* aydreeihn/issue/attachment_downloads:
  Exclude Vulnerable Image Files
  Only allow image attachments to be opened in the browser window

* issue/file-upload-bypass:
  issue: File Upload Bypass

* issue/httponly-cookies:
  issue: Httponly Cookies

* issue/xss-agent-directory:
  xss: Prevent Agent Directory XSS

This addresses a vulnerability where an Agent can perform XSS via the
Agent Directory’s REQUEST query string. This sanitizes the request params
so the code will be escaped and not executed in the browser.

This addresses an issue where someone can “takeover” an account with only
a User’s email and a User’s previous ticket number. Once they get access
to a User’s ticket they can go to the Ticket Owner’s profile and change
the email to whatever they’d like. This adds a check on the profile to see
if the User is a Guest User. If they are a Guest then it kicks them back
to the ticket view. If they are the actual User it will let them view the
profile.

cron: Delete Expired Sessions

This addresses an issue where someone can bypass the file restrictions on
the file upload field in the Client Portal. This adds the allowed
extensions and file types to the field options so that User’s cannot
upload anything other than the allowed file types.

This addresses issue 4015 where osTicket’s cookies aren’t HttpOnly by
default. The HttpOnly flag helps prevent client scripts accessing the
cookie. This updates the method that sets the cookie params to include
the HttpOnly flag.

oops: Fix Task Print

tasks: Fix Task Updated Time

oops: User Phone Search

CVE-2017-14396

xss: Cached forms data

Encode html entities of cached form data

Format the advanced search title so that it will not allow javascript

Fix crash editing thread entry with inline image

This commit addresses an SQL injection vulnerability in ORM lookup
function.

* ORM implementation failed to properly quote fields, used in SQL
statements, that might originate from unsanitized user input.

* AttachmentFile lookup allowed for key based SQL injection by blindly
delegating non-string lookup to ORM.

Extend this to exclude image files that are injectable from opening in browser windows.

This addresses an issue where updating a Task does not change the
`updated` column in the database. This adds a line to change the `update`
column when updating a Task.

This addresses issue 3782 where clicking Print on a Task gives you a blank
popup that hangs. This is because the Print button was being treated as a
Task action when it is actually not one. This adds a ternary operator to
give the proper Task Actions the `task-action` class and gives the Print
button no class.

This addresses issue 3815 where searching by User's phone number doesn't
work in v1.10. This adds phone number search capabilities for the User
Directory and User Search popup in v1.10.

This addresses an issue where expired sessions would not be removed from
the database. This caused the session table to fill up and create
unnecessary issues. This adds a cleanup method to remove all expired
sessions from the database.

forms: Proper Field Deletion

Orphaned Tasks on Dept. Deletion

i18n: Fix getPrimaryLanguage() on non-object

Chunk long text body

Add TimezoneField

This addresses issue where upon deletion of a form field and all its
entry values, the field record wouldn't be deleted from the `form_field`
table. This links another issue where you can't delete a list if its
been a field before. This is due to the list delete() function that
checks for list field records in the `form_field` table.

This is necessary to force a particular timezone on a DateTimeField entry.
If timezone is not set then user's timezone is assumed.

Address edge cases where timezone mixups happens on DateTimeField

Allow datetime field to be timezone agnostic (not timezone aware) to display
the timezone used to set the field. The timezone of the last user or agent
that edited the field is used.

This fixes an InconsistentModelException error when editing thread
entries with inline images. The fix assumes that inline images are
re-attached when a new ThreadEntry is created and the body is copied
from the previous entry. Only the non-inline attachments need to be
moved in the update query.

This addresses issues #1964 & #3668 where $cfg might be null and cause a
non-object error. Check if $cfg is set, if not return the default
en_US language.

Update README.md

Syntax Errors Hotfix

Fixes syntax error introduced with commit 71a6b2a0 & 6e0ddf2e