release: Merge default into stable for release preparation

docs/release-notes/release-notes-4.25.0.rst

@@ -0,0 +1,76 b''
+|RCE| 4.25.0 |RNS|
+------------------
+
+Release Date
+^^^^^^^^^^^^
+
+- 2021-04-02
+
+
+New Features
+^^^^^^^^^^^^
+
+- SSH: allow clone by ID via SSH operations.
+- Artifacts: added an admin panel to manage artifacts.
+- Redmine: added option to add note to a ticket without changing its status in Redmine integration.
+
+
+General
+^^^^^^^
+
+- Git: change lookups logic. Prioritize reference names over numerical ids.
+  Numerical ids are supported as a fallback if ref matching is unsuccessful.
+- Permissions: changed fork permission help text to reflect the actual state on how it works.
+- Permissions: flush permissions on owner changes for repo and repo groups. This
+  would fix problems when owner of repository changes then the new owner lacked permissions
+  until cache expired.
+- Artifacts: added API function to remove artifacts.
+- Archives: use a special name for non-hashed archives to fix caching issues.
+- Packaging: fixed few packages requirements for a proper builds.
+- Packaging: fix rhodecode-tools for docker builds.
+- Packaging: fixed some problem after latest setuptools-scm release.
+- Packaging: added setuptools-scm to packages for build.
+- Packaging: fix jira package for reproducible builds.
+- Packaging: fix zipp package patches.
+
+
+Security
+^^^^^^^^
+
+- Comments: forbid removal of comments by anyone except the owners.
+  Previously admins of a repository could remove them if they would construct a special url with data.
+- Pull requests: fixed some xss problems when a deleted file with special characters were commented on.
+
+
+Performance
+^^^^^^^^^^^
+
+- License: skip channelstream connect on license checks logic to reduce calls handling times.
+- Core: optimize some calls to skip license/scm detection on them. Each license check is expensive
+  and we don't need them on each call.
+
+
+Fixes
+^^^^^
+
+- Branch-permissions: fixed ce view. Fixes #5656
+- Feed: fix errors on feed access of empty repositories.
+- Archives: if implicit ref name was used (e.g master) to obtain archive, we now
+  redirect to explicit commit sha so we can have the proper caching for references names.
+- rcextensions: fixed pre-files extractor return code support.
+- Svn: fix subprocess problems on some of the calls for file checking.
+- Pull requests: fixed multiple repetitions of referenced tickets in pull requests summary sidebar.
+- Maintenance: fixed bad routes def
+- clone-uri: fixed the problems with key mismatch that caused errors on summary page.
+- Largefiles: added fix for downloading largefiles which had no extension in file name.
+- Compare: fix referenced commits bug.
+- Git: fix for unicode branches
+
+
+Upgrade notes
+^^^^^^^^^^^^^
+
+- Scheduled release 4.25.0.
+
+
+

pkgs/patches/channelstream/setuptools.patch

@@ -0,0 +1,13 b''
+diff -rup channelstream-0.6.14-orig/setup.py channelstream-0.6.14/setup.py
+
+--- channelstream-0.6.14/setup-orig.py	2021-03-11 12:34:45.000000000 +0100
++++ channelstream-0.6.14/setup.py	2021-03-11 12:34:56.000000000 +0100
+@@ -52,7 +52,7 @@ setup(
+     include_package_data=True,
+     install_requires=requires,
+     python_requires=">=2.7",
+-    setup_requires=["pytest-runner"],
++    setup_requires=["pytest-runner==5.1.0"],
+     extras_require={
+         "dev": ["coverage", "pytest", "pyramid", "tox", "mock", "webtest"],
+         "lint": ["black"],

pkgs/patches/configparser/pyproject.patch

@@ -0,0 +1,10 b''
+diff -rup configparser-4.0.2-orig/pyproject.toml configparser-4.0.2/pyproject.toml
+--- configparser-4.0.2-orig/pyproject.toml 2021-03-22 21:28:11.000000000 +0100
++++ configparser-4.0.2/pyproject.toml 2021-03-22 21:28:11.000000000 +0100
+@@ -1,5 +1,5 @@
+ [build-system]
+-requires = ["setuptools>=40.7", "wheel", "setuptools_scm>=1.15"]
++requires = ["setuptools<=42.0", "wheel", "setuptools_scm<6.0.0"]
+ build-backend = "setuptools.build_meta"
+
+ [tool.black]

