forms: unified usage of h.secure_form. Make sure we ALWAYS pass in

request, and removed redundant 'POST' type.

rhodecode/templates/admin/defaults/defaults_repositories.mako

@@ -1,81 +1,81 b''
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Default Settings For New Repositories')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.route_path('admin_defaults_repositories_update'), method='POST', request=request)}
+        ${h.secure_form(h.route_path('admin_defaults_repositories_update'), request=request)}
         <div class="form">
             <!-- fields -->
 
             <div class="fields">
 
                 <div class="field">
                     <div class="label">
                         <label for="default_repo_type">${_('Type')}:</label>
                     </div>
                     <div class="select">
                         ${h.select('default_repo_type','hg',c.backends,class_="medium")}
                     </div>
                 </div>
 
                 <div class="field">
                     <div class="label label-checkbox">
                         <label for="default_repo_private">${_('Private Repository')}:</label>
                     </div>
                     <div class="checkboxes">
                         ${h.checkbox('default_repo_private',value="True")}
                         <span class="help-block">${_('Private repositories are only visible to people explicitly added as collaborators.')}</span>
                     </div>
                 </div>
 
 
                 <div class="field">
                     <div class="label label-checkbox">
                         <label for="default_repo_enable_statistics">${_('Enable Statistics')}:</label>
                     </div>
                     <div class="checkboxes">
                         ${h.checkbox('default_repo_enable_statistics',value="True")}
                         <span class="help-block">${_('Enable a statistics window on the repository summary page.')}</span>
                     </div>
                 </div>
 
                 <div class="field">
                     <div class="label label-checkbox">
                         <label for="default_repo_enable_downloads">${_('Enable Downloads')}:</label>
                     </div>
                     <div class="checkboxes">
                         ${h.checkbox('default_repo_enable_downloads',value="True")}
                         <span class="help-block">${_('Enable the download option on the repository summary page.')}</span>
                     </div>
                 </div>
 
                 <div class="field">
                     <div class="label label-checkbox">
                         <label for="default_repo_enable_locking">${_('Enable Locking')}:</label>
                     </div>
                     <div class="checkboxes">
                         ${h.checkbox('default_repo_enable_locking',value="True")}
                         <span class="help-block">${_('Enable automatic repository locking. Pulling from a repository will lock it, and it is unlocked by pushing back by the same user.')}</span>
                     </div>
                 </div>
 
                 <div class="buttons">
                 ${h.submit('save',_('Save'),class_="btn")}
                 </div>
             </div>
         </div>
         ${h.end_form()}
     </div>
 
 </div>
 
 <script>
     $(document).ready(function(){
         $("#default_repo_type").select2({
             containerCssClass: 'drop-menu',
             dropdownCssClass: 'drop-menu-dropdown',
             dropdownAutoWidth: true,
             minimumResultsForSearch: -1
         });
     })
 </script>

rhodecode/templates/admin/gists/edit.mako

@@ -1,139 +1,139 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="/base/base.mako"/>
 
 <%def name="title()">
     ${_('Edit Gist')} &middot; ${c.gist.gist_access_id}
     %if c.rhodecode_name:
         &middot; ${h.branding(c.rhodecode_name)}
     %endif
 </%def>
 
 <%def name="breadcrumbs_links()">
     ${_('Edit Gist')} &middot; ${c.gist.gist_access_id}
 </%def>
 
 <%def name="menu_bar_nav()">
     ${self.menu_items(active='gists')}
 </%def>
 
 <%def name="main()">
 <div class="box">
     <!-- box / title -->
     <div class="title">
         ${self.breadcrumbs()}
     </div>
 
     <div class="table">
 
         <div id="files_data">
-          ${h.secure_form(h.route_path('gist_update', gist_id=c.gist.gist_access_id), id='eform', method='POST', request=request)}
+          ${h.secure_form(h.route_path('gist_update', gist_id=c.gist.gist_access_id), id='eform', request=request)}
             <div>
                 <input type="hidden" value="${c.file_last_commit.raw_id}" name="parent_hash">
                 <textarea id="description" name="description"
                           placeholder="${_('Gist description ...')}">${c.gist.gist_description}</textarea>
                 <div>
                     <span class="gist-gravatar">
                       ${self.gravatar(h.email_or_none(c.rhodecode_user.full_contact), 30)}
                     </span>
                     <label for='lifetime'>${_('Gist lifetime')}</label>
                     ${h.dropdownmenu('lifetime', '0', c.lifetime_options)}
 
                     <label for='gist_acl_level'>${_('Gist access level')}</label>
                     ${h.dropdownmenu('gist_acl_level', c.gist.acl_level, c.acl_options)}
                 </div>
             </div>
 
             ## peppercorn schema
             <input type="hidden" name="__start__" value="nodes:sequence"/>
             % for cnt, file in enumerate(c.files):
                 <input type="hidden" name="__start__" value="file:mapping"/>
                 <div id="codeblock" class="codeblock" >
                   <div class="code-header">
                     <div class="form">
                       <div class="fields">
                         <input type="hidden" name="filename_org" value="${file.path}" >
                         <input id="filename_${h.FID('f',file.path)}" name="filename" size="30" type="text" value="${file.path}">
                           ${h.dropdownmenu('mimetype' ,'plain',[('plain',_('plain'))],enable_filter=True, id='mimetype_'+h.FID('f',file.path))}
                       </div>
                     </div>
                   </div>
                   <div class="editor_container">
                       <pre id="editor_pre"></pre>
                       <textarea id="editor_${h.FID('f',file.path)}" name="content" >${file.content}</textarea>
                   </div>
                 </div>
                 <input type="hidden" name="__end__" />
 
                 ## dynamic edit box.
                 <script type="text/javascript">
                 $(document).ready(function(){
                     var myCodeMirror = initCodeMirror(
                             "editor_${h.FID('f',file.path)}", '');
 
                     var modes_select = $("#mimetype_${h.FID('f',file.path)}");
                     fillCodeMirrorOptions(modes_select);
 
                     // try to detect the mode based on the file we edit
                     var mimetype = "${file.mimetype}";
                     var detected_mode = detectCodeMirrorMode(
                             "${file.path}", mimetype);
 
                     if(detected_mode){
                         $(modes_select).select2("val", mimetype);
                         $(modes_select).change();
                         setCodeMirrorMode(myCodeMirror, detected_mode);
                     }
 
                     var filename_selector = "#filename_${h.FID('f',file.path)}";
                     // on change of select field set mode
                     setCodeMirrorModeFromSelect(
                             modes_select, filename_selector, myCodeMirror, null);
 
                     // on entering the new filename set mode, from given extension
                     setCodeMirrorModeFromInput(
                         modes_select, filename_selector, myCodeMirror, null);
                 });
                 </script>
             %endfor
             <input type="hidden" name="__end__" />
 
             <div class="pull-right">
             ${h.submit('update',_('Update Gist'),class_="btn btn-success")}
             <a class="btn" href="${h.route_path('gist_show', gist_id=c.gist.gist_access_id)}">${_('Cancel')}</a>
             </div>
           ${h.end_form()}
         </div>
     </div>
 
 </div>
 <script>
   $('#update').on('click', function(e){
       e.preventDefault();
 
       $(this).val('Updating...');
       $(this).attr('disabled', 'disabled');
       // check for newer version.
       $.ajax({
         url: "${h.route_path('gist_edit_check_revision', gist_id=c.gist.gist_access_id)}",
         data: {
             'revision': '${c.file_last_commit.raw_id}'
         },
         dataType: 'json',
         type: 'GET',
         success: function(data) {
           if(data.success === false){
             message = '${h.literal(_('Gist was updated since you started editing. Copy your changes and click %(here)s to reload the new version.')
               % {'here': h.link_to('here', h.route_path('gist_edit', gist_id=c.gist.gist_access_id))})}'
             alertMessage = [{"message": {
               "message": message, "force": "true", "level": "warning"}}];
             $.Topic('/notifications').publish(alertMessage[0]);
           }
           else{
             $('#eform').submit();
           }
         }
       });
   })
 
 </script>
 </%def>

rhodecode/templates/admin/gists/new.mako

@@ -1,86 +1,86 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="/base/base.mako"/>
 
 <%def name="title()">
     ${_('New Gist')}
     %if c.rhodecode_name:
         &middot; ${h.branding(c.rhodecode_name)}
     %endif
 </%def>
 
 <%def name="breadcrumbs_links()">
     ${_('New Gist')}
 </%def>
 
 <%def name="menu_bar_nav()">
     ${self.menu_items(active='gists')}
 </%def>
 
 <%def name="main()">
 <div class="box">
     <!-- box / title -->
     <div class="title">
         ${self.breadcrumbs()}
     </div>
 
     <div class="table">
         <div id="files_data">
-          ${h.secure_form(h.route_path('gists_create'), id='eform', method='POST', request=request)}
+          ${h.secure_form(h.route_path('gists_create'), id='eform', request=request)}
             <div>
                 <textarea id="description" name="description" placeholder="${_('Gist description ...')}"></textarea>
 
                 <span class="gist-gravatar">
                     ${self.gravatar(c.rhodecode_user.email, 30)}
                 </span>
                  <label for='gistid'>${_('Gist id')}</label>
                  ${h.text('gistid', placeholder=_('Auto generated'))}
 
                  <label for='lifetime'>${_('Gist lifetime')}</label>
                  ${h.dropdownmenu('lifetime', '', c.lifetime_options)}
 
                  <label for='acl_level'>${_('Gist access level')}</label>
                  ${h.dropdownmenu('gist_acl_level', '', c.acl_options)}
 
             </div>
             <div id="codeblock" class="codeblock">
                 <div class="code-header">
                     <div class="form">
                         <div class="fields">
                             ${h.text('filename', size=30, placeholder=_('name this file...'))}
                             ${h.dropdownmenu('mimetype','plain',[('plain',_('plain'))],enable_filter=True)}
                         </div>
                     </div>
                 </div>
                 <div id="editor_container">
                     <div id="editor_pre"></div>
                     <textarea id="editor" name="content" ></textarea>
                 </div>
             </div>
             <div class="pull-right">
             ${h.submit('private',_('Create Private Gist'),class_="btn")}
             ${h.submit('public',_('Create Public Gist'),class_="btn")}
             ${h.reset('reset',_('Reset'),class_="btn")}
             </div>
             ${h.end_form()}
         </div>
     </div>
 
 </div>
 
 <script type="text/javascript">
     var myCodeMirror = initCodeMirror('editor', '');
 
     var modes_select = $('#mimetype');
     fillCodeMirrorOptions(modes_select);
 
     var filename_selector = '#filename';
     // on change of select field set mode
     setCodeMirrorModeFromSelect(
             modes_select, filename_selector, myCodeMirror, null);
 
     // on entering the new filename set mode, from given extension
     setCodeMirrorModeFromInput(
         modes_select, filename_selector, myCodeMirror, null);
 
 </script>
 </%def>

rhodecode/templates/admin/gists/show.mako

@@ -1,110 +1,110 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="/base/base.mako"/>
 
 <%def name="robots()">
     %if c.gist.gist_type != 'public':
       <meta name="robots" content="noindex, nofollow">
     %else:
       ${parent.robots()}
     %endif
 </%def>
 
 <%def name="title()">
     ${_('Gist')} &middot; ${c.gist.gist_access_id}
     %if c.rhodecode_name:
         &middot; ${h.branding(c.rhodecode_name)}
     %endif
 </%def>
 
 <%def name="breadcrumbs_links()">
     ${_('Gist')} &middot; ${c.gist.gist_access_id}
 </%def>
 
 <%def name="menu_bar_nav()">
     ${self.menu_items(active='gists')}
 </%def>
 
 <%def name="main()">
 <div class="box">
     <!-- box / title -->
     <div class="title">
         ${self.breadcrumbs()}
         %if c.rhodecode_user.username != h.DEFAULT_USER:
         <ul class="links">
           <li>
               <a href="${h.route_path('gists_new')}" class="btn btn-primary">${_(u'Create New Gist')}</a>
           </li>
         </ul>
         %endif
     </div>
     <code>${c.gist.gist_url()}</code>
     <div class="table">
         <div id="files_data">
             <div id="codeblock" class="codeblock">
                 <div class="code-header">
                     <div class="stats">
                        %if h.HasPermissionAny('hg.admin')() or c.gist.gist_owner == c.rhodecode_user.user_id:
                         <div class="remove_gist">
-                            ${h.secure_form(h.route_path('gist_delete', gist_id=c.gist.gist_access_id), method='POST', request=request)}
+                            ${h.secure_form(h.route_path('gist_delete', gist_id=c.gist.gist_access_id), request=request)}
                                 ${h.submit('remove_gist', _('Delete'),class_="btn btn-mini btn-danger",onclick="return confirm('"+_('Confirm to delete this Gist')+"');")}
                             ${h.end_form()}
                         </div>
                        %endif
                         <div class="buttons">
                           ## only owner should see that
                           %if h.HasPermissionAny('hg.admin')() or c.gist.gist_owner == c.rhodecode_user.user_id:
                             ${h.link_to(_('Edit'), h.route_path('gist_edit', gist_id=c.gist.gist_access_id), class_="btn btn-mini")}
                           %endif
                           ${h.link_to(_('Show as Raw'), h.route_path('gist_show_formatted', gist_id=c.gist.gist_access_id, revision='tip', format='raw'), class_="btn btn-mini")}
                         </div>
                         <div class="left" >
                           %if c.gist.gist_type != 'public':
                             <span class="tag tag-ok disabled">${_('Private Gist')}</span>
                           %endif
                           <span> ${c.gist.gist_description}</span>
                            <span>${_('Expires')}:
                            %if c.gist.gist_expires == -1:
                              ${_('never')}
                            %else:
                               ${h.age_component(h.time_to_utcdatetime(c.gist.gist_expires))}
                           %endif
                           </span>
                        </div>
                     </div>
 
                     <div class="author">
                         <div title="${h.tooltip(c.file_last_commit.author)}">
                           ${self.gravatar_with_user(c.file_last_commit.author, 16)} - ${_('created')} ${h.age_component(c.file_last_commit.date)}
                         </div>
 
                     </div>
                     <div class="commit">${h.urlify_commit_message(c.file_last_commit.message, None)}</div>
                 </div>
 
                ## iterate over the files
                % for file in c.files:
                 <% renderer = c.render and h.renderer_from_filename(file.path, exclude=['.txt', '.TXT'])%>
                 <!--
                 <div id="${h.FID('G', file.path)}" class="stats" >
                     <a href="${c.gist.gist_url()}">¶</a>
                     <b >${file.path}</b>
                     <div>
                        ${h.link_to(_('Show as raw'), h.route_path('gist_show_formatted_path', gist_id=c.gist.gist_access_id, revision=file.commit.raw_id, format='raw', f_path=file.path), class_="btn btn-mini")}
                     </div>
                 </div>
                 -->
                 <div class="code-body textarea text-area editor">
                     %if renderer:
                         ${h.render(file.content, renderer=renderer)}
                     %else:
                         ${h.pygmentize(file,linenos=True,anchorlinenos=True,lineanchors='L',cssclass="code-highlight")}
                     %endif
                 </div>
                %endfor
             </div>
         </div>
     </div>
 
 
 </div>
 </%def>

rhodecode/templates/admin/my_account/my_account_auth_tokens.mako

@@ -1,180 +1,180 b''
 <div class="panel panel-default">
   <div class="panel-heading">
     <h3 class="panel-title">${_('Authentication Tokens')}</h3>
   </div>
   <div class="panel-body">
     <div class="apikeys_wrap">
       <p>
          ${_('Each token can have a role. Token with a role can be used only in given context, '
          'e.g. VCS tokens can be used together with the authtoken auth plugin for git/hg/svn operations only.')}
       </p>
       <table class="rctable auth_tokens">
         <tr>
             <th>${_('Token')}</th>
             <th>${_('Scope')}</th>
             <th>${_('Description')}</th>
             <th>${_('Role')}</th>
             <th>${_('Expiration')}</th>
             <th>${_('Action')}</th>
         </tr>
         %if c.user_auth_tokens:
             %for auth_token in c.user_auth_tokens:
               <tr class="${'expired' if auth_token.expired else ''}">
                 <td class="truncate-wrap td-authtoken">
                     <div class="user_auth_tokens truncate autoexpand">
                     <code>${auth_token.api_key}</code>
                     </div>
                 </td>
                 <td class="td">${auth_token.scope_humanized}</td>
                 <td class="td-wrap">${auth_token.description}</td>
                 <td class="td-tags">
                     <span class="tag disabled">${auth_token.role_humanized}</span>
                 </td>
                 <td class="td-exp">
                      %if auth_token.expires == -1:
                       ${_('never')}
                      %else:
                         %if auth_token.expired:
                             <span style="text-decoration: line-through">${h.age_component(h.time_to_utcdatetime(auth_token.expires))}</span>
                         %else:
                             ${h.age_component(h.time_to_utcdatetime(auth_token.expires))}
                         %endif
                      %endif
                 </td>
                 <td class="td-action">
-                    ${h.secure_form(h.route_path('my_account_auth_tokens_delete'), method='POST', request=request)}
+                    ${h.secure_form(h.route_path('my_account_auth_tokens_delete'), request=request)}
                         ${h.hidden('del_auth_token', auth_token.user_api_key_id)}
                         <button class="btn btn-link btn-danger" type="submit"
                                 onclick="return confirm('${_('Confirm to remove this auth token: %s') % auth_token.token_obfuscated}');">
                             ${_('Delete')}
                         </button>
                     ${h.end_form()}
                 </td>
               </tr>
             %endfor
         %else:
         <tr><td><div class="ip">${_('No additional auth tokens specified')}</div></td></tr>
         %endif
       </table>
     </div>
 
         <div class="user_auth_tokens">
-            ${h.secure_form(h.route_path('my_account_auth_tokens_add'), method='POST', request=request)}
+            ${h.secure_form(h.route_path('my_account_auth_tokens_add'), request=request)}
             <div class="form form-vertical">
                 <!-- fields -->
                 <div class="fields">
                      <div class="field">
                         <div class="label">
                             <label for="new_email">${_('New authentication token')}:</label>
                         </div>
                         <div class="input">
                             ${h.text('description', class_='medium', placeholder=_('Description'))}
                             ${h.hidden('lifetime')}
                             ${h.select('role', '', c.role_options)}
 
                             % if c.allow_scoped_tokens:
                                 ${h.hidden('scope_repo_id')}
                             % else:
                                 ${h.select('scope_repo_id_disabled', '', ['Scopes available in EE edition'], disabled='disabled')}
                             % endif
                         </div>
                         <p class="help-block">
                           ${_('Repository scope works only with tokens with VCS type.')}
                         </p>
                      </div>
                     <div class="buttons">
                       ${h.submit('save',_('Add'),class_="btn")}
                       ${h.reset('reset',_('Reset'),class_="btn")}
                     </div>
                 </div>
             </div>
             ${h.end_form()}
         </div>
     </div>
 </div>
 <script>
 $(document).ready(function(){
 
 var select2Options = {
     'containerCssClass': "drop-menu",
     'dropdownCssClass': "drop-menu-dropdown",
     'dropdownAutoWidth': true
 };
 $("#role").select2(select2Options);
 
 
 var preloadData = {
     results: [
         % for entry in c.lifetime_values:
             {id:${entry[0]}, text:"${entry[1]}"}${'' if loop.last else ','}
         % endfor
     ]
 };
 
 $("#lifetime").select2({
     containerCssClass: "drop-menu",
     dropdownCssClass: "drop-menu-dropdown",
     dropdownAutoWidth: true,
     data: preloadData,
     placeholder: "${_('Select or enter expiration date')}",
     query: function(query) {
         feedLifetimeOptions(query, preloadData);
     }
 });
 
 
 var repoFilter = function(data) {
     var results = [];
 
     if (!data.results[0]) {
         return data
     }
 
     $.each(data.results[0].children, function() {
         // replace name to ID for submision
         this.id = this.obj.repo_id;
         results.push(this);
     });
 
     data.results[0].children = results;
     return data;
 };
 
 $("#scope_repo_id_disabled").select2(select2Options);
 
 $("#scope_repo_id").select2({
     cachedDataSource: {},
     minimumInputLength: 2,
     placeholder: "${_('repository scope')}",
     dropdownAutoWidth: true,
     containerCssClass: "drop-menu",
     dropdownCssClass: "drop-menu-dropdown",
     formatResult: formatResult,
     query: $.debounce(250, function(query){
         self = this;
         var cacheKey = query.term;
         var cachedData = self.cachedDataSource[cacheKey];
 
         if (cachedData) {
             query.callback({results: cachedData.results});
         } else {
             $.ajax({
                 url: pyroutes.url('repo_list_data'),
                 data: {'query': query.term},
                 dataType: 'json',
                 type: 'GET',
                 success: function(data) {
                     data = repoFilter(data);
                     self.cachedDataSource[cacheKey] = data;
                     query.callback({results: data.results});
                 },
                 error: function(data, textStatus, errorThrown) {
                     alert("Error while fetching entries.\nError code {0} ({1}).".format(data.status, data.statusText));
                 }
             })
         }
     })
 });
 
 });
 </script>

rhodecode/templates/admin/my_account/my_account_emails.mako

@@ -1,72 +1,72 b''
 <%namespace name="base" file="/base/base.mako"/>
 
 <div class="panel panel-default">
   <div class="panel-heading">
     <h3 class="panel-title">${_('Account Emails')}</h3>
   </div>
 
     <div class="panel-body">
         <div class="emails_wrap">
           <table class="rctable account_emails">
             <tr>
             <td class="td-user">
                 ${base.gravatar(c.user.email, 16)}
                 <span class="user email">${c.user.email}</span>
             </td>
             <td class="td-tags">
                 <span class="tag tag1">${_('Primary')}</span>
             </td>
             </tr>
             %if c.user_email_map:
                 %for em in c.user_email_map:
                   <tr>
                     <td class="td-user">
                         ${base.gravatar(em.email, 16)}
                         <span class="user email">${em.email}</span>
                     </td>
                     <td class="td-action">
-                        ${h.secure_form(h.route_path('my_account_emails_delete'), method='POST', request=request)}
+                        ${h.secure_form(h.route_path('my_account_emails_delete'), request=request)}
                             ${h.hidden('del_email_id',em.email_id)}
                             <button class="btn btn-link btn-danger" type="submit" id="${'remove_email_%s'.format(em.email_id)}"
                                     onclick="return confirm('${_('Confirm to delete this email: {}').format(em.email)}');">
                                 ${_('Delete')}
                             </button>
                         ${h.end_form()}
                     </td>
                   </tr>
                 %endfor
             %else:
                 <tr class="noborder">
                     <td colspan="3">
                         <div class="td-email">
                             ${_('No additional emails specified')}
                         </div>
                     </td>
                 </tr>
             %endif
           </table>
         </div>
 
         <div>
-            ${h.secure_form(h.route_path('my_account_emails_add'), method='POST', request=request)}
+            ${h.secure_form(h.route_path('my_account_emails_add'), request=request)}
             <div class="form">
                 <!-- fields -->
                 <div class="fields">
                      <div class="field">
                         <div class="label">
                             <label for="new_email">${_('New email address')}:</label>
                         </div>
                         <div class="input">
                             ${h.text('new_email', class_='medium')}
                         </div>
                      </div>
                     <div class="buttons">
                       ${h.submit('save',_('Add'),class_="btn")}
                       ${h.reset('reset',_('Reset'),class_="btn")}
                     </div>
                 </div>
             </div>
             ${h.end_form()}
         </div>
     </div>
 </div>

rhodecode/templates/admin/my_account/my_account_profile_edit.mako

@@ -1,113 +1,113 b''
 <%namespace name="base" file="/base/base.mako"/>
 <div class="panel panel-default user-profile">
     <div class="panel-heading">
         <h3 class="panel-title">${_('My Profile')}</h3>
         <a href="${h.route_path('my_account_profile')}" class="panel-edit">Close</a>
     </div>
 
     <div class="panel-body">
-    ${h.secure_form(h.route_path('my_account_update'), class_='form', method='POST', request=request)}
+    ${h.secure_form(h.route_path('my_account_update'), class_='form', request=request)}
     <% readonly = None %>
     <% disabled = "" %>
 
     % if c.extern_type != 'rhodecode':
         <% readonly = "readonly" %>
         <% disabled = "disabled" %>
         <div class="infoform">
           <div class="fields">
             <p>${_('Your user account details are managed by an external source. Details cannot be managed here.')}
                <br/>${_('Source type')}: <strong>${c.extern_type}</strong>
             </p>
 
             <div class="field">
                <div class="label">
                    <label for="username">${_('Username')}:</label>
                </div>
                <div class="input">
                  ${h.text('username', class_='input-valuedisplay', readonly=readonly)}
                </div>
             </div>
     
             <div class="field">
                <div class="label">
                    <label for="name">${_('First Name')}:</label>
                </div>
                <div class="input">
                    ${h.text('firstname', class_='input-valuedisplay', readonly=readonly)}
                </div>
             </div>
     
             <div class="field">
                <div class="label">
                    <label for="lastname">${_('Last Name')}:</label>
                </div>
                <div class="input-valuedisplay">
                    ${h.text('lastname', class_='input-valuedisplay', readonly=readonly)}
                </div>
             </div>
           </div>
         </div>
     % else:
         <div class="form">
           <div class="fields">
             <div class="field">
                 <div class="label photo">
                     ${_('Photo')}:
                 </div>
                 <div class="input profile">
                     %if c.visual.use_gravatar:
                         ${base.gravatar(c.user.email, 100)}
                         <p class="help-block">${_('Change your avatar at')} <a href="http://gravatar.com">gravatar.com</a>.</p>
                     %else:
                         ${base.gravatar(c.user.email, 20)}
                         ${_('Avatars are disabled')}
                     %endif
                 </div>
             </div>
             <div class="field">
                <div class="label">
                    <label for="username">${_('Username')}:</label>
                </div>
                <div class="input">
                  ${h.text('username', class_='medium%s' % disabled, readonly=readonly)}
                  ${h.hidden('extern_name', c.extern_name)}
                  ${h.hidden('extern_type', c.extern_type)}
                </div>
             </div>
             <div class="field">
                <div class="label">
                    <label for="name">${_('First Name')}:</label>
                </div>
                <div class="input">
                    ${h.text('firstname', class_="medium")}
                </div>
             </div>
     
             <div class="field">
                <div class="label">
                    <label for="lastname">${_('Last Name')}:</label>
                </div>
                <div class="input">
                    ${h.text('lastname', class_="medium")}
                </div>
             </div>
     
             <div class="field">
                <div class="label">
                    <label for="email">${_('Email')}:</label>
                </div>
                <div class="input">
                    ## we should be able to edit email !
                    ${h.text('email', class_="medium")}
                </div>
             </div>
     
             <div class="buttons">
               ${h.submit('save', _('Save'), class_="btn")}
               ${h.reset('reset', _('Reset'), class_="btn")}
             </div>
           </div>
         </div>
     % endif
     </div>
 </div>
  No newline at end of file

rhodecode/templates/admin/my_account/my_account_ssh_keys.mako

@@ -1,84 +1,84 b''
 <div class="panel panel-default">
     <div class="panel-heading">
       <h3 class="panel-title">${_('SSH Keys')}</h3>
     </div>
     <div class="panel-body">
         <div class="sshkeys_wrap">
           <table class="rctable ssh_keys">
             <tr>
                 <th>${_('Fingerprint')}</th>
                 <th>${_('Description')}</th>
                 <th>${_('Created')}</th>
                 <th>${_('Action')}</th>
             </tr>
             % if not c.ssh_enabled:
                 <tr><td colspan="4"><div class="">${_('SSH Keys usage is currently disabled, please ask your administrator to enable them.')}</div></td></tr>
             % else:
                 %if c.user_ssh_keys:
                     %for ssh_key in c.user_ssh_keys:
                       <tr class="">
                         <td class="">
                             <code>${ssh_key.ssh_key_fingerprint}</code>
                         </td>
                         <td class="td-wrap">${ssh_key.description}</td>
                         <td class="td-tags">${h.format_date(ssh_key.created_on)}</td>
 
                         <td class="td-action">
-                            ${h.secure_form(h.route_path('my_account_ssh_keys_delete'), method='POST', request=request)}
+                            ${h.secure_form(h.route_path('my_account_ssh_keys_delete'), request=request)}
                                 ${h.hidden('del_ssh_key', ssh_key.ssh_key_id)}
                                 <button class="btn btn-link btn-danger" type="submit"
                                         onclick="return confirm('${_('Confirm to remove ssh key %s') % ssh_key.ssh_key_fingerprint}');">
                                     ${_('Delete')}
                                 </button>
                             ${h.end_form()}
                         </td>
                       </tr>
                     %endfor
                 %else:
                 <tr><td colspan="4"><div class="">${_('No additional ssh keys specified')}</div></td></tr>
                 %endif
             % endif
           </table>
         </div>
 
         % if c.ssh_enabled:
         <div class="user_ssh_keys">
-            ${h.secure_form(h.route_path('my_account_ssh_keys_add'), method='POST', request=request)}
+            ${h.secure_form(h.route_path('my_account_ssh_keys_add'), request=request)}
             <div class="form form-vertical">
                 <!-- fields -->
                 <div class="fields">
                     <div class="field">
                         <div class="label">
                             <label for="new_email">${_('New ssh key')}:</label>
                         </div>
                         <div class="input">
                             ${h.text('description', class_='medium', placeholder=_('Description'))}
                             <a href="${h.route_path('my_account_ssh_keys_generate')}">${_('Generate random RSA key')}</a>
                         </div>
                      </div>
 
                     <div class="field">
                         <div class="textarea text-area editor">
                             ${h.textarea('key_data',c.default_key, size=30, placeholder=_("Public key, begins with 'ssh-rsa', 'ssh-dss', 'ssh-ed25519', 'ecdsa-sha2-nistp256', 'ecdsa-sha2-nistp384', or 'ecdsa-sha2-nistp521'"))}
                         </div>
                     </div>
 
                     <div class="buttons">
                       ${h.submit('save',_('Add'),class_="btn")}
                       ${h.reset('reset',_('Reset'),class_="btn")}
                     </div>
                 </div>
             </div>
             ${h.end_form()}
         </div>
         % endif
     </div>
 </div>
 
 <script>
 
 $(document).ready(function(){
 
 
 });
 </script>

rhodecode/templates/admin/permissions/permissions_application.mako

@@ -1,81 +1,81 b''
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('System Wide Application Permissions')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.route_path('admin_permissions_application_update'), method='POST', request=request)}
+        ${h.secure_form(h.route_path('admin_permissions_application_update'), request=request)}
             <div class="form">
                 <!-- fields -->
                 <div class="fields">
                     <div class="field">
                         <div class="label label-checkbox">
                             <label for="anonymous">${_('Anonymous Access')}:</label>
                         </div>
                         <div class="checkboxes">
                             <div class="checkbox">
                                 ${h.checkbox('anonymous',True)} Allow Anonymous Access
                             </div>
                              <span class="help-block">${h.literal(_('Allow access to RhodeCode Enterprise without requiring users to login. Anonymous users get the %s permission settings.' % (h.link_to('"default user"',h.route_path('admin_permissions_object')))))}</span>
                         </div>
                     </div>
 
                     <div class="field">
                         <div class="label label-select">
                             <label for="default_register">${_('Registration')}:</label>
                         </div>
                         <div class="select">
                             ${h.select('default_register','',c.register_choices)}
                         </div>
                     </div>
 
                     <div class="field">
                         <div class="label label-select">
                             <label for="default_password_reset">${_('Password Reset')}:</label>
                         </div>
                         <div class="select">
                             ${h.select('default_password_reset','',c.password_reset_choices)}
                         </div>
                     </div>
 
                     <div class="field">
                         <div class="label label-textarea">
                             <label for="default_register_message">${_('Registration Page Message')}:</label>
                         </div>
                         <div class="textarea text-area editor" >
                             ${h.textarea('default_register_message', class_="medium", )}
                             <span class="help-block">${_('Custom message to be displayed on the registration page. HTML syntax is supported.')}</span>
                         </div>
                      </div>
 
                      <div class="field">
                         <div class="label">
                             <label for="default_extern_activate">${_('External Authentication Account Activation')}:</label>
                         </div>
                         <div class="select">
                             ${h.select('default_extern_activate','',c.extern_activate_choices)}
                         </div>
                      </div>
                     <div class="buttons">
                       ${h.submit('save',_('Save'),class_="btn")}
                       ${h.reset('reset',_('Reset'),class_="btn")}
                     </div>
                 </div>
             </div>
         ${h.end_form()}
     </div>
 </div>
 
 <script>
     $(document).ready(function(){
         var select2Options = {
             containerCssClass: 'drop-menu',
             dropdownCssClass: 'drop-menu-dropdown',
             dropdownAutoWidth: true,
             minimumResultsForSearch: -1
         };
 
         $("#default_register").select2(select2Options);
         $("#default_password_reset").select2(select2Options);
         $("#default_extern_activate").select2(select2Options);
     });
 </script>

rhodecode/templates/admin/permissions/permissions_global.mako

@@ -1,10 +1,10 b''
 
-${h.secure_form(h.route_path('admin_permissions_global_update'), method='POST', request=request)}
+${h.secure_form(h.route_path('admin_permissions_global_update'), request=request)}
     <div class="form permissions-global">
         <!-- fields -->
         <div class="fields">
             <%namespace name="dpb" file="/base/default_perms_box.mako"/>
             ${dpb.default_perms_radios(global_permissions_template = True)}
         </div>
     </div>
 ${h.end_form()}

rhodecode/templates/admin/permissions/permissions_ips.mako

@@ -1,70 +1,70 b''
 
 
 <div class="panel panel-default">
   <div class="panel-heading">
       <h3 class="panel-title">${_('Default IP Whitelist For All Users')}</h3>
   </div>
   <div class="panel-body">
     <div class="ips_wrap">
     <h5>${_('Current IP address')}: <code>${c.rhodecode_user.ip_addr}</code></h5>
 
