Drupal 6.38 (SA-CORE-2016-001) by agerard, Alan Evans, benjy, catch, chx, dalin, Damien Tournoud, DamienMcKenna, Dave Cohen, Dave Reid, David Jardin, David_Rothstein, dmitrig01, dsnopek, effulgentsia, fgm, greggles, Gábor Hojtsy, Harry Taheem, Heine, John Morahan, Juho Nurminen 2NS, klausi, larowlan, nagba, Pere Orga, plach, pwolanin, quicksketch, rickmanelius, scor, sun, Tarpinder Grewal, YesCT

Issue #2387745 by zealfire, joachim: docs for watchdog() should state character limits, and give error levels

Issue #208793 by Damien Tournoud, kbahey, TR: instead of hardcoding the HTTP protocol version in responses, respond with the HTTP protocol version requested (or fall back to HTTP/1.0 if the requested protocol/version is unknown)

#772678 by sun, jpmckinney, Berdir, markus_petrux: no way to specify default collation, entirely depended on database configuration (which might be inappropriate)

#716348 by grendzy, hefox: document that drupal_get_path(), drupal_load() and drupal_get_filename() can be used with 'profile' as well

#767512 by jhedstrom, Damien Tournoud, marvil07: make drupal_unpack() and user_save() more robust to avoid issues with empty keys in the data array

#276876 by mr.baileys, rdrh555: document that we suggest to use lowercase names with the variable_*() API due to database backend behaviors

#845672 follow up to #360605 by Damien Tournoud, Berdir, Dave Reid: previous (unreleased) fix inadvertantly turned on E_DEPRECATED on machines where it was off

#521370 by Damien Tournoud, marcingy, andypost: watchdog hook invocations should be ordered by weight, not name

#458704 by markus_petrux, tic2000, Damien Tournoud: only remove the www. prefix from autodetected cookie domains, not custom set cookie domains

#43462 by leafish_dylan, c960657, andypost: simplify and fix compatibility of compression code in page caching

#523058 by catch, sun, c960657, smk-ka, pwolanin, andypost: optimize calls to check_plain() by trying to use new PHP 5 features and inlining UTF-8 checking

#320171 by Deve Reid, jbrauer: fix return value passing by reference in bootstrap.inc's IP address checking

#732064 follow up by pwolanin: move lock system loading earlier to avoid stepping over it or attempting to use it before it is loaded

#251792 by pwolanin, Damien Tournoud, slantview, c960657: added a locking framework for long running operations; solves rebuilding issues with menus and the locale cache

#203323 by JirkaRybka, robertgarrigos, lilou, thePanz, c960657, sun: move the LANGUAGE_* constants to bootstrap.inc and remove several defined() checks on them now that they are always defined

#346285 by grendzy, Damien Tournoud, thekevinday et al: fixed problem when HTTP_HOST is not transmitted

#323474 by gpk, Dave Reid, catch: hook_boot() was not called on non-cached pages when agreesive caching was on

#324875 by pwolanin: improve HTTP_HOST checking, ensuring that the host is lowercased and only valid characters are allowed.

#225880 by pwolanin, keith.smith: get the user create settings.php instead of Drupal, so upgrading getseasier