security fixes forward ported from Drupal 5.2 - previously not committed parts of http://drupal.org/cvs?commit=74833

XSS fixes forward ported from Drupal 5.1 - previously not committed parts of http://drupal.org/cvs?commit=53675

#196410 report by daniel.soneira, patch by myself, tested by Freso: several fixes to url() generation and path aliasing, fixing path aliases for node paths and front page links in themes

#186242 by douggreen: ignore AND in search, as it is the default behavior and inform the user when a lower case 'or' is used that 'OR' should be used as an operator

another go at #181582 (same patch as before), now that maintenance theming allows us to use Minnelli properly in updates and installs even with .info file based inheritance

#197500 reported by webernet, patch by myself and chx: instead of calling into the Drupal API with _block_rehash(), implement what we need from that right there in system_update_6027

The indentation div used in drag and drop was also not RTL friendly positioned. Noted by Steven Wittens, fix by myself.

Table drag handler was not properly positioned in RTL themes. Note by Steven Wittens, patch by myself.

#196775 by dww: constant name typo caused Drupal to not inform people properly when a stale version of Drupal core was running

rollback of #112512: option labels should be wrapped, translations bugos with the default CSS can ship with other tricky solutions

#196513 by yched: resizable textarea was a bit too agressive in unbinding handlers, so it made drag and drop disabled

#141727 follow up by dvessel: handle developer edge case in theme handling when database is active, but tables are not there

#141727 by merlinofchaos, dvessel, sun: restore themeability support for maintenance pages (regression)

#194149 reported by hswong3i, in patch form by Rob Loach: action loading was using improper variable and property names

#194743 by myself, reported and tested by Murz: the base URL was not properly modified for outgoing links to different language domains and path aliases were not handled in the target language

#195678 by catch: standardise on Save and Preview button terminology (for comments) and button placement for comments and nodes, so Save is always the leftmost button, and there is no guessing to find it

#155337 by gpk and Bevan: only treat newlines teaser breakers, if the newline filter is present in the particular input format

#133092 by wmostrey: hide help page links when help module is not enabled, so the links lead to 404s