release: merge back stable branch into default

docs/release-notes/release-notes-4.9.0.rst

@@ -0,0 +1,66 b''
+|RCE| 4.9.0 |RNS|
+-----------------
+
+Release Date
+^^^^^^^^^^^^
+
+- 2017-08-12
+
+
+New Features
+^^^^^^^^^^^^
+
+
+
+General
+^^^^^^^
+
+- Off cycle Minor release to fix SCM vulnerabilities.
+
+
+Security
+^^^^^^^^
+
+- security(critical): Bumped GIT to 2.9.5 fixes CVE-2017-1000117
+  https://www.mail-archive.com/[e-mail]/msg1466490.html
+- security(critical): Bumped SVN to 1.9.7 fixes CVE-2017-9800
+  https://subversion.apache.org/security/CVE-2017-9800-advisory.txt
+- security(critical): Bumped Mercurial to 4.2.3 fixes  CVE-2017-1000116
+  https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.282017-08-10.29
+
+
+Performance
+^^^^^^^^^^^
+
+- Fixed Mercurial Stream support for very large repositories. Due to discovered
+  bug in WebOb library we manage to fix Mercurial stream support.
+  Now cloning very large repos e.g 100GB, ~1mln commits should be much
+  faster, and use less memory.
+
+
+Fixes
+^^^^^
+
+- Fixed problem with default-reviewers in EE package that was missing panel
+  title and in some occasions generate 500 errors.
+- Fixed problem with potential URL generation inside our integration.
+  This was introduced during pyramid porting. We know ensure that proper
+  routing generation is done on all events.
+
+
+Upgrade notes
+^^^^^^^^^^^^^
+
+
+- The 4.9.0 release is an off-cycle release. Due to the fact that we needed to
+  bump Mercurial from 4.1.X to 4.2.X, and Subversion from 1.9.4 to 1.9.7, we
+  released this version not as 4.8.1 security bug fix but 4.9.0.
+  We know historically that SVN and Mercurial can have internal api changes.
+  We tested basic functionality for all 3 vcs-es but due to very short release
+  time we were unable to test everything. Please report any found problems to us
+  and we'll for sure address them.
+
+  Note to SVN users: Please make sure to upgrade mod_dav to 1.9.7 version.
+  At this time we know Wandisco provides 1.9.7 packages for most major distros.
+
+

.hgtags

@@ -1,21 +1,22 b''
 1bd3e92b7e2e2d2024152b34bb88dff1db544a71 v4.0.0
 170c5398320ea6cddd50955e88d408794c21d43a v4.0.1
 c3fe200198f5aa34cf2e4066df2881a9cefe3704 v4.1.0
 7fd5c850745e2ea821fb4406af5f4bff9b0a7526 v4.1.1
 41c87da28a179953df86061d817bc35533c66dd2 v4.1.2
 baaf9f5bcea3bae0ef12ae20c8b270482e62abb6 v4.2.0
 32a70c7e56844a825f61df496ee5eaf8c3c4e189 v4.2.1
 fa695cdb411d294679ac081d595ac654e5613b03 v4.3.0
 0e4dc11b58cad833c513fe17bac39e6850edf959 v4.3.1
 8a876f48f5cb1d018b837db28ff928500cb32cfb v4.4.0
 8dd86b410b1aac086ffdfc524ef300f896af5047 v4.4.1
 d2514226abc8d3b4f6fb57765f47d1b6fb360a05 v4.4.2
 27d783325930af6dad2741476c0d0b1b7c8415c2 v4.5.0
 7f2016f352abcbdba4a19d4039c386e9629449da v4.5.1
 416fec799314c70a5c780fb28b3357b08869333a v4.5.2
 27c3b85fafc83143e6678fbc3da69e1615bcac55 v4.6.0
 5ad13deb9118c2a5243d4032d4d9cc174e5872db v4.6.1
 2be921e01fa24bb102696ada596f87464c3666f6 v4.7.0
 7198bdec29c2872c974431d55200d0398354cdb1 v4.7.1
 bd1c8d230fe741c2dfd7100a0ef39fd0774fd581 v4.7.2
 9731914f89765d9628dc4dddc84bc9402aa124c8 v4.8.0
+c5a2b7d0e4bbdebc4a62d7b624befe375207b659 v4.9.0

docs/admin/svn-http.rst

@@ -1,150 +1,167 b''
 .. _svn-http:
 
 |svn| With Write Over HTTP
 ^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 To use |svn| with read/write support over the |svn| HTTP protocol, you have to
 configure the HTTP |svn| backend.
 