 
       <table class="rctable ip-whitelist">
         <tr>
           <th>IP Address</th>
           <th>IP Range</th>
           <th>Description</th>
           <th></th>
         </tr>
       %if c.user_ip_map:
         %for ip in c.user_ip_map:
           <tr>
               <td class="td-ip"><div class="ip">${ip.ip_addr}</div></td>
               <td class="td-iprange"><div class="ip">${h.ip_range(ip.ip_addr)}</div></td>
               <td class="td-description"><div class="ip">${ip.description}</div></td>
               <td class="td-action">
-                ${h.secure_form(h.route_path('edit_user_ips_delete', user_id=c.user.user_id), method='POST', request=request)}
+                ${h.secure_form(h.route_path('edit_user_ips_delete', user_id=c.user.user_id), request=request)}
                     ${h.hidden('del_ip_id',ip.ip_id)}
                     ${h.hidden('default_user', 'True')}
                     ${h.submit('remove_',_('Delete'),id="remove_ip_%s" % ip.ip_id,
                     class_="btn btn-link btn-danger", onclick="return confirm('"+_('Confirm to delete this ip: %s') % ip.ip_addr+"');")}
                 ${h.end_form()}
               </td>
           </tr>
         %endfor
        %else:
           <tr>
             <td class="ip">${_('All IP addresses are allowed')}</td>
             <td></td>
             <td></td>
             <td></td>
           </tr>
        %endif
       </table>
     </div>
 
-    ${h.secure_form(h.route_path('edit_user_ips_add', user_id=c.user.user_id), method='POST', request=request)}
+    ${h.secure_form(h.route_path('edit_user_ips_add', user_id=c.user.user_id), request=request)}
       <div class="form">
         <!-- fields -->
         <div class="fields">
           <div class="field">
             <div class="label">
               <label for="new_ip">${_('New IP Address')}:</label>
             </div>
             <div class="input">
               ${h.hidden('default_user', 'True')}
               ${h.text('new_ip')} ${h.text('description', placeholder=_('Description...'))}
               <span class="help-block">${_('Enter a comma separated list of IP Addresses like 127.0.0.1,\n'
                'or use an IP Address with a mask 127.0.0.1/24, to create a network range.\n'
                'To specify multiple addresses in a range, use the 127.0.0.1-127.0.0.10 syntax')}</span>
             </div>
            </div>
           <div class="buttons">
             ${h.submit('save',_('Add'),class_="btn")}
             ${h.reset('reset',_('Reset'),class_="btn")}
           </div>
         </div>
       </div>
     ${h.end_form()}
   </div>
 </div>

rhodecode/templates/admin/permissions/permissions_objects.mako

@@ -1,77 +1,77 b''
    <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Default Permissions for Repositories, User Groups and Repository Groups.')}</h3>
     </div>
     <div class="panel-body">
         <p>${_('Default system permissions. Each permissions management entity will be created with the following default settings. Check the overwrite checkbox to force any permission changes on already existing settings.')}
         </p>
-        ${h.secure_form(h.route_path('admin_permissions_object_update'), method='POST', request=request)}
+        ${h.secure_form(h.route_path('admin_permissions_object_update'), request=request)}
             <div class="form">
                 <div class="fields">
                     <div class="field">
                         <div class="label">
                             <label for="default_repo_perm">${_('Repository')}:</label>
                         </div>
                         <div class="select">
                             ${h.select('default_repo_perm','',c.repo_perms_choices)}
 
                             ${h.checkbox('overwrite_default_repo','true')}
                             <label for="overwrite_default_repo">
                                 <span class="tooltip" title="${h.tooltip(_('All default permissions on each repository will be reset to chosen permission, note that all custom default permission on repositories will be lost'))}">
                                     ${_('Overwrite Existing Settings')}
                                 </span>
                             </label>
                         </div>
                     </div>
                     <div class="field">
                         <div class="label">
                             <label for="default_group_perm">${_('Repository Groups')}:</label>
                         </div>
                         <div class="select">
                             ${h.select('default_group_perm','',c.group_perms_choices)}
                             ${h.checkbox('overwrite_default_group','true')}
                             <label for="overwrite_default_group">
                                 <span class="tooltip" title="${h.tooltip(_('All default permissions on each repository group will be reset to chosen permission, note that all custom default permission on repository groups will be lost'))}">
                                     ${_('Overwrite Existing Settings')}
                                 </span>
                             </label>
                         </div>
                     </div>
                     <div class="field">
                         <div class="label">
                             <label for="default_group_perm">${_('User Groups')}:</label>
                         </div>
                         <div class="select">
                             ${h.select('default_user_group_perm','',c.user_group_perms_choices)}
                             ${h.checkbox('overwrite_default_user_group','true')}
                             <label for="overwrite_default_user_group">
                                 <span class="tooltip" title="${h.tooltip(_('All default permissions on each user group will be reset to chosen permission, note that all custom default permission on repository groups will be lost'))}">
                                     ${_('Overwrite Existing Settings')}
                                 </span>
                             </label>
                         </div>
                     </div>
 
                     <div class="buttons">
                       ${h.submit('save',_('Save'),class_="btn")}
                       ${h.reset('reset',_('Reset'),class_="btn")}
                     </div>
                 </div>
             </div>
         ${h.end_form()}
     </div>
 </div>
 
 <script>
     $(document).ready(function(){
         var select2Options = {
             containerCssClass: 'drop-menu',
             dropdownCssClass: 'drop-menu-dropdown',
             dropdownAutoWidth: true,
             minimumResultsForSearch: -1
         };
         $("#default_repo_perm").select2(select2Options);
         $("#default_group_perm").select2(select2Options);
         $("#default_user_group_perm").select2(select2Options);
     });
 </script>

rhodecode/templates/admin/permissions/permissions_ssh_keys.mako

@@ -1,91 +1,91 b''
 
 <div class="panel panel-default">
   <div class="panel-heading">
       <h3 class="panel-title">${_('SSH Keys')} - <span id="ssh_keys_count"></span></h3>
 
-      ${h.secure_form(h.route_path('admin_permissions_ssh_keys_update'), method='POST', request=request)}
+      ${h.secure_form(h.route_path('admin_permissions_ssh_keys_update'), request=request)}
         <button class="btn btn-link pull-right" type="submit">${_('Update SSH keys file')}</button>
       ${h.end_form()}
   </div>
   <div class="panel-body">
     <input class="q_filter_box" id="q_filter" size="15" type="text" name="filter" placeholder="${_('quick filter...')}" value=""/>
 
     <div id="repos_list_wrap">
         <table id="ssh_keys_table" class="display"></table>
     </div>
   </div>
 </div>
 
 
 <script type="text/javascript">
 
 $(document).ready(function() {
     var $sshKeyListTable = $('#ssh_keys_table');
 
     var getDatatableCount = function(){
       var table = $sshKeyListTable.dataTable();
       var page = table.api().page.info();
       var  active = page.recordsDisplay;
       var  total = page.recordsTotal;
 
       var _text = _gettext("{0} out of {1} ssh keys").format(active, total);
       $('#ssh_keys_count').text(_text);
     };
 
     // user list
     $sshKeyListTable.DataTable({
       processing: true,
       serverSide: true,
       ajax: "${h.route_path('admin_permissions_ssh_keys_data')}",
       dom: 'rtp',
       pageLength: ${c.visual.admin_grid_items},
       order: [[ 0, "asc" ]],
       columns: [
          { data: {"_": "username",
                   "sort": "username"}, title: "${_('Username')}", className: "td-user" },
          { data: {"_": "fingerprint",
                   "sort": "fingerprint"}, title: "${_('Fingerprint')}", className: "td-type"  },
          { data: {"_": "description",
                   "sort": "description"}, title: "${_('Description')}", className: "td-type"  },
          { data: {"_": "created_on",
                   "sort": "created_on"}, title: "${_('Created on')}", className: "td-time" },
          { data: {"_": "action",
                   "sort": "action"}, title: "${_('Action')}", className: "td-action", orderable: false }
       ],
       language: {
           paginate: DEFAULT_GRID_PAGINATION,
           sProcessing: _gettext('loading...'),
           emptyTable: _gettext("No ssh keys available yet.")
       },
 
       "createdRow": function ( row, data, index ) {
           if (!data['active_raw']){
             $(row).addClass('closed')
           }
       }
     });
 
     $sshKeyListTable.on('xhr.dt', function(e, settings, json, xhr){
         $sshKeyListTable.css('opacity', 1);
     });
 
     $sshKeyListTable.on('preXhr.dt', function(e, settings, data){
         $sshKeyListTable.css('opacity', 0.3);
     });
 
     // refresh counters on draw
     $sshKeyListTable.on('draw.dt', function(){
         getDatatableCount();
     });
 
     // filter
     $('#q_filter').on('keyup',
         $.debounce(250, function() {
             $sshKeyListTable.DataTable().search(
                 $('#q_filter').val()
             ).draw();
         })
     );
 
   });
 </script>

rhodecode/templates/admin/repo_groups/repo_group_add.mako

@@ -1,106 +1,106 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="/base/base.mako"/>
 
 <%def name="title()">
     ${_('Add repository group')}
     %if c.rhodecode_name:
         &middot; ${h.branding(c.rhodecode_name)}
     %endif
 </%def>
 
 <%def name="breadcrumbs_links()">
     ${h.link_to(_('Admin'),h.route_path('admin_home'))}
     &raquo;
     ${h.link_to(_('Repository groups'),h.url('repo_groups'))}
     &raquo;
     ${_('Add Repository Group')}
 </%def>
 
 <%def name="menu_bar_nav()">
     ${self.menu_items(active='admin')}
 </%def>
 
 <%def name="main()">
 <div class="box">
     <!-- box / title -->
     <div class="title">
         ${self.breadcrumbs()}
     </div>
     <!-- end box / title -->
-    ${h.secure_form(h.url('repo_groups'), method='post')}
+    ${h.secure_form(h.url('repo_groups'), request=request)}
     <div class="form">
         <!-- fields -->
         <div class="fields">
              <div class="field">
                 <div class="label">
                     <label for="group_name">${_('Group Name')}:</label>
                 </div>
                 <div class="input">
                     ${h.text('group_name', class_="medium")}
                 </div>
              </div>
 
             <div class="field">
                 <div class="label">
                     <label for="group_description">${_('Description')}:</label>
                 </div>
                 <div class="textarea editor">
                     ${h.textarea('group_description',cols=23,rows=5,class_="medium")}
                     <% metatags_url = h.literal('''<a href="#metatagsShow" onclick="$('#meta-tags-desc').toggle();return false">meta-tags</a>''') %>
                     <span class="help-block">${_('Plain text format with support of {metatags}').format(metatags=metatags_url)|n}</span>
                     <span id="meta-tags-desc" style="display: none">
                         <%namespace name="dt" file="/data_table/_dt_elements.mako"/>
                         ${dt.metatags_help()}
                     </span>
                 </div>
             </div>
 
             <div class="field">
                  <div class="label">
                      <label for="group_parent_id">${_('Group Parent')}:</label>
                  </div>
                  <div class="select">
                      ${h.select('group_parent_id',request.GET.get('parent_group'),c.repo_groups,class_="medium")}
                  </div>
             </div>
 
             <div id="copy_perms" class="field">
                 <div class="label label-checkbox">
                     <label for="group_copy_permissions">${_('Copy Parent Group Permissions')}:</label>
                 </div>
                 <div class="checkboxes">
                     ${h.checkbox('group_copy_permissions', value="True", checked="checked")}
                     <span class="help-block">${_('Copy permission settings from parent repository group.')}</span>
                 </div>
             </div>
 
             <div class="buttons">
               ${h.submit('save',_('Save'),class_="btn")}
             </div>
         </div>
     </div>
     ${h.end_form()}
 </div>
 <script>
     $(document).ready(function(){
         var setCopyPermsOption = function(group_val){
             if(group_val != "-1"){
                 $('#copy_perms').show()
             }
             else{
                 $('#copy_perms').hide();
             }
         }
         $("#group_parent_id").select2({
             'containerCssClass': "drop-menu",
             'dropdownCssClass': "drop-menu-dropdown",
             'dropdownAutoWidth': true
         });
         setCopyPermsOption($('#group_parent_id').val())
         $("#group_parent_id").on("change", function(e) {
             setCopyPermsOption(e.val)
         })
         $('#group_name').focus();
     })
 </script>
 </%def>

rhodecode/templates/admin/repo_groups/repo_group_edit_advanced.mako

@@ -1,64 +1,64 b''
 <%namespace name="base" file="/base/base.mako"/>
 
 <%
  elems = [
     (_('Owner'), lambda:base.gravatar_with_user(c.repo_group.user.email), '', ''),
     (_('Created on'), h.format_date(c.repo_group.created_on), '', ''),
     (_('Is Personal Group'), c.repo_group.personal or False, '', ''),
 
     (_('Total repositories'), c.repo_group.repositories_recursive_count, '', ''),
     (_('Top level repositories'), c.repo_group.repositories.count(), '', c.repo_group.repositories.all()),
 
     (_('Children groups'), c.repo_group.children.count(), '', c.repo_group.children.all()),
  ]
 %>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Repository Group: %s') % c.repo_group.group_name}</h3>
     </div>
     <div class="panel-body">
         ${base.dt_info_panel(elems)}
     </div>
 
 </div>
 
 <div class="panel panel-danger">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Delete repository group')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.url('delete_repo_group', group_name=c.repo_group.group_name),method='delete')}
+        ${h.secure_form(h.url('delete_repo_group', group_name=c.repo_group.group_name),method='delete', request=request)}
             <table class="display">
 
                 <tr>
                     <td>
                         ${_ungettext('This repository group includes %s children repository group.', 'This repository group includes %s children repository groups.', c.repo_group.children.count()) % c.repo_group.children.count()}
                     </td>
                     <td>
                     </td>
                     <td>
                     </td>
                 </tr>
                 <tr>
                     <td>
                         ${_ungettext('This repository group includes %s repository.', 'This repository group includes %s repositories.', c.repo_group.repositories_recursive_count) % c.repo_group.repositories_recursive_count}
                     </td>
                     <td>
                     </td>
                     <td>
                     </td>
                 </tr>
 
             </table>
             <div style="margin: 0 0 20px 0" class="fake-space"></div>
 
             <button class="btn btn-small btn-danger" type="submit"
                 onclick="return confirm('${_('Confirm to delete this group: %s') % (c.repo_group.group_name)}');">
                 ${_('Delete this repository group')}
             </button>
         ${h.end_form()}
     </div>
 </div>
 
 

rhodecode/templates/admin/repo_groups/repo_group_edit_perms.mako

@@ -1,148 +1,148 b''
 <%namespace name="base" file="/base/base.mako"/>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Repository Group Permissions')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.url('edit_repo_group_perms', group_name=c.repo_group.group_name),method='put')}
+        ${h.secure_form(h.url('edit_repo_group_perms', group_name=c.repo_group.group_name),method='put', request=request)}
         <table id="permissions_manage" class="rctable permissions">
             <tr>
                 <th class="td-radio">${_('None')}</th>
                 <th class="td-radio">${_('Read')}</th>
                 <th class="td-radio">${_('Write')}</th>
                 <th class="td-radio">${_('Admin')}</th>
                 <th class="td-user">${_('User/User Group')}</th>
                 <th></th>
             </tr>
             ## USERS
             %for _user in c.repo_group.permissions():
                 %if getattr(_user, 'admin_row', None) or getattr(_user, 'owner_row', None):
                     <tr class="perm_admin_row">
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.none', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.read', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.write', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.admin', 'repository.admin', disabled="disabled")}</td>
                         <td class="td-user">
                             ${base.gravatar(_user.email, 16)}
                             <span class="user">
                                 ${h.link_to_user(_user.username)}
                                 %if getattr(_user, 'admin_row', None):
                                     (${_('super admin')})
                                 %endif
                                 %if getattr(_user, 'owner_row', None):
                                     (${_('owner')})
                                 %endif
                             </span>
                         </td>
                         <td></td>
                     </tr>
                 %else:
                     ##forbid revoking permission from yourself, except if you're an super admin
                     <tr>
                         %if c.rhodecode_user.user_id != _user.user_id or c.rhodecode_user.is_admin:
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'group.none')}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'group.read')}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'group.write')}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'group.admin')}</td>
                         <td class="td-user">
                             ${base.gravatar(_user.email, 16)}
                             <span class="user">
                                 % if _user.username == h.DEFAULT_USER:
                                     ${h.DEFAULT_USER} <span class="user-perm-help-text"> - ${_('permission for all other users')}</span>
                                 % else:
                                     ${h.link_to_user(_user.username)}
                                 % endif
                             </span>
                         </td>
                         <td class="td-action">
                             %if _user.username != h.DEFAULT_USER:
                                 <span  class="btn btn-link btn-danger revoke_perm"
                                   member="${_user.user_id}" member_type="user">
                                 <i class="icon-remove"></i> ${_('Revoke')}
                                 </span>
                             %endif
                         </td>
                         %else:
                             ## special case for current user permissions, we make sure he cannot take his own permissions
                             <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'group.none', disabled="disabled")}</td>
                             <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'group.read', disabled="disabled")}</td>
                             <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'group.write', disabled="disabled")}</td>
                             <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'group.admin', disabled="disabled")}</td>
                             <td class="td-user">
                                 ${base.gravatar(_user.email, 16)}
                                 <span class="user">
                                     % if _user.username == h.DEFAULT_USER:
                                         ${h.DEFAULT_USER} <span class="user-perm-help-text"> - ${_('permission for all other users')}</span>
                                     % else:
                                         ${h.link_to_user(_user.username)}
                                     % endif
                                     <span class="user-perm-help-text">(${_('delegated admin')})</span>
                                 </span>
                             </td>
                             <td></td>
                         %endif
                     </tr>
                 %endif
             %endfor
 
             ## USER GROUPS
             %for _user_group in c.repo_group.permission_user_groups():
                 <tr id="id${id(_user_group.users_group_name)}">
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'group.none')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'group.read')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'group.write')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'group.admin')}</td>
                     <td class="td-componentname">
                         <i class="icon-group" ></i>
                         %if h.HasPermissionAny('hg.admin')():
                          <a href="${h.route_path('edit_user_group',user_group_id=_user_group.users_group_id)}">
                              ${_user_group.users_group_name}
                          </a>
                         %else:
                          ${_user_group.users_group_name}
                         %endif
                     </td>
                     <td class="td-action">
                         <span  class="btn btn-link btn-danger revoke_perm"
                               member="${_user_group.users_group_id}" member_type="user_group">
                         <i class="icon-remove"></i> ${_('Revoke')}
                         </span>
                     </td>
                 </tr>
             %endfor
 
             <tr class="new_members" id="add_perm_input"></tr>
         </table>
         <div id="add_perm" class="link">
             ${_('Add new')}
         </div>
         <div class="fields">
             <div class="field">
                <div class="label label-radio">
                    ${_('Apply to children')}:
                </div>
                <div class="radios">
                    ${h.radio('recursive', 'none', label=_('None'), checked="checked")}
                    ${h.radio('recursive', 'groups', label=_('Repository Groups'))}
                    ${h.radio('recursive', 'repos', label=_('Repositories'))}
                    ${h.radio('recursive', 'all', label=_('Both'))}
                <span class="help-block">${_('Set or revoke permissions to selected types of children of this group, including non-private repositories and other groups if chosen.')}</span>
                </div>
             </div>
         </div>
         <div class="buttons">
           ${h.submit('save',_('Save'),class_="btn btn-primary")}
           ${h.reset('reset',_('Reset'),class_="btn btn-danger")}
         </div>
         ${h.end_form()}
     </div>
 </div>
 <script type="text/javascript">
     $('#add_perm').on('click', function(e){
         addNewPermInput($(this), 'group');
     });
     $('.revoke_perm').on('click', function(e){
         markRevokePermInput($(this), 'group');
     })
 </script>

rhodecode/templates/admin/repo_groups/repo_group_edit_settings.mako

@@ -1,90 +1,90 b''
 ## -*- coding: utf-8 -*-
 <%namespace name="base" file="/base/base.mako"/>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Settings for Repository Group: %s') % c.repo_group.name}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.url('update_repo_group',group_name=c.repo_group.group_name),method='put')}
+        ${h.secure_form(h.url('update_repo_group',group_name=c.repo_group.group_name),method='put', request=request)}
         <div class="form">
             <!-- fields -->
             <div class="fields">
                 <div class="field">
                     <div class="label">
                         <label for="group_name">${_('Group Name')}:</label>
                     </div>
                     <div class="input">
                         ${h.text('group_name',class_='medium')}
                     </div>
                 </div>
 
                 <div class="field badged-field">
                     <div class="label">
                         <label for="user">${_('Owner')}:</label>
                     </div>
                     <div class="input">
                         <div class="badge-input-container">
                             <div class="user-badge">
                                 ${base.gravatar_with_user(c.repo_group.user.email, show_disabled=not c.repo_group.user.active)}
                             </div>
                             <div class="badge-input-wrap">
                                 ${h.text('user', class_="medium", autocomplete="off")}
                             </div>
                         </div>
                         <form:error name="user"/>
                         <p class="help-block">${_('Change owner of this repository group.')}</p>
                     </div>
                 </div>
 
                 <div class="field">
                     <div class="label label-textarea">
                         <label for="group_description">${_('Description')}:</label>
                     </div>
                     <div class="textarea text-area editor">
                         ${h.textarea('group_description',cols=23,rows=5,class_="medium")}
                         <% metatags_url = h.literal('''<a href="#metatagsShow" onclick="$('#meta-tags-desc').toggle();return false">meta-tags</a>''') %>
                         <span class="help-block">${_('Plain text format with support of {metatags}').format(metatags=metatags_url)|n}</span>
                         <span id="meta-tags-desc" style="display: none">
                             <%namespace name="dt" file="/data_table/_dt_elements.mako"/>
                             ${dt.metatags_help()}
                         </span>
                     </div>
                 </div>
 
                 <div class="field">
                     <div class="label">
                         <label for="group_parent_id">${_('Group parent')}:</label>
                     </div>
                     <div class="select">
                         ${h.select('group_parent_id','',c.repo_groups,class_="medium")}
                     </div>
                 </div>
                 <div class="field">
                     <div class="label label-checkbox">
                         <label for="enable_locking">${_('Enable Repository Locking')}:</label>
                     </div>
                     <div class="checkboxes">
                         ${h.checkbox('enable_locking',value="True")}
                         <span class="help-block">${_('Repository locking will be enabled on all subgroups and repositories inside this repository group. Pulling from a repository locks it, and it is unlocked by pushing back by the same user.')}</span>
                     </div>
                 </div>
                 <div class="buttons">
                   ${h.submit('save',_('Save'),class_="btn")}
                   ${h.reset('reset',_('Reset'),class_="btn")}
                 </div>
             </div>
         </div>
         ${h.end_form()}
     </div>
 </div>
 <script>
     $(document).ready(function(){
         $("#group_parent_id").select2({
             'containerCssClass': "drop-menu",
             'dropdownCssClass': "drop-menu-dropdown",
             'dropdownAutoWidth': true
         });
         UsersAutoComplete('user', '${c.rhodecode_user.user_id}');
     })
 </script>

rhodecode/templates/admin/repos/repo_add_base.mako

@@ -1,164 +1,164 b''
 ## -*- coding: utf-8 -*-
 
-${h.secure_form(h.route_path('repo_create'), method='POST', request=request)}
+${h.secure_form(h.route_path('repo_create'), request=request)}
 <div class="form">
     <!-- fields -->
     <div class="fields">
         <div class="field">
             <div class="label">
                 <label for="repo_name">${_('Name')}:</label>
             </div>
             <div class="input">
                 ${h.text('repo_name', class_="medium")}
                 <div class="info-block">
                     <a id="remote_clone_toggle" href="#"><i class="icon-download-alt"></i> ${_('Import Existing Repository ?')}</a>
                 </div>
                 %if not c.rhodecode_user.is_admin:
                     ${h.hidden('user_created',True)}
                 %endif
             </div>
          </div>
         <div id="remote_clone" class="field" style="display: none;">
             <div class="label">
                 <label for="clone_uri">${_('Clone from')}:</label>
             </div>
             <div class="input">
                 ${h.text('clone_uri', class_="medium")}
                 <span class="help-block">
                     <pre>
 - The repository must be accessible over http:// or https://
 - For Git projects it's recommended appending .git to the end of clone url.
 - Make sure to select proper repository type from the below selector before importing it.
 - If your HTTP[S] repository is not publicly accessible,
   add authentication information to the URL: https://username:[e-mail]/repo-name.
 - The Git LFS/Mercurial Largefiles objects will not be imported.
 - For very large repositories, it's recommended to manually copy them into the
   RhodeCode <a href="${h.url('admin_settings_vcs', anchor='vcs-storage-options')}">storage location</a> and run <a href="${h.url('admin_settings_mapping')}">Remap and Rescan</a>.
                     </pre>
                 </span>
             </div>
         </div>
         <div class="field">
             <div class="label">
                 <label for="repo_description">${_('Description')}:</label>
             </div>
             <div class="textarea editor">
                 ${h.textarea('repo_description')}
                 <% metatags_url = h.literal('''<a href="#metatagsShow" onclick="$('#meta-tags-desc').toggle();return false">meta-tags</a>''') %>
                 <span class="help-block">${_('Plain text format with support of {metatags}. Add a README file for longer descriptions').format(metatags=metatags_url)|n}</span>
                 <span id="meta-tags-desc" style="display: none">
                     <%namespace name="dt" file="/data_table/_dt_elements.mako"/>
                     ${dt.metatags_help()}
                 </span>
             </div>
         </div>
         <div class="field">
              <div class="label">
                  <label for="repo_group">${_('Repository Group')}:</label>
              </div>
              <div class="select">
                  ${h.select('repo_group',request.GET.get('parent_group'),c.repo_groups,class_="medium")}
                  % if c.personal_repo_group:
                      <a class="btn" href="#" id="select_my_group" data-personal-group-id="${c.personal_repo_group.group_id}">
                          ${_('Select my personal group (%(repo_group_name)s)') % {'repo_group_name': c.personal_repo_group.group_name}}
                      </a>
                  % endif
                  <span class="help-block">${_('Optionally select a group to put this repository into.')}</span>
              </div>
         </div>
         <div id="copy_perms" class="field">
             <div class="label label-checkbox">
                 <label for="repo_copy_permissions">${_('Copy Parent Group Permissions')}:</label>
             </div>
             <div class="checkboxes">
                 ${h.checkbox('repo_copy_permissions', value="True", checked="checked")}
                 <span class="help-block">${_('Copy permission set from the parent repository group.')}</span>
             </div>
         </div>
         <div class="field">
             <div class="label">
                 <label for="repo_type">${_('Type')}:</label>
             </div>
             <div class="select">
                 ${h.select('repo_type','hg',c.backends)}
                 <span class="help-block">${_('Set the type of repository to create.')}</span>
             </div>
         </div>
         <div class="field">
             <div class="label">
                 <label for="repo_landing_rev">${_('Landing commit')}:</label>
             </div>
             <div class="select">
                 ${h.select('repo_landing_rev','',c.landing_revs,class_="medium")}
                 <span class="help-block">${_('The default commit for file pages, downloads, full text search index, and README generation.')}</span>
             </div>
         </div>
         <div class="field">
             <div class="label label-checkbox">
                 <label for="repo_private">${_('Private Repository')}:</label>
             </div>
             <div class="checkboxes">
                 ${h.checkbox('repo_private',value="True")}
                 <span class="help-block">${_('Private repositories are only visible to people explicitly added as collaborators.')}</span>
             </div>
         </div>
         <div class="buttons">
           ${h.submit('save',_('Save'),class_="btn")}
         </div>
     </div>
 </div>
 <script>
     $(document).ready(function(){
         var setCopyPermsOption = function(group_val){
             if(group_val != "-1"){
                 $('#copy_perms').show()
             }
             else{
                 $('#copy_perms').hide();
             }
         };
 
         $('#remote_clone_toggle').on('click', function(e){
             $('#remote_clone').show();
             e.preventDefault();
         });
 
         if($('#remote_clone input').hasClass('error')){
             $('#remote_clone').show();
         }
         if($('#remote_clone input').val()){
             $('#remote_clone').show();
         }
 
         $("#repo_group").select2({
             'containerCssClass': "drop-menu",
             'dropdownCssClass': "drop-menu-dropdown",
             'dropdownAutoWidth': true,
             'width': "resolve"
         });
 
         setCopyPermsOption($('#repo_group').val());
         $("#repo_group").on("change", function(e) {
             setCopyPermsOption(e.val)
         });
 
         $("#repo_type").select2({
             'containerCssClass': "drop-menu",
             'dropdownCssClass': "drop-menu-dropdown",
             'minimumResultsForSearch': -1,
         });
         $("#repo_landing_rev").select2({
             'containerCssClass': "drop-menu",
             'dropdownCssClass': "drop-menu-dropdown",
             'minimumResultsForSearch': -1,
         });
         $('#repo_name').focus();
 
         $('#select_my_group').on('click', function(e){
             e.preventDefault();
             $("#repo_group").val($(this).data('personalGroupId')).trigger("change");
         })
 
     })
 </script>
 ${h.end_form()}

rhodecode/templates/admin/repos/repo_edit_advanced.mako

@@ -1,210 +1,210 b''
 <%namespace name="base" file="/base/base.mako"/>
 
 <%
  elems = [
     (_('Owner'), lambda:base.gravatar_with_user(c.rhodecode_db_repo.user.email), '', ''),
     (_('Created on'), h.format_date(c.rhodecode_db_repo.created_on), '', ''),
     (_('Updated on'), h.format_date(c.rhodecode_db_repo.updated_on), '', ''),
     (_('Cached Commit id'), lambda: h.link_to(c.rhodecode_db_repo.changeset_cache.get('short_id'), h.route_path('repo_commit',repo_name=c.repo_name,commit_id=c.rhodecode_db_repo.changeset_cache.get('raw_id'))), '', ''),
  ]
 %>
 
 <div class="panel panel-default">
     <div class="panel-heading" id="advanced-info" >
         <h3 class="panel-title">${_('Repository: %s') % c.rhodecode_db_repo.repo_name} <a class="permalink" href="#advanced-info"> ¶</a></h3>
     </div>
     <div class="panel-body">
         ${base.dt_info_panel(elems)}
     </div>
 </div>
 
 
 <div class="panel panel-default">
     <div class="panel-heading" id="advanced-fork">
         <h3 class="panel-title">${_('Fork Reference')} <a class="permalink" href="#advanced-fork"> ¶</a></h3>
     </div>
     <div class="panel-body">
-      ${h.secure_form(h.route_path('edit_repo_advanced_fork', repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
+      ${h.secure_form(h.route_path('edit_repo_advanced_fork', repo_name=c.rhodecode_db_repo.repo_name), request=request)}
 
         % if c.rhodecode_db_repo.fork:
             <div class="panel-body-title-text">${h.literal(_('This repository is a fork of %(repo_link)s') % {'repo_link': h.link_to_if(c.has_origin_repo_read_perm,c.rhodecode_db_repo.fork.repo_name, h.route_path('repo_summary', repo_name=c.rhodecode_db_repo.fork.repo_name))})}
             | <button class="btn btn-link btn-danger" type="submit">Remove fork reference</button></div>
         % endif
 
          <div class="field">
              ${h.hidden('id_fork_of')}
              ${h.submit('set_as_fork_%s' % c.rhodecode_db_repo.repo_name,_('Set'),class_="btn btn-small",)}
          </div>
          <div class="field">
              <span class="help-block">${_('Manually set this repository as a fork of another from the list')}</span>
          </div>
       ${h.end_form()}
     </div>
 </div>
 
 
 <div class="panel panel-default">
     <div class="panel-heading" id="advanced-journal">
         <h3 class="panel-title">${_('Public Journal Visibility')} <a class="permalink" href="#advanced-journal"> ¶</a></h3>
     </div>
     <div class="panel-body">
-      ${h.secure_form(h.route_path('edit_repo_advanced_journal', repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
+      ${h.secure_form(h.route_path('edit_repo_advanced_journal', repo_name=c.rhodecode_db_repo.repo_name), request=request)}
         <div class="field">
         %if c.in_public_journal:
           <button class="btn btn-small" type="submit">
               ${_('Remove from Public Journal')}
           </button>
         %else:
           <button class="btn btn-small" type="submit">
               ${_('Add to Public Journal')}
           </button>
         %endif
         </div>
        <div class="field" >
        <span class="help-block">${_('All actions made on this repository will be visible to everyone following the public journal.')}</span>
        </div>
       ${h.end_form()}
     </div>
 </div>
 
 
 <div class="panel panel-default">
     <div class="panel-heading" id="advanced-locking">
         <h3 class="panel-title">${_('Locking state')} <a class="permalink" href="#advanced-locking"> ¶</a></h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.route_path('edit_repo_advanced_locking', repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
+        ${h.secure_form(h.route_path('edit_repo_advanced_locking', repo_name=c.rhodecode_db_repo.repo_name), request=request)}
 
         %if c.rhodecode_db_repo.locked[0]:
              <div class="panel-body-title-text">${'Locked by %s on %s. Lock reason: %s' % (h.person_by_id(c.rhodecode_db_repo.locked[0]),
              h.format_date(h. time_to_datetime(c.rhodecode_db_repo.locked[1])), c.rhodecode_db_repo.locked[2])}</div>
         %else:
             <div class="panel-body-title-text">${_('This Repository is not currently locked.')}</div>
         %endif
 
         <div class="field" >
             %if c.rhodecode_db_repo.locked[0]:
               ${h.hidden('set_unlock', '1')}
               <button class="btn btn-small" type="submit"
                       onclick="return confirm('${_('Confirm to unlock repository.')}');">
                   <i class="icon-unlock"></i>
                   ${_('Unlock repository')}
               </button>
             %else:
               ${h.hidden('set_lock', '1')}
               <button class="btn btn-small" type="submit"
                       onclick="return confirm('${_('Confirm to lock repository.')}');">
                   <i class="icon-lock"></i>
                   ${_('Lock Repository')}
               </button>
             %endif
          </div>
          <div class="field" >
             <span class="help-block">
                 ${_('Force repository locking. This only works when anonymous access is disabled. Pulling from the repository locks the repository to that user until the same user pushes to that repository again.')}
             </span>
          </div>
         ${h.end_form()}
     </div>
 </div>
 
