settings: fix #3944 add password reset permission

rhodecode/lib/dbmigrate/versions/061_version_4_5_0.py

@@ -0,0 +1,42 b''
+import logging
+import datetime
+
+from sqlalchemy import *
+from sqlalchemy.exc import DatabaseError
+from sqlalchemy.orm import relation, backref, class_mapper, joinedload
+from sqlalchemy.orm.session import Session
+from sqlalchemy.ext.declarative import declarative_base
+
+from rhodecode.lib.dbmigrate.migrate import *
+from rhodecode.lib.dbmigrate.migrate.changeset import *
+from rhodecode.lib.utils2 import str2bool
+
+from rhodecode.model.meta import Base
+from rhodecode.model import meta
+from rhodecode.lib.dbmigrate.versions import _reset_base, notify
+
+log = logging.getLogger(__name__)
+
+
+def upgrade(migrate_engine):
+    """
+    Upgrade operations go here.
+    Don't create your own engine; bind migrate_engine to your metadata
+    """
+    _reset_base(migrate_engine)
+    from rhodecode.lib.dbmigrate.schema import db_4_5_0_0
+
+    fixups(db_4_5_0_0, meta.Session)
+
+def downgrade(migrate_engine):
+    meta = MetaData()
+    meta.bind = migrate_engine
+
+def fixups(models, _SESSION):
+    # ** create default permissions ** #
+    from rhodecode.model.permission import PermissionModel
+    PermissionModel(_SESSION()).create_permissions()
+
+    res = PermissionModel(_SESSION()).create_default_user_permissions(
+        models.User.DEFAULT_USER)
+    _SESSION().commit()

rhodecode/__init__.py

@@ -1,63 +1,63 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2016  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 
 RhodeCode, a web based repository management software
 versioning implementation: http://www.python.org/dev/peps/pep-0386/
 """
 
 import os
 import sys
 import platform
 
 VERSION = tuple(open(os.path.join(
     os.path.dirname(__file__), 'VERSION')).read().split('.'))
 
 BACKENDS = {
     'hg': 'Mercurial repository',
     'git': 'Git repository',
     'svn': 'Subversion repository',
 }
 
 CELERY_ENABLED = False
 CELERY_EAGER = False
 
 # link to config for pylons
 CONFIG = {}
 
 # Populated with the settings dictionary from application init in
 # rhodecode.conf.environment.load_pyramid_environment
 PYRAMID_SETTINGS = {}
 
 # Linked module for extensions
 EXTENSIONS = {}
 
 __version__ = ('.'.join((str(each) for each in VERSION[:3])))
-__dbversion__ = 60  # defines current db version for migrations
+__dbversion__ = 61  # defines current db version for migrations
 __platform__ = platform.system()
 __license__ = 'AGPLv3, and Commercial License'
 __author__ = 'RhodeCode GmbH'
 __url__ = 'http://rhodecode.com'
 
 is_windows = __platform__ in ['Windows']
 is_unix = not is_windows
 is_test = False
 disable_error_handler = False

rhodecode/api/views/user_api.py

@@ -1,465 +1,466 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2011-2016  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import logging
 
 from rhodecode.api import jsonrpc_method, JSONRPCError, JSONRPCForbidden
 from rhodecode.api.utils import (
     Optional, OAttr, has_superadmin_permission, get_user_or_error, store_update)
 from rhodecode.lib.auth import AuthUser, PasswordGenerator
 from rhodecode.lib.exceptions import DefaultUserException
 from rhodecode.lib.utils2 import safe_int
 from rhodecode.model.db import Session, User, Repository
 from rhodecode.model.user import UserModel
 
 
 log = logging.getLogger(__name__)
 
 
 @jsonrpc_method()
 def get_user(request, apiuser, userid=Optional(OAttr('apiuser'))):
     """
     Returns the information associated with a username or userid.
 
     * If the ``userid`` is not set, this command returns the information
       for the ``userid`` calling the method.
 
     .. note::
 
        Normal users may only run this command against their ``userid``. For
        full privileges you must run this command using an |authtoken| with
        admin rights.
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param userid: Sets the userid for which data will be returned.
     :type userid: Optional(str or int)
 
     Example output:
 
     .. code-block:: bash
 
         {
           "error": null,
           "id": <id>,
           "result": {
             "active": true,
             "admin": false,
             "api_key": "api-key",
             "api_keys": [ list of keys ],
             "email": "[e-mail]",
             "emails": [
               "[e-mail]"
             ],
             "extern_name": "rhodecode",
             "extern_type": "rhodecode",
             "firstname": "username",
             "ip_addresses": [],
             "language": null,
             "last_login": "Timestamp",
             "lastname": "surnae",
             "permissions": {
               "global": [
                 "hg.inherit_default_perms.true",
                 "usergroup.read",
                 "hg.repogroup.create.false",
                 "hg.create.none",
+                "hg.password_reset.enabled",
                 "hg.extern_activate.manual",
                 "hg.create.write_on_repogroup.false",
                 "hg.usergroup.create.false",
                 "group.none",
                 "repository.none",
                 "hg.register.none",
                 "hg.fork.repository"
               ],
               "repositories": { "username/example": "repository.write"},
               "repositories_groups": { "user-group/repo": "group.none" },
               "user_groups": { "user_group_name": "usergroup.read" }
             },
             "user_id": 32,
             "username": "username"
           }
         }
     """
 
     if not has_superadmin_permission(apiuser):
         # make sure normal user does not pass someone else userid,
         # he is not allowed to do that
         if not isinstance(userid, Optional) and userid != apiuser.user_id:
             raise JSONRPCError('userid is not the same as your user')
 
     userid = Optional.extract(userid, evaluate_locals=locals())
     userid = getattr(userid, 'user_id', userid)
 
     user = get_user_or_error(userid)
     data = user.get_api_data(include_secrets=True)
     data['permissions'] = AuthUser(user_id=user.user_id).permissions
     return data
 
 
 @jsonrpc_method()
 def get_users(request, apiuser):
     """
     Lists all users in the |RCE| user database.
 
     This command can only be run using an |authtoken| with admin rights to
     the specified repository.
 
     This command takes the following options:
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
 
     Example output:
 
     .. code-block:: bash
 
         id : <id_given_in_input>
             result: [<user_object>, ...]
         error:  null
     """
 
     if not has_superadmin_permission(apiuser):
         raise JSONRPCForbidden()
 
     result = []
     users_list = User.query().order_by(User.username) \
         .filter(User.username != User.DEFAULT_USER) \
         .all()
     for user in users_list:
         result.append(user.get_api_data(include_secrets=True))
     return result
 
 
 @jsonrpc_method()
 def create_user(request, apiuser, username, email, password=Optional(''),
                 firstname=Optional(''), lastname=Optional(''),
                 active=Optional(True), admin=Optional(False),
                 extern_name=Optional('rhodecode'),
                 extern_type=Optional('rhodecode'),
                 force_password_change=Optional(False)):
     """
     Creates a new user and returns the new user object.
 
     This command can only be run using an |authtoken| with admin rights to
     the specified repository.
 
     This command takes the following options:
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param username: Set the new username.
     :type username: str or int
     :param email: Set the user email address.
     :type email: str
     :param password: Set the new user password.
     :type password: Optional(str)
     :param firstname: Set the new user firstname.
     :type firstname: Optional(str)
     :param lastname: Set the new user surname.
     :type lastname: Optional(str)
     :param active: Set the user as active.
     :type active: Optional(``True`` | ``False``)
     :param admin: Give the new user admin rights.
     :type admin: Optional(``True`` | ``False``)
     :param extern_name: Set the authentication plugin name.
         Using LDAP this is filled with LDAP UID.
     :type extern_name: Optional(str)
     :param extern_type: Set the new user authentication plugin.
     :type extern_type: Optional(str)
     :param force_password_change: Force the new user to change password
         on next login.
     :type force_password_change: Optional(``True`` | ``False``)
 
     Example output:
 
     .. code-block:: bash
 
         id : <id_given_in_input>
         result: {
                   "msg" : "created new user `<username>`",
                   "user": <user_obj>
                 }
         error:  null
 
     Example error output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : null
       error :  {
         "user `<username>` already exist"
         or
         "email `<email>` already exist"
         or
         "failed to create user `<username>`"
       }
 
     """
     if not has_superadmin_permission(apiuser):
         raise JSONRPCForbidden()
 
     if UserModel().get_by_username(username):
         raise JSONRPCError("user `%s` already exist" % (username,))
 
     if UserModel().get_by_email(email, case_insensitive=True):
         raise JSONRPCError("email `%s` already exist" % (email,))
 
     # generate random password if we actually given the
     # extern_name and it's not rhodecode
     if (not isinstance(extern_name, Optional) and
                 Optional.extract(extern_name) != 'rhodecode'):
         # generate temporary password if user is external
         password = PasswordGenerator().gen_password(length=16)
 
     try:
         user = UserModel().create_or_update(
             username=Optional.extract(username),
             password=Optional.extract(password),
             email=Optional.extract(email),
             firstname=Optional.extract(firstname),
             lastname=Optional.extract(lastname),
             active=Optional.extract(active),
             admin=Optional.extract(admin),
             extern_type=Optional.extract(extern_type),
             extern_name=Optional.extract(extern_name),
             force_password_change=Optional.extract(force_password_change),
         )
         Session().commit()
         return {
             'msg': 'created new user `%s`' % username,
             'user': user.get_api_data(include_secrets=True)
         }
     except Exception:
         log.exception('Error occurred during creation of user')
         raise JSONRPCError('failed to create user `%s`' % (username,))
 
 
 @jsonrpc_method()
 def update_user(request, apiuser, userid, username=Optional(None),
                 email=Optional(None), password=Optional(None),
                 firstname=Optional(None), lastname=Optional(None),
                 active=Optional(None), admin=Optional(None),
                 extern_type=Optional(None), extern_name=Optional(None), ):
     """
     Updates the details for the specified user, if that user exists.
 
     This command can only be run using an |authtoken| with admin rights to
     the specified repository.
 
     This command takes the following options:
 
     :param apiuser: This is filled automatically from |authtoken|.
     :type apiuser: AuthUser
     :param userid: Set the ``userid`` to update.
     :type userid: str or int
     :param username: Set the new username.
     :type username: str or int
     :param email: Set the new email.
     :type email: str
     :param password: Set the new password.
     :type password: Optional(str)
     :param firstname: Set the new first name.
     :type firstname: Optional(str)
     :param lastname: Set the new surname.
     :type lastname: Optional(str)
     :param active: Set the new user as active.
     :type active: Optional(``True`` | ``False``)
     :param admin: Give the user admin rights.
     :type admin: Optional(``True`` | ``False``)
     :param extern_name: Set the authentication plugin user name.
         Using LDAP this is filled with LDAP UID.
     :type extern_name: Optional(str)
     :param extern_type: Set the authentication plugin type.
     :type extern_type: Optional(str)
 
 
     Example output:
 
     .. code-block:: bash
 
         id : <id_given_in_input>
         result: {
                   "msg" : "updated user ID:<userid> <username>",
                   "user": <user_object>,
                 }
         error:  null
 
     Example error output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : null
       error :  {
         "failed to update user `<username>`"
       }
 
     """
     if not has_superadmin_permission(apiuser):
         raise JSONRPCForbidden()
 
     user = get_user_or_error(userid)
 
     # only non optional arguments will be stored in updates
     updates = {}
 
     try:
 
         store_update(updates, username, 'username')
         store_update(updates, password, 'password')
         store_update(updates, email, 'email')
         store_update(updates, firstname, 'name')
         store_update(updates, lastname, 'lastname')
         store_update(updates, active, 'active')
         store_update(updates, admin, 'admin')
         store_update(updates, extern_name, 'extern_name')
         store_update(updates, extern_type, 'extern_type')
 
         user = UserModel().update_user(user, **updates)
         Session().commit()
         return {
             'msg': 'updated user ID:%s %s' % (user.user_id, user.username),
             'user': user.get_api_data(include_secrets=True)
         }
     except DefaultUserException:
         log.exception("Default user edit exception")
         raise JSONRPCError('editing default user is forbidden')
     except Exception:
         log.exception("Error occurred during update of user")
         raise JSONRPCError('failed to update user `%s`' % (userid,))
 
 
 @jsonrpc_method()
 def delete_user(request, apiuser, userid):
     """
     Deletes the specified user from the |RCE| user database.
 
