Tests: revise StringTest.php

- Add assertion to check string_sanitize_url() when $g_short_path = '/'
  This is a bit of a hack, but it gets the job done
- Add test case for login page URL redirection issue #17648
Fix URL redirection issue in login_page.php

When Mantis is installed at the web server's root, $g_short_path is set
to '/'. string_sanitize_url() removes the trailing '/' from the short
path, which causes the URL to be incorrectly categorized as "type 2",
thus allowing cross-site redirection to occur.

By making checking that the short path is not empty before setting URL
as type 2, we ensure that we categorize it as type 3, which then forces
the function's return value to 'index.php'

Fixes #17648 (CVE-2014-6316)
Fix #17916: limit width of project boxes

Affects: Login, signup, reauth, reset password & switch project boxes

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Fix view issue page UI inconsistencies

1. Titles in table headers are left aligned
2. Fix issue relationship box header title width

Fixes: #17831

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Fix #17297: XSS in string_insert_hrefs

The URL matching regex in the function did not validate the protocol,
allowing an attacker to use 'javascript://' to execute arbitrary code.

Issue was discovered by Mathias Karlsson (http://mathiaskarlsson.me)
and reported by Offensive Security (http://www.offensive-security.com/).
Fix #17874: XSS in file uploads

An attacker can upload a Flash file with an image extension. If such an
attachment is displayed inline, it becomes a vector for XSS attacks.

This issue was reported by Matthias Karlsson (http://mathiaskarlsson.me)
as part of Offensive Security's bug bounty program [1].

Patch with contribution from Victor Boctor.
Improve comment for 'nosniff' header

- Reworded the part about IE8 second-guessing content type
- Added a note about Flash, as per Mathias Karlsson's recommendation in
  issue #17874
Error API: catch all known error types

Our error handler was not specifically dealing with some known error
types, resulting in a default "catch all" error message e.g. for
E_STRICT or E_RECOVERABLE_ERROR.

Now all constants defined in http://php.net/errorfunc.constants at the
time of this writing are handled, while retaining the default case for
future error types.
Treat E_RECOVERABLE_ERROR as a fatal error

By default, Mantis will HALT.