Uses a seven step procedure:
  1. (user) Fails to login twice or more
  2. Clicks the 'Forgot my password' link on the login form
  3. Submits the username or email address and triggers a password-reset
     email
  4. Clicks the link in the email and is directed back to the reset page
  5. Enters the username or email again and is logged in
  6. Password change is forced, but current password is not required
  7. Password is updated, user can continue the session without
     authenticating again

Use %config table by default for config classes

Add lastModified() method to retrieve the time of last modification for a
configuration key

Add $defaults to the specified on a subclass. The defaults remove the
necessity to specify a default value for each getter method, and, the
defaults are integrated into the array retrieved from getInfo()

Use mysql connection timing as the random seed, along with the microseconds
of the current time.

Administrators are allowed to upload one or more logos and then select from
the uploaded logos to set one for the client site. Logos can also be deleted
on settings->pages submission

Previously, username and password were required. With this patch, the
email address can be used to authenticate the user with the password

This will facilitate a web-based export significantly easier

Some mail clients and servers (like the ones developed in the northwestern
United States) sometimes place encoded and non-encoded data in an email
body declared with "Content-Transfer-Encoding: base64". imap_base64 will
refuse to decode the body if it contains non base64 characters (like a
period, colon, apostrophe, etc). This patch uses base64_decode as a fallback
which will make a best effort to decode the data. In the case of our test
mails, the decoded data will contain garbage where the non-base64-encoded
data was in the original mail, but at least the message is preserved.

Disable DB session storage. This chews up database space and processing time
for a request that will never resume the same session (given the current API
model anyway).

The administrator can define pages in the admin panel defined as type
'other', and when set to active, those pages can be served from the
/pages/<page-name-slug> URL from the base of the helpdesk.

This is mocked up only against Apache

Add forgotten abort() method of the Upgrader trampoline class, and allow
getErrors() not to crash if not upgrading

SLAs can be marked transient. When a ticket is assigned to a transient SLA
and it is transferred to a department or help topic having a default SLA,
the SLA will change to the SLA of the new department or help topic. This
process can continue as long as the ticket has a transient SLA assigned.
Once a non-transient SLA is assigned to the ticket, the SLA will no longer
change automatically. Thereafter, the SLA can only be manually changed.

on line 14 of settings-pages.inc.php the section: <a href="pages"> should read: <a href="pages.php">

Spelling, grammar and readability in upgrader documents
  - Tweaked spelling, grammar and wording to make the text of the upgrader
    pages more readable.
Fixed spelling regression
  - Higly —> Highly
Spelling and readability fixes for /include/class.* files
  - Fixed some spelling mistakes
A couple more spelling/readability fixes.
  - More fixes

Allow the installation to use the same streams config and schema signatures
as the migrater

Allow the install to install mulitple database streams

Allow `streams.cfg` to be implied as 'core', which will default to only
upgrading the core osTicket stream.

Use signature to describe snapshots rather than md5

This patch allows the upgrader to upgrade multiple database update
'streams'. The main stream is renamed to 'core' to reflect changes made
to the config class. This will significantly ease customizations
requiring database customizations, and will make plugins requiring
database changes possible.

- Handle decoding large base64 encoded attachments better
- Avoid transcoding from one charset to the same
- Avoid encoding attachments without a declared charset

When creating tickets, ensure that data which should not contain leading or
trailing whitespace is trimmed and validated accordingly

 - Supported pages: landing, offline, thank-you and other

If the body of an email message is written and encoded with an unrecognized
charset (like 'iso', for instance), then use the original text, assumed to
be 8-bit encoded. This patch will create idiosyncrasies, where text might be
transcoded to utf-8 incorrectly, but it should eliminate instances where
email message bodies are missing due to incorrect charset labels.

Looks like a long standing, yet-to-be-fixed PHP bug, where
zlib.output_compression can result in the output buffer not completely being
flushed. This is especially critical for downloads where the tail of the
file might be lost.

https://bugs.php.net/bug.php?id=19436

This will allow setting something in the session and having that value
override the value from the database. If ->persist() is called for a given
key, a following ->get() will result in the session persisted value being
returned. ->set() will still save the value in the database.

This is mostly useful for last-mile scenarios (and future plugins) that need
to affect the configuration of the system without altering the data in the
configuration table.