pkgs/patches/importlib_metadata/pyproject.patch

@@ -0,0 +1,7 b''
+diff -rup importlib-metadata-1.6.0-orig/yproject.toml importlib-metadata-1.6.0/pyproject.toml
+--- importlib-metadata-1.6.0-orig/yproject.toml	2021-03-22 22:10:33.000000000 +0100
++++ importlib-metadata-1.6.0/pyproject.toml	2021-03-22 22:11:09.000000000 +0100
+@@ -1,3 +1,3 @@
+ [build-system]
+-requires = ["setuptools>=30.3", "wheel", "setuptools_scm"]
++requires = ["setuptools<42.0", "wheel", "setuptools_scm<6.0.0"]

pkgs/patches/pyramid_apispec/setuptools.patch

@@ -0,0 +1,12 b''
+diff -rup pyramid-apispec-0.3.2-orig/setup.py pyramid-apispec-0.3.2/setup.py
+--- pyramid-apispec-0.3.2-orig/setup.py	2021-03-11 11:19:26.000000000 +0100
++++ pyramid-apispec-0.3.2/setup.py	2021-03-11 11:19:51.000000000 +0100
+@@ -44,7 +44,7 @@ setup(
+     packages=find_packages(exclude=["contrib", "docs", "tests"]),
+     package_data={"pyramid_apispec": ["static/*.*"], "": ["LICENSE"]},
+     install_requires=["apispec[yaml]==1.0.0"],
+-    setup_requires=["pytest-runner"],
++    setup_requires=["pytest-runner==5.1"],
+     extras_require={
+         "dev": ["coverage", "pytest", "pyramid", "tox", "webtest"],
+         "demo": ["marshmallow==2.15.3", "pyramid", "apispec", "webtest"],
  No newline at end of file

pkgs/patches/rhodecode_tools/setuptools.patch

@@ -0,0 +1,12 b''
+diff -rup rhodecode-tools-1.4.0-orig/setup.py rhodecode-tools-1.4.0/setup.py
+--- rhodecode-tools-1.4.0/setup-orig.py	2021-03-11 12:34:45.000000000 +0100
++++ rhodecode-tools-1.4.0/setup.py	2021-03-11 12:34:56.000000000 +0100
+@@ -69,7 +69,7 @@ def _get_requirements(req_filename, excl
+
+
+ # requirements extract
+-setup_requirements = ['pytest-runner']
++setup_requirements = ['pytest-runner==5.1.0']
+ install_requirements = _get_requirements(
+     'requirements.txt', exclude=['setuptools'])
+ test_requirements = _get_requirements('requirements_test.txt')
  No newline at end of file

pkgs/patches/zipp/pyproject.patch

@@ -0,0 +1,10 b''
+diff -rup zip-1.2.0-orig/pyproject.toml zip-1.2.0/pyproject.toml
+--- zip-1.2.0-orig/pyproject.toml	2021-03-23 10:55:37.000000000 +0100
++++ zip-1.2.0/pyproject.toml	2021-03-23 10:56:05.000000000 +0100
+@@ -1,5 +1,5 @@
+ [build-system]
+-requires = ["setuptools>=34.4", "wheel", "setuptools_scm>=1.15"]
++requires = ["setuptools<42.0", "wheel", "setuptools_scm<6.0.0"]
+ build-backend = "setuptools.build_meta"
+
+ [tool.black]