 <div class="panel panel-danger">
     <div class="panel-heading" id="advanced-delete">
         <h3 class="panel-title">${_('Delete repository')} <a class="permalink" href="#advanced-delete"> ¶</a></h3>
     </div>
     <div class="panel-body">
-      ${h.secure_form(h.route_path('edit_repo_advanced_delete', repo_name=c.repo_name), method='POST', request=request)}
+      ${h.secure_form(h.route_path('edit_repo_advanced_delete', repo_name=c.repo_name), request=request)}
         <table class="display">
             <tr>
                 <td>
                     ${_ungettext('This repository has %s fork.', 'This repository has %s forks.', c.rhodecode_db_repo.forks.count()) % c.rhodecode_db_repo.forks.count()}
                 </td>
                 <td>
                     %if c.rhodecode_db_repo.forks.count():
                         <input type="radio" name="forks" value="detach_forks" checked="checked"/> <label for="forks">${_('Detach forks')}</label>
                     %endif
                 </td>
                 <td>
                     %if c.rhodecode_db_repo.forks.count():
                         <input type="radio" name="forks" value="delete_forks"/> <label for="forks">${_('Delete forks')}</label>
                     %endif
                 </td>
             </tr>
         </table>
         <div style="margin: 0 0 20px 0" class="fake-space"></div>
 
         <div class="field">
             <button class="btn btn-small btn-danger" type="submit"
                     onclick="return confirm('${_('Confirm to delete this repository: %s') % c.repo_name}');">
                 <i class="icon-remove-sign"></i>
                 ${_('Delete This Repository')}
             </button>
         </div>
         <div class="field">
             <span class="help-block">
                 ${_('This repository will be renamed in a special way in order to make it inaccessible to RhodeCode Enterprise and its VCS systems. If you need to fully delete it from the file system, please do it manually, or with rhodecode-cleanup-repos command available in rhodecode-tools.')}
             </span>
         </div>
 
       ${h.end_form()}
     </div>
 </div>
 
 
 <script>
 
 var currentRepoId = ${c.rhodecode_db_repo.repo_id};
 
 var repoTypeFilter = function(data) {
     var results = [];
 
     if (!data.results[0]) {
         return data
     }
 
     $.each(data.results[0].children, function() {
         // filter out the SAME repo, it cannot be used as fork of itself
         if (this.obj.repo_id != currentRepoId) {
             this.id = this.obj.repo_id;
             results.push(this)
         }
     });
     data.results[0].children = results;
     return data;
 };
 
 $("#id_fork_of").select2({
     cachedDataSource: {},
     minimumInputLength: 2,
     placeholder: "${_('Change repository') if c.rhodecode_db_repo.fork else _('Pick repository')}",
     dropdownAutoWidth: true,
     containerCssClass: "drop-menu",
     dropdownCssClass: "drop-menu-dropdown",
     formatResult: formatResult,
     query: $.debounce(250, function(query){
         self = this;
         var cacheKey = query.term;
         var cachedData = self.cachedDataSource[cacheKey];
 
         if (cachedData) {
             query.callback({results: cachedData.results});
         } else {
             $.ajax({
                 url: pyroutes.url('repo_list_data'),
                 data: {'query': query.term, repo_type: '${c.rhodecode_db_repo.repo_type}'},
                 dataType: 'json',
                 type: 'GET',
                 success: function(data) {
                     data = repoTypeFilter(data);
                     self.cachedDataSource[cacheKey] = data;
                     query.callback({results: data.results});
                 },
                 error: function(data, textStatus, errorThrown) {
                     alert("Error while fetching entries.\nError code {0} ({1}).".format(data.status, data.statusText));
                 }
             })
         }
     })
 });
 </script>
 

rhodecode/templates/admin/repos/repo_edit_caches.mako

@@ -1,53 +1,53 b''
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Invalidate Cache for Repository')}</h3>
     </div>
     <div class="panel-body">
 
         <h4>${_('Manually invalidate the repository cache. On the next access a repository cache will be recreated.')}</h4>
 
         <p>
             ${_('Cache purge can be automated by such api call. Can be called periodically in crontab etc.')}
             <br/>
             <code>
             ${h.api_call_example(method='invalidate_cache', args={"repoid": c.rhodecode_db_repo.repo_name})}
             </code>
         </p>
 
-        ${h.secure_form(h.route_path('edit_repo_caches', repo_name=c.repo_name), method='POST', request=request)}
+        ${h.secure_form(h.route_path('edit_repo_caches', repo_name=c.repo_name), request=request)}
         <div class="form">
            <div class="fields">
                ${h.submit('reset_cache_%s' % c.rhodecode_db_repo.repo_name,_('Invalidate repository cache'),class_="btn btn-small",onclick="return confirm('"+_('Confirm to invalidate repository cache')+"');")}
            </div>
         </div>
         ${h.end_form()}
 
     </div>
 </div>
 
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">
             ${(_ungettext('List of repository caches (%(count)s entry)', 'List of repository caches (%(count)s entries)' ,len(c.rhodecode_db_repo.cache_keys)) % {'count': len(c.rhodecode_db_repo.cache_keys)})}
         </h3>
     </div>
     <div class="panel-body">
       <div class="field" >
            <table class="rctable edit_cache">
            <tr>
             <th>${_('Prefix')}</th>
             <th>${_('Key')}</th>
             <th>${_('Active')}</th>
             </tr>
           %for cache in c.rhodecode_db_repo.cache_keys:
               <tr>
                 <td class="td-prefix">${cache.get_prefix() or '-'}</td>
                 <td class="td-cachekey">${cache.cache_key}</td>
                 <td class="td-active">${h.bool2icon(cache.cache_active)}</td>
               </tr>
           %endfor
           </table>
       </div>
     </div>
 </div>

rhodecode/templates/admin/repos/repo_edit_fields.mako

@@ -1,79 +1,79 b''
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Custom extra fields for this repository')}</h3>
     </div>
     <div class="panel-body">
         %if c.visual.repository_fields:
             %if c.repo_fields:
             <div class="emails_wrap">
               <table class="rctable edit_fields">
                 <th>${_('Label')}</th>
                 <th>${_('Key')}</th>
                 <th>${_('Type')}</th>
                 <th>${_('Action')}</th>
 
               %for field in c.repo_fields:
                 <tr>
                     <td class="td-tags">${field.field_label}</td>
                     <td class="td-hash">${field.field_key}</td>
                     <td class="td-type">${field.field_type}</td>
                     <td class="td-action">
-                      ${h.secure_form(h.route_path('edit_repo_fields_delete', repo_name=c.rhodecode_db_repo.repo_name, field_id=field.repo_field_id), method='POST', request=request)}
+                      ${h.secure_form(h.route_path('edit_repo_fields_delete', repo_name=c.rhodecode_db_repo.repo_name, field_id=field.repo_field_id), request=request)}
                             ${h.hidden('del_repo_field',field.repo_field_id)}
                             <button class="btn btn-link btn-danger" type="submit"
                                     onclick="return confirm('${_('Confirm to delete this field: %s') % field.field_key}');">
                                 ${_('Delete')}
                             </button>
                       ${h.end_form()}
                     </td>
                 </tr>
               %endfor
               </table>
             </div>
             %endif
-            ${h.secure_form(h.route_path('edit_repo_fields_create', repo_name=c.repo_name), method='POST', request=request)}
+            ${h.secure_form(h.route_path('edit_repo_fields_create', repo_name=c.repo_name), request=request)}
             <div class="form">
                 <!-- fields -->
                 <div class="fields">
                      <div class="field">
                         <div class="label">
                             <label for="new_field_key">${_('New Field Key')}:</label>
                         </div>
                         <div class="input">
                             ${h.text('new_field_key', class_='medium')}
                         </div>
                      </div>
                      <div class="field">
                         <div class="label">
                             <label for="new_field_label">${_('New Field Label')}:</label>
                         </div>
                         <div class="input">
                             ${h.text('new_field_label', class_='medium', placeholder=_('Enter short label'))}
                         </div>
                      </div>
 
                      <div class="field">
                         <div class="label">
                             <label for="new_field_desc">${_('New Field Description')}:</label>
                         </div>
                         <div class="input">
                             ${h.text('new_field_desc', class_='medium', placeholder=_('Enter a full description for the field'))}
                         </div>
                      </div>
 
                     <div class="buttons">
                       ${h.submit('save',_('Add'),class_="btn")}
                       ${h.reset('reset',_('Reset'),class_="btn")}
                     </div>
                 </div>
             </div>
             ${h.end_form()}
         %else:
           <h2>
             ${_('Extra fields are disabled. You can enable them from the Admin/Settings/Visual page.')}
           </h2>
         %endif
     </div>
 </div>
 
 

rhodecode/templates/admin/repos/repo_edit_issuetracker.mako

@@ -1,109 +1,109 b''
 <%namespace name="its" file="/base/issue_tracker_settings.mako"/>
 
 <div id="repo_issue_tracker" class="${'inherited' if c.settings_model.inherit_global_settings else ''}">
-  ${h.secure_form(h.route_path('edit_repo_issuetracker_update', repo_name=c.repo_name), id="inherit-form", method='POST', request=request)}
+  ${h.secure_form(h.route_path('edit_repo_issuetracker_update', repo_name=c.repo_name), id="inherit-form", request=request)}
       <div class="panel panel-default panel-body">
           <div class="fields">
               <div class="field">
                   <div class="label label-checkbox">
                       <label for="inherit_default_permissions">${_('Inherit from global settings')}:</label>
                   </div>
                   <div class="checkboxes">
                       ${h.checkbox('inherit_global_issuetracker', value='inherited', checked=c.settings_model.inherit_global_settings)}
                       <span class="help-block">
                       ${h.literal(_('Select to inherit global patterns for issue tracker.'))}
                       </span>
                   </div>
               </div>
           </div>
       </div>
 
       <div id="inherit_overlay">
         <div class="panel panel-default">
             <div class="panel-heading">
                 <h3 class="panel-title">${_('Inherited Issue Tracker Patterns')}</h3>
             </div>
             <div class="panel-body">
                 <table class="rctable issuetracker readonly">
           <tr>
               <th>${_('Description')}</th>
               <th>${_('Pattern')}</th>
               <th>${_('Url')}</th>
               <th>${_('Prefix')}</th>
               <th ></th>
           </tr>
               %for uid, entry in c.global_patterns.items():
             <tr id="${uid}">
                 <td class="td-description issuetracker_desc">
                   <span class="entry">
                     ${entry.desc}
                   </span>
                 </td>
                 <td class="td-regex issuetracker_pat">
                   <span class="entry">
                     ${entry.pat}
                   </span>
                 </td>
                 <td class="td-url issuetracker_url">
                   <span class="entry">
                     ${entry.url}
                   </span>
                 </td>
                 <td class="td-prefix issuetracker_pref">
                   <span class="entry">
                     ${entry.pref}
                   </span>
                 </td>
                 <td class="td-action">
                 </td>
             </tr>
           %endfor
 
           </table>
             </div>
         </div>
       </div>
 
       <div id="custom_overlay">
         <div class="panel panel-default">
             <div class="panel-heading">
                 <h3 class="panel-title">${_('Issue Tracker / Wiki Patterns')}</h3>
             </div>
             <div class="panel-body">
                     ${its.issue_tracker_settings_table(
                         patterns=c.repo_patterns.items(),
                         form_url=h.route_path('edit_repo_issuetracker', repo_name=c.rhodecode_db_repo.repo_name),
                         delete_url=h.route_path('edit_repo_issuetracker_delete', repo_name=c.rhodecode_db_repo.repo_name)
                     )}
                   <div class="buttons">
                       <button type="submit" class="btn btn-primary save-inheritance" id="save">${_('Save')}</button>
                       <button type="reset" class="btn reset-inheritance">${_('Reset')}</button>
                   </div>
             </div>
         </div>
       </div>
 
 
   ${h.end_form()}
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Test Patterns')}</h3>
     </div>
     <div class="panel-body">
         ${its.issue_tracker_new_row()}
         ${its.issue_tracker_settings_test(test_url=h.route_path('edit_repo_issuetracker_test', repo_name=c.rhodecode_db_repo.repo_name))}
     </div>
 </div>
 
 </div>
 
 <script>
   $('#inherit_global_issuetracker').on('change', function(e){
     $('#repo_issue_tracker').toggleClass('inherited',this.checked);
   });
 
   $('.reset-inheritance').on('click', function(e){
      $('#inherit_global_issuetracker').prop('checked', false).change();
   });
 </script>

rhodecode/templates/admin/repos/repo_edit_permissions.mako

@@ -1,123 +1,123 b''
 <%namespace name="base" file="/base/base.mako"/>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Repository Permissions')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.route_path('edit_repo_perms', repo_name=c.repo_name), method='POST', request=request)}
+        ${h.secure_form(h.route_path('edit_repo_perms', repo_name=c.repo_name), request=request)}
         <table id="permissions_manage" class="rctable permissions">
             <tr>
                 <th class="td-radio">${_('None')}</th>
                 <th class="td-radio">${_('Read')}</th>
                 <th class="td-radio">${_('Write')}</th>
                 <th class="td-radio">${_('Admin')}</th>
                 <th class="td-owner">${_('User/User Group')}</th>
                 <th></th>
             </tr>
             ## USERS
             %for _user in c.rhodecode_db_repo.permissions():
                 %if getattr(_user, 'admin_row', None) or getattr(_user, 'owner_row', None):
                     <tr class="perm_admin_row">
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.none', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.read', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.write', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.admin', 'repository.admin', disabled="disabled")}</td>
                         <td class="td-user">
                             ${base.gravatar(_user.email, 16)}
                             ${h.link_to_user(_user.username)}
                             %if getattr(_user, 'admin_row', None):
                                 (${_('super admin')})
                             %endif
                             %if getattr(_user, 'owner_row', None):
                                 (${_('owner')})
                             %endif
                         </td>
                         <td></td>
                     </tr>
                 %elif _user.username == h.DEFAULT_USER and c.rhodecode_db_repo.private:
                     <tr>
                         <td colspan="4">
                             <span class="private_repo_msg">
                             <strong title="${h.tooltip(_user.permission)}">${_('private repository')}</strong>
                             </span>
                         </td>
                         <td class="private_repo_msg">
                             ${base.gravatar(h.DEFAULT_USER_EMAIL, 16)}
                             ${h.DEFAULT_USER} - ${_('only users/user groups explicitly added here will have access')}</td>
                         <td></td>
                     </tr>
                 %else:
                     <tr>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.none', checked=_user.permission=='repository.none')}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.read', checked=_user.permission=='repository.read')}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.write', checked=_user.permission=='repository.write')}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.admin', checked=_user.permission=='repository.admin')}</td>
                         <td class="td-user">
                             ${base.gravatar(_user.email, 16)}
                             <span class="user">
                                 % if _user.username == h.DEFAULT_USER:
                                     ${h.DEFAULT_USER} <span class="user-perm-help-text"> - ${_('permission for all other users')}</span>
                                 % else:
                                     ${h.link_to_user(_user.username)}
                                 % endif
                             </span>
                         </td>
                         <td class="td-action">
                           %if _user.username != h.DEFAULT_USER:
                             <span class="btn btn-link btn-danger revoke_perm"
                                   member="${_user.user_id}" member_type="user">
                             <i class="icon-remove"></i> ${_('Revoke')}
                             </span>
                           %endif
                         </td>
                     </tr>
                 %endif
             %endfor
 
             ## USER GROUPS
             %for _user_group in c.rhodecode_db_repo.permission_user_groups():
                 <tr>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.none', checked=_user_group.permission=='repository.none')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.read', checked=_user_group.permission=='repository.read')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.write', checked=_user_group.permission=='repository.write')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.admin', checked=_user_group.permission=='repository.admin')}</td>
                     <td class="td-componentname">
                         <i class="icon-group" ></i>
                         %if h.HasPermissionAny('hg.admin')():
                          <a href="${h.route_path('edit_user_group',user_group_id=_user_group.users_group_id)}">
                              ${_user_group.users_group_name}
                          </a>
                         %else:
                          ${_user_group.users_group_name}
                         %endif
                     </td>
                     <td class="td-action">
                         <span class="btn btn-link btn-danger revoke_perm"
                               member="${_user_group.users_group_id}" member_type="user_group">
                         <i class="icon-remove"></i> ${_('Revoke')}
                         </span>
                     </td>
                 </tr>
             %endfor
             <tr class="new_members" id="add_perm_input"></tr>
         </table>
         <div id="add_perm" class="link">
             ${_('Add new')}
         </div>
         <div class="buttons">
           ${h.submit('save',_('Save'),class_="btn btn-primary")}
           ${h.reset('reset',_('Reset'),class_="btn btn-danger")}
         </div>
         ${h.end_form()}
     </div>
 </div>
 
 <script type="text/javascript">
     $('#add_perm').on('click', function(e){
         addNewPermInput($(this), 'repository');
     });
     $('.revoke_perm').on('click', function(e){
         markRevokePermInput($(this), 'repository');
     });
 </script>

rhodecode/templates/admin/repos/repo_edit_remote.mako

@@ -1,40 +1,40 b''
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Remote url')}</h3>
     </div>
     <div class="panel-body">
 
         <h4>${_('Manually pull changes from external repository.')}</h4>
 
         %if c.rhodecode_db_repo.clone_uri:
 
             ${_('Remote mirror url')}:
             <a href="${c.rhodecode_db_repo.clone_uri}">${c.rhodecode_db_repo.clone_uri_hidden}</a>
 
             <p>
                 ${_('Pull can be automated by such api call. Can be called periodically in crontab etc.')}
                 <br/>
                 <code>
                 ${h.api_call_example(method='pull', args={"repoid": c.rhodecode_db_repo.repo_name})}
                 </code>
             </p>
 
-            ${h.secure_form(h.route_path('edit_repo_remote_pull', repo_name=c.repo_name), method='POST', request=request)}
+            ${h.secure_form(h.route_path('edit_repo_remote_pull', repo_name=c.repo_name), request=request)}
             <div class="form">
                <div class="fields">
                    ${h.submit('remote_pull_%s' % c.rhodecode_db_repo.repo_name,_('Pull changes from remote location'),class_="btn btn-small",onclick="return confirm('"+_('Confirm to pull changes from remote side')+"');")}
                </div>
             </div>
             ${h.end_form()}
         %else:
 
           ${_('This repository does not have any remote mirror url set.')}
           <a href="${h.route_path('edit_repo', repo_name=c.rhodecode_db_repo.repo_name)}">${_('Set remote url.')}</a>
           <br/>
           <br/>
           <button class="btn disabled" type="submit" disabled="disabled">
             ${_('Pull changes from remote location')}
           </button>
         %endif
     </div>
 </div>

rhodecode/templates/admin/repos/repo_edit_settings.mako

@@ -1,266 +1,266 b''
 ## -*- coding: utf-8 -*-
 <%namespace name="base" file="/base/base.mako"/>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Settings for Repository: %s') % c.rhodecode_db_repo.repo_name}</h3>
     </div>
     <div class="panel-body">
-    ${h.secure_form(h.route_path('edit_repo', repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
+    ${h.secure_form(h.route_path('edit_repo', repo_name=c.rhodecode_db_repo.repo_name), request=request)}
     <div class="form">
         <!-- fields -->
         <div class="fields">
 
             <div class="field">
                 <div class="label">
                     <label for="repo_name">${_('Name')}:</label>
                 </div>
                 <div class="input">
                     ${c.form['repo_name'].render(css_class='medium', oid='repo_name')|n}
                     ${c.form.render_error(request, c.form['repo_name'])|n}
 
                     <p class="help-block">${_('Non-changeable id')}: `_${c.rhodecode_db_repo.repo_id}` <span><a href="#" onclick="$('#clone_id').toggle();return false">${_('what is that ?')}</a></span></p>
                     <p id="clone_id" style="display:none;">
                         ${_('URL by id')}: `${c.rhodecode_db_repo.clone_url(with_id=True)}` <br/>
                         ${_('''In case this repository is renamed or moved into another group the repository url changes.
                                Using above url guarantees that this repository will always be accessible under such url.
                                Useful for CI systems, or any other cases that you need to hardcode the url into 3rd party service.''')}</p>
                 </div>
            </div>
 
            <div class="field">
                 <div class="label">
                     <label for="repo_group">${_('Repository group')}:</label>
                 </div>
                 <div class="select">
                     ${c.form['repo_group'].render(css_class='medium', oid='repo_group')|n}
                     ${c.form.render_error(request, c.form['repo_group'])|n}
 
                     % if c.personal_repo_group:
                          <a class="btn" href="#" data-personal-group-name="${c.personal_repo_group.group_name}" data-personal-group-id="${c.personal_repo_group.group_id}" onclick="selectMyGroup(this); return false">
                              ${_('Select my personal group (`%(repo_group_name)s`)') % {'repo_group_name': c.personal_repo_group.group_name}}
                          </a>
                     % endif
                     <p class="help-block">${_('Optional select a group to put this repository into.')}</p>
                 </div>
            </div>
 
            % if c.rhodecode_db_repo.repo_type != 'svn':
            <div class="field">
                <div class="label">
                    <label for="clone_uri">${_('Remote uri')}:</label>
                </div>
                <div class="input">
                    %if c.rhodecode_db_repo.clone_uri:
                     ## display, if we don't have any errors
                     % if not c.form['repo_clone_uri'].error:
                     <div id="clone_uri_hidden" class='text-as-placeholder'>
                         <span id="clone_uri_hidden_value">${c.rhodecode_db_repo.clone_uri_hidden}</span>
                         <span class="link" id="edit_clone_uri"><i class="icon-edit"></i>${_('edit')}</span>
                     </div>
                     % endif
 
                     ## alter field
                     <div id="alter_clone_uri" style="${'' if c.form['repo_clone_uri'].error else 'display: none'}">
                         ${c.form['repo_clone_uri'].render(css_class='medium', oid='clone_uri', placeholder=_('enter new value, or leave empty to remove'))|n}
                         ${c.form.render_error(request, c.form['repo_clone_uri'])|n}
                         % if c.form['repo_clone_uri'].error:
                             ## we got error from form subit, means we modify the url
                             ${h.hidden('repo_clone_uri_change', 'MOD')}
                         % else:
                             ${h.hidden('repo_clone_uri_change', 'OLD')}
                         % endif
 
                         % if not c.form['repo_clone_uri'].error:
                         <span class="link" id="cancel_edit_clone_uri">${_('cancel')}</span>
                         % endif
 
                     </div>
                    %else:
                     ## not set yet, display form to set it
                     ${c.form['repo_clone_uri'].render(css_class='medium', oid='clone_uri')|n}
                     ${c.form.render_error(request, c.form['repo_clone_uri'])|n}
                     ${h.hidden('repo_clone_uri_change', 'NEW')}
                    %endif
                  <p id="alter_clone_uri_help_block" class="help-block">
                      <% pull_link = h.literal(h.link_to('remote sync', h.route_path('edit_repo_remote', repo_name=c.repo_name))) %>
                      ${_('http[s] url where from repository was imported, this field can used for doing {pull_link}.').format(pull_link=pull_link)|n} <br/>
                      ${_('This field is stored encrypted inside Database, a format of http://user:[e-mail]/repo_name can be used and will be hidden from display.')}
                  </p>
                </div>
             </div>
            % else:
            ${h.hidden('repo_clone_uri', '')}
            % endif
 
             <div class="field">
                 <div class="label">
                     <label for="repo_landing_commit_ref">${_('Landing commit')}:</label>
                 </div>
                 <div class="select">
                     ${c.form['repo_landing_commit_ref'].render(css_class='medium', oid='repo_landing_commit_ref')|n}
                     ${c.form.render_error(request, c.form['repo_landing_commit_ref'])|n}
                     <p class="help-block">${_('Default commit for files page, downloads, full text search index and readme')}</p>
                 </div>
             </div>
 
             <div class="field badged-field">
                 <div class="label">
                     <label for="repo_owner">${_('Owner')}:</label>
                 </div>
                 <div class="input">
                     <div class="badge-input-container">
                         <div class="user-badge">
                             ${base.gravatar_with_user(c.rhodecode_db_repo.user.email or c.rhodecode_db_repo.user.username, show_disabled=not c.rhodecode_db_repo.user.active)}
                         </div>
                         <div class="badge-input-wrap">
                             ${c.form['repo_owner'].render(css_class='medium', oid='repo_owner')|n}
                         </div>
                     </div>
                     ${c.form.render_error(request, c.form['repo_owner'])|n}
                     <p class="help-block">${_('Change owner of this repository.')}</p>
                 </div>
             </div>
 
             <div class="field">
                 <div class="label label-textarea">
                     <label for="repo_description">${_('Description')}:</label>
                 </div>
                 <div class="textarea text-area editor">
                     ${c.form['repo_description'].render(css_class='medium', oid='repo_description')|n}
                     ${c.form.render_error(request, c.form['repo_description'])|n}
 
                     <% metatags_url = h.literal('''<a href="#metatagsShow" onclick="$('#meta-tags-desc').toggle();return false">meta-tags</a>''') %>
                     <span class="help-block">${_('Plain text format with support of {metatags}. Add a README file for longer descriptions').format(metatags=metatags_url)|n}</span>
                     <span id="meta-tags-desc" style="display: none">
                         <%namespace name="dt" file="/data_table/_dt_elements.mako"/>
                         ${dt.metatags_help()}
                     </span>
                 </div>
             </div>
 
             <div class="field">
                 <div class="label label-checkbox">
                     <label for="${c.form['repo_private'].oid}">${_('Private repository')}:</label>
                 </div>
                 <div class="checkboxes">
                     ${c.form['repo_private'].render(css_class='medium')|n}
                     ${c.form.render_error(request, c.form['repo_private'])|n}
                     <span class="help-block">${_('Private repositories are only visible to people explicitly added as collaborators.')}</span>
                 </div>
             </div>
             <div class="field">
                 <div class="label label-checkbox">
                     <label for="${c.form['repo_enable_statistics'].oid}">${_('Enable statistics')}:</label>
                 </div>
                 <div class="checkboxes">
                     ${c.form['repo_enable_statistics'].render(css_class='medium')|n}
                     ${c.form.render_error(request, c.form['repo_enable_statistics'])|n}
                     <span class="help-block">${_('Enable statistics window on summary page.')}</span>
                 </div>
             </div>
             <div class="field">
                 <div class="label label-checkbox">
                     <label for="${c.form['repo_enable_downloads'].oid}">${_('Enable downloads')}:</label>
                 </div>
                 <div class="checkboxes">
                     ${c.form['repo_enable_downloads'].render(css_class='medium')|n}
                     ${c.form.render_error(request, c.form['repo_enable_downloads'])|n}
                     <span class="help-block">${_('Enable download menu on summary page.')}</span>
                 </div>
             </div>
             <div class="field">
                 <div class="label label-checkbox">
                     <label for="${c.form['repo_enable_locking'].oid}">${_('Enable automatic locking')}:</label>
                 </div>
                 <div class="checkboxes">
                     ${c.form['repo_enable_locking'].render(css_class='medium')|n}
                     ${c.form.render_error(request, c.form['repo_enable_locking'])|n}
                     <span class="help-block">${_('Enable automatic locking on repository. Pulling from this repository creates a lock that can be released by pushing back by the same user')}</span>
                 </div>
             </div>
 
             %if c.visual.repository_fields:
               ## EXTRA FIELDS
               %for field in c.repo_fields:
                 <div class="field">
                     <div class="label">
                         <label for="${field.field_key_prefixed}">${field.field_label} (${field.field_key}):</label>
                     </div>
                     <div class="input input-medium">
                         ${h.text(field.field_key_prefixed, field.field_value, class_='medium')}
                         %if field.field_desc:
                           <span class="help-block">${field.field_desc}</span>
                         %endif
                     </div>
                  </div>
               %endfor
             %endif
             <div class="buttons">
               ${h.submit('save',_('Save'),class_="btn")}
               ${h.reset('reset',_('Reset'),class_="btn")}
             </div>
         </div>
     </div>
     ${h.end_form()}
   </div>
 </div>
 
 <script>
     $(document).ready(function(){
         var cloneUrl = function() {
           var alterButton = $('#alter_clone_uri');
           var editButton = $('#edit_clone_uri');
           var cancelEditButton = $('#cancel_edit_clone_uri');
           var hiddenUrl = $('#clone_uri_hidden');
           var hiddenUrlValue = $('#clone_uri_hidden_value');
           var input = $('#clone_uri');
           var helpBlock = $('#alter_clone_uri_help_block');
           var changedFlag = $('#repo_clone_uri_change');
           var originalText = helpBlock.html();
           var obfuscatedUrl = hiddenUrlValue.html();
 
           var edit = function(e) {
             alterButton.show();
             editButton.hide();
             hiddenUrl.hide();
 
             //add the old value next to input for verification
             helpBlock.html("(" + obfuscatedUrl + ")" + "<br\>" + originalText);
             changedFlag.val('MOD');
           };
 
           var cancelEdit = function(e) {
             alterButton.hide();
             editButton.show();
             hiddenUrl.show();
 
             helpBlock.html(originalText);
             changedFlag.val('OLD');
             input.val('');
           };
 
           var initEvents = function() {
             editButton.on('click', edit);
             cancelEditButton.on('click', cancelEdit);
           };
 
           var setInitialState = function() {
             if (input.hasClass('error')) {
               alterButton.show();
               editButton.hide();
               hiddenUrl.hide();
             }
           };
 
           setInitialState();
           initEvents();
         }();
 
         selectMyGroup = function(element) {
             $("#repo_group").val($(element).data('personalGroupId')).trigger("change");
         };
 
         UsersAutoComplete('repo_owner', '${c.rhodecode_user.user_id}');
     });
 </script>

rhodecode/templates/admin/repos/repo_edit_statistics.mako

@@ -1,22 +1,22 b''
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Repository statistics')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.route_path('edit_repo_statistics_reset', repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
+        ${h.secure_form(h.route_path('edit_repo_statistics_reset', repo_name=c.rhodecode_db_repo.repo_name), request=request)}
         <div class="form">
             <div class="fields">
                <div class="field" >
                 <dl class="dl-horizontal settings">
                     <dt>${_('Processed commits')}:</dt><dd>${c.stats_revision}/${c.repo_last_rev}</dd>
                     <dt>${_('Processed progress')}:</dt><dd>${c.stats_percentage}%</dd>
                 </dl>
                </div>
                 ${h.submit('reset_stats_%s' % c.rhodecode_db_repo.repo_name,_('Reset statistics'),class_="btn btn-small",onclick="return confirm('"+_('Confirm to remove current statistics')+"');")}
            </div>
         </div>
         ${h.end_form()}
     </div>
 </div>
 
 

rhodecode/templates/admin/repos/repo_edit_strip.mako

@@ -1,197 +1,197 b''
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Strip commits from repository')}</h3>
     </div>
     <div class="panel-body">
         %if c.rhodecode_db_repo.repo_type != 'svn':
             <h4>${_('Please provide up to %d commits commits to strip') % c.strip_limit}</h4>
             <p>
                 ${_('In the first step commits will be verified for existance in the repository')}. </br>
                 ${_('In the second step, correct commits will be available for stripping')}.
             </p>
-            ${h.secure_form(h.route_path('strip_check', repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
+            ${h.secure_form(h.route_path('strip_check', repo_name=c.rhodecode_db_repo.repo_name), request=request)}
                 <div id="change_body" class="field">
                     <div id="box-1" class="inputx locked_input">
                         <input class="text" id="changeset_id-1" name="changeset_id-1" size="59"
                               placeholder="${_('Enter full 40 character commit sha')}" type="text" value="">
                         <div id="plus_icon-1" class="btn btn-default plus_input_button" onclick="addNew(1);return false">
                             <i class="icon-plus">${_('Add another commit')}</i>
                         </div>
                     </div>
                 </div>
 
                 <div id="results" style="display:none; padding: 10px 0px;"></div>
 
                 <div class="buttons">
                    <button id="strip_action" class="btn btn-small btn-primary" onclick="checkCommits();return false">
                    ${_('Check commits')}
                    </button>
                 </div>
 
             ${h.end_form()}
         %else:
            <h4>${_('Sorry this functionality is not available for SVN repository')}</h4>
         %endif
     </div>
 </div>
 
 
 <script>
 var plus_leaf = 1;
 
 addNew = function(number){
     if (number >= ${c.strip_limit}){
         return;
     }
     var minus = '<i class="icon-minus">${_('Remove')}</i>';
     $('#plus_icon-'+number).detach();
     number++;
 
     var input = '<div id="box-'+number+'" class="inputx locked_input">'+
                '<input class="text" id="changeset_id-'+number+'" name="changeset_id-'+number+'"  size="59" type="text" value=""' +
             'placeholder="${_('Enter full 40 character commit sha')}">'+
                '<div  id="plus_icon-'+number+'" class="btn btn-default plus_input_button" onclick="addNew('+number+');return false">'+
                    '<i class="icon-plus">${_('Add another commit')}</i>'+
                '</div>'+
                '<div  id="minus_icon-'+number+'" class="btn btn-default minus_input_button" onclick="delOld('+(number)+');return false">'+
                 minus +
                '</div>' +
             '</div>';
     $('#change_body').append(input);
     plus_leaf++;
 };
 
 reIndex = function(number){
     for(var i=number;i<=plus_leaf;i++){
         var check = $('#box-'+i);
         if (check.length == 0){
             var change = $('#box-'+(i+1));
             change.attr('id','box-'+i);
             var plus = $('#plus_icon-'+(i+1));
 
             if (plus.length != 0){
                 plus.attr('id','plus_icon-'+i);
                 plus.attr('onclick','addNew('+i+');return false');
                 plus_leaf--;
             }
             var minus = $('#minus_icon-'+(i+1));
 
             minus.attr('id','minus_icon-'+i);
 
             minus.attr('onclick','delOld('+i+');re' +
             'turn false');
             var input = $('input#changeset_id-'+(i+1));
             input.attr('name','changeset_id-'+i);
             input.attr('id','changeset_id-'+i);
         }
     }
 };
 
 delOld = function(number){
     $('#box-'+number).remove();
     number = number - 1;
     var box = $('#box-'+number);
     var plus =  '<div  id="plus_icon-'+number+'" class="btn btn-default plus_input_button" onclick="addNew('+number +');return false">'+
             '<i id="i_plus_icon-'+number+'" class="icon-plus">${_('Add another commit')}</i></div>';
     var minus = $('#minus_icon-'+number);
     if(number +1 == plus_leaf){
         minus.detach();
         box.append(plus);
         box.append(minus);
         plus_leaf --;
     }
     reIndex(number+1);
 
