donjakobo/A3M — pull request #29 by iam1980 (2013-03-05 17:41:42+00:00)
Title: XSS on forgot password, also added missing validation (username & password)

1) Added captcha option for forgot password (default to TRUE)

2) XSS: not really an XSS, (its not stored in the DB), but still it breaks the HTML. This
`$value = str_replace(array('\'', '"'), ' ', $value);`
should be done on all views that our outputing user input. Will update at some point.

Attack patern:
`'"--> `

3) Added a callback that checks if we have a valid username or password.