This will help avoid weird, hard to track down load ordering bugs in the
future.

The rights editor now supports editing rights on arbitrary roles on any
object, not just queues and globally.  (It still requires you extend RT's
core roles with your own, of course.)

Adds a new method on RT::Groups, LimitToRolesForObject, which
limits by Domain and Instance appropriately for the object given.  The
new method abstracts away more of the details of roles on objects.

In the 1.3 and 2.0 timeframe, many lines of POD or comments began
picking up inexplicable backslash escaping before single-quotes.  Remove
them, as this is nonsensical.

When a group becomes disabled in RT, we mark all CGM rows that existed
because of that group as 'Disabled'.  Unfortunately, many joins through
CGM neglected to take the Disabled column into account, leading to users
possibly having rights that they should not, due to having them by way
of a disabled group.

This addresses CVE-2011-4459.

The previous implementation didn't depend in any way on what object the
right was granted on, merely the membership of the group, and what
groups that group was in.  The correct implementation examines the
ObjectType and ObjectId parameters of the ACL table.  Specifically, it
returns groups which are the target of ACLs, which were granted by a
group, which the current user is a member of.  That is, groups which the
current user has a particular right on, as the name of the method
implies.

t/api/group-rights.t has been refactored to be more concise, and cover
all possibilities of where the ACL can be granted, and to what.
ForWhichCurrentUserHasRight now agrees with CurrentUserHasRight for all
cases.

Previously, you only saw the group if your _direct_ membership in it was
what granted the right.  However, what we actually care about is if:
 (a) You are a member of the group, by any means.
AND
 (b) The group grants you the right; that is, if it is a member of any
     group which has that right granted to it.

This updates our copyright to 2011, rewrites the email address and
strips a lot of extra whitespace.  These license blocks should now be
identical to 4.0-trunk which will help significantly with merges.

clean up "use warnings" to show up where "use strict" is

especially the upgrade feature.

perlcritic

git-svn-id: svn+ssh://svn.bestpractical.com/svn/bps-public/rt/3.8/branches/3.8.2-releng@17585 e417ac7c-1bcc-0310-8ffa-8f5827389a85

git-svn-id: svn+ssh://svn.bestpractical.com/svn/bps-public/rt/3.8/trunk@17581 e417ac7c-1bcc-0310-8ffa-8f5827389a85

git-svn-id: svn+ssh://svn.bestpractical.com/svn/bps-public/rt/branches/3.8-TESTING@13102 e417ac7c-1bcc-0310-8ffa-8f5827389a85

Some small warnings avoidance

git-svn-id: svn+ssh://svn.bestpractical.com/svn/bps-public/rt/branches/3.8-TESTING@11883 e417ac7c-1bcc-0310-8ffa-8f5827389a85

git-svn-id: svn+ssh://svn.bestpractical.com/svn/bps-public/rt/branches/3.7-RTIR-RELENG@11689 e417ac7c-1bcc-0310-8ffa-8f5827389a85

git-svn-id: svn+ssh://svn.bestpractical.com/svn/bps-public/rt/branches/3.6-RELEASE@11686 e417ac7c-1bcc-0310-8ffa-8f5827389a85

git-svn-id: svn+ssh://svn.bestpractical.com/svn/bps-public/rt/branches/3.7-EXPERIMENTAL@10957 e417ac7c-1bcc-0310-8ffa-8f5827389a85

add WithoutMember method along with WithMember

git-svn-id: svn+ssh://svn.bestpractical.com/svn/bps-public/rt/branches/3.7-EXPERIMENTAL@10310 e417ac7c-1bcc-0310-8ffa-8f5827389a85

git-svn-id: svn+ssh://svn.bestpractical.com/svn/bps-public/rt/branches/3.6-RELEASE@9923 e417ac7c-1bcc-0310-8ffa-8f5827389a85

git-svn-id: svn+ssh://svn.bestpractical.com/svn/bps-public/rt/branches/3.7-EXPERIMENTAL@8415 e417ac7c-1bcc-0310-8ffa-8f5827389a85