release: merge back stable branch into default

docs/release-notes/release-notes-4.15.1.rst

@@ -0,0 +1,50 b''
+|RCE| 4.15.1 |RNS|
+------------------
+
+Release Date
+^^^^^^^^^^^^
+
+- 2019-01-01
+
+
+New Features
+^^^^^^^^^^^^
+
+
+
+General
+^^^^^^^
+
+- Downloads: properly encode " in the filenames, and add RFC 5987 header for non-ascii files.
+- Documentation: updated configuration for Nginx and reverse proxy.
+- VCS: streaming will use now 100kb chunks for faster network throughput.
+
+
+Security
+^^^^^^^^
+
+- Diffs: fixed xss in context diff menu.
+- Downloads: properly encode " in the filenames, prevents from hiding executable
+  files disguised in another type of file using crafted file names.
+
+Performance
+^^^^^^^^^^^
+
+
+
+Fixes
+^^^^^
+
+- VCS: handle excessive slashes in from of the repo name path, fixes #5522.
+  This prevents 500 errors when excessive slashes are used
+- SVN: support proxy-prefix properly, fixes #5521.
+- Pull requests: validate ref types on API calls for pull request so users cannot
+  provide wrongs ones.
+- Scheduler: fix url generation with proxy prefix.
+- Celery: add DB connection ping to validate DB connection is working at worker startup.
+
+
+Upgrade notes
+^^^^^^^^^^^^^
+
+- Scheduled release addressing reported problems in 4.15.X releases.

.hgtags

@@ -1,49 +1,50 b''
 1bd3e92b7e2e2d2024152b34bb88dff1db544a71 v4.0.0
 170c5398320ea6cddd50955e88d408794c21d43a v4.0.1
 c3fe200198f5aa34cf2e4066df2881a9cefe3704 v4.1.0
 7fd5c850745e2ea821fb4406af5f4bff9b0a7526 v4.1.1
 41c87da28a179953df86061d817bc35533c66dd2 v4.1.2
 baaf9f5bcea3bae0ef12ae20c8b270482e62abb6 v4.2.0
 32a70c7e56844a825f61df496ee5eaf8c3c4e189 v4.2.1
 fa695cdb411d294679ac081d595ac654e5613b03 v4.3.0
 0e4dc11b58cad833c513fe17bac39e6850edf959 v4.3.1
 8a876f48f5cb1d018b837db28ff928500cb32cfb v4.4.0
 8dd86b410b1aac086ffdfc524ef300f896af5047 v4.4.1
 d2514226abc8d3b4f6fb57765f47d1b6fb360a05 v4.4.2
 27d783325930af6dad2741476c0d0b1b7c8415c2 v4.5.0
 7f2016f352abcbdba4a19d4039c386e9629449da v4.5.1
 416fec799314c70a5c780fb28b3357b08869333a v4.5.2
 27c3b85fafc83143e6678fbc3da69e1615bcac55 v4.6.0
 5ad13deb9118c2a5243d4032d4d9cc174e5872db v4.6.1
 2be921e01fa24bb102696ada596f87464c3666f6 v4.7.0
 7198bdec29c2872c974431d55200d0398354cdb1 v4.7.1
 bd1c8d230fe741c2dfd7100a0ef39fd0774fd581 v4.7.2
 9731914f89765d9628dc4dddc84bc9402aa124c8 v4.8.0
 c5a2b7d0e4bbdebc4a62d7b624befe375207b659 v4.9.0
 d9aa3b27ac9f7e78359775c75fedf7bfece232f1 v4.9.1
 4ba4d74981cec5d6b28b158f875a2540952c2f74 v4.10.0
 0a6821cbd6b0b3c21503002f88800679fa35ab63 v4.10.1
 434ad90ec8d621f4416074b84f6e9ce03964defb v4.10.2
 68baee10e698da2724c6e0f698c03a6abb993bf2 v4.10.3
 00821d3afd1dce3f4767cc353f84a17f7d5218a1 v4.10.4
 22f6744ad8cc274311825f63f953e4dee2ea5cb9 v4.10.5
 96eb24bea2f5f9258775245e3f09f6fa0a4dda01 v4.10.6
 3121217a812c956d7dd5a5875821bd73e8002a32 v4.11.0
 fa98b454715ac5b912f39e84af54345909a2a805 v4.11.1
 3982abcfdcc229a723cebe52d3a9bcff10bba08e v4.11.2
 33195f145db9172f0a8f1487e09207178a6ab065 v4.11.3
 194c74f33e32bbae6fc4d71ec5a999cff3c13605 v4.11.4
 8fbd8b0c3ddc2fa4ac9e4ca16942a03eb593df2d v4.11.5
 f0609aa5d5d05a1ca2f97c3995542236131c9d8a v4.11.6
 b5b30547d90d2e088472a70c84878f429ffbf40d v4.12.0
 9072253aa8894d20c00b4a43dc61c2168c1eff94 v4.12.1
 6a517543ea9ef9987d74371bd2a315eb0b232dc9 v4.12.2
 7fc0731b024c3114be87865eda7ab621cc957e32 v4.12.3
 6d531c0b068c6eda62dddceedc9f845ecb6feb6f v4.12.4
 3d6bf2d81b1564830eb5e83396110d2a9a93eb1e v4.13.0
 5468fc89e708bd90e413cd0d54350017abbdbc0e v4.13.1
 610d621550521c314ee97b3d43473ac0bcf06fb8 v4.13.2
 7dc62c090881fb5d03268141e71e0940d7c3295d v4.13.3
 9151328c1c46b72ba6f00d7640d9141e75aa1ca2 v4.14.0
 a47eeac5dfa41fa6779d90452affba4091c3ade8 v4.14.1
 4b34ce0d2c3c10510626b3b65044939bb7a2cddf v4.15.0
[phone]d22e6b70613674cd675ae9a604b7989f v4.15.1

docs/release-notes/release-notes.rst

@@ -1,126 +1,127 b''
 .. _rhodecode-release-notes-ref:
 
 Release Notes
 =============
 
 |RCE| 4.x Versions
 ------------------
 
 .. toctree::
    :maxdepth: 1
 
+   release-notes-4.15.1.rst
    release-notes-4.15.0.rst
    release-notes-4.14.1.rst
    release-notes-4.14.0.rst
    release-notes-4.13.3.rst
    release-notes-4.13.2.rst
    release-notes-4.13.1.rst
    release-notes-4.13.0.rst
    release-notes-4.12.4.rst
    release-notes-4.12.3.rst
    release-notes-4.12.2.rst
    release-notes-4.12.1.rst
    release-notes-4.12.0.rst
    release-notes-4.11.6.rst
    release-notes-4.11.5.rst
    release-notes-4.11.4.rst
    release-notes-4.11.3.rst
    release-notes-4.11.2.rst
    release-notes-4.11.1.rst
    release-notes-4.11.0.rst
    release-notes-4.10.6.rst
    release-notes-4.10.5.rst
    release-notes-4.10.4.rst
    release-notes-4.10.3.rst
    release-notes-4.10.2.rst
    release-notes-4.10.1.rst
    release-notes-4.10.0.rst
    release-notes-4.9.1.rst
    release-notes-4.9.0.rst
    release-notes-4.8.0.rst
    release-notes-4.7.2.rst
    release-notes-4.7.1.rst
    release-notes-4.7.0.rst
    release-notes-4.6.1.rst
    release-notes-4.6.0.rst
    release-notes-4.5.2.rst
    release-notes-4.5.1.rst
    release-notes-4.5.0.rst
    release-notes-4.4.2.rst
    release-notes-4.4.1.rst
    release-notes-4.4.0.rst
    release-notes-4.3.1.rst
    release-notes-4.3.0.rst
    release-notes-4.2.1.rst
    release-notes-4.2.0.rst
    release-notes-4.1.2.rst
    release-notes-4.1.1.rst
    release-notes-4.1.0.rst
    release-notes-4.0.1.rst
    release-notes-4.0.0.rst
 
 |RCE| 3.x Versions
 ------------------
 
 .. toctree::
    :maxdepth: 1
 
    release-notes-3.8.4.rst
    release-notes-3.8.3.rst
    release-notes-3.8.2.rst
    release-notes-3.8.1.rst
    release-notes-3.8.0.rst
    release-notes-3.7.1.rst
    release-notes-3.7.0.rst
    release-notes-3.6.1.rst
    release-notes-3.6.0.rst
    release-notes-3.5.2.rst
    release-notes-3.5.1.rst
    release-notes-3.5.0.rst
    release-notes-3.4.1.rst
    release-notes-3.4.0.rst
    release-notes-3.3.4.rst
    release-notes-3.3.3.rst
    release-notes-3.3.2.rst
    release-notes-3.3.1.rst
    release-notes-3.3.0.rst
    release-notes-3.2.3.rst
    release-notes-3.2.2.rst
    release-notes-3.2.1.rst
    release-notes-3.2.0.rst
    release-notes-3.1.1.rst
    release-notes-3.1.0.rst
    release-notes-3.0.2.rst
    release-notes-3.0.1.rst
    release-notes-3.0.0.rst
 
 |RCE| 2.x Versions
 ------------------
 
 .. toctree::
    :maxdepth: 1
 
    release-notes-2.2.8.rst
    release-notes-2.2.7.rst
    release-notes-2.2.6.rst
    release-notes-2.2.5.rst
    release-notes-2.2.4.rst
    release-notes-2.2.3.rst
    release-notes-2.2.2.rst
    release-notes-2.2.1.rst
    release-notes-2.2.0.rst
    release-notes-2.1.0.rst
    release-notes-2.0.2.rst
    release-notes-2.0.1.rst
    release-notes-2.0.0.rst
 
 |RCE| 1.x Versions
 ------------------
 
 .. toctree::
    :maxdepth: 1
 
    release-notes-1.7.2.rst
    release-notes-1.7.1.rst
    release-notes-1.7.0.rst
    release-notes-1.6.0.rst

rhodecode/api/tests/test_create_pull_request.py

@@ -1,349 +1,368 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2018 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import pytest
 
 from rhodecode.model.db import User
 from rhodecode.model.pull_request import PullRequestModel
 from rhodecode.model.repo import RepoModel
 from rhodecode.model.user import UserModel
 from rhodecode.tests import TEST_USER_ADMIN_LOGIN, TEST_USER_REGULAR_LOGIN
 from rhodecode.api.tests.utils import build_data, api_call, assert_error
 
 
 @pytest.mark.usefixtures("testuser_api", "app")
 class TestCreatePullRequestApi(object):
     finalizers = []
 
     def teardown_method(self, method):
         if self.finalizers:
             for finalizer in self.finalizers:
                 finalizer()
             self.finalizers = []
 
     def test_create_with_wrong_data(self):
         required_data = {
             'source_repo': 'tests/source_repo',
             'target_repo': 'tests/target_repo',
             'source_ref': 'branch:default:initial',
             'target_ref': 'branch:default:new-feature',
         }
         for key in required_data:
             data = required_data.copy()
             data.pop(key)
             id_, params = build_data(
                 self.apikey, 'create_pull_request', **data)
             response = api_call(self.app, params)
 
             expected = 'Missing non optional `{}` arg in JSON DATA'.format(key)
             assert_error(id_, expected, given=response.body)
 
     @pytest.mark.backends("git", "hg")
+    @pytest.mark.parametrize('source_ref', [
+        'bookmarg:default:initial'
+    ])
+    def test_create_with_wrong_refs_data(self, backend, source_ref):
+
+        data = self._prepare_data(backend)
+        data['source_ref'] = source_ref
+
+        id_, params = build_data(
+            self.apikey_regular, 'create_pull_request', **data)
+
+        response = api_call(self.app, params)
+
+        expected = "Ref `{}` type is not allowed. " \
+                   "Only:['bookmark', 'book', 'tag', 'branch'] " \
+                   "are possible.".format(source_ref)
+        assert_error(id_, expected, given=response.body)
+
+    @pytest.mark.backends("git", "hg")
     def test_create_with_correct_data(self, backend):
         data = self._prepare_data(backend)
         RepoModel().revoke_user_permission(
             self.source.repo_name, User.DEFAULT_USER)
         id_, params = build_data(
             self.apikey_regular, 'create_pull_request', **data)
         response = api_call(self.app, params)
         expected_message = "Created new pull request `{title}`".format(
             title=data['title'])
         result = response.json
         assert result['error'] is None
         assert result['result']['msg'] == expected_message
         pull_request_id = result['result']['pull_request_id']
         pull_request = PullRequestModel().get(pull_request_id)
         assert pull_request.title == data['title']
         assert pull_request.description == data['description']
         assert pull_request.source_ref == data['source_ref']
         assert pull_request.target_ref == data['target_ref']
         assert pull_request.source_repo.repo_name == data['source_repo']
         assert pull_request.target_repo.repo_name == data['target_repo']
         assert pull_request.revisions == [self.commit_ids['change']]
         assert len(pull_request.reviewers) == 1
 
     @pytest.mark.backends("git", "hg")
     def test_create_with_empty_description(self, backend):
         data = self._prepare_data(backend)
         data.pop('description')
         id_, params = build_data(
             self.apikey_regular, 'create_pull_request', **data)
         response = api_call(self.app, params)
         expected_message = "Created new pull request `{title}`".format(
             title=data['title'])
         result = response.json
         assert result['error'] is None
         assert result['result']['msg'] == expected_message
         pull_request_id = result['result']['pull_request_id']
         pull_request = PullRequestModel().get(pull_request_id)
         assert pull_request.description == ''
 
     @pytest.mark.backends("git", "hg")
     def test_create_with_empty_title(self, backend):
         data = self._prepare_data(backend)
         data.pop('title')
         id_, params = build_data(
             self.apikey_regular, 'create_pull_request', **data)
         response = api_call(self.app, params)
         result = response.json
         pull_request_id = result['result']['pull_request_id']
         pull_request = PullRequestModel().get(pull_request_id)
         data['ref'] = backend.default_branch_name
         title = '{source_repo}#{ref} to {target_repo}'.format(**data)
         assert pull_request.title == title
 
     @pytest.mark.backends("git", "hg")
     def test_create_with_reviewers_specified_by_names(
             self, backend, no_notifications):
         data = self._prepare_data(backend)
         reviewers = [
             {'username': TEST_USER_REGULAR_LOGIN,
              'reasons': ['{} added manually'.format(TEST_USER_REGULAR_LOGIN)]},
             {'username': TEST_USER_ADMIN_LOGIN,
              'reasons': ['{} added manually'.format(TEST_USER_ADMIN_LOGIN)],
              'mandatory': True},
         ]
         data['reviewers'] = reviewers
 
         id_, params = build_data(
             self.apikey_regular, 'create_pull_request', **data)
         response = api_call(self.app, params)
 
         expected_message = "Created new pull request `{title}`".format(
             title=data['title'])
         result = response.json
         assert result['error'] is None
         assert result['result']['msg'] == expected_message
         pull_request_id = result['result']['pull_request_id']
         pull_request = PullRequestModel().get(pull_request_id)
 
         actual_reviewers = []
         for rev in pull_request.reviewers:
             entry = {
                 'username': rev.user.username,
                 'reasons': rev.reasons,
              }
             if rev.mandatory:
                 entry['mandatory'] = rev.mandatory
             actual_reviewers.append(entry)
 
         owner_username = pull_request.target_repo.user.username
         for spec_reviewer in reviewers[::]:
             # default reviewer will be added who is an owner of the repo
             # this get's overridden by a add owner to reviewers rule
             if spec_reviewer['username'] == owner_username:
                 spec_reviewer['reasons'] = [u'Default reviewer', u'Repository owner']
                 # since owner is more important, we don't inherit mandatory flag
                 del spec_reviewer['mandatory']
 
         assert sorted(actual_reviewers, key=lambda e: e['username']) \
                == sorted(reviewers, key=lambda e: e['username'])
 
     @pytest.mark.backends("git", "hg")
     def test_create_with_reviewers_specified_by_ids(
             self, backend, no_notifications):
         data = self._prepare_data(backend)
         reviewers = [
             {'username': UserModel().get_by_username(
                 TEST_USER_REGULAR_LOGIN).user_id,
              'reasons': ['added manually']},
             {'username': UserModel().get_by_username(
                 TEST_USER_ADMIN_LOGIN).user_id,
              'reasons': ['added manually']},
         ]
 
         data['reviewers'] = reviewers
         id_, params = build_data(
             self.apikey_regular, 'create_pull_request', **data)
         response = api_call(self.app, params)
 
         expected_message = "Created new pull request `{title}`".format(
             title=data['title'])
         result = response.json
         assert result['error'] is None
         assert result['result']['msg'] == expected_message
         pull_request_id = result['result']['pull_request_id']
         pull_request = PullRequestModel().get(pull_request_id)
 
         actual_reviewers = []
         for rev in pull_request.reviewers:
             entry = {
                 'username': rev.user.user_id,
                 'reasons': rev.reasons,
              }
             if rev.mandatory:
                 entry['mandatory'] = rev.mandatory
             actual_reviewers.append(entry)
 
         owner_user_id = pull_request.target_repo.user.user_id
         for spec_reviewer in reviewers[::]:
             # default reviewer will be added who is an owner of the repo
             # this get's overridden by a add owner to reviewers rule
             if spec_reviewer['username'] == owner_user_id:
                 spec_reviewer['reasons'] = [u'Default reviewer', u'Repository owner']
 
         assert sorted(actual_reviewers, key=lambda e: e['username']) \
                == sorted(reviewers, key=lambda e: e['username'])
 
     @pytest.mark.backends("git", "hg")
     def test_create_fails_when_the_reviewer_is_not_found(self, backend):
         data = self._prepare_data(backend)
         data['reviewers'] = [{'username': 'somebody'}]
         id_, params = build_data(
             self.apikey_regular, 'create_pull_request', **data)
         response = api_call(self.app, params)
         expected_message = 'user `somebody` does not exist'
         assert_error(id_, expected_message, given=response.body)
 
     @pytest.mark.backends("git", "hg")
     def test_cannot_create_with_reviewers_in_wrong_format(self, backend):
         data = self._prepare_data(backend)
         reviewers = ','.join([TEST_USER_REGULAR_LOGIN, TEST_USER_ADMIN_LOGIN])
         data['reviewers'] = reviewers
         id_, params = build_data(
             self.apikey_regular, 'create_pull_request', **data)
         response = api_call(self.app, params)
         expected_message = {u'': '"test_regular,test_admin" is not iterable'}
         assert_error(id_, expected_message, given=response.body)
 
     @pytest.mark.backends("git", "hg")
     def test_create_with_no_commit_hashes(self, backend):
         data = self._prepare_data(backend)
         expected_source_ref = data['source_ref']
         expected_target_ref = data['target_ref']
         data['source_ref'] = 'branch:{}'.format(backend.default_branch_name)
         data['target_ref'] = 'branch:{}'.format(backend.default_branch_name)
         id_, params = build_data(
             self.apikey_regular, 'create_pull_request', **data)
         response = api_call(self.app, params)
         expected_message = "Created new pull request `{title}`".format(
             title=data['title'])
         result = response.json
         assert result['result']['msg'] == expected_message
         pull_request_id = result['result']['pull_request_id']
         pull_request = PullRequestModel().get(pull_request_id)
         assert pull_request.source_ref == expected_source_ref
         assert pull_request.target_ref == expected_target_ref
 
     @pytest.mark.backends("git", "hg")
     @pytest.mark.parametrize("data_key", ["source_repo", "target_repo"])
     def test_create_fails_with_wrong_repo(self, backend, data_key):
         repo_name = 'fake-repo'
         data = self._prepare_data(backend)
         data[data_key] = repo_name
         id_, params = build_data(
             self.apikey_regular, 'create_pull_request', **data)
         response = api_call(self.app, params)
         expected_message = 'repository `{}` does not exist'.format(repo_name)
         assert_error(id_, expected_message, given=response.body)
 
     @pytest.mark.backends("git", "hg")
     @pytest.mark.parametrize("data_key", ["source_ref", "target_ref"])
     def test_create_fails_with_non_existing_branch(self, backend, data_key):
         branch_name = 'test-branch'
         data = self._prepare_data(backend)
         data[data_key] = "branch:{}".format(branch_name)
         id_, params = build_data(
             self.apikey_regular, 'create_pull_request', **data)
         response = api_call(self.app, params)
         expected_message = 'The specified value:{type}:`{name}` ' \
                            'does not exist, or is not allowed.'.format(type='branch',
                                                                        name=branch_name)
         assert_error(id_, expected_message, given=response.body)
 
     @pytest.mark.backends("git", "hg")
     @pytest.mark.parametrize("data_key", ["source_ref", "target_ref"])
     def test_create_fails_with_ref_in_a_wrong_format(self, backend, data_key):
         data = self._prepare_data(backend)
         ref = 'stange-ref'
         data[data_key] = ref
         id_, params = build_data(
             self.apikey_regular, 'create_pull_request', **data)
         response = api_call(self.app, params)
         expected_message = (
             'Ref `{ref}` given in a wrong format. Please check the API'
             ' documentation for more details'.format(ref=ref))
         assert_error(id_, expected_message, given=response.body)
 
     @pytest.mark.backends("git", "hg")
     @pytest.mark.parametrize("data_key", ["source_ref", "target_ref"])
     def test_create_fails_with_non_existing_ref(self, backend, data_key):
         commit_id = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa10'
         ref = self._get_full_ref(backend, commit_id)
         data = self._prepare_data(backend)
         data[data_key] = ref
         id_, params = build_data(
             self.apikey_regular, 'create_pull_request', **data)
         response = api_call(self.app, params)
         expected_message = 'Ref `{}` does not exist'.format(ref)
         assert_error(id_, expected_message, given=response.body)
 
     @pytest.mark.backends("git", "hg")
     def test_create_fails_when_no_revisions(self, backend):
         data = self._prepare_data(backend, source_head='initial')
         id_, params = build_data(
             self.apikey_regular, 'create_pull_request', **data)
         response = api_call(self.app, params)
         expected_message = 'no commits found'
         assert_error(id_, expected_message, given=response.body)
 
     @pytest.mark.backends("git", "hg")
     def test_create_fails_when_no_permissions(self, backend):
         data = self._prepare_data(backend)
         RepoModel().revoke_user_permission(
             self.source.repo_name, self.test_user)
         RepoModel().revoke_user_permission(
             self.source.repo_name, User.DEFAULT_USER)
 
         id_, params = build_data(
             self.apikey_regular, 'create_pull_request', **data)
         response = api_call(self.app, params)
         expected_message = 'repository `{}` does not exist'.format(
             self.source.repo_name)
         assert_error(id_, expected_message, given=response.body)
 
     def _prepare_data(
             self, backend, source_head='change', target_head='initial'):
         commits = [
             {'message': 'initial'},
             {'message': 'change'},
             {'message': 'new-feature', 'parents': ['initial']},
         ]
         self.commit_ids = backend.create_master_repo(commits)
         self.source = backend.create_repo(heads=[source_head])
         self.target = backend.create_repo(heads=[target_head])
 
         data = {
             'source_repo': self.source.repo_name,
             'target_repo': self.target.repo_name,
             'source_ref': self._get_full_ref(
                 backend, self.commit_ids[source_head]),
             'target_ref': self._get_full_ref(
                 backend, self.commit_ids[target_head]),
             'title': 'Test PR 1',
             'description': 'Test'
         }
         RepoModel().grant_user_permission(
             self.source.repo_name, self.TEST_USER_LOGIN, 'repository.read')
         return data
 
     def _get_full_ref(self, backend, commit_id):
         return 'branch:{branch}:{commit_id}'.format(
             branch=backend.default_branch_name, commit_id=commit_id)

rhodecode/api/tests/test_utils.py

@@ -1,295 +1,295 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2018 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 
 import pytest
 from mock import Mock, patch
 
 from rhodecode.api import utils
 from rhodecode.api import JSONRPCError
 from rhodecode.lib.vcs.exceptions import RepositoryError
 
 
 class TestGetCommitOrError(object):
     def setup(self):
         self.commit_hash = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa10'
 
     @pytest.mark.parametrize("ref", ['ref', '12345', 'a:b:c:d', 'branch:name'])
     def test_ref_cannot_be_parsed(self, ref):
         repo = Mock()
         with pytest.raises(JSONRPCError) as excinfo:
             utils.get_commit_or_error(ref, repo)
         expected_message = (
             'Ref `{ref}` given in a wrong format. Please check the API'
             ' documentation for more details'.format(ref=ref)
         )
         assert excinfo.value.message == expected_message
 
     def test_success_with_hash_specified(self):
         repo = Mock()
         ref_type = 'branch'
         ref = '{}:master:{}'.format(ref_type, self.commit_hash)
 
         with patch('rhodecode.api.utils.get_commit_from_ref_name') as get_commit:
             result = utils.get_commit_or_error(ref, repo)
             get_commit.assert_called_once_with(
                 repo, self.commit_hash)
             assert result == get_commit()
 
     def test_raises_an_error_when_commit_not_found(self):
         repo = Mock()
         ref = 'branch:master:{}'.format(self.commit_hash)
 
         with patch('rhodecode.api.utils.get_commit_from_ref_name') as get_commit:
             get_commit.side_effect = RepositoryError('Commit not found')
             with pytest.raises(JSONRPCError) as excinfo:
                 utils.get_commit_or_error(ref, repo)
             expected_message = 'Ref `{}` does not exist'.format(ref)
             assert excinfo.value.message == expected_message
 
 
 class TestResolveRefOrError(object):
     def setup(self):
         self.commit_hash = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa10'
 
     def test_success_with_no_hash_specified(self):
         repo = Mock()
         ref_type = 'branch'
         ref_name = 'master'
         ref = '{}:{}'.format(ref_type, ref_name)
 
         with patch('rhodecode.api.utils._get_ref_hash') \
                 as _get_ref_hash:
             _get_ref_hash.return_value = self.commit_hash
             result = utils.resolve_ref_or_error(ref, repo)
             _get_ref_hash.assert_called_once_with(repo, ref_type, ref_name)
             assert result == '{}:{}'.format(ref, self.commit_hash)
 
     def test_non_supported_refs(self):
         repo = Mock()
-        ref = 'ancestor:ref'
+        ref = 'bookmark:ref'
         with pytest.raises(JSONRPCError) as excinfo:
             utils.resolve_ref_or_error(ref, repo)
         expected_message = (
-            'The specified value:ancestor:`ref` does not exist, or is not allowed.')
+            'The specified value:bookmark:`ref` does not exist, or is not allowed.')
         assert excinfo.value.message == expected_message
 
     def test_branch_is_not_found(self):
         repo = Mock()
         ref = 'branch:non-existing-one'
         with patch('rhodecode.api.utils._get_ref_hash')\
                 as _get_ref_hash:
             _get_ref_hash.side_effect = KeyError()
             with pytest.raises(JSONRPCError) as excinfo:
                 utils.resolve_ref_or_error(ref, repo)
         expected_message = (
             'The specified value:branch:`non-existing-one` does not exist, or is not allowed.')
         assert excinfo.value.message == expected_message
 
     def test_bookmark_is_not_found(self):
         repo = Mock()
         ref = 'bookmark:non-existing-one'
         with patch('rhodecode.api.utils._get_ref_hash')\
                 as _get_ref_hash:
             _get_ref_hash.side_effect = KeyError()
             with pytest.raises(JSONRPCError) as excinfo:
                 utils.resolve_ref_or_error(ref, repo)
         expected_message = (
             'The specified value:bookmark:`non-existing-one` does not exist, or is not allowed.')
         assert excinfo.value.message == expected_message
 
     @pytest.mark.parametrize("ref", ['ref', '12345', 'a:b:c:d'])
     def test_ref_cannot_be_parsed(self, ref):
         repo = Mock()
         with pytest.raises(JSONRPCError) as excinfo:
             utils.resolve_ref_or_error(ref, repo)
         expected_message = (
             'Ref `{ref}` given in a wrong format. Please check the API'
             ' documentation for more details'.format(ref=ref)
         )
         assert excinfo.value.message == expected_message
 
 
 class TestGetRefHash(object):
     def setup(self):
         self.commit_hash = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa10'
         self.bookmark_name = 'test-bookmark'
 
     @pytest.mark.parametrize("alias, branch_name", [
         ("git", "master"),
         ("hg", "default")
     ])
     def test_returns_hash_by_branch_name(self, alias, branch_name):
         with patch('rhodecode.model.db.Repository') as repo:
             repo.scm_instance().alias = alias
             repo.scm_instance().branches = {branch_name: self.commit_hash}
             result_hash = utils._get_ref_hash(repo, 'branch', branch_name)
             assert result_hash == self.commit_hash
 
     @pytest.mark.parametrize("alias, branch_name", [
         ("git", "master"),
         ("hg", "default")
     ])
     def test_raises_error_when_branch_is_not_found(self, alias, branch_name):
         with patch('rhodecode.model.db.Repository') as repo:
             repo.scm_instance().alias = alias
             repo.scm_instance().branches = {}
             with pytest.raises(KeyError):
                 utils._get_ref_hash(repo, 'branch', branch_name)
 
     def test_returns_hash_when_bookmark_is_specified_for_hg(self):
         with patch('rhodecode.model.db.Repository') as repo:
             repo.scm_instance().alias = 'hg'
             repo.scm_instance().bookmarks = {
                 self.bookmark_name: self.commit_hash}
             result_hash = utils._get_ref_hash(
                 repo, 'bookmark', self.bookmark_name)
             assert result_hash == self.commit_hash
 
     def test_raises_error_when_bookmark_is_not_found_in_hg_repo(self):
         with patch('rhodecode.model.db.Repository') as repo:
             repo.scm_instance().alias = 'hg'
             repo.scm_instance().bookmarks = {}
             with pytest.raises(KeyError):
                 utils._get_ref_hash(repo, 'bookmark', self.bookmark_name)
 
     def test_raises_error_when_bookmark_is_specified_for_git(self):
         with patch('rhodecode.model.db.Repository') as repo:
             repo.scm_instance().alias = 'git'
             repo.scm_instance().bookmarks = {
                 self.bookmark_name: self.commit_hash}
             with pytest.raises(ValueError):
                 utils._get_ref_hash(repo, 'bookmark', self.bookmark_name)
 
 
 class TestUserByNameOrError(object):
     def test_user_found_by_id(self):
         fake_user = Mock(id=123)
 
         patcher = patch('rhodecode.model.user.UserModel.get_user')
         with patcher as get_user:
             get_user.return_value = fake_user
 
             patcher = patch('rhodecode.model.user.UserModel.get_by_username')
             with patcher as get_by_username:
                 result = utils.get_user_or_error(123)
                 assert result == fake_user
 
     def test_user_not_found_by_id_as_str(self):
         fake_user = Mock(id=123)
 
         patcher = patch('rhodecode.model.user.UserModel.get_user')
         with patcher as get_user:
             get_user.return_value = fake_user
             patcher = patch('rhodecode.model.user.UserModel.get_by_username')
             with patcher as get_by_username:
                 get_by_username.return_value = None
 
                 with pytest.raises(JSONRPCError):
                     utils.get_user_or_error('123')
 
     def test_user_found_by_name(self):
         fake_user = Mock(id=123)
 
         patcher = patch('rhodecode.model.user.UserModel.get_user')
         with patcher as get_user:
             get_user.return_value = None
 
             patcher = patch('rhodecode.model.user.UserModel.get_by_username')
             with patcher as get_by_username:
                 get_by_username.return_value = fake_user
 
                 result = utils.get_user_or_error('test')
                 assert result == fake_user
 
     def test_user_not_found_by_id(self):
         patcher = patch('rhodecode.model.user.UserModel.get_user')
         with patcher as get_user:
             get_user.return_value = None
             patcher = patch('rhodecode.model.user.UserModel.get_by_username')
             with patcher as get_by_username:
                 get_by_username.return_value = None
 
                 with pytest.raises(JSONRPCError) as excinfo:
                     utils.get_user_or_error(123)
 
                 expected_message = 'user `123` does not exist'
                 assert excinfo.value.message == expected_message
 
     def test_user_not_found_by_name(self):
         patcher = patch('rhodecode.model.user.UserModel.get_by_username')
         with patcher as get_by_username:
             get_by_username.return_value = None
             with pytest.raises(JSONRPCError) as excinfo:
                 utils.get_user_or_error('test')
 
         expected_message = 'user `test` does not exist'
         assert excinfo.value.message == expected_message
 
 
 class TestGetCommitDict(object):
     @pytest.mark.parametrize('filename, expected', [
         (b'sp\xc3\xa4cial', u'sp\xe4cial'),
         (b'sp\xa4cial', u'sp\ufffdcial'),
     ])
     def test_decodes_filenames_to_unicode(self, filename, expected):
         result = utils._get_commit_dict(filename=filename, op='A')
         assert result['filename'] == expected
 
 
 class TestRepoAccess(object):
     def setup_method(self, method):
 
         self.admin_perm_patch = patch(
             'rhodecode.api.utils.HasPermissionAnyApi')
         self.repo_perm_patch = patch(
             'rhodecode.api.utils.HasRepoPermissionAnyApi')
 
     def test_has_superadmin_permission_checks_for_admin(self):
         admin_mock = Mock()
         with self.admin_perm_patch as amock:
             amock.return_value = admin_mock
             assert utils.has_superadmin_permission('fake_user')
             amock.assert_called_once_with('hg.admin')
 
         admin_mock.assert_called_once_with(user='fake_user')
 
     def test_has_repo_permissions_checks_for_repo_access(self):
         repo_mock = Mock()
         fake_repo = Mock()
         with self.repo_perm_patch as rmock:
             rmock.return_value = repo_mock
             assert utils.validate_repo_permissions(
                 'fake_user', 'fake_repo_id', fake_repo,
                 ['perm1', 'perm2'])
             rmock.assert_called_once_with(*['perm1', 'perm2'])
 
         repo_mock.assert_called_once_with(
             user='fake_user', repo_name=fake_repo.repo_name)
 
     def test_has_repo_permissions_raises_not_found(self):
         repo_mock = Mock(return_value=False)
         fake_repo = Mock()
         with self.repo_perm_patch as rmock:
             rmock.return_value = repo_mock
             with pytest.raises(JSONRPCError) as excinfo:
                 utils.validate_repo_permissions(
                     'fake_user', 'fake_repo_id', fake_repo, 'perms')
                 assert 'fake_repo_id' in excinfo

rhodecode/api/utils.py

@@ -1,441 +1,449 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2014-2018 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 JSON RPC utils
 """
 
 import collections
 import logging
 
 from rhodecode.api.exc import JSONRPCError
 from rhodecode.lib.auth import (
     HasPermissionAnyApi, HasRepoPermissionAnyApi, HasRepoGroupPermissionAnyApi)
 from rhodecode.lib.utils import safe_unicode
 from rhodecode.lib.vcs.exceptions import RepositoryError
 from rhodecode.lib.view_utils import get_commit_from_ref_name
 from rhodecode.lib.utils2 import str2bool
 
 log = logging.getLogger(__name__)
 
 
 class OAttr(object):
     """
     Special Option that defines other attribute, and can default to them
 
     Example::
 
         def test(apiuser, userid=Optional(OAttr('apiuser')):
             user = Optional.extract(userid, evaluate_locals=local())
             #if we pass in userid, we get it, else it will default to apiuser
             #attribute
     """
 
     def __init__(self, attr_name):
         self.attr_name = attr_name
 
     def __repr__(self):
         return '<OptionalAttr:%s>' % self.attr_name
 
     def __call__(self):
         return self
 
 
 class Optional(object):
     """
     Defines an optional parameter::
 
         param = param.getval() if isinstance(param, Optional) else param
         param = param() if isinstance(param, Optional) else param
 
     is equivalent of::
 
         param = Optional.extract(param)
 
     """
 
     def __init__(self, type_):
         self.type_ = type_
 
     def __repr__(self):
         return '<Optional:%s>' % self.type_.__repr__()
 
     def __call__(self):
         return self.getval()
 
     def getval(self, evaluate_locals=None):
         """
         returns value from this Optional instance
         """
         if isinstance(self.type_, OAttr):
             param_name = self.type_.attr_name
             if evaluate_locals:
                 return evaluate_locals[param_name]
             # use params name
             return param_name
         return self.type_
 
     @classmethod
     def extract(cls, val, evaluate_locals=None, binary=None):
         """
         Extracts value from Optional() instance
 
         :param val:
         :return: original value if it's not Optional instance else
             value of instance
         """
         if isinstance(val, cls):
             val = val.getval(evaluate_locals)
 
         if binary:
             val = str2bool(val)
 
         return val
 
 
 def parse_args(cli_args, key_prefix=''):
     from rhodecode.lib.utils2 import (escape_split)
     kwargs = collections.defaultdict(dict)
     for el in escape_split(cli_args, ','):
         kv = escape_split(el, '=', 1)
         if len(kv) == 2:
             k, v = kv
             kwargs[key_prefix + k] = v
     return kwargs
 
 
 def get_origin(obj):
     """
     Get origin of permission from object.
 