rhodecode/apps/repository/tests/test_repo_maintainance.py

@@ -0,0 +1,74 b''
+# -*- coding: utf-8 -*-
+
+# Copyright (C) 2010-2020 RhodeCode GmbH
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License, version 3
+# (only), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+# This program is dual-licensed. If you wish to learn more about the
+# RhodeCode Enterprise Edition, including its added features, Support services,
+# and proprietary license terms, please see https://rhodecode.com/licenses/
+
+import mock
+import pytest
+
+from rhodecode.lib.utils2 import str2bool
+from rhodecode.lib.vcs.exceptions import RepositoryRequirementError
+from rhodecode.model.db import Repository, UserRepoToPerm, Permission, User
+from rhodecode.model.meta import Session
+from rhodecode.tests import (
+    TEST_USER_ADMIN_LOGIN, TEST_USER_REGULAR_LOGIN, assert_session_flash)
+from rhodecode.tests.fixture import Fixture
+
+fixture = Fixture()
+
+
+def route_path(name, params=None, **kwargs):
+    import urllib
+
+    base_url = {
+        'edit_repo_maintenance': '/{repo_name}/settings/maintenance',
+        'edit_repo_maintenance_execute': '/{repo_name}/settings/maintenance/execute',
+
+    }[name].format(**kwargs)
+
+    if params:
+        base_url = '{}?{}'.format(base_url, urllib.urlencode(params))
+    return base_url
+
+
+def _get_permission_for_user(user, repo):
+    perm = UserRepoToPerm.query()\
+        .filter(UserRepoToPerm.repository ==
+                Repository.get_by_repo_name(repo))\
+        .filter(UserRepoToPerm.user == User.get_by_username(user))\
+        .all()
+    return perm
+
+
[e-mail]('autologin_user', 'app')
+class TestAdminRepoMaintenance(object):
+    @pytest.mark.parametrize('urlname', [
+        'edit_repo_maintenance',
+    ])
+    def test_show_page(self, urlname, app, backend):
+        app.get(route_path(urlname, repo_name=backend.repo_name), status=200)
+
+    def test_execute_maintenance_for_repo_hg(self, app, backend_hg, autologin_user, xhr_header):
+        repo_name = backend_hg.repo_name
+
+        response = app.get(
+            route_path('edit_repo_maintenance_execute',
+                       repo_name=repo_name,),
+            extra_environ=xhr_header)
+
+        assert "HG Verify repo" in ''.join(response.json)

.bumpversion.cfg

@@ -1,6 +1,5 b''
 [bumpversion]
-current_version = 4.24.1
+current_version = 4.25.0
 message = release: Bump version {current_version} to {new_version}
 
 [bumpversion:file:rhodecode/VERSION]
-

.release.cfg

@@ -5,25 +5,20 b' done = false'
 done = true
 
 [task:rc_tools_pinned]
-done = true
 
 [task:fixes_on_stable]
-done = true
 
 [task:pip2nix_generated]
-done = true
 
 [task:changelog_updated]
-done = true
 
 [task:generate_api_docs]
-done = true
+
+[task:updated_translation]
 
 [release]
-state = prepared
-version = 4.24.1
-
-[task:updated_translation]
+state = in_progress
+version = 4.25.0
 
 [task:generate_js_routes]
 

docs/api/methods/store-methods.rst

@@ -130,6 +130,24 b' file_store_get_info (EE only)'
      error :  null
 
 
+file_store_delete (EE only)
+---------------------------
+
+.. py:function:: file_store_delete(apiuser, store_fid)
+
+   Delete an artifact based on the secret uuid.
+
+   Example output:
+
+   .. code-block:: bash
+
+     id : <id_given_in_input>
+     result: {
+         "artifact" : {"uid": "some uid", "removed": true}
+     }
+     error :  null
+
+
 file_store_add_metadata (EE only)
 ---------------------------------
 

docs/release-notes/release-notes.rst

@@ -9,6 +9,7 b' Release Notes'
 .. toctree::
    :maxdepth: 1
 
+   release-notes-4.25.0.rst
    release-notes-4.24.1.rst
    release-notes-4.24.0.rst
    release-notes-4.23.2.rst

pkgs/patches/pytest/setuptools.patch

@@ -6,7 +6,7 b' diff -rup pytest-4.6.5-orig/setup.py pyt'
      setup(
          use_scm_version={"write_to": "src/_pytest/_version.py"},
 -        setup_requires=["setuptools-scm", "setuptools>=40.0"],
-+        setup_requires=["setuptools-scm", "setuptools<=42.0"],
++        setup_requires=["setuptools-scm<6.0.0", "setuptools<=42.0"],
          package_dir={"": "src"},
          # fmt: off
          extras_require={
  No newline at end of file

pkgs/python-packages-overrides.nix

@@ -280,6 +280,72 b' self: super: {'
     ];
   });
 
