issue-trackers: enforce a http or / patterns to avoid JS injections.

rhodecode/apps/admin/tests/test_admin_settings.py

@@ -1,730 +1,730 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import mock
 import pytest
 
 import rhodecode
 from rhodecode.apps._base import ADMIN_PREFIX
 from rhodecode.lib.utils2 import md5
 from rhodecode.model.db import RhodeCodeUi
 from rhodecode.model.meta import Session
 from rhodecode.model.settings import SettingsModel, IssueTrackerSettingsModel
 from rhodecode.tests import assert_session_flash
 from rhodecode.tests.utils import AssertResponse
 
 
 UPDATE_DATA_QUALNAME = (
     'rhodecode.apps.admin.views.system_info.AdminSystemInfoSettingsView.get_update_data')
 
 
 def route_path(name, params=None, **kwargs):
     import urllib
     from rhodecode.apps._base import ADMIN_PREFIX
 
     base_url = {
 
         'admin_settings':
             ADMIN_PREFIX +'/settings',
         'admin_settings_update':
             ADMIN_PREFIX + '/settings/update',
         'admin_settings_global':
             ADMIN_PREFIX + '/settings/global',
         'admin_settings_global_update':
             ADMIN_PREFIX + '/settings/global/update',
         'admin_settings_vcs':
             ADMIN_PREFIX + '/settings/vcs',
         'admin_settings_vcs_update':
             ADMIN_PREFIX + '/settings/vcs/update',
         'admin_settings_vcs_svn_pattern_delete':
             ADMIN_PREFIX + '/settings/vcs/svn_pattern_delete',
         'admin_settings_mapping':
             ADMIN_PREFIX + '/settings/mapping',
         'admin_settings_mapping_update':
             ADMIN_PREFIX + '/settings/mapping/update',
         'admin_settings_visual':
             ADMIN_PREFIX + '/settings/visual',
         'admin_settings_visual_update':
             ADMIN_PREFIX + '/settings/visual/update',
         'admin_settings_issuetracker':
             ADMIN_PREFIX + '/settings/issue-tracker',
         'admin_settings_issuetracker_update':
             ADMIN_PREFIX + '/settings/issue-tracker/update',
         'admin_settings_issuetracker_test':
             ADMIN_PREFIX + '/settings/issue-tracker/test',
         'admin_settings_issuetracker_delete':
             ADMIN_PREFIX + '/settings/issue-tracker/delete',
         'admin_settings_email':
             ADMIN_PREFIX + '/settings/email',
         'admin_settings_email_update':
             ADMIN_PREFIX + '/settings/email/update',
         'admin_settings_hooks':
             ADMIN_PREFIX + '/settings/hooks',
         'admin_settings_hooks_update':
             ADMIN_PREFIX + '/settings/hooks/update',
         'admin_settings_hooks_delete':
             ADMIN_PREFIX + '/settings/hooks/delete',
         'admin_settings_search':
             ADMIN_PREFIX + '/settings/search',
         'admin_settings_labs':
             ADMIN_PREFIX + '/settings/labs',
         'admin_settings_labs_update':
             ADMIN_PREFIX + '/settings/labs/update',
 
         'admin_settings_sessions':
             ADMIN_PREFIX + '/settings/sessions',
         'admin_settings_sessions_cleanup':
             ADMIN_PREFIX + '/settings/sessions/cleanup',
         'admin_settings_system':
             ADMIN_PREFIX + '/settings/system',
         'admin_settings_system_update':
             ADMIN_PREFIX + '/settings/system/updates',
         'admin_settings_open_source':
             ADMIN_PREFIX + '/settings/open_source',
 
 
     }[name].format(**kwargs)
 
     if params:
         base_url = '{}?{}'.format(base_url, urllib.urlencode(params))
     return base_url
 
 
 @pytest.mark.usefixtures('autologin_user', 'app')
 class TestAdminSettingsController(object):
 
     @pytest.mark.parametrize('urlname', [
         'admin_settings_vcs',
         'admin_settings_mapping',
         'admin_settings_global',
         'admin_settings_visual',
         'admin_settings_email',
         'admin_settings_hooks',
         'admin_settings_search',
     ])
     def test_simple_get(self, urlname):
         self.app.get(route_path(urlname))
 
     def test_create_custom_hook(self, csrf_token):
         response = self.app.post(
             route_path('admin_settings_hooks_update'),
             params={
                 'new_hook_ui_key': 'test_hooks_1',
                 'new_hook_ui_value': 'cd /tmp',
                 'csrf_token': csrf_token})
 
         response = response.follow()
         response.mustcontain('test_hooks_1')
         response.mustcontain('cd /tmp')
 
     def test_create_custom_hook_delete(self, csrf_token):
         response = self.app.post(
             route_path('admin_settings_hooks_update'),
             params={
                 'new_hook_ui_key': 'test_hooks_2',
                 'new_hook_ui_value': 'cd /tmp2',
                 'csrf_token': csrf_token})
 
         response = response.follow()
         response.mustcontain('test_hooks_2')
         response.mustcontain('cd /tmp2')
 
         hook_id = SettingsModel().get_ui_by_key('test_hooks_2').ui_id
 
         # delete
         self.app.post(
             route_path('admin_settings_hooks_delete'),
             params={'hook_id': hook_id, 'csrf_token': csrf_token})
         response = self.app.get(route_path('admin_settings_hooks'))
         response.mustcontain(no=['test_hooks_2'])
         response.mustcontain(no=['cd /tmp2'])
 
 
 @pytest.mark.usefixtures('autologin_user', 'app')
 class TestAdminSettingsGlobal(object):
 
     def test_pre_post_code_code_active(self, csrf_token):
         pre_code = 'rc-pre-code-187652122'
         post_code = 'rc-postcode-98165231'
 
         response = self.post_and_verify_settings({
             'rhodecode_pre_code': pre_code,
             'rhodecode_post_code': post_code,
             'csrf_token': csrf_token,
         })
 
         response = response.follow()
         response.mustcontain(pre_code, post_code)
 
     def test_pre_post_code_code_inactive(self, csrf_token):
         pre_code = 'rc-pre-code-187652122'
         post_code = 'rc-postcode-98165231'
         response = self.post_and_verify_settings({
             'rhodecode_pre_code': '',
             'rhodecode_post_code': '',
             'csrf_token': csrf_token,
         })
 
         response = response.follow()
         response.mustcontain(no=[pre_code, post_code])
 
     def test_captcha_activate(self, csrf_token):
         self.post_and_verify_settings({
             'rhodecode_captcha_private_key': '1234567890',
             'rhodecode_captcha_public_key': '1234567890',
             'csrf_token': csrf_token,
         })
 
         response = self.app.get(ADMIN_PREFIX + '/register')
         response.mustcontain('captcha')
 
     def test_captcha_deactivate(self, csrf_token):
         self.post_and_verify_settings({
             'rhodecode_captcha_private_key': '',
             'rhodecode_captcha_public_key': '1234567890',
             'csrf_token': csrf_token,
         })
 
         response = self.app.get(ADMIN_PREFIX + '/register')
         response.mustcontain(no=['captcha'])
 
     def test_title_change(self, csrf_token):
         old_title = 'RhodeCode'
 
         for new_title in ['Changed', 'Żółwik', old_title]:
             response = self.post_and_verify_settings({
                 'rhodecode_title': new_title,
                 'csrf_token': csrf_token,
             })
 
             response = response.follow()
             response.mustcontain(
                 """<div class="branding">- %s</div>""" % new_title)
 
     def post_and_verify_settings(self, settings):
         old_title = 'RhodeCode'
         old_realm = 'RhodeCode authentication'
         params = {
             'rhodecode_title': old_title,
             'rhodecode_realm': old_realm,
             'rhodecode_pre_code': '',
             'rhodecode_post_code': '',
             'rhodecode_captcha_private_key': '',
             'rhodecode_captcha_public_key': '',
             'rhodecode_create_personal_repo_group': False,
             'rhodecode_personal_repo_group_pattern': '${username}',
         }
         params.update(settings)
         response = self.app.post(
             route_path('admin_settings_global_update'), params=params)
 
         assert_session_flash(response, 'Updated application settings')
         app_settings = SettingsModel().get_all_settings()
         del settings['csrf_token']
         for key, value in settings.iteritems():
             assert app_settings[key] == value.decode('utf-8')
 
         return response
 
 
 @pytest.mark.usefixtures('autologin_user', 'app')
 class TestAdminSettingsVcs(object):
 
     def test_contains_svn_default_patterns(self):
         response = self.app.get(route_path('admin_settings_vcs'))
         expected_patterns = [
             '/trunk',
             '/branches/*',
             '/tags/*',
         ]
         for pattern in expected_patterns:
             response.mustcontain(pattern)
 
     def test_add_new_svn_branch_and_tag_pattern(
             self, backend_svn, form_defaults, disable_sql_cache,
             csrf_token):
         form_defaults.update({
             'new_svn_branch': '/exp/branches/*',
             'new_svn_tag': '/important_tags/*',
             'csrf_token': csrf_token,
         })
 
         response = self.app.post(
             route_path('admin_settings_vcs_update'),
             params=form_defaults, status=302)
         response = response.follow()
 
         # Expect to find the new values on the page
         response.mustcontain('/exp/branches/*')
         response.mustcontain('/important_tags/*')
 
         # Expect that those patterns are used to match branches and tags now
         repo = backend_svn['svn-simple-layout'].scm_instance()
         assert 'exp/branches/exp-sphinx-docs' in repo.branches
         assert 'important_tags/v0.5' in repo.tags
 
     def test_add_same_svn_value_twice_shows_an_error_message(
             self, form_defaults, csrf_token, settings_util):
         settings_util.create_rhodecode_ui('vcs_svn_branch', '/test')
         settings_util.create_rhodecode_ui('vcs_svn_tag', '/test')
 
         response = self.app.post(
             route_path('admin_settings_vcs_update'),
             params={
                 'paths_root_path': form_defaults['paths_root_path'],
                 'new_svn_branch': '/test',
                 'new_svn_tag': '/test',
                 'csrf_token': csrf_token,
             },
             status=200)
 
         response.mustcontain("Pattern already exists")
         response.mustcontain("Some form inputs contain invalid data.")
 
