieldList::changeFieldOrder() leftovers discarded (Jonathon Menz)
+ * 2015-05-04 [1cca37c](https://github.com/silverstripe/silverstripe-framework/commit/1cca37c9082ef53f02633d1bdac27f4a815d4208) File::getFileType() was case sensitive (fixes #3631) (Loz Calver)
+ * 2015-04-01 [7ff131d](https://github.com/silverstripe/silverstripe-framework/commit/7ff131daa76d345cff90410469accdcca9049cf1) Fix default casted (boolean)false evaluating to true in templates (Damian Mooyman)
+ * 2014-12-31 [71a14c3](https://github.com/silverstripe/silverstripe-framework/commit/71a14c30352e69e4c0ac59e5ea72e1da0c79009b) Prevent url= querystring argument override (Damian Mooyman)
+ * 2014-10-25 [28be51c](https://github.com/silverstripe/silverstripe-framework/commit/28be51cab0b567b692632503e0f440d30a2fe09e) Config state leaking between unit tests (Loz Calver)
+ * 2014-09-20 [bbc1cb8](https://github.com/silverstripe/silverstripe-framework/commit/bbc1cb82702b678b21bef15394f067c146e47625) #3458 iframe transport multi file upload FIX #3343, FIX #3148 (Thierry François)
+ * 2014-05-25 [40c5b8b](https://github.com/silverstripe/silverstripe-framework/commit/40c5b8b6758676a3e2a5daf3c438a7720c49baaf) FulltextFilter did not work and was not usable (micmania1)
+ * 2014-03-24 [fd755a7](https://github.com/silverstripe/silverstripe-framework/commit/fd755a7ff9de69802f04763570f69e4c3b68c08c) ChangePasswordForm validation message should render HTML correctly. (Sean Harvey)

javascript/UploadField.js

@@ -316,6 +316,8 @@
 						indicator.remove();
 					},
 					success: function(data, status, xhr) {
+						if (!data || $.isEmptyObject(data)) return;
+
 						self.fileupload('attach', {
 							files: data,
 							options: self.fileupload('option'),

lang/af.yml

@@ -230,7 +230,6 @@ af:
     DELETED: Was verwyder
     DropdownBatchActionsDefault: Aksies
     PERMAGAIN: 'Jy is uit die IBS uitgeteken. As jy weer wil inteken, moet jy ''n gebruikersnaam en wagwoord onder in tik'
-    PLEASESAVE: 'Stoor asseblief die bladsy: Die bladsy kon nie opgedateer word nie omdat dit nog nie gestoor is nie'
     PreviewButton: Beskou
     REORGANISATIONSUCCESSFUL: 'Die ''site tree'' is suksesvol geheorganiseer'
     SAVEDUP: Gestoor

lang/ar.yml

@@ -263,8 +263,6 @@ ar:
     FROMWEB: 'من الإنترنت'
     FindInFolder: 'ابحث في المجلد'
     IMAGEALT: 'النص البديل (بديل)'
-    IMAGEALTTEXT: 'النص البديل (ألت) - يظهر إذا كان لا يمكن عرض الصورة'
-    IMAGEALTTEXTDESC: 'تبين قارئي الشاشة أو إذا لم يمكن عرض الصورة'
     IMAGEDIMENSIONS: الأبعاد
     IMAGEHEIGHTPX: الطول
     IMAGETITLE: 'العنوان - لإضافة معلومات إلى الصورة'

lang/cs.yml

@@ -291,8 +291,6 @@ cs:
     FROMWEB: 'Z webu'
     FindInFolder: 'Hledat ve složce'
     IMAGEALT: 'Alternativní text (alt)'
-    IMAGEALTTEXT: 'Alternativní text (alt) - ukáže se, když obrázek nemúže být zobrazen'
-    IMAGEALTTEXTDESC: 'Zobrazeno na obrazovce, anebo když obrázek nemůže být zobrazen'
     IMAGEDIMENSIONS: Rozměry
     IMAGEHEIGHTPX: Výška
     IMAGETITLE: 'Titul text (tooltip) - další informace o obrázku'
@@ -327,9 +325,7 @@ cs:
     DELETED: Smazáno.
     DropdownBatchActionsDefault: Akcie
     HELP: Nápověda
-    PAGETYPE: 'Typ stránky'
     PERMAGAIN: 'Byli jste odhlášeni z CMS. Pokud se chcete znovu přihlásit, zadejte níže své uživatelské jméno a heslo.'
-    PLEASESAVE: 'Uložte stránku, prosím. Tato stránka nemůže být aktualizována, protože ještě nebyla uložena.'
     PreviewButton: Náhled
     REORGANISATIONSUCCESSFUL: 'Strom webu reorganizován úspěšně.'
     SAVEDUP: Uloženo.

lang/de.yml

@@ -291,8 +291,6 @@ de:
     FROMWEB: 'Aus dem Web'
     FindInFolder: 'In Ordner suchen'
     IMAGEALT: 'Alternativtext (alt)'
-    IMAGEALTTEXT: 'Alternativtext (alt) - erscheint, falls das Bild nicht angezeigt werden kann.'
-    IMAGEALTTEXTDESC: 'Wird von Screenreadern vorgelesen oder angezeigt, falls das Bild nicht angezeigt werden kann.'
     IMAGEDIMENSIONS: Dimensionen
     IMAGEHEIGHTPX: Höhe (px)
     IMAGETITLE: 'Titeltext (Tooltip) - für zusätzliche Informationen über das Bild'
@@ -327,9 +325,7 @@ de:
     DELETED: Gelöscht.
     DropdownBatchActionsDefault: Aktionen
     HELP: Hilfe
-    PAGETYPE: 'Seitentyp'
     PERMAGAIN: 'Sie wurden aus dem System ausgeloggt. Falls Sie sich wieder einloggen möchten, geben Sie bitte Benutzernamen und Passwort im untenstehenden Formular an.'
-    PLEASESAVE: 'Diese Seite konnte nicht aktualisiert werden weil sie noch nicht gespeichert wurde - bitte speichern.'
     PreviewButton: Vorschau
     REORGANISATIONSUCCESSFUL: 'Der Seitenbaum wurde erfolgreich sortiert.'
     SAVEDUP: Gespeichert.

