oops: Fix corruption of thread body posted by collabs

Reviewed-By: Peter Rotich <peter@osticket.com>

fixes #1777 

Reviewed-By: Peter Rotich <peter@osticket.com>

access: Allow empty staff banner. Show update errors

Reviewed-By: Peter Rotich <peter@osticket.com>

file drop: Support Firefox down to v6

Reviewed-By: Peter Rotich <peter@osticket.com>

This partially reverts commit bff191b6.
The hasSpecialSearch() method can be retired in `develop-next` — NOT in the
`develop` branch

If the system receives an email by a collaborator which has not yet been
added to the ticket (a friend of a friend — that is, a collaborator forwards
an email to a third-party), a header is added to the thread body something
like:

Received From: afriendofafriend@mycompany.tld

However, if the thread body is text and the HTML ticket thread is enabled,
then the text formatting hint will be lost and the body will be assumed as
HTML deeper inside the thread entry creation process. Therefore, the
whitespace inside the resulting thread entry will be collapsed.

This patch addresses the issue by maintaining the original format hint with
the thread body.

Allow the staff banner to be set to empty (which is the default).

Also display the update errors back on the dialog for failed updated.

Also, give a "Browser not supported" error for browsers which do not support
the Blob constructor.

[FIX] Missing icon before "Add New Filter"

Reviewed-By: Jared Hancock <jared@osticket.com>

filter: Fix filtering by list item properties

Reviewed-By: Peter Rotich <peter@osticket.com>

Fixes the missing icon before "Add new filter" in scp at the filters.php page

login: Require CSRF token to login

Reviewed-By: Peter Rotich <peter@osticket.com>

This patch fixes a vulnerable scenario, where sequential login attempts can
be made without an existing session, and without a valid CSRF token. This
scenario lends itself well for brute force password attempts, because
attackers can avoid using a session and still send requests to determine if
a set of credentials are valid. This vector also avoids the authentication
lockout mechanism, because it requires an ongoing session to shutdown the
requests.

This patch addresses the issue by requiring a session and a valid CSRF token
generated by the server and placed in the session to be submitted with the
credentials. Therefore, an existing session and a Cookie header are required
to process a login attempt. Secondly, the CSRF token will be changed on the
server after each login processed. Therefore, for each session, a subsequent
GET request would be necessary before submitting another login attempt.

email: Message-Id header with user and thread ID

Reviewed-By: Peter Rotich <peter@osticket.com>

Session never expires

Reviewed-By: Peter Rotich <peter@osticket.com>

logo: Allow customized SCP logo

Reviewed-By: Peter Rotich <peter@osticket.com>

Fix very predictable random data on some platforms

Reviewed-By: Peter Rotich <peter@osticket.com>

Revert "Disable auto-responses on staff created tickets"

thread: Remove collaborators when removing the thread

Reviewed-By: Peter Rotich <peter@osticket.com>

charset: Normalize charsets

Reviewed-By: Jared Hancock <jared@osticket.com>

References:
https://bugs.php.net/bug.php?id=43200
http://stackoverflow.com/a/22521203

Also try harder to send a relevant In-Reply-To and References header back
to the client with the email message.

This pull request adds a cleanup util for bogus and invalid charsets, mostly
added by a nameless company out of Redmond, WA.

Fix SLA link in help tips

Reviewed-By: Peter Rotich <peter@osticket.com>

This patch sends updated session cookies to the browser when the session is
refreshed on the server. This allows the session cookie to expire on the
browser at the same time the session timeout occurs at the server. In the
event the session timeout is configured in osTicket not to expire, the
cookie will expire after seven days on the client browser, and will expire
in PHP when it is garbage collected sometime after 86400 seconds after the
time last refresh time.

Using this method, the session will never expire if the session timeout in
osTicket is configured to 0, and the session is refreshed at least daily.