 };
 
 var resultData = {
     'csrf_token': CSRF_TOKEN
 };
 
 checkCommits = function() {
     var postData = $('form').serialize();
     $('#results').show();
     $('#results').html('<h4>${_('Checking commits')}...</h4>');
     var url = "${h.route_path('strip_check', repo_name=c.rhodecode_db_repo.repo_name)}";
     var btn = $('#strip_action');
     btn.attr('disabled', 'disabled');
     btn.addClass('disabled');
 
     var success = function (data) {
         resultData = {
             'csrf_token': CSRF_TOKEN
         };
         var i = 0;
         var result = '<ol>';
         $.each(data, function(index, value){
             i= index;
             var box = $('#box-'+index);
             if (value.rev){
                 resultData[index] = JSON.stringify(value);
 
                 var verifiedHtml = (
                         '<li style="line-height:1.2em">' +
                             '<code>{0}</code>' +
                             '{1}' +
                             '<div style="white-space:pre">' +
                             'author: {2}\n' +
                             'description: {3}' +
                             '</div>' +
                         '</li>').format(
                             value.rev,
                             "${_(' commit verified positive')}",
                             value.author, value.comment
                             );
                 result += verifiedHtml;
             }
             else {
                 var verifiedHtml = (
                         '<li style="line-height:1.2em">' +
                             '<code><strike>{0}</strike></code>' +
                             '{1}' +
                         '</li>').format(
                             value.commit,
                             "${_(' commit verified negative')}"
                             );
                 result += verifiedHtml;
             }
             box.remove();
         });
         result += '</ol>';
         var box = $('#box-'+(parseInt(i)+1));
         box.remove();
         $('#results').html(result);
     };
 
     btn.html('Strip');
     btn.removeAttr('disabled');
     btn.removeClass('disabled');
     btn.attr('onclick','strip();return false;');
     ajaxPOST(url, postData, success, null);
 };
 
 strip = function() {
     var url = "${h.route_path('strip_execute', repo_name=c.rhodecode_db_repo.repo_name)}";
     var success = function(data) {
         var result = '<h4>Strip executed</h4><ol>';
         $.each(data, function(index, value){
              if(data[index]) {
                  result += '<li><code>' +index+ '</code> ${_(' commit striped successfully')}' + '</li>';
              }
              else {
                  result += '<li><code>' +index+ '</code> ${_(' commit strip failed')}' + '</li>';
              }
         });
         if ($.isEmptyObject(data)) {
             result += '<li>Nothing done...</li>'
         }
         result += '</ol>';
         $('#results').html(result);
 
     };
     ajaxPOST(url, resultData, success, null);
     var btn = $('#strip_action');
     btn.remove();
 
 };
 </script>

rhodecode/templates/admin/repos/repo_edit_vcs.mako

@@ -1,73 +1,73 b''
 <%namespace name="vcss" file="/base/vcs_settings.mako"/>
 
 <div id="repo_vcs_settings" class="${'inherited' if c.inherit_global_settings else ''}">
-    ${h.secure_form(h.route_path('edit_repo_vcs_update', repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
+    ${h.secure_form(h.route_path('edit_repo_vcs_update', repo_name=c.rhodecode_db_repo.repo_name), request=request)}
         <div class="form panel panel-default">
             <div class="fields panel-body">
                 <div class="field">
                     <div class="label label-checkbox">
                         <label for="inherit_global_settings">${_('Inherit from global settings')}:</label>
                     </div>
                     <div class="checkboxes">
                         ${h.checkbox('inherit_global_settings',value=True)}
                         <span class="help-block">${h.literal(_('Select to inherit global vcs settings.'))}</span>
                     </div>
                 </div>
             </div>
         </div>
 
         <div id="inherit_overlay_vcs_default">
             <div>
                 ${vcss.vcs_settings_fields(
                     suffix='_inherited',
                     svn_tag_patterns=c.global_svn_tag_patterns,
                     svn_branch_patterns=c.global_svn_branch_patterns,
                     repo_type=c.rhodecode_db_repo.repo_type,
                     disabled='disabled'
                 )}
             </div>
         </div>
 
         <div id="inherit_overlay_vcs_custom">
             <div>
                 ${vcss.vcs_settings_fields(
                     suffix='',
                     svn_tag_patterns=c.svn_tag_patterns,
                     svn_branch_patterns=c.svn_branch_patterns,
                     repo_type=c.rhodecode_db_repo.repo_type
                 )}
             </div>
         </div>
 
         <div class="buttons">
                 ${h.submit('save',_('Save settings'),class_="btn")}
                 ${h.reset('reset',_('Reset'),class_="btn")}
         </div>
 
     ${h.end_form()}
 </div>
 
 <script type="text/javascript">
 
     function ajaxDeletePattern(pattern_id, field_id) {
         var sUrl = "${h.route_path('edit_repo_vcs_svn_pattern_delete', repo_name=c.rhodecode_db_repo.repo_name)}";
         var callback =  function (o) {
             var elem = $("#"+field_id);
             elem.remove();
         };
         var postData = {
             'delete_svn_pattern': pattern_id,
             'csrf_token': CSRF_TOKEN
         };
         var request = $.post(sUrl, postData)
             .done(callback)
             .fail(function (data, textStatus, errorThrown) {
                 alert("Error while deleting hooks.\nError code {0} ({1}). URL: {2}".format(data.status,data.statusText,$(this)[0].url));
             });
     }
 
     $('#inherit_global_settings').on('change', function(e){
         $('#repo_vcs_settings').toggleClass('inherited', this.checked);
     });
 
 </script>

rhodecode/templates/admin/settings/settings_email.mako

@@ -1,56 +1,56 b''
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Email Configuration')}</h3>
     </div>
     <div class="panel-body">
         <%
          elems = [
             (_('Email prefix'), c.rhodecode_ini.get('email_prefix'), ''),
             (_('RhodeCode email from'), c.rhodecode_ini.get('app_email_from'), ''),
             (_('Error email from'), c.rhodecode_ini.get('error_email_from'), ''),
             (_('Error email recipients'), c.rhodecode_ini.get('email_to'), ''),
 
             (_('SMTP server'), c.rhodecode_ini.get('smtp_server'), ''),
             (_('SMTP username'), c.rhodecode_ini.get('smtp_username'), ''),
             (_('SMTP password'), '%s chars' % len(c.rhodecode_ini.get('smtp_password', '')), ''),
             (_('SMTP port'), c.rhodecode_ini.get('smtp_port'), ''),
 
             (_('SMTP use TLS'), c.rhodecode_ini.get('smtp_use_tls'), ''),
             (_('SMTP use SSL'), c.rhodecode_ini.get('smtp_use_ssl'), ''),
             (_('SMTP auth'), c.rhodecode_ini.get('smtp_auth'), ''),
          ]
         %>
         <dl class="dl-horizontal settings">
         %for dt, dd, tt in elems:
           <dt >${dt}:</dt>
           <dd  title="${h.tooltip(tt)}">${dd}</dd>
         %endfor
         </dl>
     </div>
 </div>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Test Email')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.url('admin_settings_email'), method='post')}
+        ${h.secure_form(h.url('admin_settings_email'), request=request)}
 
             <div class="field input">
                 ${h.text('test_email', size=60, placeholder=_('enter valid email'))}
             </div>
             <div class="field">
                 <span class="help-block">
                     ${_('Send an auto-generated email from this server to above email...')}
                 </span>
             </div>
             <div class="buttons">
                 ${h.submit('send',_('Send'),class_="btn")}
             </div>
         ${h.end_form()}
     </div>
 </div>
 
 
 
 

rhodecode/templates/admin/settings/settings_global.mako

@@ -1,295 +1,295 b''
-${h.secure_form(h.url('admin_settings_global'), method='post')}
+${h.secure_form(h.url('admin_settings_global'), request=request)}
 
 <div class="panel panel-default">
     <div class="panel-heading" id="branding-options">
         <h3 class="panel-title">${_('Branding')} <a class="permalink" href="#branding-options"> ¶</a></h3>
     </div>
     <div class="panel-body">
         <div class="label">
             <label for="rhodecode_title">${_('Title')}</label>
         </div>
         <div class="field input">
             ${h.text('rhodecode_title',size=60)}
         </div>
         <div class="field">
             <span class="help-block">
                 ${_('Set a custom title for your RhodeCode instance (limited to 40 characters).')}
             </span>
         </div>
         <div class="label">
             <label for="rhodecode_realm">${_('HTTP[S] authentication realm')}</label>
         </div>
         <div class="field input">
             ${h.text('rhodecode_realm',size=60)}
         </div>
         <div class="field">
             <span class="help-block">
                 ${_('Set a custom text that is shown as authentication message to clients trying to connect.')}
             </span>
         </div>
     </div>
 </div>
 
 
 <div class="panel panel-default">
     <div class="panel-heading" id="personal-group-options">
         <h3 class="panel-title">${_('Personal Repository Group')} <a class="permalink" href="#personal-group-options"> ¶</a></h3>
     </div>
     <div class="panel-body">
         <div class="checkbox">
             ${h.checkbox('rhodecode_create_personal_repo_group','True')}
             <label for="rhodecode_create_personal_repo_group">${_('Create Personal Repository Group')}</label>
         </div>
         <span class="help-block">
             ${_('Always create Personal Repository Groups for new users.')} <br/>
             ${_('When creating new users from add user form or API you can still turn this off via a checkbox or flag')}
         </span>
 
         <div class="label">
             <label for="rhodecode_personal_repo_group_pattern">${_('Personal Repo Group Pattern')}</label>
         </div>
         <div class="field input">
             ${h.text('rhodecode_personal_repo_group_pattern',size=60, placeholder=c.personal_repo_group_default_pattern)}
         </div>
         <span class="help-block">
             ${_('Pattern used to create Personal Repository Groups. Prefix can be other existing repository group path[s], eg. /u/${username}')} <br/>
             ${_('Available variables are currently ${username} and ${user_id}')}
         </span>
     </div>
 </div>
 
 
 <div class="panel panel-default">
     <div class="panel-heading" id="captcha-options">
         <h3 class="panel-title">${_('Registration Captcha')} <a class="permalink" href="#captcha-options"> ¶</a></h3>
     </div>
     <div class="panel-body">
         <div class="label">
             <label for="rhodecode_captcha_public_key">${_('Google ReCaptcha public key')}</label>
         </div>
         <div class="field input">
             ${h.text('rhodecode_captcha_public_key',size=60)}
         </div>
         <div class="field">
             <span class="help-block">
                 ${_('Public key for reCaptcha system.')}
             </span>
         </div>
 
         <div class="label">
             <label for="rhodecode_captcha_private_key">${_('Google ReCaptcha private key')}</label>
         </div>
         <div class="field input">
             ${h.text('rhodecode_captcha_private_key',size=60)}
         </div>
         <div class="field">
             <span class="help-block">
                 ${_('Private key for reCaptcha system. Setting this value will enable captcha on registration')}
             </span>
         </div>
     </div>
 </div>
 
 <div class="panel panel-default">
     <div class="panel-heading" id="header-code-options">
         <h3 class="panel-title">${_('Custom Header Code')} <a class="permalink" href="#header-code-options"> ¶</a></h3>
     </div>
     <div class="panel-body">
         <div class="select">
             <select id="pre_template" >
                 <option value="#">${_('Templates...')}</option>
                 <option value="ga">Google Analytics</option>
                 <option value="clicky">Clicky</option>
                 <option value="server_announce">${_('Server Announcement')}</option>
                 <option value="flash_filtering">${_('Flash message filtering')}</option>
             </select>
         </div>
         <div style="padding: 10px 0px"></div>
         <div class="textarea text-area">
             ${h.textarea('rhodecode_pre_code',cols=23,rows=5,class_="medium")}
             <span class="help-block">${_('Custom js/css code added at the end of the <header/> tag.')}
                          ${_('Use <script/> or <css/> tags to define custom styling or scripting')}</span>
         </div>
     </div>
 </div>
 
 <div class="panel panel-default">
     <div class="panel-heading" id="footer-code-options">
         <h3 class="panel-title">${_('Custom Footer Code')} <a class="permalink" href="#footer-code-options"> ¶</a></h3>
     </div>
     <div class="panel-body">
         <div class="select">
             <select id="post_template" >
                 <option value="#">${_('Templates...')}</option>
                 <option value="ga">Google Analytics</option>
                 <option value="clicky">Clicky</option>
                 <option value="server_announce">${_('Server Announcement')}</option>
             </select>
         </div>
         <div style="padding: 10px 0px"></div>
         <div class="textarea text-area">
             ${h.textarea('rhodecode_post_code',cols=23,rows=5, class_="medium")}
             <span class="help-block">${_('Custom js/css code added at the end of the <body> tag.')}
                         ${_('Use <script> or <css> tags to define custom styling or scripting')}</span>
         </div>
     </div>
 </div>
 
 <div class="buttons">
     ${h.submit('save',_('Save settings'),class_="btn")}
     ${h.reset('reset',_('Reset'),class_="btn")}
 </div>
 ${h.end_form()}
 
 
 
 ## TEMPLATES ##
 ###############
 
 <script id="ga_tmpl" type="text/x-template">
 <%text filter="h">
 <script>
  // Google Analytics
  // Put your Google Analytics code instead of _GACODE_
  var _gaq_code = '_GACODE_';
  var _gaq = _gaq || [];
  _gaq.push(['_setAccount', _gaq_code]);
  _gaq.push(['_trackPageview']);
 
  (function() {
   var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
   ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
   var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
  })();
 
  rhodecode_statechange_callback = function(url, data){
   // ANALYTICS callback on html5 history state changed
   // triggered by file browser, url is the new url,
   // data is extra info passed from the State object
   if (typeof window._gaq !== 'undefined') {
     _gaq.push(['_trackPageview', url]);
   }
  };
 </script>
 </%text>
 </script>
 
 
 
 <script id="clicky_tmpl" type="text/x-template">
 <%text filter="h">
 <script src="//static.getclicky.com/js" type="text/javascript"></script>
 <script type="text/javascript">
  // Clicky Analytics - should be used in the footer code section.
  // Put your Clicky code instead of _CLICKYCODE_ here,
  // and below in the <img> tag.
  var _cl_code = _CLICKYCODE_;
  try{clicky.init(_cl_code);}catch(e){}
 
  rhodecode_statechange_callback = function(url, data){
   // ANALYTICS callback on html5 history state changed
   // triggered by file browser, url is the new url,
   // data is extra info passed from the State object
   if (typeof window.clicky !== 'undefined') {
    clicky.log(url);
   }
 }
 </script>
 <noscript>
 // Put your clicky code in the src file.
 <p><img alt="Clicky" width="1" height="1"
         src="//in.getclicky.com/_CLICKYCODE_ns.gif" /></p>
 </noscript>
 </%text>
 </script>
 
 
 
 <script id="server_announce_tmpl" type='text/x-template'>
 <%text filter="h">
 <script>
 // Server announcement displayed on the top of the page.
 // This can be used to send a global maintenance messages or other
 // important messages to all users of the RhodeCode Enterprise system.
 
 $(document).ready(function(e){
 
  // EDIT - put your message below
  var message = "TYPE YOUR MESSAGE HERE";
 
  // EDIT - choose "info"/"warning"/"error"/"success"/"neutral" as appropriate
  var alert_level = "info";
 
  $("#body").prepend(
   ("<div id='server-announcement' class='"+alert_level+"'>_MSG_"+"</div>").replace("_MSG_", message)
  )
 })
 </script>
 </%text>
 </script>
 
 <script id="flash_filtering_tmpl" type='text/x-template'>
 <%text filter="h">
 <script>
     // This filters out some flash messages before they are presented to user
     // based on their contents. Could be used to filter out warnings/errors
     // of license messages
 
     var filteredMessages = [];
     for(var i =0; i< alertMessagePayloads.length; i++){
         if (typeof alertMessagePayloads[i].message.subdata.subtype !== 'undefined' &&
                 alertMessagePayloads[i].message.subdata.subtype.indexOf('rc_license') !== -1){
             continue
         }
         filteredMessages.push(alertMessagePayloads[i]);
     }
     alertMessagePayloads = filteredMessages;
 </script>
 </%text>
 </script>
 
 <script>
 var pre_cm = initCodeMirror('rhodecode_pre_code', '', false);
 var pre_old = pre_cm.getValue();
 
 var post_cm = initCodeMirror('rhodecode_post_code', '', false);
 var post_old = post_cm.getValue();
 
 var get_data = function(type, old){
     var get_tmpl = function(tmpl_name){
         // unescape some stuff
         return htmlEnDeCode.htmlDecode($('#'+tmpl_name+'_tmpl').html());
     };
     return {
         '#': old,
         'ga': get_tmpl('ga'),
         'clicky': get_tmpl('clicky'),
         'server_announce': get_tmpl('server_announce'),
         'flash_filtering': get_tmpl('flash_filtering')
     }[type]
 };
 
 $('#pre_template').select2({
     containerCssClass: 'drop-menu',
     dropdownCssClass: 'drop-menu-dropdown',
     dropdownAutoWidth: true,
     minimumResultsForSearch: -1
 });
 
 $('#post_template').select2({
     containerCssClass: 'drop-menu',
     dropdownCssClass: 'drop-menu-dropdown',
     dropdownAutoWidth: true,
     minimumResultsForSearch: -1
 });
 
 $('#post_template').on('change', function(e){
     var sel = this.value;
     post_cm.setValue(get_data(sel, post_old))
 });
 
 $('#pre_template').on('change', function(e){
     var sel = this.value;
     pre_cm.setValue(get_data(sel, pre_old))
 })
 </script>

rhodecode/templates/admin/settings/settings_hooks.mako

@@ -1,93 +1,93 b''
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Built in Mercurial hooks - read only')}</h3>
     </div>
     <div class="panel-body">
         <div class="form">
             <div class="fields">
               % for hook in c.hooks:
                 <div class="field">
                     <div class="label label">
                         <label for="${hook.ui_key}">${hook.ui_key}</label>
                     </div>
                     <div class="input" >
                       ${h.text(hook.ui_key,hook.ui_value,size=59,readonly="readonly")}
                     </div>
                 </div>
               % endfor
             </div>
             <span class="help-block">${_('Hooks can be used to trigger actions on certain events such as push / pull. They can trigger Python functions or external applications.')}</span>
         </div>
     </div>
 </div>
 
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Custom hooks')}</h3>
     </div>
     <div class="panel-body">
         % if c.visual.allow_custom_hooks_settings:
-        ${h.secure_form(h.url('admin_settings_hooks'), method='post')}
+        ${h.secure_form(h.url('admin_settings_hooks'), request=request)}
         <div class="form">
             <div class="fields">
 
               % for hook in c.custom_hooks:
               <div class="field"  id="${'id%s' % hook.ui_id }">
                 <div class="label label">
                     <label for="${hook.ui_key}">${hook.ui_key}</label>
                 </div>
                 <div class="input" >
                     ${h.hidden('hook_ui_key',hook.ui_key)}
                     ${h.hidden('hook_ui_value',hook.ui_value)}
                     ${h.text('hook_ui_value_new',hook.ui_value,size=59)}
                     <span class="btn btn-danger"
                     onclick="ajaxActionHook(${hook.ui_id},'${'id%s' % hook.ui_id }')">
                     ${_('Delete')}
                     </span>
                 </div>
               </div>
               % endfor
 
               <div class="field customhooks">
                 <div class="label">
                   <div class="input-wrapper">
                      ${h.text('new_hook_ui_key',size=30)}
                   </div>
                 </div>
                 <div class="input">
                     ${h.text('new_hook_ui_value',size=59)}
                 </div>
               </div>
               <div class="buttons">
                  ${h.submit('save',_('Save'),class_="btn")}
               </div>
             </div>
         </div>
         ${h.end_form()}
         %else:
             DISABLED
         % endif
     </div>
 </div>
 
 
 <script type="text/javascript">
 function ajaxActionHook(hook_id,field_id) {
     var sUrl = "${h.url('admin_settings_hooks')}";
     var callback =  function (o) {
             var elem = $("#"+field_id);
             elem.remove();
         };
     var postData = {
       '_method': 'delete',
       'hook_id': hook_id,
       'csrf_token': CSRF_TOKEN
     };
     var request = $.post(sUrl, postData)
             .done(callback)
             .fail(function (data, textStatus, errorThrown) {
                 alert("Error while deleting hooks.\nError code {0} ({1}). URL: {2}".format(data.status,data.statusText,$(this)[0].url));
         });
 };
 </script>

rhodecode/templates/admin/settings/settings_issuetracker.mako

@@ -1,34 +1,34 b''
 <%namespace name="its" file="/base/issue_tracker_settings.mako"/>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Issue Tracker / Wiki Patterns')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.url('admin_settings_issuetracker_save'), method='post')}
+        ${h.secure_form(h.url('admin_settings_issuetracker_save'), request=request)}
             ${its.issue_tracker_settings_table(
                 patterns=c.issuetracker_entries.items(),
                 form_url=h.url('admin_settings_issuetracker'),
                 delete_url=h.url('admin_issuetracker_delete')
             )}
               <div class="buttons">
                   <button type="submit" class="btn btn-primary" id="save">${_('Save')}</button>
                   <button type="reset" class="btn">${_('Reset')}</button>
               </div>
          ${h.end_form()}
     </div>
 </div>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Test Patterns')}</h3>
     </div>
     <div class="panel-body">
         ${its.issue_tracker_new_row()}
         ${its.issue_tracker_settings_test(test_url=h.url('admin_issuetracker_test'))}
     </div>
 </div>
 
 
 
 

rhodecode/templates/admin/settings/settings_labs.mako

@@ -1,58 +1,58 b''
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Labs Settings')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.url('admin_settings_labs'), method='post')}
+        ${h.secure_form(h.url('admin_settings_labs'), request=request)}
           <div class="form">
             <div class="fields">
               % if not c.lab_settings:
                 ${_('There are no Labs settings currently')}
               % else:
                   % for lab_setting in c.lab_settings:
                   <div class="field">
                     <div class="label">
                       <label>${lab_setting.group}:</label>
                     </div>
                     % if lab_setting.type == 'bool':
                       <div class="checkboxes">
                         <div class="checkbox">
                           ${h.checkbox(lab_setting.key, 'True')}
                           % if lab_setting.label:
                             <label for="${lab_setting.key}">${lab_setting.label}</label>
                           % endif
                         </div>
                         % if lab_setting.help:
                           <p class="help-block">${lab_setting.help}</p>
                         % endif
                       </div>
                     % else:
                       <div class="input">
                         ${h.text(lab_setting.key, size=60)}
 
                         ## TODO: johbo: This style does not yet exist for our forms,
                         ## the lab settings seem not to adhere to the structure which
                         ## we use in other places.
                         % if lab_setting.label:
                           <label for="${lab_setting.key}">${lab_setting.label}</label>
                         % endif
 
                         % if lab_setting.help:
                           <p class="help-block">${lab_setting.help}</p>
                         % endif
                       </div>
                     % endif
                   </div>
                   % endfor
                   <div class="buttons">
                     ${h.submit('save', _('Save settings'), class_='btn')}
                     ${h.reset('reset', _('Reset'), class_='btn')}
                   </div>
               % endif
             </div>
           </div>
         ${h.end_form()}
     </div>
 </div>
 
 

rhodecode/templates/admin/settings/settings_mapping.mako

@@ -1,28 +1,28 b''
-${h.secure_form(h.url('admin_settings_mapping'), method='post')}
+${h.secure_form(h.url('admin_settings_mapping'), request=request)}
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Import New Groups or Repositories')}</h3>
     </div>
     <div class="panel-body">
         <div class="checkbox">
             ${h.checkbox('destroy',True)}
             <label for="destroy">${_('Destroy old data')}</label>
         </div>
         <span class="help-block">${_('In case a repository or a group was deleted from the filesystem and it still exists in the database, check this option to remove obsolete data from the database.')}</span>
 
         <div class="checkbox">
             ${h.checkbox('invalidate',True)}
             <label for="invalidate"> ${_('Invalidate cache for all repositories')}</label>
         </div>
         <span class="help-block">${_('Each cache data for repositories will be cleaned with this option selected. Use this to reload data and clear cache keys.')}</span>
 
         <div class="buttons">
             ${h.submit('rescan',_('Rescan Filesystem'),class_="btn")}
         </div>
 
     </div>
 </div>
 
 
 ${h.end_form()}

rhodecode/templates/admin/settings/settings_sessions.mako

@@ -1,62 +1,62 b''
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('User Sessions Configuration')}</h3>
     </div>
     <div class="panel-body">
         <%
          elems = [
             (_('Session type'), c.session_model.SESSION_TYPE, ''),
             (_('Session expiration period'), '{} seconds'.format(c.session_conf.get('beaker.session.timeout', 0)), ''),
 
             (_('Total sessions'), c.session_count, ''),
             (_('Expired sessions ({} days)').format(c.cleanup_older_days ), c.session_expired_count, ''),
 
         ]
         %>
         <dl class="dl-horizontal settings">
         %for dt, dd, tt in elems:
           <dt>${dt}:</dt>
           <dd title="${h.tooltip(tt)}">${dd}</dd>
         %endfor
         </dl>
     </div>
 </div>
 
 
 <div class="panel panel-warning">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Cleanup Old Sessions')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.route_path('admin_settings_sessions_cleanup'), method='POST', request=request)}
+        ${h.secure_form(h.route_path('admin_settings_sessions_cleanup'), request=request)}
 
             <p>
             ${_('Cleanup user sessions that were not active during chosen time frame.')} <br/>
             ${_('After performing this action users whose session will be removed will be required to log in again.')} <br/>
             <strong>${_('Picking `All` will log-out you, and all users in the system.')}</strong>
            </p>
 
             <script type="text/javascript">
               $(document).ready(function() {
                   $('#expire_days').select2({
                       containerCssClass: 'drop-menu',
                       dropdownCssClass: 'drop-menu-dropdown',
                       dropdownAutoWidth: true,
                       minimumResultsForSearch: -1
                   });
               });
             </script>
             <select id="expire_days" name="expire_days">
                 % for n in [60, 90, 30, 7, 0]:
                     <option value="${n}">${'{} days'.format(n) if n != 0 else 'All'}</option>
                 % endfor
             </select>
             <button class="btn btn-small" type="submit"
                 onclick="return confirm('${_('Confirm to cleanup user sessions')}');">
                 ${_('Cleanup sessions')}
             </button>
         ${h.end_form()}
     </div>
 </div>
 
 

rhodecode/templates/admin/settings/settings_vcs.mako

@@ -1,66 +1,66 b''
 <%namespace name="vcss" file="/base/vcs_settings.mako"/>
 
-${h.secure_form(h.url('admin_settings_vcs'), method='post')}
+${h.secure_form(h.url('admin_settings_vcs'), request=request)}
     <div>
         ${vcss.vcs_settings_fields(
             suffix='',
             svn_tag_patterns=c.svn_tag_patterns,
             svn_branch_patterns=c.svn_branch_patterns,
             display_globals=True,
             allow_repo_location_change=c.visual.allow_repo_location_change
         )}
         <div class="buttons">
             ${h.submit('save',_('Save settings'),class_="btn")}
             ${h.reset('reset',_('Reset'),class_="btn")}
        </div>
     </div>
 ${h.end_form()}
 
 <script type="text/javascript">
 
     function ajaxDeletePattern(pattern_id, field_id) {
         var sUrl = "${h.url('admin_settings_vcs')}";
         var callback =  function (o) {
             var elem = $("#"+field_id);
             elem.remove();
         };
         var postData = {
             '_method': 'delete',
             'delete_svn_pattern': pattern_id,
             'csrf_token': CSRF_TOKEN
         };
         var request = $.post(sUrl, postData)
                 .done(callback)
                 .fail(function (data, textStatus, errorThrown) {
                     alert("Error while deleting hooks.\nError code {0} ({1}). URL: {2}".format(data.status,data.statusText,$(this)[0].url));
             });
     };
 
     $(document).ready(function() {
 
         var unlockpath = function() {
             $('#path_unlock_icon').removeClass('icon-lock').addClass('icon-unlock');
             $('#paths_root_path').removeAttr('readonly').removeClass('disabled');
         };
 
         $('#path_unlock').on('click', function(e) {
             unlockpath();
         });
 
         if ($('.locked_input').children().hasClass('error-message')) {
             unlockpath();
         }
 
         /* On click handler for the `Generate Apache Config` button. It sends a
         POST request to trigger the (re)generation of the mod_dav_svn config. */
         $('#vcs_svn_generate_cfg').on('click', function(event) {
             event.preventDefault();
             var url = "${h.route_path('admin_settings_vcs_svn_generate_cfg')}";
             var jqxhr = $.post(url, {'csrf_token': CSRF_TOKEN});
             jqxhr.done(function(data) {
                 $.Topic('/notifications').publish(data);
             });
         });
 
     });
 </script>

rhodecode/templates/admin/settings/settings_visual.mako

@@ -1,226 +1,226 b''
-${h.secure_form(h.url('admin_settings_visual'), method='post')}
+${h.secure_form(h.url('admin_settings_visual'), request=request)}
 
 <div class="panel panel-default">
     <div class="panel-heading" id="general">
         <h3 class="panel-title">${_('General')}</h3>
     </div>
     <div class="panel-body">
         <div class="checkbox">
             ${h.checkbox('rhodecode_repository_fields','True')}
             <label for="rhodecode_repository_fields">${_('Use repository extra fields')}</label>
         </div>
         <span class="help-block">${_('Allows storing additional customized fields per repository.')}</span>
 
         <div></div>
         <div class="checkbox">
             ${h.checkbox('rhodecode_show_version','True')}
             <label for="rhodecode_show_version">${_('Show RhodeCode version')}</label>
         </div>
         <span class="help-block">${_('Shows or hides a version number of RhodeCode displayed in the footer.')}</span>
     </div>
 </div>
 
 
 <div class="panel panel-default">
     <div class="panel-heading" id="gravatars">
         <h3 class="panel-title">${_('Gravatars')}</h3>
     </div>
     <div class="panel-body">
         <div class="checkbox">
             ${h.checkbox('rhodecode_use_gravatar','True')}
             <label for="rhodecode_use_gravatar">${_('Use Gravatars based avatars')}</label>
         </div>
         <span class="help-block">${_('Use gravatar.com as avatar system for RhodeCode accounts. If this is disabled avatars are generated based on initials and email.')}</span>
 
         <div class="label">
             <label for="rhodecode_gravatar_url">${_('Gravatar URL')}</label>
         </div>
         <div class="input">
             <div class="field">
                 ${h.text('rhodecode_gravatar_url', size='100%')}
             </div>
 
             <div class="field">
             <span class="help-block">${_('''Gravatar url allows you to use other avatar server application.
                                             Following variables of the URL will be replaced accordingly.
                                             {scheme}    'http' or 'https' sent from running RhodeCode server,
                                             {email}     user email,
                                             {md5email}  md5 hash of the user email (like at gravatar.com),
                                             {size}      size of the image that is expected from the server application,
                                             {netloc}    network location/server host of running RhodeCode server''')}</span>
             </div>
         </div>
     </div>
 </div>
 
 
 <div class="panel panel-default">
     <div class="panel-heading" id="meta-tagging">
         <h3 class="panel-title">${_('Meta-Tagging')}</h3>
     </div>
     <div class="panel-body">
         <div class="checkbox">
             ${h.checkbox('rhodecode_stylify_metatags','True')}
             <label for="rhodecode_stylify_metatags">${_('Stylify recognised meta tags')}</label>
         </div>
         <span class="help-block">${_('Parses meta tags from repository or repository group description fields and turns them into colored tags.')}</span>
         <div>
             <%namespace name="dt" file="/data_table/_dt_elements.mako"/>
             ${dt.metatags_help()}
         </div>
     </div>
 </div>
 
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Dashboard Items')}</h3>
     </div>
     <div class="panel-body">
         <div class="label">
             <label for="rhodecode_dashboard_items">${_('Main page dashboard items')}</label>
         </div>
         <div class="field input">
             ${h.text('rhodecode_dashboard_items',size=5)}
         </div>
         <div class="field">
             <span class="help-block">${_('Number of items displayed in the main page dashboard before pagination is shown.')}</span>
         </div>
 
         <div class="label">
             <label for="rhodecode_admin_grid_items">${_('Admin pages items')}</label>
         </div>
         <div class="field input">
             ${h.text('rhodecode_admin_grid_items',size=5)}
         </div>
         <div class="field">
             <span class="help-block">${_('Number of items displayed in the admin pages grids before pagination is shown.')}</span>
         </div>
     </div>
 </div>
 
 
 
 <div class="panel panel-default">
     <div class="panel-heading" id="commit-id">
         <h3 class="panel-title">${_('Commit ID Style')}</h3>
     </div>
     <div class="panel-body">
         <div class="label">
             <label for="rhodecode_show_sha_length">${_('Commit sha length')}</label>
         </div>
         <div class="input">
             <div class="field">
                 ${h.text('rhodecode_show_sha_length',size=5)}
             </div>
             <div class="field">
                 <span class="help-block">${_('''Number of chars to show in commit sha displayed in web interface.
                                                 By default it's shown as r123:9043a6a4c226 this value defines the
                                                 length of the sha after the `r123:` part.''')}</span>
             </div>
         </div>
 
         <div class="checkbox">
             ${h.checkbox('rhodecode_show_revision_number','True')}
             <label for="rhodecode_show_revision_number">${_('Show commit ID numeric reference')} / ${_('Commit show revision number')}</label>
         </div>
         <span class="help-block">${_('''Show revision number in commit sha displayed in web interface.
                                         By default it's shown as r123:9043a6a4c226 this value defines the
                                         if the `r123:` part is shown.''')}</span>
     </div>
 </div>
 
 
 <div class="panel panel-default">
     <div class="panel-heading" id="icons">
         <h3 class="panel-title">${_('Icons')}</h3>
     </div>
     <div class="panel-body">
         <div class="checkbox">
             ${h.checkbox('rhodecode_show_public_icon','True')}
             <label for="rhodecode_show_public_icon">${_('Show public repo icon on repositories')}</label>
         </div>
         <div></div>
 
         <div class="checkbox">
             ${h.checkbox('rhodecode_show_private_icon','True')}
             <label for="rhodecode_show_private_icon">${_('Show private repo icon on repositories')}</label>
         </div>
         <span class="help-block">${_('Show public/private icons next to repositories names.')}</span>
     </div>
 </div>
 
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Markup Renderer')}</h3>
     </div>
     <div class="panel-body">
         <div class="field select">
             ${h.select('rhodecode_markup_renderer', '', ['rst', 'markdown'])}
         </div>
         <div class="field">
             <span class="help-block">${_('Default renderer used to render comments, pull request descriptions and other description elements. After change old entries will still work correctly.')}</span>
         </div>
     </div>
 </div>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Clone URL')}</h3>
     </div>
     <div class="panel-body">
         <div class="field">
             ${h.text('rhodecode_clone_uri_tmpl', size=60)}
         </div>
 
