middleware: replace references to Errormator with AppEnlight.

Errormator has been rebranded as AppEnlight a while back.

Errormator is no longer available. This is just a trivial rename that can't
make things worse.

docs: update links to Mercurial's website and wiki

Also Mercurial itself is not a coding standard, so add possessive suffix.

protocols: fix assertion error when accessing repositories with "permanent" urls (Issue #202)

I am not aware of any good way to test this, so it is tested with a Mercurial only hack.

api: fix forking of repos in repo groups (Issue #210)

Patch by Alexandre Beaulieu.

api: avoid duplicating group name when updating repo (Issue #37)

The api incorrectly passed repo.repo_name as repo_name, and the model update
function incorrectly always required repo_name.

Added tag 0.3.2 for changeset a84d40e9481f
Added signature for changeset a84d40e9481f

auth: further sanitize requests to prevent GET CSRF (CVE-2016-3691)

Routes allows GET requests to override the HTTP method, which breaks
the Kallithea CSRF protection (which only applies to POST requests).

This commit blocks such GET request, preventing CSRF attacks.

auth: properly invoke PermFunctions (CVE-2016-3114)

This fixes a vulnerability that allowed logged-in users to edit or
delete open pull requests associated with any repository to which
they had read access, plus a related vulnerability allowing logged-in
users to delete any comment from any repository, provided they could
determine the comment ID and had read access to just one repository.

changelog: fix range selection from changelog in git repos (Issue #190)

The Mercurial backend can handle short revision ids so the problem does not
occur with hg repositories. Git needs the full hash.

vcs: fix repo size calculation

tip.walk already 'dives into' the dirs - don't do that twice.

api: avoid sending double Content-Length header (Issue #201)

WSGI will take of Content-Length - handling it explicitly was misguided.

docs: improve mod_wsgi documentation (Issue #203)

Based on feedback from Graham Dumpleton.

* Recommend setting global Apache config WSGIRestrictEmbedded On
* Don't set the default value for processes=1 - it has side effects
* Use python-home instead of python-path
* Fix confusing mentioning of root and clarify the use of specifying user and group
* Include WSGIProcessGroup in configuration excerpt

docs: add notes about IIS, Windows Authentication and Mercurial

(The original patch from Konstantin has been heavily copyedited and modified by
Mads Kiilerich but is still [based on] Konstantin's feedback and contribution.)

Added tag 0.3.1 for changeset 9bf8eb837e78
Added signature for changeset 9bf8eb837e78

auth: support both old and new python-pam API

python-pam 1.8.* provides a new API replacing the previously
available authenticate() function. The latest unreleased
version brings it back, but until it's available, use a
custom shim instead.

users: fix crash when creating users with non ASCII characters

This was already changed by the cleaned up on the default branch in
330c671dd451 but happened to also fix this issue on the stable branch.

hg: support Mercurial 3.7.x

Testing and upgrade notes doesn't indicate problems.

auth: Fix bug where usernames are not consistently capitalized when using crowd login

If you try to log in to Kallithea via the Crowd auth module then the
capitalization of your username in Kallithea changes on every login based on
how you capitalized it in the login form.

E.g. Log in with "TestDude", username is entered as "TestDude" then log in
again, but this time as "tesTduDe", and your username gets changed to
"tesTduDe". etc.

Fix for this is to use the 'name' field returned from Crowd when saving the
username. This way the username is always capitalized identically to the record
in Crowd.

auth: Fix tomcat throwing '505 HTTP Version Not Supported' when trying to log in to Atlassian Crowd with usernames that contain spaces

If you try to log in to Kallithea via the Crowd auth module, and the username
contains a space, it fails. Tomcat on the Crowd server gives error '505 HTTP
Version Not Supported'.

Further investigation showed that the username was not being quoted. E.g. for
the user 'test account', the REST URL should contain 'test%20account' but
actually was containing 'test account'. When Tomcat received this HTTP request
it interprets the word 'account' as the HTTP version because of the space. This
obviously isn't a valid HTTP version.