     This command can only be run using an |authtoken| with admin rights to
     the specified repository.
 
     .. important::
 
        Ensure all open pull requests and open code review
        requests to this user are close.
 
        Also ensure all repositories, or repository groups owned by this
        user are reassigned before deletion.
 
     This command takes the following options:
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param userid: Set the user to delete.
     :type userid: str or int
 
     Example output:
 
     .. code-block:: bash
 
         id : <id_given_in_input>
         result: {
                   "msg" : "deleted user ID:<userid> <username>",
                   "user": null
                 }
         error:  null
 
     Example error output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : null
       error :  {
         "failed to delete user ID:<userid> <username>"
       }
 
     """
     if not has_superadmin_permission(apiuser):
         raise JSONRPCForbidden()
 
     user = get_user_or_error(userid)
 
     try:
         UserModel().delete(userid)
         Session().commit()
         return {
             'msg': 'deleted user ID:%s %s' % (user.user_id, user.username),
             'user': None
         }
     except Exception:
         log.exception("Error occurred during deleting of user")
         raise JSONRPCError(
             'failed to delete user ID:%s %s' % (user.user_id, user.username))
 
 
 @jsonrpc_method()
 def get_user_locks(request, apiuser, userid=Optional(OAttr('apiuser'))):
     """
     Displays all repositories locked by the specified user.
 
     * If this command is run by a non-admin user, it returns
       a list of |repos| locked by that user.
 
     This command takes the following options:
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param userid: Sets the userid whose list of locked |repos| will be
         displayed.
     :type userid: Optional(str or int)
 
     Example output:
 
     .. code-block:: bash
 
         id : <id_given_in_input>
         result : {
             [repo_object, repo_object,...]
         }
         error :  null
     """
 
     include_secrets = False
     if not has_superadmin_permission(apiuser):
         # make sure normal user does not pass someone else userid,
         # he is not allowed to do that
         if not isinstance(userid, Optional) and userid != apiuser.user_id:
             raise JSONRPCError('userid is not the same as your user')
     else:
         include_secrets = True
 
     userid = Optional.extract(userid, evaluate_locals=locals())
     userid = getattr(userid, 'user_id', userid)
     user = get_user_or_error(userid)
 
     ret = []
 
     # show all locks
     for r in Repository.getAll():
         _user_id, _time, _reason = r.locked
         if _user_id and _time:
             _api_data = r.get_api_data(include_secrets=include_secrets)
             # if we use user filter just show the locks for this user
             if safe_int(_user_id) == user.user_id:
                 ret.append(_api_data)
 
     return ret

rhodecode/controllers/admin/permissions.py

@@ -1,248 +1,249 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2016  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 
 """
 permissions controller for RhodeCode Enterprise
 """
 
 
 import logging
 
 import formencode
 from formencode import htmlfill
 from pylons import request, tmpl_context as c, url
 from pylons.controllers.util import redirect
 from pylons.i18n.translation import _
 
 from rhodecode.lib import helpers as h
 from rhodecode.lib import auth
 from rhodecode.lib.auth import (LoginRequired, HasPermissionAllDecorator)
 from rhodecode.lib.base import BaseController, render
 from rhodecode.model.db import User, UserIpMap
 from rhodecode.model.forms import (
     ApplicationPermissionsForm, ObjectPermissionsForm, UserPermissionsForm)
 from rhodecode.model.meta import Session
 from rhodecode.model.permission import PermissionModel
 from rhodecode.model.settings import SettingsModel
 
 log = logging.getLogger(__name__)
 
 
 class PermissionsController(BaseController):
     """REST Controller styled on the Atom Publishing Protocol"""
     # To properly map this controller, ensure your config/routing.py
     # file has a resource setup:
     #     map.resource('permission', 'permissions')
 
     @LoginRequired()
     def __before__(self):
         super(PermissionsController, self).__before__()
 
     def __load_data(self):
         PermissionModel().set_global_permission_choices(c, translator=_)
 
     @HasPermissionAllDecorator('hg.admin')
     def permission_application(self):
         c.active = 'application'
         self.__load_data()
 
         c.user = User.get_default_user()
 
         # TODO: johbo: The default user might be based on outdated state which
         # has been loaded from the cache. A call to refresh() ensures that the
         # latest state from the database is used.
         Session().refresh(c.user)
 
         app_settings = SettingsModel().get_all_settings()
         defaults = {
             'anonymous': c.user.active,
             'default_register_message': app_settings.get(
                 'rhodecode_register_message')
         }
         defaults.update(c.user.get_default_perms())
 
         return htmlfill.render(
             render('admin/permissions/permissions.html'),
             defaults=defaults,
             encoding="UTF-8",
             force_defaults=False)
 
     @HasPermissionAllDecorator('hg.admin')
     @auth.CSRFRequired()
     def permission_application_update(self):
         c.active = 'application'
         self.__load_data()
         _form = ApplicationPermissionsForm(
             [x[0] for x in c.register_choices],
+            [x[0] for x in c.password_reset_choices],
             [x[0] for x in c.extern_activate_choices])()
 
         try:
             form_result = _form.to_python(dict(request.POST))
             form_result.update({'perm_user_name': User.DEFAULT_USER})
             PermissionModel().update_application_permissions(form_result)
 
             settings = [
                 ('register_message', 'default_register_message'),
             ]
             for setting, form_key in settings:
                 sett = SettingsModel().create_or_update_setting(
                     setting, form_result[form_key])
                 Session().add(sett)
 
             Session().commit()
             h.flash(_('Application permissions updated successfully'),
                     category='success')
 
         except formencode.Invalid as errors:
             defaults = errors.value
 
             return htmlfill.render(
                 render('admin/permissions/permissions.html'),
                 defaults=defaults,
                 errors=errors.error_dict or {},
                 prefix_error=False,
                 encoding="UTF-8",
                 force_defaults=False)
         except Exception:
             log.exception("Exception during update of permissions")
             h.flash(_('Error occurred during update of permissions'),
                     category='error')
 
         return redirect(url('admin_permissions_application'))
 
     @HasPermissionAllDecorator('hg.admin')
     def permission_objects(self):
         c.active = 'objects'
         self.__load_data()
         c.user = User.get_default_user()
         defaults = {}
         defaults.update(c.user.get_default_perms())
         return htmlfill.render(
             render('admin/permissions/permissions.html'),
             defaults=defaults,
             encoding="UTF-8",
             force_defaults=False)
 
     @HasPermissionAllDecorator('hg.admin')
     @auth.CSRFRequired()
     def permission_objects_update(self):
         c.active = 'objects'
         self.__load_data()
         _form = ObjectPermissionsForm(
             [x[0] for x in c.repo_perms_choices],
             [x[0] for x in c.group_perms_choices],
             [x[0] for x in c.user_group_perms_choices])()
 
         try:
             form_result = _form.to_python(dict(request.POST))
             form_result.update({'perm_user_name': User.DEFAULT_USER})
             PermissionModel().update_object_permissions(form_result)
 
             Session().commit()
             h.flash(_('Object permissions updated successfully'),
                     category='success')
 
         except formencode.Invalid as errors:
             defaults = errors.value
 
             return htmlfill.render(
                 render('admin/permissions/permissions.html'),
                 defaults=defaults,
                 errors=errors.error_dict or {},
                 prefix_error=False,
                 encoding="UTF-8",
                 force_defaults=False)
         except Exception:
             log.exception("Exception during update of permissions")
             h.flash(_('Error occurred during update of permissions'),
                     category='error')
 
         return redirect(url('admin_permissions_object'))
 
     @HasPermissionAllDecorator('hg.admin')
     def permission_global(self):
         c.active = 'global'
         self.__load_data()
 
         c.user = User.get_default_user()
         defaults = {}
         defaults.update(c.user.get_default_perms())
 
         return htmlfill.render(
             render('admin/permissions/permissions.html'),
             defaults=defaults,
             encoding="UTF-8",
             force_defaults=False)
 
     @HasPermissionAllDecorator('hg.admin')
     @auth.CSRFRequired()
     def permission_global_update(self):
         c.active = 'global'
         self.__load_data()
         _form = UserPermissionsForm(
             [x[0] for x in c.repo_create_choices],
             [x[0] for x in c.repo_create_on_write_choices],
             [x[0] for x in c.repo_group_create_choices],
             [x[0] for x in c.user_group_create_choices],
             [x[0] for x in c.fork_choices],
             [x[0] for x in c.inherit_default_permission_choices])()
 
         try:
             form_result = _form.to_python(dict(request.POST))
             form_result.update({'perm_user_name': User.DEFAULT_USER})
             PermissionModel().update_user_permissions(form_result)
 
             Session().commit()
             h.flash(_('Global permissions updated successfully'),
                     category='success')
 
         except formencode.Invalid as errors:
             defaults = errors.value
 
             return htmlfill.render(
                 render('admin/permissions/permissions.html'),
                 defaults=defaults,
                 errors=errors.error_dict or {},
                 prefix_error=False,
                 encoding="UTF-8",
                 force_defaults=False)
         except Exception:
             log.exception("Exception during update of permissions")
             h.flash(_('Error occurred during update of permissions'),
                     category='error')
 
         return redirect(url('admin_permissions_global'))
 
     @HasPermissionAllDecorator('hg.admin')
     def permission_ips(self):
         c.active = 'ips'
         c.user = User.get_default_user()
         c.user_ip_map = (
             UserIpMap.query().filter(UserIpMap.user == c.user).all())
 
         return render('admin/permissions/permissions.html')
 
     @HasPermissionAllDecorator('hg.admin')
     def permission_perms(self):
         c.active = 'perms'
         c.user = User.get_default_user()
         c.perm_user = c.user.AuthUser
         return render('admin/permissions/permissions.html')

rhodecode/model/forms.py

@@ -1,551 +1,553 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2016  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 this is forms validation classes
 http://formencode.org/module-formencode.validators.html
 for list off all availible validators
 
 we can create our own validators
 
 The table below outlines the options which can be used in a schema in addition to the validators themselves
 pre_validators          []     These validators will be applied before the schema
 chained_validators      []     These validators will be applied after the schema
 allow_extra_fields      False     If True, then it is not an error when keys that aren't associated with a validator are present
 filter_extra_fields     False     If True, then keys that aren't associated with a validator are removed
 if_key_missing          NoDefault If this is given, then any keys that aren't available but are expected will be replaced with this value (and then validated). This does not override a present .if_missing attribute on validators. NoDefault is a special FormEncode class to mean that no default values has been specified and therefore missing keys shouldn't take a default value.
 ignore_key_missing      False     If True, then missing keys will be missing in the result, if the validator doesn't have .if_missing on it already
 
 
 <name> = formencode.validators.<name of validator>
 <name> must equal form name
 list=[1,2,3,4,5]
 for SELECT use formencode.All(OneOf(list), Int())
 
