Tests: revise StringTest.php

- Add assertion to check string_sanitize_url() when $g_short_path = '/'
  This is a bit of a hack, but it gets the job done
- Add test case for login page URL redirection issue #17648
Fix URL redirection issue in login_page.php

When Mantis is installed at the web server's root, $g_short_path is set
to '/'. string_sanitize_url() removes the trailing '/' from the short
path, which causes the URL to be incorrectly categorized as "type 2",
thus allowing cross-site redirection to occur.

By making checking that the short path is not empty before setting URL
as type 2, we ensure that we categorize it as type 3, which then forces
the function's return value to 'index.php'

Fixes #17648 (CVE-2014-6316)
Fix #17916: limit width of project boxes

Affects: Login, signup, reauth, reset password & switch project boxes

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Fix view issue page UI inconsistencies

1. Titles in table headers are left aligned
2. Fix issue relationship box header title width

Fixes: #17831

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Fix #17297: XSS in string_insert_hrefs

The URL matching regex in the function did not validate the protocol,
allowing an attacker to use 'javascript://' to execute arbitrary code.

Issue was discovered by Mathias Karlsson (http://mathiaskarlsson.me)
and reported by Offensive Security (http://www.offensive-security.com/).
Fix #17874: XSS in file uploads

An attacker can upload a Flash file with an image extension. If such an
attachment is displayed inline, it becomes a vector for XSS attacks.

This issue was reported by Matthias Karlsson (http://mathiaskarlsson.me)
as part of Offensive Security's bug bounty program [1].

Patch with contribution from Victor Boctor.
Improve comment for 'nosniff' header

- Reworded the part about IE8 second-guessing content type
- Added a note about Flash, as per Mathias Karlsson's recommendation in
  issue #17874
Upgrade PHPMailer to 5.2.7

This is a prerequisite to fix issue #16894, for which we need the revised
validateAddress() method with selection of validation pattern.

See changelog.md for full details
Allow choice of email validation method

Following implementation of 50d235ad101f61a6c6888316e827fd225ad4b9cd the
validation of email addresses was done by PHPMailer::validateAddress()
instead of filter_var() with FILTER_SANITIZE_EMAIL to allow RFC5322-
compliant emails like 'user@domain' that are rejected by PHP's method
which only accepts 'user@domain.tld'.

However, these 'top-level-domain-only' addresses are often considered as
invalid by SMTP servers but there is a strong use-case for them in
intranet environments.

To enable both scenarios, this commit introduces new constants for
$g_validate_email, allowing the admin to pick whether they want
validation using the PHP method (default) or strict RFC5322.

Backwards compatibility is maintained because EMAIL_VALIDATE_PHP == ON,
and validation can still be disabled with OFF.

Fixes #16894
Added logging to email_is_valid()
Upgrade PHPMailer to 5.2.8

This implements the HTML5-spec email validation pattern, which is what
we will be using with validateAddress() as per discussion in pull
request https://github.com/mantisbt/mantisbt/pull/172.

See changelog.md for full details
Add HTML5 email validation method (as default)

As per grangeway's suggestion in pull request
https://github.com/mantisbt/mantisbt/pull/172, we are now using an HTML5
specification-compliant regex to validate e-mail addresses by default
instead of PHP method.

Issue #16894
Upgrade PHPMailer to 5.2.9

See changelog.md for full details

Fixes #17717