     :param obj:
     """
     origin = 'permission'
 
     if getattr(obj, 'owner_row', '') and getattr(obj, 'admin_row', ''):
         # admin and owner case, maybe we should use dual string ?
         origin = 'owner'
     elif getattr(obj, 'owner_row', ''):
         origin = 'owner'
     elif getattr(obj, 'admin_row', ''):
         origin = 'super-admin'
     return origin
 
 
 def store_update(updates, attr, name):
     """
     Stores param in updates dict if it's not instance of Optional
     allows easy updates of passed in params
     """
     if not isinstance(attr, Optional):
         updates[name] = attr
 
 
 def has_superadmin_permission(apiuser):
     """
     Return True if apiuser is admin or return False
 
     :param apiuser:
     """
     if HasPermissionAnyApi('hg.admin')(user=apiuser):
         return True
     return False
 
 
 def validate_repo_permissions(apiuser, repoid, repo, perms):
     """
     Raise JsonRPCError if apiuser is not authorized or return True
 
     :param apiuser:
     :param repoid:
     :param repo:
     :param perms:
     """
     if not HasRepoPermissionAnyApi(*perms)(
             user=apiuser, repo_name=repo.repo_name):
         raise JSONRPCError(
             'repository `%s` does not exist' % repoid)
 
     return True
 
 
 def validate_repo_group_permissions(apiuser, repogroupid, repo_group, perms):
     """
     Raise JsonRPCError if apiuser is not authorized or return True
 
     :param apiuser:
     :param repogroupid: just the id of repository group
     :param repo_group: instance of repo_group
     :param perms:
     """
     if not HasRepoGroupPermissionAnyApi(*perms)(
             user=apiuser, group_name=repo_group.group_name):
         raise JSONRPCError(
             'repository group `%s` does not exist' % repogroupid)
 
     return True
 
 
 def validate_set_owner_permissions(apiuser, owner):
     if isinstance(owner, Optional):
         owner = get_user_or_error(apiuser.user_id)
     else:
         if has_superadmin_permission(apiuser):
             owner = get_user_or_error(owner)
         else:
             # forbid setting owner for non-admins
             raise JSONRPCError(
                 'Only RhodeCode super-admin can specify `owner` param')
     return owner
 
 
 def get_user_or_error(userid):
     """
     Get user by id or name or return JsonRPCError if not found
 
     :param userid:
     """
     from rhodecode.model.user import UserModel
     user_model = UserModel()
 
     if isinstance(userid, (int, long)):
         try:
             user = user_model.get_user(userid)
         except ValueError:
             user = None
     else:
         user = user_model.get_by_username(userid)
 
     if user is None:
         raise JSONRPCError(
             'user `%s` does not exist' % (userid,))
     return user
 
 
 def get_repo_or_error(repoid):
     """
     Get repo by id or name or return JsonRPCError if not found
 
     :param repoid:
     """
     from rhodecode.model.repo import RepoModel
     repo_model = RepoModel()
 
     if isinstance(repoid, (int, long)):
         try:
             repo = repo_model.get_repo(repoid)
         except ValueError:
             repo = None
     else:
         repo = repo_model.get_by_repo_name(repoid)
 
     if repo is None:
         raise JSONRPCError(
             'repository `%s` does not exist' % (repoid,))
     return repo
 
 
 def get_repo_group_or_error(repogroupid):
     """
     Get repo group by id or name or return JsonRPCError if not found
 
     :param repogroupid:
     """
     from rhodecode.model.repo_group import RepoGroupModel
     repo_group_model = RepoGroupModel()
 
     if isinstance(repogroupid, (int, long)):
         try:
             repo_group = repo_group_model._get_repo_group(repogroupid)
         except ValueError:
             repo_group = None
     else:
         repo_group = repo_group_model.get_by_group_name(repogroupid)
 
     if repo_group is None:
         raise JSONRPCError(
             'repository group `%s` does not exist' % (repogroupid,))
     return repo_group
 
 
 def get_user_group_or_error(usergroupid):
     """
     Get user group by id or name or return JsonRPCError if not found
 
     :param usergroupid:
     """
     from rhodecode.model.user_group import UserGroupModel
     user_group_model = UserGroupModel()
 
     if isinstance(usergroupid, (int, long)):
         try:
             user_group = user_group_model.get_group(usergroupid)
         except ValueError:
             user_group = None
     else:
         user_group = user_group_model.get_by_name(usergroupid)
 
     if user_group is None:
         raise JSONRPCError(
             'user group `%s` does not exist' % (usergroupid,))
     return user_group
 
 
 def get_perm_or_error(permid, prefix=None):
     """
     Get permission by id or name or return JsonRPCError if not found
 
     :param permid:
     """
     from rhodecode.model.permission import PermissionModel
 
     perm = PermissionModel.cls.get_by_key(permid)
     if perm is None:
         raise JSONRPCError('permission `%s` does not exist' % (permid,))
     if prefix:
         if not perm.permission_name.startswith(prefix):
             raise JSONRPCError('permission `%s` is invalid, '
                                'should start with %s' % (permid, prefix))
     return perm
 
 
 def get_gist_or_error(gistid):
     """
     Get gist by id or gist_access_id or return JsonRPCError if not found
 
     :param gistid:
     """
     from rhodecode.model.gist import GistModel
 
     gist = GistModel.cls.get_by_access_id(gistid)
     if gist is None:
         raise JSONRPCError('gist `%s` does not exist' % (gistid,))
     return gist
 
 
 def get_pull_request_or_error(pullrequestid):
     """
     Get pull request by id or return JsonRPCError if not found
 
     :param pullrequestid:
     """
     from rhodecode.model.pull_request import PullRequestModel
 
     try:
         pull_request = PullRequestModel().get(int(pullrequestid))
     except ValueError:
         raise JSONRPCError('pullrequestid must be an integer')
     if not pull_request:
         raise JSONRPCError('pull request `%s` does not exist' % (
             pullrequestid,))
     return pull_request
 
 
 def build_commit_data(commit, detail_level):
     parsed_diff = []
     if detail_level == 'extended':
         for f in commit.added:
             parsed_diff.append(_get_commit_dict(filename=f.path, op='A'))
         for f in commit.changed:
             parsed_diff.append(_get_commit_dict(filename=f.path, op='M'))
         for f in commit.removed:
             parsed_diff.append(_get_commit_dict(filename=f.path, op='D'))
 
     elif detail_level == 'full':
         from rhodecode.lib.diffs import DiffProcessor
         diff_processor = DiffProcessor(commit.diff())
         for dp in diff_processor.prepare():
             del dp['stats']['ops']
             _stats = dp['stats']
             parsed_diff.append(_get_commit_dict(
                 filename=dp['filename'], op=dp['operation'],
                 new_revision=dp['new_revision'],
                 old_revision=dp['old_revision'],
                 raw_diff=dp['raw_diff'], stats=_stats))
 
     return parsed_diff
 
 
 def get_commit_or_error(ref, repo):
     try:
         ref_type, _, ref_hash = ref.split(':')
     except ValueError:
         raise JSONRPCError(
             'Ref `{ref}` given in a wrong format. Please check the API'
             ' documentation for more details'.format(ref=ref))
     try:
         # TODO: dan: refactor this to use repo.scm_instance().get_commit()
         # once get_commit supports ref_types
         return get_commit_from_ref_name(repo, ref_hash)
     except RepositoryError:
         raise JSONRPCError('Ref `{ref}` does not exist'.format(ref=ref))
 
 
-def resolve_ref_or_error(ref, repo):
+def _get_ref_hash(repo, type_, name):
+    vcs_repo = repo.scm_instance()
+    if type_ in ['branch'] and vcs_repo.alias in ('hg', 'git'):
+        return vcs_repo.branches[name]
+    elif type_ in ['bookmark', 'book'] and vcs_repo.alias == 'hg':
+        return vcs_repo.bookmarks[name]
+    else:
+        raise ValueError()
+
+
+def resolve_ref_or_error(ref, repo, allowed_ref_types=None):
+    allowed_ref_types = allowed_ref_types or ['bookmark', 'book', 'tag', 'branch']
+
     def _parse_ref(type_, name, hash_=None):
         return type_, name, hash_
 
     try:
         ref_type, ref_name, ref_hash = _parse_ref(*ref.split(':'))
     except TypeError:
         raise JSONRPCError(
             'Ref `{ref}` given in a wrong format. Please check the API'
             ' documentation for more details'.format(ref=ref))
 
+    if ref_type not in allowed_ref_types:
+        raise JSONRPCError(
+            'Ref `{ref}` type is not allowed. '
+            'Only:{allowed_refs} are possible.'.format(
+                ref=ref, allowed_refs=allowed_ref_types))
+
     try:
         ref_hash = ref_hash or _get_ref_hash(repo, ref_type, ref_name)
     except (KeyError, ValueError):
         raise JSONRPCError(
             'The specified value:{type}:`{name}` does not exist, or is not allowed.'.format(
                 type=ref_type, name=ref_name))
 
     return ':'.join([ref_type, ref_name, ref_hash])
 
 
 def _get_commit_dict(
         filename, op, new_revision=None, old_revision=None,
         raw_diff=None, stats=None):
     if stats is None:
         stats = {
             "added": None,
             "binary": None,
             "deleted": None
         }
     return {
         "filename": safe_unicode(filename),
         "op": op,
 
         # extra details
         "new_revision": new_revision,
         "old_revision": old_revision,
 
         "raw_diff": raw_diff,
         "stats": stats
     }
-
-
-def _get_ref_hash(repo, type_, name):
-    vcs_repo = repo.scm_instance()
-    if type_ == 'branch' and vcs_repo.alias in ('hg', 'git'):
-        return vcs_repo.branches[name]
-    elif type_ == 'bookmark' and vcs_repo.alias == 'hg':
-        return vcs_repo.bookmarks[name]
-    else:
-        raise ValueError()

rhodecode/apps/repository/tests/test_repo_files.py

@@ -1,1069 +1,1069 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2018 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import os
 
 import mock
 import pytest
 
 from rhodecode.apps.repository.views.repo_files import RepoFilesView
 from rhodecode.lib import helpers as h
 from rhodecode.lib.compat import OrderedDict
 from rhodecode.lib.ext_json import json
 from rhodecode.lib.vcs import nodes
 
 from rhodecode.lib.vcs.conf import settings
 from rhodecode.tests import assert_session_flash
 from rhodecode.tests.fixture import Fixture
 from rhodecode.model.db import Session
 
 fixture = Fixture()
 
 
 def get_node_history(backend_type):
     return {
         'hg': json.loads(fixture.load_resource('hg_node_history_response.json')),
         'git': json.loads(fixture.load_resource('git_node_history_response.json')),
         'svn': json.loads(fixture.load_resource('svn_node_history_response.json')),
     }[backend_type]
 
 
 def route_path(name, params=None, **kwargs):
     import urllib
 
     base_url = {
         'repo_summary': '/{repo_name}',
         'repo_archivefile': '/{repo_name}/archive/{fname}',
         'repo_files_diff': '/{repo_name}/diff/{f_path}',
         'repo_files_diff_2way_redirect':  '/{repo_name}/diff-2way/{f_path}',
         'repo_files': '/{repo_name}/files/{commit_id}/{f_path}',
         'repo_files:default_path': '/{repo_name}/files/{commit_id}/',
         'repo_files:default_commit': '/{repo_name}/files',
         'repo_files:rendered': '/{repo_name}/render/{commit_id}/{f_path}',
         'repo_files:annotated': '/{repo_name}/annotate/{commit_id}/{f_path}',
         'repo_files:annotated_previous': '/{repo_name}/annotate-previous/{commit_id}/{f_path}',
         'repo_files_nodelist': '/{repo_name}/nodelist/{commit_id}/{f_path}',
         'repo_file_raw': '/{repo_name}/raw/{commit_id}/{f_path}',
         'repo_file_download': '/{repo_name}/download/{commit_id}/{f_path}',
         'repo_file_history': '/{repo_name}/history/{commit_id}/{f_path}',
         'repo_file_authors': '/{repo_name}/authors/{commit_id}/{f_path}',
         'repo_files_remove_file': '/{repo_name}/remove_file/{commit_id}/{f_path}',
         'repo_files_delete_file': '/{repo_name}/delete_file/{commit_id}/{f_path}',
         'repo_files_edit_file': '/{repo_name}/edit_file/{commit_id}/{f_path}',
         'repo_files_update_file': '/{repo_name}/update_file/{commit_id}/{f_path}',
         'repo_files_add_file': '/{repo_name}/add_file/{commit_id}/{f_path}',
         'repo_files_create_file': '/{repo_name}/create_file/{commit_id}/{f_path}',
         'repo_nodetree_full': '/{repo_name}/nodetree_full/{commit_id}/{f_path}',
         'repo_nodetree_full:default_path': '/{repo_name}/nodetree_full/{commit_id}/',
     }[name].format(**kwargs)
 
     if params:
         base_url = '{}?{}'.format(base_url, urllib.urlencode(params))
     return base_url
 
 
 def assert_files_in_response(response, files, params):
     template = (
         'href="/%(repo_name)s/files/%(commit_id)s/%(name)s"')
     _assert_items_in_response(response, files, template, params)
 
 
 def assert_dirs_in_response(response, dirs, params):
     template = (
         'href="/%(repo_name)s/files/%(commit_id)s/%(name)s"')
     _assert_items_in_response(response, dirs, template, params)
 
 
 def _assert_items_in_response(response, items, template, params):
     for item in items:
         item_params = {'name': item}
         item_params.update(params)
         response.mustcontain(template % item_params)
 
 
 def assert_timeago_in_response(response, items, params):
     for item in items:
         response.mustcontain(h.age_component(params['date']))
 
 
 @pytest.mark.usefixtures("app")
 class TestFilesViews(object):
 
     def test_show_files(self, backend):
         response = self.app.get(
             route_path('repo_files',
                        repo_name=backend.repo_name,
                        commit_id='tip', f_path='/'))
         commit = backend.repo.get_commit()
 
         params = {
             'repo_name': backend.repo_name,
             'commit_id': commit.raw_id,
             'date': commit.date
         }
         assert_dirs_in_response(response, ['docs', 'vcs'], params)
         files = [
             '.gitignore',
             '.hgignore',
             '.hgtags',
             # TODO: missing in Git
             # '.travis.yml',
             'MANIFEST.in',
             'README.rst',
             # TODO: File is missing in svn repository
             # 'run_test_and_report.sh',
             'setup.cfg',
             'setup.py',
             'test_and_report.sh',
             'tox.ini',
         ]
         assert_files_in_response(response, files, params)
         assert_timeago_in_response(response, files, params)
 
     def test_show_files_links_submodules_with_absolute_url(self, backend_hg):
         repo = backend_hg['subrepos']
         response = self.app.get(
             route_path('repo_files',
                        repo_name=repo.repo_name,
                        commit_id='tip', f_path='/'))
         assert_response = response.assert_response()
         assert_response.contains_one_link(
             'absolute-path @ 000000000000', 'http://example.com/absolute-path')
 
     def test_show_files_links_submodules_with_absolute_url_subpaths(
             self, backend_hg):
         repo = backend_hg['subrepos']
         response = self.app.get(
             route_path('repo_files',
                        repo_name=repo.repo_name,
                        commit_id='tip', f_path='/'))
         assert_response = response.assert_response()
         assert_response.contains_one_link(
             'subpaths-path @ 000000000000',
             'http://sub-base.example.com/subpaths-path')
 
     @pytest.mark.xfail_backends("svn", reason="Depends on branch support")
     def test_files_menu(self, backend):
         new_branch = "temp_branch_name"
         commits = [
             {'message': 'a'},
             {'message': 'b', 'branch': new_branch}
         ]
         backend.create_repo(commits)
         backend.repo.landing_rev = "branch:%s" % new_branch
         Session().commit()
 
         # get response based on tip and not new commit
         response = self.app.get(
             route_path('repo_files',
                        repo_name=backend.repo_name,
                        commit_id='tip', f_path='/'))
 
         # make sure Files menu url is not tip but new commit
         landing_rev = backend.repo.landing_rev[1]
         files_url = route_path('repo_files:default_path',
                                repo_name=backend.repo_name,
                                commit_id=landing_rev)
 
         assert landing_rev != 'tip'
         response.mustcontain(
             '<li class="active"><a class="menulink" href="%s">' % files_url)
 
     def test_show_files_commit(self, backend):
         commit = backend.repo.get_commit(commit_idx=32)
 
         response = self.app.get(
             route_path('repo_files',
                        repo_name=backend.repo_name,
                        commit_id=commit.raw_id, f_path='/'))
 
         dirs = ['docs', 'tests']
         files = ['README.rst']
         params = {
             'repo_name': backend.repo_name,
             'commit_id': commit.raw_id,
         }
         assert_dirs_in_response(response, dirs, params)
         assert_files_in_response(response, files, params)
 
     def test_show_files_different_branch(self, backend):
         branches = dict(
             hg=(150, ['git']),
             # TODO: Git test repository does not contain other branches
             git=(633, ['master']),
             # TODO: Branch support in Subversion
             svn=(150, [])
         )
         idx, branches = branches[backend.alias]
         commit = backend.repo.get_commit(commit_idx=idx)
         response = self.app.get(
             route_path('repo_files',
                        repo_name=backend.repo_name,
                        commit_id=commit.raw_id, f_path='/'))
 
         assert_response = response.assert_response()
         for branch in branches:
             assert_response.element_contains('.tags .branchtag', branch)
 
     def test_show_files_paging(self, backend):
         repo = backend.repo
         indexes = [73, 92, 109, 1, 0]
         idx_map = [(rev, repo.get_commit(commit_idx=rev).raw_id)
                    for rev in indexes]
 
         for idx in idx_map:
             response = self.app.get(
             route_path('repo_files',
                        repo_name=backend.repo_name,
                        commit_id=idx[1], f_path='/'))
 
             response.mustcontain("""r%s:%s""" % (idx[0], idx[1][:8]))
 
     def test_file_source(self, backend):
         commit = backend.repo.get_commit(commit_idx=167)
         response = self.app.get(
             route_path('repo_files',
                        repo_name=backend.repo_name,
                        commit_id=commit.raw_id, f_path='vcs/nodes.py'))
 
         msgbox = """<div class="commit right-content">%s</div>"""
         response.mustcontain(msgbox % (commit.message, ))
 
         assert_response = response.assert_response()
         if commit.branch:
             assert_response.element_contains(
                 '.tags.tags-main .branchtag', commit.branch)
         if commit.tags:
             for tag in commit.tags:
                 assert_response.element_contains('.tags.tags-main .tagtag', tag)
 
     def test_file_source_annotated(self, backend):
         response = self.app.get(
             route_path('repo_files:annotated',
                        repo_name=backend.repo_name,
                        commit_id='tip', f_path='vcs/nodes.py'))
         expected_commits = {
             'hg': 'r356',
             'git': 'r345',
             'svn': 'r208',
         }
         response.mustcontain(expected_commits[backend.alias])
 
     def test_file_source_authors(self, backend):
         response = self.app.get(
             route_path('repo_file_authors',
                        repo_name=backend.repo_name,
                        commit_id='tip', f_path='vcs/nodes.py'))
         expected_authors = {
             'hg': ('Marcin Kuzminski', 'Lukasz Balcerzak'),
             'git': ('Marcin Kuzminski', 'Lukasz Balcerzak'),
             'svn': ('marcin', 'lukasz'),
         }
 
         for author in expected_authors[backend.alias]:
             response.mustcontain(author)
 
     def test_file_source_authors_with_annotation(self, backend):
         response = self.app.get(
             route_path('repo_file_authors',
                        repo_name=backend.repo_name,
                        commit_id='tip', f_path='vcs/nodes.py',
                        params=dict(annotate=1)))
         expected_authors = {
             'hg': ('Marcin Kuzminski', 'Lukasz Balcerzak'),
             'git': ('Marcin Kuzminski', 'Lukasz Balcerzak'),
             'svn': ('marcin', 'lukasz'),
         }
 
         for author in expected_authors[backend.alias]:
             response.mustcontain(author)
 
     def test_file_source_history(self, backend, xhr_header):
         response = self.app.get(
             route_path('repo_file_history',
                        repo_name=backend.repo_name,
                        commit_id='tip', f_path='vcs/nodes.py'),
             extra_environ=xhr_header)
         assert get_node_history(backend.alias) == json.loads(response.body)
 
     def test_file_source_history_svn(self, backend_svn, xhr_header):
         simple_repo = backend_svn['svn-simple-layout']
         response = self.app.get(
             route_path('repo_file_history',
                        repo_name=simple_repo.repo_name,
                        commit_id='tip', f_path='trunk/example.py'),
             extra_environ=xhr_header)
 
         expected_data = json.loads(
             fixture.load_resource('svn_node_history_branches.json'))
         assert expected_data == response.json
 
     def test_file_source_history_with_annotation(self, backend, xhr_header):
         response = self.app.get(
             route_path('repo_file_history',
                        repo_name=backend.repo_name,
                        commit_id='tip', f_path='vcs/nodes.py',
                        params=dict(annotate=1)),
 
             extra_environ=xhr_header)
         assert get_node_history(backend.alias) == json.loads(response.body)
 
     def test_tree_search_top_level(self, backend, xhr_header):
         commit = backend.repo.get_commit(commit_idx=173)
         response = self.app.get(
             route_path('repo_files_nodelist',
                        repo_name=backend.repo_name,
                        commit_id=commit.raw_id, f_path='/'),
             extra_environ=xhr_header)
         assert 'nodes' in response.json
         assert {'name': 'docs', 'type': 'dir'} in response.json['nodes']
 
     def test_tree_search_missing_xhr(self, backend):
         self.app.get(
             route_path('repo_files_nodelist',
                        repo_name=backend.repo_name,
                        commit_id='tip', f_path='/'),
             status=404)
 
     def test_tree_search_at_path(self, backend, xhr_header):
         commit = backend.repo.get_commit(commit_idx=173)
         response = self.app.get(
             route_path('repo_files_nodelist',
                        repo_name=backend.repo_name,
                        commit_id=commit.raw_id, f_path='/docs'),
             extra_environ=xhr_header)
         assert 'nodes' in response.json
         nodes = response.json['nodes']
         assert {'name': 'docs/api', 'type': 'dir'} in nodes
         assert {'name': 'docs/index.rst', 'type': 'file'} in nodes
 
     def test_tree_search_at_path_2nd_level(self, backend, xhr_header):
         commit = backend.repo.get_commit(commit_idx=173)
         response = self.app.get(
             route_path('repo_files_nodelist',
                        repo_name=backend.repo_name,
                        commit_id=commit.raw_id, f_path='/docs/api'),
             extra_environ=xhr_header)
         assert 'nodes' in response.json
         nodes = response.json['nodes']
         assert {'name': 'docs/api/index.rst', 'type': 'file'} in nodes
 
     def test_tree_search_at_path_missing_xhr(self, backend):
         self.app.get(
             route_path('repo_files_nodelist',
                        repo_name=backend.repo_name,
                        commit_id='tip', f_path='/docs'),
             status=404)
 
     def test_nodetree(self, backend, xhr_header):
         commit = backend.repo.get_commit(commit_idx=173)
         response = self.app.get(
             route_path('repo_nodetree_full',
                        repo_name=backend.repo_name,
                        commit_id=commit.raw_id, f_path='/'),
             extra_environ=xhr_header)
 
         assert_response = response.assert_response()
 
         for attr in ['data-commit-id', 'data-date', 'data-author']:
             elements = assert_response.get_elements('[{}]'.format(attr))
             assert len(elements) > 1
 
             for element in elements:
                 assert element.get(attr)
 
     def test_nodetree_if_file(self, backend, xhr_header):
         commit = backend.repo.get_commit(commit_idx=173)
         response = self.app.get(
             route_path('repo_nodetree_full',
                        repo_name=backend.repo_name,
                        commit_id=commit.raw_id, f_path='README.rst'),
             extra_environ=xhr_header)
         assert response.body == ''
 
     def test_nodetree_wrong_path(self, backend, xhr_header):
         commit = backend.repo.get_commit(commit_idx=173)
         response = self.app.get(
             route_path('repo_nodetree_full',
                        repo_name=backend.repo_name,
                        commit_id=commit.raw_id, f_path='/dont-exist'),
             extra_environ=xhr_header)
 
         err = 'error: There is no file nor ' \
               'directory at the given path'
         assert err in response.body
 
     def test_nodetree_missing_xhr(self, backend):
         self.app.get(
             route_path('repo_nodetree_full',
                        repo_name=backend.repo_name,
                        commit_id='tip', f_path='/'),
             status=404)
 
 
 @pytest.mark.usefixtures("app", "autologin_user")
 class TestRawFileHandling(object):
 
     def test_download_file(self, backend):
         commit = backend.repo.get_commit(commit_idx=173)
         response = self.app.get(
             route_path('repo_file_download',
                        repo_name=backend.repo_name,
                        commit_id=commit.raw_id, f_path='vcs/nodes.py'),)
 
-        assert response.content_disposition == "attachment; filename=nodes.py"
+        assert response.content_disposition == 'attachment; filename="nodes.py"; filename*=UTF-8\'\'nodes.py'
         assert response.content_type == "text/x-python"
 
     def test_download_file_wrong_cs(self, backend):
         raw_id = u'ERRORce30c96924232dffcd24178a07ffeb5dfc'
 
         response = self.app.get(
             route_path('repo_file_download',
                        repo_name=backend.repo_name,
                        commit_id=raw_id, f_path='vcs/nodes.svg'),
             status=404)
 
         msg = """No such commit exists for this repository"""
         response.mustcontain(msg)
 
     def test_download_file_wrong_f_path(self, backend):
         commit = backend.repo.get_commit(commit_idx=173)
         f_path = 'vcs/ERRORnodes.py'
 
         response = self.app.get(
             route_path('repo_file_download',
                        repo_name=backend.repo_name,
                        commit_id=commit.raw_id, f_path=f_path),
             status=404)
 
         msg = (
             "There is no file nor directory at the given path: "
             "`%s` at commit %s" % (f_path, commit.short_id))
         response.mustcontain(msg)
 
     def test_file_raw(self, backend):
         commit = backend.repo.get_commit(commit_idx=173)
         response = self.app.get(
             route_path('repo_file_raw',
                        repo_name=backend.repo_name,
                        commit_id=commit.raw_id, f_path='vcs/nodes.py'),)
 
         assert response.content_type == "text/plain"
 
     def test_file_raw_binary(self, backend):
         commit = backend.repo.get_commit()
         response = self.app.get(
             route_path('repo_file_raw',
                        repo_name=backend.repo_name,
                        commit_id=commit.raw_id,
                        f_path='docs/theme/ADC/static/breadcrumb_background.png'),)
 
         assert response.content_disposition == 'inline'
 
     def test_raw_file_wrong_cs(self, backend):
         raw_id = u'ERRORcce30c96924232dffcd24178a07ffeb5dfc'
 
         response = self.app.get(
             route_path('repo_file_raw',
                        repo_name=backend.repo_name,
                        commit_id=raw_id, f_path='vcs/nodes.svg'),
             status=404)
 
         msg = """No such commit exists for this repository"""
         response.mustcontain(msg)
 
     def test_raw_wrong_f_path(self, backend):
         commit = backend.repo.get_commit(commit_idx=173)
         f_path = 'vcs/ERRORnodes.py'
         response = self.app.get(
             route_path('repo_file_raw',
                        repo_name=backend.repo_name,
                        commit_id=commit.raw_id, f_path=f_path),
             status=404)
 
         msg = (
             "There is no file nor directory at the given path: "
             "`%s` at commit %s" % (f_path, commit.short_id))
         response.mustcontain(msg)
 
     def test_raw_svg_should_not_be_rendered(self, backend):
         backend.create_repo()
         backend.ensure_file("xss.svg")
         response = self.app.get(
             route_path('repo_file_raw',
                        repo_name=backend.repo_name,
                        commit_id='tip', f_path='xss.svg'),)
         # If the content type is image/svg+xml then it allows to render HTML
         # and malicious SVG.
         assert response.content_type == "text/plain"
 
 
 @pytest.mark.usefixtures("app")
 class TestRepositoryArchival(object):
 
     def test_archival(self, backend):
         backend.enable_downloads()
         commit = backend.repo.get_commit(commit_idx=173)
         for archive, info in settings.ARCHIVE_SPECS.items():
             mime_type, arch_ext = info
             short = commit.short_id + arch_ext
             fname = commit.raw_id + arch_ext
             filename = '%s-%s' % (backend.repo_name, short)
             response = self.app.get(
                 route_path('repo_archivefile',
                            repo_name=backend.repo_name,
                            fname=fname))
 
             assert response.status == '200 OK'
             headers = [
                 ('Content-Disposition', 'attachment; filename=%s' % filename),
                 ('Content-Type', '%s' % mime_type),
             ]
 
             for header in headers:
                 assert header in response.headers.items()
 
     @pytest.mark.parametrize('arch_ext',[
         'tar', 'rar', 'x', '..ax', '.zipz', 'tar.gz.tar'])
     def test_archival_wrong_ext(self, backend, arch_ext):
         backend.enable_downloads()
         commit = backend.repo.get_commit(commit_idx=173)
 
         fname = commit.raw_id + '.' + arch_ext
 
         response = self.app.get(
             route_path('repo_archivefile',
                        repo_name=backend.repo_name,
                        fname=fname))
         response.mustcontain(
             'Unknown archive type for: `{}`'.format(fname))
 
     @pytest.mark.parametrize('commit_id', [
         '00x000000', 'tar', 'wrong', '@$@$42413232', '232dffcd'])
     def test_archival_wrong_commit_id(self, backend, commit_id):
         backend.enable_downloads()
         fname = '%s.zip' % commit_id
 
         response = self.app.get(
             route_path('repo_archivefile',
                        repo_name=backend.repo_name,
                        fname=fname))
         response.mustcontain('Unknown commit_id')
 
 
 @pytest.mark.usefixtures("app")
 class TestFilesDiff(object):
 
     @pytest.mark.parametrize("diff", ['diff', 'download', 'raw'])
     def test_file_full_diff(self, backend, diff):
         commit1 = backend.repo.get_commit(commit_idx=-1)
         commit2 = backend.repo.get_commit(commit_idx=-2)
 
         response = self.app.get(
             route_path('repo_files_diff',
                        repo_name=backend.repo_name,
                        f_path='README'),
             params={
                 'diff1': commit2.raw_id,
                 'diff2': commit1.raw_id,
                 'fulldiff': '1',
                 'diff': diff,
             })
 
         if diff == 'diff':
             # use redirect since this is OLD view redirecting to compare page
             response = response.follow()
 
         # It's a symlink to README.rst
         response.mustcontain('README.rst')
         response.mustcontain('No newline at end of file')
 
     def test_file_binary_diff(self, backend):
         commits = [
             {'message': 'First commit'},
             {'message': 'Commit with binary',
              'added': [nodes.FileNode('file.bin', content='\0BINARY\0')]},
         ]
         repo = backend.create_repo(commits=commits)
 
         response = self.app.get(
             route_path('repo_files_diff',
                        repo_name=backend.repo_name,
                        f_path='file.bin'),
             params={
                 'diff1': repo.get_commit(commit_idx=0).raw_id,
                 'diff2': repo.get_commit(commit_idx=1).raw_id,
                 'fulldiff': '1',
                 'diff': 'diff',
             })
         # use redirect since this is OLD view redirecting to compare page
         response = response.follow()
         response.mustcontain('Expand 1 commit')
         response.mustcontain('1 file changed: 0 inserted, 0 deleted')
 
         if backend.alias == 'svn':
             response.mustcontain('new file 10644')
             # TODO(marcink): SVN doesn't yet detect binary changes
         else:
             response.mustcontain('new file 100644')
             response.mustcontain('binary diff hidden')
 
     def test_diff_2way(self, backend):
         commit1 = backend.repo.get_commit(commit_idx=-1)
         commit2 = backend.repo.get_commit(commit_idx=-2)
         response = self.app.get(
             route_path('repo_files_diff_2way_redirect',
                        repo_name=backend.repo_name,
                        f_path='README'),
             params={
                 'diff1': commit2.raw_id,
                 'diff2': commit1.raw_id,
             })
         # use redirect since this is OLD view redirecting to compare page
         response = response.follow()
 
         # It's a symlink to README.rst
         response.mustcontain('README.rst')
         response.mustcontain('No newline at end of file')
 
     def test_requires_one_commit_id(self, backend, autologin_user):
         response = self.app.get(
             route_path('repo_files_diff',
                        repo_name=backend.repo_name,
                        f_path='README.rst'),
             status=400)
         response.mustcontain(
             'Need query parameter', 'diff1', 'diff2', 'to generate a diff.')
 
     def test_returns_no_files_if_file_does_not_exist(self, vcsbackend):
         repo = vcsbackend.repo
         response = self.app.get(
             route_path('repo_files_diff',
                        repo_name=repo.name,
                        f_path='does-not-exist-in-any-commit'),
             params={
                 'diff1': repo[0].raw_id,
                 'diff2': repo[1].raw_id
             })
 
         response = response.follow()
         response.mustcontain('No files')
 
     def test_returns_redirect_if_file_not_changed(self, backend):
         commit = backend.repo.get_commit(commit_idx=-1)
         response = self.app.get(
             route_path('repo_files_diff_2way_redirect',
                        repo_name=backend.repo_name,
                        f_path='README'),
             params={
                 'diff1': commit.raw_id,
                 'diff2': commit.raw_id,
             })
 
         response = response.follow()
         response.mustcontain('No files')
         response.mustcontain('No commits in this compare')
 
     def test_supports_diff_to_different_path_svn(self, backend_svn):
         #TODO: check this case
         return
 
         repo = backend_svn['svn-simple-layout'].scm_instance()
         commit_id_1 = '24'
         commit_id_2 = '26'
 
         response = self.app.get(
             route_path('repo_files_diff',
                        repo_name=backend_svn.repo_name,
                        f_path='trunk/example.py'),
             params={
                 'diff1': 'tags/v0.2/example.py@' + commit_id_1,
                 'diff2': commit_id_2,
             })
 
         response = response.follow()
         response.mustcontain(
             # diff contains this
             "Will print out a useful message on invocation.")
 