 """
 
 import deform
 import logging
 import formencode
 
 from pkg_resources import resource_filename
 from formencode import All, Pipe
 
 from pylons.i18n.translation import _
 
 from rhodecode import BACKENDS
 from rhodecode.lib import helpers
 from rhodecode.model import validators as v
 
 log = logging.getLogger(__name__)
 
 
 deform_templates = resource_filename('deform', 'templates')
 rhodecode_templates = resource_filename('rhodecode', 'templates/forms')
 search_path = (rhodecode_templates, deform_templates)
 
 
 class RhodecodeFormZPTRendererFactory(deform.ZPTRendererFactory):
     """ Subclass of ZPTRendererFactory to add rhodecode context variables """
     def __call__(self, template_name, **kw):
         kw['h'] = helpers
         return self.load(template_name)(**kw)
 
 
 form_renderer = RhodecodeFormZPTRendererFactory(search_path)
 deform.Form.set_default_renderer(form_renderer)
 
 
 def LoginForm():
     class _LoginForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
         username = v.UnicodeString(
             strip=True,
             min=1,
             not_empty=True,
             messages={
                 'empty': _(u'Please enter a login'),
                 'tooShort': _(u'Enter a value %(min)i characters long or more')
             }
         )
 
         password = v.UnicodeString(
             strip=False,
             min=3,
             not_empty=True,
             messages={
                 'empty': _(u'Please enter a password'),
                 'tooShort': _(u'Enter %(min)i characters or more')}
         )
 
         remember = v.StringBoolean(if_missing=False)
 
         chained_validators = [v.ValidAuth()]
     return _LoginForm
 
 
 def UserForm(edit=False, available_languages=[], old_data={}):
     class _UserForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
         username = All(v.UnicodeString(strip=True, min=1, not_empty=True),
                        v.ValidUsername(edit, old_data))
         if edit:
             new_password = All(
                 v.ValidPassword(),
                 v.UnicodeString(strip=False, min=6, not_empty=False)
             )
             password_confirmation = All(
                 v.ValidPassword(),
                 v.UnicodeString(strip=False, min=6, not_empty=False),
             )
             admin = v.StringBoolean(if_missing=False)
         else:
             password = All(
                 v.ValidPassword(),
                 v.UnicodeString(strip=False, min=6, not_empty=True)
             )
             password_confirmation = All(
                 v.ValidPassword(),
                 v.UnicodeString(strip=False, min=6, not_empty=False)
             )
 
         password_change = v.StringBoolean(if_missing=False)
         create_repo_group = v.StringBoolean(if_missing=False)
 
         active = v.StringBoolean(if_missing=False)
         firstname = v.UnicodeString(strip=True, min=1, not_empty=False)
         lastname = v.UnicodeString(strip=True, min=1, not_empty=False)
         email = All(v.Email(not_empty=True), v.UniqSystemEmail(old_data))
         extern_name = v.UnicodeString(strip=True)
         extern_type = v.UnicodeString(strip=True)
         language = v.OneOf(available_languages, hideList=False,
                            testValueList=True, if_missing=None)
         chained_validators = [v.ValidPasswordsMatch()]
     return _UserForm
 
 
 def UserGroupForm(edit=False, old_data=None, available_members=None,
                   allow_disabled=False):
     old_data = old_data or {}
     available_members = available_members or []
 
     class _UserGroupForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
 
         users_group_name = All(
             v.UnicodeString(strip=True, min=1, not_empty=True),
             v.ValidUserGroup(edit, old_data)
         )
         user_group_description = v.UnicodeString(strip=True, min=1,
                                                  not_empty=False)
 
         users_group_active = v.StringBoolean(if_missing=False)
 
         if edit:
             users_group_members = v.OneOf(
                 available_members, hideList=False, testValueList=True,
                 if_missing=None, not_empty=False
             )
             # this is user group owner
             user = All(
                 v.UnicodeString(not_empty=True),
                 v.ValidRepoUser(allow_disabled))
     return _UserGroupForm
 
 
 def RepoGroupForm(edit=False, old_data=None, available_groups=None,
                    can_create_in_root=False, allow_disabled=False):
     old_data = old_data or {}
     available_groups = available_groups or []
 
     class _RepoGroupForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
 
         group_name = All(v.UnicodeString(strip=True, min=1, not_empty=True),
                          v.SlugifyName(),)
         group_description = v.UnicodeString(strip=True, min=1,
                                             not_empty=False)
         group_copy_permissions = v.StringBoolean(if_missing=False)
 
         group_parent_id = v.OneOf(available_groups, hideList=False,
                                   testValueList=True, not_empty=True)
         enable_locking = v.StringBoolean(if_missing=False)
         chained_validators = [
             v.ValidRepoGroup(edit, old_data, can_create_in_root)]
 
         if edit:
             # this is repo group owner
             user = All(
                 v.UnicodeString(not_empty=True),
                 v.ValidRepoUser(allow_disabled))
 
     return _RepoGroupForm
 
 
 def RegisterForm(edit=False, old_data={}):
     class _RegisterForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
         username = All(
             v.ValidUsername(edit, old_data),
             v.UnicodeString(strip=True, min=1, not_empty=True)
         )
         password = All(
             v.ValidPassword(),
             v.UnicodeString(strip=False, min=6, not_empty=True)
         )
         password_confirmation = All(
             v.ValidPassword(),
             v.UnicodeString(strip=False, min=6, not_empty=True)
         )
         active = v.StringBoolean(if_missing=False)
         firstname = v.UnicodeString(strip=True, min=1, not_empty=False)
         lastname = v.UnicodeString(strip=True, min=1, not_empty=False)
         email = All(v.Email(not_empty=True), v.UniqSystemEmail(old_data))
 
         chained_validators = [v.ValidPasswordsMatch()]
 
     return _RegisterForm
 
 
 def PasswordResetForm():
     class _PasswordResetForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
         email = All(v.ValidSystemEmail(), v.Email(not_empty=True))
     return _PasswordResetForm
 
 
 def RepoForm(edit=False, old_data=None, repo_groups=None, landing_revs=None,
              allow_disabled=False):
     old_data = old_data or {}
     repo_groups = repo_groups or []
     landing_revs = landing_revs or []
     supported_backends = BACKENDS.keys()
 
     class _RepoForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         repo_name = All(v.UnicodeString(strip=True, min=1, not_empty=True),
                         v.SlugifyName())
         repo_group = All(v.CanWriteGroup(old_data),
                          v.OneOf(repo_groups, hideList=True))
         repo_type = v.OneOf(supported_backends, required=False,
                             if_missing=old_data.get('repo_type'))
         repo_description = v.UnicodeString(strip=True, min=1, not_empty=False)
         repo_private = v.StringBoolean(if_missing=False)
         repo_landing_rev = v.OneOf(landing_revs, hideList=True)
         repo_copy_permissions = v.StringBoolean(if_missing=False)
         clone_uri = All(v.UnicodeString(strip=True, min=1, not_empty=False))
 
         repo_enable_statistics = v.StringBoolean(if_missing=False)
         repo_enable_downloads = v.StringBoolean(if_missing=False)
         repo_enable_locking = v.StringBoolean(if_missing=False)
 
         if edit:
             # this is repo owner
             user = All(
                 v.UnicodeString(not_empty=True),
                 v.ValidRepoUser(allow_disabled))
             clone_uri_change = v.UnicodeString(
                 not_empty=False, if_missing=v.Missing)
 
         chained_validators = [v.ValidCloneUri(),
                               v.ValidRepoName(edit, old_data)]
     return _RepoForm
 
 
 def RepoPermsForm():
     class _RepoPermsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         chained_validators = [v.ValidPerms(type_='repo')]
     return _RepoPermsForm
 
 
 def RepoGroupPermsForm(valid_recursive_choices):
     class _RepoGroupPermsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         recursive = v.OneOf(valid_recursive_choices)
         chained_validators = [v.ValidPerms(type_='repo_group')]
     return _RepoGroupPermsForm
 
 
 def UserGroupPermsForm():
     class _UserPermsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         chained_validators = [v.ValidPerms(type_='user_group')]
     return _UserPermsForm
 
 
 def RepoFieldForm():
     class _RepoFieldForm(formencode.Schema):
         filter_extra_fields = True
         allow_extra_fields = True
 
         new_field_key = All(v.FieldKey(),
                             v.UnicodeString(strip=True, min=3, not_empty=True))
         new_field_value = v.UnicodeString(not_empty=False, if_missing=u'')
         new_field_type = v.OneOf(['str', 'unicode', 'list', 'tuple'],
                                  if_missing='str')
         new_field_label = v.UnicodeString(not_empty=False)
         new_field_desc = v.UnicodeString(not_empty=False)
 
     return _RepoFieldForm
 
 
 def RepoForkForm(edit=False, old_data={}, supported_backends=BACKENDS.keys(),
                  repo_groups=[], landing_revs=[]):
     class _RepoForkForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         repo_name = All(v.UnicodeString(strip=True, min=1, not_empty=True),
                         v.SlugifyName())
         repo_group = All(v.CanWriteGroup(),
                          v.OneOf(repo_groups, hideList=True))
         repo_type = All(v.ValidForkType(old_data), v.OneOf(supported_backends))
         description = v.UnicodeString(strip=True, min=1, not_empty=True)
         private = v.StringBoolean(if_missing=False)
         copy_permissions = v.StringBoolean(if_missing=False)
         fork_parent_id = v.UnicodeString()
         chained_validators = [v.ValidForkName(edit, old_data)]
         landing_rev = v.OneOf(landing_revs, hideList=True)
 
     return _RepoForkForm
 
 
 def ApplicationSettingsForm():
     class _ApplicationSettingsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         rhodecode_title = v.UnicodeString(strip=True, max=40, not_empty=False)
         rhodecode_realm = v.UnicodeString(strip=True, min=1, not_empty=True)
         rhodecode_pre_code = v.UnicodeString(strip=True, min=1, not_empty=False)
         rhodecode_post_code = v.UnicodeString(strip=True, min=1, not_empty=False)
         rhodecode_captcha_public_key = v.UnicodeString(strip=True, min=1, not_empty=False)
         rhodecode_captcha_private_key = v.UnicodeString(strip=True, min=1, not_empty=False)
 
     return _ApplicationSettingsForm
 
 
 def ApplicationVisualisationForm():
     class _ApplicationVisualisationForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         rhodecode_show_public_icon = v.StringBoolean(if_missing=False)
         rhodecode_show_private_icon = v.StringBoolean(if_missing=False)
         rhodecode_stylify_metatags = v.StringBoolean(if_missing=False)
 
         rhodecode_repository_fields = v.StringBoolean(if_missing=False)
         rhodecode_lightweight_journal = v.StringBoolean(if_missing=False)
         rhodecode_dashboard_items = v.Int(min=5, not_empty=True)
         rhodecode_admin_grid_items = v.Int(min=5, not_empty=True)
         rhodecode_show_version = v.StringBoolean(if_missing=False)
         rhodecode_use_gravatar = v.StringBoolean(if_missing=False)
         rhodecode_markup_renderer = v.OneOf(['markdown', 'rst'])
         rhodecode_gravatar_url = v.UnicodeString(min=3)
         rhodecode_clone_uri_tmpl = v.UnicodeString(min=3)
         rhodecode_support_url = v.UnicodeString()
         rhodecode_show_revision_number = v.StringBoolean(if_missing=False)
         rhodecode_show_sha_length = v.Int(min=4, not_empty=True)
 
     return _ApplicationVisualisationForm
 
 
 class _BaseVcsSettingsForm(formencode.Schema):
     allow_extra_fields = True
     filter_extra_fields = False
     hooks_changegroup_repo_size = v.StringBoolean(if_missing=False)
     hooks_changegroup_push_logger = v.StringBoolean(if_missing=False)
     hooks_outgoing_pull_logger = v.StringBoolean(if_missing=False)
 
     extensions_largefiles = v.StringBoolean(if_missing=False)
     phases_publish = v.StringBoolean(if_missing=False)
 
     rhodecode_pr_merge_enabled = v.StringBoolean(if_missing=False)
     rhodecode_use_outdated_comments = v.StringBoolean(if_missing=False)
     rhodecode_hg_use_rebase_for_merging = v.StringBoolean(if_missing=False)
 
     vcs_svn_proxy_http_requests_enabled = v.StringBoolean(if_missing=False)
     vcs_svn_proxy_http_server_url = v.UnicodeString(strip=True, if_missing=None)
 
 
 def ApplicationUiSettingsForm():
     class _ApplicationUiSettingsForm(_BaseVcsSettingsForm):
         web_push_ssl = v.StringBoolean(if_missing=False)
         paths_root_path = All(
             v.ValidPath(),
             v.UnicodeString(strip=True, min=1, not_empty=True)
         )
         extensions_hgsubversion = v.StringBoolean(if_missing=False)
         extensions_hggit = v.StringBoolean(if_missing=False)
         new_svn_branch = v.ValidSvnPattern(section='vcs_svn_branch')
         new_svn_tag = v.ValidSvnPattern(section='vcs_svn_tag')
 
