[SECURITY] Bug 250605: Changes to the metadata (filename, description, mime type, review flags) on attachments which were flagged as private get displayed to users who are not members of the group allowed to see private attachments when receiving bug change notification mails.  This only affects sites that use the 'insidergroup' feature.
Patch by Joel Peshkin <bugreport@peshkin.net>
r=kiko,justdave, a=justdave

[SECURITY] Bug 253544: Changes to the metadata (filename, description, mime type, review flags) on attachments which were flagged as private get displayed to users who are not members of the group allowed to see private attachments when viewing the bug activity log.  This only affects sites that use the 'insidergroup' feature.
Patch by Joel Peshkin <bugreport@peshkin.net>
r=zach,justdave, a=justdave

[SECURITY] Bug 263780: Exporting a bug to XML exposes user comments and attachment summaries which are marked as private to users who are not members of the group allowed to see private comments and attachments.  XML export is not exposed in the user interface, but is available to anyone who knows the correct URL to invoke it.  This only affects sites that use the 'insidergroup' feature.
Patch by Joel Peshkin <bugreport@peshkin.net>
r=vladd,justdave, a=justdave

[SECURITY] Bug 252638: It is possible to send a carefully crafted HTTP POST message to process_bug.cgi which will remove keywords from a bug even if you don't have permissions to edit all bug fields (the "editbugs" permission).  Such changes are reported in "bug changed" email notifications, so they are easily detected and reversed if someone abuses it.
Patch by Myk Melez <myk@mozilla.org>
r=gerv, a=justdave

Bug 250897: Enforce a 10 minute waiting period between password reset attempts to prevent the user getting mailbombed if the form is submitted multiple times.
Patch by Joel Peshkin <bugreport@peshkin.net>
r=kiko, a=justdave

Patch by Tiago R. Mello <tiago@async.com.br>
r=kiko, a=justdave

Patch by Marc Schumann <wurblzap@gmail.com>
r=kiko, a=myk

Documentation patch for bug 143490: Update documentation regarding code changes needed when running Bugzilla under win32 (some are no longer required since checksetup.pl no longer calls unsupported functions when running on Windows); patch by GavinS <bugzilla@chimpychompy.org>, r=vladd.

Patch for bug 192218: Ability to use a hyphen as a way to filter specifically for requests with no requestee; patch by Frédéric Buclin <LpSolit@netscape.net>; r=myk, a=myk.

Patch for bug 252137: tabular reports shouldn't be broken if a row/col/tbl header begins with an underscore; patch by Rob Siklos <rsiklos@adexa.com>; r=gerv, a=justdave.

Bug 265731: multipart_start in the server-push handling code wasn't honoring the $cgi->charset setting.
r=myk, a=justdave

fix for bug 263250: adds a base tag to the simple buglist so it can be loaded in an iframe on a remote site and have the CSS still work

fix for bug 256208: makes checksetup.pl create CVS-ignored skins/custom/ and children; r=gerv, a=justdave

Fix for bug 265240: make collectstats generate valid RDF by not cutting off the opening RDF tag; r=kiko, a=myk

Patch for bug 232155: Remove uninitialized value warning from Pperl's Cookie.pm and unify code by removing redundancy; patch by Christian Reis <kiko@async.com.br> backported to 2.18 by Rob Siklos <rsiklos@adexa.com>; r=vladd,kiko, a=justdave.

Patch for bug 264003: Include the DBI error in the error message if 'createdb' fails; patch by Byron Jones (glob) <bugzilla@glob.com.au>; r=kiko, a=justdave.

Patch for bug 189073: Allow accept as a resolution when changing multiple bugs only if all bugs are opened; r=kiko, a=justdave.

Patch for bug 199811: Implement UI for 'contains none of the strings' search operator; patch by Marc Schumann <wurblzap@gmail.com>, r=kiko, a=justdave.

Patch for bug 261434: implement functionality to delete a user semi-properly (only works for users with no bugs/comments); patch by Ivan Todoroski <grnch@gmx.net>; r=justdave, a=justdave.

Patch for bug 251338: Installation section should mention that you need an MTA installed; patch by Colin S. Ogilvie <colin.ogilvie@gmail.com>; r=vladd, a=justdave.

Patch for bug 257765: Make replies to private comments private by default; patch by Marc Schumann <wurblzap@gmail.com>, r=kiko, a=justdave.

Patch for bug 263165: Make Bugzilla specify table type as MyISAM when creating tables; patch by Byron Jones (glob) <bugzilla@glob.com.au>, r=kiko, a=justdave.

Patch for bug 256567: Harmonize descriptions of classifications and products in terms of 'FILTER html'; patch by Marc Schumann <wurblzap@gmail.com>; r=justdave, kiko, a=justdave.

Patch for bug 261210: adapt bz_secure CSS for text based browsers; patch by Jason Pyeron <jpyeron@pyerotechnics.com>; r=myk, a=myk.

Patch for bug 258712: whine.pl should honour emailsuffix; patch by Marc Schumann <wurblzap@gmail.com>; r=erik, a=justdave.

Patch for bug 237769: use Administrator instead of root for super-user name in Windows, and change the ppm repository from Apache to the one maintained on landfill; patch by Byron Jones (glob) <bugzilla@glob.com.au>; r=vladd, a=myk.

Patch for bug 261993: fix uninitialized value error in webserver log when accessing buglist.cgi (generated by the fix for bug 255512); patch by Marc Schumann <wurblzap@gmail.com>; r=justdave, a=myk.

images/. r,a=myk

r,a=myk.

Fix for bug 252739: moves inclusion/exclusion action names to button name instead of button value so that button values (which are also used as labels) will be localizable; patch by Marc Schumann; r=kiko,myk; a=justdave

Fix for bug 261273: make column changing work with Sun ONE web server; fix by tmabbott@hbs.edu; r,a=justdave