This bug is fixed by using urllib2.quote on the username to ensure that special
characters are correctly quoted. After making that change on my local install,
the user 'test account' was able to log in successfully.

i18n: updated translation for Japanese

Currently translated at 93.3% (1057 of 1132 strings)

i18n: updated translation for Japanese

Currently translated at 93.3% (1057 of 1132 strings)

i18n: updated translation for Czech

Currently translated at 3.3% (38 of 1132 strings)

i18n: updated translation for Japanese

Currently translated at 93.3% (1057 of 1132 strings)

middleware: decode the repo_name received from http header to unicode

The middlewares seemed to make the incorrect assumption that the headers
contained unicode. Or to put it differently: They relied on the Python default
encoding to be able to convert to unicode instead of using safe_unicode. It
would thus fail if running with LANG=C.

Instead, utilize that the header actually contains str_repo_name and explicitly
decode that to unicode.

db: fix unknown exception type in commit error handling

efce61aac33d was a blind fix. It failed because `from sqlalchemy import *`
doesn't import exc and the new except clause would thus fail. It also failed
because the session has to be rolled back after a commit failure.

Now, rework it to fix these issues.

Note that we are able to detect whether the commit failed for valid reasons ...
but we can't use that information to much ...

git: fix parsing of git mode change + rename diffs

Assume mode lines come first, like for hg diffs.

indexer: skip documents that can't be retrieved - probably because encoding issues (Issue #175)

This doesn't fix the encoding issue but it makes it less fatal.

auth: fail pam and internal authentication attempts if no username is provided (Issue #180)

When the Mercurial client communicates with a server over HTTP, it will always
first try to perform operations unauthenticated before providing credentials.
Authentication attempts without credentials is usually pointless and will just
slow operations down.

Some authentication plugins (such as LDAP) already skipped these
unauthenticated requests. Now, do the same for other authentication plugions.

Other authentication plugins also skip if no password is provided ... but that
doesn't seem necessary.

diff: get collapse target via .attr instead of .prop

Commit 3f017db297c4 was not fully tested and broke collapse/expand of diffs on
changesets. $button is not a link with a target and the target can thus not be
retrieved with .prop('target'); $button is just a span that happens to have a
custom attribute with the name 'target'.

We thus revert back to the old way of retrieving it with .attr('target'). (It
would perhaps be even better to use data attributes and name it data-target and
use .data('target') ...)

repo-scan: print status to stdout instead of logging it

Don't mute command line output just because the .ini file not is verbose.

setup: support the Mercurial 3.6 series

No significant API changes and testing doesn't show any problems.

This upgrade enables use of bundle2 with generaldelta.

cleanup: fixes of checking for None

Don't update repoinfo for all repos if an invalid repo is specified.

files: fix Selection Link for multi-line selections

It broke in dacdea9fda2a when wrong casing in the translation lookup caused an
undefined value which didn't show up in the UI and thus made the link unusable.

auth_pam: fix crash caused by colliding variable names

Regression introduced in 03afa7766ac7.

branches: fix 'compare branches' button

Commit b0774d79c7c95ec14ec6d23389d85ed544dd4b50 broke the 'Compare
branches' button on the repository branches page, when attempting to
replace a Yahoo UI click handler with jQuery.

bookmarks: fix 'compare bookmarks' button

Commit b0774d79c7c95ec14ec6d23389d85ed544dd4b50 broke the 'Compare
bookmarks' button on the repository bookmarks page, when attempting to
replace a Yahoo UI click handler with jQuery.

Added tag 0.3 for changeset 9b3e9e242f5c
Added signature for changeset 9b3e9e242f5c

auth: validate that the token protecting from CSRF attacks never is leaked

This will partly give some protection if it should happen, partly make sure the
leak doesn't go unnoticed but is found so it can be fixed.

forms: don't use secure forms with authentication token for GET requests

The token is secret and should never be used in forms posted with GET which are
URL encoded. aef21d16a262 was too aggresive in using secure forms everywhere
and did thus also incorrectly use them for forms posted with GET.

Some token leakage was reported by Gjoko Krstic <gjoko@zeroscience.mk> of Zero
Science Lab.

login: enhance came_from validation

Drop urlparse and just validate that came_from is a RFC 3986 compliant path.