     return _ApplicationUiSettingsForm
 
 
 def RepoVcsSettingsForm(repo_name):
     class _RepoVcsSettingsForm(_BaseVcsSettingsForm):
         inherit_global_settings = v.StringBoolean(if_missing=False)
         new_svn_branch = v.ValidSvnPattern(
             section='vcs_svn_branch', repo_name=repo_name)
         new_svn_tag = v.ValidSvnPattern(
             section='vcs_svn_tag', repo_name=repo_name)
 
     return _RepoVcsSettingsForm
 
 
 def LabsSettingsForm():
     class _LabSettingsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
 
     return _LabSettingsForm
 
 
-def ApplicationPermissionsForm(register_choices, extern_activate_choices):
+def ApplicationPermissionsForm(
+        register_choices, password_reset_choices, extern_activate_choices):
     class _DefaultPermissionsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
 
         anonymous = v.StringBoolean(if_missing=False)
         default_register = v.OneOf(register_choices)
         default_register_message = v.UnicodeString()
+        default_password_reset = v.OneOf(password_reset_choices)
         default_extern_activate = v.OneOf(extern_activate_choices)
 
     return _DefaultPermissionsForm
 
 
 def ObjectPermissionsForm(repo_perms_choices, group_perms_choices,
                           user_group_perms_choices):
     class _ObjectPermissionsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
         overwrite_default_repo = v.StringBoolean(if_missing=False)
         overwrite_default_group = v.StringBoolean(if_missing=False)
         overwrite_default_user_group = v.StringBoolean(if_missing=False)
         default_repo_perm = v.OneOf(repo_perms_choices)
         default_group_perm = v.OneOf(group_perms_choices)
         default_user_group_perm = v.OneOf(user_group_perms_choices)
 
     return _ObjectPermissionsForm
 
 
 def UserPermissionsForm(create_choices, create_on_write_choices,
                         repo_group_create_choices, user_group_create_choices,
                         fork_choices, inherit_default_permissions_choices):
     class _DefaultPermissionsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
 
         anonymous = v.StringBoolean(if_missing=False)
 
         default_repo_create = v.OneOf(create_choices)
         default_repo_create_on_write = v.OneOf(create_on_write_choices)
         default_user_group_create = v.OneOf(user_group_create_choices)
         default_repo_group_create = v.OneOf(repo_group_create_choices)
         default_fork_create = v.OneOf(fork_choices)
         default_inherit_default_permissions = v.OneOf(inherit_default_permissions_choices)
 
     return _DefaultPermissionsForm
 
 
 def UserIndividualPermissionsForm():
     class _DefaultPermissionsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
 
         inherit_default_permissions = v.StringBoolean(if_missing=False)
 
     return _DefaultPermissionsForm
 
 
 def DefaultsForm(edit=False, old_data={}, supported_backends=BACKENDS.keys()):
     class _DefaultsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
         default_repo_type = v.OneOf(supported_backends)
         default_repo_private = v.StringBoolean(if_missing=False)
         default_repo_enable_statistics = v.StringBoolean(if_missing=False)
         default_repo_enable_downloads = v.StringBoolean(if_missing=False)
         default_repo_enable_locking = v.StringBoolean(if_missing=False)
 
     return _DefaultsForm
 
 
 def AuthSettingsForm():
     class _AuthSettingsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
         auth_plugins = All(v.ValidAuthPlugins(),
                            v.UniqueListFromString()(not_empty=True))
 
     return _AuthSettingsForm
 
 
 def UserExtraEmailForm():
     class _UserExtraEmailForm(formencode.Schema):
         email = All(v.UniqSystemEmail(), v.Email(not_empty=True))
     return _UserExtraEmailForm
 
 
 def UserExtraIpForm():
     class _UserExtraIpForm(formencode.Schema):
         ip = v.ValidIp()(not_empty=True)
     return _UserExtraIpForm
 
 
 
 def PullRequestForm(repo_id):
     class ReviewerForm(formencode.Schema):
         user_id = v.Int(not_empty=True)
         reasons = All()
 
     class _PullRequestForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
 
         user = v.UnicodeString(strip=True, required=True)
         source_repo = v.UnicodeString(strip=True, required=True)
         source_ref = v.UnicodeString(strip=True, required=True)
         target_repo = v.UnicodeString(strip=True, required=True)
         target_ref = v.UnicodeString(strip=True, required=True)
         revisions = All(#v.NotReviewedRevisions(repo_id)(),
                         v.UniqueList()(not_empty=True))
         review_members = formencode.ForEach(ReviewerForm())
         pullrequest_title = v.UnicodeString(strip=True, required=True)
         pullrequest_desc = v.UnicodeString(strip=True, required=False)
 
     return _PullRequestForm
 
 
 def IssueTrackerPatternsForm():
     class _IssueTrackerPatternsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         chained_validators = [v.ValidPattern()]
     return _IssueTrackerPatternsForm

rhodecode/model/permission.py

@@ -1,470 +1,482 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2016  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 permissions model for RhodeCode
 """
 
 
 import logging
 import traceback
 
 from sqlalchemy.exc import DatabaseError
 
 from rhodecode.model import BaseModel
 from rhodecode.model.db import (
     User, Permission, UserToPerm, UserRepoToPerm, UserRepoGroupToPerm,
     UserUserGroupToPerm, UserGroup, UserGroupToPerm)
 from rhodecode.lib.utils2 import str2bool, safe_int
 
 log = logging.getLogger(__name__)
 
 
 class PermissionModel(BaseModel):
     """
     Permissions model for RhodeCode
     """
 
     cls = Permission
     global_perms = {
         'default_repo_create': None,
         # special case for create repos on write access to group
         'default_repo_create_on_write': None,
         'default_repo_group_create': None,
         'default_user_group_create': None,
         'default_fork_create': None,
         'default_inherit_default_permissions': None,
-
         'default_register': None,
+        'default_password_reset': None,
         'default_extern_activate': None,
 
         # object permissions below
         'default_repo_perm': None,
         'default_group_perm': None,
         'default_user_group_perm': None,
     }
 
     def set_global_permission_choices(self, c_obj, translator):
         c_obj.repo_perms_choices = [
             ('repository.none', translator('None'),),
             ('repository.read', translator('Read'),),
             ('repository.write', translator('Write'),),
             ('repository.admin', translator('Admin'),)]
 
         c_obj.group_perms_choices = [
             ('group.none', translator('None'),),
             ('group.read', translator('Read'),),
             ('group.write', translator('Write'),),
             ('group.admin', translator('Admin'),)]
 
         c_obj.user_group_perms_choices = [
             ('usergroup.none', translator('None'),),
             ('usergroup.read', translator('Read'),),
             ('usergroup.write', translator('Write'),),
             ('usergroup.admin', translator('Admin'),)]
 
         c_obj.register_choices = [
             ('hg.register.none', translator('Disabled')),
             ('hg.register.manual_activate', translator('Allowed with manual account activation')),
             ('hg.register.auto_activate', translator('Allowed with automatic account activation')),]
 
+        c_obj.password_reset_choices = [
+            ('hg.password_reset.enabled', translator('Allow password recovery')),
+            ('hg.password_reset.hidden', translator('Hide password recovery link')),
+            ('hg.password_reset.disabled', translator('Disable password recovery')),]
+
         c_obj.extern_activate_choices = [
             ('hg.extern_activate.manual', translator('Manual activation of external account')),
             ('hg.extern_activate.auto', translator('Automatic activation of external account')),]
 
         c_obj.repo_create_choices = [
             ('hg.create.none', translator('Disabled')),
             ('hg.create.repository', translator('Enabled'))]
 
         c_obj.repo_create_on_write_choices = [
             ('hg.create.write_on_repogroup.false', translator('Disabled')),
             ('hg.create.write_on_repogroup.true', translator('Enabled'))]
 
         c_obj.user_group_create_choices = [
             ('hg.usergroup.create.false', translator('Disabled')),
             ('hg.usergroup.create.true', translator('Enabled'))]
 
         c_obj.repo_group_create_choices = [
             ('hg.repogroup.create.false', translator('Disabled')),
             ('hg.repogroup.create.true', translator('Enabled'))]
 
         c_obj.fork_choices = [
             ('hg.fork.none', translator('Disabled')),
             ('hg.fork.repository', translator('Enabled'))]
 
         c_obj.inherit_default_permission_choices = [
             ('hg.inherit_default_perms.false', translator('Disabled')),
             ('hg.inherit_default_perms.true', translator('Enabled'))]
 
     def get_default_perms(self, object_perms, suffix):
         defaults = {}
         for perm in object_perms:
             # perms
             if perm.permission.permission_name.startswith('repository.'):
                 defaults['default_repo_perm' + suffix] = perm.permission.permission_name
 
             if perm.permission.permission_name.startswith('group.'):
                 defaults['default_group_perm' + suffix] = perm.permission.permission_name
 
             if perm.permission.permission_name.startswith('usergroup.'):
                 defaults['default_user_group_perm' + suffix] = perm.permission.permission_name
 
             # creation of objects
             if perm.permission.permission_name.startswith('hg.create.write_on_repogroup'):
                 defaults['default_repo_create_on_write' + suffix] = perm.permission.permission_name
 
             elif perm.permission.permission_name.startswith('hg.create.'):
                 defaults['default_repo_create' + suffix] = perm.permission.permission_name
 
             if perm.permission.permission_name.startswith('hg.fork.'):
                 defaults['default_fork_create' + suffix] = perm.permission.permission_name
 
             if perm.permission.permission_name.startswith('hg.inherit_default_perms.'):
                 defaults['default_inherit_default_permissions' + suffix] = perm.permission.permission_name
 
             if perm.permission.permission_name.startswith('hg.repogroup.'):
                 defaults['default_repo_group_create' + suffix] = perm.permission.permission_name
 
             if perm.permission.permission_name.startswith('hg.usergroup.'):
                 defaults['default_user_group_create' + suffix] = perm.permission.permission_name
 
             # registration and external account activation
             if perm.permission.permission_name.startswith('hg.register.'):
                 defaults['default_register' + suffix] = perm.permission.permission_name
 
+            if perm.permission.permission_name.startswith('hg.password_reset.'):
+                defaults['default_password_reset' + suffix] = perm.permission.permission_name
+
             if perm.permission.permission_name.startswith('hg.extern_activate.'):
                 defaults['default_extern_activate' + suffix] = perm.permission.permission_name
 
         return defaults
 
     def _make_new_user_perm(self, user, perm_name):
         log.debug('Creating new user permission:%s', perm_name)
         new = UserToPerm()
         new.user = user
         new.permission = Permission.get_by_key(perm_name)
         return new
 
     def _make_new_user_group_perm(self, user_group, perm_name):
         log.debug('Creating new user group permission:%s', perm_name)
         new = UserGroupToPerm()
         new.users_group = user_group
         new.permission = Permission.get_by_key(perm_name)
         return new
 
     def _keep_perm(self, perm_name, keep_fields):
         def get_pat(field_name):
             return {
                 # global perms
                 'default_repo_create': 'hg.create.',
                 # special case for create repos on write access to group
                 'default_repo_create_on_write': 'hg.create.write_on_repogroup.',
                 'default_repo_group_create': 'hg.repogroup.create.',
                 'default_user_group_create': 'hg.usergroup.create.',
                 'default_fork_create': 'hg.fork.',
                 'default_inherit_default_permissions': 'hg.inherit_default_perms.',
 
                 # application perms
                 'default_register': 'hg.register.',
+                'default_password_reset': 'hg.password_reset.',
                 'default_extern_activate': 'hg.extern_activate.',
 