         # Note: Expecting that we indicate the user what's being compared
         response.mustcontain("trunk/example.py")
         response.mustcontain("tags/v0.2/example.py")
 
     def test_show_rev_redirects_to_svn_path(self, backend_svn):
         #TODO: check this case
         return
 
         repo = backend_svn['svn-simple-layout'].scm_instance()
         commit_id = repo[-1].raw_id
 
         response = self.app.get(
             route_path('repo_files_diff',
                        repo_name=backend_svn.repo_name,
                        f_path='trunk/example.py'),
             params={
                 'diff1': 'branches/argparse/example.py@' + commit_id,
                 'diff2': commit_id,
             },
             status=302)
         response = response.follow()
         assert response.headers['Location'].endswith(
             'svn-svn-simple-layout/files/26/branches/argparse/example.py')
 
     def test_show_rev_and_annotate_redirects_to_svn_path(self, backend_svn):
         #TODO: check this case
         return
 
         repo = backend_svn['svn-simple-layout'].scm_instance()
         commit_id = repo[-1].raw_id
         response = self.app.get(
             route_path('repo_files_diff',
                        repo_name=backend_svn.repo_name,
                        f_path='trunk/example.py'),
             params={
                 'diff1': 'branches/argparse/example.py@' + commit_id,
                 'diff2': commit_id,
                 'show_rev': 'Show at Revision',
                 'annotate': 'true',
             },
             status=302)
         response = response.follow()
         assert response.headers['Location'].endswith(
             'svn-svn-simple-layout/annotate/26/branches/argparse/example.py')
 
 
 @pytest.mark.usefixtures("app", "autologin_user")
 class TestModifyFilesWithWebInterface(object):
 
     def test_add_file_view(self, backend):
         self.app.get(
             route_path('repo_files_add_file',
                        repo_name=backend.repo_name,
                        commit_id='tip', f_path='/')
             )
 
     @pytest.mark.xfail_backends("svn", reason="Depends on online editing")
     def test_add_file_into_repo_missing_content(self, backend, csrf_token):
         repo = backend.create_repo()
         filename = 'init.py'
         response = self.app.post(
             route_path('repo_files_create_file',
                        repo_name=backend.repo_name,
                        commit_id='tip', f_path='/'),
             params={
                 'content': "",
                 'filename': filename,
                 'location': "",
                 'csrf_token': csrf_token,
             },
             status=302)
         assert_session_flash(response,
             'Successfully committed new file `{}`'.format(
                 os.path.join(filename)))
 
     def test_add_file_into_repo_missing_filename(self, backend, csrf_token):
         response = self.app.post(
             route_path('repo_files_create_file',
                        repo_name=backend.repo_name,
                        commit_id='tip', f_path='/'),
             params={
                 'content': "foo",
                 'csrf_token': csrf_token,
             },
             status=302)
 
         assert_session_flash(response, 'No filename')
 
     def test_add_file_into_repo_errors_and_no_commits(
             self, backend, csrf_token):
         repo = backend.create_repo()
         # Create a file with no filename, it will display an error but
         # the repo has no commits yet
         response = self.app.post(
             route_path('repo_files_create_file',
                        repo_name=repo.repo_name,
                        commit_id='tip', f_path='/'),
             params={
                 'content': "foo",
                 'csrf_token': csrf_token,
             },
             status=302)
 
         assert_session_flash(response, 'No filename')
 
         # Not allowed, redirect to the summary
         redirected = response.follow()
         summary_url = h.route_path('repo_summary', repo_name=repo.repo_name)
 
         # As there are no commits, displays the summary page with the error of
         # creating a file with no filename
 
         assert redirected.request.path == summary_url
 
     @pytest.mark.parametrize("location, filename", [
         ('/abs', 'foo'),
         ('../rel', 'foo'),
         ('file/../foo', 'foo'),
     ])
     def test_add_file_into_repo_bad_filenames(
             self, location, filename, backend, csrf_token):
         response = self.app.post(
             route_path('repo_files_create_file',
                        repo_name=backend.repo_name,
                        commit_id='tip', f_path='/'),
             params={
                 'content': "foo",
                 'filename': filename,
                 'location': location,
                 'csrf_token': csrf_token,
             },
             status=302)
 
         assert_session_flash(
             response,
             'The location specified must be a relative path and must not '
             'contain .. in the path')
 
     @pytest.mark.parametrize("cnt, location, filename", [
         (1, '', 'foo.txt'),
         (2, 'dir', 'foo.rst'),
         (3, 'rel/dir', 'foo.bar'),
     ])
     def test_add_file_into_repo(self, cnt, location, filename, backend,
                                 csrf_token):
         repo = backend.create_repo()
         response = self.app.post(
             route_path('repo_files_create_file',
                        repo_name=repo.repo_name,
                        commit_id='tip', f_path='/'),
             params={
                 'content': "foo",
                 'filename': filename,
                 'location': location,
                 'csrf_token': csrf_token,
             },
             status=302)
         assert_session_flash(response,
             'Successfully committed new file `{}`'.format(
                 os.path.join(location, filename)))
 
     def test_edit_file_view(self, backend):
         response = self.app.get(
             route_path('repo_files_edit_file',
                        repo_name=backend.repo_name,
                        commit_id=backend.default_head_id,
                        f_path='vcs/nodes.py'),
             status=200)
         response.mustcontain("Module holding everything related to vcs nodes.")
 
     def test_edit_file_view_not_on_branch(self, backend):
         repo = backend.create_repo()
         backend.ensure_file("vcs/nodes.py")
 
         response = self.app.get(
             route_path('repo_files_edit_file',
                        repo_name=repo.repo_name,
                        commit_id='tip',
                        f_path='vcs/nodes.py'),
             status=302)
         assert_session_flash(
             response,
             'You can only edit files with commit being a valid branch')
 
     def test_edit_file_view_commit_changes(self, backend, csrf_token):
         repo = backend.create_repo()
         backend.ensure_file("vcs/nodes.py", content="print 'hello'")
 
         response = self.app.post(
             route_path('repo_files_update_file',
                        repo_name=repo.repo_name,
                        commit_id=backend.default_head_id,
                        f_path='vcs/nodes.py'),
             params={
                 'content': "print 'hello world'",
                 'message': 'I committed',
                 'filename': "vcs/nodes.py",
                 'csrf_token': csrf_token,
             },
             status=302)
         assert_session_flash(
             response, 'Successfully committed changes to file `vcs/nodes.py`')
         tip = repo.get_commit(commit_idx=-1)
         assert tip.message == 'I committed'
 
     def test_edit_file_view_commit_changes_default_message(self, backend,
                                                            csrf_token):
         repo = backend.create_repo()
         backend.ensure_file("vcs/nodes.py", content="print 'hello'")
 
         commit_id = (
             backend.default_branch_name or
             backend.repo.scm_instance().commit_ids[-1])
 
         response = self.app.post(
             route_path('repo_files_update_file',
                        repo_name=repo.repo_name,
                        commit_id=commit_id,
                        f_path='vcs/nodes.py'),
             params={
                 'content': "print 'hello world'",
                 'message': '',
                 'filename': "vcs/nodes.py",
                 'csrf_token': csrf_token,
             },
             status=302)
         assert_session_flash(
             response, 'Successfully committed changes to file `vcs/nodes.py`')
         tip = repo.get_commit(commit_idx=-1)
         assert tip.message == 'Edited file vcs/nodes.py via RhodeCode Enterprise'
 
     def test_delete_file_view(self, backend):
         self.app.get(
             route_path('repo_files_remove_file',
                        repo_name=backend.repo_name,
                        commit_id=backend.default_head_id,
                        f_path='vcs/nodes.py'),
             status=200)
 
     def test_delete_file_view_not_on_branch(self, backend):
         repo = backend.create_repo()
         backend.ensure_file('vcs/nodes.py')
 
         response = self.app.get(
             route_path('repo_files_remove_file',
                        repo_name=repo.repo_name,
                        commit_id='tip',
                        f_path='vcs/nodes.py'),
             status=302)
         assert_session_flash(
             response,
             'You can only delete files with commit being a valid branch')
 
     def test_delete_file_view_commit_changes(self, backend, csrf_token):
         repo = backend.create_repo()
         backend.ensure_file("vcs/nodes.py")
 
         response = self.app.post(
             route_path('repo_files_delete_file',
                        repo_name=repo.repo_name,
                        commit_id=backend.default_head_id,
                        f_path='vcs/nodes.py'),
             params={
                 'message': 'i commited',
                 'csrf_token': csrf_token,
             },
             status=302)
         assert_session_flash(
             response, 'Successfully deleted file `vcs/nodes.py`')
 
 
 @pytest.mark.usefixtures("app")
 class TestFilesViewOtherCases(object):
 
     def test_access_empty_repo_redirect_to_summary_with_alert_write_perms(
             self, backend_stub, autologin_regular_user, user_regular,
             user_util):
 
         repo = backend_stub.create_repo()
         user_util.grant_user_permission_to_repo(
             repo, user_regular, 'repository.write')
         response = self.app.get(
             route_path('repo_files',
                        repo_name=repo.repo_name,
                        commit_id='tip', f_path='/'))
 
         repo_file_add_url = route_path(
             'repo_files_add_file',
             repo_name=repo.repo_name,
             commit_id=0, f_path='') + '#edit'
 
         assert_session_flash(
             response,
             'There are no files yet. <a class="alert-link" '
             'href="{}">Click here to add a new file.</a>'
             .format(repo_file_add_url))
 
     def test_access_empty_repo_redirect_to_summary_with_alert_no_write_perms(
             self, backend_stub, autologin_regular_user):
         repo = backend_stub.create_repo()
         # init session for anon user
         route_path('repo_summary', repo_name=repo.repo_name)
 
         repo_file_add_url = route_path(
             'repo_files_add_file',
             repo_name=repo.repo_name,
             commit_id=0, f_path='') + '#edit'
 
         response = self.app.get(
             route_path('repo_files',
                        repo_name=repo.repo_name,
                        commit_id='tip', f_path='/'))
 
         assert_session_flash(response, no_=repo_file_add_url)
 
     @pytest.mark.parametrize('file_node', [
         'archive/file.zip',
         'diff/my-file.txt',
         'render.py',
         'render',
         'remove_file',
         'remove_file/to-delete.txt',
     ])
     def test_file_names_equal_to_routes_parts(self, backend, file_node):
         backend.create_repo()
         backend.ensure_file(file_node)
 
         self.app.get(
             route_path('repo_files',
                        repo_name=backend.repo_name,
                        commit_id='tip', f_path=file_node),
             status=200)
 
 
 class TestAdjustFilePathForSvn(object):
     """
     SVN specific adjustments of node history in RepoFilesView.
     """
 
     def test_returns_path_relative_to_matched_reference(self):
         repo = self._repo(branches=['trunk'])
         self.assert_file_adjustment('trunk/file', 'file', repo)
 
     def test_does_not_modify_file_if_no_reference_matches(self):
         repo = self._repo(branches=['trunk'])
         self.assert_file_adjustment('notes/file', 'notes/file', repo)
 
     def test_does_not_adjust_partial_directory_names(self):
         repo = self._repo(branches=['trun'])
         self.assert_file_adjustment('trunk/file', 'trunk/file', repo)
 
     def test_is_robust_to_patterns_which_prefix_other_patterns(self):
         repo = self._repo(branches=['trunk', 'trunk/new', 'trunk/old'])
         self.assert_file_adjustment('trunk/new/file', 'file', repo)
 
     def assert_file_adjustment(self, f_path, expected, repo):
         result = RepoFilesView.adjust_file_path_for_svn(f_path, repo)
         assert result == expected
 
     def _repo(self, branches=None):
         repo = mock.Mock()
         repo.branches = OrderedDict((name, '0') for name in branches or [])
         repo.tags = {}
         return repo

rhodecode/apps/repository/views/repo_files.py

@@ -1,1386 +1,1392 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2011-2018 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import itertools
 import logging
 import os
 import shutil
 import tempfile
 import collections
+import urllib
 
 from pyramid.httpexceptions import HTTPNotFound, HTTPBadRequest, HTTPFound
 from pyramid.view import view_config
 from pyramid.renderers import render
 from pyramid.response import Response
 
 import rhodecode
 from rhodecode.apps._base import RepoAppView
 
 
 from rhodecode.lib import diffs, helpers as h, rc_cache
 from rhodecode.lib import audit_logger
 from rhodecode.lib.view_utils import parse_path_ref
 from rhodecode.lib.exceptions import NonRelativePathError
 from rhodecode.lib.codeblocks import (
     filenode_as_lines_tokens, filenode_as_annotated_lines_tokens)
 from rhodecode.lib.utils2 import (
     convert_line_endings, detect_mode, safe_str, str2bool, safe_int)
 from rhodecode.lib.auth import (
     LoginRequired, HasRepoPermissionAnyDecorator, CSRFRequired)
 from rhodecode.lib.vcs import path as vcspath
 from rhodecode.lib.vcs.backends.base import EmptyCommit
 from rhodecode.lib.vcs.conf import settings
 from rhodecode.lib.vcs.nodes import FileNode
 from rhodecode.lib.vcs.exceptions import (
     RepositoryError, CommitDoesNotExistError, EmptyRepositoryError,
     ImproperArchiveTypeError, VCSError, NodeAlreadyExistsError,
     NodeDoesNotExistError, CommitError, NodeError)
 
 from rhodecode.model.scm import ScmModel
 from rhodecode.model.db import Repository
 
 log = logging.getLogger(__name__)
 
 
 class RepoFilesView(RepoAppView):
 
     @staticmethod
     def adjust_file_path_for_svn(f_path, repo):
         """
         Computes the relative path of `f_path`.
 
         This is mainly based on prefix matching of the recognized tags and
         branches in the underlying repository.
         """
         tags_and_branches = itertools.chain(
             repo.branches.iterkeys(),
             repo.tags.iterkeys())
         tags_and_branches = sorted(tags_and_branches, key=len, reverse=True)
 
         for name in tags_and_branches:
             if f_path.startswith('{}/'.format(name)):
                 f_path = vcspath.relpath(f_path, name)
                 break
         return f_path
 
     def load_default_context(self):
         c = self._get_local_tmpl_context(include_app_defaults=True)
         c.rhodecode_repo = self.rhodecode_vcs_repo
         return c
 
     def _ensure_not_locked(self):
         _ = self.request.translate
 
         repo = self.db_repo
         if repo.enable_locking and repo.locked[0]:
             h.flash(_('This repository has been locked by %s on %s')
                     % (h.person_by_id(repo.locked[0]),
                     h.format_date(h.time_to_datetime(repo.locked[1]))),
                     'warning')
             files_url = h.route_path(
                 'repo_files:default_path',
                 repo_name=self.db_repo_name, commit_id='tip')
             raise HTTPFound(files_url)
 
     def check_branch_permission(self, branch_name):
         _ = self.request.translate
 
         rule, branch_perm = self._rhodecode_user.get_rule_and_branch_permission(
             self.db_repo_name, branch_name)
         if branch_perm and branch_perm not in ['branch.push', 'branch.push_force']:
             h.flash(
                 _('Branch `{}` changes forbidden by rule {}.').format(branch_name, rule),
                 'warning')
             files_url = h.route_path(
                 'repo_files:default_path',
                 repo_name=self.db_repo_name, commit_id='tip')
             raise HTTPFound(files_url)
 
     def _get_commit_and_path(self):
         default_commit_id = self.db_repo.landing_rev[1]
         default_f_path = '/'
 
         commit_id = self.request.matchdict.get(
             'commit_id', default_commit_id)
         f_path = self._get_f_path(self.request.matchdict, default_f_path)
         return commit_id, f_path
 
     def _get_default_encoding(self, c):
         enc_list = getattr(c, 'default_encodings', [])
         return enc_list[0] if enc_list else 'UTF-8'
 
     def _get_commit_or_redirect(self, commit_id, redirect_after=True):
         """
         This is a safe way to get commit. If an error occurs it redirects to
         tip with proper message
 
         :param commit_id: id of commit to fetch
         :param redirect_after: toggle redirection
         """
         _ = self.request.translate
 
         try:
             return self.rhodecode_vcs_repo.get_commit(commit_id)
         except EmptyRepositoryError:
             if not redirect_after:
                 return None
 
             _url = h.route_path(
                 'repo_files_add_file',
                 repo_name=self.db_repo_name, commit_id=0, f_path='',
                 _anchor='edit')
 
             if h.HasRepoPermissionAny(
                     'repository.write', 'repository.admin')(self.db_repo_name):
                 add_new = h.link_to(
                     _('Click here to add a new file.'), _url, class_="alert-link")
             else:
                 add_new = ""
 
             h.flash(h.literal(
                 _('There are no files yet. %s') % add_new), category='warning')
             raise HTTPFound(
                 h.route_path('repo_summary', repo_name=self.db_repo_name))
 
         except (CommitDoesNotExistError, LookupError):
             msg = _('No such commit exists for this repository')
             h.flash(msg, category='error')
             raise HTTPNotFound()
         except RepositoryError as e:
             h.flash(safe_str(h.escape(e)), category='error')
             raise HTTPNotFound()
 
     def _get_filenode_or_redirect(self, commit_obj, path):
         """
         Returns file_node, if error occurs or given path is directory,
         it'll redirect to top level path
         """
         _ = self.request.translate
 
         try:
             file_node = commit_obj.get_node(path)
             if file_node.is_dir():
                 raise RepositoryError('The given path is a directory')
         except CommitDoesNotExistError:
             log.exception('No such commit exists for this repository')
             h.flash(_('No such commit exists for this repository'), category='error')
             raise HTTPNotFound()
         except RepositoryError as e:
             log.warning('Repository error while fetching '
                         'filenode `%s`. Err:%s', path, e)
             h.flash(safe_str(h.escape(e)), category='error')
             raise HTTPNotFound()
 
         return file_node
 
     def _is_valid_head(self, commit_id, repo):
         branch_name = sha_commit_id = ''
         is_head = False
 
         if h.is_svn(repo) and not repo.is_empty():
             # Note: Subversion only has one head.
             if commit_id == repo.get_commit(commit_idx=-1).raw_id:
                 is_head = True
                 return branch_name, sha_commit_id, is_head
 
         for _branch_name, branch_commit_id in repo.branches.items():
             # simple case we pass in branch name, it's a HEAD
             if commit_id == _branch_name:
                 is_head = True
                 branch_name = _branch_name
                 sha_commit_id = branch_commit_id
                 break
             # case when we pass in full sha commit_id, which is a head
             elif commit_id == branch_commit_id:
                 is_head = True
                 branch_name = _branch_name
                 sha_commit_id = branch_commit_id
                 break
 
         # checked branches, means we only need to try to get the branch/commit_sha
         if not repo.is_empty:
             commit = repo.get_commit(commit_id=commit_id)
             if commit:
                 branch_name = commit.branch
                 sha_commit_id = commit.raw_id
 
         return branch_name, sha_commit_id, is_head
 
     def _get_tree_at_commit(
             self, c, commit_id, f_path, full_load=False):
 
         repo_id = self.db_repo.repo_id
 
         cache_seconds = safe_int(
             rhodecode.CONFIG.get('rc_cache.cache_repo.expiration_time'))
         cache_on = cache_seconds > 0
         log.debug(
             'Computing FILE TREE for repo_id %s commit_id `%s` and path `%s`'
             'with caching: %s[TTL: %ss]' % (
                 repo_id, commit_id, f_path, cache_on, cache_seconds or 0))
 
         cache_namespace_uid = 'cache_repo.{}'.format(repo_id)
         region = rc_cache.get_or_create_region('cache_repo', cache_namespace_uid)
 
         @region.conditional_cache_on_arguments(namespace=cache_namespace_uid,
                                                condition=cache_on)
         def compute_file_tree(repo_id, commit_id, f_path, full_load):
             log.debug('Generating cached file tree for repo_id: %s, %s, %s',
                       repo_id, commit_id, f_path)
 
             c.full_load = full_load
             return render(
                 'rhodecode:templates/files/files_browser_tree.mako',
                 self._get_template_context(c), self.request)
 
         return compute_file_tree(self.db_repo.repo_id, commit_id, f_path, full_load)
 
     def _get_archive_spec(self, fname):
         log.debug('Detecting archive spec for: `%s`', fname)
 
         fileformat = None
         ext = None
         content_type = None
         for a_type, ext_data in settings.ARCHIVE_SPECS.items():
             content_type, extension = ext_data
 
             if fname.endswith(extension):
                 fileformat = a_type
                 log.debug('archive is of type: %s', fileformat)
                 ext = extension
                 break
 
         if not fileformat:
             raise ValueError()
 
         # left over part of whole fname is the commit
         commit_id = fname[:-len(ext)]
 
         return commit_id, ext, fileformat, content_type
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator(
         'repository.read', 'repository.write', 'repository.admin')
     @view_config(
         route_name='repo_archivefile', request_method='GET',
         renderer=None)
     def repo_archivefile(self):
         # archive cache config
         from rhodecode import CONFIG
         _ = self.request.translate
         self.load_default_context()
 
         fname = self.request.matchdict['fname']
         subrepos = self.request.GET.get('subrepos') == 'true'
 
         if not self.db_repo.enable_downloads:
             return Response(_('Downloads disabled'))
 
         try:
             commit_id, ext, fileformat, content_type = \
                 self._get_archive_spec(fname)
         except ValueError:
             return Response(_('Unknown archive type for: `{}`').format(
                 h.escape(fname)))
 
         try:
             commit = self.rhodecode_vcs_repo.get_commit(commit_id)
         except CommitDoesNotExistError:
             return Response(_('Unknown commit_id {}').format(
                 h.escape(commit_id)))
         except EmptyRepositoryError:
             return Response(_('Empty repository'))
 
         archive_name = '%s-%s%s%s' % (
             safe_str(self.db_repo_name.replace('/', '_')),
             '-sub' if subrepos else '',
             safe_str(commit.short_id), ext)
 
         use_cached_archive = False
         archive_cache_enabled = CONFIG.get(
             'archive_cache_dir') and not self.request.GET.get('no_cache')
         cached_archive_path = None
 
         if archive_cache_enabled:
             # check if we it's ok to write
             if not os.path.isdir(CONFIG['archive_cache_dir']):
                 os.makedirs(CONFIG['archive_cache_dir'])
             cached_archive_path = os.path.join(
                 CONFIG['archive_cache_dir'], archive_name)
             if os.path.isfile(cached_archive_path):
                 log.debug('Found cached archive in %s', cached_archive_path)
                 fd, archive = None, cached_archive_path
                 use_cached_archive = True
             else:
                 log.debug('Archive %s is not yet cached', archive_name)
 
         if not use_cached_archive:
             # generate new archive
             fd, archive = tempfile.mkstemp()
             log.debug('Creating new temp archive in %s', archive)
             try:
                 commit.archive_repo(archive, kind=fileformat, subrepos=subrepos)
             except ImproperArchiveTypeError:
                 return _('Unknown archive type')
             if archive_cache_enabled:
                 # if we generated the archive and we have cache enabled
                 # let's use this for future
                 log.debug('Storing new archive in %s', cached_archive_path)
                 shutil.move(archive, cached_archive_path)
                 archive = cached_archive_path
 
         # store download action
         audit_logger.store_web(
             'repo.archive.download', action_data={
                 'user_agent': self.request.user_agent,
                 'archive_name': archive_name,
                 'archive_spec': fname,
                 'archive_cached': use_cached_archive},
             user=self._rhodecode_user,
             repo=self.db_repo,
             commit=True
         )
 
         def get_chunked_archive(archive_path):
             with open(archive_path, 'rb') as stream:
                 while True:
                     data = stream.read(16 * 1024)
                     if not data:
                         if fd:  # fd means we used temporary file
                             os.close(fd)
                         if not archive_cache_enabled:
                             log.debug('Destroying temp archive %s', archive_path)
                             os.remove(archive_path)
                         break
                     yield data
 
         response = Response(app_iter=get_chunked_archive(archive))
         response.content_disposition = str(
             'attachment; filename=%s' % archive_name)
         response.content_type = str(content_type)
 
         return response
 
     def _get_file_node(self, commit_id, f_path):
         if commit_id not in ['', None, 'None', '0' * 12, '0' * 40]:
             commit = self.rhodecode_vcs_repo.get_commit(commit_id=commit_id)
             try:
                 node = commit.get_node(f_path)
                 if node.is_dir():
                     raise NodeError('%s path is a %s not a file'
                                     % (node, type(node)))
             except NodeDoesNotExistError:
                 commit = EmptyCommit(
                     commit_id=commit_id,
                     idx=commit.idx,
                     repo=commit.repository,
                     alias=commit.repository.alias,
                     message=commit.message,
                     author=commit.author,
                     date=commit.date)
                 node = FileNode(f_path, '', commit=commit)
         else:
             commit = EmptyCommit(
                 repo=self.rhodecode_vcs_repo,
                 alias=self.rhodecode_vcs_repo.alias)
             node = FileNode(f_path, '', commit=commit)
         return node
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator(
         'repository.read', 'repository.write', 'repository.admin')
     @view_config(
         route_name='repo_files_diff', request_method='GET',
         renderer=None)
     def repo_files_diff(self):
         c = self.load_default_context()
         f_path = self._get_f_path(self.request.matchdict)
         diff1 = self.request.GET.get('diff1', '')
         diff2 = self.request.GET.get('diff2', '')
 
         path1, diff1 = parse_path_ref(diff1, default_path=f_path)
 
         ignore_whitespace = str2bool(self.request.GET.get('ignorews'))
         line_context = self.request.GET.get('context', 3)
 
         if not any((diff1, diff2)):
             h.flash(
                 'Need query parameter "diff1" or "diff2" to generate a diff.',
                 category='error')
             raise HTTPBadRequest()
 
         c.action = self.request.GET.get('diff')
         if c.action not in ['download', 'raw']:
             compare_url = h.route_path(
                 'repo_compare',
                 repo_name=self.db_repo_name,
                 source_ref_type='rev',
                 source_ref=diff1,
                 target_repo=self.db_repo_name,
                 target_ref_type='rev',
                 target_ref=diff2,
                 _query=dict(f_path=f_path))
             # redirect to new view if we render diff
             raise HTTPFound(compare_url)
 
         try:
             node1 = self._get_file_node(diff1, path1)
             node2 = self._get_file_node(diff2, f_path)
         except (RepositoryError, NodeError):
             log.exception("Exception while trying to get node from repository")
             raise HTTPFound(
                 h.route_path('repo_files', repo_name=self.db_repo_name,
                              commit_id='tip', f_path=f_path))
 
         if all(isinstance(node.commit, EmptyCommit)
                for node in (node1, node2)):
             raise HTTPNotFound()
 
         c.commit_1 = node1.commit
         c.commit_2 = node2.commit
 
         if c.action == 'download':
             _diff = diffs.get_gitdiff(node1, node2,
                                       ignore_whitespace=ignore_whitespace,
                                       context=line_context)
             diff = diffs.DiffProcessor(_diff, format='gitdiff')
 
             response = Response(self.path_filter.get_raw_patch(diff))
             response.content_type = 'text/plain'
             response.content_disposition = (
                 'attachment; filename=%s_%s_vs_%s.diff' % (f_path, diff1, diff2)
             )
             charset = self._get_default_encoding(c)
             if charset:
                 response.charset = charset
             return response
 
         elif c.action == 'raw':
             _diff = diffs.get_gitdiff(node1, node2,
                                       ignore_whitespace=ignore_whitespace,
                                       context=line_context)
             diff = diffs.DiffProcessor(_diff, format='gitdiff')
 
             response = Response(self.path_filter.get_raw_patch(diff))
             response.content_type = 'text/plain'
             charset = self._get_default_encoding(c)
             if charset:
                 response.charset = charset
             return response
 
         # in case we ever end up here
         raise HTTPNotFound()
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator(
         'repository.read', 'repository.write', 'repository.admin')
     @view_config(
         route_name='repo_files_diff_2way_redirect', request_method='GET',
         renderer=None)
     def repo_files_diff_2way_redirect(self):
         """
         Kept only to make OLD links work
         """
         f_path = self._get_f_path_unchecked(self.request.matchdict)
         diff1 = self.request.GET.get('diff1', '')
         diff2 = self.request.GET.get('diff2', '')
 
         if not any((diff1, diff2)):
             h.flash(
                 'Need query parameter "diff1" or "diff2" to generate a diff.',
                 category='error')
             raise HTTPBadRequest()
 
         compare_url = h.route_path(
             'repo_compare',
             repo_name=self.db_repo_name,
             source_ref_type='rev',
             source_ref=diff1,
             target_ref_type='rev',
             target_ref=diff2,
             _query=dict(f_path=f_path, diffmode='sideside',
                         target_repo=self.db_repo_name,))
         raise HTTPFound(compare_url)
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator(
         'repository.read', 'repository.write', 'repository.admin')
     @view_config(
         route_name='repo_files', request_method='GET',
         renderer=None)
     @view_config(
         route_name='repo_files:default_path', request_method='GET',
         renderer=None)
     @view_config(
         route_name='repo_files:default_commit', request_method='GET',
         renderer=None)
     @view_config(
         route_name='repo_files:rendered', request_method='GET',
         renderer=None)
     @view_config(
         route_name='repo_files:annotated', request_method='GET',
         renderer=None)
     def repo_files(self):
         c = self.load_default_context()
 
         view_name = getattr(self.request.matched_route, 'name', None)
 
         c.annotate = view_name == 'repo_files:annotated'
         # default is false, but .rst/.md files later are auto rendered, we can
         # overwrite auto rendering by setting this GET flag
         c.renderer = view_name == 'repo_files:rendered' or \
                         not self.request.GET.get('no-render', False)
 
