repo-permissions: moved permissions into pyramid.

- fix issues when added new perms changed those already in the form
- fixed issue with default user overriding permissions when private repos where turned on.
- Two above are not security issues, but rather making the behaviour more consistent.

rhodecode/apps/repository/views/repo_permissions.py

@@ -0,0 +1,98 b''
+# -*- coding: utf-8 -*-
+
+# Copyright (C) 2011-2017 RhodeCode GmbH
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License, version 3
+# (only), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+# This program is dual-licensed. If you wish to learn more about the
+# RhodeCode Enterprise Edition, including its added features, Support services,
+# and proprietary license terms, please see https://rhodecode.com/licenses/
+
+import logging
+
+import deform
+from pyramid.httpexceptions import HTTPFound
+from pyramid.view import view_config
+
+from rhodecode.apps._base import RepoAppView
+from rhodecode.forms import RcForm
+from rhodecode.lib import helpers as h
+from rhodecode.lib import audit_logger
+from rhodecode.lib.auth import (
+    LoginRequired, HasRepoPermissionAnyDecorator,
+    HasRepoPermissionAllDecorator, CSRFRequired)
+from rhodecode.model.db import RepositoryField, RepoGroup
+from rhodecode.model.forms import RepoPermsForm
+from rhodecode.model.meta import Session
+from rhodecode.model.repo import RepoModel
+from rhodecode.model.scm import RepoGroupList, ScmModel
+from rhodecode.model.validation_schema.schemas import repo_schema
+
+log = logging.getLogger(__name__)
+
+
+class RepoSettingsPermissionsView(RepoAppView):
+
+    def load_default_context(self):
+        c = self._get_local_tmpl_context()
+
+        # TODO(marcink): remove repo_info and use c.rhodecode_db_repo instead
+        c.repo_info = self.db_repo
+
+        self._register_global_c(c)
+        return c
+
+    @LoginRequired()
+    @HasRepoPermissionAnyDecorator('repository.admin')
+    @view_config(
+        route_name='edit_repo_perms', request_method='GET',
+        renderer='rhodecode:templates/admin/repos/repo_edit.mako')
+    def edit_permissions(self):
+        c = self.load_default_context()
+        c.active = 'permissions'
+        return self._get_template_context(c)
+
+    @LoginRequired()
+    @HasRepoPermissionAllDecorator('repository.admin')
+    @CSRFRequired()
+    @view_config(
+        route_name='edit_repo_perms', request_method='POST',
+        renderer='rhodecode:templates/admin/repos/repo_edit.mako')
+    def edit_permissions_update(self):
+        _ = self.request.translate
+        c = self.load_default_context()
+        c.active = 'permissions'
+        data = self.request.POST
+        # store private flag outside of HTML to verify if we can modify
+        # default user permissions, prevents submition of FAKE post data
+        # into the form for private repos
+        data['repo_private'] = self.db_repo.private
+        form = RepoPermsForm()().to_python(data)
+        changes = RepoModel().update_permissions(
+            self.db_repo_name, form['perm_additions'], form['perm_updates'],
+            form['perm_deletions'])
+
+        action_data = {
+            'added': changes['added'],
+            'updated': changes['updated'],
+            'deleted': changes['deleted'],
+        }
+        audit_logger.store(
+            'repo.edit.permissions', action_data=action_data,
+            user=self._rhodecode_user, repo=self.db_repo)
+
+        Session().commit()
+        h.flash(_('Repository permissions updated'), category='success')
+
+        raise HTTPFound(
+            self.request.route_path('edit_repo_perms', repo_name=self.db_repo_name))

rhodecode/apps/repository/__init__.py

@@ -1,61 +1,66 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2016-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 
 def includeme(config):
 
     # Settings
     config.add_route(
         name='edit_repo',
         pattern='/{repo_name:.*?[^/]}/settings', repo_route=True)
 
     # Caches
     config.add_route(
         name='edit_repo_caches',
         pattern='/{repo_name:.*?[^/]}/settings/caches', repo_route=True)
 
+    # Permissions
+    config.add_route(
+        name='edit_repo_perms',
+        pattern='/{repo_name:.*?[^/]}/settings/permissions', repo_route=True)
+
     # Repo Review Rules
     config.add_route(
         name='repo_reviewers',
         pattern='/{repo_name:.*?[^/]}/settings/review/rules', repo_route=True)
 
     # Maintenance
     config.add_route(
         name='repo_maintenance',
         pattern='/{repo_name:.*?[^/]}/maintenance', repo_route=True)
 
     config.add_route(
         name='repo_maintenance_execute',
         pattern='/{repo_name:.*?[^/]}/maintenance/execute', repo_route=True)
 
