Restyle the send reminder form

Fixes #17832

Signed-off-by: Victor Boctor <victor@mantishub.net>
Re-style search label in Manage User page

Fixes #17815

Signed-off-by: Victor Boctor <victor@mantishub.net>
Fix #17912: display of "\n" in summary submenu

Regression introduced by 0552366c6e2aff04efd4d3ada7c794b6300bb8f5.
Fix #17913: issue hyperlinks in timeline
Convert filter links into standard form buttons

Fixes #17834
Improve validation for filter sort and direction

Fixes #17841
HTML/CSS fixes in bug_revision_view_page.php
Allow setting 'announcement' flag when editing News

News Edit was not working - boolean was being interpreted as a string

Fixes #17924

Signed-off-by: Damien Regad <dregad@mantisbt.org>
DB Credentials leak in upgrade_unattended.php

Retrieve credentials from Mantis system configuration instead of
accepting them from POST parameters.

This issue was reported by Matthias Karlsson (http://mathiaskarlsson.me)
as part of Offensive Security's bug bounty program [1].

Fixes #17877

[1] http://www.offensive-security.com/bug-bounty-program/

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Upgrade jQuery and jQuery UI to latest versions

- jQuery    from v1.9.1  to v1.11.1
- jQuery UI from v1.10.0 to v1.11.2

Fixes #17932
Tests: revise StringTest.php

- Add assertion to check string_sanitize_url() when $g_short_path = '/'
  This is a bit of a hack, but it gets the job done
- Add test case for login page URL redirection issue #17648
Fix URL redirection issue in login_page.php

When Mantis is installed at the web server's root, $g_short_path is set
to '/'. string_sanitize_url() removes the trailing '/' from the short
path, which causes the URL to be incorrectly categorized as "type 2",
thus allowing cross-site redirection to occur.

By making checking that the short path is not empty before setting URL
as type 2, we ensure that we categorize it as type 3, which then forces
the function's return value to 'index.php'

Fixes #17648 (CVE-2014-6316)
Fix #17916: limit width of project boxes

Affects: Login, signup, reauth, reset password & switch project boxes

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Fix view issue page UI inconsistencies

1. Titles in table headers are left aligned
2. Fix issue relationship box header title width

Fixes: #17831

Signed-off-by: Damien Regad <dregad@mantisbt.org>
Fix #17297: XSS in string_insert_hrefs

The URL matching regex in the function did not validate the protocol,
allowing an attacker to use 'javascript://' to execute arbitrary code.

Issue was discovered by Mathias Karlsson (http://mathiaskarlsson.me)
and reported by Offensive Security (http://www.offensive-security.com/).
Fix #17874: XSS in file uploads

An attacker can upload a Flash file with an image extension. If such an
attachment is displayed inline, it becomes a vector for XSS attacks.

This issue was reported by Matthias Karlsson (http://mathiaskarlsson.me)
as part of Offensive Security's bug bounty program [1].

Patch with contribution from Victor Boctor.
Improve comment for 'nosniff' header

- Reworded the part about IE8 second-guessing content type
- Added a note about Flash, as per Mathias Karlsson's recommendation in
  issue #17874
WIP: Fix oci8 MetaColumns uppercase

db_field_exists fails with oci8

TODO open bug