Improved performance for several reports and several other enhancements

Today's update (1234623) brings with it the following changes:

Security issues

• All request handlers that support search queries now need a minimum of three characters to be valid. The search syntax is now consistently validated before it is passed on to the database.

Performance improvements

• The My students report has been improved. It should now render faster.
• The group members report has been optimized quite a lot and should no longer cause timeouts for groups with excessively large member count. If more than 100 table rows are shown then icons are skipped to improve speed. If more than a 1000 users are shown then they are not collectable.
• The inbox/outbox should now be much more performant. The local template variables are also much more consistent. The HTTP API has been slightly changed (related to pagination).
• Automatically-generated messages older than a year will now be automatically deleted.

Enhancements

• The Course result report now shows the total time used in the course.
• The continous summary table in Page views report has been hidden behind the enable_page_views_live_report user configuration variable. It is off by default.
• The synthetic speech client now allow text and text selections in iframes to be read. The code has also been improved so it doesn't try to read JavaScript code out loud. Be aware that content in cross-origin frames or non-HTTPS frames will not be read from an HTTPS-enabled page. The starting DOM element can also be specified in the init method.
• The MP3 audio player can now be configured to place the label, slider and buttons in whatever order you want it. The currently-playing audio player is now targetable with a CSS class.
• Global and system groups are now shown in the user profile, if the user is a member of them.
• The following request handlers now support ignorable path parameters before the UUID: read, read_container, data, download

Feature removals / deprecations

• The java-settings and flash-settings object types were removed. Existing objects have been changed to type app-input.
• The java-data and flash-data object types were removed. Existing objects have been changed to type app-output.