diff --git a/changelog.html b/changelog.html
index ef6b8539991e4c7cd7b1856cab78c4a774872cc7..ed9ebcab676ec57956f5242fe13aa78a6626a866 100644
--- a/changelog.html
+++ b/changelog.html
@@ -80,6 +80,9 @@ Upcoming changes</a>
 <div id="rc" style="display:none;"><!--=BEGIN=-->
 <h3><a name=v1.502>What's new in 1.502</a> <!--=DATE=--></h3>
 <ul class=image>
+  <li class='major bug'>
+    Miscellaneous security vulnerability fixes. See the advisory for more details.
+    (SECURITY-13,16,46,47,54,55,59,60,61)
   <li class='major bug'>
     Builds disappear from build history after completion.
     (<a href="https://issues.jenkins-ci.org/browse/JENKINS-15156">issue 15156</a>)
diff --git a/core/pom.xml b/core/pom.xml
index 8e6db118c6bfc483e81ff4b9633eaef2107210d7..2f7648cc6941a2258db005a35421ee02e31cc569 100644
--- a/core/pom.xml
+++ b/core/pom.xml
@@ -43,6 +43,7 @@ THE SOFTWARE.
   <properties>
     <staplerFork>true</staplerFork>
     <stapler.version>1.199</stapler.version>
+    <spring.version>2.5.6.SEC03</spring.version>
   </properties>
 
   <dependencies>
@@ -422,18 +423,18 @@ THE SOFTWARE.
         Ideally we should be able to modify BeanBuilder so as not to depend on this.
       -->
       <groupId>org.springframework</groupId>
-      <artifactId>spring-web</artifactId>
-      <version>2.5</version>
+      <artifactId>spring-webmvc</artifactId>
+      <version>${spring.version}</version>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-core</artifactId>
-      <version>2.5</version>
+      <version>${spring.version}</version>
     </dependency>
     <dependency><!-- Jenkins core doesn't use it but HUDSON-3811 requires us to put it. -->
       <groupId>org.springframework</groupId>
       <artifactId>spring-aop</artifactId>
-      <version>2.5</version>
+      <version>${spring.version}</version>
     </dependency>
     <dependency>
       <groupId>xpp3</groupId>
diff --git a/core/src/main/java/hudson/model/AbstractBuild.java b/core/src/main/java/hudson/model/AbstractBuild.java
index 858580ed948461970485befc89fb00bc78642a12..141bac16fc0cd74cd05237c3c4e8f1a3048bb9c5 100644
--- a/core/src/main/java/hudson/model/AbstractBuild.java
+++ b/core/src/main/java/hudson/model/AbstractBuild.java
@@ -88,6 +88,7 @@ import java.util.Set;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 import javax.annotation.CheckForNull;
+import org.kohsuke.stapler.interceptor.RequirePOST;
 
 /**
  * Base implementation of {@link Run}s that build software.
@@ -1360,6 +1361,7 @@ public abstract class AbstractBuild<P extends AbstractProject<P,R>,R extends Abs
      * 
      * @since 1.489
      */
+    @RequirePOST
     public synchronized HttpResponse doStop() throws IOException, ServletException {
         Executor e = getExecutor();
         if (e==null)
diff --git a/core/src/main/java/hudson/model/AbstractProject.java b/core/src/main/java/hudson/model/AbstractProject.java
index d2d64a6f469151022c618ed591727899ec68956a..e6b606b72c79b76fda2ed23f3f6183ee2d6208db 100644
--- a/core/src/main/java/hudson/model/AbstractProject.java
+++ b/core/src/main/java/hudson/model/AbstractProject.java
@@ -1752,10 +1752,17 @@ public abstract class AbstractProject<P extends AbstractProject<P,R>,R extends A
      */
     public void doBuild( StaplerRequest req, StaplerResponse rsp, @QueryParameter TimeDuration delay ) throws IOException, ServletException {
         if (delay==null)    delay=new TimeDuration(getQuietPeriod());
-        BuildAuthorizationToken.checkPermission(this, authToken, req, rsp);
 
         // if a build is parameterized, let that take over
         ParametersDefinitionProperty pp = getProperty(ParametersDefinitionProperty.class);
+        if (pp != null && !req.getMethod().equals("POST")) {
+            // show the parameter entry form.
+            req.getView(pp, "index.jelly").forward(req, rsp);
+            return;
+        }
+
+        BuildAuthorizationToken.checkPermission(this, authToken, req, rsp);
+
         if (pp != null) {
             pp._doBuild(req,rsp,delay);
             return;
@@ -1765,7 +1772,7 @@ public abstract class AbstractProject<P extends AbstractProject<P,R>,R extends A
             throw HttpResponses.error(SC_INTERNAL_SERVER_ERROR,new IOException(getFullName()+" is not buildable"));
 
         Jenkins.getInstance().getQueue().schedule(this, (int)delay.getTime(), getBuildCause(req));
-        rsp.forwardToPreviousPage(req);
+        rsp.sendRedirect(".");
     }
 
     /**
@@ -1825,12 +1832,13 @@ public abstract class AbstractProject<P extends AbstractProject<P,R>,R extends A
     public void doPolling( StaplerRequest req, StaplerResponse rsp ) throws IOException, ServletException {
         BuildAuthorizationToken.checkPermission(this, authToken, req, rsp);
         schedulePolling();
-        rsp.forwardToPreviousPage(req);
+        rsp.sendRedirect(".");
     }
 
     /**
      * Cancels a scheduled build.
      */
+    @RequirePOST
     public void doCancelQueue( StaplerRequest req, StaplerResponse rsp ) throws IOException, ServletException {
         checkPermission(ABORT);
 
