Revert "Fixes #16833: Remove show_avatar_threshold config option."

This reverts commit 3715bfade978933f0c99fdf1b1f4304f607afc2c.
Fix CVE-2014-1608: mc_issue_attachment_get SQL injection

Use of db_query() instead of db_query_bound() allowed SQL injection
attacks due to unsanitized use of parameters within the query when using
the SOAP API mc_issue_attachment_get.

This issue was reported by e-mail by Andrea Barisani from oCERT, on
behalf of Martin Herfurt <martin.herfurt@nruns.com>, a security
researcher at n.runs professionals GmbH, who discovered the issue
during an audit at a customer's site.

Fixes #16879

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Fix CVE-2014-1609: SQL injection vulnerabilities

Additional cases of db_query() instead of db_query_bound() usage,
potentially allowing SQL injection attacks due to unsanitized use of
parameters within the query.

This includes vboctor's 2 comments.

Fixes #16880

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Travis: remove notification to mantisbt-cvs list [skip ci]
Remove Unused Variables from Mantis Core
Fix formatting of 'upload files' label on bug_report_page.
Fix layout for bug note avatar and move it to the left side

The text next to the avatar in the bug notes was being pushed under the avatar.  This change fixes that and moves the avatar to the left of the text which is more standard with other conventions.  As we add avatars elsewhere in MantisBT, they will also be on the left side.
Whitespace [skip ci]

Remove blank lines added in a6a3a136bd05df52f1ea4dd906230ac9ae9d9cad
Revert of "Use PHP's own email validation routines"

This partially reverts commit 4235a08618da1d66b44337867b72f4fdea633dc0
which introduced a regression.

The PHP email validation rejects valid e-mail addresses with the form
user@hostname [1]. The PHPMailer accepts these, and furthermore it makes
sense to rely on the validation routine provided by the library we use
to send our emails.

[1] https://bugs.php.net/bug.php?id=49576
Fixes #16849: Drop FTP support.
Fix #16880: regression introduced by original patch
Fix #16880: another one
Prevent plugin pages access when upgrade pending

If a plugin's code has been upgraded, but the schema is still on the old
version, the plugin is effectively disabled (i.e. its entry points are
not displayed). However, it was still possible to access individual
pages directly, which could lead to errors.

This commit adds an extra check in plugin.php which triggers an error
when the plugin needs to be upgraded.

Fixes #16706
Fix group actions not sending notifications

Added missing email_generic() calls

Fixes #6343, #13659
Dropping deprecated database API function db_query()

Following recent commits [1] db_query() is no longer used in MantisBT.

Considering that the function is marked as deprecated since 1.2.0a2
(April 2008), it is time to effectively remove it.

Fixes #16898

[1] 3be86ce37bb469b211663da03f61ac2b28500d91, 7d76827617e97d7356e7eb4f2f66736e4c4d41b0, cf596c27b2a2e2aac67749b546cece9c23b4bbb1 and 0db530a855f92752aaa4bcf355df3ecba9af8226
Fix error with PostgreSQL when filtering on date custom field

As PostreSQL tries to add 0 to a string, it throws an error as it tries
to operate on different data types.

I can only guess that the +0 was a hack to convert type from string to
integer on MySQL.

Implementing solution proposed by user kensonman, using standard SQL
functions CAST, COALESCE and NULLIF to achieve a clean and portable
conversion to numeric (this assumes that the data stored in the
custom_fields_string table 'value' column is indeed numeric; if not we
would get other errors or warnings)

Note: this requires bumping MySQL minimum requirement to 5.08, since
DECIMAL type used in CAST was only added in that release.

Fixes #16584
Use variable to minimize array dereferencing
Install: bump minimum MySQL version

MySQL 5.08 is required due to use of CAST to DECIMAL type.

http://dev.mysql.com/doc/refman/5.0/en/cast-functions.html#function_cast.
Add constants for minimum DB versions supported
Install: use DB minimum versions constants