lang/en.yml

@@ -292,8 +292,8 @@ en:
     FROMWEB: 'From the web'
     FindInFolder: 'Find in Folder'
     IMAGEALT: 'Alternative text (alt)'
-    IMAGEALTTEXT: 'Alternative text (alt) - shown if image can''t be displayed'
+    IMAGEALTTEXT: 'Alternative text (alt) - shown if image cannot be displayed'
-    IMAGEALTTEXTDESC: 'Shown to screen readers or if image can''t be displayed'
+    IMAGEALTTEXTDESC: 'Shown to screen readers or if image can not be displayed'
     IMAGEDIMENSIONS: Dimensions
     IMAGEHEIGHTPX: Height
     IMAGETITLE: 'Title text (tooltip) - for additional information about the image'
@@ -328,11 +328,11 @@ en:
     DELETED: Deleted.
     DropdownBatchActionsDefault: Actions
     HELP: Help
-    PAGETYPE: 'Page type'
+    PAGETYPE: 'Page type: '
     PERMAGAIN: 'You have been logged out of the CMS.  If you would like to log in again, enter a username and password below.'
     PERMALREADY: 'I''m sorry, but you can''t access that part of the CMS.  If you want to log in as someone else, do so below.'
     PERMDEFAULT: 'You must be logged in to access the administration area; please enter your credentials below.'
-    PLEASESAVE: 'Please Save Page: This page could not be updated because it hasn''t been saved yet.'
+    PLEASESAVE: 'Please Save Page: This page could not be upated because it hasn''t been saved yet.'
     PreviewButton: Preview
     REORGANISATIONSUCCESSFUL: 'Reorganised the site tree successfully.'
     SAVEDUP: Saved.

lang/eo.yml

@@ -291,8 +291,6 @@ eo:
     FROMWEB: 'El la TTT'
     FindInFolder: 'Serĉi en dosierujo'
     IMAGEALT: 'Alternativa teksto (alt)'
-    IMAGEALTTEXT: 'Alternativa teksto (alt) - vidiĝas se ne eblas vidigi bildon'
-    IMAGEALTTEXTDESC: 'Vidiĝas se ne eblas vidigi bildon'
     IMAGEDIMENSIONS: Dimensioj
     IMAGEHEIGHTPX: Alto
     IMAGETITLE: 'Titola teksto (ŝpruchelpilo) - por plua informo pri la bildo'
@@ -328,7 +326,6 @@ eo:
     DropdownBatchActionsDefault: Agoj
     HELP: Helpo
     PERMAGAIN: 'Vin adiaŭis la CMS. Se vi volas denove saluti, enigu salutnomon kaj pasvorton malsupre.'
-    PLEASESAVE: 'Bonvolu konservi paĝon: ne povis ĝisdatigi ĉi tiun paĝon ĉar ĝi ankoraŭ estas nekonservita.'
     PreviewButton: Antaŭvido
     REORGANISATIONSUCCESSFUL: 'Sukcese reorganizis la retejan arbon.'
     SAVEDUP: Konservita.

lang/es.yml

@@ -290,8 +290,6 @@ es:
     FROMWEB: 'Desde la web'
     FindInFolder: 'Buscar en carpeta'
     IMAGEALT: 'Texto alternativo (alt)'
-    IMAGEALTTEXT: 'Texto alternativo (alt) - es mostrado si la imagen no puede ser visualizada'
-    IMAGEALTTEXTDESC: 'Texto alternativo (desc) - es mostrado si la imagen no puede ser visualizada o a los lectores de pantalla'
     IMAGEDIMENSIONS: Dimensiones
     IMAGEHEIGHTPX: Alto
     IMAGETITLE: 'Texto del título (tooltip) - para obtener más información acerca de la imagen'
@@ -326,9 +324,7 @@ es:
     DELETED: Borrado
     DropdownBatchActionsDefault: Acciones
     HELP: Ayuda
-    PAGETYPE: 'Tipo de página'
     PERMAGAIN: 'Ha sido desconectado del CMS. Si quiere volver a entrar, introduzca su nombre de usuario y contraseña a continuación.'
-    PLEASESAVE: 'Por favor guarde la página: Esta página no se ha podido actualizar porque aún no ha sido guardada.'
     PreviewButton: Vista previa
     REORGANISATIONSUCCESSFUL: 'Reorganizado el árbol del sitio con éxito.'
     SAVEDUP: Guardado

lang/et_EE.yml

@@ -240,7 +240,6 @@ et_EE:
     FROMWEB: 'Veebist'
     FindInFolder: 'Otsi kaustast'
     IMAGEALT: 'Asetekst (alt)'
-    IMAGEALTTEXT: 'Asetekst (alt) – kuvatakse, kui kujutist ei ole võimalik kuvada'
     IMAGEDIMENSIONS: Mõõtmed
     IMAGEHEIGHTPX: Laius
     IMAGETITLE: 'Pealkirja tekst (kohtspikker) – lisateabeks kujutise kohta'