@@ -1906,6 +1914,13 @@ public abstract class AbstractProject<P extends AbstractProject<P,R>,R extends A
         triggers = buildDescribable(req, Trigger.for_(this));
         for (Trigger t : triggers)
             t.start(this,true);
+
+        for (Publisher _t : Descriptor.newInstancesFromHeteroList(req, json, "publisher", Jenkins.getInstance().getExtensionList(BuildTrigger.DescriptorImpl.class))) {
+            BuildTrigger t = (BuildTrigger) _t;
+            for (AbstractProject downstream : t.getChildProjects(this)) {
+                downstream.checkPermission(BUILD);
+            }
+        }
     }
 
     /**
diff --git a/core/src/main/java/hudson/model/Api.java b/core/src/main/java/hudson/model/Api.java
index 30772661b999e3d7370fbd1af2274d8164563662..5bb9b8f8af1f6383551a0c7bc26eecb20197f485 100644
--- a/core/src/main/java/hudson/model/Api.java
+++ b/core/src/main/java/hudson/model/Api.java
@@ -45,6 +45,7 @@ import java.io.IOException;
 import java.io.OutputStream;
 import java.io.StringReader;
 import java.io.StringWriter;
+import java.net.HttpURLConnection;
 import java.util.List;
 import java.util.logging.Level;
 import java.util.logging.Logger;
@@ -153,15 +154,14 @@ public class Api extends AbstractModelObject {
 
         OutputStream o = rsp.getCompressedOutputStream(req);
         try {
-            if(result instanceof CharacterData) {
-                rsp.setContentType("text/plain;charset=UTF-8");
-                o.write(((CharacterData)result).getText().getBytes("UTF-8"));
-                return;
-            }
-
-            if(result instanceof String || result instanceof Number || result instanceof Boolean) {
-                rsp.setContentType("text/plain;charset=UTF-8");
-                o.write(result.toString().getBytes("UTF-8"));
+            if (result instanceof CharacterData || result instanceof String || result instanceof Number || result instanceof Boolean) {
+                if (INSECURE) {
+                    rsp.setContentType("text/plain;charset=UTF-8");
+                    String text = result instanceof CharacterData ? ((CharacterData) result).getText() : result.toString();
+                    o.write(text.getBytes("UTF-8"));
+                } else {
+                    rsp.sendError(HttpURLConnection.HTTP_FORBIDDEN, "primitive XPath result sets forbidden; can use -Dhudson.model.Api.INSECURE=true if you run without security");
+                }
                 return;
             }
 
@@ -188,8 +188,12 @@ public class Api extends AbstractModelObject {
      * Exposes the bean as JSON.
      */
     public void doJson(StaplerRequest req, StaplerResponse rsp) throws IOException, ServletException {
+        if (INSECURE || req.getParameter("jsonp") == null) {
         setHeaders(rsp);
-        rsp.serveExposedBean(req,bean, Flavor.JSON);
+            rsp.serveExposedBean(req,bean, Flavor.JSON);
+        } else {
+            rsp.sendError(HttpURLConnection.HTTP_FORBIDDEN, "jsonp forbidden; can use -Dhudson.model.Api.INSECURE=true if you run without security");
+        }
     }
 
     /**
@@ -207,4 +211,6 @@ public class Api extends AbstractModelObject {
 
     private static final Logger LOGGER = Logger.getLogger(Api.class.getName());
     private static final ModelBuilder MODEL_BUILDER = new ModelBuilder();
+    private static final boolean INSECURE = "true".equals(System.getProperty("hudson.model.Api.INSECURE"));
+
 }
diff --git a/core/src/main/java/hudson/model/BuildAuthorizationToken.java b/core/src/main/java/hudson/model/BuildAuthorizationToken.java
index be55eadb89174c749c1a068ca840d456747831c8..ddb92839256cc4a3865d785a8e779d89a49af203 100644
--- a/core/src/main/java/hudson/model/BuildAuthorizationToken.java
+++ b/core/src/main/java/hudson/model/BuildAuthorizationToken.java
@@ -31,7 +31,9 @@ import org.kohsuke.stapler.StaplerRequest;
 import org.kohsuke.stapler.StaplerResponse;
 
 import java.io.IOException;
+import jenkins.security.ApiTokenProperty;
 import org.acegisecurity.AccessDeniedException;
+import org.kohsuke.stapler.HttpResponses;
 
 /**
  * Authorization token to allow projects to trigger themselves under the secured environment.
@@ -73,6 +75,16 @@ public final class BuildAuthorizationToken {
         }
 
         project.checkPermission(AbstractProject.BUILD);
+
+        if (req.getMethod().equals("POST")) {
+            return;
+        }
+
+        if (req.getAttribute(ApiTokenProperty.class.getName()) instanceof User) {
+            return;
+        }
+
+        throw HttpResponses.forwardToView(project, "requirePOST.jelly");
     }
 
     public String getToken() {
diff --git a/core/src/main/java/hudson/model/Descriptor.java b/core/src/main/java/hudson/model/Descriptor.java
index bf8e40e992d6d13224287199433fd7c9112e4993..195c5e4afa26d6dd03caffd68f11a75f0a4f59bc 100644
--- a/core/src/main/java/hudson/model/Descriptor.java
+++ b/core/src/main/java/hudson/model/Descriptor.java
@@ -936,7 +936,10 @@ public abstract class Descriptor<T extends Describable<T>> implements Saveable {
             for (Object o : JSONArray.fromObject(formData)) {
                 JSONObject jo = (JSONObject)o;
                 String kind = jo.getString("kind");
-                items.add(find(descriptors,kind).newInstance(req,jo));
+                Descriptor<T> d = find(descriptors, kind);
+                if (d != null) {
+                    items.add(d.newInstance(req, jo));
+                }
             }
         }
 
@@ -946,7 +949,7 @@ public abstract class Descriptor<T extends Describable<T>> implements Saveable {
     /**
      * Finds a descriptor from a collection by its class name.
      */
-    public static <T extends Descriptor> T find(Collection<? extends T> list, String className) {
+    public static @CheckForNull <T extends Descriptor> T find(Collection<? extends T> list, String className) {
         for (T d : list) {
             if(d.getClass().getName().equals(className))
                 return d;
@@ -960,7 +963,7 @@ public abstract class Descriptor<T extends Describable<T>> implements Saveable {
         return null;
     }
 