     @pytest.mark.parametrize('section', [
         'vcs_svn_branch',
         'vcs_svn_tag',
     ])
     def test_delete_svn_patterns(
             self, section, csrf_token, settings_util):
         setting = settings_util.create_rhodecode_ui(
             section, '/test_delete', cleanup=False)
 
         self.app.post(
             route_path('admin_settings_vcs_svn_pattern_delete'),
             params={
                 'delete_svn_pattern': setting.ui_id,
                 'csrf_token': csrf_token},
             headers={'X-REQUESTED-WITH': 'XMLHttpRequest'})
 
     @pytest.mark.parametrize('section', [
         'vcs_svn_branch',
         'vcs_svn_tag',
     ])
     def test_delete_svn_patterns_raises_404_when_no_xhr(
             self, section, csrf_token, settings_util):
         setting = settings_util.create_rhodecode_ui(section, '/test_delete')
 
         self.app.post(
             route_path('admin_settings_vcs_svn_pattern_delete'),
             params={
                 'delete_svn_pattern': setting.ui_id,
                 'csrf_token': csrf_token},
             status=404)
 
     def test_extensions_hgsubversion(self, form_defaults, csrf_token):
         form_defaults.update({
             'csrf_token': csrf_token,
             'extensions_hgsubversion': 'True',
         })
         response = self.app.post(
             route_path('admin_settings_vcs_update'),
             params=form_defaults,
             status=302)
 
         response = response.follow()
         extensions_input = (
             '<input id="extensions_hgsubversion" '
             'name="extensions_hgsubversion" type="checkbox" '
             'value="True" checked="checked" />')
         response.mustcontain(extensions_input)
 
     def test_extensions_hgevolve(self, form_defaults, csrf_token):
         form_defaults.update({
             'csrf_token': csrf_token,
             'extensions_evolve': 'True',
         })
         response = self.app.post(
             route_path('admin_settings_vcs_update'),
             params=form_defaults,
             status=302)
 
         response = response.follow()
         extensions_input = (
             '<input id="extensions_evolve" '
             'name="extensions_evolve" type="checkbox" '
             'value="True" checked="checked" />')
         response.mustcontain(extensions_input)
 
     def test_has_a_section_for_pull_request_settings(self):
         response = self.app.get(route_path('admin_settings_vcs'))
         response.mustcontain('Pull Request Settings')
 
     def test_has_an_input_for_invalidation_of_inline_comments(self):
         response = self.app.get(route_path('admin_settings_vcs'))
         assert_response = AssertResponse(response)
         assert_response.one_element_exists(
             '[name=rhodecode_use_outdated_comments]')
 
     @pytest.mark.parametrize('new_value', [True, False])
     def test_allows_to_change_invalidation_of_inline_comments(
             self, form_defaults, csrf_token, new_value):
         setting_key = 'use_outdated_comments'
         setting = SettingsModel().create_or_update_setting(
             setting_key, not new_value, 'bool')
         Session().add(setting)
         Session().commit()
 
         form_defaults.update({
             'csrf_token': csrf_token,
             'rhodecode_use_outdated_comments': str(new_value),
         })
         response = self.app.post(
             route_path('admin_settings_vcs_update'),
             params=form_defaults,
             status=302)
         response = response.follow()
         setting = SettingsModel().get_setting_by_name(setting_key)
         assert setting.app_settings_value is new_value
 
     @pytest.mark.parametrize('new_value', [True, False])
     def test_allows_to_change_hg_rebase_merge_strategy(
             self, form_defaults, csrf_token, new_value):
         setting_key = 'hg_use_rebase_for_merging'
 
         form_defaults.update({
             'csrf_token': csrf_token,
             'rhodecode_' + setting_key: str(new_value),
         })
 
         with mock.patch.dict(
                 rhodecode.CONFIG, {'labs_settings_active': 'true'}):
             self.app.post(
                 route_path('admin_settings_vcs_update'),
                 params=form_defaults,
                 status=302)
 
         setting = SettingsModel().get_setting_by_name(setting_key)
         assert setting.app_settings_value is new_value
 
     @pytest.fixture
     def disable_sql_cache(self, request):
         patcher = mock.patch(
             'rhodecode.lib.caching_query.FromCache.process_query')
         request.addfinalizer(patcher.stop)
         patcher.start()
 
     @pytest.fixture
     def form_defaults(self):
         from rhodecode.apps.admin.views.settings import AdminSettingsView
         return AdminSettingsView._form_defaults()
 
     # TODO: johbo: What we really want is to checkpoint before a test run and
     # reset the session afterwards.
     @pytest.fixture(scope='class', autouse=True)
     def cleanup_settings(self, request, pylonsapp):
         ui_id = RhodeCodeUi.ui_id
         original_ids = list(
             r.ui_id for r in RhodeCodeUi.query().values(ui_id))
 
         @request.addfinalizer
         def cleanup():
             RhodeCodeUi.query().filter(
                 ui_id.notin_(original_ids)).delete(False)
 
 
 @pytest.mark.usefixtures('autologin_user', 'app')
 class TestLabsSettings(object):
     def test_get_settings_page_disabled(self):
         with mock.patch.dict(
                 rhodecode.CONFIG, {'labs_settings_active': 'false'}):
 
             response = self.app.get(
                 route_path('admin_settings_labs'), status=302)
 
         assert response.location.endswith(route_path('admin_settings'))
 
     def test_get_settings_page_enabled(self):
         from rhodecode.apps.admin.views import settings
         lab_settings = [
             settings.LabSetting(
                 key='rhodecode_bool',
                 type='bool',
                 group='bool group',
                 label='bool label',
                 help='bool help'
             ),
             settings.LabSetting(
                 key='rhodecode_text',
                 type='unicode',
                 group='text group',
                 label='text label',
                 help='text help'
             ),
         ]
         with mock.patch.dict(rhodecode.CONFIG,
                              {'labs_settings_active': 'true'}):
             with mock.patch.object(settings, '_LAB_SETTINGS', lab_settings):
                 response = self.app.get(route_path('admin_settings_labs'))
 
         assert '<label>bool group:</label>' in response
         assert '<label for="rhodecode_bool">bool label</label>' in response
         assert '<p class="help-block">bool help</p>' in response
         assert 'name="rhodecode_bool" type="checkbox"' in response
 
         assert '<label>text group:</label>' in response
         assert '<label for="rhodecode_text">text label</label>' in response
         assert '<p class="help-block">text help</p>' in response
         assert 'name="rhodecode_text" size="60" type="text"' in response
 
 
 @pytest.mark.usefixtures('app')
 class TestOpenSourceLicenses(object):
 
     def test_records_are_displayed(self, autologin_user):
         sample_licenses = {
             "python2.7-pytest-2.7.1": {
                 "UNKNOWN": None
             },
             "python2.7-Markdown-2.6.2": {
                 "BSD-3-Clause": "http://spdx.org/licenses/BSD-3-Clause"
             }
         }
         read_licenses_patch = mock.patch(
             'rhodecode.apps.admin.views.open_source_licenses.read_opensource_licenses',
             return_value=sample_licenses)
         with read_licenses_patch:
             response = self.app.get(
                 route_path('admin_settings_open_source'), status=200)
 
         assert_response = AssertResponse(response)
         assert_response.element_contains(
             '.panel-heading', 'Licenses of Third Party Packages')
         for name in sample_licenses:
             response.mustcontain(name)
             for license in sample_licenses[name]:
                 assert_response.element_contains('.panel-body', license)
 
     def test_records_can_be_read(self, autologin_user):
         response = self.app.get(
             route_path('admin_settings_open_source'), status=200)
         assert_response = AssertResponse(response)
         assert_response.element_contains(
             '.panel-heading', 'Licenses of Third Party Packages')
 
     def test_forbidden_when_normal_user(self, autologin_regular_user):
         self.app.get(
             route_path('admin_settings_open_source'), status=404)
 
 
 @pytest.mark.usefixtures('app')
 class TestUserSessions(object):
 
     def test_forbidden_when_normal_user(self, autologin_regular_user):
         self.app.get(route_path('admin_settings_sessions'), status=404)
 
     def test_show_sessions_page(self, autologin_user):
         response = self.app.get(route_path('admin_settings_sessions'), status=200)
         response.mustcontain('file')
 
     def test_cleanup_old_sessions(self, autologin_user, csrf_token):
 
         post_data = {
             'csrf_token': csrf_token,
             'expire_days': '60'
         }
         response = self.app.post(
             route_path('admin_settings_sessions_cleanup'), params=post_data,
             status=302)
         assert_session_flash(response, 'Cleaned up old sessions')
 
 
 @pytest.mark.usefixtures('app')
 class TestAdminSystemInfo(object):
 
     def test_forbidden_when_normal_user(self, autologin_regular_user):
         self.app.get(route_path('admin_settings_system'), status=404)
 
     def test_system_info_page(self, autologin_user):
         response = self.app.get(route_path('admin_settings_system'))
         response.mustcontain('RhodeCode Community Edition, version {}'.format(
             rhodecode.__version__))
 
     def test_system_update_new_version(self, autologin_user):
         update_data = {
             'versions': [
                 {
                     'version': '100.3.1415926535',
                     'general': 'The latest version we are ever going to ship'
                 },
                 {
                     'version': '0.0.0',
                     'general': 'The first version we ever shipped'
                 }
             ]
         }
         with mock.patch(UPDATE_DATA_QUALNAME, return_value=update_data):
             response = self.app.get(route_path('admin_settings_system_update'))
             response.mustcontain('A <b>new version</b> is available')
 
     def test_system_update_nothing_new(self, autologin_user):
         update_data = {
             'versions': [
                 {
                     'version': '0.0.0',
                     'general': 'The first version we ever shipped'
                 }
             ]
         }
         with mock.patch(UPDATE_DATA_QUALNAME, return_value=update_data):
             response = self.app.get(route_path('admin_settings_system_update'))
             response.mustcontain(
                 'You already have the <b>latest</b> stable version.')
 
     def test_system_update_bad_response(self, autologin_user):
         with mock.patch(UPDATE_DATA_QUALNAME, side_effect=ValueError('foo')):
             response = self.app.get(route_path('admin_settings_system_update'))
             response.mustcontain(
                 'Bad data sent from update server')
 
 
 @pytest.mark.usefixtures("app")
 class TestAdminSettingsIssueTracker(object):
     RC_PREFIX = 'rhodecode_'
     SHORT_PATTERN_KEY = 'issuetracker_pat_'
     PATTERN_KEY = RC_PREFIX + SHORT_PATTERN_KEY
 
     def test_issuetracker_index(self, autologin_user):
         response = self.app.get(route_path('admin_settings_issuetracker'))
         assert response.status_code == 200
 
     def test_add_empty_issuetracker_pattern(
             self, request, autologin_user, csrf_token):
         post_url = route_path('admin_settings_issuetracker_update')
         post_data = {
             'csrf_token': csrf_token
         }
         self.app.post(post_url, post_data, status=302)
 
     def test_add_issuetracker_pattern(
             self, request, autologin_user, csrf_token):
         pattern = 'issuetracker_pat'
         another_pattern = pattern+'1'
         post_url = route_path('admin_settings_issuetracker_update')
         post_data = {
             'new_pattern_pattern_0': pattern,
-            'new_pattern_url_0': 'url',
+            'new_pattern_url_0': 'http://url',
             'new_pattern_prefix_0': 'prefix',
             'new_pattern_description_0': 'description',
             'new_pattern_pattern_1': another_pattern,
-            'new_pattern_url_1': 'url1',
+            'new_pattern_url_1': 'https://url1',
             'new_pattern_prefix_1': 'prefix1',
             'new_pattern_description_1': 'description1',
             'csrf_token': csrf_token
         }
         self.app.post(post_url, post_data, status=302)
         settings = SettingsModel().get_all_settings()
         self.uid = md5(pattern)
         assert settings[self.PATTERN_KEY+self.uid] == pattern
         self.another_uid = md5(another_pattern)
         assert settings[self.PATTERN_KEY+self.another_uid] == another_pattern
 
         @request.addfinalizer
         def cleanup():
             defaults = SettingsModel().get_all_settings()
 
             entries = [name for name in defaults if (
                 (self.uid in name) or (self.another_uid) in name)]
             start = len(self.RC_PREFIX)
             for del_key in entries:
                 # TODO: anderson: get_by_name needs name without prefix
                 entry = SettingsModel().get_setting_by_name(del_key[start:])
                 Session().delete(entry)
 
             Session().commit()
 
     def test_edit_issuetracker_pattern(
             self, autologin_user, backend, csrf_token, request):
         old_pattern = 'issuetracker_pat'
         old_uid = md5(old_pattern)
         pattern = 'issuetracker_pat_new'
         self.new_uid = md5(pattern)
 
