Security update

Maintenance and security release of the Drupal 6 series.

This release fixes security vulnerabilities. Sites are urged to upgrade immediately after reading the security announcement:

• SA-CORE-2012-004 - Drupal core - Multiple vulnerabilities

No other fixes are included.

No changes have been made to the .htaccess, robots.txt or settings.php files in this release, so upgrading custom versions of those files is not necessary.

• Addition of block token to ensure json block rendering is only available to those who can place blocks
• Issue #1253110: support pressflow drupal_set_headers by pdrake: Support for pressflow, drupal_set_header returns an array instead of string

#1866148 by stijndm: Closing the inline editor results in a page not found on sites using path prefixex
Addition of block token to ensure json block rendering is only available to those who can place blocks

The resolves some bugs in 6.x-1.14-beta2, improves the Dublin Core integration and includes a fix for a non-critical security issue. It is recommended to review the release notes for v6.x-1.14-beta1 and beta2 prior to upgrading from 6.x-1.13 as there are several important changes. See also SA-CONTRIB-2012-173 - Nodewords: Information disclosure

Security update:
o #1830812: Cross site scripting through URLS in Zero Point theme

SA-CONTRIB-2012-167 - Zero Point - Cross Site Scripting (XSS)

Security update:
o #1830812: Cross site scripting through URLS in Zero Point theme

SA-CONTRIB-2012-167 - Zero Point - Cross Site Scripting (XSS)