-    public static Descriptor find(String className) {
+    public static @CheckForNull Descriptor find(String className) {
         return find(Jenkins.getInstance().getExtensionList(Descriptor.class),className);
     }
 
diff --git a/core/src/main/java/hudson/model/Executor.java b/core/src/main/java/hudson/model/Executor.java
index 6a7c26c000d553e362e7fc3f2f617f986a819db1..ee4eddec365ddfe6277b1e8af73a5ce1ff6841e8 100644
--- a/core/src/main/java/hudson/model/Executor.java
+++ b/core/src/main/java/hudson/model/Executor.java
@@ -57,6 +57,7 @@ import java.lang.reflect.Method;
 
 import static hudson.model.queue.Executables.*;
 import static java.util.logging.Level.FINE;
+import org.kohsuke.stapler.interceptor.RequirePOST;
 
 
 /**
@@ -468,6 +469,7 @@ public class Executor extends Thread implements ModelObject {
      * @deprecated as of 1.489
      *      Use {@link #doStop()}.
      */
+    @RequirePOST
     public void doStop( StaplerRequest req, StaplerResponse rsp ) throws IOException, ServletException {
         doStop().generateResponse(req,rsp,this);
     }
diff --git a/core/src/main/java/hudson/model/ParametersDefinitionProperty.java b/core/src/main/java/hudson/model/ParametersDefinitionProperty.java
index d87ac8199a638027efb87cfc4c6f3e76791dfc90..0cc266ce430fcfb0498dbb574411bbc7ecfaba6f 100644
--- a/core/src/main/java/hudson/model/ParametersDefinitionProperty.java
+++ b/core/src/main/java/hudson/model/ParametersDefinitionProperty.java
@@ -113,11 +113,6 @@ public class ParametersDefinitionProperty extends JobProperty<AbstractProject<?,
      * This method is supposed to be invoked from {@link AbstractProject#doBuild(StaplerRequest, StaplerResponse, TimeDuration)}.
      */
     public void _doBuild(StaplerRequest req, StaplerResponse rsp, @QueryParameter TimeDuration delay) throws IOException, ServletException {
-        if(!req.getMethod().equals("POST")) {
-            // show the parameter entry form.
-            req.getView(this,"index.jelly").forward(req,rsp);
-            return;
-        }
         if (delay==null)    delay=new TimeDuration(owner.getQuietPeriod());
 
 
diff --git a/core/src/main/java/hudson/model/Queue.java b/core/src/main/java/hudson/model/Queue.java
index 3ff6bc7db9b685ab2a86b1c4b8a94c2233fcb623..f1a852d6dcd5b15714bca18ad98f43e45ce8b609 100644
--- a/core/src/main/java/hudson/model/Queue.java
+++ b/core/src/main/java/hudson/model/Queue.java
@@ -106,6 +106,7 @@ import org.kohsuke.stapler.export.ExportedBean;
 import com.thoughtworks.xstream.XStream;
 import com.thoughtworks.xstream.converters.basic.AbstractSingleValueConverter;
 import org.kohsuke.stapler.QueryParameter;
+import org.kohsuke.stapler.interceptor.RequirePOST;
 
 /**
  * Build queue.
@@ -612,6 +613,7 @@ public class Queue extends ResourceController implements Saveable {
     /**
      * Called from {@code queue.jelly} and {@code entries.jelly}.
      */
+    @RequirePOST
     public HttpResponse doCancelItem(@QueryParameter int id) throws IOException, ServletException {
         Item item = getItem(id);
         if (item != null) {
@@ -1435,6 +1437,7 @@ public class Queue extends ResourceController implements Saveable {
 
         /** @deprecated Use {@link #doCancelItem} instead. */
         @Deprecated
+        @RequirePOST
         public HttpResponse doCancelQueue() throws IOException, ServletException {
         	Jenkins.getInstance().getQueue().cancel(this);
             return HttpResponses.forwardToPreviousPage();
diff --git a/core/src/main/java/hudson/security/csrf/CrumbIssuer.java b/core/src/main/java/hudson/security/csrf/CrumbIssuer.java
index c5829477fba34d7a7b94abfe628c9b0abb96e36c..9c723723b0aa75c42a148f3aadaede76dedb331c 100644
--- a/core/src/main/java/hudson/security/csrf/CrumbIssuer.java
+++ b/core/src/main/java/hudson/security/csrf/CrumbIssuer.java
@@ -21,6 +21,13 @@ import hudson.model.Api;
 import hudson.model.Describable;
 import hudson.model.Descriptor;
 import hudson.util.MultipartFormDataParser;
+import java.io.IOException;
+import java.io.OutputStream;
+import javax.servlet.ServletException;
+import org.kohsuke.accmod.Restricted;
+import org.kohsuke.accmod.restrictions.NoExternalUse;
+import org.kohsuke.stapler.QueryParameter;
+import org.kohsuke.stapler.StaplerResponse;
 
 /**
  * A CrumbIssuer represents an algorithm to generate a nonce value, known as a
@@ -153,7 +160,7 @@ public abstract class CrumbIssuer implements Describable<CrumbIssuer>, Extension
     }
 
     public Api getApi() {
-        return new Api(this);
+        return new RestrictedApi(this);
     }
 