lang/fi.yml

@@ -291,8 +291,6 @@ fi:
     FROMWEB: 'Webistä'
     FindInFolder: 'Etsi kansiosta'
     IMAGEALT: 'Vaihtoehtoinen teksti (alt)'
-    IMAGEALTTEXT: 'Vaihtoehtoinen teksti (alt) - näytetään jos kuvaa ei voida näyttää'
-    IMAGEALTTEXTDESC: 'Näytetään ruudunlukuohjelmille tai jos kuvia ei voi näyttää'
     IMAGEDIMENSIONS: Mitat
     IMAGEHEIGHTPX: Korkeus
     IMAGETITLE: 'Otsikko (tooltip) - kuvan lisätietoja varten'
@@ -328,7 +326,6 @@ fi:
     DropdownBatchActionsDefault: Toimenpiteet
     HELP: Ohje
     PERMAGAIN: 'Olet kirjautunut ulos CMS:stä. Jos haluat kirjautua uudelleen sisään, syötä käyttäjätunnuksesi ja salasanasi alla.'
-    PLEASESAVE: 'Tallenna sivu: tätä sivua ei voida päivittää, koska sitä ei ole vielä tallennettu.'
     PreviewButton: Esikatselu
     REORGANISATIONSUCCESSFUL: 'Hakemistopuu järjestettiin uudelleen onnistuneesti.'
     SAVEDUP: Tallennettu.

lang/fr.yml

@@ -263,8 +263,6 @@ fr:
     FROMWEB: 'Du web'
     FindInFolder: 'Trouver dans un dossier'
     IMAGEALT: 'Texte alternatif (alt)'
-    IMAGEALTTEXT: 'Texte alternatif (alt) - s''affiche si l''image ne peut être affichée.'
-    IMAGEALTTEXTDESC: 'Proposé aux lecteurs d’écran ou si l’image ne peut pas être affichée'
     IMAGEDIMENSIONS: Dimensions
     IMAGEHEIGHTPX: Hauteur
     IMAGETITLE: 'Texte du titre (tooltip) - informations à propos de l''image'

lang/id.yml

@@ -291,8 +291,6 @@ id:
     FROMWEB: 'Dari situs lain'
     FindInFolder: 'Temukan di Folder'
     IMAGEALT: 'Teks alternatif (alt)'
-    IMAGEALTTEXT: 'Teks alternatif (alt) - pengganti jika gambar tidak tampil'
-    IMAGEALTTEXTDESC: 'Tampil ke pembaca layar, atau jika gambar tidak tampil'
     IMAGEDIMENSIONS: Dimensi
     IMAGEHEIGHTPX: Tinggi
     IMAGETITLE: 'Teks judul (tooltip) - untuk informasi tambahan tentang gambar'
@@ -328,7 +326,6 @@ id:
     DropdownBatchActionsDefault: Tindakan
     HELP: Bantuan
     PERMAGAIN: 'Anda telah keluar dari situs. Jika ingin kembali masuk, isikan nama pengguna dan kata kunci di bawah ini.'
-    PLEASESAVE: 'Mohon Simpan Laman: Laman ini tidak dapat diperbarui karena belum disimpan.'
     PreviewButton: Pratinjau
     REORGANISATIONSUCCESSFUL: 'Pengaturan ulang struktur situs berhasil.'
     SAVEDUP: Tersimpan.

lang/id_ID.yml

@@ -291,8 +291,6 @@ id_ID:
     FROMWEB: 'Dari situs lain'
     FindInFolder: 'Temukan di Folder'
     IMAGEALT: 'Teks alternatif (alt)'
-    IMAGEALTTEXT: 'Teks alternatif (alt) - pengganti jika gambar tidak tampil'
-    IMAGEALTTEXTDESC: 'Tampil ke pembaca layar, atau jika gambar tidak tampil'
     IMAGEDIMENSIONS: Dimensi
     IMAGEHEIGHTPX: Tinggi
     IMAGETITLE: 'Teks judul (tooltip) - untuk informasi tambahan tentang gambar'
@@ -328,7 +326,6 @@ id_ID:
     DropdownBatchActionsDefault: Tindakan
     HELP: Bantuan
     PERMAGAIN: 'Anda telah keluar dari situs. Jika ingin kembali masuk, isikan nama pengguna dan kata kunci di bawah ini.'
-    PLEASESAVE: 'Mohon Simpan Laman: Laman ini tidak dapat diperbarui karena belum disimpan.'
     PreviewButton: Pratinjau
     REORGANISATIONSUCCESSFUL: 'Pengaturan ulang struktur situs berhasil.'
     SAVEDUP: Tersimpan.

lang/it.yml

@@ -291,8 +291,6 @@ it:
     FROMWEB: 'Dal web'
     FindInFolder: 'Trova nella Cartella'
     IMAGEALT: 'Testo alternativo (alt)'
-    IMAGEALTTEXT: 'Testo alternativo (alt) - mostrato se l''immagine non può essere mostrata.'
-    IMAGEALTTEXTDESC: 'Mostrato agli screen reader o se l''immagine non può essere visualizzata'
     IMAGEDIMENSIONS: Dimensioni
     IMAGEHEIGHTPX: Altezza
     IMAGETITLE: 'Titolo (tooltip) - per informazioni aggiuntive sull''immagine.'
@@ -327,9 +325,7 @@ it:
     DELETED: Eliminato.
     DropdownBatchActionsDefault: Azioni
     HELP: Aiuto
-    PAGETYPE: 'Tipo di pagina'
     PERMAGAIN: 'Sei stato disconnesso dal CMS. Se desideri autenticarti nuovamente, inserisci qui sotto nome utente e password.'
-    PLEASESAVE: 'Per favore salvare la pagina: potrebbe non venire aggiornata perché non è ancora stata salvata.'
     PreviewButton: Anteprima
     REORGANISATIONSUCCESSFUL: 'Albero del sito riorganizzato con successo.'
     SAVEDUP: Salvato.

