Issue #932110 by Albert Volkman, David_Rothstein, marji, jurgenhaas, dcam: On some servers, the Update Manager allows administrators to directly execute arbitrary code even without the PHP module. (Documentation fix)

Issue #7881 by mikeytown2, effulgentsia, gwynnebaer, Patrizio, sylus, pwolanin, David_Rothstein: Add support to drupal_http_request() for proxy servers.

Issue #932110 by dcam, Albert Volkman, jurgenhaas, marji, David_Rothstein: Add note to settings.php about updates and security

Issue #1310250 by joelcollinsdc: Fixed Improve reverse proxy ip address handing commenting and documentation.

Issue #76824 by geerlingguy, xjm, droplet, kbahey: Change notice for Drupal should not handle 404 for certain files.

- Patch #195416 by Damien Tournoud, David Strauss: table prefixes should be per database connection.

- Patch #302327 by Josh Waihi, noahb, Crell, hswong3i: support cross-schema/database prefixing like we claim to.

- Patch #258397 by John Morahan, Dries, R.Muilwijk, Bart Jansens, grendzy, Berdir: IP address identification not broad enough.

- Patch #590656 by pwolanin, Pasqualle: harden one-time login links against vulnerability from disclosure of SQL backups, or SQL 'SELECT' injection.

#67234 by Ralf, Dave Reid, David_Rothstein, Rob Loach, dww, et al: Added a permission to update.php.

- Patch #570572 by winston, David_Rothstein | Shai, Xano, alexanderpas, emmajane, kazar: changed label for user/1 account from 'administrator' to 'site maintenance account'.

#370454 follow-up by chx: Enhance comments to page cache simplification patch, and add in missing settings.default.php hunk.