         SettingsModel().create_or_update_setting(
             self.SHORT_PATTERN_KEY+old_uid, old_pattern, 'unicode')
 
         post_url = route_path('admin_settings_issuetracker_update')
         post_data = {
             'new_pattern_pattern_0': pattern,
-            'new_pattern_url_0': 'url',
+            'new_pattern_url_0': 'https://url',
             'new_pattern_prefix_0': 'prefix',
             'new_pattern_description_0': 'description',
             'uid': old_uid,
             'csrf_token': csrf_token
         }
         self.app.post(post_url, post_data, status=302)
         settings = SettingsModel().get_all_settings()
         assert settings[self.PATTERN_KEY+self.new_uid] == pattern
         assert self.PATTERN_KEY+old_uid not in settings
 
         @request.addfinalizer
         def cleanup():
             IssueTrackerSettingsModel().delete_entries(self.new_uid)
 
     def test_replace_issuetracker_pattern_description(
             self, autologin_user, csrf_token, request, settings_util):
         prefix = 'issuetracker'
         pattern = 'issuetracker_pat'
         self.uid = md5(pattern)
         pattern_key = '_'.join([prefix, 'pat', self.uid])
         rc_pattern_key = '_'.join(['rhodecode', pattern_key])
         desc_key = '_'.join([prefix, 'desc', self.uid])
         rc_desc_key = '_'.join(['rhodecode', desc_key])
         new_description = 'new_description'
 
         settings_util.create_rhodecode_setting(
             pattern_key, pattern, 'unicode', cleanup=False)
         settings_util.create_rhodecode_setting(
             desc_key, 'old description', 'unicode', cleanup=False)
 
         post_url = route_path('admin_settings_issuetracker_update')
         post_data = {
             'new_pattern_pattern_0': pattern,
-            'new_pattern_url_0': 'url',
+            'new_pattern_url_0': 'https://url',
             'new_pattern_prefix_0': 'prefix',
             'new_pattern_description_0': new_description,
             'uid': self.uid,
             'csrf_token': csrf_token
         }
         self.app.post(post_url, post_data, status=302)
         settings = SettingsModel().get_all_settings()
         assert settings[rc_pattern_key] == pattern
         assert settings[rc_desc_key] == new_description
 
         @request.addfinalizer
         def cleanup():
             IssueTrackerSettingsModel().delete_entries(self.uid)
 
     def test_delete_issuetracker_pattern(
             self, autologin_user, backend, csrf_token, settings_util):
         pattern = 'issuetracker_pat'
         uid = md5(pattern)
         settings_util.create_rhodecode_setting(
             self.SHORT_PATTERN_KEY+uid, pattern, 'unicode', cleanup=False)
 
         post_url = route_path('admin_settings_issuetracker_delete')
         post_data = {
             '_method': 'delete',
             'uid': uid,
             'csrf_token': csrf_token
         }
         self.app.post(post_url, post_data, status=302)
         settings = SettingsModel().get_all_settings()
         assert 'rhodecode_%s%s' % (self.SHORT_PATTERN_KEY, uid) not in settings

rhodecode/apps/admin/views/settings.py

@@ -1,754 +1,762 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 
 import logging
 import collections
 
 import datetime
 import formencode
 import formencode.htmlfill
 
 import rhodecode
 from pyramid.view import view_config
 from pyramid.httpexceptions import HTTPFound, HTTPNotFound
 from pyramid.renderers import render
 from pyramid.response import Response
 
 from rhodecode.apps._base import BaseAppView
 from rhodecode.apps.admin.navigation import navigation_list
 from rhodecode.apps.svn_support.config_keys import generate_config
 from rhodecode.lib import helpers as h
 from rhodecode.lib.auth import (
     LoginRequired, HasPermissionAllDecorator, CSRFRequired)
 from rhodecode.lib.celerylib import tasks, run_task
 from rhodecode.lib.utils import repo2db_mapper
 from rhodecode.lib.utils2 import str2bool, safe_unicode, AttributeDict
 from rhodecode.lib.index import searcher_from_config
 
 from rhodecode.model.db import RhodeCodeUi, Repository
 from rhodecode.model.forms import (ApplicationSettingsForm,
     ApplicationUiSettingsForm, ApplicationVisualisationForm,
     LabsSettingsForm, IssueTrackerPatternsForm)
 from rhodecode.model.repo_group import RepoGroupModel
 
 from rhodecode.model.scm import ScmModel
 from rhodecode.model.notification import EmailNotificationModel
 from rhodecode.model.meta import Session
 from rhodecode.model.settings import (
     IssueTrackerSettingsModel, VcsSettingsModel, SettingNotFound,
     SettingsModel)
 
 
 log = logging.getLogger(__name__)
 
 
 class AdminSettingsView(BaseAppView):
 
     def load_default_context(self):
         c = self._get_local_tmpl_context()
         c.labs_active = str2bool(
             rhodecode.CONFIG.get('labs_settings_active', 'true'))
         c.navlist = navigation_list(self.request)
         self._register_global_c(c)
         return c
 
     @classmethod
     def _get_ui_settings(cls):
         ret = RhodeCodeUi.query().all()
 
         if not ret:
             raise Exception('Could not get application ui settings !')
         settings = {}
         for each in ret:
             k = each.ui_key
             v = each.ui_value
             if k == '/':
                 k = 'root_path'
 
             if k in ['push_ssl', 'publish', 'enabled']:
                 v = str2bool(v)
 
             if k.find('.') != -1:
                 k = k.replace('.', '_')
 
             if each.ui_section in ['hooks', 'extensions']:
                 v = each.ui_active
 
             settings[each.ui_section + '_' + k] = v
         return settings
 
     @classmethod
     def _form_defaults(cls):
         defaults = SettingsModel().get_all_settings()
         defaults.update(cls._get_ui_settings())
 
         defaults.update({
             'new_svn_branch': '',
             'new_svn_tag': '',
         })
         return defaults
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @view_config(
         route_name='admin_settings_vcs', request_method='GET',
         renderer='rhodecode:templates/admin/settings/settings.mako')
     def settings_vcs(self):
         c = self.load_default_context()
         c.active = 'vcs'
         model = VcsSettingsModel()
         c.svn_branch_patterns = model.get_global_svn_branch_patterns()
         c.svn_tag_patterns = model.get_global_svn_tag_patterns()
 
         settings = self.request.registry.settings
         c.svn_proxy_generate_config = settings[generate_config]
 
         defaults = self._form_defaults()
 
         model.create_largeobjects_dirs_if_needed(defaults['paths_root_path'])
 
         data = render('rhodecode:templates/admin/settings/settings.mako',
                       self._get_template_context(c), self.request)
         html = formencode.htmlfill.render(
             data,
             defaults=defaults,
             encoding="UTF-8",
             force_defaults=False
         )
         return Response(html)
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @CSRFRequired()
     @view_config(
         route_name='admin_settings_vcs_update', request_method='POST',
         renderer='rhodecode:templates/admin/settings/settings.mako')
     def settings_vcs_update(self):
         _ = self.request.translate
         c = self.load_default_context()
         c.active = 'vcs'
 
         model = VcsSettingsModel()
         c.svn_branch_patterns = model.get_global_svn_branch_patterns()
         c.svn_tag_patterns = model.get_global_svn_tag_patterns()
 
         settings = self.request.registry.settings
         c.svn_proxy_generate_config = settings[generate_config]
 
         application_form = ApplicationUiSettingsForm()()
 
         try:
             form_result = application_form.to_python(dict(self.request.POST))
         except formencode.Invalid as errors:
             h.flash(
                 _("Some form inputs contain invalid data."),
                 category='error')
             data = render('rhodecode:templates/admin/settings/settings.mako',
                           self._get_template_context(c), self.request)
             html = formencode.htmlfill.render(
                 data,
                 defaults=errors.value,
                 errors=errors.error_dict or {},
                 prefix_error=False,
                 encoding="UTF-8",
                 force_defaults=False
             )
             return Response(html)
 
         try:
             if c.visual.allow_repo_location_change:
                 model.update_global_path_setting(
                     form_result['paths_root_path'])
 
             model.update_global_ssl_setting(form_result['web_push_ssl'])
             model.update_global_hook_settings(form_result)
 
             model.create_or_update_global_svn_settings(form_result)
             model.create_or_update_global_hg_settings(form_result)
             model.create_or_update_global_git_settings(form_result)
             model.create_or_update_global_pr_settings(form_result)
         except Exception:
             log.exception("Exception while updating settings")
             h.flash(_('Error occurred during updating '
                       'application settings'), category='error')
         else:
             Session().commit()
             h.flash(_('Updated VCS settings'), category='success')
             raise HTTPFound(h.route_path('admin_settings_vcs'))
 
         data = render('rhodecode:templates/admin/settings/settings.mako',
                       self._get_template_context(c), self.request)
         html = formencode.htmlfill.render(
             data,
             defaults=self._form_defaults(),
             encoding="UTF-8",
             force_defaults=False
         )
         return Response(html)
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @CSRFRequired()
     @view_config(
         route_name='admin_settings_vcs_svn_pattern_delete', request_method='POST',
         renderer='json_ext', xhr=True)
     def settings_vcs_delete_svn_pattern(self):
         delete_pattern_id = self.request.POST.get('delete_svn_pattern')
         model = VcsSettingsModel()
         try:
             model.delete_global_svn_pattern(delete_pattern_id)
         except SettingNotFound:
             log.exception(
                 'Failed to delete svn_pattern with id %s', delete_pattern_id)
             raise HTTPNotFound()
 
         Session().commit()
         return True
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @view_config(
         route_name='admin_settings_mapping', request_method='GET',
         renderer='rhodecode:templates/admin/settings/settings.mako')
     def settings_mapping(self):
         c = self.load_default_context()
         c.active = 'mapping'
 
         data = render('rhodecode:templates/admin/settings/settings.mako',
                       self._get_template_context(c), self.request)
         html = formencode.htmlfill.render(
             data,
             defaults=self._form_defaults(),
             encoding="UTF-8",
             force_defaults=False
         )
         return Response(html)
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @CSRFRequired()
     @view_config(
         route_name='admin_settings_mapping_update', request_method='POST',
         renderer='rhodecode:templates/admin/settings/settings.mako')
     def settings_mapping_update(self):
         _ = self.request.translate
         c = self.load_default_context()
         c.active = 'mapping'
         rm_obsolete = self.request.POST.get('destroy', False)
         invalidate_cache = self.request.POST.get('invalidate', False)
         log.debug(
             'rescanning repo location with destroy obsolete=%s', rm_obsolete)
 
         if invalidate_cache:
             log.debug('invalidating all repositories cache')
             for repo in Repository.get_all():
                 ScmModel().mark_for_invalidation(repo.repo_name, delete=True)
 
         filesystem_repos = ScmModel().repo_scan()
         added, removed = repo2db_mapper(filesystem_repos, rm_obsolete)
         _repr = lambda l: ', '.join(map(safe_unicode, l)) or '-'
         h.flash(_('Repositories successfully '
                   'rescanned added: %s ; removed: %s') %
                 (_repr(added), _repr(removed)),
                 category='success')
         raise HTTPFound(h.route_path('admin_settings_mapping'))
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @view_config(
         route_name='admin_settings', request_method='GET',
         renderer='rhodecode:templates/admin/settings/settings.mako')
     @view_config(
         route_name='admin_settings_global', request_method='GET',
         renderer='rhodecode:templates/admin/settings/settings.mako')
     def settings_global(self):
         c = self.load_default_context()
         c.active = 'global'
         c.personal_repo_group_default_pattern = RepoGroupModel()\
             .get_personal_group_name_pattern()
 
