MixMonitor: Add class authorization requirements to MixMonitor AMI commands

MixMonitor AMI commands StartMixMonitor and StopMixMonitor lacked class
authorization. StopMixMonitor now requires that the manager user either have
the call or system class authorization. StartMixMonitor is a slightly larger
issue since it can execute shell commands if the right arguments are passed
into it, and we consider this a permission escalation. A security release
will be issued for problem this shortly.

ASTERISK-23609 #close
Reported by: Corey Farrell


git-svn-id: http://svn.asterisk.org/svn/asterisk/branches/11@415825 f38db490-d61c-443f-a65b-d21fe96a405b
app_queue: delayed state can cause early leavewhenempty ringing

In app_queue, device state changes arrive in event messages and
update the queue member status value.  That value is checked in
get_member_status() to decide that the caller should leave when
there are no available members.  Although event messages can be
delayed by other activity, there is no adverse affect by lagged
status except in one specific case: there is only one available
member, it was just rung, and leavewhenempty is enabled set for
ringing members.  This change adds a direct check of the device
state only under this condition where the caller may be dropped
incorrectly, resolving this issue without affecting performance
of app_queue normally.

AST-1248 #close
Review: https://reviewboard.asterisk.org/r/3595/
Reported by: Thomas Arimont
........

Merged revisions 415833 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: http://svn.asterisk.org/svn/asterisk/branches/11@415835 f38db490-d61c-443f-a65b-d21fe96a405b
Correct UPGRADE.txt notes in r415825

The change was marked against the wrong version of Asterisk. My apologies.


git-svn-id: http://svn.asterisk.org/svn/asterisk/branches/11@415837 f38db490-d61c-443f-a65b-d21fe96a405b