lang/ja.yml

@@ -261,8 +261,6 @@ ja:
     FROMWEB: 'Webから'
     FindInFolder: 'フォルダ内を探す'
     IMAGEALT: '代替テキスト(Alt)'
-    IMAGEALTTEXT: '代替(Alt)テキスト - 画像が表示されなかった場合に表示されます'
-    IMAGEALTTEXTDESC: 'スクリーンリーダー利用者やイメージが表示されなかった場合に表示されます'
     IMAGEDIMENSIONS: サイズ
     IMAGEHEIGHTPX: 高さ
     IMAGETITLE: 'タイトル(ツールチップ)テキスト - 画像に対する追加的情報'

lang/lt.yml

@@ -260,7 +260,6 @@ lt:
     many_many_Members: Vartotojai
   GroupImportForm:
     Help1: '<p>Importuoti vieną ar kelias grupes <em>CSV</em> formatu (kableliu atskirtos reikšmės). <small><a href="#" class="toggle-advanced">Rodyti detalesnį aprašymą</a></small></p>'
-    Help2: '<div class="advanced"><h4>Detalesnis aprašymas</h4><ul><li>Galimi stulpeliai: <em>%s</em></li><li>Esamos grupės yra surandamos su jų unikalia <em>Code</em> reikšme ir atnaujinamos duomenimis iš importuojamos bylos.</li><li>Grupių hierarchija gali būti sukurta naudojant <em>ParentCode</em> stulpelį.</li><li>Leidimų kodai gali būti priskirti naudojant <em>PermissionCode</em> stulpelį. Esami leidimai nebus pakeisti.</li></ul></div>'
     ResultCreated: 'Sukurta {count} grupių'
     ResultDeleted: 'Ištrinta %d grupių'
     ResultUpdated: 'Atnaujinta %d grupių'
@@ -292,8 +291,6 @@ lt:
     FROMWEB: 'Iš interneto'
     FindInFolder: 'Rasti kataloge'
     IMAGEALT: 'Alternatyvus tekstas (alt)'
-    IMAGEALTTEXT: 'Alternatyvus tekstas (alt) - rodomas, jeigu nepavyko parodyti paveikslėlio'
-    IMAGEALTTEXTDESC: 'Rodomas, jeigu nepavyko parodyti paveikslėlio'
     IMAGEDIMENSIONS: Matmenys
     IMAGEHEIGHTPX: Aukštis
     IMAGETITLE: 'Pavadinimo tekstas (tooltip) - papildomai informacijai apie paveikslėlį'
@@ -328,11 +325,9 @@ lt:
     DELETED: Ištrinta.
     DropdownBatchActionsDefault: Veiksmai
     HELP: Pagalba
-    PAGETYPE: 'Puslapio tipas'
     PERMAGAIN: 'Jūs atsijungėte. Norėdami vėl prisijungti, įveskite savo duomenis į žemiau esančius laukelius.'
     PERMALREADY: 'Deja, bet Jūs negalite patekti į šią TVS dalį. Jeigu norite prisijungti kitu vartotoju, tai atlikite žemiau.'
     PERMDEFAULT: 'Jūs turite būti prisijungę, norėdami pasiekti administravimo zoną; prašome suvesti prisijungimo duomenis į žemiau esančius laukelius.'
-    PLEASESAVE: 'Prašome išsaugoti puslapį: Šis puslapis negali būti atnaujintas, nes jis dar nėra išsaugotas.'
     PreviewButton: Peržiūra
     REORGANISATIONSUCCESSFUL: 'Puslapių medis pertvarkytas sėkmingai.'
     SAVEDUP: Išsaugota.
@@ -420,7 +415,6 @@ lt:
     Toggle: 'Rodyti formatavimo aprašymą'
   MemberImportForm:
     Help1: '<p>Importuoti vartotojus <em>CSV</em> formatu (kableliu atskirtos reikšmės). <small><a href="#" class="toggle-advanced">Rodyti detalesnį aprašymą</a></small></p>'
-    Help2: '<div class="advanced"><h4>Detalesnis aprašymas</h4><ul><li>Galimi stulpeliai: <em>%s</em></li><li>Esami vartotojai yra surandami su jų unikalia <em>Code</em> reikšme ir atnaujinami duomenimis iš importuojamos bylos.</li><li>Grupės gali būti priskirtos naudojant <em>Groups</em> column. stulpelį. Grupės yra atpažįstamos pagal <em>Code</em> stulpelį, kelios grupės nurodomos per kablelį. Jau priskirtos vartotojui grupės nebus pakeistos.</li></ul></div>'
     ResultCreated: 'Sukurta {count} vartotojų'
     ResultDeleted: 'Ištrinta %d vartotojų'
     ResultNone: 'Nėra jokių pakeitimų'

lang/mi.yml

@@ -263,8 +263,6 @@ mi:
     FROMWEB: 'Mai i te tukutuku'
     FindInFolder: 'Rapu i te Kōpaki'
     IMAGEALT: 'Tuhinga kē (alt)'
-    IMAGEALTTEXT: 'Kuputuhi kē (alt) - ka whakaaturia ki te kore e taea te atahanga te whakaatu'
-    IMAGEALTTEXTDESC: 'Ka whakaaturia ki ngā pūpānui mata ki te kore e taea te atahanga te whakaatu'
     IMAGEDIMENSIONS: Ngā Rahinga
     IMAGEHEIGHTPX: Teitei
     IMAGETITLE: 'Tuhinga taitara (ākiutauta) - mō ngā mōhiohio tāpiri mō te atahanga'

lang/nb.yml

@@ -265,8 +265,6 @@ nb:
     FROMWEB: 'Fra internett'
     FindInFolder: 'Finn i mappe'
     IMAGEALT: 'Alternativ tekst (alt)'
-    IMAGEALTTEXT: 'Alternativ tekst (alt) - blir brukt hvis bildet ikke kan vises'
-    IMAGEALTTEXTDESC: 'Blir vist til skjermlesere eller hvis bildet ikke kan vises'
     IMAGEDIMENSIONS: Dimensjoner
     IMAGEHEIGHTPX: Høyde
     IMAGETITLE: 'Titteltekst (tooltip) - for tilleggsinformasjon om bildet'