         data = render('rhodecode:templates/admin/settings/settings.mako',
                       self._get_template_context(c), self.request)
         html = formencode.htmlfill.render(
             data,
             defaults=self._form_defaults(),
             encoding="UTF-8",
             force_defaults=False
         )
         return Response(html)
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @CSRFRequired()
     @view_config(
         route_name='admin_settings_update', request_method='POST',
         renderer='rhodecode:templates/admin/settings/settings.mako')
     @view_config(
         route_name='admin_settings_global_update', request_method='POST',
         renderer='rhodecode:templates/admin/settings/settings.mako')
     def settings_global_update(self):
         _ = self.request.translate
         c = self.load_default_context()
         c.active = 'global'
         c.personal_repo_group_default_pattern = RepoGroupModel()\
             .get_personal_group_name_pattern()
         application_form = ApplicationSettingsForm()()
         try:
             form_result = application_form.to_python(dict(self.request.POST))
         except formencode.Invalid as errors:
             data = render('rhodecode:templates/admin/settings/settings.mako',
                           self._get_template_context(c), self.request)
             html = formencode.htmlfill.render(
                 data,
                 defaults=errors.value,
                 errors=errors.error_dict or {},
                 prefix_error=False,
                 encoding="UTF-8",
                 force_defaults=False
             )
             return Response(html)
 
         settings = [
             ('title', 'rhodecode_title', 'unicode'),
             ('realm', 'rhodecode_realm', 'unicode'),
             ('pre_code', 'rhodecode_pre_code', 'unicode'),
             ('post_code', 'rhodecode_post_code', 'unicode'),
             ('captcha_public_key', 'rhodecode_captcha_public_key', 'unicode'),
             ('captcha_private_key', 'rhodecode_captcha_private_key', 'unicode'),
             ('create_personal_repo_group', 'rhodecode_create_personal_repo_group', 'bool'),
             ('personal_repo_group_pattern', 'rhodecode_personal_repo_group_pattern', 'unicode'),
         ]
         try:
             for setting, form_key, type_ in settings:
                 sett = SettingsModel().create_or_update_setting(
                     setting, form_result[form_key], type_)
                 Session().add(sett)
 
             Session().commit()
             SettingsModel().invalidate_settings_cache()
             h.flash(_('Updated application settings'), category='success')
         except Exception:
             log.exception("Exception while updating application settings")
             h.flash(
                 _('Error occurred during updating application settings'),
                 category='error')
 
         raise HTTPFound(h.route_path('admin_settings_global'))
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @view_config(
         route_name='admin_settings_visual', request_method='GET',
         renderer='rhodecode:templates/admin/settings/settings.mako')
     def settings_visual(self):
         c = self.load_default_context()
         c.active = 'visual'
 
         data = render('rhodecode:templates/admin/settings/settings.mako',
                       self._get_template_context(c), self.request)
         html = formencode.htmlfill.render(
             data,
             defaults=self._form_defaults(),
             encoding="UTF-8",
             force_defaults=False
         )
         return Response(html)
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @CSRFRequired()
     @view_config(
         route_name='admin_settings_visual_update', request_method='POST',
         renderer='rhodecode:templates/admin/settings/settings.mako')
     def settings_visual_update(self):
         _ = self.request.translate
         c = self.load_default_context()
         c.active = 'visual'
         application_form = ApplicationVisualisationForm()()
         try:
             form_result = application_form.to_python(dict(self.request.POST))
         except formencode.Invalid as errors:
             data = render('rhodecode:templates/admin/settings/settings.mako',
                           self._get_template_context(c), self.request)
             html = formencode.htmlfill.render(
                 data,
                 defaults=errors.value,
                 errors=errors.error_dict or {},
                 prefix_error=False,
                 encoding="UTF-8",
                 force_defaults=False
             )
             return Response(html)
 
         try:
             settings = [
                 ('show_public_icon', 'rhodecode_show_public_icon', 'bool'),
                 ('show_private_icon', 'rhodecode_show_private_icon', 'bool'),
                 ('stylify_metatags', 'rhodecode_stylify_metatags', 'bool'),
                 ('repository_fields', 'rhodecode_repository_fields', 'bool'),
                 ('dashboard_items', 'rhodecode_dashboard_items', 'int'),
                 ('admin_grid_items', 'rhodecode_admin_grid_items', 'int'),
                 ('show_version', 'rhodecode_show_version', 'bool'),
                 ('use_gravatar', 'rhodecode_use_gravatar', 'bool'),
                 ('markup_renderer', 'rhodecode_markup_renderer', 'unicode'),
                 ('gravatar_url', 'rhodecode_gravatar_url', 'unicode'),
                 ('clone_uri_tmpl', 'rhodecode_clone_uri_tmpl', 'unicode'),
                 ('support_url', 'rhodecode_support_url', 'unicode'),
                 ('show_revision_number', 'rhodecode_show_revision_number', 'bool'),
                 ('show_sha_length', 'rhodecode_show_sha_length', 'int'),
             ]
             for setting, form_key, type_ in settings:
                 sett = SettingsModel().create_or_update_setting(
                     setting, form_result[form_key], type_)
                 Session().add(sett)
 
             Session().commit()
             SettingsModel().invalidate_settings_cache()
             h.flash(_('Updated visualisation settings'), category='success')
         except Exception:
             log.exception("Exception updating visualization settings")
             h.flash(_('Error occurred during updating '
                       'visualisation settings'),
                     category='error')
 
         raise HTTPFound(h.route_path('admin_settings_visual'))
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @view_config(
         route_name='admin_settings_issuetracker', request_method='GET',
         renderer='rhodecode:templates/admin/settings/settings.mako')
     def settings_issuetracker(self):
         c = self.load_default_context()
         c.active = 'issuetracker'
         defaults = SettingsModel().get_all_settings()
 
         entry_key = 'rhodecode_issuetracker_pat_'
 
         c.issuetracker_entries = {}
         for k, v in defaults.items():
             if k.startswith(entry_key):
                 uid = k[len(entry_key):]
                 c.issuetracker_entries[uid] = None
 
         for uid in c.issuetracker_entries:
             c.issuetracker_entries[uid] = AttributeDict({
                 'pat': defaults.get('rhodecode_issuetracker_pat_' + uid),
                 'url': defaults.get('rhodecode_issuetracker_url_' + uid),
                 'pref': defaults.get('rhodecode_issuetracker_pref_' + uid),
                 'desc': defaults.get('rhodecode_issuetracker_desc_' + uid),
             })
 
         return self._get_template_context(c)
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @CSRFRequired()
     @view_config(
         route_name='admin_settings_issuetracker_test', request_method='POST',
         renderer='string', xhr=True)
     def settings_issuetracker_test(self):
         return h.urlify_commit_message(
             self.request.POST.get('test_text', ''),
             'repo_group/test_repo1')
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @CSRFRequired()
     @view_config(
         route_name='admin_settings_issuetracker_update', request_method='POST',
         renderer='rhodecode:templates/admin/settings/settings.mako')
     def settings_issuetracker_update(self):
         _ = self.request.translate
         self.load_default_context()
         settings_model = IssueTrackerSettingsModel()
 
+        try:
         form = IssueTrackerPatternsForm()().to_python(self.request.POST)
+        except formencode.Invalid as errors:
+            log.exception('Failed to add new pattern')
+            error = errors
+            h.flash(_('Invalid issue tracker pattern: {}'.format(error)),
+                    category='error')
+            raise HTTPFound(h.route_path('admin_settings_issuetracker'))
+
         if form:
             for uid in form.get('delete_patterns', []):
                 settings_model.delete_entries(uid)
 
             for pattern in form.get('patterns', []):
                 for setting, value, type_ in pattern:
                     sett = settings_model.create_or_update_setting(
                         setting, value, type_)
                     Session().add(sett)
 
                 Session().commit()
 
             SettingsModel().invalidate_settings_cache()
             h.flash(_('Updated issue tracker entries'), category='success')
         raise HTTPFound(h.route_path('admin_settings_issuetracker'))
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @CSRFRequired()
     @view_config(
         route_name='admin_settings_issuetracker_delete', request_method='POST',
         renderer='rhodecode:templates/admin/settings/settings.mako')
     def settings_issuetracker_delete(self):
         _ = self.request.translate
         self.load_default_context()
         uid = self.request.POST.get('uid')
         try:
             IssueTrackerSettingsModel().delete_entries(uid)
         except Exception:
             log.exception('Failed to delete issue tracker setting %s', uid)
             raise HTTPNotFound()
         h.flash(_('Removed issue tracker entry'), category='success')
         raise HTTPFound(h.route_path('admin_settings_issuetracker'))
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @view_config(
         route_name='admin_settings_email', request_method='GET',
         renderer='rhodecode:templates/admin/settings/settings.mako')
     def settings_email(self):
         c = self.load_default_context()
         c.active = 'email'
         c.rhodecode_ini = rhodecode.CONFIG
 
         data = render('rhodecode:templates/admin/settings/settings.mako',
                       self._get_template_context(c), self.request)
         html = formencode.htmlfill.render(
             data,
             defaults=self._form_defaults(),
             encoding="UTF-8",
             force_defaults=False
         )
         return Response(html)
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @CSRFRequired()
     @view_config(
         route_name='admin_settings_email_update', request_method='POST',
         renderer='rhodecode:templates/admin/settings/settings.mako')
     def settings_email_update(self):
         _ = self.request.translate
         c = self.load_default_context()
         c.active = 'email'
 
         test_email = self.request.POST.get('test_email')
 
         if not test_email:
             h.flash(_('Please enter email address'), category='error')
             raise HTTPFound(h.route_path('admin_settings_email'))
 
         email_kwargs = {
             'date': datetime.datetime.now(),
             'user': c.rhodecode_user,
             'rhodecode_version': c.rhodecode_version
         }
 
         (subject, headers, email_body,
          email_body_plaintext) = EmailNotificationModel().render_email(
             EmailNotificationModel.TYPE_EMAIL_TEST, **email_kwargs)
 
         recipients = [test_email] if test_email else None
 
         run_task(tasks.send_email, recipients, subject,
                  email_body_plaintext, email_body)
 
         h.flash(_('Send email task created'), category='success')
         raise HTTPFound(h.route_path('admin_settings_email'))
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @view_config(
         route_name='admin_settings_hooks', request_method='GET',
         renderer='rhodecode:templates/admin/settings/settings.mako')
     def settings_hooks(self):
         c = self.load_default_context()
         c.active = 'hooks'
 
         model = SettingsModel()
         c.hooks = model.get_builtin_hooks()
         c.custom_hooks = model.get_custom_hooks()
 
         data = render('rhodecode:templates/admin/settings/settings.mako',
                       self._get_template_context(c), self.request)
         html = formencode.htmlfill.render(
             data,
             defaults=self._form_defaults(),
             encoding="UTF-8",
             force_defaults=False
         )
         return Response(html)
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @CSRFRequired()
     @view_config(
         route_name='admin_settings_hooks_update', request_method='POST',
         renderer='rhodecode:templates/admin/settings/settings.mako')
     @view_config(
         route_name='admin_settings_hooks_delete', request_method='POST',
         renderer='rhodecode:templates/admin/settings/settings.mako')
     def settings_hooks_update(self):
         _ = self.request.translate
         c = self.load_default_context()
         c.active = 'hooks'
         if c.visual.allow_custom_hooks_settings:
             ui_key = self.request.POST.get('new_hook_ui_key')
             ui_value = self.request.POST.get('new_hook_ui_value')
 
             hook_id = self.request.POST.get('hook_id')
             new_hook = False
 
             model = SettingsModel()
             try:
                 if ui_value and ui_key:
                     model.create_or_update_hook(ui_key, ui_value)
                     h.flash(_('Added new hook'), category='success')
                     new_hook = True
                 elif hook_id:
                     RhodeCodeUi.delete(hook_id)
                     Session().commit()
 
