security: Login-Required Policy

This addresses a privately reported issue in regards to enforcing
login-required policy before ticket creation.

open.php

@@ -18,6 +18,12 @@ define('SOURCE','Web'); //Ticket source.
 $ticket = null;
 $errors=array();
 if ($_POST) {
+    // If login is required and there is no user or if guest user then
+    // banish to the shadow realm
+    if ($cfg->isClientLoginRequired()
+            && (!$thisclient || $thisclient->isGuest()))
+        require_once 'secure.inc.php';
+
     $vars = $_POST;
     $vars['deptId']=$vars['emailId']=0; //Just Making sure we don't accept crap...only topicId is expected.
     if ($thisclient) {