Merging - fingers crossed

Conflicts:
	system/database/drivers/mysql/mysql_driver.php
	system/database/drivers/mysqli/mysqli_driver.php
	system/libraries/Email.php
	user_guide/changelog.html
	user_guide/database/configuration.html
	user_guide/helpers/url_helper.html
	user_guide/libraries/cart.html
	user_guide/libraries/form_validation.html

2 files changed, 6 insertions, 2 deletions

diff --git a/system/helpers/form_helper.php b/system/helpers/form_helper.php
index 2925d3c7c..5720a06ec 100644
--- a/system/helpers/form_helper.php
+++ b/system/helpers/form_helper.php
@@ -64,8 +64,8 @@ if ( ! function_exists('form_open'))
 
 		$form .= '>';
 
-		// CSRF
-		if ($CI->config->item('csrf_protection') === TRUE)
+		// Add CSRF field if enabled, but leave it out for GET requests and requests to external websites	
+		if ($CI->config->item('csrf_protection') === TRUE AND ! (strpos($action, $CI->config->site_url()) === FALSE OR strpos($form, 'method="get"')))	
 		{
 			$hidden[$CI->security->get_csrf_token_name()] = $CI->security->get_csrf_hash();
 		}
diff --git a/system/helpers/html_helper.php b/system/helpers/html_helper.php
index 080f622dd..b64b60650 100644
--- a/system/helpers/html_helper.php
+++ b/system/helpers/html_helper.php
@@ -124,6 +124,10 @@ if ( ! function_exists('_list'))
 			}
 			$attributes = $atts;
 		}
+		elseif (is_string($attributes) AND strlen($attributes) > 0)
+		{
+			$attributes = ' '. $attributes;
+		}
 
 		// Write the opening list tag
 		$out .= "<".$type.$attributes.">\n";