This blocks an HTTP header injection vulnerability discovered by
Gjoko Krstic <gjoko@zeroscience.mk> of Zero Science Lab (CVE-2015-5285)

docs: add advice of upgrading pip and setuptools in new virtualenvs

Withtout this, the new virtualenv might have setuptools version 12 while the
URLObject dependency mock fails because it requires setuptools>=17.1 .

codemirror: remove the bad and hopefully unused CodeMirror.modeURL guessing

It should always be set in initCodeMirror before CodeMirror actually is used.

codemirror: fix modeURL when using proxy prefix (Issue #160)

Modified by Mads to use request.script_name instead of h.url().

login: use server-relative URLs in came_from correctly

Using h.url to combine came_from with query parameters caused the
SCRIPT_NAME to incorrectly be prepended to came_from, even though
it was already present. This was not a problem if the Kallithea
instance was served directly from the server root ('/') as is common,
but broke setups where Kallithea was served from a prefix.

login: include query parameters in came_from

The login controller uses the came_from query argument to determine
the page to continue to after login.

Previously, came_from specified only the URL path (obtained using
h.url.current), and any URL query parameters were passed along as
separate (additional) URL query parameters; to obtain the final redirect
target, h.url was used to combine came_from with the request.GET.

As of this changeset, came_from specifies both the URL path and query
string (obtained using request.path_qs), which means that came_from can
be used directly as the redirect target (as always, WebOb handles the
task of expanding the server relative path to a fully qualified URL).
The mangling of request.GET can also be removed.

The login code appended arbitrary, user-supplied query parameters to
URLs by calling the Routes URLGenerator (h.url) with user-supplied
keyword arguments. This construct is unfortunate, since url only
appends _unknown_ keyword arguments as query parameters, and the
parameter names could overlap with known keyword arguments, possibly
affecting the generated URL in various ways. This changeset removes
this usage from the login code, but other instances remain.

(In practice, the damage is apparently limited to causing an Internal
Server Error when going to e.g. "/_admin/login?host=foo", since WebOb
returns Unicode strings and URLGenerator only allows byte strings for
these keyword arguments.)

login: simplify came_from validation

Even though only server-relative came_from URLs were ever generated,
the login controller allowed fully qualified URLs (URLs including
scheme and server). To avoid an open HTTP redirect (CWE-601), the code
included logic to prevent redirects to other servers. By requiring
server-relative URLs, this logic can simply be removed.

Note: SCRIPT_NAME is still not validated and it is thus possible to redirect
from one app to another on the same netloc.

login: inline _redirect_to_origin

Refactor to simplify code and make next changes simpler.

Let the controller handle came_from early and more explicit, thus simplifying
the redirect flow.

pull requests: fix incorrect display of pull requests without updates

avail_revs would contain the top revision and thus not be empty even though no
revs were available for update.

pull requests: blame the right user when an admin adds reviewers to other peoples PRs

Don't send notifications from the PR owner.

cleanup: use example.com for tests and examples

example.com is explicitly reserved for this purpose. Using that means
we won't accidentally hammer a real server or real email address if an
example value escapes into the wild, e.g. in an automated test.

The domain "kallithea.example.com" has been used throughout to refer to the
example Kallithea server.

docs: update example output and example server configs

kallithea-api example output was not up-to-date, and the text was a
little vague on whether you specify a hostname or a URL.

The Nginx example config has been updated to assume a Kallithea backend
server on localhost:5000, like the Apache example.

The redundant ServerAlias option was removed from the Apache example.

notifications: ensure paginator's links remain correct after Mark All Read

Paginator is loaded together with the dynamic page content, so when it's
generated, a wrong URL may be used for its links.

docs: add documentation for setup with puppet

Incorporates feedback from Branko Majic and Søren Løvborg.

i18n: updated translation for French

Currently translated at 100.0% (1132 of 1132 strings)

i18n: updated translation for French

Currently translated at 59.6% (675 of 1132 strings)

i18n: updated translation for German

Currently translated at 60.5% (680 of 1123 strings)

i18n: updated translation for German

Currently translated at 59.7% (671 of 1123 strings)

i18n: updated translation for German

Currently translated at 59.6% (670 of 1123 strings)

i18n: updated translation for German

Currently translated at 57.7% (649 of 1123 strings)

i18n: updated translation for German

Currently translated at 57.7% (648 of 1123 strings)

i18n: updated translation for French

Currently translated at 58.8% (661 of 1123 strings)

release: set version number to 0.2.9 to hint that it is a 0.3 rc

I don't trust the rc numbering system in kallithea/__init__.py and how it
interacts with pip versioning.

gists: pass CSRF token when editing gists

check_revision was failing.