+  "pytest-runner" = super."pytest-runner".override (attrs: {
+    propagatedBuildInputs = [
+      self."setuptools-scm"
+    ];
+  });
+
+  "py" = super."py".override (attrs: {
+    propagatedBuildInputs = [
+      self."setuptools-scm"
+    ];
+  });
+
+  "python-dateutil" = super."python-dateutil".override (attrs: {
+    propagatedBuildInputs = attrs.propagatedBuildInputs ++ [
+      self."setuptools-scm"
+    ];
+  });
+
+  "configparser" = super."configparser".override (attrs: {
+    patches = [
+      ./patches/configparser/pyproject.patch
+    ];
+    propagatedBuildInputs = [
+      self."setuptools-scm"
+    ];
+  });
+
+  "importlib-metadata" = super."importlib-metadata".override (attrs: {
+
+    patches = [
+      ./patches/importlib_metadata/pyproject.patch
+    ];
+
+    propagatedBuildInputs = attrs.propagatedBuildInputs ++ [
+      self."setuptools-scm"
+    ];
+
+  });
+
+  "zipp" = super."zipp".override (attrs: {
+    patches = [
+      ./patches/zipp/pyproject.patch
+    ];
+    propagatedBuildInputs = attrs.propagatedBuildInputs ++ [
+      self."setuptools-scm"
+    ];
+  });
+
+  "pyramid-apispec" = super."pyramid-apispec".override (attrs: {
+    patches = [
+      ./patches/pyramid_apispec/setuptools.patch
+    ];
+  });
+
+  "channelstream" = super."channelstream".override (attrs: {
+    patches = [
+      ./patches/channelstream/setuptools.patch
+    ];
+  });
+
+  "rhodecode-tools" = super."rhodecode-tools".override (attrs: {
+    patches = [
+      ./patches/rhodecode_tools/setuptools.patch
+    ];
+  });
+
   # Avoid that base packages screw up the build process
   inherit (basePythonPackages)
     setuptools;

pkgs/python-packages.nix

@@ -1883,7 +1883,7 b' self: super: {'
     };
   };
   "rhodecode-enterprise-ce" = super.buildPythonPackage {
-    name = "rhodecode-enterprise-ce-4.24.1";
+    name = "rhodecode-enterprise-ce-4.25.0";
     buildInputs = [
       self."pytest"
       self."py"
@@ -2092,6 +2092,17 b' self: super: {'
       license = [ pkgs.lib.licenses.mit ];
     };
   };
+  "setuptools-scm" = super.buildPythonPackage {
+    name = "setuptools-scm-3.5.0";
+    doCheck = false;
+    src = fetchurl {
+      url = "https://files.pythonhosted.org/packages/b2/f7/60a645aae001a2e06cf4b8db2fba9d9f36b8fd378f10647e3e218b61b74b/setuptools_scm-3.5.0.tar.gz";
+      sha256 = "5bdf21a05792903cafe7ae0c9501182ab52497614fa6b1750d9dbae7b60c1a87";
+    };
+    meta = {
+      license = [ pkgs.lib.licenses.psfl ];
+    };
+  };
   "simplegeneric" = super.buildPythonPackage {
     name = "simplegeneric-0.8.1";
     doCheck = false;

rhodecode/VERSION

@@ -1,1 +1,1 b''
-4.24.1
  No newline at end of file
+4.25.0
  No newline at end of file

rhodecode/api/views/repo_api.py

@@ -1212,7 +1212,7 b' def fork_repo(request, apiuser, repoid, '
         validate_repo_permissions(apiuser, repoid, repo, _perms)
 