                 # check for edits
                 update = False
                 _d = self.request.POST.dict_of_lists()
                 for k, v in zip(_d.get('hook_ui_key', []),
                                 _d.get('hook_ui_value_new', [])):
                     model.create_or_update_hook(k, v)
                     update = True
 
                 if update and not new_hook:
                     h.flash(_('Updated hooks'), category='success')
                 Session().commit()
             except Exception:
                 log.exception("Exception during hook creation")
                 h.flash(_('Error occurred during hook creation'),
                         category='error')
 
         raise HTTPFound(h.route_path('admin_settings_hooks'))
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @view_config(
         route_name='admin_settings_search', request_method='GET',
         renderer='rhodecode:templates/admin/settings/settings.mako')
     def settings_search(self):
         c = self.load_default_context()
         c.active = 'search'
 
         searcher = searcher_from_config(self.request.registry.settings)
         c.statistics = searcher.statistics()
 
         return self._get_template_context(c)
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @view_config(
         route_name='admin_settings_labs', request_method='GET',
         renderer='rhodecode:templates/admin/settings/settings.mako')
     def settings_labs(self):
         c = self.load_default_context()
         if not c.labs_active:
             raise HTTPFound(h.route_path('admin_settings'))
 
         c.active = 'labs'
         c.lab_settings = _LAB_SETTINGS
 
         data = render('rhodecode:templates/admin/settings/settings.mako',
                       self._get_template_context(c), self.request)
         html = formencode.htmlfill.render(
             data,
             defaults=self._form_defaults(),
             encoding="UTF-8",
             force_defaults=False
         )
         return Response(html)
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @CSRFRequired()
     @view_config(
         route_name='admin_settings_labs_update', request_method='POST',
         renderer='rhodecode:templates/admin/settings/settings.mako')
     def settings_labs_update(self):
         _ = self.request.translate
         c = self.load_default_context()
         c.active = 'labs'
 
         application_form = LabsSettingsForm()()
         try:
             form_result = application_form.to_python(dict(self.request.POST))
         except formencode.Invalid as errors:
             h.flash(
                 _('Some form inputs contain invalid data.'),
                 category='error')
             data = render('rhodecode:templates/admin/settings/settings.mako',
                           self._get_template_context(c), self.request)
             html = formencode.htmlfill.render(
                 data,
                 defaults=errors.value,
                 errors=errors.error_dict or {},
                 prefix_error=False,
                 encoding="UTF-8",
                 force_defaults=False
             )
             return Response(html)
 
         try:
             session = Session()
             for setting in _LAB_SETTINGS:
                 setting_name = setting.key[len('rhodecode_'):]
                 sett = SettingsModel().create_or_update_setting(
                     setting_name, form_result[setting.key], setting.type)
                 session.add(sett)
 
         except Exception:
             log.exception('Exception while updating lab settings')
             h.flash(_('Error occurred during updating labs settings'),
                     category='error')
         else:
             Session().commit()
             SettingsModel().invalidate_settings_cache()
             h.flash(_('Updated Labs settings'), category='success')
             raise HTTPFound(h.route_path('admin_settings_labs'))
 
         data = render('rhodecode:templates/admin/settings/settings.mako',
                       self._get_template_context(c), self.request)
         html = formencode.htmlfill.render(
             data,
             defaults=self._form_defaults(),
             encoding="UTF-8",
             force_defaults=False
         )
         return Response(html)
 
 
 # :param key: name of the setting including the 'rhodecode_' prefix
 # :param type: the RhodeCodeSetting type to use.
 # :param group: the i18ned group in which we should dispaly this setting
 # :param label: the i18ned label we should display for this setting
 # :param help: the i18ned help we should dispaly for this setting
 LabSetting = collections.namedtuple(
     'LabSetting', ('key', 'type', 'group', 'label', 'help'))
 
 
 # This list has to be kept in sync with the form
 # rhodecode.model.forms.LabsSettingsForm.
 _LAB_SETTINGS = [
 
 ]

rhodecode/apps/repository/tests/test_repo_issue_tracker.py

@@ -1,148 +1,148 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import pytest
 
 from rhodecode.lib.utils2 import md5
 from rhodecode.model.db import Repository
 from rhodecode.model.meta import Session
 from rhodecode.model.settings import SettingsModel, IssueTrackerSettingsModel
 
 
 def route_path(name, params=None, **kwargs):
     import urllib
 
     base_url = {
         'repo_summary': '/{repo_name}',
         'edit_repo_issuetracker': '/{repo_name}/settings/issue_trackers',
         'edit_repo_issuetracker_test': '/{repo_name}/settings/issue_trackers/test',
         'edit_repo_issuetracker_delete': '/{repo_name}/settings/issue_trackers/delete',
         'edit_repo_issuetracker_update': '/{repo_name}/settings/issue_trackers/update',
     }[name].format(**kwargs)
 
     if params:
         base_url = '{}?{}'.format(base_url, urllib.urlencode(params))
     return base_url
 
 
 @pytest.mark.usefixtures("app")
 class TestRepoIssueTracker(object):
     def test_issuetracker_index(self, autologin_user, backend):
         repo = backend.create_repo()
         response = self.app.get(route_path('edit_repo_issuetracker',
                                 repo_name=repo.repo_name))
         assert response.status_code == 200
 
     def test_add_and_test_issuetracker_patterns(
             self, autologin_user, backend, csrf_token, request, xhr_header):
         pattern = 'issuetracker_pat'
         another_pattern = pattern+'1'
         post_url = route_path(
             'edit_repo_issuetracker_update', repo_name=backend.repo.repo_name)
         post_data = {
             'new_pattern_pattern_0': pattern,
-            'new_pattern_url_0': 'url',
+            'new_pattern_url_0': 'http://url',
             'new_pattern_prefix_0': 'prefix',
             'new_pattern_description_0': 'description',
             'new_pattern_pattern_1': another_pattern,
-            'new_pattern_url_1': 'url1',
+            'new_pattern_url_1': '/url1',
             'new_pattern_prefix_1': 'prefix1',
             'new_pattern_description_1': 'description1',
             'csrf_token': csrf_token
         }
         self.app.post(post_url, post_data, status=302)
         self.settings_model = IssueTrackerSettingsModel(repo=backend.repo)
         settings = self.settings_model.get_repo_settings()
         self.uid = md5(pattern)
         assert settings[self.uid]['pat'] == pattern
         self.another_uid = md5(another_pattern)
         assert settings[self.another_uid]['pat'] == another_pattern
 
         # test pattern
         data = {'test_text': 'example of issuetracker_pat replacement',
                 'csrf_token': csrf_token}
         response = self.app.post(
             route_path('edit_repo_issuetracker_test',
                        repo_name=backend.repo.repo_name),
             extra_environ=xhr_header, params=data)
 
         assert response.body == \
-               'example of <a class="issue-tracker-link" href="url">prefix</a> replacement'
+               'example of <a class="issue-tracker-link" href="http://url">prefix</a> replacement'
 
         @request.addfinalizer
         def cleanup():
             self.settings_model.delete_entries(self.uid)
             self.settings_model.delete_entries(self.another_uid)
 
     def test_edit_issuetracker_pattern(
             self, autologin_user, backend, csrf_token, request):
         entry_key = 'issuetracker_pat_'
         pattern = 'issuetracker_pat2'
         old_pattern = 'issuetracker_pat'
         old_uid = md5(old_pattern)
 
         sett = SettingsModel(repo=backend.repo).create_or_update_setting(
             entry_key+old_uid, old_pattern, 'unicode')
         Session().add(sett)
         Session().commit()
         post_url = route_path(
             'edit_repo_issuetracker_update', repo_name=backend.repo.repo_name)
         post_data = {
             'new_pattern_pattern_0': pattern,
-            'new_pattern_url_0': 'url',
+            'new_pattern_url_0': '/url',
             'new_pattern_prefix_0': 'prefix',
             'new_pattern_description_0': 'description',
             'uid': old_uid,
             'csrf_token': csrf_token
         }
         self.app.post(post_url, post_data, status=302)
         self.settings_model = IssueTrackerSettingsModel(repo=backend.repo)
         settings = self.settings_model.get_repo_settings()
         self.uid = md5(pattern)
         assert settings[self.uid]['pat'] == pattern
         with pytest.raises(KeyError):
             key = settings[old_uid]
 
         @request.addfinalizer
         def cleanup():
             self.settings_model.delete_entries(self.uid)
 
     def test_delete_issuetracker_pattern(
             self, autologin_user, backend, csrf_token, settings_util):
         repo = backend.create_repo()
         repo_name = repo.repo_name
         entry_key = 'issuetracker_pat_'
         pattern = 'issuetracker_pat3'
         uid = md5(pattern)
         settings_util.create_repo_rhodecode_setting(
             repo=backend.repo, name=entry_key+uid,
             value=entry_key, type_='unicode', cleanup=False)
 
         self.app.post(
             route_path(
                 'edit_repo_issuetracker_delete',
                 repo_name=backend.repo.repo_name),
             {
                 'uid': uid,
                 'csrf_token': csrf_token
             }, status=302)
         settings = IssueTrackerSettingsModel(
             repo=Repository.get_by_repo_name(repo_name)).get_repo_settings()
         assert 'rhodecode_%s%s' % (entry_key, uid) not in settings

rhodecode/apps/repository/views/repo_settings_issue_trackers.py

@@ -1,126 +1,137 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2017-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import logging
 
 from pyramid.httpexceptions import HTTPFound
 from pyramid.view import view_config
+import formencode
 
 from rhodecode.apps._base import RepoAppView
 from rhodecode.lib import audit_logger
 from rhodecode.lib import helpers as h
 from rhodecode.lib.auth import (
     LoginRequired, HasRepoPermissionAnyDecorator, CSRFRequired)
 from rhodecode.model.forms import IssueTrackerPatternsForm
 from rhodecode.model.meta import Session
 from rhodecode.model.settings import IssueTrackerSettingsModel
 
 log = logging.getLogger(__name__)
 
 
 class RepoSettingsIssueTrackersView(RepoAppView):
     def load_default_context(self):
         c = self._get_local_tmpl_context()
 
         self._register_global_c(c)
         return c
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.admin')
     @view_config(
         route_name='edit_repo_issuetracker', request_method='GET',
         renderer='rhodecode:templates/admin/repos/repo_edit.mako')
     def repo_issuetracker(self):
         c = self.load_default_context()
         c.active = 'issuetracker'
         c.data = 'data'
 
         c.settings_model = IssueTrackerSettingsModel(repo=self.db_repo)
         c.global_patterns = c.settings_model.get_global_settings()
         c.repo_patterns = c.settings_model.get_repo_settings()
 
         return self._get_template_context(c)
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.admin')
     @CSRFRequired()
     @view_config(
         route_name='edit_repo_issuetracker_test', request_method='POST',
         xhr=True, renderer='string')
     def repo_issuetracker_test(self):
         return h.urlify_commit_message(
             self.request.POST.get('test_text', ''),
             self.db_repo_name)
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.admin')
     @CSRFRequired()
     @view_config(
         route_name='edit_repo_issuetracker_delete', request_method='POST',
         renderer='rhodecode:templates/admin/repos/repo_edit.mako')
     def repo_issuetracker_delete(self):
         _ = self.request.translate
         uid = self.request.POST.get('uid')
         repo_settings = IssueTrackerSettingsModel(repo=self.db_repo_name)
         try:
             repo_settings.delete_entries(uid)
         except Exception:
             h.flash(_('Error occurred during deleting issue tracker entry'),
                     category='error')
         else:
             h.flash(_('Removed issue tracker entry'), category='success')
         raise HTTPFound(
             h.route_path('edit_repo_issuetracker', repo_name=self.db_repo_name))
 
     def _update_patterns(self, form, repo_settings):
         for uid in form['delete_patterns']:
             repo_settings.delete_entries(uid)
 
         for pattern_data in form['patterns']:
             for setting_key, pattern, type_ in pattern_data:
                 sett = repo_settings.create_or_update_setting(
                     setting_key, pattern.strip(), type_)
                 Session().add(sett)
 