     /**
@@ -180,4 +187,45 @@ public abstract class CrumbIssuer implements Describable<CrumbIssuer>, Extension
             }
         });
     }
+
+    @Restricted(NoExternalUse.class)
+    public static class RestrictedApi extends Api {
+
+        RestrictedApi(CrumbIssuer instance) {
+            super(instance);
+        }
+
+        @Override public void doXml(StaplerRequest req, StaplerResponse rsp, @QueryParameter String xpath, @QueryParameter String wrapper, @QueryParameter String tree, @QueryParameter int depth) throws IOException, ServletException {
+            String text;
+            CrumbIssuer ci = (CrumbIssuer) bean;
+            if ("/*/crumbRequestField/text()".equals(xpath)) { // old FullDuplexHttpStream
+                text = ci.getCrumbRequestField();
+            } else if ("/*/crumb/text()".equals(xpath)) { // ditto
+                text = ci.getCrumb();
+            } else if ("concat(//crumbRequestField,\":\",//crumb)".equals(xpath)) { // new FullDuplexHttpStream; Main
+                text = ci.getCrumbRequestField() + ':' + ci.getCrumb();
+            } else if ("concat(//crumbRequestField,'=',//crumb)".equals(xpath)) { // NetBeans
+                if (ci.getCrumbRequestField().startsWith(".")) {
+                    text = ci.getCrumbRequestField() + '=' + ci.getCrumb();
+                } else {
+                    text = null;
+                }
+            } else {
+                text = null;
+            }
+            if (text != null) {
+                OutputStream o = rsp.getCompressedOutputStream(req);
+                try {
+                    rsp.setContentType("text/plain;charset=UTF-8");
+                    o.write(text.getBytes("UTF-8"));
+                } finally {
+                    o.close();
+                }
+            } else {
+                super.doXml(req, rsp, xpath, wrapper, tree, depth);
+            }
+        }
+
+    }
+
 }
diff --git a/core/src/main/java/hudson/tasks/BuildTrigger.java b/core/src/main/java/hudson/tasks/BuildTrigger.java
index 3646b55b8e7d0f0ec151c08f2176b42be45fe49c..432b1bbb079bc06ab91dadb326ca3b74e677f6c0 100644
--- a/core/src/main/java/hudson/tasks/BuildTrigger.java
+++ b/core/src/main/java/hudson/tasks/BuildTrigger.java
@@ -319,7 +319,7 @@ public class BuildTrigger extends Recorder implements DependencyDeclarer {
         /**
          * Form validation method.
          */
-        public FormValidation doCheck(@AncestorInPath Item project, @QueryParameter String value ) {
+        public FormValidation doCheck(@AncestorInPath Item project, @QueryParameter String value, @QueryParameter boolean upstream) {
             // Require CONFIGURE permission on this project
             if(!project.hasPermission(Item.CONFIGURE))      return FormValidation.ok();
 
@@ -334,6 +334,9 @@ public class BuildTrigger extends Recorder implements DependencyDeclarer {
                                 AbstractProject.findNearest(projectName,project.getParent()).getRelativeNameFrom(project)));
                     if(!(item instanceof AbstractProject))
                         return FormValidation.error(Messages.BuildTrigger_NotBuildable(projectName));
+                    if (!upstream && !item.hasPermission(Item.BUILD)) {
+                        return FormValidation.error(Messages.BuildTrigger_you_have_no_permission_to_build_(projectName));
+                    }
                     hasProjects = true;
                 }
             }
diff --git a/core/src/main/java/jenkins/security/ApiTokenFilter.java b/core/src/main/java/jenkins/security/ApiTokenFilter.java
index 02a40b206c73344402ad1f264eead124ff18dc6f..630ae5ec0482b120f84f5b841883ffea191e95f1 100644
--- a/core/src/main/java/jenkins/security/ApiTokenFilter.java
+++ b/core/src/main/java/jenkins/security/ApiTokenFilter.java
@@ -51,6 +51,7 @@ public class ApiTokenFilter implements Filter {
                     // as the user might be passing in a real password.
                     SecurityContext oldContext = ACL.impersonate(u.impersonate());
                     try {
+                        request.setAttribute(ApiTokenProperty.class.getName(), u);
                         chain.doFilter(request,response);
                         return;
                     } finally {
diff --git a/core/src/main/resources/hudson/matrix/MatrixProject/configure-entries.jelly b/core/src/main/resources/hudson/matrix/MatrixProject/configure-entries.jelly
index 07a8c2809c600dcca61763059ce828be39ad1251..103f6b870a96620d1491042c66f1451f53258f06 100644
--- a/core/src/main/resources/hudson/matrix/MatrixProject/configure-entries.jelly
+++ b/core/src/main/resources/hudson/matrix/MatrixProject/configure-entries.jelly
@@ -50,7 +50,7 @@ THE SOFTWARE.
       </f:optionalBlock>
 
       <f:entry title="${%Display Name}" field="displayNameOrNull">
-         <f:textbox checkUrl="'${rootURL}/checkDisplayName?displayName='+encodeURIComponent(this.value)+'&amp;jobName='+encodeURIComponent('${it.name}')"/>
+         <f:textbox checkUrl="'${rootURL}/checkDisplayName?displayName='+encodeURIComponent(this.value)+'&amp;jobName='+encodeURIComponent('${h.jsStringEscape(it.name)}')"/>
       </f:entry>
     </f:advanced>
   </f:section>
diff --git a/core/src/main/resources/hudson/model/AbstractItem/configure-common.jelly b/core/src/main/resources/hudson/model/AbstractItem/configure-common.jelly
index 4fe2269e12b4b5495a4f4c7cd6d198604b0fb4b5..38e8e78772e499206c0b7c49f349cecd33604560 100644
--- a/core/src/main/resources/hudson/model/AbstractItem/configure-common.jelly
+++ b/core/src/main/resources/hudson/model/AbstractItem/configure-common.jelly
@@ -63,7 +63,7 @@ THE SOFTWARE.
       <p:config-blockWhenDownstreamBuilding />
       <st:include page="configure-advanced.jelly" optional="true" />
       <f:entry title="${%Display Name}" field="displayNameOrNull">
-         <f:textbox checkUrl="'${rootURL}/checkDisplayName?displayName='+encodeURIComponent(this.value)+'&amp;jobName='+encodeURIComponent('${it.name}')"/>
+         <f:textbox checkUrl="'${rootURL}/checkDisplayName?displayName='+encodeURIComponent(this.value)+'&amp;jobName='+encodeURIComponent('${h.jsStringEscape(it.name)}')"/>
       </f:entry>
       
