Fix #16810: $s_os in custom_strings_inc.php partially ignored
Remove usage of undefined constant ERROR_TWITTER_NO_CURL_EXT

Commit cd3e0ed21fb39577af3cb48b941be4001b659dd5 removed Twitter code but
not the usage if constant ERROR_TWITTER_NO_CURL_EXT in language file.
Fix #11785: Comment for access_compare_level in access_api.php is bogus
Prompt user with message on create project page on first login

When user logs in and there are no projects, they are redirected to create project page.  Show a message to users to create a project similar to one shown on login when the administrator user name and password are the default.
Remove main page from main menu when news feature is OFF

The main page was really designed to include the news which has been deprecated for a while.  Hence, the main page is useless for most users.  This change hides it unless the news feature is ON.

This is until the news feature is completely removed.
Fixes #16833: Remove show_avatar_threshold config option.
Revise footer to be less verbose and more like 1.2.x

- Don't show administrator email on login page.
- Show copyright years independent of show_version given that they currently are from 0 to today's year, so no disclosure of versioning anyway.
- User copyright message shows up after our copy right and before contact administrator message.
- Use much brief message for contacting administrator.  Remove usage of the word "us".
Replace email_* calls with raw email_generic calls. This is to try and make a shorter patchset in a bit ;)
Port a potential database corruption fix in the installer to 1.x from 2.x branch.

When converting dates, abort if the old value has already been converted to an integer from a database timestamp.
This avoids potentially wiping out dates quietly within the database.
remove duplicate install_do_nothing
Revert "Fixes #16833: Remove show_avatar_threshold config option."

This reverts commit 3715bfade978933f0c99fdf1b1f4304f607afc2c.
PHPdoc Update
Fix CVE-2014-1608: mc_issue_attachment_get SQL injection

Use of db_query() instead of db_query_bound() allowed SQL injection
attacks due to unsanitized use of parameters within the query when using
the SOAP API mc_issue_attachment_get.

This issue was reported by e-mail by Andrea Barisani from oCERT, on
behalf of Martin Herfurt <martin.herfurt@nruns.com>, a security
researcher at n.runs professionals GmbH, who discovered the issue
during an audit at a customer's site.

Fixes #16879

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Fix CVE-2014-1609: SQL injection vulnerabilities

Additional cases of db_query() instead of db_query_bound() usage,
potentially allowing SQL injection attacks due to unsanitized use of
parameters within the query.

This includes vboctor's 2 comments.

Fixes #16880

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Remove unused variables from current_user_get_bug_filter
Travis: remove notification to mantisbt-cvs list [skip ci]
Remove Unused Variables from Mantis Core
Code Guidelines: Fix naming of variable '$result' to $t_result
Fix formatting of 'upload files' label on bug_report_page.
Fix layout for bug note avatar and move it to the left side

The text next to the avatar in the bug notes was being pushed under the avatar.  This change fixes that and moves the avatar to the left of the text which is more standard with other conventions.  As we add avatars elsewhere in MantisBT, they will also be on the left side.