             Session().commit()
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.admin')
     @CSRFRequired()
     @view_config(
         route_name='edit_repo_issuetracker_update', request_method='POST',
         renderer='rhodecode:templates/admin/repos/repo_edit.mako')
     def repo_issuetracker_update(self):
         _ = self.request.translate
         # Save inheritance
         repo_settings = IssueTrackerSettingsModel(repo=self.db_repo_name)
         inherited = (
             self.request.POST.get('inherit_global_issuetracker') == "inherited")
         repo_settings.inherit_global_settings = inherited
         Session().commit()
 
+        try:
         form = IssueTrackerPatternsForm()().to_python(self.request.POST)
+        except formencode.Invalid as errors:
+            log.exception('Failed to add new pattern')
+            error = errors
+            h.flash(_('Invalid issue tracker pattern: {}'.format(error)),
+                    category='error')
+            raise HTTPFound(
+                h.route_path('edit_repo_issuetracker',
+                             repo_name=self.db_repo_name))
+
         if form:
             self._update_patterns(form, repo_settings)
 
         h.flash(_('Updated issue tracker entries'), category='success')
         raise HTTPFound(
             h.route_path('edit_repo_issuetracker', repo_name=self.db_repo_name))
 

rhodecode/model/validators.py

@@ -1,1122 +1,1132 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 Set of generic validators
 """
 
 import logging
 import os
 import re
 from collections import defaultdict
 
 import formencode
 import ipaddress
 from formencode.validators import (
     UnicodeString, OneOf, Int, Number, Regex, Email, Bool, StringBoolean, Set,
     NotEmpty, IPAddress, CIDR, String, FancyValidator
 )
 from pylons.i18n.translation import _
 from sqlalchemy.sql.expression import true
 from sqlalchemy.util import OrderedSet
 from webhelpers.pylonslib.secure_form import authentication_token
 
 from rhodecode.authentication import (
     legacy_plugin_prefix, _import_legacy_plugin)
 from rhodecode.authentication.base import loadplugin
 from rhodecode.apps._base import ADMIN_PREFIX
 from rhodecode.lib.auth import HasRepoGroupPermissionAny, HasPermissionAny
 from rhodecode.lib.utils import repo_name_slug, make_db_config
 from rhodecode.lib.utils2 import safe_int, str2bool, aslist, md5, safe_unicode
 from rhodecode.lib.vcs.backends.git.repository import GitRepository
 from rhodecode.lib.vcs.backends.hg.repository import MercurialRepository
 from rhodecode.lib.vcs.backends.svn.repository import SubversionRepository
 from rhodecode.model.db import (
     RepoGroup, Repository, UserGroup, User, ChangesetStatus, Gist)
 from rhodecode.model.settings import VcsSettingsModel
 
 # silence warnings and pylint
 UnicodeString, OneOf, Int, Number, Regex, Email, Bool, StringBoolean, Set, \
     NotEmpty, IPAddress, CIDR, String, FancyValidator
 
 log = logging.getLogger(__name__)
 
 
 class _Missing(object):
     pass
 
 Missing = _Missing()
 
 
 class StateObj(object):
     """
     this is needed to translate the messages using _() in validators
     """
     _ = staticmethod(_)
 
 
 def M(self, key, state=None, **kwargs):
     """
     returns string from self.message based on given key,
     passed kw params are used to substitute %(named)s params inside
     translated strings
 
     :param msg:
     :param state:
     """
     if state is None:
         state = StateObj()
     else:
         state._ = staticmethod(_)
     # inject validator into state object
     return self.message(key, state, **kwargs)
 
 
 def UniqueList(convert=None):
     class _UniqueList(formencode.FancyValidator):
         """
         Unique List !
         """
         messages = {
             'empty': _(u'Value cannot be an empty list'),
             'missing_value': _(u'Value cannot be an empty list'),
         }
 
         def _to_python(self, value, state):
             ret_val = []
 
             def make_unique(value):
                 seen = []
                 return [c for c in value if not (c in seen or seen.append(c))]
 
             if isinstance(value, list):
                 ret_val = make_unique(value)
             elif isinstance(value, set):
                 ret_val = make_unique(list(value))
             elif isinstance(value, tuple):
                 ret_val = make_unique(list(value))
             elif value is None:
                 ret_val = []
             else:
                 ret_val = [value]
 
             if convert:
                 ret_val = map(convert, ret_val)
             return ret_val
 
         def empty_value(self, value):
             return []
 
     return _UniqueList
 
 
 def UniqueListFromString():
     class _UniqueListFromString(UniqueList()):
         def _to_python(self, value, state):
             if isinstance(value, basestring):
                 value = aslist(value, ',')
             return super(_UniqueListFromString, self)._to_python(value, state)
     return _UniqueListFromString
 
 
 def ValidSvnPattern(section, repo_name=None):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'pattern_exists': _(u'Pattern already exists'),
         }
 
         def validate_python(self, value, state):
             if not value:
                 return
             model = VcsSettingsModel(repo=repo_name)
             ui_settings = model.get_svn_patterns(section=section)
             for entry in ui_settings:
                 if value == entry.value:
                     msg = M(self, 'pattern_exists', state)
                     raise formencode.Invalid(msg, value, state)
     return _validator
 
 
 def ValidUsername(edit=False, old_data={}):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'username_exists': _(u'Username "%(username)s" already exists'),
             'system_invalid_username':
                 _(u'Username "%(username)s" is forbidden'),
             'invalid_username':
                 _(u'Username may only contain alphanumeric characters '
                     u'underscores, periods or dashes and must begin with '
                     u'alphanumeric character or underscore')
         }
 
         def validate_python(self, value, state):
             if value in ['default', 'new_user']:
                 msg = M(self, 'system_invalid_username', state, username=value)
                 raise formencode.Invalid(msg, value, state)
             # check if user is unique
             old_un = None
             if edit:
                 old_un = User.get(old_data.get('user_id')).username
 
             if old_un != value or not edit:
                 if User.get_by_username(value, case_insensitive=True):
                     msg = M(self, 'username_exists', state, username=value)
                     raise formencode.Invalid(msg, value, state)
 
             if (re.match(r'^[\w]{1}[\w\-\.]{0,254}$', value)
                     is None):
                 msg = M(self, 'invalid_username', state)
                 raise formencode.Invalid(msg, value, state)
     return _validator
 
 
 def ValidRegex(msg=None):
     class _validator(formencode.validators.Regex):
         messages = {'invalid': msg or _(u'The input is not valid')}
     return _validator
 
 
 def ValidRepoUser(allow_disabled=False):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_username': _(u'Username %(username)s is not valid'),
             'disabled_username': _(u'Username %(username)s is disabled')
         }
 
         def validate_python(self, value, state):
             try:
                 user = User.query().filter(User.username == value).one()
             except Exception:
                 msg = M(self, 'invalid_username', state, username=value)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'username': msg}
                 )
             if user and (not allow_disabled and not user.active):
                 msg = M(self, 'disabled_username', state, username=value)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'username': msg}
                 )
 
     return _validator
 
 
 def ValidUserGroup(edit=False, old_data={}):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_group': _(u'Invalid user group name'),
             'group_exist': _(u'User group `%(usergroup)s` already exists'),
             'invalid_usergroup_name':
                 _(u'user group name may only contain alphanumeric '
                   u'characters underscores, periods or dashes and must begin '
                   u'with alphanumeric character')
         }
 
         def validate_python(self, value, state):
             if value in ['default']:
                 msg = M(self, 'invalid_group', state)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'users_group_name': msg}
                 )
             # check if group is unique
             old_ugname = None
             if edit:
                 old_id = old_data.get('users_group_id')
                 old_ugname = UserGroup.get(old_id).users_group_name
 
             if old_ugname != value or not edit:
                 is_existing_group = UserGroup.get_by_group_name(
                     value, case_insensitive=True)
                 if is_existing_group:
                     msg = M(self, 'group_exist', state, usergroup=value)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'users_group_name': msg}
                     )
 
             if re.match(r'^[a-zA-Z0-9]{1}[a-zA-Z0-9\-\_\.]+$', value) is None:
                 msg = M(self, 'invalid_usergroup_name', state)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'users_group_name': msg}
                 )
 
     return _validator
 
 
 def ValidRepoGroup(edit=False, old_data={}, can_create_in_root=False):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'group_parent_id': _(u'Cannot assign this group as parent'),
             'group_exists': _(u'Group "%(group_name)s" already exists'),
             'repo_exists': _(u'Repository with name "%(group_name)s" '
                              u'already exists'),
             'permission_denied': _(u"no permission to store repository group"
                                    u"in this location"),
             'permission_denied_root': _(
                 u"no permission to store repository group "
                 u"in root location")
         }
 
         def _to_python(self, value, state):
             group_name = repo_name_slug(value.get('group_name', ''))
             group_parent_id = safe_int(value.get('group_parent_id'))
             gr = RepoGroup.get(group_parent_id)
             if gr:
                 parent_group_path = gr.full_path
                 # value needs to be aware of group name in order to check
                 # db key This is an actual just the name to store in the
                 # database
                 group_name_full = (
                     parent_group_path + RepoGroup.url_sep() + group_name)
             else:
                 group_name_full = group_name
 
             value['group_name'] = group_name
             value['group_name_full'] = group_name_full
             value['group_parent_id'] = group_parent_id
             return value
 
         def validate_python(self, value, state):
 
             old_group_name = None
             group_name = value.get('group_name')
             group_name_full = value.get('group_name_full')
             group_parent_id = safe_int(value.get('group_parent_id'))
             if group_parent_id == -1:
                 group_parent_id = None
 
             group_obj = RepoGroup.get(old_data.get('group_id'))
             parent_group_changed = False
             if edit:
                 old_group_name = group_obj.group_name
                 old_group_parent_id = group_obj.group_parent_id
 
                 if group_parent_id != old_group_parent_id:
                     parent_group_changed = True
 
                 # TODO: mikhail: the following if statement is not reached
                 # since group_parent_id's OneOf validation fails before.
                 # Can be removed.
 