         <div class="field">
             <span class="help-block">
                 ${_('''Schema of clone url construction eg. '{scheme}://{user}@{netloc}/{repo}', available vars:
                        {scheme} 'http' or 'https' sent from running RhodeCode server,
                        {user}   current user username,
                        {netloc} network location/server host of running RhodeCode server,
                        {repo}   full repository name,
                        {repoid} ID of repository, can be used to contruct clone-by-id''')}
             </span>
         </div>
     </div>
 </div>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Custom Support Link')}</h3>
     </div>
     <div class="panel-body">
         <div class="field">
             ${h.text('rhodecode_support_url', size=60)}
         </div>
         <div class="field">
             <span class="help-block">
                 ${_('''Custom url for the support link located at the bottom.
                     The default is set to %(default_url)s. In case there's a need
                     to change the support link to internal issue tracker, it should be done here.
                     ''') % {'default_url': h.url('rhodecode_support')}}
             </span>
         </div>
     </div>
 </div>
 
 <div class="buttons">
     ${h.submit('save',_('Save settings'),class_="btn")}
     ${h.reset('reset',_('Reset'),class_="btn")}
 </div>
 
 
 ${h.end_form()}
 
 <script>
 $(document).ready(function() {
     $('#rhodecode_markup_renderer').select2({
         containerCssClass: 'drop-menu',
         dropdownCssClass: 'drop-menu-dropdown',
         dropdownAutoWidth: true,
         minimumResultsForSearch: -1
     });
 });
 </script>

rhodecode/templates/admin/user_groups/user_group_add.mako

@@ -1,72 +1,72 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="/base/base.mako"/>
 
 <%def name="title()">
     ${_('Add user group')}
     %if c.rhodecode_name:
         &middot; ${h.branding(c.rhodecode_name)}
     %endif
 </%def>
 <%def name="breadcrumbs_links()">
     ${h.link_to(_('Admin'),h.route_path('admin_home'))}
     &raquo;
     ${h.link_to(_('User groups'),h.route_path('user_groups'))}
     &raquo;
     ${_('Add User Group')}
 </%def>
 
 <%def name="menu_bar_nav()">
     ${self.menu_items(active='admin')}
 </%def>
 
 <%def name="main()">
 <div class="box main-content">
     <!-- box / title -->
     <div class="title">
         ${self.breadcrumbs()}
     </div>
     <!-- end box / title -->
-    ${h.secure_form(h.route_path('user_groups_create'), method='POST', request=request)}
+    ${h.secure_form(h.route_path('user_groups_create'), request=request)}
     <div class="form">
         <!-- fields -->
         <div class="fields">
              <div class="field">
                 <div class="label">
                     <label for="users_group_name">${_('Group name')}:</label>
                 </div>
                 <div class="input">
                     ${h.text('users_group_name', class_='medium')}
                 </div>
              </div>
             <div class="field">
                 <div class="label">
                     <label for="user_group_description">${_('Description')}:</label>
                 </div>
                 <div class="textarea editor">
                     ${h.textarea('user_group_description')}
                     <span class="help-block">${_('Short, optional description for this user group.')}</span>
                 </div>
              </div>
              <div class="field">
                 <div class="label">
                     <label for="users_group_active">${_('Active')}:</label>
                 </div>
                 <div class="checkboxes">
                     ${h.checkbox('users_group_active',value=True, checked='checked')}
                 </div>
              </div>
 
             <div class="buttons">
               ${h.submit('save',_('Save'),class_="btn")}
             </div>
         </div>
     </div>
     ${h.end_form()}
 </div>
 </%def>
 
 <script>
     $(document).ready(function(){
         $('#users_group_name').focus();
     })
 </script>

rhodecode/templates/admin/user_groups/user_group_edit_advanced.mako

@@ -1,84 +1,84 b''
 <%namespace name="base" file="/base/base.mako"/>
 
 <%
  elems = [
     (_('Owner'), lambda:base.gravatar_with_user(c.user_group.user.email), '', ''),
     (_('Created on'), h.format_date(c.user_group.created_on), '', '',),
 
     (_('Members'), len(c.group_members_obj),'', [x for x in c.group_members_obj]),
     (_('Automatic member sync'), 'Yes' if c.user_group.group_data.get('extern_type') else 'No', '', '',),
 
     (_('Assigned to repositories'), len(c.group_to_repos),'', [x for x in c.group_to_repos]),
     (_('Assigned to repo groups'), len(c.group_to_repo_groups), '', [x for x in c.group_to_repo_groups]),
 
     (_('Assigned to review rules'), len(c.group_to_review_rules), '', [x for x in c.group_to_review_rules]),
  ]
 %>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('User Group: %s') % c.user_group.users_group_name}</h3>
     </div>
     <div class="panel-body">
         ${base.dt_info_panel(elems)}
     </div>
 
 </div>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Group members sync')}</h3>
     </div>
     <div class="panel-body">
         <% sync_type = c.user_group.group_data.get('extern_type') %>
 
         % if sync_type:
             <p>
                 ${_('This group is set to be automatically synchronised.')}<br/>
                 ${_('This group synchronization was set by')}: <strong>${sync_type}</strong>
             </p>
         % else:
             <p>
                 ${_('This group is not set to be automatically synchronised')}
             </p>
         % endif
 
         <div>
-        ${h.secure_form(h.route_path('edit_user_group_advanced_sync', user_group_id=c.user_group.users_group_id), method='POST', request=request)}
+        ${h.secure_form(h.route_path('edit_user_group_advanced_sync', user_group_id=c.user_group.users_group_id), request=request)}
             <div class="field">
                 <button class="btn btn-default" type="submit">
                     %if sync_type:
                         ${_('Disable synchronization')}
                     %else:
                         ${_('Enable synchronization')}
                     %endif
                 </button>
             </div>
             <div class="field">
                 <span class="help-block">
                     ${_('Users will be added or removed from this group when they authenticate with RhodeCode system, based on LDAP group membership. '
                         'This requires `LDAP+User group` authentication plugin to be configured and enabled. (EE only feature)')}
                 </span>
             </div>
         ${h.end_form()}
         </div>
 
     </div>
 </div>
 
 
 <div class="panel panel-danger">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Delete User Group')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.route_path('user_groups_delete', user_group_id=c.user_group.users_group_id), method='POST', request=request)}
+        ${h.secure_form(h.route_path('user_groups_delete', user_group_id=c.user_group.users_group_id), request=request)}
             ${h.hidden('force', 1)}
             <button class="btn btn-small btn-danger" type="submit"
                     onclick="return confirm('${_('Confirm to delete user group `%(ugroup)s` with all permission assignments') % {'ugroup': c.user_group.users_group_name}}');">
                 <i class="icon-remove-sign"></i>
                 ${_('Delete This User Group')}
             </button>
         ${h.end_form()}
     </div>
 </div>

rhodecode/templates/admin/user_groups/user_group_edit_perms.mako

@@ -1,134 +1,134 b''
 <%namespace name="base" file="/base/base.mako"/>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('User Group Permissions')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.route_path('edit_user_group_perms_update', user_group_id=c.user_group.users_group_id), method='POST', request=request)}
+        ${h.secure_form(h.route_path('edit_user_group_perms_update', user_group_id=c.user_group.users_group_id), request=request)}
         <table id="permissions_manage" class="rctable permissions">
             <tr>
                 <th class="td-radio">${_('None')}</th>
                 <th class="td-radio">${_('Read')}</th>
                 <th class="td-radio">${_('Write')}</th>
                 <th class="td-radio">${_('Admin')}</th>
                 <th>${_('User/User Group')}</th>
                 <th></th>
             </tr>
             ## USERS
             %for _user in c.user_group.permissions():
                 %if getattr(_user, 'admin_row', None) or getattr(_user, 'owner_row', None):
                     <tr class="perm_admin_row">
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.none', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.read', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.write', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.admin', 'repository.admin', disabled="disabled")}</td>
                         <td class="td-user">
                             ${base.gravatar(_user.email, 16)}
                             <span class="user">
                                 ${h.link_to_user(_user.username)}
                                 %if getattr(_user, 'admin_row', None):
                                     (${_('super admin')})
                                 %endif
                                 %if getattr(_user, 'owner_row', None):
                                     (${_('owner')})
                                 %endif
                             </span>
                         </td>
                         <td></td>
                     </tr>
                 %else:
                     ##forbid revoking permission from yourself, except if you're an super admin
                     <tr>
                         %if c.rhodecode_user.user_id != _user.user_id or c.rhodecode_user.is_admin:
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'usergroup.none')}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'usergroup.read')}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'usergroup.write')}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'usergroup.admin')}</td>
                         <td class="td-user">
                             ${base.gravatar(_user.email, 16)}
                             <span class="user">
                                 % if _user.username == h.DEFAULT_USER:
                                     ${h.DEFAULT_USER} <span class="user-perm-help-text"> - ${_('permission for all other users')}</span>
                                 % else:
                                     ${h.link_to_user(_user.username)}
                                 % endif
                             </span>
                         </td>
                         <td class="td-action">
                           %if _user.username != h.DEFAULT_USER:
                             <span class="btn btn-link btn-danger revoke_perm"
                                   member="${_user.user_id}" member_type="user">
                             <i class="icon-remove"></i> ${_('revoke')}
                             </span>
                           %endif
                         </td>
                         %else:
                         ## special case for current user permissions, we make sure he cannot take his own permissions
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'usergroup.none', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'usergroup.read', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'usergroup.write', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'usergroup.admin', disabled="disabled")}</td>
                         <td class="td-user">
                             ${base.gravatar(_user.email, 16)}
                             <span class="user">
                                 % if _user.username == h.DEFAULT_USER:
                                     ${h.DEFAULT_USER} <span class="user-perm-help-text"> - ${_('permission for all other users')}</span>
                                 % else:
                                     ${h.link_to_user(_user.username)}
                                 % endif
                                 <span class="user-perm-help-text">(${_('delegated admin')})</span>
                             </span>
                         </td>
                         <td></td>
                         %endif
                     </tr>
                 %endif
             %endfor
 
             ## USER GROUPS
             %for _user_group in c.user_group.permission_user_groups():
                 <tr>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'usergroup.none')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'usergroup.read')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'usergroup.write')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'usergroup.admin')}</td>
                     <td class="td-user">
                         <i class="icon-group" ></i>
                         %if h.HasPermissionAny('hg.admin')():
                          <a href="${h.route_path('edit_user_group',user_group_id=_user_group.users_group_id)}">
                              ${_user_group.users_group_name}
                          </a>
                         %else:
                          ${_user_group.users_group_name}
                         %endif
                     </td>
                     <td class="td-action">
                         <span class="btn btn-link btn-danger revoke_perm"
                               member="${_user_group.users_group_id}" member_type="user_group">
                         <i class="icon-remove"></i> ${_('revoke')}
                         </span>
                     </td>
                 </tr>
             %endfor
             <tr class="new_members" id="add_perm_input"></tr>
         </table>
         <div id="add_perm" class="link">
             ${_('Add new')}
         </div>
         <div class="buttons">
           ${h.submit('save',_('Save'),class_="btn btn-primary")}
           ${h.reset('reset',_('Reset'),class_="btn btn-danger")}
         </div>
         ${h.end_form()}
     </div>
 </div>
 
 <script type="text/javascript">
     $('#add_perm').on('click', function(e){
         addNewPermInput($(this), 'usergroup');
     });
     $('.revoke_perm').on('click', function(e){
         markRevokePermInput($(this), 'usergroup');
     });
 </script>

rhodecode/templates/admin/user_groups/user_group_edit_settings.mako

@@ -1,186 +1,186 b''
 ## -*- coding: utf-8 -*-
 <%namespace name="base" file="/base/base.mako"/>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('User Group: %s') % c.user_group.users_group_name}</h3>
     </div>
     <div class="panel-body">
-    ${h.secure_form(h.route_path('user_groups_update', user_group_id=c.user_group.users_group_id), id='edit_user_group', method='POST', request=request)}
+    ${h.secure_form(h.route_path('user_groups_update', user_group_id=c.user_group.users_group_id), id='edit_user_group', request=request)}
         <div class="form">
             <!-- fields -->
                 <div class="fields">
                      <div class="field">
                         <div class="label">
                             <label for="users_group_name">${_('Group name')}:</label>
                         </div>
                         <div class="input">
                             ${h.text('users_group_name',class_='medium')}
                         </div>
                      </div>
 
                     <div class="field badged-field">
                         <div class="label">
                             <label for="user">${_('Owner')}:</label>
                         </div>
                         <div class="input">
                             <div class="badge-input-container">
                                 <div class="user-badge">
                                     ${base.gravatar_with_user(c.user_group.user.email, show_disabled=not c.user_group.user.active)}
                                 </div>
                                 <div class="badge-input-wrap">
                                     ${h.text('user', class_="medium", autocomplete="off")}
                                 </div>
                             </div>
                             <form:error name="user"/>
                             <p class="help-block">${_('Change owner of this user group.')}</p>
                         </div>
                     </div>
 
                      <div class="field">
                         <div class="label label-textarea">
                             <label for="user_group_description">${_('Description')}:</label>
                         </div>
                         <div class="textarea textarea-small editor">
                             ${h.textarea('user_group_description',cols=23,rows=5,class_="medium")}
                             <span class="help-block">${_('Short, optional description for this user group.')}</span>
                         </div>
                      </div>
                      <div class="field">
                         <div class="label label-checkbox">
                             <label for="users_group_active">${_('Active')}:</label>
                         </div>
                         <div class="checkboxes">
                             ${h.checkbox('users_group_active',value=True)}
                         </div>
                      </div>
 
                      <div class="field">
                         <div class="label label-checkbox">
                             <label for="users_group_active">${_('Add members')}:</label>
                         </div>
                         <div class="input">
                             ${h.text('user_group_add_members', placeholder="user/usergroup", class_="medium")}
                         </div>
                      </div>
 
                     <input type="hidden" name="__start__" value="user_group_members:sequence"/>
                     <table id="group_members_placeholder" class="rctable group_members">
                         <tr>
                           <th>${_('Username')}</th>
                           <th>${_('Action')}</th>
                         </tr>
 
                         % if c.group_members_obj:
                           % for user in c.group_members_obj:
                             <tr>
                               <td id="member_user_${user.user_id}" class="td-author">
                                 <div class="group_member">
                                   ${base.gravatar(user.email, 16)}
                                   <span class="username user">${h.link_to(h.person(user), h.url( 'edit_user',user_id=user.user_id))}</span>
                                   <input type="hidden" name="__start__" value="member:mapping">
                                   <input type="hidden" name="member_user_id" value="${user.user_id}">
                                   <input type="hidden" name="type" value="existing" id="member_${user.user_id}">
                                   <input type="hidden" name="__end__" value="member:mapping">
                                 </div>
                               </td>
                               <td class="">
                                 <div class="usergroup_member_remove action_button" onclick="removeUserGroupMember(${user.user_id}, true)" style="visibility: visible;">
                                     <i class="icon-remove-sign"></i>
                                 </div>
                               </td>
                             </tr>
                           % endfor
 
                         % else:
                           <tr><td colspan="2">${_('No members yet')}</td></tr>
                         % endif
                      </table>
                     <input type="hidden" name="__end__" value="user_group_members:sequence"/>
 
                      <div class="buttons">
                        ${h.submit('Save',_('Save'),class_="btn")}
                      </div>
                 </div>
         </div>
     ${h.end_form()}
     </div>
 </div>
 <script>
     $(document).ready(function(){
         $("#group_parent_id").select2({
             'containerCssClass': "drop-menu",
             'dropdownCssClass': "drop-menu-dropdown",
             'dropdownAutoWidth': true
         });
 
         removeUserGroupMember = function(userId){
             $('#member_'+userId).val('remove');
             $('#member_user_'+userId).addClass('to-delete');
         };
 
         $('#user_group_add_members').autocomplete({
             serviceUrl: pyroutes.url('user_autocomplete_data'),
             minChars:2,
             maxHeight:400,
             width:300,
             deferRequestBy: 300, //miliseconds
             showNoSuggestionNotice: true,
             params: { user_groups:true },
             formatResult: autocompleteFormatResult,
             lookupFilter: autocompleteFilterResult,
             onSelect: function(element, suggestion){
 
                 function addMember(user, fromUserGroup) {
                     var gravatar = user.icon_link;
                     var username = user.value_display;
                     var userLink = pyroutes.url('edit_user', {"user_id": user.id});
                     var uid = user.id;
 
                     if (fromUserGroup) {
                         username = username +" "+ _gettext('(from usergroup {0})'.format(fromUserGroup))
                     }
 
                     var elem = $(
                         ('<tr>'+
                           '<td id="member_user_{6}" class="td-author td-author-new-entry">'+
                             '<div class="group_member">'+
                               '<img class="gravatar" src="{0}" height="16" width="16">'+
                               '<span class="username user"><a href="{1}">{2}</a></span>'+
                               '<input type="hidden" name="__start__" value="member:mapping">'+
                               '<input type="hidden" name="member_user_id" value="{3}">'+
                               '<input type="hidden" name="type" value="new" id="member_{4}">'+
                               '<input type="hidden" name="__end__" value="member:mapping">'+
                             '</div>'+
                           '</td>'+
                           '<td class="td-author-new-entry">'+
                             '<div class="usergroup_member_remove action_button" onclick="removeUserGroupMember({5}, true)" style="visibility: visible;">'+
                                 '<i class="icon-remove-sign"></i>'+
                             '</div>'+
                           '</td>'+
                         '</tr>').format(gravatar, userLink, username,
                                 uid, uid, uid, uid)
                     );
                     $('#group_members_placeholder').append(elem)
                 }
 
                 if (suggestion.value_type == 'user_group') {
                     $.getJSON(
                         pyroutes.url('user_group_members_data',
                                     {'user_group_id': suggestion.id}),
                         function(data) {
                             $.each(data.members, function(idx, user) {
                                 addMember(user, suggestion.value)
                             });
                         }
                     );
                 } else if (suggestion.value_type == 'user') {
                     addMember(suggestion, null);
                 }
             }
         });
 
 
         UsersAutoComplete('user', '${c.rhodecode_user.user_id}');
     })
 </script>

rhodecode/templates/admin/users/user_edit_auth_tokens.mako

@@ -1,176 +1,176 b''
 <div class="panel panel-default">
     <div class="panel-heading">
       <h3 class="panel-title">${_('Authentication Tokens')}</h3>
     </div>
     <div class="panel-body">
         <div class="apikeys_wrap">
           <p>
              ${_('Each token can have a role. Token with a role can be used only in given context, '
              'e.g. VCS tokens can be used together with the authtoken auth plugin for git/hg/svn operations only.')}
           </p>
           <table class="rctable auth_tokens">
             <tr>
                 <th>${_('Token')}</th>
                 <th>${_('Scope')}</th>
                 <th>${_('Description')}</th>
                 <th>${_('Role')}</th>
                 <th>${_('Expiration')}</th>
                 <th>${_('Action')}</th>
             </tr>
             %if c.user_auth_tokens:
                 %for auth_token in c.user_auth_tokens:
                   <tr class="${'expired' if auth_token.expired else ''}">
                     <td class="truncate-wrap td-authtoken"><div class="user_auth_tokens truncate autoexpand"><code>${auth_token.api_key}</code></div></td>
                     <td class="td">${auth_token.scope_humanized}</td>
                     <td class="td-wrap">${auth_token.description}</td>
                     <td class="td-tags">
                         <span class="tag disabled">${auth_token.role_humanized}</span>
                     </td>
                     <td class="td-exp">
                          %if auth_token.expires == -1:
                           ${_('never')}
                          %else:
                             %if auth_token.expired:
                                 <span style="text-decoration: line-through">${h.age_component(h.time_to_utcdatetime(auth_token.expires))}</span>
                             %else:
                                 ${h.age_component(h.time_to_utcdatetime(auth_token.expires))}
                             %endif
                          %endif
                     </td>
                     <td class="td-action">
-                        ${h.secure_form(h.route_path('edit_user_auth_tokens_delete', user_id=c.user.user_id), method='POST', request=request)}
+                        ${h.secure_form(h.route_path('edit_user_auth_tokens_delete', user_id=c.user.user_id), request=request)}
                             ${h.hidden('del_auth_token', auth_token.user_api_key_id)}
                             <button class="btn btn-link btn-danger" type="submit"
                                     onclick="return confirm('${_('Confirm to remove this auth token: %s') % auth_token.token_obfuscated}');">
                                 ${_('Delete')}
                             </button>
                         ${h.end_form()}
                     </td>
                   </tr>
                 %endfor
             %else:
             <tr><td><div class="ip">${_('No additional auth tokens specified')}</div></td></tr>
             %endif
           </table>
         </div>
 
         <div class="user_auth_tokens">
-            ${h.secure_form(h.route_path('edit_user_auth_tokens_add', user_id=c.user.user_id), method='POST', request=request)}
+            ${h.secure_form(h.route_path('edit_user_auth_tokens_add', user_id=c.user.user_id), request=request)}
             <div class="form form-vertical">
                 <!-- fields -->
                 <div class="fields">
                      <div class="field">
                         <div class="label">
                             <label for="new_email">${_('New authentication token')}:</label>
                         </div>
                         <div class="input">
                             ${h.text('description', class_='medium', placeholder=_('Description'))}
                             ${h.hidden('lifetime')}
                             ${h.select('role', '', c.role_options)}
 
                             % if c.allow_scoped_tokens:
                                 ${h.hidden('scope_repo_id')}
                             % else:
                                 ${h.select('scope_repo_id_disabled', '', ['Scopes available in EE edition'], disabled='disabled')}
                             % endif
                         </div>
                         <p class="help-block">
                           ${_('Repository scope works only with tokens with VCS type.')}
                         </p>
                      </div>
                     <div class="buttons">
                       ${h.submit('save',_('Add'),class_="btn")}
                       ${h.reset('reset',_('Reset'),class_="btn")}
                     </div>
                 </div>
             </div>
             ${h.end_form()}
         </div>
     </div>
 </div>
 
 <script>
 
 $(document).ready(function(){
 var select2Options = {
     'containerCssClass': "drop-menu",
     'dropdownCssClass': "drop-menu-dropdown",
     'dropdownAutoWidth': true
 };
 $("#role").select2(select2Options);
 
 var preloadData = {
     results: [
         % for entry in c.lifetime_values:
             {id:${entry[0]}, text:"${entry[1]}"}${'' if loop.last else ','}
         % endfor
     ]
 };
 
 $("#lifetime").select2({
     containerCssClass: "drop-menu",
     dropdownCssClass: "drop-menu-dropdown",
     dropdownAutoWidth: true,
     data: preloadData,
     placeholder: "${_('Select or enter expiration date')}",
     query: function(query) {
         feedLifetimeOptions(query, preloadData);
     }
 });
 
 
 var repoFilter = function(data) {
     var results = [];
 
     if (!data.results[0]) {
         return data
     }
 
     $.each(data.results[0].children, function() {
         // replace name to ID for submision
         this.id = this.obj.repo_id;
         results.push(this);
     });
 
     data.results[0].children = results;
     return data;
 };
 
 $("#scope_repo_id_disabled").select2(select2Options);
 
 $("#scope_repo_id").select2({
     cachedDataSource: {},
     minimumInputLength: 2,
     placeholder: "${_('repository scope')}",
     dropdownAutoWidth: true,
     containerCssClass: "drop-menu",
     dropdownCssClass: "drop-menu-dropdown",
     formatResult: formatResult,
     query: $.debounce(250, function(query){
         self = this;
         var cacheKey = query.term;
         var cachedData = self.cachedDataSource[cacheKey];
 
         if (cachedData) {
             query.callback({results: cachedData.results});
         } else {
             $.ajax({
                 url: pyroutes.url('repo_list_data'),
                 data: {'query': query.term},
                 dataType: 'json',
                 type: 'GET',
                 success: function(data) {
                     data = repoFilter(data);
                     self.cachedDataSource[cacheKey] = data;
                     query.callback({results: data.results});
                 },
                 error: function(data, textStatus, errorThrown) {
                     alert("Error while fetching entries.\nError code {0} ({1}).".format(data.status, data.statusText));
                 }
 })
         }
     })
 });
 
 });
 </script>

rhodecode/templates/admin/users/user_edit_emails.mako

@@ -1,71 +1,71 b''
 <%namespace name="base" file="/base/base.mako"/>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Additional Email Addresses')}</h3>
     </div>
     <div class="panel-body">
         <div class="emails_wrap">
           <table class="rctable account_emails useremails">
             <tr>
             <td class="td-user">
                 ${base.gravatar(c.user.email, 16)}
                 <span class="user email">${c.user.email}</span>
             </td>
             <td class="td-tags">
                 <span class="tag">${_('Primary')}</span>
             </td>
             </tr>
             %if c.user_email_map:
                 %for em in c.user_email_map:
                   <tr>
                     <td class="td-user">
                         ${base.gravatar(em.email, 16)}
                         <span class="user email">${em.email}</span>
                     </td>
                     <td class="td-action">
-                        ${h.secure_form(h.route_path('edit_user_emails_delete', user_id=c.user.user_id), method='POST', request=request)}
+                        ${h.secure_form(h.route_path('edit_user_emails_delete', user_id=c.user.user_id), request=request)}
                             ${h.hidden('del_email_id', em.email_id)}
                             <button class="btn btn-link btn-danger" type="submit"
                                     onclick="return confirm('${_('Confirm to delete this email: %s') % em.email}');">
                                 ${_('Delete')}
                             </button>
                         ${h.end_form()}
                     </td>
                   </tr>
                 %endfor
             %else:
             <tr class="noborder">
                 <td colspan="3">
                     <div class="td-email">
                         ${_('No additional emails specified')}
                     </div>
                 </td>
             </tr>
             %endif
           </table>
         </div>
 
-        ${h.secure_form(h.route_path('edit_user_emails_add', user_id=c.user.user_id), method='POST', request=request)}
+        ${h.secure_form(h.route_path('edit_user_emails_add', user_id=c.user.user_id), request=request)}
         <div class="form">
             <!-- fields -->
             <div class="fields">
                  <div class="field">
                     <div class="label">
                         <label for="new_email">${_('New email address')}:</label>
                     </div>
                     <div class="input">
                         ${h.text('new_email', class_='medium')}
                     </div>
                  </div>
                 <div class="buttons">
                   ${h.submit('save',_('Add'),class_="btn btn-small")}
                   ${h.reset('reset',_('Reset'),class_="btn btn-small")}
                 </div>
             </div>
         </div>
         ${h.end_form()}
     </div>
 </div>
 
 

rhodecode/templates/admin/users/user_edit_groups.mako

@@ -1,147 +1,147 b''
 ## -*- coding: utf-8 -*-
 
 
 <div class="panel panel-default">
     <div class="panel-heading">
       <h3 class="panel-title">${_('User groups administration')}</h3>
     </div>
     <div class="panel-body">
         <div class="fields">
             <div class="field">
                 <div class="label label-checkbox">
                     <label for="users_group_active">${_('Add `%s` to user group') % c.user.username}:</label>
                 </div>
                 <div class="input">
                     ${h.text('add_user_to_group', placeholder="user group name", class_="medium")}
                 </div>
 
             </div>
         </div>
 
         <div class="groups_management">
-            ${h.secure_form(h.route_path('edit_user_groups_management_updates', user_id=c.user.user_id), method='POST', request=request)}
+            ${h.secure_form(h.route_path('edit_user_groups_management_updates', user_id=c.user.user_id), request=request)}
             <div id="repos_list_wrap">
                 <table id="user_group_list_table" class="display"></table>
             </div>
             <div class="buttons">
                 ${h.submit('save',_('Save'),class_="btn")}
             </div>
             ${h.end_form()}
         </div>
         </div>
 </div>
 <script>
 var api;
 $(document).ready(function() {
 
     var get_datatable_count = function(){
         $('#user_group_count').text(api.page.info().recordsDisplay);
     };
 
     $('#user_group_list_table').on('click', 'a.editor_remove', function (e) {
         e.preventDefault();
         var row = api.row($(this).closest('tr'));
         row.remove().draw();
     } );
 
     $('#user_group_list_table').DataTable({
       data: ${c.groups|n},
       dom: 'rtp',
       pageLength: ${c.visual.admin_grid_items},
       order: [[ 0, "asc" ]],
       columns: [
          { data: {"_": "group_name",
                   "sort": "group_name"}, title: "${_('Name')}", className: "td-componentname," ,
             render: function (data,type,full,meta)
                     {return '<div><i class="icon-group" title="User group">'+data+'</i></div>'}},
 
          { data: {"_": "group_description",
                   "sort": "group_description"}, title: "${_('Description')}", className: "td-description" },
          { data: {"_": "users_group_id"}, className: "td-user",
                  render: function (data,type,full,meta)
                     {return '<input type="hidden" name="users_group_id" value="'+data+'">'}},
          { data: {"_": "active",
                   "sort": "active"}, title: "${_('Active')}", className: "td-active", className: "td-number"},
          { data: {"_": "owner_data"}, title: "${_('Owner')}", className: "td-user",
              render: function (data,type,full,meta)
                     {return '<div class="rc-user tooltip">'+
                             '<img class="gravatar" src="'+ data.owner_icon +'" height="16" width="16">'+
                              data.owner +'</div>'
                     }
 },
          { data: null,
              title: "${_('Action')}",
              className: "td-action",
              defaultContent: '<a href="" class="btn btn-link btn-danger">Delete</a>'
          },
       ],
       language: {
           paginate: DEFAULT_GRID_PAGINATION,
           emptyTable: _gettext("No user groups available yet.")
       },
       "initComplete": function( settings, json ) {
           var data_grid = $('#user_group_list_table').dataTable();
           api = data_grid.api();
           get_datatable_count();
       }
     });
 
     // update the counter when doing search
     $('#user_group_list_table').on( 'search.dt', function (e,settings) {
         get_datatable_count();
     });
 
     // filter, filter both grids
     $('#q_filter').on( 'keyup', function () {
       var user_api = $('#user_group_list_table').dataTable().api();
       user_api
         .columns(0)
         .search(this.value)
         .draw();
     });
 
     // refilter table if page load via back button
     $("#q_filter").trigger('keyup');
 
   });
 
     $('#language').select2({
         'containerCssClass': "drop-menu",
         'dropdownCssClass': "drop-menu-dropdown",
         'dropdownAutoWidth': true
     });
 
 
 
 $(document).ready(function(){
     $("#group_parent_id").select2({
         'containerCssClass': "drop-menu",
         'dropdownCssClass': "drop-menu-dropdown",
         'dropdownAutoWidth': true
     });
 
     $('#add_user_to_group').autocomplete({
         serviceUrl: pyroutes.url('user_group_autocomplete_data'),
         minChars:2,
         maxHeight:400,
         width:300,
         deferRequestBy: 300, //miliseconds
         showNoSuggestionNotice: true,
         params: { user_groups:true },
         formatResult: autocompleteFormatResult,
         lookupFilter: autocompleteFilterResult,
         onSelect: function(element, suggestion){
             var owner = {owner_icon: suggestion.owner_icon, owner:suggestion.owner};
             api.row.add(
                     {"active": suggestion.active,
                         "owner_data": owner,
                         "users_group_id": suggestion.id,
                         "group_description": suggestion.description,
                         "group_name": suggestion.value}).draw();
         }
     });
 })
 
 </script>
 
 

rhodecode/templates/admin/users/user_edit_ips.mako

@@ -1,78 +1,78 b''
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Custom IP Whitelist')}</h3>
     </div>
     <div class="panel-body">
         <div class="ips_wrap">
         <h5>${_('Current IP address')}: <code>${c.rhodecode_user.ip_addr}</code></h5>
   <table class="rctable ip-whitelist">
     <tr>
       <th>${_('IP Address')}</th>
       <th>${_('IP Range')}</th>
       <th>${_('Description')}</th>
       <th></th>
     </tr>
     %if c.default_user_ip_map and c.inherit_default_ips:
         %for ip in c.default_user_ip_map:
           <tr>
             <td class="td-ip"><div class="ip">${ip.ip_addr}</div></td>
             <td class="td-iprange"><div class="ip">${h.ip_range(ip.ip_addr)}</div></td>
             <td class="td-description">${h.literal(_('Inherited from %s') % h.link_to('*default*',h.route_path('admin_permissions_ips')))}</td>
             <td></td>
           </tr>
         %endfor
     %endif
 
     %if c.user_ip_map:
         %for ip in c.user_ip_map:
           <tr>
             <td class="td-ip"><div class="ip">${ip.ip_addr}</div></td>
             <td class="td-iprange"><div class="ip">${h.ip_range(ip.ip_addr)}</div></td>
             <td class="td-description"><div class="ip">${ip.description}</div></td>
             <td class="td-action">
-                ${h.secure_form(h.route_path('edit_user_ips_delete', user_id=c.user.user_id), method='POST', request=request)}
+                ${h.secure_form(h.route_path('edit_user_ips_delete', user_id=c.user.user_id), request=request)}
                     ${h.hidden('del_ip_id', ip.ip_id)}
                     ${h.submit('remove_', _('Delete'),id="remove_ip_%s" % ip.ip_id,
                     class_="btn btn-link btn-danger", onclick="return confirm('"+_('Confirm to delete this ip: %s') % ip.ip_addr+"');")}
                 ${h.end_form()}
             </td>
           </tr>
         %endfor
     %endif
     %if not c.default_user_ip_map and not c.user_ip_map:
         <tr>
           <td><h2 class="ip">${_('All IP addresses are allowed')}</h2></td>
           <td></td>
           <td></td>
           <td></td>
         </tr>
     %endif
   </table>
 </div>
 