     # Strip
     config.add_route(
         name='strip',
         pattern='/{repo_name:.*?[^/]}/strip', repo_route=True)
 
     config.add_route(
         name='strip_check',
         pattern='/{repo_name:.*?[^/]}/strip_check', repo_route=True)
 
     config.add_route(
         name='strip_execute',
         pattern='/{repo_name:.*?[^/]}/strip_execute', repo_route=True)
     # Scan module for configuration decorators.
     config.scan()

rhodecode/apps/repository/tests/test_repo_settings.py

@@ -1,231 +1,232 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import mock
 import pytest
 
 from rhodecode.lib.utils2 import str2bool
 from rhodecode.lib.vcs.exceptions import RepositoryRequirementError
 from rhodecode.model.db import Repository, UserRepoToPerm, Permission, User
 from rhodecode.model.meta import Session
 from rhodecode.tests import (
     url, HG_REPO, TEST_USER_ADMIN_LOGIN, TEST_USER_REGULAR_LOGIN,
     assert_session_flash)
 from rhodecode.tests.fixture import Fixture
 
 fixture = Fixture()
 
 
 def route_path(name, params=None, **kwargs):
     import urllib
 
     base_url = {
         'edit_repo': '/{repo_name}/settings',
         'edit_repo_caches': '/{repo_name}/settings/caches',
+        'edit_repo_perms': '/{repo_name}/settings/permissions',
     }[name].format(**kwargs)
 
     if params:
         base_url = '{}?{}'.format(base_url, urllib.urlencode(params))
     return base_url
 
 
 def _get_permission_for_user(user, repo):
     perm = UserRepoToPerm.query()\
         .filter(UserRepoToPerm.repository ==
                 Repository.get_by_repo_name(repo))\
         .filter(UserRepoToPerm.user == User.get_by_username(user))\
         .all()
     return perm
 
 
 @pytest.mark.usefixtures('autologin_user', 'app')
 class TestAdminRepoSettings(object):
     @pytest.mark.parametrize('urlname', [
         'edit_repo',
-        'edit_repo_caches'
+        'edit_repo_caches',
+        'edit_repo_perms',
     ])
     def test_show_page(self, urlname, app, backend):
         app.get(route_path(urlname, repo_name=backend.repo_name), status=200)
 
     def test_edit_accessible_when_missing_requirements(
             self, backend_hg, autologin_user):
         scm_patcher = mock.patch.object(
             Repository, 'scm_instance', side_effect=RepositoryRequirementError)
         with scm_patcher:
             self.app.get(route_path('edit_repo', repo_name=backend_hg.repo_name))
 
     @pytest.mark.parametrize('urlname', [
-        'edit_repo_perms',
         'edit_repo_advanced',
         'repo_vcs_settings',
         'edit_repo_fields',
         'repo_settings_issuetracker',
         'edit_repo_remote',
         'edit_repo_statistics',
     ])
     def test_show_page_pylons(self, urlname, app):
         app.get(url(urlname, repo_name=HG_REPO))
 
     @pytest.mark.parametrize('update_settings', [
         {'repo_description': 'alter-desc'},
         {'repo_owner': TEST_USER_REGULAR_LOGIN},
         {'repo_private': 'true'},
         {'repo_enable_locking': 'true'},
         {'repo_enable_downloads': 'true'},
     ])
     def test_update_repo_settings(self, update_settings, csrf_token, backend, user_util):
         repo = user_util.create_repo(repo_type=backend.alias)
         repo_name = repo.repo_name
 
         params = fixture._get_repo_create_params(
                 csrf_token=csrf_token,
                 repo_name=repo_name,
                 repo_type=backend.alias,
                 repo_owner=TEST_USER_ADMIN_LOGIN,
                 repo_description='DESC',
 
                 repo_private='false',
                 repo_enable_locking='false',
                 repo_enable_downloads='false')
         params.update(update_settings)
         self.app.post(
             route_path('edit_repo', repo_name=repo_name),
             params=params, status=302)
 
         repo = Repository.get_by_repo_name(repo_name)
         assert repo.user.username == \
                update_settings.get('repo_owner', repo.user.username)
 
         assert repo.description == \
                update_settings.get('repo_description', repo.description)
 
         assert repo.private == \
                str2bool(update_settings.get(
                    'repo_private', repo.private))
 
         assert repo.enable_locking == \
                str2bool(update_settings.get(
                    'repo_enable_locking', repo.enable_locking))
 
         assert repo.enable_downloads == \
                str2bool(update_settings.get(
                    'repo_enable_downloads', repo.enable_downloads))
 
     def test_update_repo_name_via_settings(self, csrf_token, user_util, backend):
         repo = user_util.create_repo(repo_type=backend.alias)
         repo_name = repo.repo_name
 
         repo_group = user_util.create_repo_group()
         repo_group_name = repo_group.group_name
         new_name = repo_group_name + '_' + repo_name
 
         params = fixture._get_repo_create_params(
                 csrf_token=csrf_token,
                 repo_name=new_name,
                 repo_type=backend.alias,
                 repo_owner=TEST_USER_ADMIN_LOGIN,
                 repo_description='DESC',
                 repo_private='false',
                 repo_enable_locking='false',
                 repo_enable_downloads='false')
         self.app.post(
             route_path('edit_repo', repo_name=repo_name),
             params=params, status=302)
         repo = Repository.get_by_repo_name(new_name)
         assert repo.repo_name == new_name
 
