- Global Auth::setAdvancedSecurity  ($flag=true)
- Add challenge cookies - Create a cookie which changes every time and contains some challenge key which the server can verify with a session var cookie might need to be crypted (user pass)  
- Global Auth_Container_IMAP::Auth_Container_IMAP  ($params)
- Use PEAR Net_IMAP if IMAP extension not loaded  
- Global Auth_Controller::Auth_Controller  (&$auth_obj, $login='login.php', $default='index.php', $accessList=array())
- Add a list of urls which need redirection  
- Global Auth_Controller::start  ()
- Implement an access list which specifies which urls/pages need login and which do not  
- Global Auth_OpenID_Parse::parseLinkAttrs  ($html)
- This is quite ineffective and may fail with the default pcre.backtrack_limit of 100000 in PHP 5.2, if $html is big. It should rather use stripos (in PHP5) or strpos()+strtoupper() in PHP4 to manage this. 
- Global CleanUpTest::doTestBytes  ($head, $tail)
- document  
- Global CleanUpTest::doTestDoubleBytes  ($head, $tail)
- document  
- Global CleanUpTest::doTestTripleBytes  ($head, $tail)
- document  
- Global CleanUpTest::setUp  ()
- document  
- Global CleanUpTest::tearDown  ()
- document  
- Global CleanUpTest::testAllBytes  ()
- document  
- Global CleanUpTest::testAscii  ()
- document  
- Global CleanUpTest::testBomRegression  ()
- document  
- Global CleanUpTest::testChunkRegression  ()
- document  
- Global CleanUpTest::testDoubleBytes  ()
- document  
- Global CleanUpTest::testForbiddenRegression  ()
- document  
- Global CleanUpTest::testHangulRegression  ()
- document  
- Global CleanUpTest::testInterposeRegression  ()
- document  
- Global CleanUpTest::testLatin  ()
- document  
- Global CleanUpTest::testLatinNormal  ()
- document  
- Global CleanUpTest::testNull  ()
- document  
- Global CleanUpTest::testOverlongRegression  ()
- document  
- Global CleanUpTest::testSurrogateRegression  ()
- document  
- Global CleanUpTest::testTripleBytes  ()
- document  
- Global CleanUpTest::XtestAllChars  ()
- document  
- Group DifferenceEngine  
- indicate where diff.doc can be found. - document - document - document - document - document - document - document - document, bad name. - document - document - document - document 
- Class HTMLPurifier  
- We need an easier way to inject strategies using the configuration object.  
- Global HTMLPurifier_AttrDef_CSS_Composite::$defs  
- Make protected  
- Global HTMLPurifier_AttrDef_CSS_Multiple::$max  
- Make protected  
- Global HTMLPurifier_AttrDef_CSS_Multiple::$single  
- Make protected  
- Global HTMLPurifier_AttrDef_Enum::$valid_values  
- Make protected  
- Class HTMLPurifier_Config  
- Reconsider some of the public member variables  
- Class HTMLPurifier_ContentSets  
- Unit test  
- Global HTMLPurifier_CSSDefinition::setupConfigStuff  ($config)
- Refactor duplicate elements into common class (probably using composition, not inheritance).  
- Class HTMLPurifier_DefinitionCache  
- Create a separate maintenance file advanced users can use to cache their custom HTMLDefinition, which can be loaded via a configuration directive  - Implement memcached   
- Global HTMLPurifier_DefinitionCache_Serializer::generateBaseDirectoryPath  ($config)
- Make protected  
- Global HTMLPurifier_DefinitionCache_Serializer::generateDirectoryPath  ($config)
- Make protected  
- Global HTMLPurifier_DefinitionCache_Serializer::generateFilePath  ($config)
- Make protected  
- Global HTMLPurifier_Filter_ExtractStyleBlocks::preFilter  ($html, $config, $context)
- Extend to indicate non-text/css style blocks  
- Class HTMLPurifier_Generator  
- Refactor interface so that configuration/context is determined upon instantiation, no need for messy generateFromTokens() calls  - Make some of the more internal functions protected, and have unit tests work around that   
- Global HTMLPurifier_Generator::escape  ($string, $quote=null)
- This really ought to be protected, but until we have a facility for properly generating HTML here w/o using tokens, it stays public.  
