MRBS 1.12.2 等保2.0二级整改完整提交

包含：登录失败锁定、90天密码有效期、30分钟会话超时、
强制改密、登录审计日志、屏幕水印、企业背景图、
备案信息固定底部、favicon、JS空集合保护、
会话过期体验优化（403 JSON）、display_errors 关闭、
固定 key 根治 Integrity check failed 等全部改动

注意：config.inc.php/.htaccess/.user.ini 含敏感信息，
通过 .gitignore 排除，勿推送到公开仓库。

upgrade/53/mysql.sql

@@ -0,0 +1 @@
+#

upgrade/53/post.inc

@@ -0,0 +1,37 @@
+<?php
+namespace MRBS;
+
+// Check whether there is any custom HTML in the room and area tables.   If there is and
+// they haven't set $auth['allow_custom_html'] to true, then warn them that custom HTML is
+// now disabled by default for security reasons and they will have to enable it if they
+// want to continue using it.
+
+global $auth;
+
+if (empty($auth['allow_custom_html']))
+{
+  $sql = "SELECT custom_html
+            FROM " . _tbl('area') . " UNION SELECT custom_html FROM " . _tbl('room');
+  $custom_html = $upgrade_handle->query_array($sql);
+
+  foreach ($custom_html as $value)
+  {
+    if (isset($value) && ($value !== ''))
+    {
+      ?>
+
+      <script>
+      //<![CDATA[
+        alert('You are using custom HTML. For security reasons this has now been disabled ' +
+              'by default. If you want to continue using custom HTML and trust the HTML that ' +
+              'is being used, then you need to set "$auth[\'allow_custom_html\'] = true;" in ' +
+              'your config.inc.php file.');
+      //]];
+      </script>
+
+      <?php
+      break;
+    }
+  }
+
+}