                 # object permissions below
                 'default_repo_perm': 'repository.',
                 'default_group_perm': 'group.',
                 'default_user_group_perm': 'usergroup.',
             }[field_name]
         for field in keep_fields:
             pat = get_pat(field)
             if perm_name.startswith(pat):
                 return True
         return False
 
     def _clear_object_perm(self, object_perms, preserve=None):
         preserve = preserve or []
         _deleted = []
         for perm in object_perms:
             perm_name = perm.permission.permission_name
             if not self._keep_perm(perm_name, keep_fields=preserve):
                 _deleted.append(perm_name)
                 self.sa.delete(perm)
         return _deleted
 
     def _clear_user_perms(self, user_id, preserve=None):
         perms = self.sa.query(UserToPerm)\
             .filter(UserToPerm.user_id == user_id)\
             .all()
         return self._clear_object_perm(perms, preserve=preserve)
 
     def _clear_user_group_perms(self, user_group_id, preserve=None):
         perms = self.sa.query(UserGroupToPerm)\
             .filter(UserGroupToPerm.users_group_id == user_group_id)\
             .all()
         return self._clear_object_perm(perms, preserve=preserve)
 
     def _set_new_object_perms(self, obj_type, object, form_result, preserve=None):
         # clear current entries, to make this function idempotent
         # it will fix even if we define more permissions or permissions
         # are somehow missing
         preserve = preserve or []
         _global_perms = self.global_perms.copy()
         if obj_type not in ['user', 'user_group']:
             raise ValueError("obj_type must be on of 'user' or 'user_group'")
         if len(_global_perms) != len(Permission.DEFAULT_USER_PERMISSIONS):
             raise Exception('Inconsistent permissions definition')
 
         if obj_type == 'user':
             self._clear_user_perms(object.user_id, preserve)
         if obj_type == 'user_group':
             self._clear_user_group_perms(object.users_group_id, preserve)
 
         # now kill the keys that we want to preserve from the form.
         for key in preserve:
             del _global_perms[key]
 
         for k in _global_perms.copy():
             _global_perms[k] = form_result[k]
 
         # at that stage we validate all are passed inside form_result
         for _perm_key, perm_value in _global_perms.items():
             if perm_value is None:
                 raise ValueError('Missing permission for %s' % (_perm_key,))
 
             if obj_type == 'user':
                 p = self._make_new_user_perm(object, perm_value)
                 self.sa.add(p)
             if obj_type == 'user_group':
                 p = self._make_new_user_group_perm(object, perm_value)
                 self.sa.add(p)
 
     def _set_new_user_perms(self, user, form_result, preserve=None):
         return self._set_new_object_perms(
             'user', user, form_result, preserve)
 
     def _set_new_user_group_perms(self, user_group, form_result, preserve=None):
         return self._set_new_object_perms(
             'user_group', user_group, form_result, preserve)
 
     def set_new_user_perms(self, user, form_result):
         # calculate what to preserve from what is given in form_result
         preserve = set(self.global_perms.keys()).difference(set(form_result.keys()))
         return self._set_new_user_perms(user, form_result, preserve)
 
     def set_new_user_group_perms(self, user_group, form_result):
         # calculate what to preserve from what is given in form_result
         preserve = set(self.global_perms.keys()).difference(set(form_result.keys()))
         return self._set_new_user_group_perms(user_group, form_result, preserve)
 
     def create_permissions(self):
         """
         Create permissions for whole system
         """
         for p in Permission.PERMS:
             if not Permission.get_by_key(p[0]):
                 new_perm = Permission()
                 new_perm.permission_name = p[0]
                 new_perm.permission_longname = p[0]  # translation err with p[1]
                 self.sa.add(new_perm)
 
     def _create_default_object_permission(self, obj_type, obj, obj_perms,
                                           force=False):
         if obj_type not in ['user', 'user_group']:
             raise ValueError("obj_type must be on of 'user' or 'user_group'")
 
         def _get_group(perm_name):
             return '.'.join(perm_name.split('.')[:1])
 
         defined_perms_groups = map(
             _get_group, (x.permission.permission_name for x in obj_perms))
         log.debug('GOT ALREADY DEFINED:%s', obj_perms)
 
         if force:
             self._clear_object_perm(obj_perms)
             self.sa.commit()
             defined_perms_groups = []
         # for every default permission that needs to be created, we check if
         # it's group is already defined, if it's not we create default perm
         for perm_name in Permission.DEFAULT_USER_PERMISSIONS:
             gr = _get_group(perm_name)
             if gr not in defined_perms_groups:
                 log.debug('GR:%s not found, creating permission %s',
                           gr, perm_name)
                 if obj_type == 'user':
                     new_perm = self._make_new_user_perm(obj, perm_name)
                     self.sa.add(new_perm)
                 if obj_type == 'user_group':
                     new_perm = self._make_new_user_group_perm(obj, perm_name)
                     self.sa.add(new_perm)
 
     def create_default_user_permissions(self, user, force=False):
         """
         Creates only missing default permissions for user, if force is set it
         resets the default permissions for that user
 
         :param user:
         :param force:
         """
         user = self._get_user(user)
         obj_perms = UserToPerm.query().filter(UserToPerm.user == user).all()
         return self._create_default_object_permission(
             'user', user, obj_perms, force)
 
     def create_default_user_group_permissions(self, user_group, force=False):
         """
         Creates only missing default permissions for user group, if force is set it
         resets the default permissions for that user group
 
         :param user_group:
         :param force:
         """
         user_group = self._get_user_group(user_group)
         obj_perms = UserToPerm.query().filter(UserGroupToPerm.users_group == user_group).all()
         return self._create_default_object_permission(
             'user_group', user_group, obj_perms, force)
 
     def update_application_permissions(self, form_result):
         if 'perm_user_id' in form_result:
             perm_user = User.get(safe_int(form_result['perm_user_id']))
         else:
             # used mostly to do lookup for default user
             perm_user = User.get_by_username(form_result['perm_user_name'])
 
         try:
             # stage 1 set anonymous access
             if perm_user.username == User.DEFAULT_USER:
                 perm_user.active = str2bool(form_result['anonymous'])
                 self.sa.add(perm_user)
 
             # stage 2 reset defaults and set them from form data
             self._set_new_user_perms(perm_user, form_result, preserve=[
                 'default_repo_perm',
                 'default_group_perm',
                 'default_user_group_perm',
 
                 'default_repo_group_create',
                 'default_user_group_create',
                 'default_repo_create_on_write',
                 'default_repo_create',
                 'default_fork_create',
                 'default_inherit_default_permissions',])
 
             self.sa.commit()
         except (DatabaseError,):
             log.error(traceback.format_exc())
             self.sa.rollback()
             raise
 
     def update_user_permissions(self, form_result):
         if 'perm_user_id' in form_result:
             perm_user = User.get(safe_int(form_result['perm_user_id']))
         else:
             # used mostly to do lookup for default user
             perm_user = User.get_by_username(form_result['perm_user_name'])
         try:
             # stage 2 reset defaults and set them from form data
             self._set_new_user_perms(perm_user, form_result, preserve=[
                 'default_repo_perm',
                 'default_group_perm',
                 'default_user_group_perm',
 
                 'default_register',
+                'default_password_reset',
                 'default_extern_activate'])
             self.sa.commit()
         except (DatabaseError,):
             log.error(traceback.format_exc())
             self.sa.rollback()
             raise
 
     def update_user_group_permissions(self, form_result):
         if 'perm_user_group_id' in form_result:
             perm_user_group = UserGroup.get(safe_int(form_result['perm_user_group_id']))
         else:
             # used mostly to do lookup for default user
             perm_user_group = UserGroup.get_by_group_name(form_result['perm_user_group_name'])
         try:
             # stage 2 reset defaults and set them from form data
             self._set_new_user_group_perms(perm_user_group, form_result, preserve=[
                 'default_repo_perm',
                 'default_group_perm',
                 'default_user_group_perm',
 
                 'default_register',
+                'default_password_reset',
                 'default_extern_activate'])
             self.sa.commit()
         except (DatabaseError,):
             log.error(traceback.format_exc())
             self.sa.rollback()
             raise
 
     def update_object_permissions(self, form_result):
         if 'perm_user_id' in form_result:
             perm_user = User.get(safe_int(form_result['perm_user_id']))
         else:
             # used mostly to do lookup for default user
             perm_user = User.get_by_username(form_result['perm_user_name'])
         try:
 
             # stage 2 reset defaults and set them from form data
             self._set_new_user_perms(perm_user, form_result, preserve=[
                 'default_repo_group_create',
                 'default_user_group_create',
                 'default_repo_create_on_write',
                 'default_repo_create',
                 'default_fork_create',
                 'default_inherit_default_permissions',
 
                 'default_register',
+                'default_password_reset',
                 'default_extern_activate'])
 
             # overwrite default repo permissions
             if form_result['overwrite_default_repo']:
                 _def_name = form_result['default_repo_perm'].split('repository.')[-1]
                 _def = Permission.get_by_key('repository.' + _def_name)
                 for r2p in self.sa.query(UserRepoToPerm)\
                                .filter(UserRepoToPerm.user == perm_user)\
                                .all():
                     # don't reset PRIVATE repositories
                     if not r2p.repository.private:
                         r2p.permission = _def
                         self.sa.add(r2p)
 
             # overwrite default repo group permissions
             if form_result['overwrite_default_group']:
                 _def_name = form_result['default_group_perm'].split('group.')[-1]
                 _def = Permission.get_by_key('group.' + _def_name)
                 for g2p in self.sa.query(UserRepoGroupToPerm)\
                                .filter(UserRepoGroupToPerm.user == perm_user)\
                                .all():
                     g2p.permission = _def
                     self.sa.add(g2p)
 
             # overwrite default user group permissions
             if form_result['overwrite_default_user_group']:
                 _def_name = form_result['default_user_group_perm'].split('usergroup.')[-1]
                 # user groups
                 _def = Permission.get_by_key('usergroup.' + _def_name)
                 for g2p in self.sa.query(UserUserGroupToPerm)\
                                .filter(UserUserGroupToPerm.user == perm_user)\
                                .all():
                     g2p.permission = _def
                     self.sa.add(g2p)
             self.sa.commit()
         except (DatabaseError,):
             log.exception('Failed to set default object permissions')
             self.sa.rollback()
             raise

rhodecode/public/css/login.less

@@ -1,297 +1,301 b''
 //LOGIN
 
 
 .loginbox {
     max-width: 65%;
     margin: @pagepadding auto;
     font-family: @text-light;
     border: @border-thickness solid @grey5;
     box-sizing: border-box;
 
     @media (max-width:1200px) {
         max-width: 85%;
     }
 
     @media (max-width:768px) {
         max-width: 100%;
         width: 100%;
         margin: 0;
     }
 
     .title {
         float: none;
     }
 
     .header {
         width: 100%;
         padding: 0 35px;
         box-sizing: border-box;
 
         .title {
             padding: 0;
         }
     }
 
     .loginwrapper {
         float: left;
         height: 100%;
         width: 100%;
         padding: 35px 55px 35px 0;
         background-color: white;
         box-sizing: border-box;
 
         @media (max-width:414px) {
             padding: 35px;
         }
     }
 
     .left-column {
         float: left;
         position: relative;
         width: 50%;
         height: 100%;
 
         @media (max-width:414px) {
             display:none;
         }
     }
 
     .right-column {
         float: right;
         position: relative;
         width: 50%;
 
         @media (max-width:414px) {
             width: 100%;
         }
     }
 
     .sign-in-image {
         display: block;
         width: 65%;
         margin: 5% auto;
     }
 
     .sign-in-title {
         h1 {
             margin: 0;
         }
 
         h4 {
             margin: @padding*2 0;
         }
     }
 
     .form {
         label {
             display: block;
         }
 
         input {
             width: 100%;
             margin: 0 10% @padding 0;
             .box-sizing(border-box) ;
 
             &[type="checkbox"] {
                 clear: both;
                 width: auto;
                 margin: 0 1em @padding 0;
             }
         }
         
         .checkbox {
             display: inline;
             width: auto;
         }
 
         .sign-in {
             clear: both;
             width: 100%;
             margin: @padding 0;
         }
     }
     .register_message,
     .activation_msg {
         padding: 0 0 @padding;
     }
 