     </f:advanced>
diff --git a/core/src/main/resources/hudson/model/AbstractProject/requirePOST.jelly b/core/src/main/resources/hudson/model/AbstractProject/requirePOST.jelly
new file mode 100644
index 0000000000000000000000000000000000000000..6979338eac5c4d16496caa36c48a6e1e68d7f41d
--- /dev/null
+++ b/core/src/main/resources/hudson/model/AbstractProject/requirePOST.jelly
@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+The MIT License
+
+Copyright 2013 Jesse Glick.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+-->
+
+<?jelly escape-by-default='true'?>
+<j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:i="jelly:fmt" xmlns:l="/lib/layout">
+    <l:layout title="${%Form post required}">
+        <l:main-panel>
+            <p>${%use_post}</p>
+            <form method="POST">
+                <input type="submit" value="${%Proceed}"/>
+            </form>
+        </l:main-panel>
+    </l:layout>
+</j:jelly>
diff --git a/core/src/main/resources/hudson/model/AbstractProject/requirePOST.properties b/core/src/main/resources/hudson/model/AbstractProject/requirePOST.properties
new file mode 100644
index 0000000000000000000000000000000000000000..afd123b05adb2363f473504e56e3a8aa188195ec
--- /dev/null
+++ b/core/src/main/resources/hudson/model/AbstractProject/requirePOST.properties
@@ -0,0 +1,26 @@
+# The MIT License
+#
+# Copyright 2013 Jesse Glick.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+# THE SOFTWARE.
+
+use_post=\
+    You must use POST method to trigger builds. \
+    (From scripts you may instead pass a per-project authentication token, or authenticate with your API token.) \
+    If you see this page, it may be because a plugin offered a GET link; file a bug report for that plugin.
diff --git a/core/src/main/resources/hudson/tasks/Messages.properties b/core/src/main/resources/hudson/tasks/Messages.properties
index 3f61827ddcf21fbef2481de227b5840819254323..2c0a388fa7bb9946afb875a7e6ab835d14e4050d 100644
--- a/core/src/main/resources/hudson/tasks/Messages.properties
+++ b/core/src/main/resources/hudson/tasks/Messages.properties
@@ -47,6 +47,7 @@ BuildTrigger.NoSuchProject=No such project ''{0}''. Did you mean ''{1}''?
 BuildTrigger.NoProjectSpecified=No project specified
 BuildTrigger.NotBuildable={0} is not buildable
 BuildTrigger.Triggering=Triggering a new build of {0}
+BuildTrigger.you_have_no_permission_to_build_=You have no permission to build {0}
 