                 # check against setting a parent of self
                 parent_of_self = (
                     old_data['group_id'] == group_parent_id
                     if group_parent_id else False
                 )
                 if parent_of_self:
                     msg = M(self, 'group_parent_id', state)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'group_parent_id': msg}
                     )
 
             # group we're moving current group inside
             child_group = None
             if group_parent_id:
                 child_group = RepoGroup.query().filter(
                     RepoGroup.group_id == group_parent_id).scalar()
 
             # do a special check that we cannot move a group to one of
             # it's children
             if edit and child_group:
                 parents = [x.group_id for x in child_group.parents]
                 move_to_children = old_data['group_id'] in parents
                 if move_to_children:
                     msg = M(self, 'group_parent_id', state)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'group_parent_id': msg})
 
             # Check if we have permission to store in the parent.
             # Only check if the parent group changed.
             if parent_group_changed:
                 if child_group is None:
                     if not can_create_in_root:
                         msg = M(self, 'permission_denied_root', state)
                         raise formencode.Invalid(
                             msg, value, state,
                             error_dict={'group_parent_id': msg})
                 else:
                     valid = HasRepoGroupPermissionAny('group.admin')
                     forbidden = not valid(
                         child_group.group_name, 'can create group validator')
                     if forbidden:
                         msg = M(self, 'permission_denied', state)
                         raise formencode.Invalid(
                             msg, value, state,
                             error_dict={'group_parent_id': msg})
 
             # if we change the name or it's new group, check for existing names
             # or repositories with the same name
             if old_group_name != group_name_full or not edit:
                 # check group
                 gr = RepoGroup.get_by_group_name(group_name_full)
                 if gr:
                     msg = M(self, 'group_exists', state, group_name=group_name)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'group_name': msg})
 
                 # check for same repo
                 repo = Repository.get_by_repo_name(group_name_full)
                 if repo:
                     msg = M(self, 'repo_exists', state, group_name=group_name)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'group_name': msg})
 
     return _validator
 
 
 def ValidPassword():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_password':
                 _(u'Invalid characters (non-ascii) in password')
         }
 
         def validate_python(self, value, state):
             try:
                 (value or '').decode('ascii')
             except UnicodeError:
                 msg = M(self, 'invalid_password', state)
                 raise formencode.Invalid(msg, value, state,)
     return _validator
 
 
 def ValidOldPassword(username):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_password': _(u'Invalid old password')
         }
 
         def validate_python(self, value, state):
             from rhodecode.authentication.base import authenticate, HTTP_TYPE
             if not authenticate(username, value, '', HTTP_TYPE):
                 msg = M(self, 'invalid_password', state)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'current_password': msg}
                 )
     return _validator
 
 
 def ValidPasswordsMatch(
         passwd='new_password', passwd_confirmation='password_confirmation'):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'password_mismatch': _(u'Passwords do not match'),
         }
 
         def validate_python(self, value, state):
 
             pass_val = value.get('password') or value.get(passwd)
             if pass_val != value[passwd_confirmation]:
                 msg = M(self, 'password_mismatch', state)
                 raise formencode.Invalid(
                     msg, value, state,
                     error_dict={passwd: msg, passwd_confirmation: msg}
                 )
     return _validator
 
 
 def ValidAuth():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_password': _(u'invalid password'),
             'invalid_username': _(u'invalid user name'),
             'disabled_account': _(u'Your account is disabled')
         }
 
         def validate_python(self, value, state):
             from rhodecode.authentication.base import authenticate, HTTP_TYPE
 
             password = value['password']
             username = value['username']
 
             if not authenticate(username, password, '', HTTP_TYPE,
                                 skip_missing=True):
                 user = User.get_by_username(username)
                 if user and not user.active:
                     log.warning('user %s is disabled', username)
                     msg = M(self, 'disabled_account', state)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'username': msg}
                     )
                 else:
                     log.warning('user `%s` failed to authenticate', username)
                     msg = M(self, 'invalid_username', state)
                     msg2 = M(self, 'invalid_password', state)
                     raise formencode.Invalid(
                         msg, value, state,
                         error_dict={'username': msg, 'password': msg2}
                     )
     return _validator
 
 
 def ValidAuthToken():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_token': _(u'Token mismatch')
         }
 
         def validate_python(self, value, state):
             if value != authentication_token():
                 msg = M(self, 'invalid_token', state)
                 raise formencode.Invalid(msg, value, state)
     return _validator
 
 
 def ValidRepoName(edit=False, old_data={}):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_repo_name':
                 _(u'Repository name %(repo)s is disallowed'),
             # top level
             'repository_exists': _(u'Repository with name %(repo)s '
                                    u'already exists'),
             'group_exists': _(u'Repository group with name "%(repo)s" '
                               u'already exists'),
             # inside a group
             'repository_in_group_exists': _(u'Repository with name %(repo)s '
                                             u'exists in group "%(group)s"'),
             'group_in_group_exists': _(
                 u'Repository group with name "%(repo)s" '
                 u'exists in group "%(group)s"'),
         }
 
         def _to_python(self, value, state):
             repo_name = repo_name_slug(value.get('repo_name', ''))
             repo_group = value.get('repo_group')
             if repo_group:
                 gr = RepoGroup.get(repo_group)
                 group_path = gr.full_path
                 group_name = gr.group_name
                 # value needs to be aware of group name in order to check
                 # db key This is an actual just the name to store in the
                 # database
                 repo_name_full = group_path + RepoGroup.url_sep() + repo_name
             else:
                 group_name = group_path = ''
                 repo_name_full = repo_name
 
             value['repo_name'] = repo_name
             value['repo_name_full'] = repo_name_full
             value['group_path'] = group_path
             value['group_name'] = group_name
             return value
 
         def validate_python(self, value, state):
 
             repo_name = value.get('repo_name')
             repo_name_full = value.get('repo_name_full')
             group_path = value.get('group_path')
             group_name = value.get('group_name')
 
             if repo_name in [ADMIN_PREFIX, '']:
                 msg = M(self, 'invalid_repo_name', state, repo=repo_name)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'repo_name': msg})
 
             rename = old_data.get('repo_name') != repo_name_full
             create = not edit
             if rename or create:
 
                 if group_path:
                     if Repository.get_by_repo_name(repo_name_full):
                         msg = M(self, 'repository_in_group_exists', state,
                                 repo=repo_name, group=group_name)
                         raise formencode.Invalid(
                             msg, value, state, error_dict={'repo_name': msg})
                     if RepoGroup.get_by_group_name(repo_name_full):
                         msg = M(self, 'group_in_group_exists', state,
                                 repo=repo_name, group=group_name)
                         raise formencode.Invalid(
                             msg, value, state, error_dict={'repo_name': msg})
                 else:
                     if RepoGroup.get_by_group_name(repo_name_full):
                         msg = M(self, 'group_exists', state, repo=repo_name)
                         raise formencode.Invalid(
                             msg, value, state, error_dict={'repo_name': msg})
 
                     if Repository.get_by_repo_name(repo_name_full):
                         msg = M(
                             self, 'repository_exists', state, repo=repo_name)
                         raise formencode.Invalid(
                             msg, value, state, error_dict={'repo_name': msg})
             return value
     return _validator
 
 
 def ValidForkName(*args, **kwargs):
     return ValidRepoName(*args, **kwargs)
 
 
 def SlugifyName():
     class _validator(formencode.validators.FancyValidator):
 
         def _to_python(self, value, state):
             return repo_name_slug(value)
 
         def validate_python(self, value, state):
             pass
 
     return _validator
 
 
 def CannotHaveGitSuffix():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'has_git_suffix':
                 _(u'Repository name cannot end with .git'),
         }
 
         def _to_python(self, value, state):
             return value
 
         def validate_python(self, value, state):
             if value and value.endswith('.git'):
                 msg = M(
                     self, 'has_git_suffix', state)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'repo_name': msg})
 
     return _validator
 
 
 def ValidCloneUri():
     class InvalidCloneUrl(Exception):
         allowed_prefixes = ()
 
     def url_handler(repo_type, url):
         config = make_db_config(clear_session=False)
         if repo_type == 'hg':
             allowed_prefixes = ('http', 'svn+http', 'git+http')
 
             if 'http' in url[:4]:
                 # initially check if it's at least the proper URL
                 # or does it pass basic auth
                 MercurialRepository.check_url(url, config)
             elif 'svn+http' in url[:8]:  # svn->hg import
                 SubversionRepository.check_url(url, config)
             elif 'git+http' in url[:8]:  # git->hg import
                 raise NotImplementedError()
             else:
                 exc = InvalidCloneUrl('Clone from URI %s not allowed. '
                                       'Allowed url must start with one of %s'
                                       % (url, ','.join(allowed_prefixes)))
                 exc.allowed_prefixes = allowed_prefixes
                 raise exc
 
         elif repo_type == 'git':
             allowed_prefixes = ('http', 'svn+http', 'hg+http')
             if 'http' in url[:4]:
                 # initially check if it's at least the proper URL
                 # or does it pass basic auth
                 GitRepository.check_url(url, config)
             elif 'svn+http' in url[:8]:  # svn->git import
                 raise NotImplementedError()
             elif 'hg+http' in url[:8]:  # hg->git import
                 raise NotImplementedError()
             else:
                 exc = InvalidCloneUrl('Clone from URI %s not allowed. '
                                       'Allowed url must start with one of %s'
                                       % (url, ','.join(allowed_prefixes)))
                 exc.allowed_prefixes = allowed_prefixes
                 raise exc
 
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'clone_uri': _(u'invalid clone url for %(rtype)s repository'),
             'invalid_clone_uri': _(
                 u'Invalid clone url, provide a valid clone '
                 u'url starting with one of %(allowed_prefixes)s')
         }
 
         def validate_python(self, value, state):
             repo_type = value.get('repo_type')
             url = value.get('clone_uri')
 
             if url:
                 try:
                     url_handler(repo_type, url)
                 except InvalidCloneUrl as e:
                     log.warning(e)
                     msg = M(self, 'invalid_clone_uri', rtype=repo_type,
                             allowed_prefixes=','.join(e.allowed_prefixes))
                     raise formencode.Invalid(msg, value, state,
                                              error_dict={'clone_uri': msg})
                 except Exception:
                     log.exception('Url validation failed')
                     msg = M(self, 'clone_uri', rtype=repo_type)
                     raise formencode.Invalid(msg, value, state,
                                              error_dict={'clone_uri': msg})
     return _validator
 
 
 def ValidForkType(old_data={}):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_fork_type': _(u'Fork have to be the same type as parent')
         }
 
         def validate_python(self, value, state):
             if old_data['repo_type'] != value:
                 msg = M(self, 'invalid_fork_type', state)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'repo_type': msg}
                 )
     return _validator
 
 
 def CanWriteGroup(old_data=None):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'permission_denied': _(
                 u"You do not have the permission "
                 u"to create repositories in this group."),
             'permission_denied_root': _(
                 u"You do not have the permission to store repositories in "
                 u"the root location.")
         }
 
         def _to_python(self, value, state):
             # root location
             if value in [-1, "-1"]:
                 return None
             return value
 
         def validate_python(self, value, state):
             gr = RepoGroup.get(value)
             gr_name = gr.group_name if gr else None  # None means ROOT location
             # create repositories with write permission on group is set to true
             create_on_write = HasPermissionAny(
                 'hg.create.write_on_repogroup.true')()
             group_admin = HasRepoGroupPermissionAny('group.admin')(
                 gr_name, 'can write into group validator')
             group_write = HasRepoGroupPermissionAny('group.write')(
                 gr_name, 'can write into group validator')
             forbidden = not (group_admin or (group_write and create_on_write))
             can_create_repos = HasPermissionAny(
                 'hg.admin', 'hg.create.repository')
             gid = (old_data['repo_group'].get('group_id')
                    if (old_data and 'repo_group' in old_data) else None)
             value_changed = gid != safe_int(value)
             new = not old_data
             # do check if we changed the value, there's a case that someone got
             # revoked write permissions to a repository, he still created, we
             # don't need to check permission if he didn't change the value of
             # groups in form box
             if value_changed or new:
                 # parent group need to be existing
                 if gr and forbidden:
                     msg = M(self, 'permission_denied', state)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'repo_type': msg}
                     )
                 # check if we can write to root location !
                 elif gr is None and not can_create_repos():
                     msg = M(self, 'permission_denied_root', state)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'repo_type': msg}
                     )
 
     return _validator
 
 
 def ValidPerms(type_='repo'):
     if type_ == 'repo_group':
         EMPTY_PERM = 'group.none'
     elif type_ == 'repo':
         EMPTY_PERM = 'repository.none'
     elif type_ == 'user_group':
         EMPTY_PERM = 'usergroup.none'
 