     .buttons,
     .links {
         padding: 0;
     }
 
     .buttons {
         input {
             margin-right: 0;
             .box-sizing(border-box);
         }
 
         #sign_up, #send {
             width: 100%;
         }
     }
 
     .fields {
         .field.field-compact {
             margin-bottom: 0px;
         }
 
         .buttons {
             margin: 0;
         }
 
         .field {
             margin-bottom: 15px;
 
             input {
                 width: 100%;
                 .box-sizing(border-box);
             }
 
             .input {
                 margin-left: 0;
             }
 
             .label {
                 padding-top: 0;
             }
         }
     }
 
     .checkbox {
         margin:  0 0 @textmargin 0;
 
         input[type="checkbox"] {
             width: auto;
         }
 
         label {
             padding: 0;
             min-height: 0;
         }
     }
 
     .activation_msg {
         padding: @padding 0 0;
         color: @grey4;
     }
 
     .links {
         float: right;
         margin: 0;
         padding: 0;
         line-height: 1;
 
         p {
             float: right;
             margin: 0;
             line-height: 1.5em;
         }
     }
+
+    p.help-block {
+        margin-left: 0;
+    }
 }
 
 .user-menu.submenu {
     right: 0; 
     left: auto;
 }
 #quick_login {
     left: auto;
     right: 0;
     padding: @menupadding;
     z-index: 999;
     overflow: hidden;
     background-color: @grey6;
     color: @grey2;
 
     h4 {
         margin-bottom: 12px;
     }
 
     .form {
         width: auto;
     }
 
     label, .field {
         margin-bottom: 0;
     }
 
     .label {
         padding-top: 0;
     }
 
     input {
         min-width: 215px;
         margin: 8px 0 @padding;
     }
 
     input[type="submit"] {
         &:extend(.btn-primary);
         width:100%;
         min-width: 0;
     }
 
     .forgot_password,
     .buttons .register {
         a {
             color: @rcblue;
     
             &:hover {
                 color: @rcdarkblue;
             }
         }
     }
 
     .buttons {
         margin: 0;
     }
 
     .buttons a {
         padding: 8px 0;
         line-height: 1.4em;
         color: @grey4;
 
         &:hover {
             color: @grey2;
         }
     }
 
     #sign_in {
         margin-bottom: 0
     }
 
     .big_gravatar {
         float: left;
         display: block;
         margin-top: .5em;
     }
 
     .full_name,
     .email {
         margin: 0 0 0 65px;
     }
 
     .email {
         font-family: @text-light;
     }
 
     ol.links {
         clear:both;
         margin: 0;
         padding: @padding 0 0 0;
 
         li {
             border-top: @border-thickness solid @grey5;
 
             input {
                 margin: @padding 0 0 0;
             }
         }
     }
 }
 .submenu #quick_login li:hover {
     background-color: transparent;
 }
 
 #quick_login_link:hover + #quick_login {
     display: block;
 }

rhodecode/templates/admin/permissions/permissions_application.html

@@ -1,71 +1,81 b''
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('System Wide Application Permissions')}</h3>
     </div>
     <div class="panel-body">
         ${h.secure_form(url('admin_permissions_application'), method='post')}
             <div class="form">
                 <!-- fields -->
                 <div class="fields">
                     <div class="field">
                         <div class="label label-checkbox">
                             <label for="anonymous">${_('Anonymous Access')}:</label>
                         </div>
                         <div class="checkboxes">
                             <div class="checkbox">
                                 ${h.checkbox('anonymous',True)} Allow Anonymous Access
                             </div>
                              <span class="help-block">${h.literal(_('Allow access to RhodeCode Enterprise without requiring users to login. Anonymous users get the %s permission settings.' % (h.link_to('"default user"',h.url('admin_permissions_object')))))}</span>
                         </div>
                     </div>
 
                     <div class="field">
                         <div class="label label-select">
                             <label for="default_register">${_('Registration')}:</label>
                         </div>
                         <div class="select">
                             ${h.select('default_register','',c.register_choices)}
                         </div>
                     </div>
 
                     <div class="field">
+                        <div class="label label-select">
+                            <label for="default_password_reset">${_('Password Reset')}:</label>
+                        </div>
+                        <div class="select">
+                            ${h.select('default_password_reset','',c.password_reset_choices)}
+                        </div>
+                    </div>
+
+                    <div class="field">
                         <div class="label label-textarea">
                             <label for="default_register_message">${_('Registration Page Message')}:</label>
                         </div>
                         <div class="textarea text-area editor" >
                             ${h.textarea('default_register_message', class_="medium", )}
                             <span class="help-block">${_('Custom message to be displayed on the registration page. HTML syntax is supported.')}</span>
                         </div>
                      </div>
 
                      <div class="field">
                         <div class="label">
                             <label for="default_extern_activate">${_('External Authentication Account Activation')}:</label>
                         </div>
                         <div class="select">
                             ${h.select('default_extern_activate','',c.extern_activate_choices)}
                         </div>
                      </div>
                     <div class="buttons">
                       ${h.submit('save',_('Save'),class_="btn")}
                       ${h.reset('reset',_('Reset'),class_="btn")}
                     </div>
                 </div>
             </div>
         ${h.end_form()}
     </div>
 </div>
 
 <script>
     $(document).ready(function(){
         var select2Options = {
             containerCssClass: 'drop-menu',
             dropdownCssClass: 'drop-menu-dropdown',
             dropdownAutoWidth: true,
             minimumResultsForSearch: -1
         };
 
         $("#default_register").select2(select2Options);
+        $("#default_password_reset").select2(select2Options);
         $("#default_extern_activate").select2(select2Options);
     });
 </script>

rhodecode/templates/base/base.html

@@ -1,651 +1,653 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="root.html"/>
 
 <div class="outerwrapper">
   <!-- HEADER -->
   <div class="header">
       <div id="header-inner" class="wrapper">
           <div id="logo">
               <div class="logo-wrapper">
                   <a href="${h.url('home')}"><img src="${h.asset('images/rhodecode-logo-white-216x60.png')}" alt="RhodeCode"/></a>
               </div>
               %if c.rhodecode_name:
                <div class="branding">- ${h.branding(c.rhodecode_name)}</div>
               %endif
           </div>
           <!-- MENU BAR NAV -->
           ${self.menu_bar_nav()}
           <!-- END MENU BAR NAV -->
       </div>
   </div>
   ${self.menu_bar_subnav()}
   <!-- END HEADER -->
 
   <!-- CONTENT -->
   <div id="content" class="wrapper">
       <div class="main">
           ${next.main()}
       </div>
   </div>
   <!-- END CONTENT -->
 
 </div>
 <!-- FOOTER -->
 <div id="footer">
    <div id="footer-inner" class="title wrapper">
        <div>
            <p class="footer-link-right">
                % if c.visual.show_version:
                    RhodeCode Enterprise ${c.rhodecode_version} ${c.rhodecode_edition}
                % endif
                &copy; 2010-${h.datetime.today().year}, <a href="${h.url('rhodecode_official')}" target="_blank">RhodeCode GmbH</a>. All rights reserved.
                % if c.visual.rhodecode_support_url:
                   <a href="${c.visual.rhodecode_support_url}" target="_blank">${_('Support')}</a>
                % endif
            </p>
            <% sid = 'block' if request.GET.get('showrcid') else 'none' %>
            <p class="server-instance" style="display:${sid}">
                ## display hidden instance ID if specially defined
                % if c.rhodecode_instanceid:
                    ${_('RhodeCode instance id: %s') % c.rhodecode_instanceid}
                % endif
            </p>
        </div>
    </div>
 </div>
 
 <!-- END FOOTER -->
 
 ### MAKO DEFS ###
 
 <%def name="menu_bar_subnav()">
 </%def>
 
 <%def name="breadcrumbs(class_='breadcrumbs')">
     <div class="${class_}">
     ${self.breadcrumbs_links()}
     </div>
 </%def>
 
 <%def name="admin_menu()">
   <ul class="admin_menu submenu">
       <li><a href="${h.url('admin_home')}">${_('Admin journal')}</a></li>
       <li><a href="${h.url('repos')}">${_('Repositories')}</a></li>
       <li><a href="${h.url('repo_groups')}">${_('Repository groups')}</a></li>
       <li><a href="${h.url('users')}">${_('Users')}</a></li>
       <li><a href="${h.url('users_groups')}">${_('User groups')}</a></li>
       <li><a href="${h.url('admin_permissions_application')}">${_('Permissions')}</a></li>
       <li><a href="${h.route_path('auth_home', traverse='')}">${_('Authentication')}</a></li>
       <li><a href="${h.route_path('global_integrations_home')}">${_('Integrations')}</a></li>
       <li><a href="${h.url('admin_defaults_repositories')}">${_('Defaults')}</a></li>
       <li class="last"><a href="${h.url('admin_settings')}">${_('Settings')}</a></li>
   </ul>
 </%def>
 
 
 <%def name="dt_info_panel(elements)">
     <dl class="dl-horizontal">
     %for dt, dd, title, show_items in elements:
       <dt>${dt}:</dt>
       <dd title="${title}">
       %if callable(dd):
           ## allow lazy evaluation of elements
           ${dd()}
       %else:
           ${dd}
       %endif
       %if show_items:
           <span class="btn-collapse" data-toggle="item-${h.md5_safe(dt)[:6]}-details">${_('Show More')} </span>
       %endif
       </dd>
 
       %if show_items:
           <div class="collapsable-content" data-toggle="item-${h.md5_safe(dt)[:6]}-details" style="display: none">
           %for item in show_items:
               <dt></dt>
               <dd>${item}</dd>
           %endfor
           </div>
       %endif
 
     %endfor
     </dl>
 </%def>
 
 
 <%def name="gravatar(email, size=16)">
   <%
     if (size > 16):
         gravatar_class = 'gravatar gravatar-large'
     else:
         gravatar_class = 'gravatar'
   %>
   <%doc>
     TODO: johbo: For now we serve double size images to make it smooth
     for retina. This is how it worked until now. Should be replaced
     with a better solution at some point.
   </%doc>
   <img class="${gravatar_class}" src="${h.gravatar_url(email, size * 2)}" height="${size}" width="${size}">
 </%def>
 
 
 <%def name="gravatar_with_user(contact, size=16, show_disabled=False)">
   <% email = h.email_or_none(contact) %>
   <div class="rc-user tooltip" title="${h.author_string(email)}">
     ${self.gravatar(email, size)}
     <span class="${'user user-disabled' if show_disabled else 'user'}"> ${h.link_to_user(contact)}</span>
   </div>
 </%def>
 
 
 ## admin menu used for people that have some admin resources
 <%def name="admin_menu_simple(repositories=None, repository_groups=None, user_groups=None)">
   <ul class="submenu">
    %if repositories:
       <li><a href="${h.url('repos')}">${_('Repositories')}</a></li>
    %endif
    %if repository_groups:
       <li><a href="${h.url('repo_groups')}">${_('Repository groups')}</a></li>
    %endif
    %if user_groups:
       <li><a href="${h.url('users_groups')}">${_('User groups')}</a></li>
    %endif
   </ul>
 </%def>
 
 <%def name="repo_page_title(repo_instance)">
 <div class="title-content">
     <div class="title-main">
         ## SVN/HG/GIT icons
         %if h.is_hg(repo_instance):
             <i class="icon-hg"></i>
         %endif
         %if h.is_git(repo_instance):
             <i class="icon-git"></i>
         %endif
         %if h.is_svn(repo_instance):
             <i class="icon-svn"></i>
         %endif
 
         ## public/private
         %if repo_instance.private:
             <i class="icon-repo-private"></i>
         %else:
             <i class="icon-repo-public"></i>
         %endif
 
         ## repo name with group name
         ${h.breadcrumb_repo_link(c.rhodecode_db_repo)}
 
     </div>
 
     ## FORKED
     %if repo_instance.fork:
     <p>
         <i class="icon-code-fork"></i> ${_('Fork of')}
         <a href="${h.url('summary_home',repo_name=repo_instance.fork.repo_name)}">${repo_instance.fork.repo_name}</a>
     </p>
     %endif
 