         # redirect to given commit_id from form if given
         get_commit_id = self.request.GET.get('at_rev', None)
         if get_commit_id:
             self._get_commit_or_redirect(get_commit_id)
 
         commit_id, f_path = self._get_commit_and_path()
         c.commit = self._get_commit_or_redirect(commit_id)
         c.branch = self.request.GET.get('branch', None)
         c.f_path = f_path
 
         # prev link
         try:
             prev_commit = c.commit.prev(c.branch)
             c.prev_commit = prev_commit
             c.url_prev = h.route_path(
                 'repo_files', repo_name=self.db_repo_name,
                 commit_id=prev_commit.raw_id, f_path=f_path)
             if c.branch:
                 c.url_prev += '?branch=%s' % c.branch
         except (CommitDoesNotExistError, VCSError):
             c.url_prev = '#'
             c.prev_commit = EmptyCommit()
 
         # next link
         try:
             next_commit = c.commit.next(c.branch)
             c.next_commit = next_commit
             c.url_next = h.route_path(
                 'repo_files', repo_name=self.db_repo_name,
                 commit_id=next_commit.raw_id, f_path=f_path)
             if c.branch:
                 c.url_next += '?branch=%s' % c.branch
         except (CommitDoesNotExistError, VCSError):
             c.url_next = '#'
             c.next_commit = EmptyCommit()
 
         # files or dirs
         try:
             c.file = c.commit.get_node(f_path)
             c.file_author = True
             c.file_tree = ''
 
             # load file content
             if c.file.is_file():
                 c.lf_node = c.file.get_largefile_node()
 
                 c.file_source_page = 'true'
                 c.file_last_commit = c.file.last_commit
                 if c.file.size < c.visual.cut_off_limit_diff:
                     if c.annotate:  # annotation has precedence over renderer
                         c.annotated_lines = filenode_as_annotated_lines_tokens(
                             c.file
                         )
                     else:
                         c.renderer = (
                             c.renderer and h.renderer_from_filename(c.file.path)
                         )
                         if not c.renderer:
                             c.lines = filenode_as_lines_tokens(c.file)
 
                 _branch_name, _sha_commit_id, is_head = self._is_valid_head(
                     commit_id, self.rhodecode_vcs_repo)
                 c.on_branch_head = is_head
 
                 branch = c.commit.branch if (
                     c.commit.branch and '/' not in c.commit.branch) else None
                 c.branch_or_raw_id = branch or c.commit.raw_id
                 c.branch_name = c.commit.branch or h.short_id(c.commit.raw_id)
 
                 author = c.file_last_commit.author
                 c.authors = [[
                     h.email(author),
                     h.person(author, 'username_or_name_or_email'),
                     1
                 ]]
 
             else:  # load tree content at path
                 c.file_source_page = 'false'
                 c.authors = []
                 # this loads a simple tree without metadata to speed things up
                 # later via ajax we call repo_nodetree_full and fetch whole
                 c.file_tree = self._get_tree_at_commit(
                     c, c.commit.raw_id, f_path)
 
         except RepositoryError as e:
             h.flash(safe_str(h.escape(e)), category='error')
             raise HTTPNotFound()
 
         if self.request.environ.get('HTTP_X_PJAX'):
             html = render('rhodecode:templates/files/files_pjax.mako',
                           self._get_template_context(c), self.request)
         else:
             html = render('rhodecode:templates/files/files.mako',
                           self._get_template_context(c), self.request)
         return Response(html)
 
     @HasRepoPermissionAnyDecorator(
         'repository.read', 'repository.write', 'repository.admin')
     @view_config(
         route_name='repo_files:annotated_previous', request_method='GET',
         renderer=None)
     def repo_files_annotated_previous(self):
         self.load_default_context()
 
         commit_id, f_path = self._get_commit_and_path()
         commit = self._get_commit_or_redirect(commit_id)
         prev_commit_id = commit.raw_id
         line_anchor = self.request.GET.get('line_anchor')
         is_file = False
         try:
             _file = commit.get_node(f_path)
             is_file = _file.is_file()
         except (NodeDoesNotExistError, CommitDoesNotExistError, VCSError):
             pass
 
         if is_file:
             history = commit.get_path_history(f_path)
             prev_commit_id = history[1].raw_id \
                 if len(history) > 1 else prev_commit_id
         prev_url = h.route_path(
             'repo_files:annotated', repo_name=self.db_repo_name,
             commit_id=prev_commit_id, f_path=f_path,
             _anchor='L{}'.format(line_anchor))
 
         raise HTTPFound(prev_url)
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator(
         'repository.read', 'repository.write', 'repository.admin')
     @view_config(
         route_name='repo_nodetree_full', request_method='GET',
         renderer=None, xhr=True)
     @view_config(
         route_name='repo_nodetree_full:default_path', request_method='GET',
         renderer=None, xhr=True)
     def repo_nodetree_full(self):
         """
         Returns rendered html of file tree that contains commit date,
         author, commit_id for the specified combination of
         repo, commit_id and file path
         """
         c = self.load_default_context()
 
         commit_id, f_path = self._get_commit_and_path()
         commit = self._get_commit_or_redirect(commit_id)
         try:
             dir_node = commit.get_node(f_path)
         except RepositoryError as e:
             return Response('error: {}'.format(h.escape(safe_str(e))))
 
         if dir_node.is_file():
             return Response('')
 
         c.file = dir_node
         c.commit = commit
 
         html = self._get_tree_at_commit(
             c, commit.raw_id, dir_node.path, full_load=True)
 
         return Response(html)
 
-    def _get_attachement_disposition(self, f_path):
-        return 'attachment; filename=%s' % \
-            safe_str(f_path.split(Repository.NAME_SEP)[-1])
+    def _get_attachement_headers(self, f_path):
+        f_name = safe_str(f_path.split(Repository.NAME_SEP)[-1])
+        safe_path = f_name.replace('"', '\\"')
+        encoded_path = urllib.quote(f_name)
+
+        return "attachment; " \
+               "filename=\"{}\"; " \
+               "filename*=UTF-8\'\'{}".format(safe_path, encoded_path)
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator(
         'repository.read', 'repository.write', 'repository.admin')
     @view_config(
         route_name='repo_file_raw', request_method='GET',
         renderer=None)
     def repo_file_raw(self):
         """
         Action for show as raw, some mimetypes are "rendered",
         those include images, icons.
         """
         c = self.load_default_context()
 
         commit_id, f_path = self._get_commit_and_path()
         commit = self._get_commit_or_redirect(commit_id)
         file_node = self._get_filenode_or_redirect(commit, f_path)
 
         raw_mimetype_mapping = {
             # map original mimetype to a mimetype used for "show as raw"
             # you can also provide a content-disposition to override the
             # default "attachment" disposition.
             # orig_type: (new_type, new_dispo)
 
             # show images inline:
             # Do not re-add SVG: it is unsafe and permits XSS attacks. One can
             # for example render an SVG with javascript inside or even render
             # HTML.
             'image/x-icon': ('image/x-icon', 'inline'),
             'image/png': ('image/png', 'inline'),
             'image/gif': ('image/gif', 'inline'),
             'image/jpeg': ('image/jpeg', 'inline'),
             'application/pdf': ('application/pdf', 'inline'),
         }
 
         mimetype = file_node.mimetype
         try:
             mimetype, disposition = raw_mimetype_mapping[mimetype]
         except KeyError:
             # we don't know anything special about this, handle it safely
             if file_node.is_binary:
                 # do same as download raw for binary files
                 mimetype, disposition = 'application/octet-stream', 'attachment'
             else:
                 # do not just use the original mimetype, but force text/plain,
                 # otherwise it would serve text/html and that might be unsafe.
                 # Note: underlying vcs library fakes text/plain mimetype if the
                 # mimetype can not be determined and it thinks it is not
                 # binary.This might lead to erroneous text display in some
                 # cases, but helps in other cases, like with text files
                 # without extension.
                 mimetype, disposition = 'text/plain', 'inline'
 
         if disposition == 'attachment':
-            disposition = self._get_attachement_disposition(f_path)
+            disposition = self._get_attachement_headers(f_path)
 
         def stream_node():
             yield file_node.raw_bytes
 
         response = Response(app_iter=stream_node())
         response.content_disposition = disposition
         response.content_type = mimetype
 
         charset = self._get_default_encoding(c)
         if charset:
             response.charset = charset
 
         return response
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator(
         'repository.read', 'repository.write', 'repository.admin')
     @view_config(
         route_name='repo_file_download', request_method='GET',
         renderer=None)
     @view_config(
         route_name='repo_file_download:legacy', request_method='GET',
         renderer=None)
     def repo_file_download(self):
         c = self.load_default_context()
 
         commit_id, f_path = self._get_commit_and_path()
         commit = self._get_commit_or_redirect(commit_id)
         file_node = self._get_filenode_or_redirect(commit, f_path)
 
         if self.request.GET.get('lf'):
             # only if lf get flag is passed, we download this file
             # as LFS/Largefile
             lf_node = file_node.get_largefile_node()
             if lf_node:
                 # overwrite our pointer with the REAL large-file
                 file_node = lf_node
 
-        disposition = self._get_attachement_disposition(f_path)
+        disposition = self._get_attachement_headers(f_path)
 
         def stream_node():
             yield file_node.raw_bytes
 
         response = Response(app_iter=stream_node())
         response.content_disposition = disposition
         response.content_type = file_node.mimetype
 
         charset = self._get_default_encoding(c)
         if charset:
             response.charset = charset
 
         return response
 
     def _get_nodelist_at_commit(self, repo_name, repo_id, commit_id, f_path):
 
         cache_seconds = safe_int(
             rhodecode.CONFIG.get('rc_cache.cache_repo.expiration_time'))
         cache_on = cache_seconds > 0
         log.debug(
             'Computing FILE SEARCH for repo_id %s commit_id `%s` and path `%s`'
             'with caching: %s[TTL: %ss]' % (
                 repo_id, commit_id, f_path, cache_on, cache_seconds or 0))
 
         cache_namespace_uid = 'cache_repo.{}'.format(repo_id)
         region = rc_cache.get_or_create_region('cache_repo', cache_namespace_uid)
 
         @region.conditional_cache_on_arguments(namespace=cache_namespace_uid,
                                                condition=cache_on)
         def compute_file_search(repo_id, commit_id, f_path):
             log.debug('Generating cached nodelist for repo_id:%s, %s, %s',
                       repo_id, commit_id, f_path)
             try:
                 _d, _f = ScmModel().get_nodes(
                     repo_name, commit_id, f_path, flat=False)
             except (RepositoryError, CommitDoesNotExistError, Exception) as e:
                 log.exception(safe_str(e))
                 h.flash(safe_str(h.escape(e)), category='error')
                 raise HTTPFound(h.route_path(
                     'repo_files', repo_name=self.db_repo_name,
                     commit_id='tip', f_path='/'))
             return _d + _f
 
         return compute_file_search(self.db_repo.repo_id, commit_id, f_path)
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator(
         'repository.read', 'repository.write', 'repository.admin')
     @view_config(
         route_name='repo_files_nodelist', request_method='GET',
         renderer='json_ext', xhr=True)
     def repo_nodelist(self):
         self.load_default_context()
 
         commit_id, f_path = self._get_commit_and_path()
         commit = self._get_commit_or_redirect(commit_id)
 
         metadata = self._get_nodelist_at_commit(
             self.db_repo_name, self.db_repo.repo_id, commit.raw_id, f_path)
         return {'nodes': metadata}
 
     def _create_references(
             self, branches_or_tags, symbolic_reference, f_path):
         items = []
         for name, commit_id in branches_or_tags.items():
             sym_ref = symbolic_reference(commit_id, name, f_path)
             items.append((sym_ref, name))
         return items
 
     def _symbolic_reference(self, commit_id, name, f_path):
         return commit_id
 
     def _symbolic_reference_svn(self, commit_id, name, f_path):
         new_f_path = vcspath.join(name, f_path)
         return u'%s@%s' % (new_f_path, commit_id)
 
     def _get_node_history(self, commit_obj, f_path, commits=None):
         """
         get commit history for given node
 
         :param commit_obj: commit to calculate history
         :param f_path: path for node to calculate history for
         :param commits: if passed don't calculate history and take
             commits defined in this list
         """
         _ = self.request.translate
 
         # calculate history based on tip
         tip = self.rhodecode_vcs_repo.get_commit()
         if commits is None:
             pre_load = ["author", "branch"]
             try:
                 commits = tip.get_path_history(f_path, pre_load=pre_load)
             except (NodeDoesNotExistError, CommitError):
                 # this node is not present at tip!
                 commits = commit_obj.get_path_history(f_path, pre_load=pre_load)
 
         history = []
         commits_group = ([], _("Changesets"))
         for commit in commits:
             branch = ' (%s)' % commit.branch if commit.branch else ''
             n_desc = 'r%s:%s%s' % (commit.idx, commit.short_id, branch)
             commits_group[0].append((commit.raw_id, n_desc,))
         history.append(commits_group)
 
         symbolic_reference = self._symbolic_reference
 
         if self.rhodecode_vcs_repo.alias == 'svn':
             adjusted_f_path = RepoFilesView.adjust_file_path_for_svn(
                 f_path, self.rhodecode_vcs_repo)
             if adjusted_f_path != f_path:
                 log.debug(
                     'Recognized svn tag or branch in file "%s", using svn '
                     'specific symbolic references', f_path)
                 f_path = adjusted_f_path
                 symbolic_reference = self._symbolic_reference_svn
 
         branches = self._create_references(
             self.rhodecode_vcs_repo.branches, symbolic_reference, f_path)
         branches_group = (branches, _("Branches"))
 
         tags = self._create_references(
             self.rhodecode_vcs_repo.tags, symbolic_reference, f_path)
         tags_group = (tags, _("Tags"))
 
         history.append(branches_group)
         history.append(tags_group)
 
         return history, commits
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator(
         'repository.read', 'repository.write', 'repository.admin')
     @view_config(
         route_name='repo_file_history', request_method='GET',
         renderer='json_ext')
     def repo_file_history(self):
         self.load_default_context()
 
         commit_id, f_path = self._get_commit_and_path()
         commit = self._get_commit_or_redirect(commit_id)
         file_node = self._get_filenode_or_redirect(commit, f_path)
 
         if file_node.is_file():
             file_history, _hist = self._get_node_history(commit, f_path)
 
             res = []
             for obj in file_history:
                 res.append({
                     'text': obj[1],
                     'children': [{'id': o[0], 'text': o[1]} for o in obj[0]]
                 })
 
             data = {
                 'more': False,
                 'results': res
             }
             return data
 
         log.warning('Cannot fetch history for directory')
         raise HTTPBadRequest()
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator(
         'repository.read', 'repository.write', 'repository.admin')
     @view_config(
         route_name='repo_file_authors', request_method='GET',
         renderer='rhodecode:templates/files/file_authors_box.mako')
     def repo_file_authors(self):
         c = self.load_default_context()
 
         commit_id, f_path = self._get_commit_and_path()
         commit = self._get_commit_or_redirect(commit_id)
         file_node = self._get_filenode_or_redirect(commit, f_path)
 
         if not file_node.is_file():
             raise HTTPBadRequest()
 
         c.file_last_commit = file_node.last_commit
         if self.request.GET.get('annotate') == '1':
             # use _hist from annotation if annotation mode is on
             commit_ids = set(x[1] for x in file_node.annotate)
             _hist = (
                 self.rhodecode_vcs_repo.get_commit(commit_id)
                 for commit_id in commit_ids)
         else:
             _f_history, _hist = self._get_node_history(commit, f_path)
         c.file_author = False
 
         unique = collections.OrderedDict()
         for commit in _hist:
             author = commit.author
             if author not in unique:
                 unique[commit.author] = [
                     h.email(author),
                     h.person(author, 'username_or_name_or_email'),
                     1  # counter
                 ]
 
             else:
                 # increase counter
                 unique[commit.author][2] += 1
 
         c.authors = [val for val in unique.values()]
 
         return self._get_template_context(c)
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.write', 'repository.admin')
     @view_config(
         route_name='repo_files_remove_file', request_method='GET',
         renderer='rhodecode:templates/files/files_delete.mako')
     def repo_files_remove_file(self):
         _ = self.request.translate
         c = self.load_default_context()
         commit_id, f_path = self._get_commit_and_path()
 
         self._ensure_not_locked()
         _branch_name, _sha_commit_id, is_head = \
             self._is_valid_head(commit_id, self.rhodecode_vcs_repo)
 
         if not is_head:
             h.flash(_('You can only delete files with commit '
                       'being a valid branch head.'), category='warning')
             raise HTTPFound(
                 h.route_path('repo_files',
                              repo_name=self.db_repo_name, commit_id='tip',
                              f_path=f_path))
 
         self.check_branch_permission(_branch_name)
         c.commit = self._get_commit_or_redirect(commit_id)
         c.file = self._get_filenode_or_redirect(c.commit, f_path)
 
         c.default_message = _(
             'Deleted file {} via RhodeCode Enterprise').format(f_path)
         c.f_path = f_path
 
         return self._get_template_context(c)
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.write', 'repository.admin')
     @CSRFRequired()
     @view_config(
         route_name='repo_files_delete_file', request_method='POST',
         renderer=None)
     def repo_files_delete_file(self):
         _ = self.request.translate
 
         c = self.load_default_context()
         commit_id, f_path = self._get_commit_and_path()
 
         self._ensure_not_locked()
         _branch_name, _sha_commit_id, is_head = \
             self._is_valid_head(commit_id, self.rhodecode_vcs_repo)
 
         if not is_head:
             h.flash(_('You can only delete files with commit '
                       'being a valid branch head.'), category='warning')
             raise HTTPFound(
                 h.route_path('repo_files',
                              repo_name=self.db_repo_name, commit_id='tip',
                              f_path=f_path))
         self.check_branch_permission(_branch_name)
 
         c.commit = self._get_commit_or_redirect(commit_id)
         c.file = self._get_filenode_or_redirect(c.commit, f_path)
 
         c.default_message = _(
             'Deleted file {} via RhodeCode Enterprise').format(f_path)
         c.f_path = f_path
         node_path = f_path
         author = self._rhodecode_db_user.full_contact
         message = self.request.POST.get('message') or c.default_message
         try:
             nodes = {
                 node_path: {
                     'content': ''
                 }
             }
             ScmModel().delete_nodes(
                 user=self._rhodecode_db_user.user_id, repo=self.db_repo,
                 message=message,
                 nodes=nodes,
                 parent_commit=c.commit,
                 author=author,
             )
 
             h.flash(
                 _('Successfully deleted file `{}`').format(
                     h.escape(f_path)), category='success')
         except Exception:
             log.exception('Error during commit operation')
             h.flash(_('Error occurred during commit'), category='error')
         raise HTTPFound(
             h.route_path('repo_commit', repo_name=self.db_repo_name,
                          commit_id='tip'))
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.write', 'repository.admin')
     @view_config(
         route_name='repo_files_edit_file', request_method='GET',
         renderer='rhodecode:templates/files/files_edit.mako')
     def repo_files_edit_file(self):
         _ = self.request.translate
         c = self.load_default_context()
         commit_id, f_path = self._get_commit_and_path()
 
         self._ensure_not_locked()
         _branch_name, _sha_commit_id, is_head = \
             self._is_valid_head(commit_id, self.rhodecode_vcs_repo)
 
         if not is_head:
             h.flash(_('You can only edit files with commit '
                       'being a valid branch head.'), category='warning')
             raise HTTPFound(
                 h.route_path('repo_files',
                              repo_name=self.db_repo_name, commit_id='tip',
                              f_path=f_path))
         self.check_branch_permission(_branch_name)
 
         c.commit = self._get_commit_or_redirect(commit_id)
         c.file = self._get_filenode_or_redirect(c.commit, f_path)
 
         if c.file.is_binary:
             files_url = h.route_path(
                 'repo_files',
                 repo_name=self.db_repo_name,
                 commit_id=c.commit.raw_id, f_path=f_path)
             raise HTTPFound(files_url)
 
         c.default_message = _(
             'Edited file {} via RhodeCode Enterprise').format(f_path)
         c.f_path = f_path
 
         return self._get_template_context(c)
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.write', 'repository.admin')
     @CSRFRequired()
     @view_config(
         route_name='repo_files_update_file', request_method='POST',
         renderer=None)
     def repo_files_update_file(self):
         _ = self.request.translate
         c = self.load_default_context()
         commit_id, f_path = self._get_commit_and_path()
 
         self._ensure_not_locked()
         _branch_name, _sha_commit_id, is_head = \
             self._is_valid_head(commit_id, self.rhodecode_vcs_repo)
 
         if not is_head:
             h.flash(_('You can only edit files with commit '
                       'being a valid branch head.'), category='warning')
             raise HTTPFound(
                 h.route_path('repo_files',
                              repo_name=self.db_repo_name, commit_id='tip',
                              f_path=f_path))
 
         self.check_branch_permission(_branch_name)
 
         c.commit = self._get_commit_or_redirect(commit_id)
         c.file = self._get_filenode_or_redirect(c.commit, f_path)
 
         if c.file.is_binary:
             raise HTTPFound(
                 h.route_path('repo_files',
                              repo_name=self.db_repo_name,
                              commit_id=c.commit.raw_id,
                              f_path=f_path))
 
         c.default_message = _(
             'Edited file {} via RhodeCode Enterprise').format(f_path)
         c.f_path = f_path
         old_content = c.file.content
         sl = old_content.splitlines(1)
         first_line = sl[0] if sl else ''
 
         r_post = self.request.POST
         # modes:  0 - Unix, 1 - Mac, 2 - DOS
         mode = detect_mode(first_line, 0)
         content = convert_line_endings(r_post.get('content', ''), mode)
 
         message = r_post.get('message') or c.default_message
         org_f_path = c.file.unicode_path
         filename = r_post['filename']
         org_filename = c.file.name
 
         if content == old_content and filename == org_filename:
             h.flash(_('No changes'), category='warning')
             raise HTTPFound(
                 h.route_path('repo_commit', repo_name=self.db_repo_name,
                              commit_id='tip'))
         try:
             mapping = {
                 org_f_path: {
                     'org_filename': org_f_path,
                     'filename': os.path.join(c.file.dir_path, filename),
                     'content': content,
                     'lexer': '',
                     'op': 'mod',
                 }
             }
 
             ScmModel().update_nodes(
                 user=self._rhodecode_db_user.user_id,
                 repo=self.db_repo,
                 message=message,
                 nodes=mapping,
                 parent_commit=c.commit,
             )
 
             h.flash(
                 _('Successfully committed changes to file `{}`').format(
                     h.escape(f_path)), category='success')
         except Exception:
             log.exception('Error occurred during commit')
             h.flash(_('Error occurred during commit'), category='error')
         raise HTTPFound(
             h.route_path('repo_commit', repo_name=self.db_repo_name,
                          commit_id='tip'))
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.write', 'repository.admin')
     @view_config(
         route_name='repo_files_add_file', request_method='GET',
         renderer='rhodecode:templates/files/files_add.mako')
     def repo_files_add_file(self):
         _ = self.request.translate
         c = self.load_default_context()
         commit_id, f_path = self._get_commit_and_path()
 
         self._ensure_not_locked()
 
         c.commit = self._get_commit_or_redirect(commit_id, redirect_after=False)
         if c.commit is None:
             c.commit = EmptyCommit(alias=self.rhodecode_vcs_repo.alias)
         c.default_message = (_('Added file via RhodeCode Enterprise'))
         c.f_path = f_path.lstrip('/')  # ensure not relative path
 
         if self.rhodecode_vcs_repo.is_empty:
             # for empty repository we cannot check for current branch, we rely on
             # c.commit.branch instead
             _branch_name = c.commit.branch
             is_head = True
         else:
             _branch_name, _sha_commit_id, is_head = \
                 self._is_valid_head(commit_id, self.rhodecode_vcs_repo)
 
         if not is_head:
             h.flash(_('You can only add files with commit '
                       'being a valid branch head.'), category='warning')
             raise HTTPFound(
                 h.route_path('repo_files',
                              repo_name=self.db_repo_name, commit_id='tip',
                              f_path=f_path))
 
         self.check_branch_permission(_branch_name)
 
         return self._get_template_context(c)
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.write', 'repository.admin')
     @CSRFRequired()
     @view_config(
         route_name='repo_files_create_file', request_method='POST',
         renderer=None)
     def repo_files_create_file(self):
         _ = self.request.translate
         c = self.load_default_context()
         commit_id, f_path = self._get_commit_and_path()
 
         self._ensure_not_locked()
 
         r_post = self.request.POST
 
         c.commit = self._get_commit_or_redirect(
             commit_id, redirect_after=False)
         if c.commit is None:
             c.commit = EmptyCommit(alias=self.rhodecode_vcs_repo.alias)
 
         if self.rhodecode_vcs_repo.is_empty:
             # for empty repository we cannot check for current branch, we rely on
             # c.commit.branch instead
             _branch_name = c.commit.branch
             is_head = True
         else:
             _branch_name, _sha_commit_id, is_head = \
                 self._is_valid_head(commit_id, self.rhodecode_vcs_repo)
 
         if not is_head:
             h.flash(_('You can only add files with commit '
                       'being a valid branch head.'), category='warning')
             raise HTTPFound(
                 h.route_path('repo_files',
                              repo_name=self.db_repo_name, commit_id='tip',
                              f_path=f_path))
 
         self.check_branch_permission(_branch_name)
 
         c.default_message = (_('Added file via RhodeCode Enterprise'))
         c.f_path = f_path
         unix_mode = 0
         content = convert_line_endings(r_post.get('content', ''), unix_mode)
 
         message = r_post.get('message') or c.default_message
         filename = r_post.get('filename')
         location = r_post.get('location', '')  # dir location
         file_obj = r_post.get('upload_file', None)
 
         if file_obj is not None and hasattr(file_obj, 'filename'):
             filename = r_post.get('filename_upload')
             content = file_obj.file
 
             if hasattr(content, 'file'):
                 # non posix systems store real file under file attr
                 content = content.file
 
         if self.rhodecode_vcs_repo.is_empty:
             default_redirect_url = h.route_path(
                 'repo_summary', repo_name=self.db_repo_name)
         else:
             default_redirect_url = h.route_path(
                 'repo_commit', repo_name=self.db_repo_name, commit_id='tip')
 
         # If there's no commit, redirect to repo summary
         if type(c.commit) is EmptyCommit:
             redirect_url = h.route_path(
                 'repo_summary', repo_name=self.db_repo_name)
         else:
             redirect_url = default_redirect_url
 
         if not filename:
             h.flash(_('No filename'), category='warning')
             raise HTTPFound(redirect_url)
 
         # extract the location from filename,
         # allows using foo/bar.txt syntax to create subdirectories
         subdir_loc = filename.rsplit('/', 1)
         if len(subdir_loc) == 2:
             location = os.path.join(location, subdir_loc[0])
 
         # strip all crap out of file, just leave the basename
         filename = os.path.basename(filename)
         node_path = os.path.join(location, filename)
         author = self._rhodecode_db_user.full_contact
 
         try:
             nodes = {
                 node_path: {
                     'content': content
                 }
             }
             ScmModel().create_nodes(
                 user=self._rhodecode_db_user.user_id,
                 repo=self.db_repo,
                 message=message,
                 nodes=nodes,
                 parent_commit=c.commit,
                 author=author,
             )
 
             h.flash(
                 _('Successfully committed new file `{}`').format(
                     h.escape(node_path)), category='success')
         except NonRelativePathError:
             log.exception('Non Relative path found')
             h.flash(_(
                 'The location specified must be a relative path and must not '
                 'contain .. in the path'), category='warning')
             raise HTTPFound(default_redirect_url)
         except (NodeError, NodeAlreadyExistsError) as e:
             h.flash(_(h.escape(e)), category='error')
         except Exception:
             log.exception('Error occurred during commit')
             h.flash(_('Error occurred during commit'), category='error')
 
         raise HTTPFound(default_redirect_url)

rhodecode/lib/middleware/simplesvn.py

@@ -1,225 +1,226 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2018 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import base64
 import logging
 import urllib
 import urlparse
 
 import requests
 from pyramid.httpexceptions import HTTPNotAcceptable
 
 from rhodecode.lib import rc_cache
 from rhodecode.lib.middleware import simplevcs
 from rhodecode.lib.utils import is_valid_repo
 from rhodecode.lib.utils2 import str2bool, safe_int
 from rhodecode.lib.ext_json import json
 from rhodecode.lib.hooks_daemon import store_txn_id_data
 
 
 log = logging.getLogger(__name__)
 
 
 class SimpleSvnApp(object):
     IGNORED_HEADERS = [
         'connection', 'keep-alive', 'content-encoding',
         'transfer-encoding', 'content-length']
     rc_extras = {}
 
     def __init__(self, config):
         self.config = config
 
     def __call__(self, environ, start_response):
         request_headers = self._get_request_headers(environ)
         data = environ['wsgi.input']
         req_method = environ['REQUEST_METHOD']
         has_content_length = 'CONTENT_LENGTH' in environ
-        path_info = self._get_url(environ['PATH_INFO'])
+        path_info = self._get_url(
+            self.config.get('subversion_http_server_url', ''), environ['PATH_INFO'])
         transfer_encoding = environ.get('HTTP_TRANSFER_ENCODING', '')
         log.debug('Handling: %s method via `%s`', req_method, path_info)
 
         # stream control flag, based on request and content type...
         stream = False
 
         if req_method in ['MKCOL'] or has_content_length:
             data_processed = False
             # read chunk to check if we have txn-with-props
             initial_data = data.read(1024)
             if initial_data.startswith('(create-txn-with-props'):
                 data = initial_data + data.read()
                 # store on-the-fly our rc_extra using svn revision properties
                 # those can be read later on in hooks executed so we have a way
                 # to pass in the data into svn hooks
                 rc_data = base64.urlsafe_b64encode(json.dumps(self.rc_extras))
                 rc_data_len = len(rc_data)
                 # header defines data length, and serialized data
                 skel = ' rc-scm-extras {} {}'.format(rc_data_len, rc_data)
                 data = data[:-2] + skel + '))'
                 data_processed = True
 
             if not data_processed:
                 # NOTE(johbo): Avoid that we end up with sending the request in chunked
                 # transfer encoding (mainly on Gunicorn). If we know the content
                 # length, then we should transfer the payload in one request.
                 data = initial_data + data.read()
 
         if req_method in ['GET', 'PUT'] or transfer_encoding == 'chunked':
             # NOTE(marcink): when getting/uploading files we want to STREAM content
             # back to the client/proxy instead of buffering it here...
             stream = True
 
         stream = stream
         log.debug(
             'Calling SVN PROXY: method:%s via `%s`, Stream: %s',
             req_method, path_info, stream)
         response = requests.request(
             req_method, path_info,
             data=data, headers=request_headers, stream=stream)
 
         if response.status_code not in [200, 401]:
             if response.status_code >= 500:
                 log.error('Got SVN response:%s with text:\n`%s`',
                           response, response.text)
             else:
                 log.debug('Got SVN response:%s with text:\n`%s`',
                           response, response.text)
         else:
             log.debug('got response code: %s', response.status_code)
 
         response_headers = self._get_response_headers(response.headers)
 
         if response.headers.get('SVN-Txn-name'):
             svn_tx_id = response.headers.get('SVN-Txn-name')
             txn_id = rc_cache.utils.compute_key_from_params(
                 self.config['repository'], svn_tx_id)
             port = safe_int(self.rc_extras['hooks_uri'].split(':')[-1])
             store_txn_id_data(txn_id, {'port': port})
 
         start_response(
             '{} {}'.format(response.status_code, response.reason),
             response_headers)
         return response.iter_content(chunk_size=1024)
 
-    def _get_url(self, path):
-        url_path = urlparse.urljoin(
-            self.config.get('subversion_http_server_url', ''), path)
+    def _get_url(self, svn_http_server, path):
+        svn_http_server_url = (svn_http_server or '').rstrip('/')
+        url_path = urlparse.urljoin(svn_http_server_url + '/', (path or '').lstrip('/'))
         url_path = urllib.quote(url_path, safe="/:=~+!$,;'")
         return url_path
 
     def _get_request_headers(self, environ):
         headers = {}
 
         for key in environ:
             if not key.startswith('HTTP_'):
                 continue
             new_key = key.split('_')
             new_key = [k.capitalize() for k in new_key[1:]]
             new_key = '-'.join(new_key)
             headers[new_key] = environ[key]
 
         if 'CONTENT_TYPE' in environ:
             headers['Content-Type'] = environ['CONTENT_TYPE']
 
         if 'CONTENT_LENGTH' in environ:
             headers['Content-Length'] = environ['CONTENT_LENGTH']
 
         return headers
 
     def _get_response_headers(self, headers):
         headers = [
             (h, headers[h])
             for h in headers
             if h.lower() not in self.IGNORED_HEADERS
         ]
 
         return headers
 
 
 class DisabledSimpleSvnApp(object):
     def __init__(self, config):
         self.config = config
 
     def __call__(self, environ, start_response):
         reason = 'Cannot handle SVN call because: SVN HTTP Proxy is not enabled'
         log.warning(reason)
         return HTTPNotAcceptable(reason)(environ, start_response)
 
 
 class SimpleSvn(simplevcs.SimpleVCS):
 
     SCM = 'svn'
     READ_ONLY_COMMANDS = ('OPTIONS', 'PROPFIND', 'GET', 'REPORT')
     DEFAULT_HTTP_SERVER = 'http://localhost:8090'
 
     def _get_repository_name(self, environ):
         """
         Gets repository name out of PATH_INFO header
 