         # check if the regular user has at least fork permissions as well
-        if not HasPermissionAnyApi('hg.fork.repository')(user=apiuser):
+        if not HasPermissionAnyApi(PermissionModel.FORKING_ENABLED)(user=apiuser):
             raise JSONRPCForbidden()
 
     # check if user can set owner parameter

rhodecode/apps/file_store/backends/local_store.py

@@ -255,7 +255,7 b' class LocalFileStorage(object):'
 
         return filename, metadata
 
-    def get_metadata(self, filename):
+    def get_metadata(self, filename, ignore_missing=False):
         """
         Reads JSON stored metadata for a file
 
@@ -264,6 +264,7 b' class LocalFileStorage(object):'
         """
         filename = self.store_path(filename)
         filename_meta = filename + '.meta'
-
+        if ignore_missing and not os.path.isfile(filename_meta):
+            return {}
         with open(filename_meta, "rb") as source_meta:
             return json.loads(source_meta.read())

rhodecode/apps/repository/__init__.py

@@ -932,8 +932,8 b' def includeme(config):'
         name='edit_repo_perms_branch',
         pattern='/{repo_name:.*?[^/]}/settings/branch_permissions', repo_route=True)
     config.add_view(
-        RepoBranchesView,
-        attr='branches',
+        RepoSettingsBranchPermissionsView,
+        attr='branch_permissions',
         route_name='edit_repo_perms_branch', request_method='GET',
         renderer='rhodecode:templates/admin/repos/repo_edit.mako')
 
@@ -950,8 +950,8 b' def includeme(config):'
     config.add_view(
         RepoMaintenanceView,
         attr='repo_maintenance',
-        route_name='edit_repo_maintenance_execute', request_method='GET',
-        renderer='json', xhr=True)
+        route_name='edit_repo_maintenance', request_method='GET',
+        renderer='rhodecode:templates/admin/repos/repo_edit.mako')
 
     config.add_route(
         name='edit_repo_maintenance_execute',
@@ -959,8 +959,8 b' def includeme(config):'
     config.add_view(
         RepoMaintenanceView,
         attr='repo_maintenance_execute',
-        route_name='edit_repo_maintenance', request_method='GET',
-        renderer='rhodecode:templates/admin/repos/repo_edit.mako')
+        route_name='edit_repo_maintenance_execute', request_method='GET',
+        renderer='json', xhr=True)
 
     # Fields
     config.add_route(

rhodecode/apps/repository/tests/test_repo_files.py

@@ -542,6 +542,28 b' class TestRepositoryArchival(object):'
             for header in headers:
                 assert header in response.headers.items()
 
+    def test_archival_no_hash(self, backend):
+        backend.enable_downloads()
+        commit = backend.repo.get_commit(commit_idx=173)
+        for a_type, content_type, extension in settings.ARCHIVE_SPECS:
+
+            short = 'plain' + extension
+            fname = commit.raw_id + extension
+            filename = '%s-%s' % (backend.repo_name, short)
+            response = self.app.get(
+                route_path('repo_archivefile',
+                           repo_name=backend.repo_name,
+                           fname=fname, params={'with_hash': 0}))
+
+            assert response.status == '200 OK'
+            headers = [
+                ('Content-Disposition', 'attachment; filename=%s' % filename),
+                ('Content-Type', '%s' % content_type),
+            ]
+
+            for header in headers:
+                assert header in response.headers.items()
+
     @pytest.mark.parametrize('arch_ext',[
         'tar', 'rar', 'x', '..ax', '.zipz', 'tar.gz.tar'])
     def test_archival_wrong_ext(self, backend, arch_ext):

rhodecode/apps/repository/views/repo_changelog.py

@@ -34,7 +34,7 b' from rhodecode.lib.auth import ('
 from rhodecode.lib.ext_json import json
 from rhodecode.lib.graphmod import _colored, _dagwalker
 from rhodecode.lib.helpers import RepoPage
-from rhodecode.lib.utils2 import safe_int, safe_str, str2bool
+from rhodecode.lib.utils2 import safe_int, safe_str, str2bool, safe_unicode
 from rhodecode.lib.vcs.exceptions import (
     RepositoryError, CommitDoesNotExistError,
     CommitError, NodeDoesNotExistError, EmptyRepositoryError)
@@ -110,7 +110,7 b' class RepoChangelogView(RepoAppView):'
 
