Issue #1870612 by David_Rothstein, plach, greggles: Add tests for SA-CORE-2012-004 - Drupal core - Arbitrary code execution via file upload.

Issue #1857956 by catch, David_Rothstein: Do not re-prepare comment update timestamp if it's the same as the created timestamp (performance improvement).

Issue #1815930 by slashrsm, gbrands, amontero: Fixed Update watchdog message in file_unmanaged_copy() with correct string/variable replacement values.

Issue #1143460 by WorldFallz, Dave Reid, colette, typhonius, David_Rothstein | localhost: Fixed hook_file_download_access_alter() missing entity argument (by allowing an additional context argument to be passed to drupal_alter()).

Issue #1864188 by johnshortess | hefox: Fixed user_filters() invokes hook_permission() with argument 'permission' ($function('permission')).

Issue #1741386 by lazysoundsystem, rasmusluckow, andypost, Lars Toomre, dcam: Removing t() from asserts in simpletests in book module.

Issue #1874342 by erikwebb: Fixed Undefined constant STEAM_WRAPPERS_LOCAL used in file_get_stream_wrappers() documentation.

Issue #1873608 by David_Rothstein: Improve documentation of format_string() to emphasize that it is used to prepare variables for HTML display.

Issue #1629994 by Aron Novak, oadaeh, yurtboy, jhodgdon, kingandy: Fixed Mail functions reference obsolete RFC.

Issue #1606946 follow-up by David_Rothstein: Remove note about const from D7 docs since we don't require PHP 5.3.

Issue #1847382 by thehong, pingwin4eg, 63reasons: Fixed Undefined index: access in includes/menu.inc (when custom access_callback() does not exist or does not get included).

Issue #1706878 by tim.plunkett, lazysoundsystem: Added DrupalWebTestCase::assertThemeOutput() to allow modules to test theme function output.

Issue #1446650 by superspring | drupalsven: Added After installing module display link to 'install another module'.

Issue #1727430 by tedbow, webchick, fubhy | amontero: Added 'exclusive' flag to install profiles to auto-select them during installation.

Issue #843114 by sun, quicksketch, Berdir | c960657: Fixed DatabaseConnection::__construct() and DatabaseConnection_mysql()::__construct() leaks $this (Too many connections).

Issue #1494676 by Liam Morland, cam8001: Removed unused variable $http_protocol in drupal_settings_initialize().

Issue #1672694 by Devin Carlson, JulienD, jibran, kalabro: Fixed Field UI continues to use t() for $instance['label'] in field_ui().admin.inc.

Issue #1550892 by david.mckay | fgm: Fixed reset() on function call in image_update_7002() to avoid an E_STRICT notice.

Issue #1833028 by michaelmol | rmfleet: Fixed bug which prevented image styles from being reverted on PHP 5.4.

Issue #1733476 by greggles, BMDan: Fixed Make default htaccess rules protocol sensitive to avoid man-in-the-middle-attacks if users don't fully customize the rule.