         :param environ: environ where PATH_INFO is stored
         """
         path = environ['PATH_INFO'].split('!')
         repo_name = path[0].strip('/')
 
         # SVN includes the whole path in it's requests, including
         # subdirectories inside the repo. Therefore we have to search for
         # the repo root directory.
         if not is_valid_repo(
                 repo_name, self.base_path, explicit_scm=self.SCM):
             current_path = ''
             for component in repo_name.split('/'):
                 current_path += component
                 if is_valid_repo(
                         current_path, self.base_path, explicit_scm=self.SCM):
                     return current_path
                 current_path += '/'
 
         return repo_name
 
     def _get_action(self, environ):
         return (
             'pull'
             if environ['REQUEST_METHOD'] in self.READ_ONLY_COMMANDS
             else 'push')
 
     def _should_use_callback_daemon(self, extras, environ, action):
         # only MERGE command triggers hooks, so we don't want to start
         # hooks server too many times. POST however starts the svn transaction
         # so we also need to run the init of callback daemon of POST
         if environ['REQUEST_METHOD'] in ['MERGE', 'POST']:
             return True
         return False
 
     def _create_wsgi_app(self, repo_path, repo_name, config):
         if self._is_svn_enabled():
             return SimpleSvnApp(config)
         # we don't have http proxy enabled return dummy request handler
         return DisabledSimpleSvnApp(config)
 
     def _is_svn_enabled(self):
         conf = self.repo_vcs_config
         return str2bool(conf.get('vcs_svn_proxy', 'http_requests_enabled'))
 
     def _create_config(self, extras, repo_name):
         conf = self.repo_vcs_config
         server_url = conf.get('vcs_svn_proxy', 'http_server_url')
         server_url = server_url or self.DEFAULT_HTTP_SERVER
 
         extras['subversion_http_server_url'] = server_url
         return extras

rhodecode/lib/utils2.py

@@ -1,1022 +1,1022 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2011-2018 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 
 """
 Some simple helper functions
 """
 
 import collections
 import datetime
 import dateutil.relativedelta
 import hashlib
 import logging
 import re
 import sys
 import time
 import urllib
 import urlobject
 import uuid
 import getpass
 
 import pygments.lexers
 import sqlalchemy
 import sqlalchemy.engine.url
 import sqlalchemy.exc
 import sqlalchemy.sql
 import webob
 import pyramid.threadlocal
+from pyramid.settings import asbool
 
 import rhodecode
 from rhodecode.translation import _, _pluralize
 
 
 def md5(s):
     return hashlib.md5(s).hexdigest()
 
 
 def md5_safe(s):
     return md5(safe_str(s))
 
 
 def sha1(s):
     return hashlib.sha1(s).hexdigest()
 
 
 def sha1_safe(s):
     return sha1(safe_str(s))
 
 
 def __get_lem(extra_mapping=None):
     """
     Get language extension map based on what's inside pygments lexers
     """
     d = collections.defaultdict(lambda: [])
 
     def __clean(s):
         s = s.lstrip('*')
         s = s.lstrip('.')
 
         if s.find('[') != -1:
             exts = []
             start, stop = s.find('['), s.find(']')
 
             for suffix in s[start + 1:stop]:
                 exts.append(s[:s.find('[')] + suffix)
             return [e.lower() for e in exts]
         else:
             return [s.lower()]
 
     for lx, t in sorted(pygments.lexers.LEXERS.items()):
         m = map(__clean, t[-2])
         if m:
             m = reduce(lambda x, y: x + y, m)
             for ext in m:
                 desc = lx.replace('Lexer', '')
                 d[ext].append(desc)
 
     data = dict(d)
 
     extra_mapping = extra_mapping or {}
     if extra_mapping:
         for k, v in extra_mapping.items():
             if k not in data:
                 # register new mapping2lexer
                 data[k] = [v]
 
     return data
 
 
 def str2bool(_str):
     """
     returns True/False value from given string, it tries to translate the
     string into boolean
 
     :param _str: string value to translate into boolean
     :rtype: boolean
     :returns: boolean from given string
     """
     if _str is None:
         return False
     if _str in (True, False):
         return _str
     _str = str(_str).strip().lower()
     return _str in ('t', 'true', 'y', 'yes', 'on', '1')
 
 
 def aslist(obj, sep=None, strip=True):
     """
     Returns given string separated by sep as list
 
     :param obj:
     :param sep:
     :param strip:
     """
     if isinstance(obj, (basestring,)):
         lst = obj.split(sep)
         if strip:
             lst = [v.strip() for v in lst]
         return lst
     elif isinstance(obj, (list, tuple)):
         return obj
     elif obj is None:
         return []
     else:
         return [obj]
 
 
 def convert_line_endings(line, mode):
     """
     Converts a given line  "line end" accordingly to given mode
 
     Available modes are::
         0 - Unix
         1 - Mac
         2 - DOS
 
     :param line: given line to convert
     :param mode: mode to convert to
     :rtype: str
     :return: converted line according to mode
     """
     if mode == 0:
         line = line.replace('\r\n', '\n')
         line = line.replace('\r', '\n')
     elif mode == 1:
         line = line.replace('\r\n', '\r')
         line = line.replace('\n', '\r')
     elif mode == 2:
         line = re.sub('\r(?!\n)|(?<!\r)\n', '\r\n', line)
     return line
 
 
 def detect_mode(line, default):
     """
     Detects line break for given line, if line break couldn't be found
     given default value is returned
 
     :param line: str line
     :param default: default
     :rtype: int
     :return: value of line end on of 0 - Unix, 1 - Mac, 2 - DOS
     """
     if line.endswith('\r\n'):
         return 2
     elif line.endswith('\n'):
         return 0
     elif line.endswith('\r'):
         return 1
     else:
         return default
 
 
 def safe_int(val, default=None):
     """
     Returns int() of val if val is not convertable to int use default
     instead
 
     :param val:
     :param default:
     """
 
     try:
         val = int(val)
     except (ValueError, TypeError):
         val = default
 
     return val
 
 
 def safe_unicode(str_, from_encoding=None):
     """
     safe unicode function. Does few trick to turn str_ into unicode
 
     In case of UnicodeDecode error, we try to return it with encoding detected
     by chardet library if it fails fallback to unicode with errors replaced
 
     :param str_: string to decode
     :rtype: unicode
     :returns: unicode object
     """
     if isinstance(str_, unicode):
         return str_
 
     if not from_encoding:
         DEFAULT_ENCODINGS = aslist(rhodecode.CONFIG.get('default_encoding',
                                                         'utf8'), sep=',')
         from_encoding = DEFAULT_ENCODINGS
 
     if not isinstance(from_encoding, (list, tuple)):
         from_encoding = [from_encoding]
 
     try:
         return unicode(str_)
     except UnicodeDecodeError:
         pass
 
     for enc in from_encoding:
         try:
             return unicode(str_, enc)
         except UnicodeDecodeError:
             pass
 
     try:
         import chardet
         encoding = chardet.detect(str_)['encoding']
         if encoding is None:
             raise Exception()
         return str_.decode(encoding)
     except (ImportError, UnicodeDecodeError, Exception):
         return unicode(str_, from_encoding[0], 'replace')
 
 
 def safe_str(unicode_, to_encoding=None):
     """
     safe str function. Does few trick to turn unicode_ into string
 
     In case of UnicodeEncodeError, we try to return it with encoding detected
     by chardet library if it fails fallback to string with errors replaced
 
     :param unicode_: unicode to encode
     :rtype: str
     :returns: str object
     """
 
     # if it's not basestr cast to str
     if not isinstance(unicode_, basestring):
         return str(unicode_)
 
     if isinstance(unicode_, str):
         return unicode_
 
     if not to_encoding:
         DEFAULT_ENCODINGS = aslist(rhodecode.CONFIG.get('default_encoding',
                                                         'utf8'), sep=',')
         to_encoding = DEFAULT_ENCODINGS
 
     if not isinstance(to_encoding, (list, tuple)):
         to_encoding = [to_encoding]
 
     for enc in to_encoding:
         try:
             return unicode_.encode(enc)
         except UnicodeEncodeError:
             pass
 
     try:
         import chardet
         encoding = chardet.detect(unicode_)['encoding']
         if encoding is None:
             raise UnicodeEncodeError()
 
         return unicode_.encode(encoding)
     except (ImportError, UnicodeEncodeError):
         return unicode_.encode(to_encoding[0], 'replace')
 
 
 def remove_suffix(s, suffix):
     if s.endswith(suffix):
         s = s[:-1 * len(suffix)]
     return s
 
 
 def remove_prefix(s, prefix):
     if s.startswith(prefix):
         s = s[len(prefix):]
     return s
 
 
 def find_calling_context(ignore_modules=None):
     """
     Look through the calling stack and return the frame which called
     this function and is part of core module ( ie. rhodecode.* )
 
     :param ignore_modules: list of modules to ignore eg. ['rhodecode.lib']
     """
 
     ignore_modules = ignore_modules or []
 
     f = sys._getframe(2)
     while f.f_back is not None:
         name = f.f_globals.get('__name__')
         if name and name.startswith(__name__.split('.')[0]):
             if name not in ignore_modules:
                 return f
         f = f.f_back
     return None
 
 
 def ping_connection(connection, branch):
     if branch:
         # "branch" refers to a sub-connection of a connection,
         # we don't want to bother pinging on these.
         return
 
     # turn off "close with result".  This flag is only used with
     # "connectionless" execution, otherwise will be False in any case
     save_should_close_with_result = connection.should_close_with_result
     connection.should_close_with_result = False
 
     try:
         # run a SELECT 1.   use a core select() so that
         # the SELECT of a scalar value without a table is
         # appropriately formatted for the backend
         connection.scalar(sqlalchemy.sql.select([1]))
     except sqlalchemy.exc.DBAPIError as err:
         # catch SQLAlchemy's DBAPIError, which is a wrapper
         # for the DBAPI's exception.  It includes a .connection_invalidated
         # attribute which specifies if this connection is a "disconnect"
         # condition, which is based on inspection of the original exception
         # by the dialect in use.
         if err.connection_invalidated:
             # run the same SELECT again - the connection will re-validate
             # itself and establish a new connection.  The disconnect detection
             # here also causes the whole connection pool to be invalidated
             # so that all stale connections are discarded.
             connection.scalar(sqlalchemy.sql.select([1]))
         else:
             raise
     finally:
         # restore "close with result"
         connection.should_close_with_result = save_should_close_with_result
 
 
 def engine_from_config(configuration, prefix='sqlalchemy.', **kwargs):
     """Custom engine_from_config functions."""
     log = logging.getLogger('sqlalchemy.engine')
-    _ping_connection = configuration.pop('sqlalchemy.db1.ping_connection', None)
+    use_ping_connection = asbool(configuration.pop('sqlalchemy.db1.ping_connection', None))
+    debug = asbool(configuration.get('debug'))
 
     engine = sqlalchemy.engine_from_config(configuration, prefix, **kwargs)
 
     def color_sql(sql):
         color_seq = '\033[1;33m'  # This is yellow: code 33
         normal = '\x1b[0m'
         return ''.join([color_seq, sql, normal])
 
-    if configuration['debug'] or _ping_connection:
+    if use_ping_connection:
+        log.debug('Adding ping_connection on the engine config.')
         sqlalchemy.event.listen(engine, "engine_connect", ping_connection)
 
-    if configuration['debug']:
+    if debug:
         # attach events only for debug configuration
-
         def before_cursor_execute(conn, cursor, statement,
                                   parameters, context, executemany):
             setattr(conn, 'query_start_time', time.time())
             log.info(color_sql(">>>>> STARTING QUERY >>>>>"))
             calling_context = find_calling_context(ignore_modules=[
                 'rhodecode.lib.caching_query',
                 'rhodecode.model.settings',
             ])
             if calling_context:
                 log.info(color_sql('call context %s:%s' % (
                     calling_context.f_code.co_filename,
                     calling_context.f_lineno,
                 )))
 
         def after_cursor_execute(conn, cursor, statement,
                                  parameters, context, executemany):
             delattr(conn, 'query_start_time')
 
-        sqlalchemy.event.listen(engine, "before_cursor_execute",
-                                before_cursor_execute)
-        sqlalchemy.event.listen(engine, "after_cursor_execute",
-                                after_cursor_execute)
+        sqlalchemy.event.listen(engine, "before_cursor_execute", before_cursor_execute)
+        sqlalchemy.event.listen(engine, "after_cursor_execute", after_cursor_execute)
 
     return engine
 
 
 def get_encryption_key(config):
     secret = config.get('rhodecode.encrypted_values.secret')
     default = config['beaker.session.secret']
     return secret or default
 
 
 def age(prevdate, now=None, show_short_version=False, show_suffix=True,
         short_format=False):
     """
     Turns a datetime into an age string.
     If show_short_version is True, this generates a shorter string with
     an approximate age; ex. '1 day ago', rather than '1 day and 23 hours ago'.
 
     * IMPORTANT*
     Code of this function is written in special way so it's easier to
     backport it to javascript. If you mean to update it, please also update
     `jquery.timeago-extension.js` file
 
     :param prevdate: datetime object
     :param now: get current time, if not define we use
         `datetime.datetime.now()`
     :param show_short_version: if it should approximate the date and
         return a shorter string
     :param show_suffix:
     :param short_format: show short format, eg 2D instead of 2 days
     :rtype: unicode
     :returns: unicode words describing age
     """
 
     def _get_relative_delta(now, prevdate):
         base = dateutil.relativedelta.relativedelta(now, prevdate)
         return {
             'year': base.years,
             'month': base.months,
             'day': base.days,
             'hour': base.hours,
             'minute': base.minutes,
             'second': base.seconds,
         }
 
     def _is_leap_year(year):
         return year % 4 == 0 and (year % 100 != 0 or year % 400 == 0)
 
     def get_month(prevdate):
         return prevdate.month
 
     def get_year(prevdate):
         return prevdate.year
 
     now = now or datetime.datetime.now()
     order = ['year', 'month', 'day', 'hour', 'minute', 'second']
     deltas = {}
     future = False
 
     if prevdate > now:
         now_old = now
         now = prevdate
         prevdate = now_old
         future = True
     if future:
         prevdate = prevdate.replace(microsecond=0)
     # Get date parts deltas
     for part in order:
         rel_delta = _get_relative_delta(now, prevdate)
         deltas[part] = rel_delta[part]
 
     # Fix negative offsets (there is 1 second between 10:59:59 and 11:00:00,
     # not 1 hour, -59 minutes and -59 seconds)
     offsets = [[5, 60], [4, 60], [3, 24]]
     for element in offsets:  # seconds, minutes, hours
         num = element[0]
         length = element[1]
 
         part = order[num]
         carry_part = order[num - 1]
 
         if deltas[part] < 0:
             deltas[part] += length
             deltas[carry_part] -= 1
 
     # Same thing for days except that the increment depends on the (variable)
     # number of days in the month
     month_lengths = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31]
     if deltas['day'] < 0:
         if get_month(prevdate) == 2 and _is_leap_year(get_year(prevdate)):
             deltas['day'] += 29
         else:
             deltas['day'] += month_lengths[get_month(prevdate) - 1]
 
         deltas['month'] -= 1
 
     if deltas['month'] < 0:
         deltas['month'] += 12
         deltas['year'] -= 1
 
     # Format the result
     if short_format:
         fmt_funcs = {
             'year': lambda d: u'%dy' % d,
             'month': lambda d: u'%dm' % d,
             'day': lambda d: u'%dd' % d,
             'hour': lambda d: u'%dh' % d,
             'minute': lambda d: u'%dmin' % d,
             'second': lambda d: u'%dsec' % d,
         }
     else:
         fmt_funcs = {
             'year': lambda d: _pluralize(u'${num} year', u'${num} years', d, mapping={'num': d}).interpolate(),
             'month': lambda d: _pluralize(u'${num} month', u'${num} months', d, mapping={'num': d}).interpolate(),
             'day': lambda d: _pluralize(u'${num} day', u'${num} days', d, mapping={'num': d}).interpolate(),
             'hour': lambda d: _pluralize(u'${num} hour', u'${num} hours', d, mapping={'num': d}).interpolate(),
             'minute': lambda d: _pluralize(u'${num} minute', u'${num} minutes', d, mapping={'num': d}).interpolate(),
             'second': lambda d: _pluralize(u'${num} second', u'${num} seconds', d, mapping={'num': d}).interpolate(),
         }
 
     i = 0
     for part in order:
         value = deltas[part]
         if value != 0:
 
             if i < 5:
                 sub_part = order[i + 1]
                 sub_value = deltas[sub_part]
             else:
                 sub_value = 0
 
             if sub_value == 0 or show_short_version:
                 _val = fmt_funcs[part](value)
                 if future:
                     if show_suffix:
                         return _(u'in ${ago}', mapping={'ago': _val})
                     else:
                         return _(_val)
 
                 else:
                     if show_suffix:
                         return _(u'${ago} ago', mapping={'ago': _val})
                     else:
                         return _(_val)
 
             val = fmt_funcs[part](value)
             val_detail = fmt_funcs[sub_part](sub_value)
             mapping = {'val': val, 'detail': val_detail}
 
             if short_format:
                 datetime_tmpl = _(u'${val}, ${detail}', mapping=mapping)
                 if show_suffix:
                     datetime_tmpl = _(u'${val}, ${detail} ago', mapping=mapping)
                     if future:
                         datetime_tmpl = _(u'in ${val}, ${detail}', mapping=mapping)
             else:
                 datetime_tmpl = _(u'${val} and ${detail}', mapping=mapping)
                 if show_suffix:
                     datetime_tmpl = _(u'${val} and ${detail} ago', mapping=mapping)
                     if future:
                         datetime_tmpl = _(u'in ${val} and ${detail}', mapping=mapping)
 
             return datetime_tmpl
         i += 1
     return _(u'just now')
 
 
 def cleaned_uri(uri):
     """
     Quotes '[' and ']' from uri if there is only one of them.
         according to RFC3986 we cannot use such chars in uri
     :param uri:
     :return: uri without this chars
     """
     return urllib.quote(uri, safe='@$:/')
 
 
 def uri_filter(uri):
     """
     Removes user:password from given url string
 
     :param uri:
     :rtype: unicode
     :returns: filtered list of strings
     """
     if not uri:
         return ''
 
     proto = ''
 
     for pat in ('https://', 'http://'):
         if uri.startswith(pat):
             uri = uri[len(pat):]
             proto = pat
             break
 
     # remove passwords and username
     uri = uri[uri.find('@') + 1:]
 
     # get the port
     cred_pos = uri.find(':')
     if cred_pos == -1:
         host, port = uri, None
     else:
         host, port = uri[:cred_pos], uri[cred_pos + 1:]
 
     return filter(None, [proto, host, port])
 
 
 def credentials_filter(uri):
     """
     Returns a url with removed credentials
 
     :param uri:
     """
 
     uri = uri_filter(uri)
     # check if we have port
     if len(uri) > 2 and uri[2]:
         uri[2] = ':' + uri[2]
 
     return ''.join(uri)
 
 
 def get_clone_url(request, uri_tmpl, repo_name, repo_id, **override):
     qualifed_home_url = request.route_url('home')
     parsed_url = urlobject.URLObject(qualifed_home_url)
     decoded_path = safe_unicode(urllib.unquote(parsed_url.path.rstrip('/')))
 
     args = {
         'scheme': parsed_url.scheme,
         'user': '',
         'sys_user': getpass.getuser(),
         # path if we use proxy-prefix
         'netloc': parsed_url.netloc+decoded_path,
         'hostname': parsed_url.hostname,
         'prefix': decoded_path,
         'repo': repo_name,
         'repoid': str(repo_id)
     }
     args.update(override)
     args['user'] = urllib.quote(safe_str(args['user']))
 
     for k, v in args.items():
         uri_tmpl = uri_tmpl.replace('{%s}' % k, v)
 
     # remove leading @ sign if it's present. Case of empty user
     url_obj = urlobject.URLObject(uri_tmpl)
     url = url_obj.with_netloc(url_obj.netloc.lstrip('@'))
 
     return safe_unicode(url)
 
 
 def get_commit_safe(repo, commit_id=None, commit_idx=None, pre_load=None):
     """
     Safe version of get_commit if this commit doesn't exists for a
     repository it returns a Dummy one instead
 
     :param repo: repository instance
     :param commit_id: commit id as str
     :param pre_load: optional list of commit attributes to load
     """
     # TODO(skreft): remove these circular imports
     from rhodecode.lib.vcs.backends.base import BaseRepository, EmptyCommit
     from rhodecode.lib.vcs.exceptions import RepositoryError
     if not isinstance(repo, BaseRepository):
         raise Exception('You must pass an Repository '
                         'object as first argument got %s', type(repo))
 
     try:
         commit = repo.get_commit(
             commit_id=commit_id, commit_idx=commit_idx, pre_load=pre_load)
     except (RepositoryError, LookupError):
         commit = EmptyCommit()
     return commit
 
 
 def datetime_to_time(dt):
     if dt:
         return time.mktime(dt.timetuple())
 
 
 def time_to_datetime(tm):
     if tm:
         if isinstance(tm, basestring):
             try:
                 tm = float(tm)
             except ValueError:
                 return
         return datetime.datetime.fromtimestamp(tm)
 
 
 def time_to_utcdatetime(tm):
     if tm:
         if isinstance(tm, basestring):
             try:
                 tm = float(tm)
             except ValueError:
                 return
         return datetime.datetime.utcfromtimestamp(tm)
 
 
 MENTIONS_REGEX = re.compile(
     # ^@ or @ without any special chars in front
     r'(?:^@|[^a-zA-Z0-9\-\_\.]@)'
     # main body starts with letter, then can be . - _
     r'([a-zA-Z0-9]{1}[a-zA-Z0-9\-\_\.]+)',
     re.VERBOSE | re.MULTILINE)
 
 
 def extract_mentioned_users(s):
     """
     Returns unique usernames from given string s that have @mention
 
     :param s: string to get mentions
     """
     usrs = set()
     for username in MENTIONS_REGEX.findall(s):
         usrs.add(username)
 
     return sorted(list(usrs), key=lambda k: k.lower())
 
 
 class AttributeDictBase(dict):
     def __getstate__(self):
         odict = self.__dict__  # get attribute dictionary
         return odict
 
     def __setstate__(self, dict):
         self.__dict__ = dict
 
     __setattr__ = dict.__setitem__
     __delattr__ = dict.__delitem__
 
 
 class StrictAttributeDict(AttributeDictBase):
     """
     Strict Version of Attribute dict which raises an Attribute error when
     requested attribute is not set
     """
     def __getattr__(self, attr):
         try:
             return self[attr]
         except KeyError:
             raise AttributeError('%s object has no attribute %s' % (
                 self.__class__, attr))
 
 
 class AttributeDict(AttributeDictBase):
     def __getattr__(self, attr):
         return self.get(attr, None)
 
 
 
 class OrderedDefaultDict(collections.OrderedDict, collections.defaultdict):
     def __init__(self, default_factory=None, *args, **kwargs):
         # in python3 you can omit the args to super
         super(OrderedDefaultDict, self).__init__(*args, **kwargs)
         self.default_factory = default_factory
 
 
 def fix_PATH(os_=None):
     """
     Get current active python path, and append it to PATH variable to fix
     issues of subprocess calls and different python versions
     """
     if os_ is None:
         import os
     else:
         os = os_
 
     cur_path = os.path.split(sys.executable)[0]
     if not os.environ['PATH'].startswith(cur_path):
         os.environ['PATH'] = '%s:%s' % (cur_path, os.environ['PATH'])
 
 
 def obfuscate_url_pw(engine):
     _url = engine or ''
     try:
         _url = sqlalchemy.engine.url.make_url(engine)
         if _url.password:
             _url.password = 'XXXXX'
     except Exception:
         pass
     return unicode(_url)
 
 
 def get_server_url(environ):
     req = webob.Request(environ)
     return req.host_url + req.script_name
 
 
 def unique_id(hexlen=32):
     alphabet = "23456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghjklmnpqrstuvwxyz"
     return suuid(truncate_to=hexlen, alphabet=alphabet)
 
 
 def suuid(url=None, truncate_to=22, alphabet=None):
     """
     Generate and return a short URL safe UUID.
 
     If the url parameter is provided, set the namespace to the provided
     URL and generate a UUID.
 
     :param url to get the uuid for
     :truncate_to: truncate the basic 22 UUID to shorter version
 
     The IDs won't be universally unique any longer, but the probability of
     a collision will still be very low.
     """
     # Define our alphabet.
     _ALPHABET = alphabet or "23456789ABCDEFGHJKLMNPQRSTUVWXYZ"
 
     # If no URL is given, generate a random UUID.
     if url is None:
         unique_id = uuid.uuid4().int
     else:
         unique_id = uuid.uuid3(uuid.NAMESPACE_URL, url).int
 
     alphabet_length = len(_ALPHABET)
     output = []
     while unique_id > 0:
         digit = unique_id % alphabet_length
         output.append(_ALPHABET[digit])
         unique_id = int(unique_id / alphabet_length)
     return "".join(output)[:truncate_to]
 
 
 def get_current_rhodecode_user(request=None):
     """
     Gets rhodecode user from request
     """
     pyramid_request = request or pyramid.threadlocal.get_current_request()
 
     # web case
     if pyramid_request and hasattr(pyramid_request, 'user'):
         return pyramid_request.user
 
     # api case
     if pyramid_request and hasattr(pyramid_request, 'rpc_user'):
         return pyramid_request.rpc_user
 
     return None
 
 
 def action_logger_generic(action, namespace=''):
     """
     A generic logger for actions useful to the system overview, tries to find
     an acting user for the context of the call otherwise reports unknown user
 
     :param action: logging message eg 'comment 5 deleted'
     :param type: string
 
     :param namespace: namespace of the logging message eg. 'repo.comments'
     :param type: string
 
     """
 
     logger_name = 'rhodecode.actions'
 
     if namespace:
         logger_name += '.' + namespace
 
     log = logging.getLogger(logger_name)
 
     # get a user if we can
     user = get_current_rhodecode_user()
 
     logfunc = log.info
 
     if not user:
         user = '<unknown user>'
         logfunc = log.warning
 
     logfunc('Logging action by {}: {}'.format(user, action))
 
 
 def escape_split(text, sep=',', maxsplit=-1):
     r"""
     Allows for escaping of the separator: e.g. arg='foo\, bar'
 
     It should be noted that the way bash et. al. do command line parsing, those
     single quotes are required.
     """
     escaped_sep = r'\%s' % sep
 
     if escaped_sep not in text:
         return text.split(sep, maxsplit)
 
     before, _mid, after = text.partition(escaped_sep)
     startlist = before.split(sep, maxsplit)  # a regular split is fine here
     unfinished = startlist[-1]
     startlist = startlist[:-1]
 
     # recurse because there may be more escaped separators
     endlist = escape_split(after, sep, maxsplit)
 
     # finish building the escaped value. we use endlist[0] becaue the first
     # part of the string sent in recursion is the rest of the escaped value.
     unfinished += sep + endlist[0]
 
     return startlist + [unfinished] + endlist[1:]  # put together all the parts
 
 
 class OptionalAttr(object):
     """
     Special Optional Option that defines other attribute. Example::
 
         def test(apiuser, userid=Optional(OAttr('apiuser')):
             user = Optional.extract(userid)
             # calls
 
     """
 
     def __init__(self, attr_name):
         self.attr_name = attr_name
 
     def __repr__(self):
         return '<OptionalAttr:%s>' % self.attr_name
 
     def __call__(self):
         return self
 
 
 # alias
 OAttr = OptionalAttr
 
 
 class Optional(object):
     """
     Defines an optional parameter::
 
         param = param.getval() if isinstance(param, Optional) else param
         param = param() if isinstance(param, Optional) else param
 
     is equivalent of::
 
         param = Optional.extract(param)
 
     """
 
     def __init__(self, type_):
         self.type_ = type_
 
     def __repr__(self):
         return '<Optional:%s>' % self.type_.__repr__()
 
     def __call__(self):
         return self.getval()
 
     def getval(self):
         """
         returns value from this Optional instance
         """
         if isinstance(self.type_, OAttr):
             # use params name
             return self.type_.attr_name
         return self.type_
 
     @classmethod
     def extract(cls, val):
         """
         Extracts value from Optional() instance
 
         :param val:
         :return: original value if it's not Optional instance else
             value of instance
         """
         if isinstance(val, cls):
             return val.getval()
         return val
 
 
 def glob2re(pat):
     """
     Translate a shell PATTERN to a regular expression.
 
     There is no way to quote meta-characters.
     """
 
     i, n = 0, len(pat)
     res = ''
     while i < n:
         c = pat[i]
         i = i+1
         if c == '*':
             #res = res + '.*'
             res = res + '[^/]*'
         elif c == '?':
             #res = res + '.'
             res = res + '[^/]'
         elif c == '[':
             j = i
             if j < n and pat[j] == '!':
                 j = j+1
             if j < n and pat[j] == ']':
                 j = j+1
             while j < n and pat[j] != ']':
                 j = j+1
             if j >= n:
                 res = res + '\\['
             else:
                 stuff = pat[i:j].replace('\\','\\\\')
                 i = j+1
                 if stuff[0] == '!':
                     stuff = '^' + stuff[1:]
                 elif stuff[0] == '^':
                     stuff = '\\' + stuff
                 res = '%s[%s]' % (res, stuff)
         else:
             res = res + re.escape(c)
     return res + '\Z(?ms)'
 
 
 def parse_byte_string(size_str):
     match = re.match(r'(\d+)(MB|KB)', size_str, re.IGNORECASE)
     if not match:
         raise ValueError('Given size:%s is invalid, please make sure '
                          'to use format of <num>(MB|KB)' % size_str)
 
     _parts = match.groups()
     num, type_ = _parts
     return long(num) * {'mb': 1024*1024, 'kb': 1024}[type_.lower()]

rhodecode/model/pull_request.py

@@ -1,1694 +1,1696 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2012-2018 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 
 """
 pull request model for RhodeCode
 """
 
 
 import json
 import logging
 import datetime
 import urllib
 import collections
 
 from pyramid.threadlocal import get_current_request
 
 from rhodecode import events
 from rhodecode.translation import lazy_ugettext
 from rhodecode.lib import helpers as h, hooks_utils, diffs
 from rhodecode.lib import audit_logger
 from rhodecode.lib.compat import OrderedDict
 from rhodecode.lib.hooks_daemon import prepare_callback_daemon
 from rhodecode.lib.markup_renderer import (
     DEFAULT_COMMENTS_RENDERER, RstTemplateRenderer)
 from rhodecode.lib.utils2 import safe_unicode, safe_str, md5_safe
 from rhodecode.lib.vcs.backends.base import (
     Reference, MergeResponse, MergeFailureReason, UpdateFailureReason)
 from rhodecode.lib.vcs.conf import settings as vcs_settings
 from rhodecode.lib.vcs.exceptions import (
     CommitDoesNotExistError, EmptyRepositoryError)
 from rhodecode.model import BaseModel
 from rhodecode.model.changeset_status import ChangesetStatusModel
 from rhodecode.model.comment import CommentsModel
 from rhodecode.model.db import (
     or_, PullRequest, PullRequestReviewers, ChangesetStatus,
     PullRequestVersion, ChangesetComment, Repository, RepoReviewRule)
 from rhodecode.model.meta import Session
 from rhodecode.model.notification import NotificationModel, \
     EmailNotificationModel
 from rhodecode.model.scm import ScmModel
 from rhodecode.model.settings import VcsSettingsModel
 
 
 log = logging.getLogger(__name__)
 
 
 # Data structure to hold the response data when updating commits during a pull
 # request update.
 UpdateResponse = collections.namedtuple('UpdateResponse', [
     'executed', 'reason', 'new', 'old', 'changes',
     'source_changed', 'target_changed'])
 
 
 class PullRequestModel(BaseModel):
 
     cls = PullRequest
 
     DIFF_CONTEXT = diffs.DEFAULT_CONTEXT
 
     UPDATE_STATUS_MESSAGES = {
         UpdateFailureReason.NONE: lazy_ugettext(
             'Pull request update successful.'),
         UpdateFailureReason.UNKNOWN: lazy_ugettext(
             'Pull request update failed because of an unknown error.'),
         UpdateFailureReason.NO_CHANGE: lazy_ugettext(
             'No update needed because the source and target have not changed.'),
         UpdateFailureReason.WRONG_REF_TYPE: lazy_ugettext(
             'Pull request cannot be updated because the reference type is '
             'not supported for an update. Only Branch, Tag or Bookmark is allowed.'),
         UpdateFailureReason.MISSING_TARGET_REF: lazy_ugettext(
             'This pull request cannot be updated because the target '
             'reference is missing.'),
         UpdateFailureReason.MISSING_SOURCE_REF: lazy_ugettext(
             'This pull request cannot be updated because the source '
             'reference is missing.'),
     }
+    REF_TYPES = ['bookmark', 'book', 'tag', 'branch']
+    UPDATABLE_REF_TYPES = ['bookmark', 'book', 'branch']
 
     def __get_pull_request(self, pull_request):
         return self._get_instance((
             PullRequest, PullRequestVersion), pull_request)
 
     def _check_perms(self, perms, pull_request, user, api=False):
         if not api:
             return h.HasRepoPermissionAny(*perms)(
                 user=user, repo_name=pull_request.target_repo.repo_name)
         else:
             return h.HasRepoPermissionAnyApi(*perms)(
                 user=user, repo_name=pull_request.target_repo.repo_name)
 
     def check_user_read(self, pull_request, user, api=False):
         _perms = ('repository.admin', 'repository.write', 'repository.read',)
         return self._check_perms(_perms, pull_request, user, api)
 
     def check_user_merge(self, pull_request, user, api=False):
         _perms = ('repository.admin', 'repository.write', 'hg.admin',)
         return self._check_perms(_perms, pull_request, user, api)
 
     def check_user_update(self, pull_request, user, api=False):
         owner = user.user_id == pull_request.user_id
         return self.check_user_merge(pull_request, user, api) or owner
 
     def check_user_delete(self, pull_request, user):
         owner = user.user_id == pull_request.user_id
         _perms = ('repository.admin',)
         return self._check_perms(_perms, pull_request, user) or owner
 
     def check_user_change_status(self, pull_request, user, api=False):
         reviewer = user.user_id in [x.user_id for x in
                                     pull_request.reviewers]
         return self.check_user_update(pull_request, user, api) or reviewer
 
     def check_user_comment(self, pull_request, user):
         owner = user.user_id == pull_request.user_id
         return self.check_user_read(pull_request, user) or owner
 
     def get(self, pull_request):
         return self.__get_pull_request(pull_request)
 
     def _prepare_get_all_query(self, repo_name, source=False, statuses=None,
                                opened_by=None, order_by=None,
                                order_dir='desc'):
         repo = None
         if repo_name:
             repo = self._get_repo(repo_name)
 
         q = PullRequest.query()
 
         # source or target
         if repo and source:
             q = q.filter(PullRequest.source_repo == repo)
         elif repo:
             q = q.filter(PullRequest.target_repo == repo)
 
         # closed,opened
         if statuses:
             q = q.filter(PullRequest.status.in_(statuses))
 
         # opened by filter
         if opened_by:
             q = q.filter(PullRequest.user_id.in_(opened_by))
 
         if order_by:
             order_map = {
                 'name_raw': PullRequest.pull_request_id,
                 'title': PullRequest.title,
                 'updated_on_raw': PullRequest.updated_on,
                 'target_repo': PullRequest.target_repo_id
             }
             if order_dir == 'asc':
                 q = q.order_by(order_map[order_by].asc())
             else:
                 q = q.order_by(order_map[order_by].desc())
 
         return q
 
     def count_all(self, repo_name, source=False, statuses=None,
                   opened_by=None):
         """
         Count the number of pull requests for a specific repository.
 
