Security update

SA-CONTRIB-2012-093 - Node Embed - Access Bypass
Security update to add permission to node list used in CKEditor and #1481526: Suppress Administration Menu module's toolbar in the Node Embed popup

SA-CONTRIB-2012-097 - Protest - Cross Site Scripting (XSS).

SA-CONTRIB-2012-097 - Protest - Cross Site Scripting (XSS).

Fixed security related issues that could allow a XSS or CSRF attack and potentially allow someone to post a link that an maestro admin clicks on and deletes workflow related data. Added token support to all forms and AJAX actions to secure all forms and admin/user actions. See SA-CONTRIB-2012-094 - Maestro module - Cross Site Request Forgery (CSRF), Cross Site Scripting (XSS) for more details.

Additional fixes and changes from previous commits to the dev branch include:

Changes since 7.x-1.3:

See SA-CONTRIB-2012-086 - Amadou - Cross Site Scripting.

An XSS vulnerability was identified in Amadou theme's themes_links() function in the template.php file, which was fixed in the theme_links() function in Drupal 6.3 as noted in (SA-2008-044 http://drupal.org/node/280571).

This release fixes that security issue and should be applied to all Drupal 6 websites running Amadou theme.

The current 6.x-1.x-dev release also contains this fix.