     def _check_if_valid_branch(self, branch_name, repo_name, f_path):
         if branch_name not in self.rhodecode_vcs_repo.branches_all:
-            h.flash('Branch {} is not found.'.format(h.escape(branch_name)),
+            h.flash(u'Branch {} is not found.'.format(h.escape(safe_unicode(branch_name))),
                     category='warning')
             redirect_url = h.route_path(
                 'repo_commits_file', repo_name=repo_name,

rhodecode/apps/repository/views/repo_commits.py

@@ -674,6 +674,10 b' class RepoCommitsView(RepoAppView):'
         is_repo_comment = comment.repo.repo_id == self.db_repo.repo_id
         comment_repo_admin = is_repo_admin and is_repo_comment
 
+        if comment.draft and not comment_owner:
+            # We never allow to delete draft comments for other than owners
+            raise HTTPNotFound()
+
         if super_admin or comment_owner or comment_repo_admin:
             CommentsModel().delete(comment=comment, auth_user=self._rhodecode_user)
             Session().commit()

rhodecode/apps/repository/views/repo_feed.py

@@ -104,6 +104,9 b' class RepoFeedView(RepoAppView):'
 
     def _get_commits(self):
         pre_load = ['author', 'branch', 'date', 'message', 'parents']
+        if self.rhodecode_vcs_repo.is_empty():
+            return []
+
         collection = self.rhodecode_vcs_repo.get_commits(
             branch_name=None, show_hidden=False, pre_load=pre_load,
             translate_tags=False)
@@ -137,6 +140,7 b' class RepoFeedView(RepoAppView):'
                 language=self.language,
                 ttl=self.ttl
             )
+
             for commit in reversed(self._get_commits()):
                 date = self._set_timezone(commit.date)
                 feed.add_item(

rhodecode/apps/repository/views/repo_files.py

@@ -325,17 +325,18 b' class RepoFilesView(RepoAppView):'
 
         return lf_enabled
 
-    def _get_archive_name(self, db_repo_name, commit_sha, ext, subrepos=False, path_sha=''):
+    def _get_archive_name(self, db_repo_name, commit_sha, ext, subrepos=False, path_sha='', with_hash=True):
         # original backward compat name of archive
         clean_name = safe_str(db_repo_name.replace('/', '_'))
 
         # e.g vcsserver.zip
         # e.g vcsserver-abcdefgh.zip
         # e.g vcsserver-abcdefgh-defghijk.zip
-        archive_name = '{}{}{}{}{}'.format(
+        archive_name = '{}{}{}{}{}{}'.format(
             clean_name,
             '-sub' if subrepos else '',
             commit_sha,
+            '-{}'.format('plain') if not with_hash else '',
             '-{}'.format(path_sha) if path_sha else '',
             ext)
         return archive_name
@@ -372,6 +373,11 b' class RepoFilesView(RepoAppView):'
         except EmptyRepositoryError:
             return Response(_('Empty repository'))
 
+        # we used a ref, or a shorter version, lets redirect client ot use explicit hash
+        if commit_id != commit.raw_id:
+            fname='{}{}'.format(commit.raw_id, ext)
+            raise HTTPFound(self.request.current_route_path(fname=fname))
+
         try:
             at_path = commit.get_node(at_path).path or default_at_path
         except Exception:
@@ -385,7 +391,7 b' class RepoFilesView(RepoAppView):'
         # used for cache etc
         archive_name = self._get_archive_name(
             self.db_repo_name, commit_sha=short_sha, ext=ext, subrepos=subrepos,
-            path_sha=path_sha)
+            path_sha=path_sha, with_hash=with_hash)
 
         if not with_hash:
             short_sha = ''
@@ -394,7 +400,7 b' class RepoFilesView(RepoAppView):'
         # what end client gets served
         response_archive_name = self._get_archive_name(
             self.db_repo_name, commit_sha=short_sha, ext=ext, subrepos=subrepos,
-            path_sha=path_sha)
+            path_sha=path_sha, with_hash=with_hash)
         # remove extension from our archive directory name
         archive_dir_name = response_archive_name[:-len(ext)]
 