         :param repo_name: target or source repo
         :param source: boolean flag to specify if repo_name refers to source
         :param statuses: list of pull request statuses
         :param opened_by: author user of the pull request
         :returns: int number of pull requests
         """
         q = self._prepare_get_all_query(
             repo_name, source=source, statuses=statuses, opened_by=opened_by)
 
         return q.count()
 
     def get_all(self, repo_name, source=False, statuses=None, opened_by=None,
                 offset=0, length=None, order_by=None, order_dir='desc'):
         """
         Get all pull requests for a specific repository.
 
         :param repo_name: target or source repo
         :param source: boolean flag to specify if repo_name refers to source
         :param statuses: list of pull request statuses
         :param opened_by: author user of the pull request
         :param offset: pagination offset
         :param length: length of returned list
         :param order_by: order of the returned list
         :param order_dir: 'asc' or 'desc' ordering direction
         :returns: list of pull requests
         """
         q = self._prepare_get_all_query(
             repo_name, source=source, statuses=statuses, opened_by=opened_by,
             order_by=order_by, order_dir=order_dir)
 
         if length:
             pull_requests = q.limit(length).offset(offset).all()
         else:
             pull_requests = q.all()
 
         return pull_requests
 
     def count_awaiting_review(self, repo_name, source=False, statuses=None,
                               opened_by=None):
         """
         Count the number of pull requests for a specific repository that are
         awaiting review.
 
         :param repo_name: target or source repo
         :param source: boolean flag to specify if repo_name refers to source
         :param statuses: list of pull request statuses
         :param opened_by: author user of the pull request
         :returns: int number of pull requests
         """
         pull_requests = self.get_awaiting_review(
             repo_name, source=source, statuses=statuses, opened_by=opened_by)
 
         return len(pull_requests)
 
     def get_awaiting_review(self, repo_name, source=False, statuses=None,
                             opened_by=None, offset=0, length=None,
                             order_by=None, order_dir='desc'):
         """
         Get all pull requests for a specific repository that are awaiting
         review.
 
         :param repo_name: target or source repo
         :param source: boolean flag to specify if repo_name refers to source
         :param statuses: list of pull request statuses
         :param opened_by: author user of the pull request
         :param offset: pagination offset
         :param length: length of returned list
         :param order_by: order of the returned list
         :param order_dir: 'asc' or 'desc' ordering direction
         :returns: list of pull requests
         """
         pull_requests = self.get_all(
             repo_name, source=source, statuses=statuses, opened_by=opened_by,
             order_by=order_by, order_dir=order_dir)
 
         _filtered_pull_requests = []
         for pr in pull_requests:
             status = pr.calculated_review_status()
             if status in [ChangesetStatus.STATUS_NOT_REVIEWED,
                           ChangesetStatus.STATUS_UNDER_REVIEW]:
                 _filtered_pull_requests.append(pr)
         if length:
             return _filtered_pull_requests[offset:offset+length]
         else:
             return _filtered_pull_requests
 
     def count_awaiting_my_review(self, repo_name, source=False, statuses=None,
                                  opened_by=None, user_id=None):
         """
         Count the number of pull requests for a specific repository that are
         awaiting review from a specific user.
 
         :param repo_name: target or source repo
         :param source: boolean flag to specify if repo_name refers to source
         :param statuses: list of pull request statuses
         :param opened_by: author user of the pull request
         :param user_id: reviewer user of the pull request
         :returns: int number of pull requests
         """
         pull_requests = self.get_awaiting_my_review(
             repo_name, source=source, statuses=statuses, opened_by=opened_by,
             user_id=user_id)
 
         return len(pull_requests)
 
     def get_awaiting_my_review(self, repo_name, source=False, statuses=None,
                                opened_by=None, user_id=None, offset=0,
                                length=None, order_by=None, order_dir='desc'):
         """
         Get all pull requests for a specific repository that are awaiting
         review from a specific user.
 
         :param repo_name: target or source repo
         :param source: boolean flag to specify if repo_name refers to source
         :param statuses: list of pull request statuses
         :param opened_by: author user of the pull request
         :param user_id: reviewer user of the pull request
         :param offset: pagination offset
         :param length: length of returned list
         :param order_by: order of the returned list
         :param order_dir: 'asc' or 'desc' ordering direction
         :returns: list of pull requests
         """
         pull_requests = self.get_all(
             repo_name, source=source, statuses=statuses, opened_by=opened_by,
             order_by=order_by, order_dir=order_dir)
 
         _my = PullRequestModel().get_not_reviewed(user_id)
         my_participation = []
         for pr in pull_requests:
             if pr in _my:
                 my_participation.append(pr)
         _filtered_pull_requests = my_participation
         if length:
             return _filtered_pull_requests[offset:offset+length]
         else:
             return _filtered_pull_requests
 
     def get_not_reviewed(self, user_id):
         return [
             x.pull_request for x in PullRequestReviewers.query().filter(
                 PullRequestReviewers.user_id == user_id).all()
         ]
 
     def _prepare_participating_query(self, user_id=None, statuses=None,
                                      order_by=None, order_dir='desc'):
         q = PullRequest.query()
         if user_id:
             reviewers_subquery = Session().query(
                 PullRequestReviewers.pull_request_id).filter(
                 PullRequestReviewers.user_id == user_id).subquery()
             user_filter = or_(
                 PullRequest.user_id == user_id,
                 PullRequest.pull_request_id.in_(reviewers_subquery)
             )
             q = PullRequest.query().filter(user_filter)
 
         # closed,opened
         if statuses:
             q = q.filter(PullRequest.status.in_(statuses))
 
         if order_by:
             order_map = {
                 'name_raw': PullRequest.pull_request_id,
                 'title': PullRequest.title,
                 'updated_on_raw': PullRequest.updated_on,
                 'target_repo': PullRequest.target_repo_id
             }
             if order_dir == 'asc':
                 q = q.order_by(order_map[order_by].asc())
             else:
                 q = q.order_by(order_map[order_by].desc())
 
         return q
 
     def count_im_participating_in(self, user_id=None, statuses=None):
         q = self._prepare_participating_query(user_id, statuses=statuses)
         return q.count()
 
     def get_im_participating_in(
             self, user_id=None, statuses=None, offset=0,
             length=None, order_by=None, order_dir='desc'):
         """
         Get all Pull requests that i'm participating in, or i have opened
         """
 
         q = self._prepare_participating_query(
             user_id, statuses=statuses, order_by=order_by,
             order_dir=order_dir)
 
         if length:
             pull_requests = q.limit(length).offset(offset).all()
         else:
             pull_requests = q.all()
 
         return pull_requests
 
     def get_versions(self, pull_request):
         """
         returns version of pull request sorted by ID descending
         """
         return PullRequestVersion.query()\
             .filter(PullRequestVersion.pull_request == pull_request)\
             .order_by(PullRequestVersion.pull_request_version_id.asc())\
             .all()
 
     def get_pr_version(self, pull_request_id, version=None):
         at_version = None
 
         if version and version == 'latest':
             pull_request_ver = PullRequest.get(pull_request_id)
             pull_request_obj = pull_request_ver
             _org_pull_request_obj = pull_request_obj
             at_version = 'latest'
         elif version:
             pull_request_ver = PullRequestVersion.get_or_404(version)
             pull_request_obj = pull_request_ver
             _org_pull_request_obj = pull_request_ver.pull_request
             at_version = pull_request_ver.pull_request_version_id
         else:
             _org_pull_request_obj = pull_request_obj = PullRequest.get_or_404(
                 pull_request_id)
 
         pull_request_display_obj = PullRequest.get_pr_display_object(
             pull_request_obj, _org_pull_request_obj)
 
         return _org_pull_request_obj, pull_request_obj, \
                pull_request_display_obj, at_version
 
     def create(self, created_by, source_repo, source_ref, target_repo,
                target_ref, revisions, reviewers, title, description=None,
                description_renderer=None,
                reviewer_data=None, translator=None, auth_user=None):
         translator = translator or get_current_request().translate
 
         created_by_user = self._get_user(created_by)
         auth_user = auth_user or created_by_user.AuthUser()
         source_repo = self._get_repo(source_repo)
         target_repo = self._get_repo(target_repo)
 
         pull_request = PullRequest()
         pull_request.source_repo = source_repo
         pull_request.source_ref = source_ref
         pull_request.target_repo = target_repo
         pull_request.target_ref = target_ref
         pull_request.revisions = revisions
         pull_request.title = title
         pull_request.description = description
         pull_request.description_renderer = description_renderer
         pull_request.author = created_by_user
         pull_request.reviewer_data = reviewer_data
 
         Session().add(pull_request)
         Session().flush()
 
         reviewer_ids = set()
         # members / reviewers
         for reviewer_object in reviewers:
             user_id, reasons, mandatory, rules = reviewer_object
             user = self._get_user(user_id)
 
             # skip duplicates
             if user.user_id in reviewer_ids:
                 continue
 
             reviewer_ids.add(user.user_id)
 
             reviewer = PullRequestReviewers()
             reviewer.user = user
             reviewer.pull_request = pull_request
             reviewer.reasons = reasons
             reviewer.mandatory = mandatory
 
             # NOTE(marcink): pick only first rule for now
             rule_id = list(rules)[0] if rules else None
             rule = RepoReviewRule.get(rule_id) if rule_id else None
             if rule:
                 review_group = rule.user_group_vote_rule(user_id)
                 # we check if this particular reviewer is member of a voting group
                 if review_group:
                     # NOTE(marcink):
                     # can be that user is member of more but we pick the first same,
                     # same as default reviewers algo
                     review_group = review_group[0]
 
                     rule_data = {
                         'rule_name':
                             rule.review_rule_name,
                         'rule_user_group_entry_id':
                             review_group.repo_review_rule_users_group_id,
                         'rule_user_group_name':
                             review_group.users_group.users_group_name,
                         'rule_user_group_members':
                             [x.user.username for x in review_group.users_group.members],
                         'rule_user_group_members_id':
                             [x.user.user_id for x in review_group.users_group.members],
                     }
                     # e.g {'vote_rule': -1, 'mandatory': True}
                     rule_data.update(review_group.rule_data())
 
                     reviewer.rule_data = rule_data
 
             Session().add(reviewer)
             Session().flush()
 
         # Set approval status to "Under Review" for all commits which are
         # part of this pull request.
         ChangesetStatusModel().set_status(
             repo=target_repo,
             status=ChangesetStatus.STATUS_UNDER_REVIEW,
             user=created_by_user,
             pull_request=pull_request
         )
         # we commit early at this point. This has to do with a fact
         # that before queries do some row-locking. And because of that
         # we need to commit and finish transation before below validate call
         # that for large repos could be long resulting in long row locks
         Session().commit()
 
         # prepare workspace, and run initial merge simulation
         MergeCheck.validate(
             pull_request, auth_user=auth_user, translator=translator)
 
         self.notify_reviewers(pull_request, reviewer_ids)
         self._trigger_pull_request_hook(
             pull_request, created_by_user, 'create')
 
         creation_data = pull_request.get_api_data(with_merge_state=False)
         self._log_audit_action(
             'repo.pull_request.create', {'data': creation_data},
             auth_user, pull_request)
 
         return pull_request
 
     def _trigger_pull_request_hook(self, pull_request, user, action):
         pull_request = self.__get_pull_request(pull_request)
         target_scm = pull_request.target_repo.scm_instance()
         if action == 'create':
             trigger_hook = hooks_utils.trigger_log_create_pull_request_hook
         elif action == 'merge':
             trigger_hook = hooks_utils.trigger_log_merge_pull_request_hook
         elif action == 'close':
             trigger_hook = hooks_utils.trigger_log_close_pull_request_hook
         elif action == 'review_status_change':
             trigger_hook = hooks_utils.trigger_log_review_pull_request_hook
         elif action == 'update':
             trigger_hook = hooks_utils.trigger_log_update_pull_request_hook
         else:
             return
 
         trigger_hook(
             username=user.username,
             repo_name=pull_request.target_repo.repo_name,
             repo_alias=target_scm.alias,
             pull_request=pull_request)
 
     def _get_commit_ids(self, pull_request):
         """
         Return the commit ids of the merged pull request.
 
         This method is not dealing correctly yet with the lack of autoupdates
         nor with the implicit target updates.
         For example: if a commit in the source repo is already in the target it
         will be reported anyways.
         """
         merge_rev = pull_request.merge_rev
         if merge_rev is None:
             raise ValueError('This pull request was not merged yet')
 
         commit_ids = list(pull_request.revisions)
         if merge_rev not in commit_ids:
             commit_ids.append(merge_rev)
 
         return commit_ids
 
     def merge_repo(self, pull_request, user, extras):
         log.debug("Merging pull request %s", pull_request.pull_request_id)
         extras['user_agent'] = 'internal-merge'
         merge_state = self._merge_pull_request(pull_request, user, extras)
         if merge_state.executed:
             log.debug("Merge was successful, updating the pull request comments.")
             self._comment_and_close_pr(pull_request, user, merge_state)
 
             self._log_audit_action(
                 'repo.pull_request.merge',
                 {'merge_state': merge_state.__dict__},
                 user, pull_request)
 
         else:
             log.warn("Merge failed, not updating the pull request.")
         return merge_state
 
     def _merge_pull_request(self, pull_request, user, extras, merge_msg=None):
         target_vcs = pull_request.target_repo.scm_instance()
         source_vcs = pull_request.source_repo.scm_instance()
 
         message = safe_unicode(merge_msg or vcs_settings.MERGE_MESSAGE_TMPL).format(
             pr_id=pull_request.pull_request_id,
             pr_title=pull_request.title,
             source_repo=source_vcs.name,
             source_ref_name=pull_request.source_ref_parts.name,
             target_repo=target_vcs.name,
             target_ref_name=pull_request.target_ref_parts.name,
         )
 
         workspace_id = self._workspace_id(pull_request)
         repo_id = pull_request.target_repo.repo_id
         use_rebase = self._use_rebase_for_merging(pull_request)
         close_branch = self._close_branch_before_merging(pull_request)
 
         target_ref = self._refresh_reference(
             pull_request.target_ref_parts, target_vcs)
 
         callback_daemon, extras = prepare_callback_daemon(
             extras, protocol=vcs_settings.HOOKS_PROTOCOL,
             host=vcs_settings.HOOKS_HOST,
             use_direct_calls=vcs_settings.HOOKS_DIRECT_CALLS)
 
         with callback_daemon:
             # TODO: johbo: Implement a clean way to run a config_override
             # for a single call.
             target_vcs.config.set(
                 'rhodecode', 'RC_SCM_DATA', json.dumps(extras))
 
             user_name = user.short_contact
             merge_state = target_vcs.merge(
                 repo_id, workspace_id, target_ref, source_vcs,
                 pull_request.source_ref_parts,
                 user_name=user_name, user_email=user.email,
                 message=message, use_rebase=use_rebase,
                 close_branch=close_branch)
         return merge_state
 
     def _comment_and_close_pr(self, pull_request, user, merge_state, close_msg=None):
         pull_request.merge_rev = merge_state.merge_ref.commit_id
         pull_request.updated_on = datetime.datetime.now()
         close_msg = close_msg or 'Pull request merged and closed'
 
         CommentsModel().create(
             text=safe_unicode(close_msg),
             repo=pull_request.target_repo.repo_id,
             user=user.user_id,
             pull_request=pull_request.pull_request_id,
             f_path=None,
             line_no=None,
             closing_pr=True
         )
 
         Session().add(pull_request)
         Session().flush()
         # TODO: paris: replace invalidation with less radical solution
         ScmModel().mark_for_invalidation(
             pull_request.target_repo.repo_name)
         self._trigger_pull_request_hook(pull_request, user, 'merge')
 
     def has_valid_update_type(self, pull_request):
         source_ref_type = pull_request.source_ref_parts.type
-        return source_ref_type in ['book', 'branch', 'tag']
+        return source_ref_type in self.REF_TYPES
 
     def update_commits(self, pull_request):
         """
         Get the updated list of commits for the pull request
         and return the new pull request version and the list
         of commits processed by this update action
         """
         pull_request = self.__get_pull_request(pull_request)
         source_ref_type = pull_request.source_ref_parts.type
         source_ref_name = pull_request.source_ref_parts.name
         source_ref_id = pull_request.source_ref_parts.commit_id
 
         target_ref_type = pull_request.target_ref_parts.type
         target_ref_name = pull_request.target_ref_parts.name
         target_ref_id = pull_request.target_ref_parts.commit_id
 
         if not self.has_valid_update_type(pull_request):
             log.debug(
                 "Skipping update of pull request %s due to ref type: %s",
                 pull_request, source_ref_type)
             return UpdateResponse(
                 executed=False,
                 reason=UpdateFailureReason.WRONG_REF_TYPE,
                 old=pull_request, new=None, changes=None,
                 source_changed=False, target_changed=False)
 
         # source repo
         source_repo = pull_request.source_repo.scm_instance()
         try:
             source_commit = source_repo.get_commit(commit_id=source_ref_name)
         except CommitDoesNotExistError:
             return UpdateResponse(
                 executed=False,
                 reason=UpdateFailureReason.MISSING_SOURCE_REF,
                 old=pull_request, new=None, changes=None,
                 source_changed=False, target_changed=False)
 
         source_changed = source_ref_id != source_commit.raw_id
 
         # target repo
         target_repo = pull_request.target_repo.scm_instance()
         try:
             target_commit = target_repo.get_commit(commit_id=target_ref_name)
         except CommitDoesNotExistError:
             return UpdateResponse(
                 executed=False,
                 reason=UpdateFailureReason.MISSING_TARGET_REF,
                 old=pull_request, new=None, changes=None,
                 source_changed=False, target_changed=False)
         target_changed = target_ref_id != target_commit.raw_id
 
         if not (source_changed or target_changed):
             log.debug("Nothing changed in pull request %s", pull_request)
             return UpdateResponse(
                 executed=False,
                 reason=UpdateFailureReason.NO_CHANGE,
                 old=pull_request, new=None, changes=None,
                 source_changed=target_changed, target_changed=source_changed)
 
         change_in_found = 'target repo' if target_changed else 'source repo'
         log.debug('Updating pull request because of change in %s detected',
                   change_in_found)
 
         # Finally there is a need for an update, in case of source change
         # we create a new version, else just an update
         if source_changed:
             pull_request_version = self._create_version_from_snapshot(pull_request)
             self._link_comments_to_version(pull_request_version)
         else:
             try:
                 ver = pull_request.versions[-1]
             except IndexError:
                 ver = None
 
             pull_request.pull_request_version_id = \
                 ver.pull_request_version_id if ver else None
             pull_request_version = pull_request
 
         try:
-            if target_ref_type in ('tag', 'branch', 'book'):
+            if target_ref_type in self.REF_TYPES:
                 target_commit = target_repo.get_commit(target_ref_name)
             else:
                 target_commit = target_repo.get_commit(target_ref_id)
         except CommitDoesNotExistError:
             return UpdateResponse(
                 executed=False,
                 reason=UpdateFailureReason.MISSING_TARGET_REF,
                 old=pull_request, new=None, changes=None,
                 source_changed=source_changed, target_changed=target_changed)
 
         # re-compute commit ids
         old_commit_ids = pull_request.revisions
         pre_load = ["author", "branch", "date", "message"]
         commit_ranges = target_repo.compare(
             target_commit.raw_id, source_commit.raw_id, source_repo, merge=True,
             pre_load=pre_load)
 
         ancestor = target_repo.get_common_ancestor(
             target_commit.raw_id, source_commit.raw_id, source_repo)
 
         pull_request.source_ref = '%s:%s:%s' % (
             source_ref_type, source_ref_name, source_commit.raw_id)
         pull_request.target_ref = '%s:%s:%s' % (
             target_ref_type, target_ref_name, ancestor)
 
         pull_request.revisions = [
             commit.raw_id for commit in reversed(commit_ranges)]
         pull_request.updated_on = datetime.datetime.now()
         Session().add(pull_request)
         new_commit_ids = pull_request.revisions
 
         old_diff_data, new_diff_data = self._generate_update_diffs(
             pull_request, pull_request_version)
 
         # calculate commit and file changes
         changes = self._calculate_commit_id_changes(
             old_commit_ids, new_commit_ids)
         file_changes = self._calculate_file_changes(
             old_diff_data, new_diff_data)
 
         # set comments as outdated if DIFFS changed
         CommentsModel().outdate_comments(
             pull_request, old_diff_data=old_diff_data,
             new_diff_data=new_diff_data)
 
         commit_changes = (changes.added or changes.removed)
         file_node_changes = (
             file_changes.added or file_changes.modified or file_changes.removed)
         pr_has_changes = commit_changes or file_node_changes
 
         # Add an automatic comment to the pull request, in case
         # anything has changed
         if pr_has_changes:
             update_comment = CommentsModel().create(
                 text=self._render_update_message(changes, file_changes),
                 repo=pull_request.target_repo,
                 user=pull_request.author,
                 pull_request=pull_request,
                 send_email=False, renderer=DEFAULT_COMMENTS_RENDERER)
 
             # Update status to "Under Review" for added commits
             for commit_id in changes.added:
                 ChangesetStatusModel().set_status(
                     repo=pull_request.source_repo,
                     status=ChangesetStatus.STATUS_UNDER_REVIEW,
                     comment=update_comment,
                     user=pull_request.author,
                     pull_request=pull_request,
                     revision=commit_id)
 
         log.debug(
             'Updated pull request %s, added_ids: %s, common_ids: %s, '
             'removed_ids: %s', pull_request.pull_request_id,
             changes.added, changes.common, changes.removed)
         log.debug(
             'Updated pull request with the following file changes: %s',
             file_changes)
 
         log.info(
             "Updated pull request %s from commit %s to commit %s, "
             "stored new version %s of this pull request.",
             pull_request.pull_request_id, source_ref_id,
             pull_request.source_ref_parts.commit_id,
             pull_request_version.pull_request_version_id)
         Session().commit()
         self._trigger_pull_request_hook(
             pull_request, pull_request.author, 'update')
 
         return UpdateResponse(
             executed=True, reason=UpdateFailureReason.NONE,
             old=pull_request, new=pull_request_version, changes=changes,
             source_changed=source_changed, target_changed=target_changed)
 
     def _create_version_from_snapshot(self, pull_request):
         version = PullRequestVersion()
         version.title = pull_request.title
         version.description = pull_request.description
         version.status = pull_request.status
         version.created_on = datetime.datetime.now()
         version.updated_on = pull_request.updated_on
         version.user_id = pull_request.user_id
         version.source_repo = pull_request.source_repo
         version.source_ref = pull_request.source_ref
         version.target_repo = pull_request.target_repo
         version.target_ref = pull_request.target_ref
 
         version._last_merge_source_rev = pull_request._last_merge_source_rev
         version._last_merge_target_rev = pull_request._last_merge_target_rev
         version.last_merge_status = pull_request.last_merge_status
         version.shadow_merge_ref = pull_request.shadow_merge_ref
         version.merge_rev = pull_request.merge_rev
         version.reviewer_data = pull_request.reviewer_data
 
         version.revisions = pull_request.revisions
         version.pull_request = pull_request
         Session().add(version)
         Session().flush()
 
         return version
 
     def _generate_update_diffs(self, pull_request, pull_request_version):
 
         diff_context = (
             self.DIFF_CONTEXT +
             CommentsModel.needed_extra_diff_context())
         hide_whitespace_changes = False
         source_repo = pull_request_version.source_repo
         source_ref_id = pull_request_version.source_ref_parts.commit_id
         target_ref_id = pull_request_version.target_ref_parts.commit_id
         old_diff = self._get_diff_from_pr_or_version(
             source_repo, source_ref_id, target_ref_id,
             hide_whitespace_changes=hide_whitespace_changes, diff_context=diff_context)
 
         source_repo = pull_request.source_repo
         source_ref_id = pull_request.source_ref_parts.commit_id
         target_ref_id = pull_request.target_ref_parts.commit_id
 
         new_diff = self._get_diff_from_pr_or_version(
             source_repo, source_ref_id, target_ref_id,
             hide_whitespace_changes=hide_whitespace_changes, diff_context=diff_context)
 
         old_diff_data = diffs.DiffProcessor(old_diff)
         old_diff_data.prepare()
         new_diff_data = diffs.DiffProcessor(new_diff)
         new_diff_data.prepare()
 
         return old_diff_data, new_diff_data
 
     def _link_comments_to_version(self, pull_request_version):
         """
         Link all unlinked comments of this pull request to the given version.
 
         :param pull_request_version: The `PullRequestVersion` to which
             the comments shall be linked.
 
         """
         pull_request = pull_request_version.pull_request
         comments = ChangesetComment.query()\
             .filter(
                 # TODO: johbo: Should we query for the repo at all here?
                 # Pending decision on how comments of PRs are to be related
                 # to either the source repo, the target repo or no repo at all.
                 ChangesetComment.repo_id == pull_request.target_repo.repo_id,
                 ChangesetComment.pull_request == pull_request,
                 ChangesetComment.pull_request_version == None)\
             .order_by(ChangesetComment.comment_id.asc())
 
         # TODO: johbo: Find out why this breaks if it is done in a bulk
         # operation.
         for comment in comments:
             comment.pull_request_version_id = (
                 pull_request_version.pull_request_version_id)
             Session().add(comment)
 
     def _calculate_commit_id_changes(self, old_ids, new_ids):
         added = [x for x in new_ids if x not in old_ids]
         common = [x for x in new_ids if x in old_ids]
         removed = [x for x in old_ids if x not in new_ids]
         total = new_ids
         return ChangeTuple(added, common, removed, total)
 
     def _calculate_file_changes(self, old_diff_data, new_diff_data):
 
         old_files = OrderedDict()
         for diff_data in old_diff_data.parsed_diff:
             old_files[diff_data['filename']] = md5_safe(diff_data['raw_diff'])
 
         added_files = []
         modified_files = []
         removed_files = []
         for diff_data in new_diff_data.parsed_diff:
             new_filename = diff_data['filename']
             new_hash = md5_safe(diff_data['raw_diff'])
 
             old_hash = old_files.get(new_filename)
             if not old_hash:
                 # file is not present in old diff, means it's added
                 added_files.append(new_filename)
             else:
                 if new_hash != old_hash:
                     modified_files.append(new_filename)
                 # now remove a file from old, since we have seen it already
                 del old_files[new_filename]
 
         # removed files is when there are present in old, but not in NEW,
         # since we remove old files that are present in new diff, left-overs
         # if any should be the removed files
         removed_files.extend(old_files.keys())
 
         return FileChangeTuple(added_files, modified_files, removed_files)
 
     def _render_update_message(self, changes, file_changes):
         """
         render the message using DEFAULT_COMMENTS_RENDERER (RST renderer),
         so it's always looking the same disregarding on which default
         renderer system is using.
 