         <div>
-    ${h.secure_form(h.route_path('edit_user_ips_add', user_id=c.user.user_id), method='POST', request=request)}
+    ${h.secure_form(h.route_path('edit_user_ips_add', user_id=c.user.user_id), request=request)}
     <div class="form">
         <!-- fields -->
         <div class="fields">
              <div class="field">
                 <div class="label">
                     <label for="new_ip">${_('New IP Address')}:</label>
                 </div>
                 <div class="input">
                     ${h.text('new_ip')} ${h.text('description', placeholder=_('Description...'))}
                     <span class="help-block">${_('Enter comma separated list of ip addresses like 127.0.0.1,\n'
                      'or use a ip address with a mask 127.0.0.1/24, to create a network range.\n'
                      'To specify multiple address range use 127.0.0.1-127.0.0.10 syntax')}</span>
                 </div>
              </div>
             <div class="buttons">
               ${h.submit('save',_('Add'),class_="btn btn-small")}
               ${h.reset('reset',_('Reset'),class_="btn btn-small")}
             </div>
         </div>
     </div>
     ${h.end_form()}
 </div>
     </div>
 </div>

rhodecode/templates/admin/users/user_edit_ssh_keys.mako

@@ -1,78 +1,78 b''
 <div class="panel panel-default">
     <div class="panel-heading">
       <h3 class="panel-title">${_('SSH Keys')}</h3>
     </div>
     <div class="panel-body">
         <div class="sshkeys_wrap">
           <table class="rctable ssh_keys">
             <tr>
                 <th>${_('Fingerprint')}</th>
                 <th>${_('Description')}</th>
                 <th>${_('Created')}</th>
                 <th>${_('Action')}</th>
             </tr>
             %if c.user_ssh_keys:
                 %for ssh_key in c.user_ssh_keys:
                   <tr class="">
                     <td class="">
                         <code>${ssh_key.ssh_key_fingerprint}</code>
                     </td>
                     <td class="td-wrap">${ssh_key.description}</td>
                     <td class="td-tags">${h.format_date(ssh_key.created_on)}</td>
 
                     <td class="td-action">
-                        ${h.secure_form(h.route_path('edit_user_ssh_keys_delete', user_id=c.user.user_id), method='POST', request=request)}
+                        ${h.secure_form(h.route_path('edit_user_ssh_keys_delete', user_id=c.user.user_id), request=request)}
                             ${h.hidden('del_ssh_key', ssh_key.ssh_key_id)}
                             <button class="btn btn-link btn-danger" type="submit"
                                     onclick="return confirm('${_('Confirm to remove ssh key %s') % ssh_key.ssh_key_fingerprint}');">
                                 ${_('Delete')}
                             </button>
                         ${h.end_form()}
                     </td>
                   </tr>
                 %endfor
             %else:
             <tr><td><div class="ip">${_('No additional ssh keys specified')}</div></td></tr>
             %endif
           </table>
         </div>
 
         <div class="user_ssh_keys">
-            ${h.secure_form(h.route_path('edit_user_ssh_keys_add', user_id=c.user.user_id), method='POST', request=request)}
+            ${h.secure_form(h.route_path('edit_user_ssh_keys_add', user_id=c.user.user_id), request=request)}
             <div class="form form-vertical">
                 <!-- fields -->
                 <div class="fields">
                     <div class="field">
                         <div class="label">
                             <label for="new_email">${_('New ssh key')}:</label>
                         </div>
                         <div class="input">
                             ${h.text('description', class_='medium', placeholder=_('Description'))}
                             <a href="${h.route_path('edit_user_ssh_keys_generate_keypair', user_id=c.user.user_id)}">${_('Generate random RSA key')}</a>
                         </div>
                      </div>
 
                     <div class="field">
                         <div class="textarea text-area editor">
                             ${h.textarea('key_data',c.default_key, size=30, placeholder=_("Public key, begins with 'ssh-rsa', 'ssh-dss', 'ssh-ed25519', 'ecdsa-sha2-nistp256', 'ecdsa-sha2-nistp384', or 'ecdsa-sha2-nistp521'"))}
                         </div>
                     </div>
 
                     <div class="buttons">
                       ${h.submit('save',_('Add'),class_="btn")}
                       ${h.reset('reset',_('Reset'),class_="btn")}
                     </div>
                 </div>
             </div>
             ${h.end_form()}
         </div>
     </div>
 </div>
 
 <script>
 
 $(document).ready(function(){
 
 
 });
 </script>

rhodecode/templates/base/default_perms_box.mako

@@ -1,156 +1,156 b''
 ## snippet for displaying default permission box
 ## usage:
 ##    <%namespace name="dpb" file="/base/default_perms_box.mako"/>
 ##    ${dpb.default_perms_box(<url_to_form>)}
 ##    ${dpb.default_perms_radios()}
 
 <%def name="default_perms_radios(global_permissions_template = False, suffix='', **kwargs)">
 <div class="main-content-full-width">
   <div class="panel panel-default">
 
     ## displayed according to checkbox selection
     <div class="panel-heading">
       %if not global_permissions_template:
         <h3 class="inherit_overlay_default panel-title">${_('Inherited Permissions')}</h3>
         <h3 class="inherit_overlay panel-title">${_('Custom Permissions')}</h3>
       %else:
         <h3 class="panel-title">${_('Default Global Permissions')}</h3>
       %endif
     </div>
 
     <div class="panel-body">
       %if global_permissions_template:
         <p>${_('The following options configure the default permissions each user or group will inherit. You can override these permissions for each individual user or user group using individual permissions settings.')}</p>
       %endif
         <div class="field">
            <div class="label">
                <label for="default_repo_create${suffix}">${_('Repository Creation')}:</label>
            </div>
            <div class="radios">
                ${h.radio('default_repo_create' + suffix, c.repo_create_choices[1][0], label=c.repo_create_choices[1][1], **kwargs)}
                ${h.radio('default_repo_create' + suffix, c.repo_create_choices[0][0], label=c.repo_create_choices[0][1], **kwargs)}
                <span class="help-block">${_('Permission to create root level repositories. When disabled, users can still create repositories inside their own repository groups.')}</span>
            </div>
         </div>
         <div class="field">
            <div class="label">
                <label for="default_repo_create_on_write${suffix}">${_('Repository Creation With Group Write Access')}:</label>
            </div>
            <div class="radios">
                ${h.radio('default_repo_create_on_write' + suffix, c.repo_create_on_write_choices[1][0], label=c.repo_create_on_write_choices[1][1], **kwargs)}
                ${h.radio('default_repo_create_on_write' + suffix, c.repo_create_on_write_choices[0][0], label=c.repo_create_on_write_choices[0][1], **kwargs)}
                <span class="help-block">${_('Write permission given on a repository group will allow creating repositories inside that group.')}</span>
            </div>
         </div>
         <div class="field">
            <div class="label">
                <label for="default_fork_create${suffix}">${_('Repository Forking')}:</label>
            </div>
            <div class="radios">
                ${h.radio('default_fork_create' + suffix, c.fork_choices[1][0], label=c.fork_choices[1][1], **kwargs)}
                ${h.radio('default_fork_create' + suffix, c.fork_choices[0][0], label=c.fork_choices[0][1], **kwargs)}
                <span class="help-block">${_('Permission to create root level repository forks. When disabled, users can still fork repositories inside their own repository groups.')}</span>
            </div>
         </div>
         <div class="field">
            <div class="label">
                <label for="default_repo_group_create${suffix}">${_('Repository Group Creation')}:</label>
            </div>
            <div class="radios">
                ${h.radio('default_repo_group_create' + suffix, c.repo_group_create_choices[1][0], label=c.repo_group_create_choices[1][1], **kwargs)}
                ${h.radio('default_repo_group_create' + suffix, c.repo_group_create_choices[0][0], label=c.repo_group_create_choices[0][1], **kwargs)}
                <span class="help-block">${_('Permission to create root level repository groups. When disabled, repository group admins can still create repository subgroups within their repository groups.')}</span>
            </div>
         </div>
         <div class="field">
            <div class="label">
                <label for="default_user_group_create${suffix}">${_('User Group Creation')}:</label>
            </div>
            <div class="radios">
                ${h.radio('default_user_group_create' + suffix, c.user_group_create_choices[1][0], label=c.user_group_create_choices[1][1], **kwargs)}
                ${h.radio('default_user_group_create' + suffix, c.user_group_create_choices[0][0], label=c.user_group_create_choices[0][1], **kwargs)}
                <span class="help-block">${_('Permission to allow user group creation.')}</span>
            </div>
         </div>
 
         <div class="field">
            <div class="label">
                <label for="default_inherit_default_permissions${suffix}">${_('Inherit Permissions From The Default User')}:</label>
            </div>
            <div class="radios">
                ${h.radio('default_inherit_default_permissions' + suffix, c.inherit_default_permission_choices[1][0], label=c.inherit_default_permission_choices[1][1], **kwargs)}
                ${h.radio('default_inherit_default_permissions' + suffix, c.inherit_default_permission_choices[0][0], label=c.inherit_default_permission_choices[0][1], **kwargs)}
                <span class="help-block">${_('Inherit default permissions from the default user. Turn off this option to force explicit permissions for users, even if they are more restrictive than the default user permissions.')}</span>
            </div>
         </div>
 
         <div class="buttons">
          ${h.submit('save',_('Save'),class_="btn")}
          ${h.reset('reset',_('Reset'),class_="btn")}
         </div>
     </div>
   </div>
 </div>
 </%def>
 
 <%def name="default_perms_box(form_url)">
-  ${h.secure_form(form_url, method='POST', request=request)}
+  ${h.secure_form(form_url, request=request)}
     <div class="form">
       <div class="fields">
         <div class="field panel panel-default panel-body">
           <div class="label label-checkbox">
               <label for="inherit_default_permissions">${_('Inherit from default settings')}:</label>
           </div>
           <div class="checkboxes">
               ${h.checkbox('inherit_default_permissions',value=True)}
               <span class="help-block">
               ${h.literal(_('Select to inherit permissions from %s permissions settings, '
                             'including default IP address whitelist and inheritance of \npermission by members of user groups.')
                           % h.link_to('default user', h.route_path('admin_permissions_global')))}
               </span>
           </div>
         </div>
   
         ## INHERITED permissions == the user permissions in admin
         ## if inherit checkbox is set this is displayed in non-edit mode
         <div class="inherit_overlay_default">
             ${default_perms_radios(global_permissions_template = False, suffix='_inherited', disabled="disabled")}
         </div>
   
         ## CUSTOM permissions
         <div class="inherit_overlay">
             ${default_perms_radios(global_permissions_template = False)}
         </div>
       </div>
     </div>
   ${h.end_form()}
 
         
 ## JS
 <script>
 var show_custom_perms = function(inherit_default){
     if(inherit_default) {
         $('.inherit_overlay_default').show();
         $('.inherit_overlay').hide();
     }
     else {
         $('.inherit_overlay').show();
         $('.inherit_overlay_default').hide();
     }
 };
 $(document).ready(function(e){
     var inherit_checkbox = $('#inherit_default_permissions');
     var defaults = inherit_checkbox.prop('checked');
     show_custom_perms(defaults);
     inherit_checkbox.on('change', function(){
         if($(this).prop('checked')){
            show_custom_perms(true);
         }
         else{
            show_custom_perms(false);
         }
     })
 })
 </script>
 
 </%def>

rhodecode/templates/data_table/_dt_elements.mako

@@ -1,377 +1,377 b''
 ## DATA TABLE RE USABLE ELEMENTS
 ## usage:
 ## <%namespace name="dt" file="/data_table/_dt_elements.mako"/>
 <%namespace name="base" file="/base/base.mako"/>
 
 <%def name="metatags_help()">
     <table>
         <%
             example_tags = [
                 ('state','[stable]'),
                 ('state','[stale]'),
                 ('state','[featured]'),
                 ('state','[dev]'),
                 ('state','[dead]'),
                 ('state','[deprecated]'),
 
                 ('label','[personal]'),
                 ('generic','[v2.0.0]'),
 
                 ('lang','[lang =&gt; JavaScript]'),
                 ('license','[license =&gt; LicenseName]'),
 
                 ('ref','[requires =&gt; RepoName]'),
                 ('ref','[recommends =&gt; GroupName]'),
                 ('ref','[conflicts =&gt; SomeName]'),
                 ('ref','[base =&gt; SomeName]'),
                 ('url','[url =&gt; [linkName](https://rhodecode.com)]'),
                 ('see','[see =&gt; http://rhodecode.com]'),
             ]
         %>
         % for tag_type, tag in example_tags:
             <tr>
                 <td>${tag|n}</td>
                 <td>${h.style_metatag(tag_type, tag)|n}</td>
             </tr>
         % endfor
     </table>
 </%def>
 
 ## REPOSITORY RENDERERS
 <%def name="quick_menu(repo_name)">
   <i class="icon-more"></i>
   <div class="menu_items_container hidden">
     <ul class="menu_items">
       <li>
          <a title="${_('Summary')}" href="${h.route_path('repo_summary',repo_name=repo_name)}">
          <span>${_('Summary')}</span>
          </a>
       </li>
       <li>
          <a title="${_('Changelog')}" href="${h.route_path('repo_changelog',repo_name=repo_name)}">
          <span>${_('Changelog')}</span>
          </a>
       </li>
       <li>
          <a title="${_('Files')}" href="${h.route_path('repo_files:default_commit',repo_name=repo_name)}">
          <span>${_('Files')}</span>
          </a>
       </li>
       <li>
          <a title="${_('Fork')}" href="${h.route_path('repo_fork_new',repo_name=repo_name)}">
          <span>${_('Fork')}</span>
          </a>
       </li>
     </ul>
   </div>
 </%def>
 
 <%def name="repo_name(name,rtype,rstate,private,fork_of,short_name=False,admin=False)">
     <%
     def get_name(name,short_name=short_name):
       if short_name:
         return name.split('/')[-1]
       else:
         return name
     %>
   <div class="${'repo_state_pending' if rstate == 'repo_state_pending' else ''} truncate">
     ##NAME
     <a href="${h.route_path('edit_repo',repo_name=name) if admin else h.route_path('repo_summary',repo_name=name)}">
 
     ##TYPE OF REPO
     %if h.is_hg(rtype):
         <span title="${_('Mercurial repository')}"><i class="icon-hg" style="font-size: 14px;"></i></span>
     %elif h.is_git(rtype):
         <span title="${_('Git repository')}"><i class="icon-git" style="font-size: 14px"></i></span>
     %elif h.is_svn(rtype):
         <span title="${_('Subversion repository')}"><i class="icon-svn" style="font-size: 14px"></i></span>
     %endif
 
     ##PRIVATE/PUBLIC
     %if private and c.visual.show_private_icon:
       <i class="icon-lock" title="${_('Private repository')}"></i>
     %elif not private and c.visual.show_public_icon:
       <i class="icon-unlock-alt" title="${_('Public repository')}"></i>
     %else:
       <span></span>
     %endif
     ${get_name(name)}
     </a>
     %if fork_of:
       <a href="${h.route_path('repo_summary',repo_name=fork_of.repo_name)}"><i class="icon-code-fork"></i></a>
     %endif
     %if rstate == 'repo_state_pending':
       <span class="creation_in_progress tooltip" title="${_('This repository is being created in a background task')}">
           (${_('creating...')})
       </span>
     %endif
   </div>
 </%def>
 
 <%def name="repo_desc(description, stylify_metatags)">
     <%
     tags, description = h.extract_metatags(description)
     %>
 
     <div class="truncate-wrap">
         % if stylify_metatags:
             % for tag_type, tag in tags:
                 ${h.style_metatag(tag_type, tag)|n}
             % endfor
         % endif
         ${description}
     </div>
 
 </%def>
 
 <%def name="last_change(last_change)">
     ${h.age_component(last_change)}
 </%def>
 
 <%def name="revision(name,rev,tip,author,last_msg)">
   <div>
   %if rev >= 0:
       <code><a title="${h.tooltip('%s:\n\n%s' % (author,last_msg))}" class="tooltip" href="${h.route_path('repo_commit',repo_name=name,commit_id=tip)}">${'r%s:%s' % (rev,h.short_id(tip))}</a></code>
   %else:
       ${_('No commits yet')}
   %endif
   </div>
 </%def>
 
 <%def name="rss(name)">
   %if c.rhodecode_user.username != h.DEFAULT_USER:
     <a title="${h.tooltip(_('Subscribe to %s rss feed')% name)}" href="${h.route_path('rss_feed_home', repo_name=name, _query=dict(auth_token=c.rhodecode_user.feed_token))}"><i class="icon-rss-sign"></i></a>
   %else:
     <a title="${h.tooltip(_('Subscribe to %s rss feed')% name)}" href="${h.route_path('rss_feed_home', repo_name=name)}"><i class="icon-rss-sign"></i></a>
   %endif
 </%def>
 
 <%def name="atom(name)">
   %if c.rhodecode_user.username != h.DEFAULT_USER:
     <a title="${h.tooltip(_('Subscribe to %s atom feed')% name)}" href="${h.route_path('atom_feed_home', repo_name=name, _query=dict(auth_token=c.rhodecode_user.feed_token))}"><i class="icon-rss-sign"></i></a>
   %else:
     <a title="${h.tooltip(_('Subscribe to %s atom feed')% name)}" href="${h.route_path('atom_feed_home', repo_name=name)}"><i class="icon-rss-sign"></i></a>
   %endif
 </%def>
 
 <%def name="user_gravatar(email, size=16)">
   <div class="rc-user tooltip" title="${h.tooltip(h.author_string(email))}">
     ${base.gravatar(email, 16)}
   </div>
 </%def>
 
 <%def name="repo_actions(repo_name, super_user=True)">
   <div>
     <div class="grid_edit">
       <a href="${h.route_path('edit_repo',repo_name=repo_name)}" title="${_('Edit')}">
         <i class="icon-pencil"></i>Edit</a>
     </div>
     <div class="grid_delete">
-      ${h.secure_form(h.route_path('edit_repo_advanced_delete', repo_name=repo_name), method='POST', request=request)}
+      ${h.secure_form(h.route_path('edit_repo_advanced_delete', repo_name=repo_name), request=request)}
         ${h.submit('remove_%s' % repo_name,_('Delete'),class_="btn btn-link btn-danger",
         onclick="return confirm('"+_('Confirm to delete this repository: %s') % repo_name+"');")}
       ${h.end_form()}
     </div>
   </div>
 </%def>
 
 <%def name="repo_state(repo_state)">
   <div>
     %if repo_state == 'repo_state_pending':
         <div class="tag tag4">${_('Creating')}</div>
     %elif repo_state == 'repo_state_created':
         <div class="tag tag1">${_('Created')}</div>
     %else:
         <div class="tag alert2" title="${h.tooltip(repo_state)}">invalid</div>
     %endif
   </div>
 </%def>
 
 
 ## REPO GROUP RENDERERS
 <%def name="quick_repo_group_menu(repo_group_name)">
   <i class="icon-more"></i>
   <div class="menu_items_container hidden">
     <ul class="menu_items">
       <li>
          <a href="${h.route_path('repo_group_home', repo_group_name=repo_group_name)}">${_('Summary')}</a>
       </li>
 
     </ul>
   </div>
 </%def>
 
 <%def name="repo_group_name(repo_group_name, children_groups=None)">
   <div>
     <a href="${h.route_path('repo_group_home', repo_group_name=repo_group_name)}">
     <i class="icon-folder-close" title="${_('Repository group')}" style="font-size: 16px"></i>
       %if children_groups:
           ${h.literal(' &raquo; '.join(children_groups))}
       %else:
           ${repo_group_name}
       %endif
   </a>
   </div>
 </%def>
 
 <%def name="repo_group_desc(description, personal, stylify_metatags)">
 
     <%
     tags, description = h.extract_metatags(description)
     %>
 
     <div class="truncate-wrap">
         % if personal:
             <div class="metatag" tag="personal">${_('personal')}</div>
         % endif
 
         % if stylify_metatags:
             % for tag_type, tag in tags:
                 ${h.style_metatag(tag_type, tag)|n}
             % endfor
         % endif
         ${description}
     </div>
 
 </%def>
 
 <%def name="repo_group_actions(repo_group_id, repo_group_name, gr_count)">
  <div class="grid_edit">
     <a href="${h.url('edit_repo_group',group_name=repo_group_name)}" title="${_('Edit')}">Edit</a>
  </div>
  <div class="grid_delete">
-    ${h.secure_form(h.url('delete_repo_group', group_name=repo_group_name),method='delete')}
+    ${h.secure_form(h.url('delete_repo_group', group_name=repo_group_name),method='delete', request=request)}
         ${h.submit('remove_%s' % repo_group_name,_('Delete'),class_="btn btn-link btn-danger",
         onclick="return confirm('"+_ungettext('Confirm to delete this group: %s with %s repository','Confirm to delete this group: %s with %s repositories',gr_count) % (repo_group_name, gr_count)+"');")}
     ${h.end_form()}
  </div>
 </%def>
 
 
 <%def name="user_actions(user_id, username)">
  <div class="grid_edit">
    <a href="${h.url('edit_user',user_id=user_id)}" title="${_('Edit')}">
      <i class="icon-pencil"></i>Edit</a>
  </div>
  <div class="grid_delete">
   ${h.secure_form(h.url('delete_user', user_id=user_id),method='delete')}
     ${h.submit('remove_',_('Delete'),id="remove_user_%s" % user_id, class_="btn btn-link btn-danger",
     onclick="return confirm('"+_('Confirm to delete this user: %s') % username+"');")}
   ${h.end_form()}
  </div>
 </%def>
 
 <%def name="user_group_actions(user_group_id, user_group_name)">
  <div class="grid_edit">
     <a href="${h.route_path('edit_user_group', user_group_id=user_group_id)}" title="${_('Edit')}">Edit</a>
  </div>
  <div class="grid_delete">
-    ${h.secure_form(h.route_path('user_groups_delete', user_group_id=user_group_id), method='POST', request=request)}
+    ${h.secure_form(h.route_path('user_groups_delete', user_group_id=user_group_id), request=request)}
       ${h.submit('remove_',_('Delete'),id="remove_group_%s" % user_group_id, class_="btn btn-link btn-danger",
       onclick="return confirm('"+_('Confirm to delete this user group: %s') % user_group_name+"');")}
     ${h.end_form()}
  </div>
 </%def>
 
 
 <%def name="user_name(user_id, username)">
     ${h.link_to(h.person(username, 'username_or_name_or_email'), h.url('edit_user', user_id=user_id))}
 </%def>
 
 <%def name="user_profile(username)">
     ${base.gravatar_with_user(username, 16)}
 </%def>
 
 <%def name="user_group_name(user_group_id, user_group_name)">
   <div>
   <a href="${h.route_path('edit_user_group', user_group_id=user_group_id)}">
     <i class="icon-group" title="${_('User group')}"></i> ${user_group_name}</a>
   </div>
 </%def>
 
 
 ## GISTS
 
 <%def name="gist_gravatar(full_contact)">
     <div class="gist_gravatar">
       ${base.gravatar(full_contact, 30)}
     </div>
 </%def>
 
 <%def name="gist_access_id(gist_access_id, full_contact)">
     <div>
       <b>
         <a href="${h.route_path('gist_show', gist_id=gist_access_id)}">gist: ${gist_access_id}</a>
       </b>
     </div>
 </%def>
 
 <%def name="gist_author(full_contact, created_on, expires)">
     ${base.gravatar_with_user(full_contact, 16)}
 </%def>
 
 
 <%def name="gist_created(created_on)">
     <div class="created">
       ${h.age_component(created_on, time_is_local=True)}
     </div>
 </%def>
 
 <%def name="gist_expires(expires)">
     <div class="created">
           %if expires == -1:
             ${_('never')}
           %else:
             ${h.age_component(h.time_to_utcdatetime(expires))}
           %endif
     </div>
 </%def>
 
 <%def name="gist_type(gist_type)">
     %if gist_type != 'public':
       <div class="tag">${_('Private')}</div>
     %endif
 </%def>
 
 <%def name="gist_description(gist_description)">
   ${gist_description}
 </%def>
 
 
 ## PULL REQUESTS GRID RENDERERS
 
 <%def name="pullrequest_target_repo(repo_name)">
     <div class="truncate">
       ${h.link_to(repo_name,h.route_path('repo_summary',repo_name=repo_name))}
     </div>
 </%def>
 <%def name="pullrequest_status(status)">
     <div class="${'flag_status %s' % status} pull-left"></div>
 </%def>
 
 <%def name="pullrequest_title(title, description)">
     ${title} <br/>
     ${h.shorter(description, 40)}
 </%def>
 
 <%def name="pullrequest_comments(comments_nr)">
     <i class="icon-comment"></i> ${comments_nr}
 </%def>
 
 <%def name="pullrequest_name(pull_request_id, target_repo_name, short=False)">
     <a href="${h.route_path('pullrequest_show',repo_name=target_repo_name,pull_request_id=pull_request_id)}">
       % if short:
         #${pull_request_id}
       % else:
         ${_('Pull request #%(pr_number)s') % {'pr_number': pull_request_id,}}
       % endif
     </a>
 </%def>
 
 <%def name="pullrequest_updated_on(updated_on)">
     ${h.age_component(h.time_to_utcdatetime(updated_on))}
 </%def>
 
 <%def name="pullrequest_author(full_contact)">
     ${base.gravatar_with_user(full_contact, 16)}
 </%def>

rhodecode/templates/files/files_add.mako

@@ -1,238 +1,238 b''
 <%inherit file="/base/base.mako"/>
 
 <%def name="title()">
     ${_('%s Files Add') % c.repo_name}
     %if c.rhodecode_name:
         &middot; ${h.branding(c.rhodecode_name)}
     %endif
 </%def>
 
 <%def name="menu_bar_nav()">
     ${self.menu_items(active='repositories')}
 </%def>
 
 <%def name="breadcrumbs_links()">
     ${_('Add new file')} @ ${h.show_id(c.commit)}
 </%def>
 
 <%def name="menu_bar_subnav()">
     ${self.repo_menu(active='files')}
 </%def>
 
 <%def name="main()">
 <div class="box">
     <div class="title">
         ${self.repo_page_title(c.rhodecode_db_repo)}
     </div>
     <div class="edit-file-title">
         ${self.breadcrumbs()}
     </div>
-    ${h.secure_form(h.route_path('repo_files_create_file', repo_name=c.repo_name, commit_id=c.commit.raw_id, f_path=c.f_path), id='eform', method='POST', enctype="multipart/form-data", class_="form-horizontal", request=request)}
+    ${h.secure_form(h.route_path('repo_files_create_file', repo_name=c.repo_name, commit_id=c.commit.raw_id, f_path=c.f_path), id='eform', enctype="multipart/form-data", class_="form-horizontal", request=request)}
     <div class="edit-file-fieldset">
         <div class="fieldset">
             <div id="destination-label" class="left-label">
                 ${_('Path')}:
             </div>
             <div class="right-content">
                 <div id="specify-custom-path-container">
                     <span id="path-breadcrumbs">${h.files_breadcrumbs(c.repo_name,c.commit.raw_id,c.f_path)}</span>
                     <a class="custom-path-link" id="specify-custom-path" href="#">${_('Specify Custom Path')}</a>
                 </div>
                 <div id="remove-custom-path-container" style="display: none;">
                     ${c.repo_name}/
                     <input type="input-small" value="${c.f_path}" size="46" name="location" id="location">
                     <a class="custom-path-link" id="remove-custom-path" href="#">${_('Remove Custom Path')}</a>
                 </div>
             </div>
         </div>
         <div id="filename_container" class="fieldset">
             <div class="filename-label left-label">
                 ${_('Filename')}:
             </div>
             <div class="right-content">
                 <input class="input-small" type="text" value="" size="46" name="filename" id="filename">
                 <p>${_('or')} <a id="upload_file_enable" href="#">${_('Upload File')}</a></p>
             </div>
         </div>
         <div id="upload_file_container" class="fieldset" style="display: none;">
             <div class="filename-label left-label">
                 ${_('Filename')}:
             </div>
             <div class="right-content">
                 <input class="input-small" type="text" value="" size="46" name="filename_upload" id="filename_upload" placeholder="${_('No file selected')}">
             </div>
             <div class="filename-label left-label file-upload-label">
                 ${_('Upload file')}:
             </div>
             <div class="right-content file-upload-input">
                 <label for="upload_file" class="btn btn-default">Browse</label>
 
                 <input type="file" name="upload_file" id="upload_file">
                 <p>${_('or')} <a id="file_enable" href="#">${_('Create New File')}</a></p>
             </div>
         </div>
     </div>
     <div class="table">
         <div id="files_data">
             <div id="codeblock" class="codeblock">
             <div class="code-header form" id="set_mode_header">
                 <div class="fields">
                     ${h.dropdownmenu('set_mode','plain',[('plain',_('plain'))],enable_filter=True)}
                     <label for="line_wrap">${_('line wraps')}</label>
                     ${h.dropdownmenu('line_wrap', 'off', [('on', _('on')), ('off', _('off')),])}
 
                     <div id="render_preview" class="btn btn-small preview hidden" >${_('Preview')}</div>
                 </div>
             </div>
                 <div id="editor_container">
                     <pre id="editor_pre"></pre>
                     <textarea id="editor" name="content" ></textarea>
                     <div id="editor_preview"></div>
                 </div>
             </div>
         </div>
     </div>
 
     <div class="edit-file-fieldset">
         <div class="fieldset">
             <div id="commit-message-label" class="commit-message-label left-label">
                 ${_('Commit Message')}:
             </div>
             <div class="right-content">
                 <div class="message">
                     <textarea id="commit" name="message"  placeholder="${c.default_message}"></textarea>
                 </div>
             </div>
         </div>
         <div class="pull-right">
             ${h.reset('reset',_('Cancel'),class_="btn btn-small")}
             ${h.submit('commit_btn',_('Commit changes'),class_="btn btn-small btn-success")}
         </div>
     </div>
     ${h.end_form()}
 </div>
 <script type="text/javascript">
 
     $('#commit_btn').on('click', function() {
         var button = $(this);
         if (button.hasClass('clicked')) {
             button.attr('disabled', true);
         } else {
             button.addClass('clicked');
         }
     });
-    
+
     $('#specify-custom-path').on('click', function(e){
         e.preventDefault();
         $('#specify-custom-path-container').hide();
         $('#remove-custom-path-container').show();
         $('#destination-label').css('margin-top', '13px');
     });
 
     $('#remove-custom-path').on('click', function(e){
         e.preventDefault();
         $('#specify-custom-path-container').show();
         $('#remove-custom-path-container').hide();
         $('#location').val('${c.f_path}');
         $('#destination-label').css('margin-top', '0');
     });
 
     var hide_upload = function(){
         $('#files_data').show();
         $('#upload_file_container').hide();
         $('#filename_container').show();
     };
 
     $('#file_enable').on('click', function(e){
         e.preventDefault();
         hide_upload();
     });
 
     $('#upload_file_enable').on('click', function(e){
         e.preventDefault();
         $('#files_data').hide();
         $('#upload_file_container').show();
         $('#filename_container').hide();
         if (detectIE() && detectIE() <= 9) {
             $('#upload_file_container .file-upload-input label').hide();
             $('#upload_file_container .file-upload-input span').hide();
             $('#upload_file_container .file-upload-input input').show();
         }
     });
 
     $('#upload_file').on('change', function() {
         if (this.files && this.files[0]) {
             $('#filename_upload').val(this.files[0].name);
         }
     });
 
     hide_upload();
 
     var renderer = "";
     var reset_url = "${h.route_path('repo_files',repo_name=c.repo_name,commit_id=c.commit.raw_id,f_path=c.f_path)}";
     var myCodeMirror = initCodeMirror('editor', reset_url, false);
 
     var modes_select = $('#set_mode');
     fillCodeMirrorOptions(modes_select);
 
     var filename_selector = '#filename';
     var callback = function(filename, mimetype, mode){
         CodeMirrorPreviewEnable(mode);
     };
     // on change of select field set mode
     setCodeMirrorModeFromSelect(
             modes_select, filename_selector, myCodeMirror, callback);
 
     // on entering the new filename set mode, from given extension
     setCodeMirrorModeFromInput(
         modes_select, filename_selector, myCodeMirror, callback);
 
     // if the file is renderable set line wraps automatically
     if (renderer !== ""){
         var line_wrap = 'on';
         $($('#line_wrap option[value="'+line_wrap+'"]')[0]).attr("selected", "selected");
         setCodeMirrorLineWrap(myCodeMirror, true);
     }
 
     // on select line wraps change the editor
     $('#line_wrap').on('change', function(e){
         var selected = e.currentTarget;
         var line_wraps = {'on': true, 'off': false}[selected.value];
         setCodeMirrorLineWrap(myCodeMirror, line_wraps)
     });
 
     // render preview/edit button
     $('#render_preview').on('click', function(e){
         if($(this).hasClass('preview')){
             $(this).removeClass('preview');
             $(this).html("${_('Edit')}");
             $('#editor_preview').show();
             $(myCodeMirror.getWrapperElement()).hide();
 
             var possible_renderer = {
                 'rst':'rst',
                 'markdown':'markdown',
                 'gfm': 'markdown'}[myCodeMirror.getMode().name];
             var _text = myCodeMirror.getValue();
             var _renderer = possible_renderer || DEFAULT_RENDERER;
             var post_data = {'text': _text, 'renderer': _renderer, 'csrf_token': CSRF_TOKEN};
             $('#editor_preview').html(_gettext('Loading ...'));
             var url = pyroutes.url('repo_commit_comment_preview',
                     {'repo_name': '${c.repo_name}',
                      'commit_id': '${c.commit.raw_id}'});
 
             ajaxPOST(url, post_data, function(o){
                 $('#editor_preview').html(o);
             })
         }
         else{
             $(this).addClass('preview');
             $(this).html("${_('Preview')}");
             $('#editor_preview').hide();
             $(myCodeMirror.getWrapperElement()).show();
         }
     });
     $('#filename').focus();
 
 </script>
 </%def>

rhodecode/templates/files/files_delete.mako

@@ -1,75 +1,75 b''
 <%inherit file="/base/base.mako"/>
 
 <%def name="title()">
     ${_('%s Files Delete') % c.repo_name}
     %if c.rhodecode_name:
         &middot; ${h.branding(c.rhodecode_name)}
     %endif
 </%def>
 
 <%def name="menu_bar_nav()">
     ${self.menu_items(active='repositories')}
 </%def>
 
 <%def name="breadcrumbs_links()">
     ${_('Delete file')} @ ${h.show_id(c.commit)}
 </%def>
 
 <%def name="menu_bar_subnav()">
     ${self.repo_menu(active='files')}
 </%def>
 
 <%def name="main()">
 <div class="box">
     <div class="title">
         ${self.repo_page_title(c.rhodecode_db_repo)}
     </div>
     <div class="edit-file-title">
         ${self.breadcrumbs()}
     </div>
-    ${h.secure_form(h.route_path('repo_files_delete_file', repo_name=c.repo_name, commit_id=c.commit.raw_id, f_path=c.f_path), id='eform', method='POST', class_="form-horizontal", request=request)}
+    ${h.secure_form(h.route_path('repo_files_delete_file', repo_name=c.repo_name, commit_id=c.commit.raw_id, f_path=c.f_path), id='eform', class_="form-horizontal", request=request)}
     <div class="edit-file-fieldset">
         <div class="fieldset">
             <div id="destination-label" class="left-label">
                 ${_('Path')}:
             </div>
             <div class="right-content">
                 <span id="path-breadcrumbs">${h.files_breadcrumbs(c.repo_name,c.commit.raw_id,c.f_path)}</span>
             </div>
         </div>
     </div>
 