@@ -404,9 +410,10 b' class RepoFilesView(RepoAppView):'
         cached_archive_path = None
 
         if archive_cache_enabled:
-            # check if we it's ok to write
+            # check if we it's ok to write, and re-create the archive cache
             if not os.path.isdir(CONFIG['archive_cache_dir']):
                 os.makedirs(CONFIG['archive_cache_dir'])
+
             cached_archive_path = os.path.join(
                 CONFIG['archive_cache_dir'], archive_name)
             if os.path.isfile(cached_archive_path):

rhodecode/apps/repository/views/repo_forks.py

@@ -165,7 +165,7 b' class RepoForksView(RepoAppView, DataGri'
 
     @LoginRequired()
     @NotAnonymous()
-    @HasPermissionAnyDecorator('hg.admin', 'hg.fork.repository')
+    @HasPermissionAnyDecorator('hg.admin', PermissionModel.FORKING_ENABLED)
     @HasRepoPermissionAnyDecorator(
         'repository.read', 'repository.write', 'repository.admin')
     def repo_fork_new(self):
@@ -191,7 +191,7 b' class RepoForksView(RepoAppView, DataGri'
 
     @LoginRequired()
     @NotAnonymous()
-    @HasPermissionAnyDecorator('hg.admin', 'hg.fork.repository')
+    @HasPermissionAnyDecorator('hg.admin', PermissionModel.FORKING_ENABLED)
     @HasRepoPermissionAnyDecorator(
         'repository.read', 'repository.write', 'repository.admin')
     @CSRFRequired()

rhodecode/apps/repository/views/repo_pull_requests.py

@@ -1748,6 +1748,10 b' class RepoPullRequestsView(RepoAppView, '
         is_repo_comment = comment.repo.repo_name == self.db_repo_name
         comment_repo_admin = is_repo_admin and is_repo_comment
 
+        if comment.draft and not comment_owner:
+            # We never allow to delete draft comments for other than owners
+            raise HTTPNotFound()
+
         if super_admin or comment_owner or comment_repo_admin:
             old_calculated_status = comment.pull_request.calculated_review_status()
             CommentsModel().delete(comment=comment, auth_user=self._rhodecode_user)

rhodecode/apps/ssh_support/lib/backends/__init__.py

@@ -89,6 +89,14 b' class SshWrapper(object):'
 
         return conn
 
+    def maybe_translate_repo_uid(self, repo_name):
+        if repo_name.startswith('_'):
+            from rhodecode.model.repo import RepoModel
+            by_id_match = RepoModel().get_repo_by_id(repo_name)
+            if by_id_match:
+                repo_name = by_id_match.repo_name
+        return repo_name
+
     def get_repo_details(self, mode):
         vcs_type = mode if mode in ['svn', 'hg', 'git'] else None
         repo_name = None
@@ -97,14 +105,14 b' class SshWrapper(object):'
         hg_match = re.match(hg_pattern, self.command)
         if hg_match is not None:
             vcs_type = 'hg'
-            repo_name = hg_match.group(1).strip('/')
+            repo_name = self.maybe_translate_repo_uid(hg_match.group(1).strip('/'))
             return vcs_type, repo_name, mode
 
         git_pattern = r'^git-(receive-pack|upload-pack)\s\'[/]?(\S+?)(|\.git)\'$'
         git_match = re.match(git_pattern, self.command)
         if git_match is not None:
             vcs_type = 'git'
-            repo_name = git_match.group(2).strip('/')
+            repo_name = self.maybe_translate_repo_uid(git_match.group(2).strip('/'))
             mode = git_match.group(1)
             return vcs_type, repo_name, mode
 

rhodecode/apps/ssh_support/tests/test_server_git.py

@@ -19,6 +19,8 b''
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import json
+import os
+
 import mock
 import<