Fix #17913: issue hyperlinks in timeline
Convert filter links into standard form buttons

Fixes #17834
Improve validation for filter sort and direction

Fixes #17841
HTML/CSS fixes in bug_revision_view_page.php
Allow setting 'announcement' flag when editing News

News Edit was not working - boolean was being interpreted as a string

Fixes #17924

Signed-off-by: Damien Regad <dregad@mantisbt.org>
DB Credentials leak in upgrade_unattended.php

Retrieve credentials from Mantis system configuration instead of
accepting them from POST parameters.

This issue was reported by Matthias Karlsson (http://mathiaskarlsson.me)
as part of Offensive Security's bug bounty program [1].

Fixes #17877

[1] http://www.offensive-security.com/bug-bounty-program/

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Upgrade jQuery and jQuery UI to latest versions

- jQuery    from v1.9.1  to v1.11.1
- jQuery UI from v1.10.0 to v1.11.2

Fixes #17932
Tests: revise StringTest.php

- Add assertion to check string_sanitize_url() when $g_short_path = '/'
  This is a bit of a hack, but it gets the job done
- Add test case for login page URL redirection issue #17648
Fix URL redirection issue in login_page.php

When Mantis is installed at the web server's root, $g_short_path is set
to '/'. string_sanitize_url() removes the trailing '/' from the short
path, which causes the URL to be incorrectly categorized as "type 2",
thus allowing cross-site redirection to occur.

By making checking that the short path is not empty before setting URL
as type 2, we ensure that we categorize it as type 3, which then forces
the function's return value to 'index.php'

Fixes #17648 (CVE-2014-6316)
Fix #17916: limit width of project boxes

Affects: Login, signup, reauth, reset password & switch project boxes

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Fix view issue page UI inconsistencies

1. Titles in table headers are left aligned
2. Fix issue relationship box header title width

Fixes: #17831

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Fix #17297: XSS in string_insert_hrefs

The URL matching regex in the function did not validate the protocol,
allowing an attacker to use 'javascript://' to execute arbitrary code.

Issue was discovered by Mathias Karlsson (http://mathiaskarlsson.me)
and reported by Offensive Security (http://www.offensive-security.com/).
Fix #17874: XSS in file uploads

An attacker can upload a Flash file with an image extension. If such an
attachment is displayed inline, it becomes a vector for XSS attacks.

This issue was reported by Matthias Karlsson (http://mathiaskarlsson.me)
as part of Offensive Security's bug bounty program [1].

Patch with contribution from Victor Boctor.
Improve comment for 'nosniff' header

- Reworded the part about IE8 second-guessing content type
- Added a note about Flash, as per Mathias Karlsson's recommendation in
  issue #17874
Add support DejaVu Font http://dejavu-fonts.org/ for MantisBT Graph plugin
DejaVu font support when using JpGraph library
Whitespace and coding guidelines
Improve get_font_path() to handle DejaVu fonts

On most Linux systems, the DejaVu font is installed by default whereas
the MS TrueType fonts may not.

The function now checks for 'dejavu' directory below the base font path
prior to checking the 'msttcorefonts'. This gives a better chance to
have a valid fonts directory when $g_system_font_folder is not defined.
Resize synthese.gif to 16x16 pixels

Required so that the graph api's submenu elements in summary page are
all aligned vertically.
Renaming summary graph page

Make the name consistent with other graph pages