     <div id="codeblock" class="codeblock delete-file-preview">
         <div class="code-body">
             %if c.file.is_binary:
                 ${_('Binary file (%s)') % c.file.mimetype}
             %else:
                 %if c.file.size < c.visual.cut_off_limit_file:
                     ${h.pygmentize(c.file,linenos=True,anchorlinenos=False,cssclass="code-highlight")}
                 %else:
                     ${_('File size {} is bigger then allowed limit {}. ').format(h.format_byte_size_binary(c.file.size), h.format_byte_size_binary(c.visual.cut_off_limit_file))} ${h.link_to(_('Show as raw'),
                     h.route_path('repo_file_raw',repo_name=c.repo_name,commit_id=c.commit.raw_id,f_path=c.f_path))}
                 %endif
             %endif
         </div>
     </div>
 
     <div class="edit-file-fieldset">
         <div class="fieldset">
             <div id="commit-message-label" class="commit-message-label left-label">
                 ${_('Commit Message')}:
             </div>
             <div class="right-content">
                 <div class="message">
                     <textarea id="commit" name="message"  placeholder="${c.default_message}"></textarea>
                 </div>
             </div>
         </div>
         <div class="pull-right">
             ${h.reset('reset',_('Cancel'),class_="btn btn-small btn-danger")}
             ${h.submit('commit',_('Delete File'),class_="btn btn-small btn-danger-action")}
         </div>
     </div>
     ${h.end_form()}
 </div>
 </%def>

rhodecode/templates/files/files_edit.mako

@@ -1,197 +1,197 b''
 <%inherit file="/base/base.mako"/>
 
 <%def name="title()">
     ${_('%s File Edit') % c.repo_name}
     %if c.rhodecode_name:
         &middot; ${h.branding(c.rhodecode_name)}
     %endif
 </%def>
 
 <%def name="menu_bar_nav()">
     ${self.menu_items(active='repositories')}
 </%def>
 
 <%def name="breadcrumbs_links()">
     ${_('Edit file')} @ ${h.show_id(c.commit)}
 </%def>
 
 <%def name="menu_bar_subnav()">
     ${self.repo_menu(active='files')}
 </%def>
 
 <%def name="main()">
 <% renderer = h.renderer_from_filename(c.f_path)%>
 <div class="box">
     <div class="title">
         ${self.repo_page_title(c.rhodecode_db_repo)}
     </div>
     <div class="edit-file-title">
         ${self.breadcrumbs()}
     </div>
     <div class="edit-file-fieldset">
         <div class="fieldset">
             <div id="destination-label" class="left-label">
                 ${_('Path')}:
             </div>
             <div class="right-content">
                 <div id="specify-custom-path-container">
                     <span id="path-breadcrumbs">${h.files_breadcrumbs(c.repo_name,c.commit.raw_id,c.f_path)}</span>
                 </div>
             </div>
         </div>
     </div>
 
     <div class="table">
-        ${h.secure_form(h.route_path('repo_files_update_file', repo_name=c.repo_name, commit_id=c.commit.raw_id, f_path=c.f_path), id='eform', method='POST', request=request)}
+        ${h.secure_form(h.route_path('repo_files_update_file', repo_name=c.repo_name, commit_id=c.commit.raw_id, f_path=c.f_path), id='eform', request=request)}
         <div id="codeblock" class="codeblock" >
         <div class="code-header">
             <div class="stats">
                 <i class="icon-file"></i>
                 <span class="item">${h.link_to("r%s:%s" % (c.file.commit.idx,h.short_id(c.file.commit.raw_id)),h.route_path('repo_commit',repo_name=c.repo_name,commit_id=c.file.commit.raw_id))}</span>
                 <span class="item">${h.format_byte_size_binary(c.file.size)}</span>
                 <span class="item last">${c.file.mimetype}</span>
                 <div class="buttons">
                   <a class="btn btn-mini" href="${h.route_path('repo_changelog_file',repo_name=c.repo_name, commit_id=c.commit.raw_id, f_path=c.f_path)}">
                       <i class="icon-time"></i> ${_('history')}
                   </a>
 
                   % if h.HasRepoPermissionAny('repository.write','repository.admin')(c.repo_name):
                    % if not c.file.is_binary:
                       %if True:
                         ${h.link_to(_('source'),    h.route_path('repo_files',          repo_name=c.repo_name,commit_id=c.commit.raw_id,f_path=c.f_path),class_="btn btn-mini")}
                       %else:
                         ${h.link_to(_('annotation'),h.route_path('repo_files:annotated',repo_name=c.repo_name,commit_id=c.commit.raw_id,f_path=c.f_path),class_="btn btn-mini")}
                       %endif
 
                       <a class="btn btn-mini" href="${h.route_path('repo_file_raw',repo_name=c.repo_name,commit_id=c.commit.raw_id,f_path=c.f_path)}">
                           ${_('raw')}
                       </a>
                       <a class="btn btn-mini" href="${h.route_path('repo_file_download',repo_name=c.repo_name,commit_id=c.commit.raw_id,f_path=c.f_path)}">
                           <i class="icon-archive"></i> ${_('download')}
                       </a>
                    % endif
                   % endif
                 </div>
             </div>
             <div class="form">
                 <label for="set_mode">${_('Editing file')}:</label>
                 ${'%s /' % c.file.dir_path if c.file.dir_path else c.file.dir_path}
                 <input id="filename" type="text" name="filename" value="${c.file.name}">
 
                 ${h.dropdownmenu('set_mode','plain',[('plain',_('plain'))],enable_filter=True)}
                 <label for="line_wrap">${_('line wraps')}</label>
                 ${h.dropdownmenu('line_wrap', 'off', [('on', _('on')), ('off', _('off')),])}
 
                 <div id="render_preview" class="btn btn-small preview hidden">${_('Preview')}</div>
             </div>
         </div>
             <div id="editor_container">
                 <pre id="editor_pre"></pre>
                 <textarea id="editor" name="content" >${h.escape(c.file.content)|n}</textarea>
                 <div id="editor_preview" ></div>
             </div>
         </div>
     </div>
 
     <div class="edit-file-fieldset">
         <div class="fieldset">
             <div id="commit-message-label" class="commit-message-label left-label">
                 ${_('Commit Message')}:
             </div>
             <div class="right-content">
                 <div class="message">
                     <textarea id="commit" name="message" placeholder="${c.default_message}"></textarea>
                 </div>
             </div>
         </div>
         <div class="pull-right">
             ${h.reset('reset',_('Cancel'),class_="btn btn-small")}
             ${h.submit('commit',_('Commit changes'),class_="btn btn-small btn-success")}
         </div>
     </div>
     ${h.end_form()}
 </div>
 
 <script type="text/javascript">
 $(document).ready(function(){
     var renderer = "${renderer}";
     var reset_url = "${h.route_path('repo_files',repo_name=c.repo_name,commit_id=c.commit.raw_id,f_path=c.file.path)}";
     var myCodeMirror = initCodeMirror('editor', reset_url);
 
     var modes_select = $('#set_mode');
     fillCodeMirrorOptions(modes_select);
 
     // try to detect the mode based on the file we edit
     var mimetype = "${c.file.mimetype}";
     var detected_mode = detectCodeMirrorMode(
             "${c.file.name}", mimetype);
 
     if(detected_mode){
         setCodeMirrorMode(myCodeMirror, detected_mode);
         $(modes_select).select2("val", mimetype);
         $(modes_select).change();
         setCodeMirrorMode(myCodeMirror, detected_mode);
     }
 
     var filename_selector = '#filename';
     var callback = function(filename, mimetype, mode){
         CodeMirrorPreviewEnable(mode);
     };
     // on change of select field set mode
     setCodeMirrorModeFromSelect(
             modes_select, filename_selector, myCodeMirror, callback);
 
     // on entering the new filename set mode, from given extension
     setCodeMirrorModeFromInput(
         modes_select, filename_selector, myCodeMirror, callback);
 
     // if the file is renderable set line wraps automatically
     if (renderer !== ""){
         var line_wrap = 'on';
         $($('#line_wrap option[value="'+line_wrap+'"]')[0]).attr("selected", "selected");
         setCodeMirrorLineWrap(myCodeMirror, true);
     }
     // on select line wraps change the editor
     $('#line_wrap').on('change', function(e){
         var selected = e.currentTarget;
         var line_wraps = {'on': true, 'off': false}[selected.value];
         setCodeMirrorLineWrap(myCodeMirror, line_wraps)
     });
 
     // render preview/edit button
     if (mimetype === 'text/x-rst' || mimetype === 'text/plain') {
         $('#render_preview').removeClass('hidden');
     }
     $('#render_preview').on('click', function(e){
         if($(this).hasClass('preview')){
             $(this).removeClass('preview');
             $(this).html("${_('Edit')}");
             $('#editor_preview').show();
             $(myCodeMirror.getWrapperElement()).hide();
 
             var possible_renderer = {
                 'rst':'rst',
                 'markdown':'markdown',
                 'gfm': 'markdown'}[myCodeMirror.getMode().name];
             var _text = myCodeMirror.getValue();
             var _renderer = possible_renderer || DEFAULT_RENDERER;
             var post_data = {'text': _text, 'renderer': _renderer, 'csrf_token': CSRF_TOKEN};
             $('#editor_preview').html(_gettext('Loading ...'));
             var url = pyroutes.url('repo_commit_comment_preview',
                     {'repo_name': '${c.repo_name}',
                      'commit_id': '${c.commit.raw_id}'});
             ajaxPOST(url, post_data, function(o){
                 $('#editor_preview').html(o);
             })
         }
         else{
             $(this).addClass('preview');
             $(this).html("${_('Preview')}");
             $('#editor_preview').hide();
             $(myCodeMirror.getWrapperElement()).show();
         }
     });
 
 })
 </script>
 </%def>

rhodecode/templates/forks/fork.mako

@@ -1,134 +1,134 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="/base/base.mako"/>
 
 <%def name="title()">
     ${_('Fork repository %s') % c.repo_name}
     %if c.rhodecode_name:
         &middot; ${h.branding(c.rhodecode_name)}
     %endif
 </%def>
 
 <%def name="breadcrumbs_links()">
     ${_('New Fork')}
 </%def>
 
 <%def name="menu_bar_nav()">
     ${self.menu_items(active='repositories')}
 </%def>
 
 <%def name="menu_bar_subnav()">
   ${self.repo_menu(active='options')}
 </%def>
 
 <%def name="main()">
 <div class="box">
       <div class="title">
           ${self.repo_page_title(c.rhodecode_db_repo)}
           ${self.breadcrumbs()}
       </div>
 
-    ${h.secure_form(h.route_path('repo_fork_create',repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
+    ${h.secure_form(h.route_path('repo_fork_create',repo_name=c.rhodecode_db_repo.repo_name), request=request)}
     <div class="form">
         <!-- fields -->
         <div class="fields">
 
             <div class="field">
               <div class="label">
                   <label for="repo_name">${_('Fork name')}:</label>
               </div>
               <div class="input">
                   ${h.text('repo_name', class_="medium")}
                   ${h.hidden('repo_type',c.rhodecode_db_repo.repo_type)}
                   ${h.hidden('fork_parent_id',c.rhodecode_db_repo.repo_id)}
               </div>
             </div>
 
             <div class="field">
                 <div class="label label-textarea">
                     <label for="description">${_('Description')}:</label>
                 </div>
                 <div class="textarea-repo textarea text-area editor">
                     ${h.textarea('description')}
                     <% metatags_url = h.literal('''<a href="#metatagsShow" onclick="$('#meta-tags-desc').toggle();return false">meta-tags</a>''') %>
                     <span class="help-block">${_('Plain text format with support of {metatags}. Add a README file for longer descriptions').format(metatags=metatags_url)|n}</span>
                     <span id="meta-tags-desc" style="display: none">
                         <%namespace name="dt" file="/data_table/_dt_elements.mako"/>
                         ${dt.metatags_help()}
                     </span>
                 </div>
             </div>
 
             <div class="field">
                  <div class="label">
                      <label for="repo_group">${_('Repository group')}:</label>
                  </div>
                  <div class="select">
                      ${h.select('repo_group','',c.repo_groups,class_="medium")}
                      % if c.personal_repo_group:
                          <a class="btn" href="#" id="select_my_group" data-personal-group-id="${c.personal_repo_group.group_id}">
                              ${_('Select my personal group (%(repo_group_name)s)') % {'repo_group_name': c.personal_repo_group.group_name}}
                          </a>
                      % endif
                      <span class="help-block">${_('Optionally select a group to put this repository into.')}</span>
                  </div>
             </div>
 
              <div class="field">
                 <div class="label">
                     <label for="landing_rev">${_('Landing commit')}:</label>
                 </div>
                 <div class="select">
                     ${h.select('landing_rev','',c.landing_revs,class_="medium")}
                     <span class="help-block">${_('Default commit for files page, downloads, whoosh and readme')}</span>
                 </div>
             </div>
 
             <div class="field">
                 <div class="label label-checkbox">
                     <label for="private">${_('Private')}:</label>
                 </div>
                 <div class="checkboxes">
                     ${h.checkbox('private',value="True")}
                     <span class="help-block">${_('Private repositories are only visible to people explicitly added as collaborators.')}</span>
                 </div>
             </div>
 
             <div class="field">
                 <div class="label label-checkbox">
                     <label for="private">${_('Copy permissions')}:</label>
                 </div>
                 <div class="checkboxes">
                     ${h.checkbox('copy_permissions',value="True", checked="checked")}
                     <span class="help-block">${_('Copy permissions from forked repository')}</span>
                 </div>
             </div>
 
             <div class="buttons">
                 ${h.submit('',_('Fork this Repository'),class_="btn")}
             </div>
         </div>
     </div>
     ${h.end_form()}
 </div>
 <script>
     $(document).ready(function(){
         $("#repo_group").select2({
             'dropdownAutoWidth': true,
             'containerCssClass': "drop-menu",
             'dropdownCssClass': "drop-menu-dropdown",
             'width': "resolve"
         });
         $("#landing_rev").select2({
             'containerCssClass': "drop-menu",
             'dropdownCssClass': "drop-menu-dropdown",
             'minimumResultsForSearch': -1
         });
         $('#repo_name').focus();
 
         $('#select_my_group').on('click', function(e){
             e.preventDefault();
             $("#repo_group").val($(this).data('personalGroupId')).trigger("change");
         })
     })
 </script>
 </%def>

rhodecode/templates/pullrequests/pullrequest.mako

@@ -1,526 +1,526 b''
 <%inherit file="/base/base.mako"/>
 
 <%def name="title()">
     ${c.repo_name} ${_('New pull request')}
 </%def>
 
 <%def name="breadcrumbs_links()">
     ${_('New pull request')}
 </%def>
 
 <%def name="menu_bar_nav()">
     ${self.menu_items(active='repositories')}
 </%def>
 
 <%def name="menu_bar_subnav()">
     ${self.repo_menu(active='showpullrequest')}
 </%def>
 
 <%def name="main()">
 <div class="box">
     <div class="title">
         ${self.repo_page_title(c.rhodecode_db_repo)}
     </div>
 
-    ${h.secure_form(h.route_path('pullrequest_create', repo_name=c.repo_name, _query=request.GET.mixed()), id='pull_request_form', method='POST', request=request)}
+    ${h.secure_form(h.route_path('pullrequest_create', repo_name=c.repo_name, _query=request.GET.mixed()), id='pull_request_form', request=request)}
 
         ${self.breadcrumbs()}
 
         <div class="box pr-summary">
 
             <div class="summary-details block-left">
 
 
                 <div class="pr-details-title">
                     ${_('Pull request summary')}
                 </div>
 
                 <div class="form" style="padding-top: 10px">
                     <!-- fields -->
 
                     <div class="fields" >
 
                          <div class="field">
                             <div class="label">
                                 <label for="pullrequest_title">${_('Title')}:</label>
                             </div>
                             <div class="input">
                                 ${h.text('pullrequest_title', c.default_title, class_="medium autogenerated-title")}
                             </div>
                          </div>
 
                         <div class="field">
                             <div class="label label-textarea">
                                 <label for="pullrequest_desc">${_('Description')}:</label>
                             </div>
                             <div class="textarea text-area editor">
                                 ${h.textarea('pullrequest_desc',size=30, )}
                                 <span class="help-block">${_('Write a short description on this pull request')}</span>
                             </div>
                         </div>
 
                         <div class="field">
                             <div class="label label-textarea">
                                 <label for="pullrequest_desc">${_('Commit flow')}:</label>
                             </div>
 
                             ## TODO: johbo: Abusing the "content" class here to get the
                             ## desired effect. Should be replaced by a proper solution.
 
                             ##ORG
                             <div class="content">
                                 <strong>${_('Source repository')}:</strong>
                                 ${c.rhodecode_db_repo.description}
                             </div>
                             <div class="content">
                                 ${h.hidden('source_repo')}
                                 ${h.hidden('source_ref')}
                             </div>
 
                             ##OTHER, most Probably the PARENT OF THIS FORK
                             <div class="content">
                                 ## filled with JS
                                 <div id="target_repo_desc"></div>
                             </div>
 
                             <div class="content">
                                 ${h.hidden('target_repo')}
                                 ${h.hidden('target_ref')}
                                 <span id="target_ref_loading" style="display: none">
                                     ${_('Loading refs...')}
                                 </span>
                             </div>
                         </div>
 
                         <div class="field">
                             <div class="label label-textarea">
                                 <label for="pullrequest_submit"></label>
                             </div>
                             <div class="input">
                                 <div class="pr-submit-button">
                                     ${h.submit('save',_('Submit Pull Request'),class_="btn")}
                                 </div>
                                 <div id="pr_open_message"></div>
                             </div>
                         </div>
 
                         <div class="pr-spacing-container"></div>
                     </div>
                 </div>
             </div>
             <div>
                 ## AUTHOR
                 <div class="reviewers-title block-right">
                   <div class="pr-details-title">
                       ${_('Author of this pull request')}
                   </div>
                 </div>
                 <div class="block-right pr-details-content reviewers">
                     <ul class="group_members">
                       <li>
                         ${self.gravatar_with_user(c.rhodecode_user.email, 16)}
                       </li>
                     </ul>
                 </div>
 
                 ## REVIEW RULES
                 <div id="review_rules" style="display: none" class="reviewers-title block-right">
                     <div class="pr-details-title">
                         ${_('Reviewer rules')}
                     </div>
                     <div class="pr-reviewer-rules">
                         ## review rules will be appended here, by default reviewers logic
                     </div>
                 </div>
 
                 ## REVIEWERS
                 <div class="reviewers-title block-right">
                     <div class="pr-details-title">
                         ${_('Pull request reviewers')}
                         <span class="calculate-reviewers"> - ${_('loading...')}</span>
                     </div>
                 </div>
                 <div id="reviewers" class="block-right pr-details-content reviewers">
                     ## members goes here, filled via JS based on initial selection !
                     <input type="hidden" name="__start__" value="review_members:sequence">
                     <ul id="review_members" class="group_members"></ul>
                     <input type="hidden" name="__end__" value="review_members:sequence">
                     <div id="add_reviewer_input" class='ac'>
                         <div class="reviewer_ac">
                             ${h.text('user', class_='ac-input', placeholder=_('Add reviewer or reviewer group'))}
                             <div id="reviewers_container"></div>
                         </div>
                     </div>
                 </div>
             </div>
         </div>
         <div class="box">
             <div>
                 ## overview pulled by ajax
                 <div id="pull_request_overview"></div>
             </div>
         </div>
     ${h.end_form()}
 </div>
 
 <script type="text/javascript">
 $(function(){
   var defaultSourceRepo = '${c.default_repo_data['source_repo_name']}';
   var defaultSourceRepoData = ${c.default_repo_data['source_refs_json']|n};
   var defaultTargetRepo = '${c.default_repo_data['target_repo_name']}';
   var defaultTargetRepoData = ${c.default_repo_data['target_refs_json']|n};
 
   var $pullRequestForm = $('#pull_request_form');
   var $sourceRepo = $('#source_repo', $pullRequestForm);
   var $targetRepo = $('#target_repo', $pullRequestForm);
   var $sourceRef = $('#source_ref', $pullRequestForm);
   var $targetRef = $('#target_ref', $pullRequestForm);
 
   var sourceRepo = function() { return $sourceRepo.eq(0).val() };
   var sourceRef = function() { return $sourceRef.eq(0).val().split(':') };
 
   var targetRepo = function() { return $targetRepo.eq(0).val() };
   var targetRef = function() { return $targetRef.eq(0).val().split(':') };
 
   var calculateContainerWidth = function() {
       var maxWidth = 0;
       var repoSelect2Containers = ['#source_repo', '#target_repo'];
       $.each(repoSelect2Containers, function(idx, value) {
           $(value).select2('container').width('auto');
           var curWidth = $(value).select2('container').width();
           if (maxWidth <= curWidth) {
               maxWidth = curWidth;
           }
           $.each(repoSelect2Containers, function(idx, value) {
               $(value).select2('container').width(maxWidth + 10);
           });
       });
   };
 
   var initRefSelection = function(selectedRef) {
       return function(element, callback) {
           // translate our select2 id into a text, it's a mapping to show
           // simple label when selecting by internal ID.
           var id, refData;
           if (selectedRef === undefined) {
             id = element.val();
             refData = element.val().split(':');
           } else {
             id = selectedRef;
             refData = selectedRef.split(':');
           }
 
           var text = refData[1];
           if (refData[0] === 'rev') {
               text = text.substring(0, 12);
           }
 
           var data = {id: id, text: text};
 
           callback(data);
       };
   };
 
   var formatRefSelection = function(item) {
       var prefix = '';
       var refData = item.id.split(':');
       if (refData[0] === 'branch') {
           prefix = '<i class="icon-branch"></i>';
       }
       else if (refData[0] === 'book') {
           prefix = '<i class="icon-bookmark"></i>';
       }
       else if (refData[0] === 'tag') {
           prefix = '<i class="icon-tag"></i>';
       }
 
       var originalOption = item.element;
       return prefix + item.text;
   };
 
   // custom code mirror
   var codeMirrorInstance = initPullRequestsCodeMirror('#pullrequest_desc');
 
   reviewersController = new ReviewersController();
 
   var queryTargetRepo = function(self, query) {
       // cache ALL results if query is empty
       var cacheKey = query.term || '__';
       var cachedData = self.cachedDataSource[cacheKey];
 
       if (cachedData) {
           query.callback({results: cachedData.results});
       } else {
           $.ajax({
               url: pyroutes.url('pullrequest_repo_destinations', {'repo_name': templateContext.repo_name}),
               data: {query: query.term},
               dataType: 'json',
               type: 'GET',
               success: function(data) {
                   self.cachedDataSource[cacheKey] = data;
                   query.callback({results: data.results});
               },
               error: function(data, textStatus, errorThrown) {
                   alert(
                     "Error while fetching entries.\nError code {0} ({1}).".format(data.status, data.statusText));
               }
           });
       }
   };
 
   var queryTargetRefs = function(initialData, query) {
       var data = {results: []};
       // filter initialData
       $.each(initialData, function() {
           var section = this.text;
           var children = [];
           $.each(this.children, function() {
               if (query.term.length === 0 ||
                   this.text.toUpperCase().indexOf(query.term.toUpperCase()) >= 0 ) {
                   children.push({'id': this.id, 'text': this.text})
               }
           });
           data.results.push({'text': section, 'children': children})
       });
       query.callback({results: data.results});
   };
 
   var loadRepoRefDiffPreview = function() {
 
       var url_data = {
           'repo_name': targetRepo(),
           'target_repo': sourceRepo(),
           'source_ref': targetRef()[2],
           'source_ref_type': 'rev',
           'target_ref': sourceRef()[2],
           'target_ref_type': 'rev',
           'merge': true,
           '_': Date.now() // bypass browser caching
       }; // gather the source/target ref and repo here
 
       if (sourceRef().length !== 3 || targetRef().length !== 3) {
           prButtonLock(true, "${_('Please select source and target')}");
           return;
       }
       var url = pyroutes.url('repo_compare', url_data);
 
       // lock PR button, so we cannot send PR before it's calculated
       prButtonLock(true, "${_('Loading compare ...')}", 'compare');
 
       if (loadRepoRefDiffPreview._currentRequest) {
           loadRepoRefDiffPreview._currentRequest.abort();
       }
 
       loadRepoRefDiffPreview._currentRequest = $.get(url)
           .error(function(data, textStatus, errorThrown) {
                 alert(
                 "Error while processing request.\nError code {0} ({1}).".format(
                         data.status, data.statusText));
           })
           .done(function(data) {
               loadRepoRefDiffPreview._currentRequest = null;
               $('#pull_request_overview').html(data);
 
               var commitElements = $(data).find('tr[commit_id]');
 
               var prTitleAndDesc = getTitleAndDescription(
                   sourceRef()[1], commitElements, 5);
 
               var title = prTitleAndDesc[0];
               var proposedDescription = prTitleAndDesc[1];
 
               var useGeneratedTitle = (
                    $('#pullrequest_title').hasClass('autogenerated-title') ||
                    $('#pullrequest_title').val() === "");
 
               if (title && useGeneratedTitle) {
                   // use generated title if we haven't specified our own
                   $('#pullrequest_title').val(title);
                   $('#pullrequest_title').addClass('autogenerated-title');
 
               }
 
               var useGeneratedDescription = (
                   !codeMirrorInstance._userDefinedDesc ||
                    codeMirrorInstance.getValue() === "");
 
               if (proposedDescription && useGeneratedDescription) {
                   // set proposed content, if we haven't defined our own,
                   // or we don't have description written
                   codeMirrorInstance._userDefinedDesc = false; // reset state
                   codeMirrorInstance.setValue(proposedDescription);
               }
 
               var msg = '';
               if (commitElements.length === 1) {
                   msg = "${_ungettext('This pull request will consist of __COMMITS__ commit.', 'This pull request will consist of __COMMITS__ commits.', 1)}";
               } else {
                   msg = "${_ungettext('This pull request will consist of __COMMITS__ commit.', 'This pull request will consist of __COMMITS__ commits.', 2)}";
               }
 
               msg += ' <a id="pull_request_overview_url" href="{0}" target="_blank">${_('Show detailed compare.')}</a>'.format(url);
 
               if (commitElements.length) {
                   var commitsLink = '<a href="#pull_request_overview"><strong>{0}</strong></a>'.format(commitElements.length);
                   prButtonLock(false, msg.replace('__COMMITS__', commitsLink), 'compare');
               }
               else {
                   prButtonLock(true, "${_('There are no commits to merge.')}", 'compare');
               }
 
 
           });
   };
 
   var Select2Box = function(element, overrides) {
     var globalDefaults = {
         dropdownAutoWidth: true,
         containerCssClass: "drop-menu",
         dropdownCssClass: "drop-menu-dropdown"
     };
 
     var initSelect2 = function(defaultOptions) {
       var options = jQuery.extend(globalDefaults, defaultOptions, overrides);
       element.select2(options);
     };
 
     return {
       initRef: function() {
         var defaultOptions = {
           minimumResultsForSearch: 5,
           formatSelection: formatRefSelection
         };
 
         initSelect2(defaultOptions);
       },
 
       initRepo: function(defaultValue, readOnly) {
         var defaultOptions = {
           initSelection : function (element, callback) {
             var data = {id: defaultValue, text: defaultValue};
             callback(data);
           }
         };
 
         initSelect2(defaultOptions);
 
         element.select2('val', defaultSourceRepo);
         if (readOnly === true) {
           element.select2('readonly', true);
         }
       }
     };
   };
 
   var initTargetRefs = function(refsData, selectedRef){
     Select2Box($targetRef, {
       query: function(query) {
         queryTargetRefs(refsData, query);
       },
       initSelection : initRefSelection(selectedRef)
     }).initRef();
 
     if (!(selectedRef === undefined)) {
         $targetRef.select2('val', selectedRef);
     }
   };
 
   var targetRepoChanged = function(repoData) {
       // generate new DESC of target repo displayed next to select
       $('#target_repo_desc').html(
           "<strong>${_('Target repository')}</strong>: {0}".format(repoData['description'])
       );
 
       // generate dynamic select2 for refs.
       initTargetRefs(repoData['refs']['select2_refs'],
                      repoData['refs']['selected_ref']);
 
   };
 
   var sourceRefSelect2 = Select2Box($sourceRef, {
       placeholder: "${_('Select commit reference')}",
       query: function(query) {
         var initialData = defaultSourceRepoData['refs']['select2_refs'];
         queryTargetRefs(initialData, query)
       },
       initSelection: initRefSelection()
     }
   );
 
   var sourceRepoSelect2 = Select2Box($sourceRepo, {
     query: function(query) {}
   });
 
   var targetRepoSelect2 = Select2Box($targetRepo, {
     cachedDataSource: {},
     query: $.debounce(250, function(query) {
       queryTargetRepo(this, query);
     }),
     formatResult: formatResult
   });
 
   sourceRefSelect2.initRef();
 
   sourceRepoSelect2.initRepo(defaultSourceRepo, true);
 
   targetRepoSelect2.initRepo(defaultTargetRepo, false);
 
   $sourceRef.on('change', function(e){
     loadRepoRefDiffPreview();
     reviewersController.loadDefaultReviewers(
         sourceRepo(), sourceRef(), targetRepo(), targetRef());
   });
 
   $targetRef.on('change', function(e){
     loadRepoRefDiffPreview();
     reviewersController.loadDefaultReviewers(
         sourceRepo(), sourceRef(), targetRepo(), targetRef());
   });
 
   $targetRepo.on('change', function(e){
       var repoName = $(this).val();
       calculateContainerWidth();
       $targetRef.select2('destroy');
       $('#target_ref_loading').show();
 
       $.ajax({
           url: pyroutes.url('pullrequest_repo_refs',
             {'repo_name': templateContext.repo_name, 'target_repo_name':repoName}),
           data: {},
           dataType: 'json',
           type: 'GET',
           success: function(data) {
               $('#target_ref_loading').hide();
               targetRepoChanged(data);
               loadRepoRefDiffPreview();
           },
           error: function(data, textStatus, errorThrown) {
               alert("Error while fetching entries.\nError code {0} ({1}).".format(data.status, data.statusText));
           }
       })
 
   });
 
   prButtonLock(true, "${_('Please select source and target')}", 'all');
 
   // auto-load on init, the target refs select2
   calculateContainerWidth();
   targetRepoChanged(defaultTargetRepoData);
 
   $('#pullrequest_title').on('keyup', function(e){
       $(this).removeClass('autogenerated-title');
   });
 
   % if c.default_source_ref:
   // in case we have a pre-selected value, use it now
   $sourceRef.select2('val', '${c.default_source_ref}');
   loadRepoRefDiffPreview();
   reviewersController.loadDefaultReviewers(
       sourceRepo(), sourceRef(), targetRepo(), targetRef());
   % endif
 
   ReviewerAutoComplete('#user');
 });
 </script>
 
 </%def>

rhodecode/templates/pullrequests/pullrequest_merge_checks.mako

@@ -1,78 +1,78 b''
 
 <div class="pull-request-wrap">
 
     % if c.pr_merge_possible:
         <h2 class="merge-status">
             <span class="merge-icon success"><i class="icon-ok"></i></span>
             ${_('This pull request can be merged automatically.')}
         </h2>
     % else:
         <h2 class="merge-status">
             <span class="merge-icon warning"><i class="icon-false"></i></span>
             ${_('Merge is not currently possible because of below failed checks.')}
         </h2>
     % endif
 
     % if c.pr_merge_errors.items():
     <ul>
         % for pr_check_key, pr_check_details in c.pr_merge_errors.items():
             <% pr_check_type = pr_check_details['error_type'] %>
             <li>
                 <span class="merge-message ${pr_check_type}" data-role="merge-message">
                     - ${pr_check_details['message']}
                     % if pr_check_key == 'todo':
                         % for co in pr_check_details['details']:
                             <a class="permalink" href="#comment-${co.comment_id}" onclick="Rhodecode.comments.scrollToComment($('#comment-${co.comment_id}'), 0, ${h.json.dumps(co.outdated)})"> #${co.comment_id}</a>${'' if loop.last else ','}
                         % endfor
                     % endif
                 </span>
             </li>
         % endfor
     </ul>
     % endif
 
     <div class="pull-request-merge-actions">
         % if c.allowed_to_merge:
           ## Merge info, show only if all errors are taken care of
           % if not c.pr_merge_errors and c.pr_merge_info:
               <div class="pull-request-merge-info">
                   <ul>
                     % for pr_merge_key, pr_merge_details in c.pr_merge_info.items():
                     <li>
                         - ${pr_merge_details['message']}
                     </li>
                     % endfor
                   </ul>
               </div>
           % endif
 
         <div>
-          ${h.secure_form(h.route_path('pullrequest_merge', repo_name=c.repo_name, pull_request_id=c.pull_request.pull_request_id), id='merge_pull_request_form', method='POST', request=request)}
+          ${h.secure_form(h.route_path('pullrequest_merge', repo_name=c.repo_name, pull_request_id=c.pull_request.pull_request_id), id='merge_pull_request_form', request=request)}
           <% merge_disabled = ' disabled' if c.pr_merge_possible is False else '' %>
           <a class="btn" href="#" onclick="refreshMergeChecks(); return false;">${_('refresh checks')}</a>
           <input type="submit" id="merge_pull_request" value="${_('Merge Pull Request')}" class="btn${merge_disabled}"${merge_disabled}>
           ${h.end_form()}
         </div>
         % elif c.rhodecode_user.username != h.DEFAULT_USER:
             <a class="btn" href="#" onclick="refreshMergeChecks(); return false;">${_('refresh checks')}</a>
             <input type="submit" value="${_('Merge Pull Request')}" class="btn disabled" disabled="disabled" title="${_('You are not allowed to merge this pull request.')}">
         % else:
           <input type="submit" value="${_('Login to Merge this Pull Request')}" class="btn disabled" disabled="disabled">
         % endif
     </div>
 