lang/nl.yml

@@ -266,8 +266,6 @@ nl:
     FROMWEB: 'Vanaf een website'
     FindInFolder: 'Zoek in map'
     IMAGEALT: 'Alternatieve tekst (alt tekst)'
-    IMAGEALTTEXT: 'Alternatieve tekst (alt-tekst) - wordt gebruikt als de afbeelding niet geladen kan worden '
-    IMAGEALTTEXTDESC: 'Voor schermlezers, of als de afbeelding niet weergegeven kan worden '
     IMAGEDIMENSIONS: Dimensies
     IMAGEHEIGHTPX: Hoogte
     IMAGETITLE: 'Tooltip (title) - Toon extra informatie over de afbeelding'

lang/pl.yml

@@ -265,8 +265,6 @@ pl:
     FROMWEB: 'Z WWW'
     FindInFolder: 'Znajdź w Folderze'
     IMAGEALT: 'Tekst alternatywny (alt)'
-    IMAGEALTTEXT: 'Alternatywny tekst (alt) - pokazuje się gdy zdjęcie nie może się wyświetlić'
-    IMAGEALTTEXTDESC: 'Używane przez czytniki ekranu lub gdy obraz nie może zostać wyświetlony'
     IMAGEDIMENSIONS: Rozmiar
     IMAGEHEIGHTPX: Wysokość (px)
     IMAGETITLE: 'Tytuł (tooltip) - dodatkowe informacje o obrazku'

lang/ru.yml

@@ -265,8 +265,6 @@ ru:
     FROMWEB: 'Из интернета'
     FindInFolder: 'Найти в папке'
     IMAGEALT: 'Альтернативный текст (alt)'
-    IMAGEALTTEXT: 'Альтернативный текст (alt) - показывается, если изображение недоступно'
-    IMAGEALTTEXTDESC: 'Передается программе чтения экрана или отображается, если изображение недоступно'
     IMAGEDIMENSIONS: Размеры
     IMAGEHEIGHTPX: Высота
     IMAGETITLE: 'Текст (всплывающая подсказка) - для дополнительной информации об изображении'

lang/sk.yml

@@ -291,8 +291,6 @@ sk:
     FROMWEB: 'Z webu'
     FindInFolder: 'Vyhľadať v priečinku'
     IMAGEALT: 'Atlernatívny text (alt)'
-    IMAGEALTTEXT: 'Atlernatívny text (alt) - zobrazí sa ak obrázok nemože byť zobrazený '
-    IMAGEALTTEXTDESC: 'Zobrazí sa na obrazovke, ak obrázok nemôže byť zobrazený'
     IMAGEDIMENSIONS: Rozmery
     IMAGEHEIGHTPX: Výška
     IMAGETITLE: 'Text titulky (tooltip) - pre doplňujúce informácie o obrázku'
@@ -327,9 +325,7 @@ sk:
     DELETED: Zmazané.
     DropdownBatchActionsDefault: Akcie
     HELP: Pomoc
-    PAGETYPE: 'Typ stránky'
     PERMAGAIN: 'Boli ste odhlásený'
-    PLEASESAVE: 'Uložte stránku, prosím. Táto stránka nemôže byť aktualizovaná, pretože eště nebola uložená.'
     PreviewButton: Náhľad
     REORGANISATIONSUCCESSFUL: 'Strom webu bol reorganizovaný úspešne.'
     SAVEDUP: Uložené.

lang/sr.yml

@@ -265,8 +265,6 @@ sr:
     FROMWEB: 'Са веба'
     FindInFolder: 'Пронађи у фасцикли'
     IMAGEALT: 'Алтернативни текст (alt)'
-    IMAGEALTTEXT: 'Алтернативни текст (alt) - приказује се ако слика не може бити приказана'
-    IMAGEALTTEXTDESC: 'Приказује се читачима екрана или ако слика не може бити приказана'
     IMAGEDIMENSIONS: Димензије
     IMAGEHEIGHTPX: Висина
     IMAGETITLE: 'Текст наслова (tooltip) - за додатне информације о слици'

lang/sr@latin.yml

@@ -265,8 +265,6 @@ sr@latin:
     FROMWEB: 'Sa veba'
     FindInFolder: 'Pronađi u fascikli'
     IMAGEALT: 'Alternativni tekst (alt)'
-    IMAGEALTTEXT: 'Alternativni tekst (alt) - prikazuje se ako slika ne može biti prikazana'
-    IMAGEALTTEXTDESC: 'Prikazuje se čitačima ekrana ili ako slika ne može biti prikazana'
     IMAGEDIMENSIONS: Dimenzije
     IMAGEHEIGHTPX: Visina
     IMAGETITLE: 'Tekst naslova (tooltip) - za dodatne informacije o slici'

lang/sr_RS.yml

@@ -265,8 +265,6 @@ sr_RS:
     FROMWEB: 'Са веба'
     FindInFolder: 'Пронађи у фасцикли'
     IMAGEALT: 'Алтернативни текст (alt)'
-    IMAGEALTTEXT: 'Алтернативни текст (alt) - приказује се ако слика не може бити приказана'
-    IMAGEALTTEXTDESC: 'Приказује се читачима екрана или ако слика не може бити приказана'
     IMAGEDIMENSIONS: Димензије
     IMAGEHEIGHTPX: Висина
     IMAGETITLE: 'Текст наслова (tooltip) - за додатне информације о слици'