 Prerequisites
 =============
 
 - Enable HTTP support inside the admin VCS settings on your |RCE| instance
 - You need to install the following tools on the machine that is running an
   instance of |RCE|:
   ``Apache HTTP Server`` and ``mod_dav_svn``.
 
 
-Using Ubuntu 14.04 Distribution as an example execute the following:
+.. tip::
+
+   We recommend using Wandisco repositories which provide latest SVN versions
+   for most platforms. Below is example how to add the wandisco repositories
+   for Ubuntu.
+
+    .. code-block:: bash
+
+        $ sudo sh -c 'echo "deb http://opensource.wandisco.com/ubuntu `lsb_release -cs` svn19" >> /etc/apt/sources.list.d/subversion19.list'
+        $ sudo wget -q http://opensource.wandisco.com/wandisco-debian.gpg -O- | sudo apt-key add -
+        $ sudo apt-get update
+
+
+Using Ubuntu 14.04/16.04 Distribution as an example execute the following to
+install required components:
 
 .. code-block:: bash
 
     $ sudo apt-get install apache2 libapache2-mod-svn
 
 Once installed you need to enable ``dav_svn``:
 
 .. code-block:: bash
 
     $ sudo a2enmod dav_svn
     $ sudo a2enmod headers
     $ sudo a2enmod authn_anon
 
 
 Configuring Apache Setup
 ========================
 
 .. tip::
 
    It is recommended to run Apache on a port other than 80, due to possible
    conflicts with other HTTP servers like nginx. To do this, set the
    ``Listen`` parameter in the ``/etc/apache2/ports.conf`` file, for example
    ``Listen 8090``.
 
 
 .. warning::
 
    Make sure your Apache instance which runs the mod_dav_svn module is
    only accessible by |RCE|. Otherwise everyone is able to browse
    the repositories or run subversion operations (checkout/commit/etc.).
 
 It is also recommended to run apache as the same user as |RCE|, otherwise
 permission issues could occur. To do this edit the ``/etc/apache2/envvars``
 
    .. code-block:: apache
 
       export APACHE_RUN_USER=rhodecode
       export APACHE_RUN_GROUP=rhodecode
 
 1. To configure Apache, create and edit a virtual hosts file, for example
    :file:`/etc/apache2/sites-enabled/default.conf`. Below is an example
    how to use one with auto-generated config ```mod_dav_svn.conf```
    from configured |RCE| instance.
 
 .. code-block:: apache
 
     <VirtualHost *:8090>
         ServerAdmin rhodecode-admin@localhost
         DocumentRoot /var/www/html
         ErrorLog ${'${APACHE_LOG_DIR}'}/error.log
         CustomLog ${'${APACHE_LOG_DIR}'}/access.log combined
+        LogLevel info
+        # allows custom host names, prevents 400 errors on checkout
+        HttpProtocolOptions Unsafe
         Include /home/user/.rccontrol/enterprise-1/mod_dav_svn.conf
     </VirtualHost>
 
 
 2. Go to the :menuselection:`Admin --> Settings --> VCS` page, and
    enable :guilabel:`Proxy Subversion HTTP requests`, and specify the
    :guilabel:`Subversion HTTP Server URL`.
 
 3. Open the |RCE| configuration file,
    :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini`
 
 4. Add the following configuration option in the ``[app:main]``
    section if you don't have it yet.
 
    This enables mapping of the created |RCE| repo groups into special
    |svn| paths. Each time a new repository group is created, the system will
    update the template file and create new mapping. Apache web server needs to
    be reloaded to pick up the changes on this file.
    To do this, simply configure `svn.proxy.reload_cmd` inside the .ini file.
    Example configuration:
 
