Fix URL redirection issue in login_page.php

When Mantis is installed at the web server's root, $g_short_path is set
to '/'. string_sanitize_url() removes the trailing '/' from the short
path, which causes the URL to be incorrectly categorized as "type 2",
thus allowing cross-site redirection to occur.

By making checking that the short path is not empty before setting URL
as type 2, we ensure that we categorize it as type 3, which then forces
the function's return value to 'index.php'

Fixes #17648 (CVE-2014-6316)

core/string_api.php

@@ -242,7 +242,9 @@ function string_sanitize_url( $p_url, $p_return_absolute = false ) {
 	$t_type = 0;
 	if ( preg_match( '@^(?P<path>' . preg_quote( $t_path, '@' ) . ')' . $t_pattern . '$@', $t_url, $t_matches ) ) {
 		$t_type = 1;
-	} else if ( preg_match( '@^(?P<path>' . preg_quote( $t_short_path, '@' ) . ')' . $t_pattern . '$@', $t_url, $t_matches ) ) {
+	} else if ( !empty( $t_short_path )
+			 && preg_match( '@^(?P<path>' . preg_quote( $t_short_path, '@' ) . ')' . $t_pattern . '$@', $t_url, $t_matches )
+	) {
 		$t_type = 2;
 	} else if ( preg_match( '@^(?P<path>)' . $t_pattern . '$@', $t_url, $t_matches ) ) {
 		$t_type = 3;