lang/sr_RS@latin.yml

@@ -265,8 +265,6 @@ sr_RS@latin:
     FROMWEB: 'Sa veba'
     FindInFolder: 'Pronađi u fascikli'
     IMAGEALT: 'Alternativni tekst (alt)'
-    IMAGEALTTEXT: 'Alternativni tekst (alt) - prikazuje se ako slika ne može biti prikazana'
-    IMAGEALTTEXTDESC: 'Prikazuje se čitačima ekrana ili ako slika ne može biti prikazana'
     IMAGEDIMENSIONS: Dimenzije
     IMAGEHEIGHTPX: Visina
     IMAGETITLE: 'Tekst naslova (tooltip) - za dodatne informacije o slici'

lang/sv.yml

@@ -290,8 +290,6 @@ sv:
     FROMWEB: 'Från webben'
     FindInFolder: 'Hitta i mapp'
     IMAGEALT: 'Alternativ text (alt)'
-    IMAGEALTTEXT: 'Alternativ text (alt) - visas om bilden inte kan visas'
-    IMAGEALTTEXTDESC: 'Visas för skärmläsare eller om bilden inte kan visas'
     IMAGEDIMENSIONS: Dimensioner
     IMAGEHEIGHTPX: Höjd
     IMAGETITLE: 'Titel text (tooltip) - för ytterligare information om bilden'
@@ -327,7 +325,6 @@ sv:
     DropdownBatchActionsDefault: Åtgärder
     HELP: Hjälp
     PERMAGAIN: 'Du har blivit utloggad. Om du vill logga in igen anger du dina uppgifter nedan.'
-    PLEASESAVE: 'Var god spara sidan. Den kan inte uppdateras eftersom den har inte sparats ännu.'
     PreviewButton: Förhandsgranska
     REORGANISATIONSUCCESSFUL: 'Omorganisationen av sidträdet luyckades.'
     SAVEDUP: Sparad.

lang/zh.yml

@@ -265,8 +265,6 @@ zh:
     FROMWEB: '从网站上'
     FindInFolder: '在文件夹中寻找'
     IMAGEALT: '替代性文本 (alt)'
-    IMAGEALTTEXT: '替代文字 (alt) - 用于图像无法显示时'
-    IMAGEALTTEXTDESC: '向显示屏读者显示，或者用于图像无法显示时'
     IMAGEDIMENSIONS: 体积
     IMAGEHEIGHTPX: 高度
     IMAGETITLE: '标题文字（工具提示）- 关于该图像的更多信息'

model/DatabaseAdmin.php

@@ -90,17 +90,37 @@ class DatabaseAdmin extends Controller {
 		// Get all our classes
 		SS_ClassLoader::instance()->getManifest()->regenerate();
 
-		if(isset($_GET['returnURL'])) {
+		$url = $this->getReturnURL();
+		if($url) {
 			echo "<p>Setting up the database; you will be returned to your site shortly....</p>";
 			$this->doBuild(true);
 			echo "<p>Done!</p>";
-			$this->redirect($_GET['returnURL']);
+			$this->redirect($url);
 		} else {
-			$this->doBuild(isset($_REQUEST['quiet']) || isset($_REQUEST['from_installer']),
+			$quiet = $this->request->requestVar('quiet') !== null;
-				!isset($_REQUEST['dont_populate']));
+			$fromInstaller = $this->request->requestVar('from_installer') !== null;
+			$populate = $this->request->requestVar('dont_populate') === null;
+			$this->doBuild($quiet || $fromInstaller, $populate);
 		}
 	}
 
+	/**
+	 * Gets the url to return to after build
+	 *
+	 * @return string|null
+	 */
+	protected function getReturnURL() {
+		$url = $this->request->getVar('returnURL');
+
+		// Check that this url is a site url
+		if(empty($url) || !Director::is_site_url($url)) {
+			return null;
+		}
+
+		// Convert to absolute URL
+		return Director::absoluteURL($url, true);
+	}
+
 	/**
 	 * Check if database needs to be built, and build it if it does.
 	 */

security/Member.php

@@ -274,7 +274,11 @@ class Member extends DataObject implements TemplateGlobalProvider {
 
 		// Ensure this user is in the admin group
 		if(!$admin->inGroup($adminGroup)) {
-			$admin->Groups()->add($adminGroup);
+			// Add member to group instead of adding group to member
+			// This bypasses the privilege escallation code in Member_GroupSet
+			$adminGroup
+				->DirectMembers()
+				->add($admin);
 		}
 
 		return $admin;
@@ -912,6 +916,8 @@ class Member extends DataObject implements TemplateGlobalProvider {
 	public function onAfterWrite() {
 		parent::onAfterWrite();
 
+		Permission::flush_permission_cache();
+
 		if($this->isChanged('Password')) {
 			MemberPassword::log($this);
 		}
@@ -938,21 +944,22 @@ class Member extends DataObject implements TemplateGlobalProvider {
 	}
 
 	/**
+	 * Filter out admin groups to avoid privilege escalation,
 	 * If any admin groups are requested, deny the whole save operation.
 	 *
 	 * @param Array $ids Database IDs of Group records
-	 * @return boolean
+	 * @return boolean True if the change can be accepted
 	 */
 	public function onChangeGroups($ids) {
-		// Filter out admin groups to avoid privilege escalation,
 		// unless the current user is an admin already OR the logged in user is an admin
-		if(!(Permission::check('ADMIN') || Permission::checkMember($this, 'ADMIN'))) {
+		if(Permission::check('ADMIN') || Permission::checkMember($this, 'ADMIN')) {
+			return true;
+		}
+
+		// If there are no admin groups in this set then it's ok
 		$adminGroups = Permission::get_groups_by_permission('ADMIN');
 		$adminGroupIDs = ($adminGroups) ? $adminGroups->column('ID') : array();
 		return count(array_intersect($ids, $adminGroupIDs)) == 0;
-		} else {
-			return true;
-		}
 	}
 
