This script adds a single download script, 'file.php', which provides access
to files of all types to all users. It uses a HMAC signature system with an
expires time, which allows signed URLs to be sent to external users.

This also fixes an issue with the Http::cacheable() method, where the
last-modified and Etag headers were not properly compared, which resulted in
permanent cache misses by the client.

Use http::build_query instead of inline urlencode

  * Fix incorrect mapping to user email address
  * Fix early rejecting of tickets — even if a filter earlier in the
    matching filter list had "stop on match" set
  * Fix ::stopOnMatch referring to incorrect db field

The new logic abandons the early rejection logic in ticket create. Instead,
the normal validation is completed as usual. Thereafter, the filter is
initialized and applied to the ticket. Upon rejection, a RejectedException
is thrown by the ::apply() method of the TicketFilter. The Ticket::create()
method will handle the exception and reject the ticket.

Stop trampolining links via l.php. It was necessary before in order to avoid
the potential of leaking ticket number & email. The authentication mechanism
in place now redirects on successful login.

This is necessary so we can sanitize/encode inputs.

This patch changes the default formatting for text bodies used in emails,
ticket thread, and canned response quoting so that white-space in text
bodies is properly preserved. Previously, the text was treated as raw HTML
and was not properly escaped, nor was the original whitespace preserved.

This patch adds a ::getAlertEmail() method to the Department class, which
allows administrators to use the department email address (normally for
replies) as the alert email address. If not specified, the system alert
email address is retrieved instead, automatically.

This affects new ticket by staff as well as honoring the influence of ticket
filters on new ticket, where the status may be set to something other than
the system default. Even the system default may be influenced if it were set
to a closed state derivative.

So the concept is simple: the new status should be set using the standard
logic so that the closed_by staff member, date, events, and other
information is set as normally is when a ticket is closed.

This resolves #1570

This patch removes the selection of canned responses as well as the canned
responses navigation page from the ui when the canned responses feature is
disabled.

Allow usage of something like `%{ticket.user.organization.var}`

Faq articles should be viewed in the .thread-body div in the client portal
like they are in the staff portal.

Since the automatic lock was being acquired but not passed to the autoLock
system, the automatically acquired lock was not being release on away
navigation.

This patch addresses the issue by passing the automatically acquired lock id
to the autoLock system on ticket-view page load and change the ::Init()
method so that the lock id is not cleared with the ::Init() method is called
by the page load.

Ensure that when generating the list of acceptable file extensions, that the list is lower cased, because the extension from the filename will be lower-cased before attempting to find the extension in the list of acceptable extensions.

Do not reopen closed ticket, if the system can reliably determine that the new message is an
auto-response/reply from the end user.

- Allows the string "false" to be used in the XML payload as the documentation demonstrates, and have that be interpreted as a boolean false.
- Switching $alert/$autorespond to use isset(), and forcing those variables to be type-casted to booleans.

Take into consideration the auto-response settings when sending out new
ticket by staff notice to the end user.

The ticket number regex was changed with the advent of custom ticket
numbers, and it matches the closing punctuation in [#12345], that is, the
closing bracket would be included in the ticket number sought in the
database. Therefore, it would never match the ticket number properly.

The new regex attempts to match punctuation and non-punctuation groups so
that punctuation in the middle of the ticket number is matched; however,
punctuation at the end is not. So #12345+DEPT will match properly and will
ignore any trailing whitespace and punctuation.

Previously, this was not ported properly now that multiple selections are
supported in the choice field and derivatives.

It was previously not possible to use the `alert` and `autorespond` flags in a negative way to prevent those two events, since the ternary operator would have used the `false` ternary value, which was `true`.  This corrects that by allowing the default of `true` to be used only when the `$data` array does not have the appropriate keys set.  Assigning `$data['source']` was altered to use the same formatting and caution against an undefined index error.

There was a slight issue when transitioning from a short answer field to a
drop-down field, and when the CDATA table is dropped and rebuilt.