     ## IMPORTED FROM REMOTE
     %if repo_instance.clone_uri:
     <p>
        <i class="icon-code-fork"></i> ${_('Clone from')}
        <a href="${h.url(h.safe_str(h.hide_credentials(repo_instance.clone_uri)))}">${h.hide_credentials(repo_instance.clone_uri)}</a>
     </p>
     %endif
 
     ## LOCKING STATUS
      %if repo_instance.locked[0]:
        <p class="locking_locked">
            <i class="icon-repo-lock"></i>
            ${_('Repository locked by %(user)s') % {'user': h.person_by_id(repo_instance.locked[0])}}
        </p>
      %elif repo_instance.enable_locking:
          <p class="locking_unlocked">
              <i class="icon-repo-unlock"></i>
              ${_('Repository not locked. Pull repository to lock it.')}
          </p>
      %endif
 
 </div>
 </%def>
 
 <%def name="repo_menu(active=None)">
     <%
     def is_active(selected):
         if selected == active:
             return "active"
     %>
 
   <!--- CONTEXT BAR -->
   <div id="context-bar">
     <div class="wrapper">
       <ul id="context-pages" class="horizontal-list navigation">
         <li class="${is_active('summary')}"><a class="menulink" href="${h.url('summary_home', repo_name=c.repo_name)}"><div class="menulabel">${_('Summary')}</div></a></li>
         <li class="${is_active('changelog')}"><a class="menulink" href="${h.url('changelog_home', repo_name=c.repo_name)}"><div class="menulabel">${_('Changelog')}</div></a></li>
         <li class="${is_active('files')}"><a class="menulink" href="${h.url('files_home', repo_name=c.repo_name, revision=c.rhodecode_db_repo.landing_rev[1])}"><div class="menulabel">${_('Files')}</div></a></li>
         <li class="${is_active('compare')}">
             <a class="menulink" href="${h.url('compare_home',repo_name=c.repo_name)}"><div class="menulabel">${_('Compare')}</div></a>
         </li>
         ## TODO: anderson: ideally it would have a function on the scm_instance "enable_pullrequest() and enable_fork()"
         %if c.rhodecode_db_repo.repo_type in ['git','hg']:
           <li class="${is_active('showpullrequest')}">
             <a class="menulink" href="${h.url('pullrequest_show_all',repo_name=c.repo_name)}" title="${_('Show Pull Requests for %s') % c.repo_name}">
               %if c.repository_pull_requests:
                 <span class="pr_notifications">${c.repository_pull_requests}</span>
               %endif
               <div class="menulabel">${_('Pull Requests')}</div>
             </a>
           </li>
         %endif
         <li class="${is_active('options')}">
           <a class="menulink" href="#" class="dropdown"><div class="menulabel">${_('Options')} <div class="show_more"></div></div></a>
           <ul class="submenu">
              %if h.HasRepoPermissionAll('repository.admin')(c.repo_name):
                    <li><a href="${h.url('edit_repo',repo_name=c.repo_name)}">${_('Settings')}</a></li>
              %endif
               %if c.rhodecode_db_repo.fork:
                <li><a href="${h.url('compare_url',repo_name=c.rhodecode_db_repo.fork.repo_name,source_ref_type=c.rhodecode_db_repo.landing_rev[0],source_ref=c.rhodecode_db_repo.landing_rev[1], target_repo=c.repo_name,target_ref_type='branch' if request.GET.get('branch') else c.rhodecode_db_repo.landing_rev[0],target_ref=request.GET.get('branch') or c.rhodecode_db_repo.landing_rev[1], merge=1)}">
                    ${_('Compare fork')}</a></li>
               %endif
 
               <li><a href="${h.url('search_repo_home',repo_name=c.repo_name)}">${_('Search')}</a></li>
 
               %if h.HasRepoPermissionAny('repository.write','repository.admin')(c.repo_name) and c.rhodecode_db_repo.enable_locking:
                 %if c.rhodecode_db_repo.locked[0]:
                   <li><a class="locking_del" href="${h.url('toggle_locking',repo_name=c.repo_name)}">${_('Unlock')}</a></li>
                 %else:
                   <li><a class="locking_add" href="${h.url('toggle_locking',repo_name=c.repo_name)}">${_('Lock')}</a></li>
                 %endif
               %endif
               %if c.rhodecode_user.username != h.DEFAULT_USER:
                 %if c.rhodecode_db_repo.repo_type in ['git','hg']:
                   <li><a href="${h.url('repo_fork_home',repo_name=c.repo_name)}">${_('Fork')}</a></li>
                   <li><a href="${h.url('pullrequest_home',repo_name=c.repo_name)}">${_('Create Pull Request')}</a></li>
                 %endif
               %endif
              </ul>
         </li>
       </ul>
     </div>
     <div class="clear"></div>
   </div>
   <!--- END CONTEXT BAR -->
 
 </%def>
 
 <%def name="usermenu()">
     ## USER MENU
     <li id="quick_login_li">
       <a id="quick_login_link" class="menulink childs">
         ${gravatar(c.rhodecode_user.email, 20)}
         <span class="user">
           %if c.rhodecode_user.username != h.DEFAULT_USER:
             <span class="menu_link_user">${c.rhodecode_user.username}</span><div class="show_more"></div>
           %else:
             <span>${_('Sign in')}</span>
           %endif
         </span>
       </a>
 
   <div class="user-menu submenu">
       <div id="quick_login">
         %if c.rhodecode_user.username == h.DEFAULT_USER:
             <h4>${_('Sign in to your account')}</h4>
             ${h.form(h.route_path('login', _query={'came_from': h.url.current()}), needs_csrf_token=False)}
             <div class="form form-vertical">
                 <div class="fields">
                     <div class="field">
                         <div class="label">
                             <label for="username">${_('Username')}:</label>
                         </div>
                         <div class="input">
                             ${h.text('username',class_='focus',tabindex=1)}
                         </div>
 
                     </div>
                     <div class="field">
                         <div class="label">
                             <label for="password">${_('Password')}:</label>
+                            %if h.HasPermissionAny('hg.password_reset.enabled')():
                             <span class="forgot_password">${h.link_to(_('(Forgot password?)'),h.route_path('reset_password'))}</span>
+                            %endif
                         </div>
                         <div class="input">
                             ${h.password('password',class_='focus',tabindex=2)}
                         </div>
                     </div>
                     <div class="buttons">
                         <div class="register">
                         %if h.HasPermissionAny('hg.admin', 'hg.register.auto_activate', 'hg.register.manual_activate')():
                          ${h.link_to(_("Don't have an account ?"),h.route_path('register'))}
                         %endif
                         </div>
                         <div class="submit">
                             ${h.submit('sign_in',_('Sign In'),class_="btn btn-small",tabindex=3)}
                         </div>
                     </div>
                 </div>
             </div>
             ${h.end_form()}
         %else:
             <div class="">
                 <div class="big_gravatar">${gravatar(c.rhodecode_user.email, 48)}</div>
                 <div class="full_name">${c.rhodecode_user.full_name_or_username}</div>
                 <div class="email">${c.rhodecode_user.email}</div>
             </div>
             <div class="">
             <ol class="links">
               <li>${h.link_to(_(u'My account'),h.url('my_account'))}</li>
               <li class="logout">
               ${h.secure_form(h.route_path('logout'))}
                   ${h.submit('log_out', _(u'Sign Out'),class_="btn btn-primary")}
               ${h.end_form()}
               </li>
             </ol>
             </div>
         %endif
       </div>
   </div>
       %if c.rhodecode_user.username != h.DEFAULT_USER:
         <div class="pill_container">
         % if c.unread_notifications == 0:
           <a class="menu_link_notifications empty" href="${h.url('notifications')}">${c.unread_notifications}</a>
         % else:
           <a class="menu_link_notifications" href="${h.url('notifications')}">${c.unread_notifications}</a>
         % endif
         </div>
       % endif
     </li>
 </%def>
 
 <%def name="menu_items(active=None)">
     <%
     def is_active(selected):
         if selected == active:
             return "active"
         return ""
     %>
     <ul id="quick" class="main_nav navigation horizontal-list">
       <!-- repo switcher -->
       <li class="${is_active('repositories')} repo_switcher_li has_select2">
         <input id="repo_switcher" name="repo_switcher" type="hidden">
       </li>
 
       ## ROOT MENU
       %if c.rhodecode_user.username != h.DEFAULT_USER:
         <li class="${is_active('journal')}">
           <a class="menulink" title="${_('Show activity journal')}" href="${h.url('journal')}">
             <div class="menulabel">${_('Journal')}</div>
           </a>
         </li>
       %else:
         <li class="${is_active('journal')}">
           <a class="menulink" title="${_('Show Public activity journal')}" href="${h.url('public_journal')}">
             <div class="menulabel">${_('Public journal')}</div>
           </a>
         </li>
       %endif
         <li class="${is_active('gists')}">
           <a class="menulink childs" title="${_('Show Gists')}" href="${h.url('gists')}">
             <div class="menulabel">${_('Gists')}</div>
           </a>
         </li>
       <li class="${is_active('search')}">
           <a class="menulink" title="${_('Search in repositories you have access to')}" href="${h.url('search')}">
             <div class="menulabel">${_('Search')}</div>
           </a>
       </li>
       % if h.HasPermissionAll('hg.admin')('access admin main page'):
         <li class="${is_active('admin')}">
           <a class="menulink childs" title="${_('Admin settings')}" href="#" onclick="return false;">
             <div class="menulabel">${_('Admin')} <div class="show_more"></div></div>
           </a>
           ${admin_menu()}
         </li>
       % elif c.rhodecode_user.repositories_admin or c.rhodecode_user.repository_groups_admin or c.rhodecode_user.user_groups_admin:
       <li class="${is_active('admin')}">
           <a class="menulink childs" title="${_('Delegated Admin settings')}">
             <div class="menulabel">${_('Admin')} <div class="show_more"></div></div>
           </a>
           ${admin_menu_simple(c.rhodecode_user.repositories_admin,
                               c.rhodecode_user.repository_groups_admin,
                               c.rhodecode_user.user_groups_admin or h.HasPermissionAny('hg.usergroup.create.true')())}
       </li>
       % endif
       % if c.debug_style:
       <li class="${is_active('debug_style')}">
           <a class="menulink" title="${_('Style')}" href="${h.url('debug_style_home')}">
             <div class="menulabel">${_('Style')}</div>
           </a>
       </li>
       % endif
       ## render extra user menu
       ${usermenu()}
     </ul>
 
     <script type="text/javascript">
         var visual_show_public_icon = "${c.visual.show_public_icon}" == "True";
 
         /*format the look of items in the list*/
         var format = function(state, escapeMarkup){
             if (!state.id){
               return state.text; // optgroup
             }
             var obj_dict = state.obj;
             var tmpl = '';
 
             if(obj_dict && state.type == 'repo'){
                 if(obj_dict['repo_type'] === 'hg'){
                     tmpl += '<i class="icon-hg"></i> ';
                 }
                 else if(obj_dict['repo_type'] === 'git'){
                     tmpl += '<i class="icon-git"></i> ';
                 }
                 else if(obj_dict['repo_type'] === 'svn'){
                     tmpl += '<i class="icon-svn"></i> ';
                 }
                 if(obj_dict['private']){
                     tmpl += '<i class="icon-lock" ></i> ';
                 }
                 else if(visual_show_public_icon){
                     tmpl += '<i class="icon-unlock-alt"></i> ';
                 }
             }
             if(obj_dict && state.type == 'commit') {
                 tmpl += '<i class="icon-tag"></i>';
             }
             if(obj_dict && state.type == 'group'){
                 tmpl += '<i class="icon-folder-close"></i> ';
             }
             tmpl += escapeMarkup(state.text);
             return tmpl;
         };
 
         var formatResult = function(result, container, query, escapeMarkup) {
             return format(result, escapeMarkup);
         };
 
         var formatSelection = function(data, container, escapeMarkup) {
             return format(data, escapeMarkup);
         };
 