 
@@ -1185,6 +1192,7 @@ class Member extends DataObject implements TemplateGlobalProvider {
 	 * Use {@link DirectGroups()} to only retrieve the group relations without inheritance.
 	 *
 	 * @todo Push all this logic into Member_GroupSet's getIterator()?
+	 * @return Member_Groupset
 	 */
 	public function Groups() {
 		$groups = Member_GroupSet::create('Group', 'Group_Members', 'GroupID', 'MemberID');
@@ -1706,6 +1714,47 @@ class Member_GroupSet extends ManyManyList {
 		// in this class, otherwise we end up selecting all inherited groups
 		return parent::foreignIDFilter($id);
 	}
+
+	public function add($item, $extraFields = null) {
+		// Get Group.ID
+		$itemID = null;
+		if(is_numeric($item)) {
+			$itemID = $item;
+		} else if($item instanceof Group) {
+			$itemID = $item->ID;
+		}
+
+		// Check if this group is allowed to be added
+		if($this->canAddGroups(array($itemID))) {
+			parent::add($item, $extraFields);
+		}
+	}
+
+	/**
+	 * Determine if the following groups IDs can be added
+	 *
+	 * @param array $itemIDs
+	 * @return boolean
+	 */
+	protected function canAddGroups($itemIDs) {
+		if(empty($itemIDs)) {
+			return true;
+		}
+		$member = $this->getMember();
+		return empty($member) || $member->onChangeGroups($itemIDs);
+	}
+
+	/**
+	 * Get foreign member record for this relation
+	 *
+	 * @return Member
+	 */
+	protected function getMember() {
+		$id = $this->getForeignID();
+		if($id) {
+			return DataObject::get_by_id('Member', $id);
+		}
+	}
 }
 
 /**

security/Security.php

@@ -805,7 +805,11 @@ class Security extends Controller implements TemplateGlobalProvider {
 			$member = Member::create();
 			$member->FirstName = _t('Member.DefaultAdminFirstname', 'Default Admin');
 			$member->write();
-			$member->Groups()->add($adminGroup);
+			// Add member to group instead of adding group to member
+			// This bypasses the privilege escallation code in Member_GroupSet
+			$adminGroup
+				->DirectMembers()
+				->add($member);
 		}
 
 		return $member;

tests/model/DataListTest.php

@@ -166,7 +166,8 @@ class DataListTest extends SapphireTest {
 			. 'CASE WHEN "DataObjectTest_TeamComment"."ClassName" IS NOT NULL '
 			. 'THEN "DataObjectTest_TeamComment"."ClassName" ELSE '
 			. $db->quoteString('DataObjectTest_TeamComment')
-			. ' END AS "RecordClassName" FROM "DataObjectTest_TeamComment"';
+			. ' END AS "RecordClassName" FROM "DataObjectTest_TeamComment"'
+			. ' ORDER BY "DataObjectTest_TeamComment"."Name" ASC';
 		$this->assertSQLEquals($expected, $list->sql($parameters));
 	}
 
@@ -189,7 +190,9 @@ class DataListTest extends SapphireTest {
 			. $db->quoteString('DataObjectTest_TeamComment')
 			. ' END AS "RecordClassName" FROM "DataObjectTest_TeamComment" INNER JOIN '
 			. '"DataObjectTest_Team" AS "Team" ON "DataObjectTest_Team"."ID" = '
-			. '"DataObjectTest_TeamComment"."TeamID"';
+			. '"DataObjectTest_TeamComment"."TeamID"'
+			. ' ORDER BY "DataObjectTest_TeamComment"."Name" ASC';
+
 
 		$this->assertSQLEquals($expected, $list->sql($parameters));
 		$this->assertEmpty($parameters);
@@ -218,7 +221,8 @@ class DataListTest extends SapphireTest {
 			. ' END AS "RecordClassName" FROM "DataObjectTest_TeamComment" INNER JOIN '
 			. '"DataObjectTest_Team" AS "Team" ON "DataObjectTest_Team"."ID" = '
 			. '"DataObjectTest_TeamComment"."TeamID" '
-			. 'AND "DataObjectTest_Team"."Title" LIKE ?';
+			. 'AND "DataObjectTest_Team"."Title" LIKE ?'
+			. ' ORDER BY "DataObjectTest_TeamComment"."Name" ASC';
 
 		$this->assertSQLEquals($expected, $list->sql($parameters));
 		$this->assertEquals(array('Team%'), $parameters);
@@ -242,7 +246,9 @@ class DataListTest extends SapphireTest {
 			. 'THEN "DataObjectTest_TeamComment"."ClassName" ELSE '
 			. $db->quoteString('DataObjectTest_TeamComment')
 			. ' END AS "RecordClassName" FROM "DataObjectTest_TeamComment" LEFT JOIN "DataObjectTest_Team" '
-			. 'AS "Team" ON "DataObjectTest_Team"."ID" = "DataObjectTest_TeamComment"."TeamID"';
+			. 'AS "Team" ON "DataObjectTest_Team"."ID" = "DataObjectTest_TeamComment"."TeamID"'
+			. ' ORDER BY "DataObjectTest_TeamComment"."Name" ASC';
+
 
 		$this->assertSQLEquals($expected, $list->sql($parameters));
 		$this->assertEmpty($parameters);
@@ -266,7 +272,8 @@ class DataListTest extends SapphireTest {
 			. 'ELSE ' . $db->quoteString('DataObjectTest_TeamComment') . ' END AS "RecordClassName" '
 			. 'FROM "DataObjectTest_TeamComment" '
 			. 'LEFT JOIN "DataObjectTest\NamespacedClass" ON '
-			. '"DataObjectTest\NamespacedClass"."ID" = "DataObjectTest_TeamComment"."ID"';
+			. '"DataObjectTest\NamespacedClass"."ID" = "DataObjectTest_TeamComment"."ID"'
+			. ' ORDER BY "DataObjectTest_TeamComment"."Name" ASC';
 		$this->assertSQLEquals($expected, $list->sql($parameters), 'Retains backslashes in namespaced classes');
 		$this->assertEmpty($parameters);
 