 CommandInterpreter.CommandFailed=command execution failed
 CommandInterpreter.UnableToDelete=Unable to delete script file {0}
diff --git a/core/src/main/resources/hudson/views/BuildButtonColumn/column.jelly b/core/src/main/resources/hudson/views/BuildButtonColumn/column.jelly
index 9296682ca15ac3b955a6866b745951e314ce463f..6e12e9ed6eacfb245a7c2e77b73b214b3a1062cc 100644
--- a/core/src/main/resources/hudson/views/BuildButtonColumn/column.jelly
+++ b/core/src/main/resources/hudson/views/BuildButtonColumn/column.jelly
@@ -29,8 +29,16 @@ THE SOFTWARE.
               <a href="${jobBaseUrl}${job.shortUrl}build?delay=0sec">
                   <img src="${imagesURL}/${subIconSize}/clock.png"
                        title="${%Schedule a build}" alt="${%Schedule a build}"
+                       onclick="${job.parameterized ? null : 'return build(this)'}"
                        border="0"/>
               </a>
+              <script>
+                function build(img) {
+                  new Ajax.Request(img.parentNode.href);
+                  hoverNotification('${%Build scheduled}', img, -100);
+                  return false;
+                }
+              </script>
           </j:if>
       </td>
 </j:jelly>
\ No newline at end of file
diff --git a/core/src/main/resources/hudson/widgets/BuildHistoryWidget/entries.jelly b/core/src/main/resources/hudson/widgets/BuildHistoryWidget/entries.jelly
index c368425e8e37ca42421eef100ef0e030c7ed3fe8..2c9f091bffb488e0da22804a85525388ccf60158 100644
--- a/core/src/main/resources/hudson/widgets/BuildHistoryWidget/entries.jelly
+++ b/core/src/main/resources/hudson/widgets/BuildHistoryWidget/entries.jelly
@@ -43,9 +43,7 @@ THE SOFTWARE.
         <td style="white-space:normal;" colspan="2">
           <div style="float:right">
             <j:if test="${item.hasCancelPermission()}">
-              <a href="${rootURL}/queue/cancelItem?id=${item.id}">
-                <img src="${imagesURL}/16x16/stop.png" alt="${%cancel this build}" height="16" width="16"/>
-              </a>
+              <l:stopButton href="${rootURL}/queue/cancelItem?id=${item.id}" alt="${%cancel this build}"/>
             </j:if>
           </div>
           <j:set var="cause" value="${item.getCauseOfBlockage()}"/>
diff --git a/core/src/main/resources/hudson/widgets/HistoryWidget/entry.jelly b/core/src/main/resources/hudson/widgets/HistoryWidget/entry.jelly
index c5d99b57787c23b13d925b4c366cce5bf728140b..c21b4762af499bc32b0e1898cffb25ea1932af52 100644
--- a/core/src/main/resources/hudson/widgets/HistoryWidget/entry.jelly
+++ b/core/src/main/resources/hudson/widgets/HistoryWidget/entry.jelly
@@ -58,7 +58,7 @@ THE SOFTWARE.
         </td><td style="padding:0">
           <!-- Check ABORT permission for Project, Admin permission otherwise -->
           <j:if test="${empty(it.owner.ABORT) ? h.hasPermission(app.ADMINISTER) : it.owner.hasPermission(it.owner.ABORT)}">
-            <a href="${link}stop"><img src="${imagesURL}/16x16/stop.png" alt="[cancel]" height="16" width="16"/></a>
+            <l:stopButton href="${link}stop" alt="[cancel]"/>
           </j:if>
         </td></tr>
       </table>
diff --git a/core/src/main/resources/lib/hudson/buildCaption.jelly b/core/src/main/resources/lib/hudson/buildCaption.jelly
index 254d8beccb326af27c3db88a9337dec912835330..2d0befb162ed302a9c5e63b444a1f5e728ca5f1e 100644
--- a/core/src/main/resources/lib/hudson/buildCaption.jelly
+++ b/core/src/main/resources/lib/hudson/buildCaption.jelly
@@ -37,7 +37,7 @@ THE SOFTWARE.
 	          <t:buildProgressBar build="${it}"/>
 	        </td><td>
             <j:if test="${it.parent.hasAbortPermission()}">
-              <a href="stop"><img src="${imagesURL}/16x16/stop.png" alt="[${%cancel}]" height="16" width="16" /></a>
+              <l:stopButton href="stop" alt="[${%cancel}]"/>
             </j:if>
 	        </td>
 	      </tr></table>
diff --git a/core/src/main/resources/lib/hudson/executors.jelly b/core/src/main/resources/lib/hudson/executors.jelly
index 398a9f4a278f8a0bece54e80ad5cd9c136c4cb43..2530004a3a98be7ac31ce6539b54afd8d7abb3ae 100644
--- a/core/src/main/resources/lib/hudson/executors.jelly
+++ b/core/src/main/resources/lib/hudson/executors.jelly
@@ -91,7 +91,7 @@ THE SOFTWARE.
                 </st:include>
                 <td class="pane" align="center" valign="middle">
                   <j:if test="${e.hasStopPermission()}">
-                    <a href="${rootURL}/${c.url}${url}/stop"><img src="${imagesURL}/16x16/stop.png" alt="${%terminate this build}" height="16" width="16" /></a>
+                    <l:stopButton href="${rootURL}/${c.url}${url}/stop" alt="${%terminate this build}"/>
                   </j:if>
                 </td>
               </j:otherwise>
diff --git a/core/src/main/resources/lib/hudson/project/config-upstream-pseudo-trigger.jelly b/core/src/main/resources/lib/hudson/project/config-upstream-pseudo-trigger.jelly
index 5ce128e8938aaf984aad3a93410023689ed3d6eb..9c5737d82629fc99c2b32f8b2d0bf6dc3467b5b0 100644
--- a/core/src/main/resources/lib/hudson/project/config-upstream-pseudo-trigger.jelly
+++ b/core/src/main/resources/lib/hudson/project/config-upstream-pseudo-trigger.jelly
@@ -38,7 +38,7 @@ THE SOFTWARE.
     <f:entry title="${%Project names}"
              description="${%Multiple projects can be specified like 'abc, def'}">
       <f:textbox name="upstreamProjects" value="${h.getProjectListString(up)}"
-        checkUrl="'descriptorByName/hudson.tasks.BuildTrigger/check?value='+encodeURIComponent(this.value)"
+        checkUrl="'descriptorByName/hudson.tasks.BuildTrigger/check?upstream=true&amp;value='+encodeURIComponent(this.value)"
         autoCompleteField="upstreamProjects"/>
     </f:entry>
   </f:optionalBlock>
diff --git a/core/src/main/resources/lib/hudson/queue.jelly b/core/src/main/resources/lib/hudson/queue.jelly
index 405844c2d8a562f750b0de858c3332a7d87dbfbc..6d5eb2e0d25d0dafeaee973e9fca060513a05ba5 100644
--- a/core/src/main/resources/lib/hudson/queue.jelly
+++ b/core/src/main/resources/lib/hudson/queue.jelly
@@ -79,7 +79,7 @@ THE SOFTWARE.
             </td>
             <td class="pane" width="16" align="center" valign="middle">
               <j:if test="${item.hasCancelPermission()}">
-                <a href="${rootURL}/queue/cancelItem?id=${item.id}"><img src="${imagesURL}/16x16/stop.png" alt="cancel this build" height="16" width="16"/></a>
+                <l:stopButton href="${rootURL}/queue/cancelItem?id=${item.id}" alt="cancel this build"/>
               </j:if>
              </td>
           </tr>
diff --git a/core/src/main/resources/lib/layout/stopButton.jelly b/core/src/main/resources/lib/layout/stopButton.jelly
new file mode 100644
index 0000000000000000000000000000000000000000..48cf43453c41008c7d6c2b07075e5133fa569027
--- /dev/null
+++ b/core/src/main/resources/lib/layout/stopButton.jelly
@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+The MIT License
+
+Copyright 2013 Jesse Glick.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+-->
+
+<?jelly escape-by-default='true'?>
+<j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:i="jelly:fmt">
+    <st:documentation>
+        Creates a clickable “Stop” button.
+        <st:attribute name="href" use="required">
+            Link target. Relative to the current page.
+        </st:attribute>
+        <st:attribute name="alt" use="required">
+            Alt text for image.
+        </st:attribute>
+    </st:documentation>
+    <a href="${href}" onclick="new Ajax.Request(this.href); return false">
+        <img src="${imagesURL}/16x16/stop.png" alt="${alt}" height="16" width="16"/>
+    </a>
+</j:jelly>
diff --git a/debian/debian/changelog b/debian/debian/changelog
index 6614bdf1daacf1364f9199c8a6fb8aa25fc33df7..c43d036b18081e535339fd339a5975e10efcdba1 100644
--- a/debian/debian/changelog
+++ b/debian/debian/changelog
@@ -1,3 +1,9 @@
+jenkins (1.502) unstable; urgency=low
+
+  * See http://jenkins-ci.org/changelog for more details.
+
+ -- Kohsuke Kawaguchi <kk@kohsuke.org>  Sat, 16 Feb 2013 08:33:01 -0800
+
 jenkins (1.501) unstable; urgency=low
 