         :param changes: changes named tuple
         :param file_changes: file changes named tuple
 
         """
         new_status = ChangesetStatus.get_status_lbl(
             ChangesetStatus.STATUS_UNDER_REVIEW)
 
         changed_files = (
             file_changes.added + file_changes.modified + file_changes.removed)
 
         params = {
             'under_review_label': new_status,
             'added_commits': changes.added,
             'removed_commits': changes.removed,
             'changed_files': changed_files,
             'added_files': file_changes.added,
             'modified_files': file_changes.modified,
             'removed_files': file_changes.removed,
         }
         renderer = RstTemplateRenderer()
         return renderer.render('pull_request_update.mako', **params)
 
     def edit(self, pull_request, title, description, description_renderer, user):
         pull_request = self.__get_pull_request(pull_request)
         old_data = pull_request.get_api_data(with_merge_state=False)
         if pull_request.is_closed():
             raise ValueError('This pull request is closed')
         if title:
             pull_request.title = title
         pull_request.description = description
         pull_request.updated_on = datetime.datetime.now()
         pull_request.description_renderer = description_renderer
         Session().add(pull_request)
         self._log_audit_action(
             'repo.pull_request.edit', {'old_data': old_data},
             user, pull_request)
 
     def update_reviewers(self, pull_request, reviewer_data, user):
         """
         Update the reviewers in the pull request
 
         :param pull_request: the pr to update
         :param reviewer_data: list of tuples
             [(user, ['reason1', 'reason2'], mandatory_flag, [rules])]
         """
         pull_request = self.__get_pull_request(pull_request)
         if pull_request.is_closed():
             raise ValueError('This pull request is closed')
 
         reviewers = {}
         for user_id, reasons, mandatory, rules in reviewer_data:
             if isinstance(user_id, (int, basestring)):
                 user_id = self._get_user(user_id).user_id
             reviewers[user_id] = {
                 'reasons': reasons, 'mandatory': mandatory}
 
         reviewers_ids = set(reviewers.keys())
         current_reviewers = PullRequestReviewers.query()\
             .filter(PullRequestReviewers.pull_request ==
                     pull_request).all()
         current_reviewers_ids = set([x.user.user_id for x in current_reviewers])
 
         ids_to_add = reviewers_ids.difference(current_reviewers_ids)
         ids_to_remove = current_reviewers_ids.difference(reviewers_ids)
 
         log.debug("Adding %s reviewers", ids_to_add)
         log.debug("Removing %s reviewers", ids_to_remove)
         changed = False
         for uid in ids_to_add:
             changed = True
             _usr = self._get_user(uid)
             reviewer = PullRequestReviewers()
             reviewer.user = _usr
             reviewer.pull_request = pull_request
             reviewer.reasons = reviewers[uid]['reasons']
             # NOTE(marcink): mandatory shouldn't be changed now
             # reviewer.mandatory = reviewers[uid]['reasons']
             Session().add(reviewer)
             self._log_audit_action(
                 'repo.pull_request.reviewer.add', {'data': reviewer.get_dict()},
                 user, pull_request)
 
         for uid in ids_to_remove:
             changed = True
             reviewers = PullRequestReviewers.query()\
                 .filter(PullRequestReviewers.user_id == uid,
                         PullRequestReviewers.pull_request == pull_request)\
                 .all()
             # use .all() in case we accidentally added the same person twice
             # this CAN happen due to the lack of DB checks
             for obj in reviewers:
                 old_data = obj.get_dict()
                 Session().delete(obj)
                 self._log_audit_action(
                     'repo.pull_request.reviewer.delete',
                     {'old_data': old_data}, user, pull_request)
 
         if changed:
             pull_request.updated_on = datetime.datetime.now()
             Session().add(pull_request)
 
         self.notify_reviewers(pull_request, ids_to_add)
         return ids_to_add, ids_to_remove
 
     def get_url(self, pull_request, request=None, permalink=False):
         if not request:
             request = get_current_request()
 
         if permalink:
             return request.route_url(
                 'pull_requests_global',
                 pull_request_id=pull_request.pull_request_id,)
         else:
             return request.route_url('pullrequest_show',
                 repo_name=safe_str(pull_request.target_repo.repo_name),
                 pull_request_id=pull_request.pull_request_id,)
 
     def get_shadow_clone_url(self, pull_request, request=None):
         """
         Returns qualified url pointing to the shadow repository. If this pull
         request is closed there is no shadow repository and ``None`` will be
         returned.
         """
         if pull_request.is_closed():
             return None
         else:
             pr_url = urllib.unquote(self.get_url(pull_request, request=request))
             return safe_unicode('{pr_url}/repository'.format(pr_url=pr_url))
 
     def notify_reviewers(self, pull_request, reviewers_ids):
         # notification to reviewers
         if not reviewers_ids:
             return
 
         pull_request_obj = pull_request
         # get the current participants of this pull request
         recipients = reviewers_ids
         notification_type = EmailNotificationModel.TYPE_PULL_REQUEST
 
         pr_source_repo = pull_request_obj.source_repo
         pr_target_repo = pull_request_obj.target_repo
 
         pr_url = h.route_url('pullrequest_show',
             repo_name=pr_target_repo.repo_name,
             pull_request_id=pull_request_obj.pull_request_id,)
 
         # set some variables for email notification
         pr_target_repo_url = h.route_url(
             'repo_summary', repo_name=pr_target_repo.repo_name)
 
         pr_source_repo_url = h.route_url(
             'repo_summary', repo_name=pr_source_repo.repo_name)
 
         # pull request specifics
         pull_request_commits = [
             (x.raw_id, x.message)
             for x in map(pr_source_repo.get_commit, pull_request.revisions)]
 
         kwargs = {
             'user': pull_request.author,
             'pull_request': pull_request_obj,
             'pull_request_commits': pull_request_commits,
 
             'pull_request_target_repo': pr_target_repo,
             'pull_request_target_repo_url': pr_target_repo_url,
 
             'pull_request_source_repo': pr_source_repo,
             'pull_request_source_repo_url': pr_source_repo_url,
 
             'pull_request_url': pr_url,
         }
 
         # pre-generate the subject for notification itself
         (subject,
          _h, _e,  # we don't care about those
          body_plaintext) = EmailNotificationModel().render_email(
             notification_type, **kwargs)
 
         # create notification objects, and emails
         NotificationModel().create(
             created_by=pull_request.author,
             notification_subject=subject,
             notification_body=body_plaintext,
             notification_type=notification_type,
             recipients=recipients,
             email_kwargs=kwargs,
         )
 
     def delete(self, pull_request, user):
         pull_request = self.__get_pull_request(pull_request)
         old_data = pull_request.get_api_data(with_merge_state=False)
         self._cleanup_merge_workspace(pull_request)
         self._log_audit_action(
             'repo.pull_request.delete', {'old_data': old_data},
             user, pull_request)
         Session().delete(pull_request)
 
     def close_pull_request(self, pull_request, user):
         pull_request = self.__get_pull_request(pull_request)
         self._cleanup_merge_workspace(pull_request)
         pull_request.status = PullRequest.STATUS_CLOSED
         pull_request.updated_on = datetime.datetime.now()
         Session().add(pull_request)
         self._trigger_pull_request_hook(
             pull_request, pull_request.author, 'close')
 
         pr_data = pull_request.get_api_data(with_merge_state=False)
         self._log_audit_action(
             'repo.pull_request.close', {'data': pr_data}, user, pull_request)
 
     def close_pull_request_with_comment(
             self, pull_request, user, repo, message=None, auth_user=None):
 
         pull_request_review_status = pull_request.calculated_review_status()
 
         if pull_request_review_status == ChangesetStatus.STATUS_APPROVED:
             # approved only if we have voting consent
             status = ChangesetStatus.STATUS_APPROVED
         else:
             status = ChangesetStatus.STATUS_REJECTED
         status_lbl = ChangesetStatus.get_status_lbl(status)
 
         default_message = (
             'Closing with status change {transition_icon} {status}.'
         ).format(transition_icon='>', status=status_lbl)
         text = message or default_message
 
         # create a comment, and link it to new status
         comment = CommentsModel().create(
             text=text,
             repo=repo.repo_id,
             user=user.user_id,
             pull_request=pull_request.pull_request_id,
             status_change=status_lbl,
             status_change_type=status,
             closing_pr=True,
             auth_user=auth_user,
         )
 
         # calculate old status before we change it
         old_calculated_status = pull_request.calculated_review_status()
         ChangesetStatusModel().set_status(
             repo.repo_id,
             status,
             user.user_id,
             comment=comment,
             pull_request=pull_request.pull_request_id
         )
 
         Session().flush()
         events.trigger(events.PullRequestCommentEvent(pull_request, comment))
         # we now calculate the status of pull request again, and based on that
         # calculation trigger status change. This might happen in cases
         # that non-reviewer admin closes a pr, which means his vote doesn't
         # change the status, while if he's a reviewer this might change it.
         calculated_status = pull_request.calculated_review_status()
         if old_calculated_status != calculated_status:
             self._trigger_pull_request_hook(
                 pull_request, user, 'review_status_change')
 
         # finally close the PR
         PullRequestModel().close_pull_request(
             pull_request.pull_request_id, user)
 
         return comment, status
 
     def merge_status(self, pull_request, translator=None,
                      force_shadow_repo_refresh=False):
         _ = translator or get_current_request().translate
 
         if not self._is_merge_enabled(pull_request):
             return False, _('Server-side pull request merging is disabled.')
         if pull_request.is_closed():
             return False, _('This pull request is closed.')
         merge_possible, msg = self._check_repo_requirements(
             target=pull_request.target_repo, source=pull_request.source_repo,
             translator=_)
         if not merge_possible:
             return merge_possible, msg
 
         try:
             resp = self._try_merge(
                 pull_request,
                 force_shadow_repo_refresh=force_shadow_repo_refresh)
             log.debug("Merge response: %s", resp)
             status = resp.possible, resp.merge_status_message
         except NotImplementedError:
             status = False, _('Pull request merging is not supported.')
 
         return status
 
     def _check_repo_requirements(self, target, source, translator):
         """
         Check if `target` and `source` have compatible requirements.
 
         Currently this is just checking for largefiles.
         """
         _ = translator
         target_has_largefiles = self._has_largefiles(target)
         source_has_largefiles = self._has_largefiles(source)
         merge_possible = True
         message = u''
 
         if target_has_largefiles != source_has_largefiles:
             merge_possible = False
             if source_has_largefiles:
                 message = _(
                     'Target repository large files support is disabled.')
             else:
                 message = _(
                     'Source repository large files support is disabled.')
 
         return merge_possible, message
 
     def _has_largefiles(self, repo):
         largefiles_ui = VcsSettingsModel(repo=repo).get_ui_settings(
             'extensions', 'largefiles')
         return largefiles_ui and largefiles_ui[0].active
 
     def _try_merge(self, pull_request, force_shadow_repo_refresh=False):
         """
         Try to merge the pull request and return the merge status.
         """
         log.debug(
             "Trying out if the pull request %s can be merged. Force_refresh=%s",
             pull_request.pull_request_id, force_shadow_repo_refresh)
         target_vcs = pull_request.target_repo.scm_instance()
         # Refresh the target reference.
         try:
             target_ref = self._refresh_reference(
                 pull_request.target_ref_parts, target_vcs)
         except CommitDoesNotExistError:
             merge_state = MergeResponse(
                 False, False, None, MergeFailureReason.MISSING_TARGET_REF,
                 metadata={'target_ref': pull_request.target_ref_parts})
             return merge_state
 
         target_locked = pull_request.target_repo.locked
         if target_locked and target_locked[0]:
             locked_by = 'user:{}'.format(target_locked[0])
             log.debug("The target repository is locked by %s.", locked_by)
             merge_state = MergeResponse(
                 False, False, None, MergeFailureReason.TARGET_IS_LOCKED,
                 metadata={'locked_by': locked_by})
         elif force_shadow_repo_refresh or self._needs_merge_state_refresh(
                 pull_request, target_ref):
             log.debug("Refreshing the merge status of the repository.")
             merge_state = self._refresh_merge_state(
                 pull_request, target_vcs, target_ref)
         else:
             possible = pull_request.\
                 last_merge_status == MergeFailureReason.NONE
             merge_state = MergeResponse(
                 possible, False, None, pull_request.last_merge_status)
 
         return merge_state
 
     def _refresh_reference(self, reference, vcs_repository):
-        if reference.type in ('branch', 'book'):
+        if reference.type in self.UPDATABLE_REF_TYPES:
             name_or_id = reference.name
         else:
             name_or_id = reference.commit_id
         refreshed_commit = vcs_repository.get_commit(name_or_id)
         refreshed_reference = Reference(
             reference.type, reference.name, refreshed_commit.raw_id)
         return refreshed_reference
 
     def _needs_merge_state_refresh(self, pull_request, target_reference):
         return not(
             pull_request.revisions and
             pull_request.revisions[0] == pull_request._last_merge_source_rev and
             target_reference.commit_id == pull_request._last_merge_target_rev)
 
     def _refresh_merge_state(self, pull_request, target_vcs, target_reference):
         workspace_id = self._workspace_id(pull_request)
         source_vcs = pull_request.source_repo.scm_instance()
         repo_id = pull_request.target_repo.repo_id
         use_rebase = self._use_rebase_for_merging(pull_request)
         close_branch = self._close_branch_before_merging(pull_request)
         merge_state = target_vcs.merge(
             repo_id, workspace_id,
             target_reference, source_vcs, pull_request.source_ref_parts,
             dry_run=True, use_rebase=use_rebase,
             close_branch=close_branch)
 
         # Do not store the response if there was an unknown error.
         if merge_state.failure_reason != MergeFailureReason.UNKNOWN:
             pull_request._last_merge_source_rev = \
                 pull_request.source_ref_parts.commit_id
             pull_request._last_merge_target_rev = target_reference.commit_id
             pull_request.last_merge_status = merge_state.failure_reason
             pull_request.shadow_merge_ref = merge_state.merge_ref
             Session().add(pull_request)
             Session().commit()
 
         return merge_state
 
     def _workspace_id(self, pull_request):
         workspace_id = 'pr-%s' % pull_request.pull_request_id
         return workspace_id
 
     def generate_repo_data(self, repo, commit_id=None, branch=None,
                            bookmark=None, translator=None):
         from rhodecode.model.repo import RepoModel
 
         all_refs, selected_ref = \
             self._get_repo_pullrequest_sources(
                 repo.scm_instance(), commit_id=commit_id,
                 branch=branch, bookmark=bookmark, translator=translator)
 
         refs_select2 = []
         for element in all_refs:
             children = [{'id': x[0], 'text': x[1]} for x in element[0]]
             refs_select2.append({'text': element[1], 'children': children})
 
         return {
             'user': {
                 'user_id': repo.user.user_id,
                 'username': repo.user.username,
                 'firstname': repo.user.first_name,
                 'lastname': repo.user.last_name,
                 'gravatar_link': h.gravatar_url(repo.user.email, 14),
             },
             'name': repo.repo_name,
             'link': RepoModel().get_url(repo),
             'description': h.chop_at_smart(repo.description_safe, '\n'),
             'refs': {
                 'all_refs': all_refs,
                 'selected_ref': selected_ref,
                 'select2_refs': refs_select2
             }
         }
 
     def generate_pullrequest_title(self, source, source_ref, target):
         return u'{source}#{at_ref} to {target}'.format(
             source=source,
             at_ref=source_ref,
             target=target,
         )
 
     def _cleanup_merge_workspace(self, pull_request):
         # Merging related cleanup
         repo_id = pull_request.target_repo.repo_id
         target_scm = pull_request.target_repo.scm_instance()
         workspace_id = self._workspace_id(pull_request)
 
         try:
             target_scm.cleanup_merge_workspace(repo_id, workspace_id)
         except NotImplementedError:
             pass
 
     def _get_repo_pullrequest_sources(
             self, repo, commit_id=None, branch=None, bookmark=None,
             translator=None):
         """
         Return a structure with repo's interesting commits, suitable for
         the selectors in pullrequest controller
 
         :param commit_id: a commit that must be in the list somehow
             and selected by default
         :param branch: a branch that must be in the list and selected
             by default - even if closed
         :param bookmark: a bookmark that must be in the list and selected
         """
         _ = translator or get_current_request().translate
 
         commit_id = safe_str(commit_id) if commit_id else None
         branch = safe_str(branch) if branch else None
         bookmark = safe_str(bookmark) if bookmark else None
 
         selected = None
 
         # order matters: first source that has commit_id in it will be selected
         sources = []
         sources.append(('book', repo.bookmarks.items(), _('Bookmarks'), bookmark))
         sources.append(('branch', repo.branches.items(), _('Branches'), branch))
 
         if commit_id:
             ref_commit = (h.short_id(commit_id), commit_id)
             sources.append(('rev', [ref_commit], _('Commit IDs'), commit_id))
 
         sources.append(
             ('branch', repo.branches_closed.items(), _('Closed Branches'), branch),
         )
 
         groups = []
         for group_key, ref_list, group_name, match in sources:
             group_refs = []
             for ref_name, ref_id in ref_list:
                 ref_key = '%s:%s:%s' % (group_key, ref_name, ref_id)
                 group_refs.append((ref_key, ref_name))
 
                 if not selected:
                     if set([commit_id, match]) & set([ref_id, ref_name]):
                         selected = ref_key
 
             if group_refs:
                 groups.append((group_refs, group_name))
 
         if not selected:
             ref = commit_id or branch or bookmark
             if ref:
                 raise CommitDoesNotExistError(
                     'No commit refs could be found matching: %s' % ref)
             elif repo.DEFAULT_BRANCH_NAME in repo.branches:
                 selected = 'branch:%s:%s' % (
                     repo.DEFAULT_BRANCH_NAME,
                     repo.branches[repo.DEFAULT_BRANCH_NAME]
                 )
             elif repo.commit_ids:
                 # make the user select in this case
                 selected = None
             else:
                 raise EmptyRepositoryError()
         return groups, selected
 
     def get_diff(self, source_repo, source_ref_id, target_ref_id,
                  hide_whitespace_changes, diff_context):
 
         return self._get_diff_from_pr_or_version(
             source_repo, source_ref_id, target_ref_id,
             hide_whitespace_changes=hide_whitespace_changes, diff_context=diff_context)
 
     def _get_diff_from_pr_or_version(
             self, source_repo, source_ref_id, target_ref_id,
             hide_whitespace_changes, diff_context):
 
         target_commit = source_repo.get_commit(
             commit_id=safe_str(target_ref_id))
         source_commit = source_repo.get_commit(
             commit_id=safe_str(source_ref_id))
         if isinstance(source_repo, Repository):
             vcs_repo = source_repo.scm_instance()
         else:
             vcs_repo = source_repo
 
         # TODO: johbo: In the context of an update, we cannot reach
         # the old commit anymore with our normal mechanisms. It needs
         # some sort of special support in the vcs layer to avoid this
         # workaround.
         if (source_commit.raw_id == vcs_repo.EMPTY_COMMIT_ID and
                 vcs_repo.alias == 'git'):
             source_commit.raw_id = safe_str(source_ref_id)
 
         log.debug('calculating diff between '
                   'source_ref:%s and target_ref:%s for repo `%s`',
                   target_ref_id, source_ref_id,
                   safe_unicode(vcs_repo.path))
 
         vcs_diff = vcs_repo.get_diff(
             commit1=target_commit, commit2=source_commit,
             ignore_whitespace=hide_whitespace_changes, context=diff_context)
         return vcs_diff
 
     def _is_merge_enabled(self, pull_request):
         return self._get_general_setting(
             pull_request, 'rhodecode_pr_merge_enabled')
 
     def _use_rebase_for_merging(self, pull_request):
         repo_type = pull_request.target_repo.repo_type
         if repo_type == 'hg':
             return self._get_general_setting(
                 pull_request, 'rhodecode_hg_use_rebase_for_merging')
         elif repo_type == 'git':
             return self._get_general_setting(
                 pull_request, 'rhodecode_git_use_rebase_for_merging')
 
         return False
 
     def _close_branch_before_merging(self, pull_request):
         repo_type = pull_request.target_repo.repo_type
         if repo_type == 'hg':
             return self._get_general_setting(
                 pull_request, 'rhodecode_hg_close_branch_before_merging')
         elif repo_type == 'git':
             return self._get_general_setting(
                 pull_request, 'rhodecode_git_close_branch_before_merging')
 
         return False
 
     def _get_general_setting(self, pull_request, settings_key, default=False):
         settings_model = VcsSettingsModel(repo=pull_request.target_repo)
         settings = settings_model.get_general_settings()
         return settings.get(settings_key, default)
 
     def _log_audit_action(self, action, action_data, user, pull_request):
         audit_logger.store(
             action=action,
             action_data=action_data,
             user=user,
             repo=pull_request.target_repo)
 
     def get_reviewer_functions(self):
         """
         Fetches functions for validation and fetching default reviewers.
         If available we use the EE package, else we fallback to CE
         package functions
         """
         try:
             from rc_reviewers.utils import get_default_reviewers_data
             from rc_reviewers.utils import validate_default_reviewers
         except ImportError:
             from rhodecode.apps.repository.utils import get_default_reviewers_data
             from rhodecode.apps.repository.utils import validate_default_reviewers
 
         return get_default_reviewers_data, validate_default_reviewers
 
 
 class MergeCheck(object):
     """
     Perform Merge Checks and returns a check object which stores information
     about merge errors, and merge conditions
     """
     TODO_CHECK = 'todo'
     PERM_CHECK = 'perm'
     REVIEW_CHECK = 'review'
     MERGE_CHECK = 'merge'
 
     def __init__(self):
         self.review_status = None
         self.merge_possible = None
         self.merge_msg = ''
         self.failed = None
         self.errors = []
         self.error_details = OrderedDict()
 
     def push_error(self, error_type, message, error_key, details):
         self.failed = True
         self.errors.append([error_type, message])
         self.error_details[error_key] = dict(
             details=details,
             error_type=error_type,
             message=message
         )
 
     @classmethod
     def validate(cls, pull_request, auth_user, translator, fail_early=False,
                  force_shadow_repo_refresh=False):
         _ = translator
         merge_check = cls()
 
         # permissions to merge
         user_allowed_to_merge = PullRequestModel().check_user_merge(
             pull_request, auth_user)
         if not user_allowed_to_merge:
             log.debug("MergeCheck: cannot merge, approval is pending.")
 
             msg = _('User `{}` not allowed to perform merge.').format(auth_user.username)
             merge_check.push_error('error', msg, cls.PERM_CHECK, auth_user.username)
             if fail_early:
                 return merge_check
 
         # permission to merge into the target branch
         target_commit_id = pull_request.target_ref_parts.commit_id
         if pull_request.target_ref_parts.type == 'branch':
             branch_name = pull_request.target_ref_parts.name
         else:
             # for mercurial we can always figure out the branch from the commit
             # in case of bookmark
             target_commit = pull_request.target_repo.get_commit(target_commit_id)
             branch_name = target_commit.branch
 
         rule, branch_perm = auth_user.get_rule_and_branch_permission(
             pull_request.target_repo.repo_name, branch_name)
         if branch_perm and branch_perm == 'branch.none':
             msg = _('Target branch `{}` changes rejected by rule {}.').format(
                 branch_name, rule)
             merge_check.push_error('error', msg, cls.PERM_CHECK, auth_user.username)
             if fail_early:
                 return merge_check
 
         # review status, must be always present
         review_status = pull_request.calculated_review_status()
         merge_check.review_status = review_status
 
         status_approved = review_status == ChangesetStatus.STATUS_APPROVED
         if not status_approved:
             log.debug("MergeCheck: cannot merge, approval is pending.")
 
             msg = _('Pull request reviewer approval is pending.')
 
             merge_check.push_error(
                 'warning', msg, cls.REVIEW_CHECK, review_status)
 
             if fail_early:
                 return merge_check
 
         # left over TODOs
         todos = CommentsModel().get_unresolved_todos(pull_request)
         if todos:
             log.debug("MergeCheck: cannot merge, {} "
                       "unresolved todos left.".format(len(todos)))
 
             if len(todos) == 1:
                 msg = _('Cannot merge, {} TODO still not resolved.').format(
                     len(todos))
             else:
                 msg = _('Cannot merge, {} TODOs still not resolved.').format(
                     len(todos))
 
             merge_check.push_error('warning', msg, cls.TODO_CHECK, todos)
 
             if fail_early:
                 return merge_check
 
         # merge possible, here is the filesystem simulation + shadow repo
         merge_status, msg = PullRequestModel().merge_status(
             pull_request, translator=translator,
             force_shadow_repo_refresh=force_shadow_repo_refresh)
         merge_check.merge_possible = merge_status
         merge_check.merge_msg = msg
         if not merge_status:
             log.debug(
                 "MergeCheck: cannot merge, pull request merge not possible.")
             merge_check.push_error('warning', msg, cls.MERGE_CHECK, None)
 
             if fail_early:
                 return merge_check
 
         log.debug('MergeCheck: is failed: %s', merge_check.failed)
         return merge_check
 
     @classmethod
     def get_merge_conditions(cls, pull_request, translator):
         _ = translator
         merge_details = {}
 
         model = PullRequestModel()
         use_rebase = model._use_rebase_for_merging(pull_request)
 
         if use_rebase:
             merge_details['merge_strategy'] = dict(
                 details={},
                 message=_('Merge strategy: rebase')
             )
         else:
             merge_details['merge_strategy'] = dict(
                 details={},
                 message=_('Merge strategy: explicit merge commit')
             )
 
         close_branch = model._close_branch_before_merging(pull_request)
         if close_branch:
             repo_type = pull_request.target_repo.repo_type
             if repo_type == 'hg':
                 close_msg = _('Source branch will be closed after merge.')
             elif repo_type == 'git':
                 close_msg = _('Source branch will be deleted after merge.')
 
             merge_details['close_branch'] = dict(
                 details={},
                 message=close_msg
             )
 
         return merge_details
 
 ChangeTuple = collections.namedtuple(
     'ChangeTuple', ['added', 'common', 'removed', 'total'])
 
 FileChangeTuple = collections.namedtuple(
     'FileChangeTuple', ['added', 'modified', 'removed'])

rhodecode/templates/codeblocks/diffs.mako

@@ -1,1023 +1,1025 b''
 <%namespace name="commentblock" file="/changeset/changeset_file_comment.mako"/>
 
 <%def name="diff_line_anchor(commit, filename, line, type)"><%
 return '%s_%s_%i' % (h.md5_safe(commit+filename), type, line)
 %></%def>
 
 <%def name="action_class(action)">
 <%
     return {
         '-': 'cb-deletion',
         '+': 'cb-addition',
         ' ': 'cb-context',
         }.get(action, 'cb-empty')
 %>
 </%def>
 
 <%def name="op_class(op_id)">
 <%
     return {
         DEL_FILENODE: 'deletion', # file deleted
         BIN_FILENODE: 'warning' # binary diff hidden
     }.get(op_id, 'addition')
 %>
 </%def>
 
 
 
 <%def name="render_diffset(diffset, commit=None,
 
     # collapse all file diff entries when there are more than this amount of files in the diff
     collapse_when_files_over=20,
 
     # collapse lines in the diff when more than this amount of lines changed in the file diff
     lines_changed_limit=500,
 
     # add a ruler at to the output
     ruler_at_chars=0,
 
     # show inline comments
     use_comments=False,
 
     # disable new comments
     disable_new_comments=False,
 
     # special file-comments that were deleted in previous versions
     # it's used for showing outdated comments for deleted files in a PR
     deleted_files_comments=None,
 
     # for cache purpose
     inline_comments=None,
 
 )">
 %if use_comments:
 <div id="cb-comments-inline-container-template" class="js-template">
   ${inline_comments_container([], inline_comments)}
 </div>
 <div class="js-template" id="cb-comment-inline-form-template">
     <div class="comment-inline-form ac">
 
     %if c.rhodecode_user.username != h.DEFAULT_USER:
         ## render template for inline comments
         ${commentblock.comment_form(form_type='inline')}
     %else:
         ${h.form('', class_='inline-form comment-form-login', method='get')}
         <div class="pull-left">
             <div class="comment-help pull-right">
               ${_('You need to be logged in to leave comments.')} <a href="${h.route_path('login', _query={'came_from': h.current_route_path(request)})}">${_('Login now')}</a>
             </div>
         </div>
         <div class="comment-button pull-right">
          <button type="button" class="cb-comment-cancel" onclick="return Rhodecode.comments.cancelComment(this);">
           ${_('Cancel')}
          </button>
         </div>
         <div class="clearfix"></div>
         ${h.end_form()}
     %endif
     </div>
 </div>
 
 %endif
 <%
 collapse_all = len(diffset.files) > collapse_when_files_over
 %>
 
 %if c.user_session_attrs["diffmode"] == 'sideside':
 <style>
 .wrapper {
     max-width: 1600px !important;
 }
 </style>
 %endif
 
 %if ruler_at_chars:
 <style>
 .diff table.cb .cb-content:after {
     content: "";
     border-left: 1px solid blue;
     position: absolute;
     top: 0;
     height: 18px;
     opacity: .2;
     z-index: 10;
     //## +5 to account for diff action (+/-)
     left: ${ruler_at_chars + 5}ch;
 </style>
 %endif
 
 <div class="diffset ${disable_new_comments and 'diffset-comments-disabled'}">
     <div class="diffset-heading ${diffset.limited_diff and 'diffset-heading-warning' or ''}">
         %if commit:
             <div class="pull-right">
                 <a class="btn tooltip" title="${h.tooltip(_('Browse Files at revision {}').format(commit.raw_id))}" href="${h.route_path('repo_files',repo_name=diffset.repo_name, commit_id=commit.raw_id, f_path='')}">
                     ${_('Browse Files')}
                 </a>
             </div>
         %endif
         <h2 class="clearinner">
         ## invidual commit
         % if commit:
             <a class="tooltip revision" title="${h.tooltip(commit.message)}" href="${h.route_path('repo_commit',repo_name=diffset.repo_name,commit_id=commit.raw_id)}">${('r%s:%s' % (commit.idx,h.short_id(commit.raw_id)))}</a> -
             ${h.age_component(commit.date)}
             % if diffset.limited_diff:
                 - ${_('The requested commit is too big and content was truncated.')}
                 ${_ungettext('%(num)s file changed.', '%(num)s files changed.', diffset.changed_files) % {'num': diffset.changed_files}}
                 <a href="${h.current_route_path(request, fulldiff=1)}" onclick="return confirm('${_("Showing a big diff might take some time and resources, continue?")}')">${_('Show full diff')}</a>
             % elif hasattr(c, 'commit_ranges') and len(c.commit_ranges) > 1:
                 ## compare diff, has no file-selector and we want to show stats anyway
                ${_ungettext('{num} file changed: {linesadd} inserted, ''{linesdel} deleted',
                             '{num} files changed: {linesadd} inserted, {linesdel} deleted', diffset.changed_files) \
                             .format(num=diffset.changed_files, linesadd=diffset.lines_added, linesdel=diffset.lines_deleted)}
             % endif
         % else:
             ## pull requests/compare
             ${_('File Changes')}
         % endif
 
         </h2>
     </div>
 
     %if diffset.has_hidden_changes:
         <p class="empty_data">${_('Some changes may be hidden')}</p>
     %elif not diffset.files:
         <p class="empty_data">${_('No files')}</p>
     %endif
 
     <div class="filediffs">
 
     ## initial value could be marked as False later on
     <% over_lines_changed_limit = False %>
     %for i, filediff in enumerate(diffset.files):
 
         <%
         lines_changed = filediff.patch['stats']['added'] + filediff.patch['stats']['deleted']
         over_lines_changed_limit = lines_changed > lines_changed_limit
         %>
         ## anchor with support of sticky header
         <div class="anchor" id="a_${h.FID(filediff.raw_id, filediff.patch['filename'])}"></div>
 
         <input ${(collapse_all and 'checked' or '')} class="filediff-collapse-state" id="filediff-collapse-${id(filediff)}" type="checkbox" onchange="updateSticky();">
         <div
             class="filediff"
             data-f-path="${filediff.patch['filename']}"
             data-anchor-id="${h.FID(filediff.raw_id, filediff.patch['filename'])}"
         >
         <label for="filediff-collapse-${id(filediff)}" class="filediff-heading">
             <div class="filediff-collapse-indicator"></div>
             ${diff_ops(filediff)}
         </label>
 
         ${diff_menu(filediff, use_comments=use_comments)}
         <table data-f-path="${filediff.patch['filename']}" data-anchor-id="${h.FID(filediff.raw_id, filediff.patch['filename'])}" class="code-visible-block cb cb-diff-${c.user_session_attrs["diffmode"]} code-highlight ${(over_lines_changed_limit and 'cb-collapsed' or '')}">
 
         ## new/deleted/empty content case
         % if not filediff.hunks:
             ## Comment container, on "fakes" hunk that contains all data to render comments
             ${render_hunk_lines(filediff, c.user_session_attrs["diffmode"], filediff.hunk_ops, use_comments=use_comments, inline_comments=inline_comments)}
         % endif
 
         %if filediff.limited_diff:
                 <tr class="cb-warning cb-collapser">
                     <td class="cb-text" ${(c.user_session_attrs["diffmode"] == 'unified' and 'colspan=4' or 'colspan=6')}>
                         ${_('The requested commit is too big and content was truncated.')} <a href="${h.current_route_path(request, fulldiff=1)}" onclick="return confirm('${_("Showing a big diff might take some time and resources, continue?")}')">${_('Show full diff')}</a>
                     </td>
                 </tr>
         %else:
             %if over_lines_changed_limit:
                     <tr class="cb-warning cb-collapser">
                         <td class="cb-text" ${(c.user_session_attrs["diffmode"] == 'unified' and 'colspan=4' or 'colspan=6')}>
                             ${_('This diff has been collapsed as it changes many lines, (%i lines changed)' % lines_changed)}
                             <a href="#" class="cb-expand"
                                onclick="$(this).closest('table').removeClass('cb-collapsed'); updateSticky(); return false;">${_('Show them')}
                             </a>
                             <a href="#" class="cb-collapse"
                                onclick="$(this).closest('table').addClass('cb-collapsed'); updateSticky(); return false;">${_('Hide them')}
                             </a>
                         </td>
                     </tr>
             %endif
         %endif
 
         % for hunk in filediff.hunks:
             <tr class="cb-hunk">
                 <td ${(c.user_session_attrs["diffmode"] == 'unified' and 'colspan=3' or '')}>
                     ## TODO: dan: add ajax loading of more context here
                     ## <a href="#">
                         <i class="icon-more"></i>
                     ## </a>
                 </td>
                 <td ${(c.user_session_attrs["diffmode"] == 'sideside' and 'colspan=5' or '')}>
                     @@
                     -${hunk.source_start},${hunk.source_length}
                     +${hunk.target_start},${hunk.target_length}
                     ${hunk.section_header}
                 </td>
             </tr>
             ${render_hunk_lines(filediff, c.user_session_attrs["diffmode"], hunk, use_comments=use_comments, inline_comments=inline_comments)}
         % endfor
 
         <% unmatched_comments = (inline_comments or {}).get(filediff.patch['filename'], {}) %>
 
         ## outdated comments that do not fit into currently displayed lines
         % for lineno, comments in unmatched_comments.items():
 
             %if c.user_session_attrs["diffmode"] == 'unified':
                 % if loop.index == 0:
                 <tr class="cb-hunk">
                     <td colspan="3"></td>
                     <td>
                         <div>
                         ${_('Unmatched inline comments below')}
                         </div>
                     </td>
                 </tr>
                 % endif
                 <tr class="cb-line">
                     <td class="cb-data cb-context"></td>
                     <td class="cb-lineno cb-context"></td>
                     <td class="cb-lineno cb-context"></td>
                     <td class="cb-content cb-context">
                         ${inline_comments_container(comments, inline_comments)}
                     </td>
                 </tr>
             %elif c.user_session_attrs["diffmode"] == 'sideside':
                 % if loop.index == 0:
                 <tr class="cb-comment-info">
                     <td colspan="2"></td>
                     <td class="cb-line">
                         <div>
                         ${_('Unmatched inline comments below')}
                         </div>
                     </td>
                     <td colspan="2"></td>
                     <td class="cb-line">
                         <div>
                         ${_('Unmatched comments below')}
                         </div>
                     </td>
                 </tr>
                 % endif
                 <tr class="cb-line">
                     <td class="cb-data cb-context"></td>
                     <td class="cb-lineno cb-context"></td>
                     <td class="cb-content cb-context">
                         % if lineno.startswith('o'):
                             ${inline_comments_container(comments, inline_comments)}
                         % endif
                     </td>
 
                     <td class="cb-data cb-context"></td>
                     <td class="cb-lineno cb-context"></td>
                     <td class="cb-content cb-context">
                         % if lineno.startswith('n'):
                             ${inline_comments_container(comments, inline_comments)}
                         % endif
                     </td>
                 </tr>
             %endif
 
         % endfor
 
             </table>
         </div>
     %endfor
 
     ## outdated comments that are made for a file that has been deleted
     % for filename, comments_dict in (deleted_files_comments or {}).items():
         <%
             display_state = 'display: none'
             open_comments_in_file = [x for x in comments_dict['comments'] if x.outdated is False]
             if open_comments_in_file:
                 display_state = ''
         %>
         <div class="filediffs filediff-outdated" style="${display_state}">
             <input ${(collapse_all and 'checked' or '')} class="filediff-collapse-state" id="filediff-collapse-${id(filename)}" type="checkbox" onchange="updateSticky();">
             <div class="filediff" data-f-path="${filename}"  id="a_${h.FID(filediff.raw_id, filename)}">
                 <label for="filediff-collapse-${id(filename)}" class="filediff-heading">
                     <div class="filediff-collapse-indicator"></div>
                     <span class="pill">
                         ## file was deleted
                         <strong>${filename}</strong>
                     </span>
                     <span class="pill-group" style="float: left">
                         ## file op, doesn't need translation
                         <span class="pill" op="removed">removed in this version</span>
                     </span>
                     <a class="pill filediff-anchor" href="#a_${h.FID(filediff.raw_id, filename)}">¶</a>
                     <span class="pill-group" style="float: right">
                         <span class="pill" op="deleted">-${comments_dict['stats']}</span>
                     </span>
                 </label>
 