@@ -295,7 +302,8 @@ class DataListTest extends SapphireTest {
 			. ' END AS "RecordClassName" FROM "DataObjectTest_TeamComment" LEFT JOIN '
 			. '"DataObjectTest_Team" AS "Team" ON "DataObjectTest_Team"."ID" = '
 			. '"DataObjectTest_TeamComment"."TeamID" '
-			. 'AND "DataObjectTest_Team"."Title" LIKE ?';
+			. 'AND "DataObjectTest_Team"."Title" LIKE ?'
+			. ' ORDER BY "DataObjectTest_TeamComment"."Name" ASC';
 
 		$this->assertSQLEquals($expected, $list->sql($parameters));
 		$this->assertEquals(array('Team%'), $parameters);

tests/model/DataObjectTest.php

@@ -1916,6 +1916,7 @@ class DataObjectTest_TeamComment extends DataObject implements TestOnly {
 		'Team' => 'DataObjectTest_Team'
 	);
 
+	private static $default_sort = '"Name" ASC';
 }
 
 class DataObjectTest_Fan extends DataObject implements TestOnly {

tests/security/MemberTest.php

@@ -584,7 +584,6 @@ class MemberTest extends FunctionalTest {
 
 	public function testOnChangeGroups() {
 		$staffGroup = $this->objFromFixture('Group', 'staffgroup');
-		$adminGroup = $this->objFromFixture('Group', 'admingroup');
 		$staffMember = $this->objFromFixture('Member', 'staffmember');
 		$adminMember = $this->objFromFixture('Member', 'admin');
 		$newAdminGroup = new Group(array('Title' => 'newadmin'));
@@ -619,6 +618,76 @@ class MemberTest extends FunctionalTest {
 		);
 	}
 
+	/**
+	 * Test Member_GroupSet::add
+	 */
+	public function testOnChangeGroupsByAdd() {
+		$staffMember = $this->objFromFixture('Member', 'staffmember');
+		$adminMember = $this->objFromFixture('Member', 'admin');
+
+		// Setup new admin group
+		$newAdminGroup = new Group(array('Title' => 'newadmin'));
+		$newAdminGroup->write();
+		Permission::grant($newAdminGroup->ID, 'ADMIN');
+
+		// Setup non-admin group
+		$newOtherGroup = new Group(array('Title' => 'othergroup'));
+		$newOtherGroup->write();
+
+		// Test staff can be added to other group
+		$this->assertFalse($staffMember->inGroup($newOtherGroup));
+		$staffMember->Groups()->add($newOtherGroup);
+		$this->assertTrue(
+			$staffMember->inGroup($newOtherGroup),
+			'Adding new non-admin group relation is allowed for non-admin members'
+		);
+
+		// Test staff member can't be added to admin groups
+		$this->assertFalse($staffMember->inGroup($newAdminGroup));
+		$staffMember->Groups()->add($newAdminGroup);
+		$this->assertFalse(
+			$staffMember->inGroup($newAdminGroup),
+			'Adding new admin group relation is not allowed for non-admin members'
+		);
+
+		// Test staff member can be added to admin group by admins
+		$this->logInAs($adminMember);
+		$staffMember->Groups()->add($newAdminGroup);
+		$this->assertTrue(
+			$staffMember->inGroup($newAdminGroup),
+			'Adding new admin group relation is allowed for normal users, when granter is logged in as admin'
+		);
+
+		// Test staff member can be added if they are already admin
+		$this->session()->inst_set('loggedInAs', null);
+		$this->assertFalse($adminMember->inGroup($newAdminGroup));
+		$adminMember->Groups()->add($newAdminGroup);
+		$this->assertTrue(
+			$adminMember->inGroup($newAdminGroup),
+			'Adding new admin group relation is allowed for admin members'
+		);
+	}
+
+	/**
+	 * Test Member_GroupSet::add
+	 */
+	public function testOnChangeGroupsBySetIDList() {
+		$staffMember = $this->objFromFixture('Member', 'staffmember');
+
+		// Setup new admin group
+		$newAdminGroup = new Group(array('Title' => 'newadmin'));
+		$newAdminGroup->write();
+		Permission::grant($newAdminGroup->ID, 'ADMIN');
+		
+		// Test staff member can't be added to admin groups
+		$this->assertFalse($staffMember->inGroup($newAdminGroup));
+		$staffMember->Groups()->setByIDList(array($newAdminGroup->ID));
+		$this->assertFalse(
+			$staffMember->inGroup($newAdminGroup),
+			'Adding new admin group relation is not allowed for non-admin members'
+		);
+	}
+
 	/**
 	 * Test that extensions using updateCMSFields() are applied correctly
 	 */

tests/security/SecurityDefaultAdminTest.php

@@ -1,6 +1,8 @@
 <?php
 class SecurityDefaultAdminTest extends SapphireTest {
 
+	protected $usesDatabase = true;
+
 	protected $defaultUsername = null;
 	protected $defaultPassword = null;
 	
@@ -16,10 +18,12 @@ class SecurityDefaultAdminTest extends SapphireTest {
 		$this->defaultPassword = Security::default_admin_password();
 		Security::clear_default_admin();
 		Security::setDefaultAdmin('admin', 'password');
+		Permission::flush_permission_cache();
 	}
 
 	public function tearDown() {
 		Security::setDefaultAdmin($this->defaultUsername, $this->defaultPassword);
+		Permission::flush_permission_cache();
 		parent::tearDown();
 	}