   * See http://jenkins-ci.org/changelog for more details.
diff --git a/licenseCompleter.groovy b/licenseCompleter.groovy
index a961b38c7082b61acff7b601aec188e63c8f7d17..97fe4bbd5fccdb1cbc641004f97e70377e67dc33 100644
--- a/licenseCompleter.groovy
+++ b/licenseCompleter.groovy
@@ -93,11 +93,6 @@ complete {
     }
            
 
-    match("nekohtml:xercesMinimal:1.9.6.2") {
-        if (dependency.licenses.isEmpty())
-            rewriteLicense([], apacheLicense)
-    }    
-
     //
     // Choose from multi-licensed modules
     //==========================================================================
diff --git a/maven-plugin/pom.xml b/maven-plugin/pom.xml
index c30e0dc43d504186430a4b917950c36e937c91b2..89910118beddc1aeecbe3d53742a02f8b17114a0 100644
--- a/maven-plugin/pom.xml
+++ b/maven-plugin/pom.xml
@@ -301,17 +301,6 @@ THE SOFTWARE.
           <groupId>org.apache.maven.wagon</groupId>
           <artifactId>wagon-webdav</artifactId>
         </exclusion>
-
-        <!-- prefer net.sourceforge.nekohtml:nekohtml:jar:1.9.13 so that we use consistent version across Jenkins -->
-        <exclusion>
-          <groupId>nekohtml</groupId>
-          <artifactId>nekohtml</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>nekohtml</groupId>
-          <artifactId>xercesMinimal</artifactId>
-        </exclusion>
-
       </exclusions>
     </dependency>
 
@@ -330,7 +319,7 @@ THE SOFTWARE.
           <groupId>org.slf4j</groupId>
           <artifactId>jcl-over-slf4j</artifactId>
         </exclusion>
-        <!-- prefer net.sourceforge.nekohtml:nekohtml:jar:1.9.13 so that we use consistent version across Jenkins -->
+        <!-- SECURITY-61: unused -->
         <exclusion>
           <groupId>nekohtml</groupId>
           <artifactId>nekohtml</artifactId>
@@ -342,12 +331,6 @@ THE SOFTWARE.
       </exclusions>
     </dependency>
 
-    <dependency>
-      <groupId>net.sourceforge.nekohtml</groupId>
-      <artifactId>nekohtml</artifactId>
-      <version>1.9.13</version>
-    </dependency>
-
     <dependency>
       <groupId>org.jenkins-ci.plugins</groupId>
       <artifactId>token-macro</artifactId>
diff --git a/test/src/main/java/org/jvnet/hudson/test/HudsonTestCase.java b/test/src/main/java/org/jvnet/hudson/test/HudsonTestCase.java
index 5bf2722b2e4c5ef11061045aaafae93cfa34a8bc..cce60e79d10d5c0fb7c894f7ad238dce812be517 100644
--- a/test/src/main/java/org/jvnet/hudson/test/HudsonTestCase.java
+++ b/test/src/main/java/org/jvnet/hudson/test/HudsonTestCase.java
@@ -177,6 +177,7 @@ import com.gargoylesoftware.htmlunit.DefaultCssErrorHandler;
 import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException;
 import com.gargoylesoftware.htmlunit.Page;
 import com.gargoylesoftware.htmlunit.WebRequestSettings;
+import com.gargoylesoftware.htmlunit.WebResponse;
 import com.gargoylesoftware.htmlunit.html.DomNode;
 import com.gargoylesoftware.htmlunit.html.HtmlButton;
 import com.gargoylesoftware.htmlunit.html.HtmlElement;
@@ -186,6 +187,7 @@ import com.gargoylesoftware.htmlunit.html.HtmlPage;
 import com.gargoylesoftware.htmlunit.javascript.HtmlUnitContextFactory;
 import com.gargoylesoftware.htmlunit.javascript.host.xml.XMLHttpRequest;
 import com.gargoylesoftware.htmlunit.xml.XmlPage;
+import java.net.HttpURLConnection;
 
 /**
  * Base class for all Jenkins test cases.
@@ -1852,6 +1854,19 @@ public abstract class HudsonTestCase extends TestCase implements RootAction {
                 return null;
         }
         
+        /**
+         * Verify that the server rejects an attempt to load the given page.
+         * @param url a URL path (relative to Jenkins root)
+         * @param statusCode the expected failure code (such as {@link HttpURLConnection#HTTP_FORBIDDEN})
+         * @since 1.502
+         */
+        public void assertFails(String url, int statusCode) throws Exception {
+            try {
+                fail(url + " should have been rejected but produced: " + super.getPage(getContextPath() + url).getWebResponse().getContentAsString());
+            } catch (FailingHttpStatusCodeException x) {
+                assertEquals(statusCode, x.getStatusCode());
+            }
+        }
 