     % if c.allowed_to_close:
         ## close PR action, injected later next to COMMENT button
         <div id="close-pull-request-action" style="display: none">
         % if c.pull_request_review_status == c.REVIEW_STATUS_APPROVED:
         <a class="btn btn-approved-status" href="#close-as-approved" onclick="closePullRequest('${c.REVIEW_STATUS_APPROVED}'); return false;">
             ${_('Close with status {}').format(h.commit_status_lbl(c.REVIEW_STATUS_APPROVED))}
         </a>
         % else:
         <a class="btn btn-rejected-status" href="#close-as-rejected" onclick="closePullRequest('${c.REVIEW_STATUS_REJECTED}'); return false;">
             ${_('Close with status {}').format(h.commit_status_lbl(c.REVIEW_STATUS_REJECTED))}
         </a>
         % endif
         </div>
     % endif
 </div>

rhodecode/templates/pullrequests/pullrequest_show.mako

@@ -1,866 +1,866 b''
 <%inherit file="/base/base.mako"/>
 <%namespace name="base" file="/base/base.mako"/>
 
 <%def name="title()">
     ${_('%s Pull Request #%s') % (c.repo_name, c.pull_request.pull_request_id)}
     %if c.rhodecode_name:
         &middot; ${h.branding(c.rhodecode_name)}
     %endif
 </%def>
 
 <%def name="breadcrumbs_links()">
     <span id="pr-title">
     ${c.pull_request.title}
     %if c.pull_request.is_closed():
         (${_('Closed')})
     %endif
     </span>
     <div id="pr-title-edit" class="input" style="display: none;">
         ${h.text('pullrequest_title', id_="pr-title-input", class_="large", value=c.pull_request.title)}
     </div>
 </%def>
 
 <%def name="menu_bar_nav()">
     ${self.menu_items(active='repositories')}
 </%def>
 
 <%def name="menu_bar_subnav()">
     ${self.repo_menu(active='showpullrequest')}
 </%def>
 
 <%def name="main()">
 
 <script type="text/javascript">
     // TODO: marcink switch this to pyroutes
     AJAX_COMMENT_DELETE_URL = "${h.route_path('pullrequest_comment_delete',repo_name=c.repo_name,pull_request_id=c.pull_request.pull_request_id,comment_id='__COMMENT_ID__')}";
     templateContext.pull_request_data.pull_request_id = ${c.pull_request.pull_request_id};
 </script>
 <div class="box">
 
   <div class="title">
     ${self.repo_page_title(c.rhodecode_db_repo)}
   </div>
 
   ${self.breadcrumbs()}
 
   <div class="box pr-summary">
 
       <div class="summary-details block-left">
         <% summary = lambda n:{False:'summary-short'}.get(n) %>
         <div class="pr-details-title">
             <a href="${h.route_path('pull_requests_global', pull_request_id=c.pull_request.pull_request_id)}">${_('Pull request #%s') % c.pull_request.pull_request_id}</a> ${_('From')} ${h.format_date(c.pull_request.created_on)}
             %if c.allowed_to_update:
               <div id="delete_pullrequest" class="pull-right action_button ${'' if c.allowed_to_delete else 'disabled' }" style="clear:inherit;padding: 0">
                   % if c.allowed_to_delete:
-                      ${h.secure_form(h.route_path('pullrequest_delete', repo_name=c.pull_request.target_repo.repo_name, pull_request_id=c.pull_request.pull_request_id), method='POST', request=request)}
+                      ${h.secure_form(h.route_path('pullrequest_delete', repo_name=c.pull_request.target_repo.repo_name, pull_request_id=c.pull_request.pull_request_id), request=request)}
                           ${h.submit('remove_%s' % c.pull_request.pull_request_id, _('Delete'),
                         class_="btn btn-link btn-danger no-margin",onclick="return confirm('"+_('Confirm to delete this pull request')+"');")}
                       ${h.end_form()}
                   % else:
                     ${_('Delete')}
                   % endif
               </div>
               <div id="open_edit_pullrequest" class="pull-right action_button">${_('Edit')}</div>
               <div id="close_edit_pullrequest" class="pull-right action_button" style="display: none;padding: 0">${_('Cancel')}</div>
             %endif
         </div>
 
         <div id="summary" class="fields pr-details-content">
            <div class="field">
             <div class="label-summary">
                 <label>${_('Source')}:</label>
             </div>
             <div class="input">
                 <div class="pr-origininfo">
                     ## branch link is only valid if it is a branch
                     <span class="tag">
                       %if c.pull_request.source_ref_parts.type == 'branch':
                         <a href="${h.route_path('repo_changelog', repo_name=c.pull_request.source_repo.repo_name, _query=dict(branch=c.pull_request.source_ref_parts.name))}">${c.pull_request.source_ref_parts.type}: ${c.pull_request.source_ref_parts.name}</a>
                       %else:
                         ${c.pull_request.source_ref_parts.type}: ${c.pull_request.source_ref_parts.name}
                       %endif
                     </span>
                     <span class="clone-url">
                         <a href="${h.route_path('repo_summary', repo_name=c.pull_request.source_repo.repo_name)}">${c.pull_request.source_repo.clone_url()}</a>
                     </span>
                     <br/>
                     % if c.ancestor_commit:
                         ${_('Common ancestor')}:
                         <code><a href="${h.route_path('repo_commit', repo_name=c.target_repo.repo_name, commit_id=c.ancestor_commit.raw_id)}">${h.show_id(c.ancestor_commit)}</a></code>
                     % endif
                 </div>
                 %if h.is_hg(c.pull_request.source_repo):
                     <% clone_url = 'hg pull -r {} {}'.format(h.short_id(c.source_ref), c.pull_request.source_repo.clone_url()) %>
                 %elif h.is_git(c.pull_request.source_repo):
                     <% clone_url = 'git pull {} {}'.format(c.pull_request.source_repo.clone_url(), c.pull_request.source_ref_parts.name) %>
                 %endif
 
                 <div class="">
                     <input type="text" class="input-monospace pr-pullinfo" value="${clone_url}" readonly="readonly">
                     <i class="tooltip icon-clipboard clipboard-action pull-right pr-pullinfo-copy" data-clipboard-text="${clone_url}" title="${_('Copy the pull url')}"></i>
                 </div>
 
             </div>
            </div>
            <div class="field">
             <div class="label-summary">
                 <label>${_('Target')}:</label>
             </div>
             <div class="input">
                 <div class="pr-targetinfo">
                     ## branch link is only valid if it is a branch
                     <span class="tag">
                       %if c.pull_request.target_ref_parts.type == 'branch':
                         <a href="${h.route_path('repo_changelog', repo_name=c.pull_request.target_repo.repo_name, _query=dict(branch=c.pull_request.target_ref_parts.name))}">${c.pull_request.target_ref_parts.type}: ${c.pull_request.target_ref_parts.name}</a>
                       %else:
                         ${c.pull_request.target_ref_parts.type}: ${c.pull_request.target_ref_parts.name}
                       %endif
                     </span>
                     <span class="clone-url">
                         <a href="${h.route_path('repo_summary', repo_name=c.pull_request.target_repo.repo_name)}">${c.pull_request.target_repo.clone_url()}</a>
                     </span>
                 </div>
             </div>
            </div>
 
             ## Link to the shadow repository.
             <div class="field">
                 <div class="label-summary">
                     <label>${_('Merge')}:</label>
                 </div>
                 <div class="input">
                     % if not c.pull_request.is_closed() and c.pull_request.shadow_merge_ref:
                         %if h.is_hg(c.pull_request.target_repo):
                             <% clone_url = 'hg clone --update {} {} pull-request-{}'.format(c.pull_request.shadow_merge_ref.name, c.shadow_clone_url, c.pull_request.pull_request_id) %>
                         %elif h.is_git(c.pull_request.target_repo):
                             <% clone_url = 'git clone --branch {} {} pull-request-{}'.format(c.pull_request.shadow_merge_ref.name, c.shadow_clone_url, c.pull_request.pull_request_id) %>
                         %endif
                         <div class="">
                             <input type="text" class="input-monospace pr-mergeinfo" value="${clone_url}" readonly="readonly">
                             <i class="tooltip icon-clipboard clipboard-action pull-right pr-mergeinfo-copy" data-clipboard-text="${clone_url}" title="${_('Copy the clone url')}"></i>
                         </div>
                     % else:
                         <div class="">
                             ${_('Shadow repository data not available')}.
                         </div>
                     % endif
                 </div>
             </div>
 
            <div class="field">
             <div class="label-summary">
                 <label>${_('Review')}:</label>
             </div>
             <div class="input">
               %if c.pull_request_review_status:
                 <div class="${'flag_status %s' % c.pull_request_review_status} tooltip pull-left"></div>
                 <span class="changeset-status-lbl tooltip">
                   %if c.pull_request.is_closed():
                       ${_('Closed')},
                   %endif
                   ${h.commit_status_lbl(c.pull_request_review_status)}
                 </span>
                 - ${_ungettext('calculated based on %s reviewer vote', 'calculated based on %s reviewers votes', len(c.pull_request_reviewers)) % len(c.pull_request_reviewers)}
               %endif
             </div>
            </div>
            <div class="field">
             <div class="pr-description-label label-summary">
                 <label>${_('Description')}:</label>
             </div>
             <div id="pr-desc" class="input">
                 <div class="pr-description">${h.urlify_commit_message(c.pull_request.description, c.repo_name)}</div>
             </div>
             <div id="pr-desc-edit" class="input textarea editor" style="display: none;">
                 <textarea id="pr-description-input" size="30">${c.pull_request.description}</textarea>
             </div>
            </div>
 
            <div class="field">
                <div class="label-summary">
                    <label>${_('Versions')}:</label>
                </div>
 
                <% outdated_comm_count_ver = len(c.inline_versions[None]['outdated']) %>
                <% general_outdated_comm_count_ver = len(c.comment_versions[None]['outdated']) %>
 
                <div class="pr-versions">
                % if c.show_version_changes:
                    <% outdated_comm_count_ver = len(c.inline_versions[c.at_version_num]['outdated']) %>
                    <% general_outdated_comm_count_ver = len(c.comment_versions[c.at_version_num]['outdated']) %>
                    <a id="show-pr-versions" class="input" onclick="return versionController.toggleVersionView(this)" href="#show-pr-versions"
                         data-toggle-on="${_ungettext('{} version available for this pull request, show it.', '{} versions available for this pull request, show them.', len(c.versions)).format(len(c.versions))}"
                         data-toggle-off="${_('Hide all versions of this pull request')}">
                        ${_ungettext('{} version available for this pull request, show it.', '{} versions available for this pull request, show them.', len(c.versions)).format(len(c.versions))}
                    </a>
                    <table>
                        ## SHOW ALL VERSIONS OF PR
                        <% ver_pr = None %>
 
                        % for data in reversed(list(enumerate(c.versions, 1))):
                            <% ver_pos = data[0] %>
                            <% ver = data[1] %>
                            <% ver_pr = ver.pull_request_version_id %>
                            <% display_row = '' if c.at_version and (c.at_version_num == ver_pr or c.from_version_num == ver_pr) else 'none' %>
 
                            <tr class="version-pr" style="display: ${display_row}">
                                <td>
                                     <code>
                                         <a href="${request.current_route_path(_query=dict(version=ver_pr or 'latest'))}">v${ver_pos}</a>
                                     </code>
                                </td>
                                <td>
                                    <input ${'checked="checked"' if c.from_version_num == ver_pr else ''} class="compare-radio-button" type="radio" name="ver_source" value="${ver_pr or 'latest'}" data-ver-pos="${ver_pos}"/>
                                    <input ${'checked="checked"' if c.at_version_num == ver_pr else ''} class="compare-radio-button" type="radio" name="ver_target" value="${ver_pr or 'latest'}" data-ver-pos="${ver_pos}"/>
                                </td>
                                <td>
                                 <% review_status = c.review_versions[ver_pr].status if ver_pr in c.review_versions else 'not_reviewed' %>
                                 <div class="${'flag_status %s' % review_status} tooltip pull-left" title="${_('Your review status at this version')}">
                                 </div>
                                </td>
                                <td>
                                    % if c.at_version_num != ver_pr:
                                     <i class="icon-comment"></i>
                                        <code class="tooltip" title="${_('Comment from pull request version {0}, general:{1} inline:{2}').format(ver_pos, len(c.comment_versions[ver_pr]['at']), len(c.inline_versions[ver_pr]['at']))}">
                                            G:${len(c.comment_versions[ver_pr]['at'])} / I:${len(c.inline_versions[ver_pr]['at'])}
                                        </code>
                                    % endif
                                </td>
                                <td>
                                    ##<code>${ver.source_ref_parts.commit_id[:6]}</code>
                                </td>
                                <td>
                                    ${h.age_component(ver.updated_on, time_is_local=True)}
                                </td>
                            </tr>
                        % endfor
 
                        <tr>
                            <td colspan="6">
                                <button id="show-version-diff" onclick="return versionController.showVersionDiff()" class="btn btn-sm" style="display: none"
                                        data-label-text-locked="${_('select versions to show changes')}"
                                        data-label-text-diff="${_('show changes between versions')}"
                                        data-label-text-show="${_('show pull request for this version')}"
                                >
                                    ${_('select versions to show changes')}
                                </button>
                            </td>
                        </tr>
 
                        ## show comment/inline comments summary
                        <%def name="comments_summary()">
                        <tr>
                            <td colspan="6" class="comments-summary-td">
 
                             % if c.at_version:
                                 <% inline_comm_count_ver = len(c.inline_versions[c.at_version_num]['display']) %>
                                 <% general_comm_count_ver = len(c.comment_versions[c.at_version_num]['display']) %>
                                 ${_('Comments at this version')}:
                             % else:
                                 <% inline_comm_count_ver = len(c.inline_versions[c.at_version_num]['until']) %>
                                 <% general_comm_count_ver = len(c.comment_versions[c.at_version_num]['until']) %>
                                 ${_('Comments for this pull request')}:
                             % endif
 
 
                             %if general_comm_count_ver:
                                 <a href="#comments">${_("%d General ") % general_comm_count_ver}</a>
                             %else:
                                 ${_("%d General ") % general_comm_count_ver}
                             %endif
 
                             %if inline_comm_count_ver:
                                , <a href="#" onclick="return Rhodecode.comments.nextComment();" id="inline-comments-counter">${_("%d Inline") % inline_comm_count_ver}</a>
                             %else:
                                , ${_("%d Inline") % inline_comm_count_ver}
                             %endif
 
                             %if outdated_comm_count_ver:
                               , <a href="#" onclick="showOutdated(); Rhodecode.comments.nextOutdatedComment(); return false;">${_("%d Outdated") % outdated_comm_count_ver}</a>
                                 <a href="#" class="showOutdatedComments" onclick="showOutdated(this); return false;"> | ${_('show outdated comments')}</a>
                                 <a href="#" class="hideOutdatedComments" style="display: none" onclick="hideOutdated(this); return false;"> | ${_('hide outdated comments')}</a>
                             %else:
                               , ${_("%d Outdated") % outdated_comm_count_ver}
                             %endif
                            </td>
                        </tr>
                        </%def>
                        ${comments_summary()}
                    </table>
                % else:
                    <div class="input">
                    ${_('Pull request versions not available')}.
                    </div>
                    <div>
                       <table>
                         ${comments_summary()}
                       </table>
                    </div>
                % endif
                </div>
            </div>
 
            <div id="pr-save" class="field" style="display: none;">
             <div class="label-summary"></div>
             <div class="input">
               <span id="edit_pull_request" class="btn btn-small no-margin">${_('Save Changes')}</span>
             </div>
            </div>
         </div>
       </div>
       <div>
         ## AUTHOR
         <div class="reviewers-title block-right">
           <div class="pr-details-title">
               ${_('Author of this pull request')}
           </div>
         </div>
         <div class="block-right pr-details-content reviewers">
             <ul class="group_members">
               <li>
                 ${self.gravatar_with_user(c.pull_request.author.email, 16)}
               </li>
             </ul>
         </div>
 
         ## REVIEW RULES
         <div id="review_rules" style="display: none" class="reviewers-title block-right">
             <div class="pr-details-title">
                 ${_('Reviewer rules')}
               %if c.allowed_to_update:
                 <span id="close_edit_reviewers" class="block-right action_button last-item" style="display: none;">${_('Close')}</span>
               %endif
             </div>
             <div class="pr-reviewer-rules">
                 ## review rules will be appended here, by default reviewers logic
             </div>
             <input id="review_data" type="hidden" name="review_data" value="">
         </div>
 
         ## REVIEWERS
         <div class="reviewers-title block-right">
           <div class="pr-details-title">
               ${_('Pull request reviewers')}
               %if c.allowed_to_update:
                 <span id="open_edit_reviewers" class="block-right action_button last-item">${_('Edit')}</span>
               %endif
           </div>
         </div>
         <div id="reviewers" class="block-right pr-details-content reviewers">
           ## members goes here !
             <input type="hidden" name="__start__" value="review_members:sequence">
             <ul id="review_members" class="group_members">
             %for member,reasons,mandatory,status in c.pull_request_reviewers:
               <li id="reviewer_${member.user_id}" class="reviewer_entry">
                 <div class="reviewers_member">
                     <div class="reviewer_status tooltip" title="${h.tooltip(h.commit_status_lbl(status[0][1].status if status else 'not_reviewed'))}">
                       <div class="${'flag_status %s' % (status[0][1].status if status else 'not_reviewed')} pull-left reviewer_member_status"></div>
                     </div>
                   <div id="reviewer_${member.user_id}_name" class="reviewer_name">
                     ${self.gravatar_with_user(member.email, 16)}
                   </div>
                   <input type="hidden" name="__start__" value="reviewer:mapping">
                   <input type="hidden" name="__start__" value="reasons:sequence">
                   %for reason in reasons:
                   <div class="reviewer_reason">- ${reason}</div>
                   <input type="hidden" name="reason" value="${reason}">
 
                   %endfor
                   <input type="hidden" name="__end__" value="reasons:sequence">
                   <input id="reviewer_${member.user_id}_input" type="hidden" value="${member.user_id}" name="user_id" />
                   <input type="hidden" name="mandatory" value="${mandatory}"/>
                   <input type="hidden" name="__end__" value="reviewer:mapping">
                   % if mandatory:
                         <div class="reviewer_member_mandatory_remove">
                             <i class="icon-remove-sign"></i>
                         </div>
                         <div class="reviewer_member_mandatory">
                             <i class="icon-lock" title="${h.tooltip(_('Mandatory reviewer'))}"></i>
                         </div>
                   % else:
                     %if c.allowed_to_update:
                       <div class="reviewer_member_remove action_button" onclick="reviewersController.removeReviewMember(${member.user_id}, true)" style="visibility: hidden;">
                           <i class="icon-remove-sign" ></i>
                       </div>
                     %endif
                   % endif
                 </div>
               </li>
             %endfor
             </ul>
             <input type="hidden" name="__end__" value="review_members:sequence">
 
             %if not c.pull_request.is_closed():
                 <div id="add_reviewer" class="ac" style="display: none;">
                 %if c.allowed_to_update:
                     % if not c.forbid_adding_reviewers:
                         <div id="add_reviewer_input" class="reviewer_ac">
                            ${h.text('user', class_='ac-input', placeholder=_('Add reviewer or reviewer group'))}
                            <div id="reviewers_container"></div>
                         </div>
                     % endif
                     <div class="pull-right">
                         <button id="update_pull_request" class="btn btn-small no-margin">${_('Save Changes')}</button>
                     </div>
                 %endif
                 </div>
             %endif
         </div>
       </div>
   </div>
   <div class="box">
       ##DIFF
       <div class="table" >
           <div id="changeset_compare_view_content">
               ##CS
               % if c.missing_requirements:
                 <div class="box">
                   <div class="alert alert-warning">
                     <div>
                       <strong>${_('Missing requirements:')}</strong>
                       ${_('These commits cannot be displayed, because this repository uses the Mercurial largefiles extension, which was not enabled.')}
                     </div>
                   </div>
                 </div>
               % elif c.missing_commits:
                 <div class="box">
                   <div class="alert alert-warning">
                     <div>
                       <strong>${_('Missing commits')}:</strong>
                         ${_('This pull request cannot be displayed, because one or more commits no longer exist in the source repository.')}
                         ${_('Please update this pull request, push the commits back into the source repository, or consider closing this pull request.')}
                     </div>
                   </div>
                 </div>
               % endif
 
               <div class="compare_view_commits_title">
                   % if not c.compare_mode:
 
                     % if c.at_version_pos:
                         <h4>
                         ${_('Showing changes at v%d, commenting is disabled.') % c.at_version_pos}
                         </h4>
                     % endif
 
                     <div class="pull-left">
                       <div class="btn-group">
                           <a
                               class="btn"
                               href="#"
                               onclick="$('.compare_select').show();$('.compare_select_hidden').hide(); return false">
                               ${_ungettext('Expand %s commit','Expand %s commits', len(c.commit_ranges)) % len(c.commit_ranges)}
                           </a>
                           <a
                               class="btn"
                               href="#"
                               onclick="$('.compare_select').hide();$('.compare_select_hidden').show(); return false">
                               ${_ungettext('Collapse %s commit','Collapse %s commits', len(c.commit_ranges)) % len(c.commit_ranges)}
                           </a>
                       </div>
                     </div>
 
                     <div class="pull-right">
                         % if c.allowed_to_update and not c.pull_request.is_closed():
                           <a id="update_commits" class="btn btn-primary no-margin pull-right">${_('Update commits')}</a>
                         % else:
                           <a class="tooltip btn disabled pull-right" disabled="disabled" title="${_('Update is disabled for current view')}">${_('Update commits')}</a>
                         % endif
 
                     </div>
                   % endif
               </div>
 
               % if not c.missing_commits:
                 % if c.compare_mode:
                     % if c.at_version:
                     <h4>
                         ${_('Commits and changes between v{ver_from} and {ver_to} of this pull request, commenting is disabled').format(ver_from=c.from_version_pos, ver_to=c.at_version_pos if c.at_version_pos else 'latest')}:
                     </h4>
 
                     <div class="subtitle-compare">
                         ${_('commits added: {}, removed: {}').format(len(c.commit_changes_summary.added), len(c.commit_changes_summary.removed))}
                     </div>
 
                     <div class="container">
                         <table class="rctable compare_view_commits">
                             <tr>
                                 <th></th>
                                 <th>${_('Time')}</th>
                                 <th>${_('Author')}</th>
                                 <th>${_('Commit')}</th>
                                 <th></th>
                                 <th>${_('Description')}</th>
                             </tr>
 
                             % for c_type, commit in c.commit_changes:
                               % if c_type in ['a', 'r']:
                                 <%
                                     if c_type == 'a':
                                         cc_title = _('Commit added in displayed changes')
                                     elif c_type == 'r':
                                         cc_title = _('Commit removed in displayed changes')
                                     else:
                                         cc_title = ''
                                 %>
                                 <tr id="row-${commit.raw_id}" commit_id="${commit.raw_id}" class="compare_select">
                                 <td>
                                     <div class="commit-change-indicator color-${c_type}-border">
                                       <div class="commit-change-content color-${c_type} tooltip" title="${h.tooltip(cc_title)}">
                                         ${c_type.upper()}
                                       </div>
                                     </div>
                                 </td>
                                 <td class="td-time">
                                     ${h.age_component(commit.date)}
                                 </td>
                                 <td class="td-user">
                                     ${base.gravatar_with_user(commit.author, 16)}
                                 </td>
                                 <td class="td-hash">
                                     <code>
                                         <a href="${h.route_path('repo_commit', repo_name=c.target_repo.repo_name, commit_id=commit.raw_id)}">
                                             r${commit.revision}:${h.short_id(commit.raw_id)}
                                         </a>
                                         ${h.hidden('revisions', commit.raw_id)}
                                     </code>
                                 </td>
                                 <td class="expand_commit" data-commit-id="${commit.raw_id}" title="${_( 'Expand commit message')}">
                                     <div class="show_more_col">
                                     <i class="show_more"></i>
                                     </div>
                                 </td>
                                 <td class="mid td-description">
                                     <div class="log-container truncate-wrap">
                                         <div class="message truncate" id="c-${commit.raw_id}" data-message-raw="${commit.message}">
                                             ${h.urlify_commit_message(commit.message, c.repo_name)}
                                         </div>
                                     </div>
                                 </td>
                             </tr>
                               % endif
                             % endfor
                         </table>
                     </div>
 
                     <script>
                     $('.expand_commit').on('click',function(e){
                       var target_expand = $(this);
                       var cid = target_expand.data('commitId');
 
                       if (target_expand.hasClass('open')){
                         $('#c-'+cid).css({
                             'height': '1.5em',
                             'white-space': 'nowrap',
                             'text-overflow': 'ellipsis',
                             'overflow':'hidden'
                         });
                         target_expand.removeClass('open');
                       }
                       else {
                         $('#c-'+cid).css({
                             'height': 'auto',
                             'white-space': 'pre-line',
                             'text-overflow': 'initial',
                             'overflow':'visible'
                         });
                         target_expand.addClass('open');
                       }
                     });
                     </script>
 
                     % endif
 
                 % else:
                     <%include file="/compare/compare_commits.mako" />
                 % endif
 
                 <div class="cs_files">
                     <%namespace name="cbdiffs" file="/codeblocks/diffs.mako"/>
                     ${cbdiffs.render_diffset_menu()}
                     ${cbdiffs.render_diffset(
                       c.diffset, use_comments=True,
                       collapse_when_files_over=30,
                       disable_new_comments=not c.allowed_to_comment,
                       deleted_files_comments=c.deleted_files_comments)}
                 </div>
               % else:
                   ## skipping commits we need to clear the view for missing commits
                   <div style="clear:both;"></div>
               % endif
 
           </div>
       </div>
 
       ## template for inline comment form
       <%namespace name="comment" file="/changeset/changeset_file_comment.mako"/>
 
       ## render general comments
 
       <div id="comment-tr-show">
           <div class="comment">
             % if general_outdated_comm_count_ver:
             <div class="meta">
                 % if general_outdated_comm_count_ver == 1:
                     ${_('there is {num} general comment from older versions').format(num=general_outdated_comm_count_ver)},
                     <a href="#show-hidden-comments" onclick="$('.comment-general.comment-outdated').show(); $(this).parent().hide(); return false;">${_('show it')}</a>
                 % else:
                     ${_('there are {num} general comments from older versions').format(num=general_outdated_comm_count_ver)},
                     <a href="#show-hidden-comments" onclick="$('.comment-general.comment-outdated').show(); $(this).parent().hide(); return false;">${_('show them')}</a>
                 % endif
             </div>
             % endif
           </div>
       </div>
 
       ${comment.generate_comments(c.comments, include_pull_request=True, is_pull_request=True)}
 
       % if not c.pull_request.is_closed():
         ## merge status, and merge action
         <div class="pull-request-merge">
             <%include file="/pullrequests/pullrequest_merge_checks.mako"/>
         </div>
 
         ## main comment form and it status
         ${comment.comments(h.route_path('pullrequest_comment_create', repo_name=c.repo_name,
                                         pull_request_id=c.pull_request.pull_request_id),
                            c.pull_request_review_status,
                            is_pull_request=True, change_status=c.allowed_to_change_status)}
       %endif
 
       <script type="text/javascript">
         if (location.hash) {
           var result = splitDelimitedHash(location.hash);
             var line = $('html').find(result.loc);
             // show hidden comments if we use location.hash
             if (line.hasClass('comment-general')) {
                 $(line).show();
             } else if (line.hasClass('comment-inline')) {
                 $(line).show();
                 var $cb = $(line).closest('.cb');
                 $cb.removeClass('cb-collapsed')
             }
             if (line.length > 0){
                 offsetScroll(line, 70);
             }
         }
 
         versionController = new VersionController();
         versionController.init();
 
         reviewersController = new ReviewersController();
 
         $(function(){
 
             // custom code mirror
             var codeMirrorInstance = initPullRequestsCodeMirror('#pr-description-input');
 
             var PRDetails = {
               editButton: $('#open_edit_pullrequest'),
               closeButton: $('#close_edit_pullrequest'),
               deleteButton: $('#delete_pullrequest'),
               viewFields: $('#pr-desc, #pr-title'),
               editFields: $('#pr-desc-edit, #pr-title-edit, #pr-save'),
 
               init: function() {
                 var that = this;
                 this.editButton.on('click', function(e) { that.edit(); });
                 this.closeButton.on('click', function(e) { that.view(); });
               },
 
               edit: function(event) {
                 this.viewFields.hide();
                 this.editButton.hide();
                 this.deleteButton.hide();
                 this.closeButton.show();
                 this.editFields.show();
                 codeMirrorInstance.refresh();
               },
 
               view: function(event) {
                 this.editButton.show();
                 this.deleteButton.show();
                 this.editFields.hide();
                 this.closeButton.hide();
                 this.viewFields.show();
               }
             };
 
             var ReviewersPanel = {
               editButton: $('#open_edit_reviewers'),
               closeButton: $('#close_edit_reviewers'),
               addButton: $('#add_reviewer'),
               removeButtons: $('.reviewer_member_remove,.reviewer_member_mandatory_remove,.reviewer_member_mandatory'),
 
               init: function() {
                 var self = this;
                 this.editButton.on('click', function(e) { self.edit(); });
                 this.closeButton.on('click', function(e) { self.close(); });
               },
 
               edit: function(event) {
                 this.editButton.hide();
                 this.closeButton.show();
                 this.addButton.show();
                 this.removeButtons.css('visibility', 'visible');
                 // review rules
                 reviewersController.loadReviewRules(
                     ${c.pull_request.reviewer_data_json | n});
               },
 
               close: function(event) {
                 this.editButton.show();
                 this.closeButton.hide();
                 this.addButton.hide();
                 this.removeButtons.css('visibility', 'hidden');
                 // hide review rules
                 reviewersController.hideReviewRules()
               }
             };
 
             PRDetails.init();
             ReviewersPanel.init();
 
             showOutdated = function(self){
                 $('.comment-inline.comment-outdated').show();
                 $('.filediff-outdated').show();
                 $('.showOutdatedComments').hide();
                 $('.hideOutdatedComments').show();
             };
 
             hideOutdated = function(self){
                 $('.comment-inline.comment-outdated').hide();
                 $('.filediff-outdated').hide();
                 $('.hideOutdatedComments').hide();
                 $('.showOutdatedComments').show();
             };
 
             refreshMergeChecks = function(){
                 var loadUrl = "${request.current_route_path(_query=dict(merge_checks=1))}";
                 $('.pull-request-merge').css('opacity', 0.3);
                 $('.action-buttons-extra').css('opacity', 0.3);
 
                 $('.pull-request-merge').load(
                     loadUrl, function() {
                         $('.pull-request-merge').css('opacity', 1);
 
                         $('.action-buttons-extra').css('opacity', 1);
                         injectCloseAction();
                     }
                 );
             };
 
             injectCloseAction =  function() {
                 var closeAction = $('#close-pull-request-action').html();
                 var $actionButtons = $('.action-buttons-extra');
                 // clear the action before
                 $actionButtons.html("");
                 $actionButtons.html(closeAction);
             };
 
             closePullRequest = function (status) {
                 // inject closing flag
                 $('.action-buttons-extra').append('<input type="hidden" class="close-pr-input" id="close_pull_request" value="1">');
                 $(generalCommentForm.statusChange).select2("val", status).trigger('change');
                 $(generalCommentForm.submitForm).submit();
             };
 
             $('#show-outdated-comments').on('click', function(e){
                 var button = $(this);
                 var outdated = $('.comment-outdated');
 
                 if (button.html() === "(Show)") {
                   button.html("(Hide)");
                   outdated.show();
                 } else {
                   button.html("(Show)");
                   outdated.hide();
                 }
             });
 
             $('.show-inline-comments').on('change', function(e){
                 var show = 'none';
                 var target = e.currentTarget;
                 if(target.checked){
                     show = ''
                 }
                 var boxid = $(target).attr('id_for');
                 var comments = $('#{0} .inline-comments'.format(boxid));
                 var fn_display = function(idx){
                    $(this).css('display', show);
                 };
                 $(comments).each(fn_display);
                 var btns = $('#{0} .inline-comments-button'.format(boxid));
                 $(btns).each(fn_display);
             });
 
             $('#merge_pull_request_form').submit(function() {
                 if (!$('#merge_pull_request').attr('disabled')) {
                     $('#merge_pull_request').attr('disabled', 'disabled');
                 }
                 return true;
             });
 
             $('#edit_pull_request').on('click', function(e){
                 var title = $('#pr-title-input').val();
                 var description = codeMirrorInstance.getValue();
                 editPullRequest(
                     "${c.repo_name}", "${c.pull_request.pull_request_id}",
                     title, description);
             });
 
             $('#update_pull_request').on('click', function(e){
                 $(this).attr('disabled', 'disabled');
                 $(this).addClass('disabled');
                 $(this).html(_gettext('Saving...'));
                 reviewersController.updateReviewers(
                     "${c.repo_name}", "${c.pull_request.pull_request_id}");
             });
 
             $('#update_commits').on('click', function(e){
                 var isDisabled = !$(e.currentTarget).attr('disabled');
                 $(e.currentTarget).attr('disabled', 'disabled');
                 $(e.currentTarget).addClass('disabled');
                 $(e.currentTarget).removeClass('btn-primary');
                 $(e.currentTarget).text(_gettext('Updating...'));
                 if(isDisabled){
                     updateCommits(
                         "${c.repo_name}", "${c.pull_request.pull_request_id}");
                 }
             });
             // fixing issue with caches on firefox
             $('#update_commits').removeAttr("disabled");
 
             $('.show-inline-comments').on('click', function(e){
                 var boxid = $(this).attr('data-comment-id');
                 var button = $(this);
 
                 if(button.hasClass("comments-visible")) {
                   $('#{0} .inline-comments'.format(boxid)).each(function(index){
                     $(this).hide();
                   });
                   button.removeClass("comments-visible");
                 } else {
                   $('#{0} .inline-comments'.format(boxid)).each(function(index){
                     $(this).show();
                   });
                   button.addClass("comments-visible");
                 }
             });
 
             // register submit callback on commentForm form to track TODOs
             window.commentFormGlobalSubmitSuccessCallback = function(){
                 refreshMergeChecks();
             };
             // initial injection
             injectCloseAction();
 
             ReviewerAutoComplete('#user');
 
         })
       </script>
 
   </div>
 </div>
 
 </%def>