 
 .. code-block:: ini
 
     ############################################################
     ### Subversion proxy support (mod_dav_svn)               ###
     ### Maps RhodeCode repo groups into SVN paths for Apache ###
     ############################################################
     ## Enable or disable the config file generation.
     svn.proxy.generate_config = true
     ## Generate config file with `SVNListParentPath` set to `On`.
     svn.proxy.list_parent_path = true
     ## Set location and file name of generated config file.
     svn.proxy.config_file_path = %(here)s/mod_dav_svn.conf
     ## Used as a prefix to the <Location> block in the generated config file.
     ## In most cases it should be set to `/`.
     svn.proxy.location_root = /
     ## Command to reload the mod dav svn configuration on change.
     ## Example: `/etc/init.d/apache2 reload`
     svn.proxy.reload_cmd = /etc/init.d/apache2 reload
     ## If the timeout expires before the reload command finishes, the command will
     ## be killed. Setting it to zero means no timeout. Defaults to 10 seconds.
     #svn.proxy.reload_timeout = 10
 
 
 This would create a special template file called ```mod_dav_svn.conf```. We
 used that file path in the apache config above inside the Include statement.
 It's also possible to manually generate the config from the
 :menuselection:`Admin --> Settings --> VCS` page by clicking a
 `Generate Apache Config` button.
 
 5. Now only things left is to enable svn support, and generate the initial
    configuration.
 
    - Select `Proxy subversion HTTP requests` checkbox
    - Enter http://localhost:8090 into `Subversion HTTP Server URL`
    - Click the `Generate Apache Config` button.
 
 This config will be automatically re-generated once an user-groups is added
 to properly map the additional paths generated.
 
 
 
 Using |svn|
 ===========
 
 Once |svn| has been enabled on your instance, you can use it with the
 following examples. For more |svn| information, see the `Subversion Red Book`_
 
 .. code-block:: bash
 
     # To clone a repository
     svn checkout http://my-svn-server.example.com/my-svn-repo
 
     # svn commit
     svn commit
 
 
 .. _Subversion Red Book: http://svnbook.red-bean.com/en/1.7/svn-book.html#svn.ref.svn
 
 .. _Ask Ubuntu: http://askubuntu.com/questions/162391/how-do-i-fix-my-locale-issue
  No newline at end of file

docs/release-notes/release-notes.rst

@@ -1,98 +1,99 b''
 .. _rhodecode-release-notes-ref:
 
 Release Notes
 =============
 
 |RCE| 4.x Versions
 ------------------
 
 .. toctree::
    :maxdepth: 1
 
+   release-notes-4.9.0.rst
    release-notes-4.8.0.rst
    release-notes-4.7.2.rst
    release-notes-4.7.1.rst
    release-notes-4.7.0.rst
    release-notes-4.6.1.rst
    release-notes-4.6.0.rst
    release-notes-4.5.2.rst
    release-notes-4.5.1.rst
    release-notes-4.5.0.rst
    release-notes-4.4.2.rst
    release-notes-4.4.1.rst
    release-notes-4.4.0.rst
    release-notes-4.3.1.rst
    release-notes-4.3.0.rst
    release-notes-4.2.1.rst
    release-notes-4.2.0.rst
    release-notes-4.1.2.rst
    release-notes-4.1.1.rst
    release-notes-4.1.0.rst
    release-notes-4.0.1.rst
    release-notes-4.0.0.rst
 
 |RCE| 3.x Versions
 ------------------
 
 .. toctree::
    :maxdepth: 1
 
    release-notes-3.8.4.rst
    release-notes-3.8.3.rst
    release-notes-3.8.2.rst
    release-notes-3.8.1.rst
    release-notes-3.8.0.rst
    release-notes-3.7.1.rst
    release-notes-3.7.0.rst
    release-notes-3.6.1.rst
    release-notes-3.6.0.rst
    release-notes-3.5.2.rst
    release-notes-3.5.1.rst
    release-notes-3.5.0.rst
    release-notes-3.4.1.rst
    release-notes-3.4.0.rst
    release-notes-3.3.4.rst
    release-notes-3.3.3.rst
    release-notes-3.3.2.rst
    release-notes-3.3.1.rst
    release-notes-3.3.0.rst
    release-notes-3.2.3.rst
    release-notes-3.2.2.rst
    release-notes-3.2.1.rst
    release-notes-3.2.0.rst
    release-notes-3.1.1.rst
    release-notes-3.1.0.rst
    release-notes-3.0.2.rst
    release-notes-3.0.1.rst
    release-notes-3.0.0.rst
 
