Localisation updates from https://translatewiki.net.
Fix CVE-2014-1608: mc_issue_attachment_get SQL injection

Use of db_query() instead of db_query_bound() allowed SQL injection
attacks due to unsanitized use of parameters within the query when using
the SOAP API mc_issue_attachment_get.

This issue was reported by e-mail by Andrea Barisani from oCERT, on
behalf of Martin Herfurt <martin.herfurt@nruns.com>, a security
researcher at n.runs professionals GmbH, who discovered the issue
during an audit at a customer's site.

Fixes #16879

Signed-off-by: Damien Regad <dregad@mantisbt.org>

Conflicts:
	api/soap/mc_file_api.php
Fix CVE-2014-1609: SQL injection vulnerabilities

Additional cases of db_query() instead of db_query_bound() usage,
potentially allowing SQL injection attacks due to unsanitized use of
parameters within the query.

This includes vboctor's 2 comments.

Fixes #16880

Signed-off-by: Damien Regad <dregad@mantisbt.org>

Conflicts:
	admin/db_stats.php
	plugins/MantisGraph/pages/bug_graph_bycategory.php
	plugins/MantisGraph/pages/bug_graph_bystatus.php
	proj_doc_page.php
Travis: remove notification to mantisbt-cvs list [skip ci]
Fix #16880: regression introduced by original patch
Fix #16880: another one
Fixes #16848: Remove main page from main menu when news feature is OFF

The main page was really designed to include the news which has been deprecated for a while. Hence, the main page is useless for most users. This change hides it unless the news feature is ON.

This is until the news feature is completely removed.
Prevent plugin pages access when upgrade pending

If a plugin's code has been upgraded, but the schema is still on the old
version, the plugin is effectively disabled (i.e. its entry points are
not displayed). However, it was still possible to access individual
pages directly, which could lead to errors.

This commit adds an extra check in plugin.php which triggers an error
when the plugin needs to be upgraded.

Fixes #16706
Fix group actions not sending notifications

Added missing email_generic() calls

Fixes #6343, #13659
Localisation updates from https://translatewiki.net.
Updated CREDITS file in preparation of 1.2.16 release
Bump version and update release notes for 1.2.16
Changed version to 1.2.17dev [skip ci]
Update copyright year to 2014

Really should have done this before releasing 1.2.16... oh well.
[skip ci]
Fix #16940: undefined function db_params() in news_api.php

Regression introduced by 7efe0175f0853e18ebfacedfd2374c4179028b3f
(fix for issue #16880)
Localisation updates from https://translatewiki.net.
Fix #16989: The bug_get_bugnote_count() function in the bug API always returns 0
Fix #17007: duplicate "<a " tag
Fix SQL injection vulnerability in adm_config_report.php

Jakub Galczyk (HauntIT blog http://hauntit.blogspot.com/) reported this
issue, introduced by f8a81a33880752364ea47bdd9a987bff986c81de in
MantisBT 1.2.13.

Root cause is the use of unsanitized inlined query parameters.

Fixes #17055
Localisation updates from https://translatewiki.net.