- Global HTMLPurifier_HTMLDefinition::parseTinyMCEAllowedList  ($list)
- Give this its own class, probably static interface  
- Class HTMLPurifier_HTMLModule  
- Consider making some member functions protected  
- Class HTMLPurifier_HTMLModule_Tidy  
- Figure out how to protect some of these methods/properties  
- Global HTMLPurifier_HTMLModule_Tidy::setup  ($config)
- Wildcard matching and error reporting when an added or subtracted fix has no effect.  
- Class HTMLPurifier_Injector  
- Allow injectors to request a re-run on their output. This would help if an operation is recursive.  
- Class HTMLPurifier_Injector_AutoParagraph  
- Ensure all states are unit tested, including variations as well.  - Make a graph of the flow control for this Injector.   
- Global HTMLPurifier_Language::$_loaded  
- Make it private, fix usage in HTMLPurifier_LanguageTest  
- Global HTMLPurifier_Language::formatMessage  ($key, $args=array())
- Implement conditionals? Right now, some messages make reference to line numbers, but those aren't always available  
- Class HTMLPurifier_LanguageFactory  
- Serialized cache for languages  
- Global HTMLPurifier_Lexer::extractBody  ($html)
- Consider making protected  
- Global HTMLPurifier_Lexer::normalize  ($html, $config, $context)
- Consider making protected  
- Class HTMLPurifier_Lexer_DirectLex  
- Reread XML spec and document differences.  
- Class HTMLPurifier_Lexer_PEARSax3  
- Generalize so that XML_HTMLSax is also supported. 
- Class HTMLPurifier_Printer_ConfigForm  
- Rewrite to use Interchange objects  
- Global HTMLPurifier_Printer_HTMLDefinition::listifyObjectList  ($array)
- Also add information about internal state  
- Class HTMLPurifier_Strategy_FixNesting  
- Enable nodes to be bubbled out of the structure.  
- Class HTMLPurifier_TokenFactory  
- Port DirectLex to use this  
- Class HTMLPurifier_URIScheme_mailto  
- Validate the email address  - Filter allowed query parameters   
- Class ilAuthContainerSOAP  
- This class should inherit either from Auth_Container_SOAP or Auth_Container_SOAP5  
- Global ilAuthOpenId::supportsRedirects  ()
- check if redirects are possible 
- Global ilConsultationHoursGUI::appointmentList  ()
- add list/filter of consultation hours if user is responsible for more than one other consultation hour series.  
- Global ilDBOracle::now  ()
- fix this  
- Global ilDBPostgreSQL::now  ()
- fix this  
- Class ilErrorHandling  
- when an error occured and clicking the back button to return to previous page the referer-var in session is deleted -> server error  
- Class ILIAS  
- review the concept how the object type definition is loaded. We need a concept to edit the definitions via webfrontend in the admin console.  
- Class ilLanguage  
- Das Datefeld wird bei Aenderungen einer Sprache (update, install, deinstall) nicht richtig gesetzt!!! Die Formatfunktionen gehoeren nicht in class.Language. Die sind auch woanders einsetzbar!!! Daher->besser in class.Format  - The DATE field is not set correctly on changes of a language (update, install, your stable). The format functions do not belong in class.Language. Those are also applicable elsewhere. Therefore, they would be better placed in class.Format   
- Global ilMediaPoolPage::lookupUsages  ($a_id)
- : This should be all in one context -> mob id table  
- Global ilMembershipRegistrationCodes::register  ($a_user_id)
- Throw exeption if registration is impossible due to other restrictions. 
- Global ilMembershipRegistrationCodeUtils::useCode  ($a_code, $a_endnode)
- : throw an error if registration fails (max members, availibility...) 