         /**
          * Returns the URL of the webapp top page.
diff --git a/test/src/test/java/hudson/model/ApiTest.java b/test/src/test/java/hudson/model/ApiTest.java
index 6bb64d8ae450665ca0c2781f6e144fbf5eb43c47..dec7269a7b7d3cf721961c48eb36c1f1aef64f81 100644
--- a/test/src/test/java/hudson/model/ApiTest.java
+++ b/test/src/test/java/hudson/model/ApiTest.java
@@ -72,8 +72,10 @@ public class ApiTest extends HudsonTestCase {
 
     public void testUnwrappedLongString() throws Exception {
         jenkins.setSystemMessage("Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.");
-        Page page = new WebClient().goTo("api/xml?xpath=/hudson/description/text()", "text/plain");
-        assertEquals(jenkins.getSystemMessage(), page.getWebResponse().getContentAsString());
+        Page page = new WebClient().goTo("api/xml?xpath=/hudson/description", "application/xml");
+        assertEquals(
+                "<description>"+jenkins.getSystemMessage()+"</description>",
+                page.getWebResponse().getContentAsString());
     }
 
     public void testUnwrappedMultipleItems() throws Exception {
diff --git a/test/src/test/java/hudson/security/csrf/DefaultCrumbIssuerTest.java b/test/src/test/java/hudson/security/csrf/DefaultCrumbIssuerTest.java
index 13fdd7bac0648d626345bb0ef7803f17e0c57a43..84b349c1af3989c95a549e8e39bff46ecfea573e 100644
--- a/test/src/test/java/hudson/security/csrf/DefaultCrumbIssuerTest.java
+++ b/test/src/test/java/hudson/security/csrf/DefaultCrumbIssuerTest.java
@@ -8,6 +8,7 @@ package hudson.security.csrf;
 
 import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException;
 import com.gargoylesoftware.htmlunit.html.HtmlPage;
+import java.net.HttpURLConnection;
 import org.jvnet.hudson.test.Bug;
 import org.jvnet.hudson.test.HudsonTestCase;
 
@@ -95,4 +96,31 @@ public class DefaultCrumbIssuerTest extends HudsonTestCase {
         // The crumb should still match if we remove the proxy info
         submit(p.getFormByName("config"));
    }
+
+    public void testApiXml() throws Exception {
+        WebClient wc = new WebClient();
+        assertXPathValue(wc.goToXml("crumbIssuer/api/xml"), "//crumbRequestField", jenkins.getCrumbIssuer().getCrumbRequestField());
+        String text = wc.goTo("crumbIssuer/api/xml?xpath=concat(//crumbRequestField,'=',//crumb)", "text/plain").getWebResponse().getContentAsString();
+        assertTrue(text, text.matches("\\Q" + jenkins.getCrumbIssuer().getCrumbRequestField() + "\\E=[0-9a-f]+"));
+        text = wc.goTo("crumbIssuer/api/xml?xpath=concat(//crumbRequestField,\":\",//crumb)", "text/plain").getWebResponse().getContentAsString();
+        assertTrue(text, text.matches("\\Q" + jenkins.getCrumbIssuer().getCrumbRequestField() + "\\E:[0-9a-f]+"));
+        text = wc.goTo("crumbIssuer/api/xml?xpath=/*/crumbRequestField/text()", "text/plain").getWebResponse().getContentAsString();
+        assertEquals(jenkins.getCrumbIssuer().getCrumbRequestField(), text);
+        text = wc.goTo("crumbIssuer/api/xml?xpath=/*/crumb/text()", "text/plain").getWebResponse().getContentAsString();
+        assertTrue(text, text.matches("[0-9a-f]+"));
+        wc.assertFails("crumbIssuer/api/xml?xpath=concat('hack=\"',//crumb,'\"')", HttpURLConnection.HTTP_FORBIDDEN);
+        wc.assertFails("crumbIssuer/api/xml?xpath=concat(\"hack='\",//crumb,\"'\")", HttpURLConnection.HTTP_FORBIDDEN);
+        wc.assertFails("crumbIssuer/api/xml?xpath=concat('{',//crumb,':1}')", HttpURLConnection.HTTP_FORBIDDEN); // 37.5% chance that crumb ~ /[a-f].+/
+        wc.assertFails("crumbIssuer/api/xml?xpath=concat('hack.',//crumb,'=1')", HttpURLConnection.HTTP_FORBIDDEN); // ditto
+        jenkins.getCrumbIssuer().getDescriptor().setCrumbRequestField("_crumb");
+        wc.assertFails("crumbIssuer/api/xml?xpath=concat(//crumbRequestField,'=',//crumb)", HttpURLConnection.HTTP_FORBIDDEN); // perhaps interpretable as JS number
+    }
+
+    public void testApiJson() throws Exception {
+        WebClient wc = new WebClient();
+        String json = wc.goTo("crumbIssuer/api/json", "application/json").getWebResponse().getContentAsString();
+        assertTrue(json, json.matches("\\Q{\"crumb\":\"\\E[0-9a-f]+\\Q\",\"crumbRequestField\":\"" + jenkins.getCrumbIssuer().getCrumbRequestField() + "\"}\\E"));
+        wc.assertFails("crumbIssuer/api/json?jsonp=hack", HttpURLConnection.HTTP_FORBIDDEN);
+    }
+
 }
diff --git a/war/src/main/webapp/scripts/hudson-behavior.js b/war/src/main/webapp/scripts/hudson-behavior.js
index d520d8d0deed7742fd500562b939ba67939f6cae..277ed3bba782f70d3b8e8c7d829148937d81a618 100644
--- a/war/src/main/webapp/scripts/hudson-behavior.js
+++ b/war/src/main/webapp/scripts/hudson-behavior.js
@@ -1649,7 +1649,7 @@ function createSearchBox(searchURL) {
     function updatePos() {
         function max(a,b) { if(a>b) return a; else return b; }
 
-        sizer.innerHTML = box.value;
+        sizer.innerHTML = box.value.escapeHTML();
         var w = max(sizer.offsetWidth,minW.offsetWidth);
         box.style.width =
         comp.style.width = 
@@ -1919,11 +1919,14 @@ var hoverNotification = (function() {
         msgBox.render();
     }
 
-    return function(title,anchor) {
+    return function(title, anchor, offset) {
+        if (typeof offset === 'undefined') {
+            offset = 48;
+        }
         init();
         body.innerHTML = title;
         var xy = YAHOO.util.Dom.getXY(anchor);
-        xy[0] += 48;
+        xy[0] += offset;
         xy[1] += anchor.offsetHeight;
         msgBox.cfg.setProperty("xy",xy);
         msgBox.show();