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'perm_new_member_name':
                 _(u'This username or user group name is not valid')
         }
 
         def _to_python(self, value, state):
             perm_updates = OrderedSet()
             perm_additions = OrderedSet()
             perm_deletions = OrderedSet()
             # build a list of permission to update/delete and new permission
 
             # Read the perm_new_member/perm_del_member attributes and group
             # them by they IDs
             new_perms_group = defaultdict(dict)
             del_perms_group = defaultdict(dict)
             for k, v in value.copy().iteritems():
                 if k.startswith('perm_del_member'):
                     # delete from org storage so we don't process that later
                     del value[k]
                     # part is `id`, `type`
                     _type, part = k.split('perm_del_member_')
                     args = part.split('_')
                     if len(args) == 2:
                         _key, pos = args
                         del_perms_group[pos][_key] = v
                 if k.startswith('perm_new_member'):
                     # delete from org storage so we don't process that later
                     del value[k]
                     # part is `id`, `type`, `perm`
                     _type, part = k.split('perm_new_member_')
                     args = part.split('_')
                     if len(args) == 2:
                         _key, pos = args
                         new_perms_group[pos][_key] = v
 
             # store the deletes
             for k in sorted(del_perms_group.keys()):
                 perm_dict = del_perms_group[k]
                 del_member = perm_dict.get('id')
                 del_type = perm_dict.get('type')
                 if del_member and del_type:
                     perm_deletions.add(
                         (del_member, None, del_type))
 
             # store additions in order of how they were added in web form
             for k in sorted(new_perms_group.keys()):
                 perm_dict = new_perms_group[k]
                 new_member = perm_dict.get('id')
                 new_type = perm_dict.get('type')
                 new_perm = perm_dict.get('perm')
                 if new_member and new_perm and new_type:
                     perm_additions.add(
                         (new_member, new_perm, new_type))
 
             # get updates of permissions
             # (read the existing radio button states)
             default_user_id = User.get_default_user().user_id
             for k, update_value in value.iteritems():
                 if k.startswith('u_perm_') or k.startswith('g_perm_'):
                     member = k[7:]
                     update_type = {'u': 'user',
                                    'g': 'users_group'}[k[0]]
 
                     if safe_int(member) == default_user_id:
                         if str2bool(value.get('repo_private')):
                             # prevent from updating default user permissions
                             # when this repository is marked as private
                             update_value = EMPTY_PERM
 
                     perm_updates.add(
                         (member, update_value, update_type))
 
             value['perm_additions'] = []  # propagated later
             value['perm_updates'] = list(perm_updates)
             value['perm_deletions'] = list(perm_deletions)
 
             updates_map = dict(
                 (x[0], (x[1], x[2])) for x in value['perm_updates'])
             # make sure Additions don't override updates.
             for member_id, perm, member_type in list(perm_additions):
                 if member_id in updates_map:
                     perm = updates_map[member_id][0]
                 value['perm_additions'].append((member_id, perm, member_type))
 
                 # on new entries validate users they exist and they are active !
                 # this leaves feedback to the form
                 try:
                     if member_type == 'user':
                         User.query()\
                             .filter(User.active == true())\
                             .filter(User.user_id == member_id).one()
                     if member_type == 'users_group':
                         UserGroup.query()\
                             .filter(UserGroup.users_group_active == true())\
                             .filter(UserGroup.users_group_id == member_id)\
                             .one()
 
                 except Exception:
                     log.exception('Updated permission failed: org_exc:')
                     msg = M(self, 'perm_new_member_type', state)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={
                             'perm_new_member_name': msg}
                     )
             return value
     return _validator
 
 
 def ValidSettings():
     class _validator(formencode.validators.FancyValidator):
         def _to_python(self, value, state):
             # settings  form for users that are not admin
             # can't edit certain parameters, it's extra backup if they mangle
             # with forms
 
             forbidden_params = [
                 'user', 'repo_type', 'repo_enable_locking',
                 'repo_enable_downloads', 'repo_enable_statistics'
             ]
 
             for param in forbidden_params:
                 if param in value:
                     del value[param]
             return value
 
         def validate_python(self, value, state):
             pass
     return _validator
 
 
 def ValidPath():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_path': _(u'This is not a valid path')
         }
 
         def validate_python(self, value, state):
             if not os.path.isdir(value):
                 msg = M(self, 'invalid_path', state)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'paths_root_path': msg}
                 )
     return _validator
 
 
 def UniqSystemEmail(old_data={}):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'email_taken': _(u'This e-mail address is already taken')
         }
 
         def _to_python(self, value, state):
             return value.lower()
 
         def validate_python(self, value, state):
             if (old_data.get('email') or '').lower() != value:
                 user = User.get_by_email(value, case_insensitive=True)
                 if user:
                     msg = M(self, 'email_taken', state)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'email': msg}
                     )
     return _validator
 
 
 def ValidSystemEmail():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'non_existing_email': _(u'e-mail "%(email)s" does not exist.')
         }
 
         def _to_python(self, value, state):
             return value.lower()
 
         def validate_python(self, value, state):
             user = User.get_by_email(value, case_insensitive=True)
             if user is None:
                 msg = M(self, 'non_existing_email', state, email=value)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'email': msg}
                 )
 
     return _validator
 
 
 def NotReviewedRevisions(repo_id):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'rev_already_reviewed':
                 _(u'Revisions %(revs)s are already part of pull request '
                   u'or have set status'),
         }
 
         def validate_python(self, value, state):
             # check revisions if they are not reviewed, or a part of another
             # pull request
             statuses = ChangesetStatus.query()\
                 .filter(ChangesetStatus.revision.in_(value))\
                 .filter(ChangesetStatus.repo_id == repo_id)\
                 .all()
 
             errors = []
             for status in statuses:
                 if status.pull_request_id:
                     errors.append(['pull_req', status.revision[:12]])
                 elif status.status:
                     errors.append(['status', status.revision[:12]])
 
             if errors:
                 revs = ','.join([x[1] for x in errors])
                 msg = M(self, 'rev_already_reviewed', state, revs=revs)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'revisions': revs})
 
     return _validator
 
 
 def ValidIp():
     class _validator(CIDR):
         messages = {
             'badFormat': _(u'Please enter a valid IPv4 or IpV6 address'),
             'illegalBits': _(
                 u'The network size (bits) must be within the range '
                 u'of 0-32 (not %(bits)r)'),
         }
 
         # we ovveride the default to_python() call
         def to_python(self, value, state):
             v = super(_validator, self).to_python(value, state)
             v = safe_unicode(v.strip())
             net = ipaddress.ip_network(address=v, strict=False)
             return str(net)
 
         def validate_python(self, value, state):
             try:
                 addr = safe_unicode(value.strip())
                 # this raises an ValueError if address is not IpV4 or IpV6
                 ipaddress.ip_network(addr, strict=False)
             except ValueError:
                 raise formencode.Invalid(self.message('badFormat', state),
                                          value, state)
 
     return _validator
 
 
 def FieldKey():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'badFormat': _(
                 u'Key name can only consist of letters, '
                 u'underscore, dash or numbers'),
         }
 
         def validate_python(self, value, state):
             if not re.match('[a-zA-Z0-9_-]+$', value):
                 raise formencode.Invalid(self.message('badFormat', state),
                                          value, state)
     return _validator
 
 
 def ValidAuthPlugins():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'import_duplicate': _(
                 u'Plugins %(loaded)s and %(next_to_load)s '
                 u'both export the same name'),
             'missing_includeme': _(
                 u'The plugin "%(plugin_id)s" is missing an includeme '
                 u'function.'),
             'import_error': _(
                 u'Can not load plugin "%(plugin_id)s"'),
             'no_plugin': _(
                 u'No plugin available with ID "%(plugin_id)s"'),
         }
 
         def _to_python(self, value, state):
             # filter empty values
             return filter(lambda s: s not in [None, ''], value)
 
         def _validate_legacy_plugin_id(self, plugin_id, value, state):
             """
             Validates that the plugin import works. It also checks that the
             plugin has an includeme attribute.
             """
             try:
                 plugin = _import_legacy_plugin(plugin_id)
             except Exception as e:
                 log.exception(
                     'Exception during import of auth legacy plugin "{}"'
                     .format(plugin_id))
                 msg = M(self, 'import_error', plugin_id=plugin_id)
                 raise formencode.Invalid(msg, value, state)
 
             if not hasattr(plugin, 'includeme'):
                 msg = M(self, 'missing_includeme', plugin_id=plugin_id)
                 raise formencode.Invalid(msg, value, state)
 
             return plugin
 
         def _validate_plugin_id(self, plugin_id, value, state):
             """
             Plugins are already imported during app start up. Therefore this
             validation only retrieves the plugin from the plugin registry and
             if it returns something not None everything is OK.
             """
             plugin = loadplugin(plugin_id)
 
             if plugin is None:
                 msg = M(self, 'no_plugin', plugin_id=plugin_id)
                 raise formencode.Invalid(msg, value, state)
 
             return plugin
 
         def validate_python(self, value, state):
             unique_names = {}
             for plugin_id in value:
 
                 # Validate legacy or normal plugin.
                 if plugin_id.startswith(legacy_plugin_prefix):
                     plugin = self._validate_legacy_plugin_id(
                         plugin_id, value, state)
                 else:
                     plugin = self._validate_plugin_id(plugin_id, value, state)
 
                 # Only allow unique plugin names.
                 if plugin.name in unique_names:
                     msg = M(self, 'import_duplicate', state,
                             loaded=unique_names[plugin.name],
                             next_to_load=plugin)
                     raise formencode.Invalid(msg, value, state)
                 unique_names[plugin.name] = plugin
 
     return _validator
 
 
 def ValidPattern():
 
     class _Validator(formencode.validators.FancyValidator):
+        messages = {
+            'bad_format': _(u'Url must start with http or /'),
+        }
 
         def _to_python(self, value, state):
             patterns = []
 
             prefix = 'new_pattern'
             for name, v in value.iteritems():
                 pattern_name = '_'.join((prefix, 'pattern'))
                 if name.startswith(pattern_name):
                     new_item_id = name[len(pattern_name)+1:]
 
                     def _field(name):
                         return '%s_%s_%s' % (prefix, name, new_item_id)
 
                     values = {
                         'issuetracker_pat': value.get(_field('pattern')),
-                        'issuetracker_pat': value.get(_field('pattern')),
                         'issuetracker_url': value.get(_field('url')),
                         'issuetracker_pref': value.get(_field('prefix')),
                         'issuetracker_desc': value.get(_field('description'))
                     }
                     new_uid = md5(values['issuetracker_pat'])
 
                     has_required_fields = (
                         values['issuetracker_pat']
                         and values['issuetracker_url'])
 
                     if has_required_fields:
+                        # validate url that it starts with http or /
+                        # otherwise it can lead to JS injections
+                        # e.g specifig javascript:<malicios code>
+                        if not values['issuetracker_url'].startswith(('http', '/')):
+                            raise formencode.Invalid(
+                                self.message('bad_format', state),
+                                value, state)
+
                         settings = [
                             ('_'.join((key, new_uid)), values[key], 'unicode')
                             for key in values]
                         patterns.append(settings)
 
             value['patterns'] = patterns
             delete_patterns = value.get('uid') or []
             if not isinstance(delete_patterns, (list, tuple)):
                 delete_patterns = [delete_patterns]
             value['delete_patterns'] = delete_patterns
             return value
     return _Validator