 |RCE| 2.x Versions
 ------------------
 
 .. toctree::
    :maxdepth: 1
 
    release-notes-2.2.8.rst
    release-notes-2.2.7.rst
    release-notes-2.2.6.rst
    release-notes-2.2.5.rst
    release-notes-2.2.4.rst
    release-notes-2.2.3.rst
    release-notes-2.2.2.rst
    release-notes-2.2.1.rst
    release-notes-2.2.0.rst
    release-notes-2.1.0.rst
    release-notes-2.0.2.rst
    release-notes-2.0.1.rst
    release-notes-2.0.0.rst
 
 |RCE| 1.x Versions
 ------------------
 
 .. toctree::
    :maxdepth: 1
 
    release-notes-1.7.2.rst
    release-notes-1.7.1.rst
    release-notes-1.7.0.rst
    release-notes-1.6.0.rst

rhodecode/apps/svn_support/templates/mod-dav-svn.conf.mako

@@ -1,85 +1,88 b''
 # Auto generated configuration for use with the Apache mod_dav_svn module.
 #
 # WARNING: Make sure your Apache instance which runs the mod_dav_svn module is
 #          only accessible by RhodeCode. Otherwise everyone is able to browse
 #          the repositories or run subversion operations (checkout/commit/etc.).
 #
 # The mod_dav_svn module does not support subversion repositories which are
 # organized in subfolders. To support the repository groups of RhodeCode it is
 # required to provide a <Location> block for each group pointing to the
 # repository group sub folder. To ease the configuration RhodeCode auto
 # generates this file whenever a repository group is created/changed/deleted.
 # Auto generation can be configured in the ini file. Settings are prefixed with
 # ``svn.proxy``.
 #
 # To include this configuration into your apache config you can use the
 # `Include` directive. See the following example snippet of a virtual host how
 # to include this configuration file.
 #
 #     <VirtualHost *:8090>
 #         ServerAdmin webmaster@localhost
 #         DocumentRoot /var/www/html
 #         ErrorLog ${'${APACHE_LOG_DIR}'}/error.log
 #         CustomLog ${'${APACHE_LOG_DIR}'}/access.log combined
+#         LogLevel info
+#         # allows custom host names, prevents 400 errors on checkout
+#         HttpProtocolOptions Unsafe
 #         Include /path/to/generated/mod_dav_svn.conf
 #     </VirtualHost>
 #
 # Depending on the apache configuration you may encounter the following error if
 # you are using speecial characters in your repository or repository group
 # names.
 #
 #    ``Error converting entry in directory '/path/to/repo' to UTF-8``
 #
 # In this case you have to change the LANG environment variable in the apache
 # configuration. This setting is typically located at ``/etc/apache2/envvars``.
 # You have to change it to an UTF-8 value like ``export LANG="en_US.UTF-8"``.
 # After changing this a stop and start of Apache is required (using restart
 # doesn't work).
 
 # fix https -> http downgrade with DAV. It requires an header downgrade for
 # https -> http reverse proxy to work properly
 % if use_https:
 RequestHeader edit Destination ^https: http: early
 % else:
 #RequestHeader edit Destination ^https: http: early
 % endif
 
 <Location "${location_root|n}">
     # The mod_dav_svn module takes the username from the apache request object.
     # Without authorization this will be empty and no username is logged for the
     # transactions. This will result in "(no author)" for each revision. The
     # following directives implement a fake authentication that allows every
     # username/password combination.
     AuthType Basic
     AuthName "${rhodecode_realm|n}"
     AuthBasicProvider anon
     Anonymous *
     Anonymous_LogEmail off
     Require valid-user
 
     DAV svn
     SVNParentPath "${parent_path_root|n}"
     SVNListParentPath ${"On" if svn_list_parent_path else "Off"|n}
 
     Allow from all
     Order allow,deny
 </Location>
 
 % for location, parent_path in repo_group_paths:
 
 <Location "${location|n}">
     AuthType Basic
     AuthName "${rhodecode_realm|n}"
     AuthBasicProvider anon
     Anonymous *
     Anonymous_LogEmail off
     Require valid-user
 
     DAV svn
     SVNParentPath "${parent_path|n}"
     SVNListParentPath ${"On" if svn_list_parent_path else "Off"|n}
 
     Allow from all
     Order allow,deny
 </Location>
 % endfor