- Global ilObject::putInTree  ($a_parent_ref)
- role/rbac stuff  
- Global ilObjMediaObject::lookupUsages  ($a_id, $a_include_history=true)
- : This should be all in one context -> mob id table  
- Global ilObjQuestionPool::_getSelfAssessmentQuestionTypes  ($all_tags=FALSE)
- Make it more flexible  
- Global ilObjSCORM2004LearningModuleGUI::confirmedDeleteTracking  ()
- alex, 14 Apr.: This does not confirm to our guidelines, please move DB access to application class  
- Global ilObjSCORMTracking::_getCompleted  ($scorm_item_id, $a_obj_id)
- avoid like search against clob field rvalue  
- Global ilObjSCORMTracking::_getFailed  ($scorm_item_id, $a_obj_id)
- avoid like search against clob field rvalue  
- Global ilObjSCORMTracking::_getInProgress  ($scorm_item_id, $a_obj_id)
- avoid like search against clob field rvalue  
- Global ilPrivacySettings::checkExportAccess  ($a_ref_id, $a_user_id=0)
- rename  
- Global ilSCORM2004NodeGUI::putInTree  ($a_parent_id, $a_target)
- : move to application class  
- Global ilSCORM2004NodeGUI::showOrganization  ()
- : check if we need this  - : check if we need this  - : check if we need this  - : check if we need this   
- Global ilSearchSettings::getEnabledLuceneItemFilterDefinitions  ()
- This has to be defined in module.xml  
- Global ilSearchSettings::getLuceneItemFilterDefinitions  ()
- This has to be defined in module.xml  
- Global ilShopShoppingCartGUI::finishEPay  ()
- : Check for ePay/PBS error  - : Flyt fakturering til callback   
- Global ilWikiUtil::processInternalLinks  ($s, $a_wiki_id, $a_mode=IL_WIKI_MODE_REPLACE, $a_collect_non_ex=false)
- We might want to use trim($tmp, "\n") here.  
- Global Mail_smtpmx::$debug  
- as I need unique error-codes to identify what exactly went wrond I did not use intergers as it should be. Instead I added a "namespace" for each code. This avoids conflicts with error codes from different classes. How can I use unique error codes and stay conform with PEAR?  
- Group Parser  
- document, briefly. - document, briefly. 
- Global Parser::replaceInternalLinks  ($s)
- We might want to use trim($tmp, "\n") here.  
- Global Parser::replaceUnusualEscapes  ($url)
- This can merge genuinely required bits in the path or query string, breaking legit URLs. A proper fix would treat the various parts of the URL differently; as a workaround, just use the output for statistical records, not for actual linking/output.  
- Global Sanitizer::escapeClass  ($class)
- For extra validity, input should be validated UTF-8. 
- Global Sanitizer::setupAttributeWhitelist  ()
- Document it a bit  
- Global Sanitizer::validateTagAttributes  ($attribs, $element)
- Check for legal values where the DTD limits things.  - Check for unique id attribute :P   
- Global Services_JSON::isError  ($data, $code=null)
- Ultimately, this should just call PEAR::isError()  - Ultimately, this should just call PEAR::isError()   
- Namespace SOAP  
- 
- add wsdl caching
- refactor namespace handling ($namespace/$ns)
- implement IDL type syntax declaration so we can generate WSDL
 - use Net_Socket; implement some security scheme; implement support for attachments  public 
- Global Title::newFromID  ($id)
- This is inefficiently implemented, the page row is requested but not used for anything else 
- Global Title::setFragment  ($fragment)
- clarify whether access is supposed to be public (was marked as "kind of public")  
- Global Title::userCanEditCssJsSubpage  ()
- XXX: this might be better using restrictions  
- Global Title::userCanRead  ()
- fold these checks into userCan()  
- Global XML_Util::attributesToString  ($attributes, $sort=true, $multiline=false, $indent= ' ', $linebreak="\n", $entities=XML_UTIL_ENTITIES_XML)
- allow sort also to be an options array  
- Global XML_Util::collapseEmptyTags  ($xml, $mode=XML_UTIL_COLLAPSE_ALL)
- PEAR CS - unable to avoid "space after open parens" error in the IF branch  
- Global XML_Util::isValidName  ($string)
- support for other charsets  - PEAR CS - unable to avoid 85-char limit on second preg_match   
- Global XML_Util::raiseError  ($msg, $code)
- PEAR CS - should this use include_once instead?