                 <table class="cb cb-diff-${c.user_session_attrs["diffmode"]} code-highlight ${over_lines_changed_limit and 'cb-collapsed' or ''}">
                     <tr>
                         % if c.user_session_attrs["diffmode"] == 'unified':
                         <td></td>
                         %endif
 
                         <td></td>
                         <td class="cb-text cb-${op_class(BIN_FILENODE)}" ${(c.user_session_attrs["diffmode"] == 'unified' and 'colspan=4' or 'colspan=5')}>
                         ${_('File was deleted in this version. There are still outdated/unresolved comments attached to it.')}
                         </td>
                     </tr>
                     %if c.user_session_attrs["diffmode"] == 'unified':
                     <tr class="cb-line">
                         <td class="cb-data cb-context"></td>
                         <td class="cb-lineno cb-context"></td>
                         <td class="cb-lineno cb-context"></td>
                         <td class="cb-content cb-context">
                             ${inline_comments_container(comments_dict['comments'], inline_comments)}
                         </td>
                     </tr>
                     %elif c.user_session_attrs["diffmode"] == 'sideside':
                     <tr class="cb-line">
                         <td class="cb-data cb-context"></td>
                         <td class="cb-lineno cb-context"></td>
                         <td class="cb-content cb-context"></td>
 
                         <td class="cb-data cb-context"></td>
                         <td class="cb-lineno cb-context"></td>
                         <td class="cb-content cb-context">
                             ${inline_comments_container(comments_dict['comments'], inline_comments)}
                         </td>
                     </tr>
                     %endif
                 </table>
             </div>
         </div>
     % endfor
 
 </div>
 </div>
 </%def>
 
 <%def name="diff_ops(filediff)">
 <%
 from rhodecode.lib.diffs import NEW_FILENODE, DEL_FILENODE, \
     MOD_FILENODE, RENAMED_FILENODE, CHMOD_FILENODE, BIN_FILENODE, COPIED_FILENODE
 %>
     <span class="pill">
         %if filediff.source_file_path and filediff.target_file_path:
             %if filediff.source_file_path != filediff.target_file_path:
                  ## file was renamed, or copied
                 %if RENAMED_FILENODE in filediff.patch['stats']['ops']:
                     <strong>${filediff.target_file_path}</strong> ⬅ <del>${filediff.source_file_path}</del>
                     <% final_path = filediff.target_file_path %>
                 %elif COPIED_FILENODE in filediff.patch['stats']['ops']:
                     <strong>${filediff.target_file_path}</strong> ⬅ ${filediff.source_file_path}
                     <% final_path = filediff.target_file_path %>
                 %endif
             %else:
                 ## file was modified
                 <strong>${filediff.source_file_path}</strong>
                 <% final_path = filediff.source_file_path %>
             %endif
         %else:
             %if filediff.source_file_path:
                 ## file was deleted
                 <strong>${filediff.source_file_path}</strong>
                 <% final_path = filediff.source_file_path %>
             %else:
                 ## file was added
                 <strong>${filediff.target_file_path}</strong>
                 <% final_path = filediff.target_file_path %>
             %endif
         %endif
         <i style="color: #aaa" class="tooltip icon-clipboard clipboard-action" data-clipboard-text="${final_path}" title="${_('Copy the full path')}" onclick="return false;"></i>
     </span>
     ## anchor link
     <a class="pill filediff-anchor" href="#a_${h.FID(filediff.raw_id, filediff.patch['filename'])}">¶</a>
 
     <span class="pill-group" style="float: right">
 
         ## ops pills
         %if filediff.limited_diff:
         <span class="pill tooltip" op="limited" title="The stats for this diff are not complete">limited diff</span>
         %endif
 
         %if NEW_FILENODE in filediff.patch['stats']['ops']:
         <span class="pill" op="created">created</span>
             %if filediff['target_mode'].startswith('120'):
         <span class="pill" op="symlink">symlink</span>
             %else:
         <span class="pill" op="mode">${nice_mode(filediff['target_mode'])}</span>
             %endif
         %endif
 
         %if RENAMED_FILENODE in filediff.patch['stats']['ops']:
         <span class="pill" op="renamed">renamed</span>
         %endif
 
         %if COPIED_FILENODE in filediff.patch['stats']['ops']:
         <span class="pill" op="copied">copied</span>
         %endif
 
         %if DEL_FILENODE in filediff.patch['stats']['ops']:
         <span class="pill" op="removed">removed</span>
         %endif
 
         %if CHMOD_FILENODE in filediff.patch['stats']['ops']:
         <span class="pill" op="mode">
             ${nice_mode(filediff['source_mode'])} ➡ ${nice_mode(filediff['target_mode'])}
         </span>
         %endif
 
         %if BIN_FILENODE in filediff.patch['stats']['ops']:
         <span class="pill" op="binary">binary</span>
             %if MOD_FILENODE in filediff.patch['stats']['ops']:
         <span class="pill" op="modified">modified</span>
             %endif
         %endif
 
         <span class="pill" op="added">${('+' if filediff.patch['stats']['added'] else '')}${filediff.patch['stats']['added']}</span>
         <span class="pill" op="deleted">${((h.safe_int(filediff.patch['stats']['deleted']) or 0) * -1)}</span>
 
     </span>
 
 </%def>
 
 <%def name="nice_mode(filemode)">
     ${(filemode.startswith('100') and filemode[3:] or filemode)}
 </%def>
 
 <%def name="diff_menu(filediff, use_comments=False)">
     <div class="filediff-menu">
 
     %if filediff.diffset.source_ref:
 
     ## FILE BEFORE CHANGES
     %if filediff.operation in ['D', 'M']:
         <a
             class="tooltip"
             href="${h.route_path('repo_files',repo_name=filediff.diffset.target_repo_name,commit_id=filediff.diffset.source_ref,f_path=filediff.source_file_path)}"
             title="${h.tooltip(_('Show file at commit: %(commit_id)s') % {'commit_id': filediff.diffset.source_ref[:12]})}"
         >
             ${_('Show file before')}
         </a> |
     %else:
         <span
             class="tooltip"
             title="${h.tooltip(_('File not present at commit: %(commit_id)s') % {'commit_id': filediff.diffset.source_ref[:12]})}"
         >
             ${_('Show file before')}
         </span> |
     %endif
 
     ## FILE AFTER CHANGES
     %if filediff.operation in ['A', 'M']:
         <a
             class="tooltip"
             href="${h.route_path('repo_files',repo_name=filediff.diffset.source_repo_name,commit_id=filediff.diffset.target_ref,f_path=filediff.target_file_path)}"
             title="${h.tooltip(_('Show file at commit: %(commit_id)s') % {'commit_id': filediff.diffset.target_ref[:12]})}"
         >
             ${_('Show file after')}
         </a>
     %else:
         <span
             class="tooltip"
             title="${h.tooltip(_('File not present at commit: %(commit_id)s') % {'commit_id': filediff.diffset.target_ref[:12]})}"
             >
             ${_('Show file after')}
         </span>
     %endif
 
     % if use_comments:
     |
     <a href="#" onclick="return Rhodecode.comments.toggleComments(this);">
         <span class="show-comment-button">${_('Show comments')}</span><span class="hide-comment-button">${_('Hide comments')}</span>
     </a>
     % endif
 
     %endif
 
     </div>
 </%def>
 
 
 <%def name="inline_comments_container(comments, inline_comments)">
 <div class="inline-comments">
     %for comment in comments:
         ${commentblock.comment_block(comment, inline=True)}
     %endfor
     % if comments and comments[-1].outdated:
     <span class="btn btn-secondary cb-comment-add-button comment-outdated}"
           style="display: none;}">
         ${_('Add another comment')}
     </span>
     % else:
     <span onclick="return Rhodecode.comments.createComment(this)"
           class="btn btn-secondary cb-comment-add-button">
         ${_('Add another comment')}
     </span>
     % endif
 
 </div>
 </%def>
 
 <%!
 def get_comments_for(diff_type, comments, filename, line_version, line_number):
     if hasattr(filename, 'unicode_path'):
         filename = filename.unicode_path
 
     if not isinstance(filename, basestring):
         return None
 
     line_key = '{}{}'.format(line_version, line_number) ## e.g o37, n12
 
     if comments and filename in comments:
         file_comments = comments[filename]
         if line_key in file_comments:
             data = file_comments.pop(line_key)
             return data
 %>
 
 <%def name="render_hunk_lines_sideside(filediff, hunk, use_comments=False, inline_comments=None)">
     %for i, line in enumerate(hunk.sideside):
     <%
     old_line_anchor, new_line_anchor = None, None
 
     if line.original.lineno:
         old_line_anchor = diff_line_anchor(filediff.raw_id, hunk.source_file_path, line.original.lineno, 'o')
     if line.modified.lineno:
         new_line_anchor = diff_line_anchor(filediff.raw_id, hunk.target_file_path, line.modified.lineno, 'n')
     %>
 
     <tr class="cb-line">
         <td class="cb-data ${action_class(line.original.action)}"
             data-line-no="${line.original.lineno}"
             >
             <div>
 
             <% line_old_comments = None %>
             %if line.original.get_comment_args:
                 <% line_old_comments = get_comments_for('side-by-side', inline_comments, *line.original.get_comment_args) %>
             %endif
             %if line_old_comments:
                 <% has_outdated = any([x.outdated for x in line_old_comments]) %>
                 % if has_outdated:
                     <i title="${_('comments including outdated')}:${len(line_old_comments)}" class="icon-comment_toggle" onclick="return Rhodecode.comments.toggleLineComments(this)"></i>
                 % else:
                     <i title="${_('comments')}: ${len(line_old_comments)}" class="icon-comment" onclick="return Rhodecode.comments.toggleLineComments(this)"></i>
                 % endif
             %endif
             </div>
         </td>
         <td class="cb-lineno ${action_class(line.original.action)}"
             data-line-no="${line.original.lineno}"
             %if old_line_anchor:
             id="${old_line_anchor}"
             %endif
         >
             %if line.original.lineno:
             <a name="${old_line_anchor}" href="#${old_line_anchor}">${line.original.lineno}</a>
             %endif
         </td>
         <td class="cb-content ${action_class(line.original.action)}"
             data-line-no="o${line.original.lineno}"
             >
             %if use_comments and line.original.lineno:
             ${render_add_comment_button()}
             %endif
             <span class="cb-code"><span class="cb-action ${action_class(line.original.action)}"></span>${line.original.content or '' | n}</span>
 
             %if use_comments and line.original.lineno and line_old_comments:
                 ${inline_comments_container(line_old_comments, inline_comments)}
             %endif
 
         </td>
         <td class="cb-data ${action_class(line.modified.action)}"
             data-line-no="${line.modified.lineno}"
             >
             <div>
 
             %if line.modified.get_comment_args:
                 <% line_new_comments = get_comments_for('side-by-side', inline_comments, *line.modified.get_comment_args) %>
             %else:
                 <% line_new_comments = None%>
             %endif
             %if line_new_comments:
                 <% has_outdated = any([x.outdated for x in line_new_comments]) %>
                 % if has_outdated:
                     <i title="${_('comments including outdated')}:${len(line_new_comments)}" class="icon-comment_toggle" onclick="return Rhodecode.comments.toggleLineComments(this)"></i>
                 % else:
                     <i title="${_('comments')}: ${len(line_new_comments)}" class="icon-comment" onclick="return Rhodecode.comments.toggleLineComments(this)"></i>
                 % endif
             %endif
             </div>
         </td>
         <td class="cb-lineno ${action_class(line.modified.action)}"
             data-line-no="${line.modified.lineno}"
             %if new_line_anchor:
             id="${new_line_anchor}"
             %endif
             >
             %if line.modified.lineno:
                 <a name="${new_line_anchor}" href="#${new_line_anchor}">${line.modified.lineno}</a>
             %endif
         </td>
         <td class="cb-content ${action_class(line.modified.action)}"
             data-line-no="n${line.modified.lineno}"
             >
             %if use_comments and line.modified.lineno:
             ${render_add_comment_button()}
             %endif
             <span class="cb-code"><span class="cb-action ${action_class(line.modified.action)}"></span>${line.modified.content or '' | n}</span>
             %if use_comments and line.modified.lineno and line_new_comments:
             ${inline_comments_container(line_new_comments, inline_comments)}
             %endif
         </td>
     </tr>
     %endfor
 </%def>
 
 
 <%def name="render_hunk_lines_unified(filediff, hunk, use_comments=False,  inline_comments=None)">
     %for old_line_no, new_line_no, action, content, comments_args in hunk.unified:
 
     <%
     old_line_anchor, new_line_anchor = None, None
     if old_line_no:
         old_line_anchor = diff_line_anchor(filediff.raw_id, hunk.source_file_path, old_line_no, 'o')
     if new_line_no:
         new_line_anchor = diff_line_anchor(filediff.raw_id, hunk.target_file_path, new_line_no, 'n')
     %>
     <tr class="cb-line">
         <td class="cb-data ${action_class(action)}">
             <div>
 
             %if comments_args:
                 <% comments = get_comments_for('unified', inline_comments, *comments_args) %>
             %else:
                 <% comments = None %>
             %endif
 
             % if comments:
                 <% has_outdated = any([x.outdated for x in comments]) %>
                 % if has_outdated:
                     <i title="${_('comments including outdated')}:${len(comments)}" class="icon-comment_toggle" onclick="return Rhodecode.comments.toggleLineComments(this)"></i>
                 % else:
                     <i title="${_('comments')}: ${len(comments)}" class="icon-comment" onclick="return Rhodecode.comments.toggleLineComments(this)"></i>
                 % endif
             % endif
             </div>
         </td>
         <td class="cb-lineno ${action_class(action)}"
             data-line-no="${old_line_no}"
             %if old_line_anchor:
             id="${old_line_anchor}"
             %endif
         >
             %if old_line_anchor:
             <a name="${old_line_anchor}" href="#${old_line_anchor}">${old_line_no}</a>
             %endif
         </td>
         <td class="cb-lineno ${action_class(action)}"
             data-line-no="${new_line_no}"
             %if new_line_anchor:
             id="${new_line_anchor}"
             %endif
         >
             %if new_line_anchor:
             <a name="${new_line_anchor}" href="#${new_line_anchor}">${new_line_no}</a>
             %endif
         </td>
         <td class="cb-content ${action_class(action)}"
             data-line-no="${(new_line_no and 'n' or 'o')}${(new_line_no or old_line_no)}"
             >
             %if use_comments:
             ${render_add_comment_button()}
             %endif
             <span class="cb-code"><span class="cb-action ${action_class(action)}"></span> ${content or '' | n}</span>
             %if use_comments and comments:
             ${inline_comments_container(comments, inline_comments)}
             %endif
         </td>
     </tr>
     %endfor
 </%def>
 
 
 <%def name="render_hunk_lines(filediff, diff_mode, hunk, use_comments, inline_comments)">
     % if diff_mode == 'unified':
         ${render_hunk_lines_unified(filediff, hunk, use_comments=use_comments, inline_comments=inline_comments)}
     % elif diff_mode == 'sideside':
         ${render_hunk_lines_sideside(filediff, hunk, use_comments=use_comments, inline_comments=inline_comments)}
     % else:
         <tr class="cb-line">
             <td>unknown diff mode</td>
         </tr>
     % endif
 </%def>file changes
 
 
 <%def name="render_add_comment_button()">
 <button class="btn btn-small btn-primary cb-comment-box-opener" onclick="return Rhodecode.comments.createComment(this)">
     <span><i class="icon-comment"></i></span>
 </button>
 </%def>
 
 <%def name="render_diffset_menu(diffset=None, range_diff_on=None)">
 
     <div id="diff-file-sticky" class="diffset-menu clearinner">
         ## auto adjustable
         <div class="sidebar__inner">
             <div class="sidebar__bar">
             <div class="pull-right">
             <div class="btn-group">
 
                 ## DIFF OPTIONS via Select2
                 <div class="pull-left">
                 ${h.hidden('diff_menu')}
                 </div>
 
                 <a
                   class="btn ${(c.user_session_attrs["diffmode"] == 'sideside' and 'btn-primary')} tooltip"
                   title="${h.tooltip(_('View side by side'))}"
                   href="${h.current_route_path(request, diffmode='sideside')}">
                     <span>${_('Side by Side')}</span>
                 </a>
 
                 <a
                   class="btn ${(c.user_session_attrs["diffmode"] == 'unified' and 'btn-primary')} tooltip"
                   title="${h.tooltip(_('View unified'))}" href="${h.current_route_path(request, diffmode='unified')}">
                     <span>${_('Unified')}</span>
                 </a>
 
                 % if range_diff_on is True:
                     <a
                       title="${_('Turn off: Show the diff as commit range')}"
                       class="btn btn-primary"
                       href="${h.current_route_path(request, **{"range-diff":"0"})}">
                         <span>${_('Range Diff')}</span>
                    </a>
                 % elif range_diff_on is False:
                     <a
                       title="${_('Show the diff as commit range')}"
                       class="btn"
                       href="${h.current_route_path(request, **{"range-diff":"1"})}">
                         <span>${_('Range Diff')}</span>
                    </a>
                 % endif
             </div>
         </div>
             <div class="pull-left">
             <div class="btn-group">
               <div class="pull-left">
               ${h.hidden('file_filter')}
               </div>
               <a
                   class="btn"
                   href="#"
                   onclick="$('input[class=filediff-collapse-state]').prop('checked', false); updateSticky(); return false">${_('Expand All Files')}</a>
               <a
                   class="btn"
                   href="#"
                   onclick="$('input[class=filediff-collapse-state]').prop('checked', true); updateSticky(); return false">${_('Collapse All Files')}</a>
             </div>
             </div>
         </div>
         <div class="fpath-placeholder">
             <i class="icon-file-text"></i>
             <strong class="fpath-placeholder-text">
             Context file:
             </strong>
         </div>
         <div class="sidebar_inner_shadow"></div>
         </div>
     </div>
 
     % if diffset:
 
         %if diffset.limited_diff:
             <% file_placeholder = _ungettext('%(num)s file changed', '%(num)s files changed', diffset.changed_files) % {'num': diffset.changed_files} %>
         %else:
             <% file_placeholder = _ungettext('%(num)s file changed: %(linesadd)s inserted, ''%(linesdel)s deleted', '%(num)s files changed: %(linesadd)s inserted, %(linesdel)s deleted', diffset.changed_files) % {'num': diffset.changed_files, 'linesadd': diffset.lines_added, 'linesdel': diffset.lines_deleted}%>
         %endif
         ## case on range-diff placeholder needs to be updated
         % if range_diff_on is True:
             <% file_placeholder = _('Disabled on range diff') %>
         % endif
 
         <script>
 
         var feedFilesOptions = function (query, initialData) {
             var data = {results: []};
             var isQuery = typeof query.term !== 'undefined';
 
             var section = _gettext('Changed files');
             var filteredData = [];
 
             //filter results
             $.each(initialData.results, function (idx, value) {
 
                 if (!isQuery || query.term.length === 0 || value.text.toUpperCase().indexOf(query.term.toUpperCase()) >= 0) {
                     filteredData.push({
                         'id': this.id,
                         'text': this.text,
                         "ops": this.ops,
                     })
                 }
 
             });
 
             data.results = filteredData;
 
             query.callback(data);
         };
 
         var formatFileResult = function(result, container, query, escapeMarkup) {
             return function(data, escapeMarkup) {
                 var container = '<div class="filelist" style="padding-right:100px">{0}</div>';
                 var tmpl = '<span style="margin-right:-50px"><strong>{0}</strong></span>'.format(escapeMarkup(data['text']));
                 var pill = '<span class="pill-group" style="float: right;margin-right: -100px">' +
                             '<span class="pill" op="added">{0}</span>' +
                             '<span class="pill" op="deleted">{1}</span>' +
                            '</span>'
                         ;
                 var added = data['ops']['added'];
                 if (added === 0) {
                     // don't show +0
                     added = 0;
                 } else {
                     added = '+' + added;
                 }
 
                 var deleted = -1*data['ops']['deleted'];
 
                 tmpl += pill.format(added, deleted);
                 return container.format(tmpl);
 
             }(result, escapeMarkup);
         };
 
         var preloadFileFilterData = {
             results: [
                 % for filediff in diffset.files:
                     {id:"a_${h.FID(filediff.raw_id, filediff.patch['filename'])}",
                      text:"${filediff.patch['filename']}",
                      ops:${h.json.dumps(filediff.patch['stats'])|n}}${('' if loop.last else ',')}
                 % endfor
             ]
         };
 
         $(document).ready(function () {
 
             var fileFilter = $("#file_filter").select2({
                 'dropdownAutoWidth': true,
                 'width': 'auto',
                 'placeholder': "${file_placeholder}",
                 containerCssClass: "drop-menu",
                 dropdownCssClass: "drop-menu-dropdown",
                 data: preloadFileFilterData,
                 query: function(query) {
                     feedFilesOptions(query, preloadFileFilterData);
                 },
                 formatResult: formatFileResult
             });
 
             % if range_diff_on is True:
                 fileFilter.select2("enable", false);
             % endif
 
             $("#file_filter").on('click', function (e) {
                 e.preventDefault();
                 var selected = $('#file_filter').select2('data');
                 var idSelector = "#"+selected.id;
                 window.location.hash = idSelector;
                 // expand the container if we quick-select the field
                 $(idSelector).next().prop('checked', false);
                 updateSticky()
             });
 
             var contextPrefix = _gettext('Context file: ');
             ## sticky sidebar
             var sidebarElement = document.getElementById('diff-file-sticky');
             sidebar = new StickySidebar(sidebarElement, {
                   topSpacing: 0,
                   bottomSpacing: 0,
                   innerWrapperSelector: '.sidebar__inner'
             });
             sidebarElement.addEventListener('affixed.static.stickySidebar', function () {
                 // reset our file so it's not holding new value
                 $('.fpath-placeholder-text').html(contextPrefix)
             });
 
             updateSticky = function () {
                 sidebar.updateSticky();
                 Waypoint.refreshAll();
             };
 
             var animateText =  $.debounce(100, function(fPath, anchorId) {
+                fPath = Select2.util.escapeMarkup(fPath);
+
                 // animate setting the text
                 var callback = function () {
                     $('.fpath-placeholder-text').animate({'opacity': 1.00}, 200)
                     $('.fpath-placeholder-text').html(contextPrefix + '<a href="#a_' + anchorId + '">' + fPath + '</a>')
                 };
                 $('.fpath-placeholder-text').animate({'opacity': 0.15}, 200, callback);
             });
 
             ## dynamic file waypoints
             var setFPathInfo = function(fPath, anchorId){
                 animateText(fPath, anchorId)
             };
 
             var codeBlock = $('.filediff');
             // forward waypoint
             codeBlock.waypoint(
                 function(direction) {
                     if (direction === "down"){
                         setFPathInfo($(this.element).data('fPath'), $(this.element).data('anchorId'))
                     }
                 }, {
                     offset: 70,
                     context: '.fpath-placeholder'
                 }
             );
 
             // backward waypoint
             codeBlock.waypoint(
                 function(direction) {
                     if (direction === "up"){
                         setFPathInfo($(this.element).data('fPath'), $(this.element).data('anchorId'))
                     }
                 }, {
                     offset: function () {
                         return -this.element.clientHeight + 90
                     },
                     context: '.fpath-placeholder'
                 }
             );
 
             var preloadDiffMenuData = {
                 results: [
                     ## Wide diff mode
                     {
                         id: 1,
                         text: _gettext('Toggle Wide Mode diff'),
                         action: function () {
                             updateSticky();
                             Rhodecode.comments.toggleWideMode(this);
                             return null;
                         },
                         url: null,
                     },
 
                     ## Whitespace change
                     % if request.GET.get('ignorews', '') == '1':
                     {
                         id: 2,
                         text: _gettext('Show whitespace changes'),
                         action: function () {},
                         url: "${h.current_route_path(request, ignorews=0)|n}"
                     },
                     % else:
                     {
                         id: 2,
                         text: _gettext('Hide whitespace changes'),
                         action: function () {},
                         url: "${h.current_route_path(request, ignorews=1)|n}"
                     },
                     % endif
 
                     ## FULL CONTEXT
                     % if request.GET.get('fullcontext', '') == '1':
                     {
                         id: 3,
                         text: _gettext('Hide full context diff'),
                         action: function () {},
                         url: "${h.current_route_path(request, fullcontext=0)|n}"
                     },
                     % else:
                     {
                         id: 3,
                         text: _gettext('Show full context diff'),
                         action: function () {},
                         url: "${h.current_route_path(request, fullcontext=1)|n}"
                     },
                     % endif
 
                 ]
             };
 
             $("#diff_menu").select2({
                 minimumResultsForSearch: -1,
                 containerCssClass: "drop-menu",
                 dropdownCssClass: "drop-menu-dropdown",
                 dropdownAutoWidth: true,
                 data: preloadDiffMenuData,
                 placeholder: "${_('Diff Options')}",
             });
             $("#diff_menu").on('select2-selecting', function (e) {
                 e.choice.action();
                 if (e.choice.url !== null) {
                     window.location = e.choice.url
                 }
             });
 
         });
 
     </script>
     % endif
 
 </%def>

rhodecode/tests/lib/middleware/test_simplesvn.py

@@ -1,201 +1,209 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2018 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 from StringIO import StringIO
 
 import pytest
 from mock import patch, Mock
 
 from rhodecode.lib.middleware.simplesvn import SimpleSvn, SimpleSvnApp
 from rhodecode.lib.utils import get_rhodecode_base_path
 
 
 class TestSimpleSvn(object):
     @pytest.fixture(autouse=True)
     def simple_svn(self, baseapp, request_stub):
         base_path = get_rhodecode_base_path()
         self.app = SimpleSvn(
             config={'auth_ret_code': '', 'base_path': base_path},
             registry=request_stub.registry)
 
     def test_get_config(self):
         extras = {'foo': 'FOO', 'bar': 'BAR'}
         config = self.app._create_config(extras, repo_name='test-repo')
         assert config == extras
 
     @pytest.mark.parametrize(
         'method', ['OPTIONS', 'PROPFIND', 'GET', 'REPORT'])
     def test_get_action_returns_pull(self, method):
         environment = {'REQUEST_METHOD': method}
         action = self.app._get_action(environment)
         assert action == 'pull'
 
     @pytest.mark.parametrize(
         'method', [
             'MKACTIVITY', 'PROPPATCH', 'PUT', 'CHECKOUT', 'MKCOL', 'MOVE',
             'COPY', 'DELETE', 'LOCK', 'UNLOCK', 'MERGE'
         ])
     def test_get_action_returns_push(self, method):
         environment = {'REQUEST_METHOD': method}
         action = self.app._get_action(environment)
         assert action == 'push'
 
     @pytest.mark.parametrize(
         'path, expected_name', [
             ('/hello-svn', 'hello-svn'),
             ('/hello-svn/', 'hello-svn'),
             ('/group/hello-svn/', 'group/hello-svn'),
             ('/group/hello-svn/!svn/vcc/default', 'group/hello-svn'),
         ])
     def test_get_repository_name(self, path, expected_name):
         environment = {'PATH_INFO': path}
         name = self.app._get_repository_name(environment)
         assert name == expected_name
 
     def test_get_repository_name_subfolder(self, backend_svn):
         repo = backend_svn.repo
         environment = {
             'PATH_INFO': '/{}/path/with/subfolders'.format(repo.repo_name)}
         name = self.app._get_repository_name(environment)
         assert name == repo.repo_name
 
     def test_create_wsgi_app(self):
         with patch.object(SimpleSvn, '_is_svn_enabled') as mock_method:
             mock_method.return_value = False
             with patch('rhodecode.lib.middleware.simplesvn.DisabledSimpleSvnApp') as (
                     wsgi_app_mock):
                 config = Mock()
                 wsgi_app = self.app._create_wsgi_app(
                     repo_path='', repo_name='', config=config)
 
             wsgi_app_mock.assert_called_once_with(config)
             assert wsgi_app == wsgi_app_mock()
 
     def test_create_wsgi_app_when_enabled(self):
         with patch.object(SimpleSvn, '_is_svn_enabled') as mock_method:
             mock_method.return_value = True
             with patch('rhodecode.lib.middleware.simplesvn.SimpleSvnApp') as (
                     wsgi_app_mock):
                 config = Mock()
                 wsgi_app = self.app._create_wsgi_app(
                     repo_path='', repo_name='', config=config)
 
             wsgi_app_mock.assert_called_once_with(config)
             assert wsgi_app == wsgi_app_mock()
 
 
 class TestSimpleSvnApp(object):
     data = '<xml></xml>'
     path = '/group/my-repo'
     wsgi_input = StringIO(data)
     environment = {
         'HTTP_DAV': (
             'http://subversion.tigris.org/xmlns/dav/svn/depth,'
             ' http://subversion.tigris.org/xmlns/dav/svn/mergeinfo'),
         'HTTP_USER_AGENT': 'SVN/1.8.11 (x86_64-linux) serf/1.3.8',
         'REQUEST_METHOD': 'OPTIONS',
         'PATH_INFO': path,
         'wsgi.input': wsgi_input,
         'CONTENT_TYPE': 'text/xml',
         'CONTENT_LENGTH': '130'
     }
 
     def setup_method(self, method):
         self.host = 'http://localhost/'
         base_path = get_rhodecode_base_path()
         self.app = SimpleSvnApp(
             config={'subversion_http_server_url': self.host,
                     'base_path': base_path})
 
     def test_get_request_headers_with_content_type(self):
         expected_headers = {
             'Dav': self.environment['HTTP_DAV'],
             'User-Agent': self.environment['HTTP_USER_AGENT'],
             'Content-Type': self.environment['CONTENT_TYPE'],
             'Content-Length': self.environment['CONTENT_LENGTH']
         }
         headers = self.app._get_request_headers(self.environment)
         assert headers == expected_headers
 
     def test_get_request_headers_without_content_type(self):
         environment = self.environment.copy()
         environment.pop('CONTENT_TYPE')
         expected_headers = {
             'Dav': environment['HTTP_DAV'],
             'Content-Length': self.environment['CONTENT_LENGTH'],
             'User-Agent': environment['HTTP_USER_AGENT'],
         }
         request_headers = self.app._get_request_headers(environment)
         assert request_headers == expected_headers
 
     def test_get_response_headers(self):
         headers = {
             'Connection': 'keep-alive',
             'Keep-Alive': 'timeout=5, max=100',
             'Transfer-Encoding': 'chunked',
             'Content-Encoding': 'gzip',
             'MS-Author-Via': 'DAV',
             'SVN-Supported-Posts': 'create-txn-with-props'
         }
         expected_headers = [
             ('MS-Author-Via', 'DAV'),
             ('SVN-Supported-Posts', 'create-txn-with-props'),
         ]
         response_headers = self.app._get_response_headers(headers)
         assert sorted(response_headers) == sorted(expected_headers)
 
-    def test_get_url(self):
-        url = self.app._get_url(self.path)
-        expected_url = '{}{}'.format(self.host.strip('/'), self.path)
+    @pytest.mark.parametrize('svn_http_url, path_info, expected_url', [
+        ('http://localhost:8200', '/repo_name', 'http://localhost:8200/repo_name'),
+        ('http://localhost:8200///', '/repo_name', 'http://localhost:8200/repo_name'),
+        ('http://localhost:8200', '/group/repo_name', 'http://localhost:8200/group/repo_name'),
+        ('http://localhost:8200/', '/group/repo_name', 'http://localhost:8200/group/repo_name'),
+        ('http://localhost:8200/prefix', '/repo_name', 'http://localhost:8200/prefix/repo_name'),
+        ('http://localhost:8200/prefix', 'repo_name', 'http://localhost:8200/prefix/repo_name'),
+        ('http://localhost:8200/prefix', '/group/repo_name', 'http://localhost:8200/prefix/group/repo_name')
+    ])
+    def test_get_url(self, svn_http_url, path_info, expected_url):
+        url = self.app._get_url(svn_http_url, path_info)
         assert url == expected_url
 
     def test_call(self):
         start_response = Mock()
         response_mock = Mock()
         response_mock.headers = {
             'Content-Encoding': 'gzip',
             'MS-Author-Via': 'DAV',
             'SVN-Supported-Posts': 'create-txn-with-props'
         }
         response_mock.status_code = 200
         response_mock.reason = 'OK'
         with patch('rhodecode.lib.middleware.simplesvn.requests.request') as (
                 request_mock):
             request_mock.return_value = response_mock
             self.app(self.environment, start_response)
 
         expected_url = '{}{}'.format(self.host.strip('/'), self.path)
         expected_request_headers = {
             'Dav': self.environment['HTTP_DAV'],
             'User-Agent': self.environment['HTTP_USER_AGENT'],
             'Content-Type': self.environment['CONTENT_TYPE'],
             'Content-Length': self.environment['CONTENT_LENGTH']
         }
         expected_response_headers = [
             ('SVN-Supported-Posts', 'create-txn-with-props'),
             ('MS-Author-Via', 'DAV'),
         ]
         request_mock.assert_called_once_with(
             self.environment['REQUEST_METHOD'], expected_url,
             data=self.data, headers=expected_request_headers, stream=False)
         response_mock.iter_content.assert_called_once_with(chunk_size=1024)
         args, _ = start_response.call_args
         assert args[0] == '200 OK'
         assert sorted(args[1]) == sorted(expected_response_headers)