         $("#repo_switcher").select2({
             cachedDataSource: {},
             minimumInputLength: 2,
             placeholder: '<div class="menulabel">${_('Go to')} <div class="show_more"></div></div>',
             dropdownAutoWidth: true,
             formatResult: formatResult,
             formatSelection: formatSelection,
             containerCssClass: "repo-switcher",
             dropdownCssClass: "repo-switcher-dropdown",
             escapeMarkup: function(m){
                 // don't escape our custom placeholder
                 if(m.substr(0,23) == '<div class="menulabel">'){
                     return m;
                 }
 
                 return Select2.util.escapeMarkup(m);
             },
             query: $.debounce(250, function(query){
                 self = this;
                 var cacheKey = query.term;
                 var cachedData = self.cachedDataSource[cacheKey];
 
                 if (cachedData) {
                     query.callback({results: cachedData.results});
                 } else {
                     $.ajax({
                         url: "${h.url('goto_switcher_data')}",
                         data: {'query': query.term},
                         dataType: 'json',
                         type: 'GET',
                         success: function(data) {
                             self.cachedDataSource[cacheKey] = data;
                             query.callback({results: data.results});
                         },
                         error: function(data, textStatus, errorThrown) {
                             alert("Error while fetching entries.\nError code {0} ({1}).".format(data.status, data.statusText));
                         }
                     })
                 }
             })
         });
 
         $("#repo_switcher").on('select2-selecting', function(e){
             e.preventDefault();
             window.location = e.choice.url;
         });
 
         ## Global mouse bindings ##
 
         // general help "?"
         Mousetrap.bind(['?'], function(e) {
             $('#help_kb').modal({})
         });
 
         // / open the quick filter
         Mousetrap.bind(['/'], function(e) {
             $("#repo_switcher").select2("open");
 
             // return false to prevent default browser behavior
             // and stop event from bubbling
             return false;
         });
 
         // general nav g + action
         Mousetrap.bind(['g h'], function(e) {
             window.location = pyroutes.url('home');
         });
         Mousetrap.bind(['g g'], function(e) {
             window.location = pyroutes.url('gists', {'private':1});
         });
         Mousetrap.bind(['g G'], function(e) {
             window.location = pyroutes.url('gists', {'public':1});
         });
         Mousetrap.bind(['n g'], function(e) {
             window.location = pyroutes.url('new_gist');
         });
         Mousetrap.bind(['n r'], function(e) {
             window.location = pyroutes.url('new_repo');
         });
 
         % if hasattr(c, 'repo_name') and hasattr(c, 'rhodecode_db_repo'):
             // nav in repo context
             Mousetrap.bind(['g s'], function(e) {
                 window.location = pyroutes.url('summary_home', {'repo_name': REPO_NAME});
             });
             Mousetrap.bind(['g c'], function(e) {
                 window.location = pyroutes.url('changelog_home', {'repo_name': REPO_NAME});
             });
             Mousetrap.bind(['g F'], function(e) {
                 window.location = pyroutes.url('files_home', {'repo_name': REPO_NAME, 'revision': '${c.rhodecode_db_repo.landing_rev[1]}', 'f_path': '', 'search': '1'});
             });
             Mousetrap.bind(['g f'], function(e) {
                 window.location = pyroutes.url('files_home', {'repo_name': REPO_NAME, 'revision': '${c.rhodecode_db_repo.landing_rev[1]}', 'f_path': ''});
             });
             Mousetrap.bind(['g p'], function(e) {
                 window.location = pyroutes.url('pullrequest_show_all', {'repo_name': REPO_NAME});
             });
             Mousetrap.bind(['g o'], function(e) {
                 window.location = pyroutes.url('edit_repo', {'repo_name': REPO_NAME});
             });
             Mousetrap.bind(['g O'], function(e) {
                 window.location = pyroutes.url('edit_repo_perms', {'repo_name': REPO_NAME});
             });
         % endif
 
     </script>
     <script src="${h.asset('js/rhodecode/base/keyboard-bindings.js', ver=c.rhodecode_version_hash)}"></script>
 </%def>
 
 <div class="modal" id="help_kb" tabindex="-1" role="dialog" aria-labelledby="myModalLabel" aria-hidden="true">
     <div class="modal-dialog">
       <div class="modal-content">
         <div class="modal-header">
           <button type="button" class="close" data-dismiss="modal" aria-hidden="true">&times;</button>
           <h4 class="modal-title" id="myModalLabel">${_('Keyboard shortcuts')}</h4>
         </div>
         <div class="modal-body">
               <div class="block-left">
                 <table class="keyboard-mappings">
                     <tbody>
                   <tr>
                     <th></th>
                     <th>${_('Site-wide shortcuts')}</th>
                   </tr>
                   <%
                      elems = [
                          ('/', 'Open quick search box'),
                          ('g h', 'Goto home page'),
                          ('g g', 'Goto my private gists page'),
                          ('g G', 'Goto my public gists page'),
                          ('n r', 'New repository page'),
                          ('n g', 'New gist page'),
                      ]
                   %>
                   %for key, desc in elems:
                   <tr>
                     <td class="keys">
                       <span class="key tag">${key}</span>
                     </td>
                     <td>${desc}</td>
                   </tr>
                 %endfor
                 </tbody>
                   </table>
               </div>
               <div class="block-left">
                 <table class="keyboard-mappings">
                 <tbody>
                   <tr>
                     <th></th>
                     <th>${_('Repositories')}</th>
                   </tr>
                   <%
                      elems = [
                          ('g s', 'Goto summary page'),
                          ('g c', 'Goto changelog page'),
                          ('g f', 'Goto files page'),
                          ('g F', 'Goto files page with file search activated'),
                          ('g p', 'Goto pull requests page'),
                          ('g o', 'Goto repository settings'),
                          ('g O', 'Goto repository permissions settings'),
                      ]
                   %>
                   %for key, desc in elems:
                   <tr>
                     <td class="keys">
                       <span class="key tag">${key}</span>
                     </td>
                     <td>${desc}</td>
                   </tr>
                 %endfor
                 </tbody>
               </table>
             </div>
         </div>
         <div class="modal-footer">
         </div>
       </div><!-- /.modal-content -->
     </div><!-- /.modal-dialog -->
 </div><!-- /.modal -->

rhodecode/templates/login.html

@@ -1,76 +1,84 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="base/root.html"/>
 
 <%def name="title()">
     ${_('Sign In')}
     %if c.rhodecode_name:
         &middot; ${h.branding(c.rhodecode_name)}
     %endif
 </%def>
 
 <style>body{background-color:#eeeeee;}</style>
 <div class="loginbox">
     <div class="header">
         <div id="header-inner" class="title">
             <div id="logo">
                 <div class="logo-wrapper">
                     <a href="${h.url('home')}"><img src="${h.asset('images/rhodecode-logo-white-216x60.png')}" alt="RhodeCode"/></a>
                 </div>
                 %if c.rhodecode_name:
                 <div class="branding"> ${h.branding(c.rhodecode_name)}</div>
                 %endif
             </div>
         </div>
     </div>
 
     <div class="loginwrapper">
         <div class="left-column">
             <img class="sign-in-image" src="${h.asset('images/sign-in.png')}" alt="RhodeCode"/>
         </div>
         <%block name="above_login_button" />
         <div id="login" class="right-column">
             <!-- login -->
             <div class="sign-in-title">
                 <h1>${_('Sign In')}</h1>
                 %if h.HasPermissionAny('hg.admin', 'hg.register.auto_activate', 'hg.register.manual_activate')():
                 <h4>${h.link_to(_("Go to the registration page to create a new account."), request.route_path('register'))}</h4>
                 %endif
             </div>
             <div class="inner form">
                 ${h.form(request.route_path('login', _query={'came_from': came_from}), needs_csrf_token=False)}
 
                     <label for="username">${_('Username')}:</label>
                     ${h.text('username', class_='focus', value=defaults.get('username'))}
                     %if 'username' in errors:
                     <span class="error-message">${errors.get('username')}</span>
                     <br />
                     %endif
 
                     <label for="password">${_('Password')}:</label>
                     ${h.password('password', class_='focus')}
                     %if 'password' in errors:
                     <span class="error-message">${errors.get('password')}</span>
                     <br />
                     %endif
 
                     ${h.checkbox('remember', value=True, checked=defaults.get('remember'))}
                     <label class="checkbox" for="remember">${_('Remember me')}</label>
 
+                    
+                    %if h.HasPermissionAny('hg.password_reset.enable')():
                     <p class="links">
                         ${h.link_to(_('Forgot your password?'), h.route_path('reset_password'))}
                     </p>
+                    %elif h.HasPermissionAny('hg.password_reset.hidden')():
+                        <p class="help-block">
+                            ${_('Contact an administrator if you have forgotten your password.')}
+                        </p>
+                    %endif
+                    
 
                     ${h.submit('sign_in', _('Sign In'), class_="btn sign-in")}
 
                 ${h.end_form()}
                 <script type="text/javascript">
                     $(document).ready(function(){
                         $('#username').focus();
                     })
                 </script>
             </div>
             <!-- end login -->
             <%block name="below_login_button" />
         </div>
     </div>
 </div>

rhodecode/templates/password_reset.html

@@ -1,77 +1,83 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="base/root.html"/>
 
 <%def name="title()">
     ${_('Create an Account')}
     %if c.rhodecode_name:
         &middot; ${h.branding(c.rhodecode_name)}
     %endif
 </%def>
 <style>body{background-color:#eeeeee;}</style>
 
 <div class="loginbox">
     <div class="header">
         <div id="header-inner" class="title">
             <div id="logo">
                 <div class="logo-wrapper">
                     <a href="${h.url('home')}"><img src="${h.asset('images/rhodecode-logo-white-216x60.png')}" alt="RhodeCode"/></a>
                 </div>
                 %if c.rhodecode_name:
                 <div class="branding"> ${h.branding(c.rhodecode_name)}</div>
                 %endif
             </div>
         </div>
     </div>
 
     <div class="loginwrapper">
         <div class="left-column">
             <img class="sign-in-image" src="${h.asset('images/sign-in.png')}" alt="RhodeCode"/>
         </div>
 
+        %if h.HasPermissionAny('hg.password_reset.disabled')():
+            <div class="right-column">
+                <p>${_('Password reset has been disabled.')}</p>
+            </div>
+        %else:
         <div id="register" class="right-column">
             <!-- login -->
             <div class="sign-in-title">
                 <h1>${_('Reset your Password')}</h1>
                 <h4>${h.link_to(_("Go to the login page to sign in."), request.route_path('login'))}</h4>
             </div>
             <div class="inner form">
                 ${h.form(request.route_path('reset_password'), needs_csrf_token=False)}
                     <label for="email">${_('Email Address')}:</label>
                     ${h.text('email', defaults.get('email'))}
                     %if 'email' in errors:
                       <span class="error-message">${errors.get('email')}</span>
                       <br />
                     %endif
 
                     %if captcha_active:
                     <div class="login-captcha"
                         <label for="email">${_('Captcha')}:</label>
                         ${h.hidden('recaptcha_field')}
                         <div id="recaptcha"></div>
                         %if 'recaptcha_field' in errors:
                           <span class="error-message">${errors.get('recaptcha_field')}</span>
                           <br />
                         %endif
                     </div>
                     %endif
 
                     ${h.submit('send', _('Send password reset email'), class_="btn sign-in")}
                     <div class="activation_msg">${_('Password reset link will be sent to matching email address')}</div>
 
                 ${h.end_form()}
             </div>
         </div>
+        %endif
     </div>
 </div>
 
 %if captcha_active:
 <script type="text/javascript" src="https://www.google.com/recaptcha/api/js/recaptcha_ajax.js"></script>
 %endif
 <script type="text/javascript">
  $(document).ready(function(){
     $('#email').focus();
     %if captcha_active:
       Recaptcha.create("${captcha_public_key}", "recaptcha", {theme: "white"});
     %endif
  });
 </script>