     def test_update_repo_group_via_settings(self, csrf_token, user_util, backend):
         repo = user_util.create_repo(repo_type=backend.alias)
         repo_name = repo.repo_name
 
         repo_group = user_util.create_repo_group()
         repo_group_name = repo_group.group_name
         repo_group_id = repo_group.group_id
 
         new_name = repo_group_name + '/' + repo_name
         params = fixture._get_repo_create_params(
                 csrf_token=csrf_token,
                 repo_name=repo_name,
                 repo_type=backend.alias,
                 repo_owner=TEST_USER_ADMIN_LOGIN,
                 repo_description='DESC',
                 repo_group=repo_group_id,
                 repo_private='false',
                 repo_enable_locking='false',
                 repo_enable_downloads='false')
         self.app.post(
             route_path('edit_repo', repo_name=repo_name),
             params=params, status=302)
         repo = Repository.get_by_repo_name(new_name)
         assert repo.repo_name == new_name
 
     def test_set_private_flag_sets_default_user_permissions_to_none(
             self, autologin_user, backend, csrf_token):
 
         # initially repository perm should be read
         perm = _get_permission_for_user(user='default', repo=backend.repo_name)
         assert len(perm) == 1
         assert perm[0].permission.permission_name == 'repository.read'
         assert not backend.repo.private
 
         response = self.app.post(
             route_path('edit_repo', repo_name=backend.repo_name),
             params=fixture._get_repo_create_params(
                 repo_private='true',
                 repo_name=backend.repo_name,
                 repo_type=backend.alias,
                 repo_owner=TEST_USER_ADMIN_LOGIN,
                 csrf_token=csrf_token), status=302)
 
         assert_session_flash(
             response,
             msg='Repository %s updated successfully' % (backend.repo_name))
 
         repo = Repository.get_by_repo_name(backend.repo_name)
         assert repo.private is True
 
         # now the repo default permission should be None
         perm = _get_permission_for_user(user='default', repo=backend.repo_name)
         assert len(perm) == 1
         assert perm[0].permission.permission_name == 'repository.none'
 
         response = self.app.post(
             route_path('edit_repo', repo_name=backend.repo_name),
             params=fixture._get_repo_create_params(
                 repo_private='false',
                 repo_name=backend.repo_name,
                 repo_type=backend.alias,
                 repo_owner=TEST_USER_ADMIN_LOGIN,
                 csrf_token=csrf_token), status=302)
 
         assert_session_flash(
             response,
             msg='Repository %s updated successfully' % (backend.repo_name))
         assert backend.repo.private is False
 
         # we turn off private now the repo default permission should stay None
         perm = _get_permission_for_user(user='default', repo=backend.repo_name)
         assert len(perm) == 1
         assert perm[0].permission.permission_name == 'repository.none'
 
         # update this permission back
         perm[0].permission = Permission.get_by_key('repository.read')
         Session().add(perm[0])
         Session().commit()

rhodecode/config/routing.py

@@ -1,1098 +1,1088 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 Routes configuration
 
 The more specific and detailed routes should be defined first so they
 may take precedent over the more generic routes. For more information
 refer to the routes manual at http://routes.groovie.org/docs/
 
 IMPORTANT: if you change any routing here, make sure to take a look at lib/base.py
 and _route_name variable which uses some of stored naming here to do redirects.
 """
 import os
 import re
 from routes import Mapper
 
 # prefix for non repository related links needs to be prefixed with `/`
 ADMIN_PREFIX = '/_admin'
 STATIC_FILE_PREFIX = '/_static'
 
 # Default requirements for URL parts
 URL_NAME_REQUIREMENTS = {
     # group name can have a slash in them, but they must not end with a slash
     'group_name': r'.*?[^/]',
     'repo_group_name': r'.*?[^/]',
     # repo names can have a slash in them, but they must not end with a slash
     'repo_name': r'.*?[^/]',
     # file path eats up everything at the end
     'f_path': r'.*',
     # reference types
     'source_ref_type': '(branch|book|tag|rev|\%\(source_ref_type\)s)',
     'target_ref_type': '(branch|book|tag|rev|\%\(target_ref_type\)s)',
 }
 
 
 def add_route_requirements(route_path, requirements):
     """
     Adds regex requirements to pyramid routes using a mapping dict
 
     >>> add_route_requirements('/{action}/{id}', {'id': r'\d+'})
     '/{action}/{id:\d+}'
 
      """
     for key, regex in requirements.items():
         route_path = route_path.replace('{%s}' % key, '{%s:%s}' % (key, regex))
     return route_path
 
 
 class JSRoutesMapper(Mapper):
     """
     Wrapper for routes.Mapper to make pyroutes compatible url definitions
     """
     _named_route_regex = re.compile(r'^[a-z-_0-9A-Z]+$')
     _argument_prog = re.compile('\{(.*?)\}|:\((.*)\)')
     def __init__(self, *args, **kw):
         super(JSRoutesMapper, self).__init__(*args, **kw)
         self._jsroutes = []
 
     def connect(self, *args, **kw):
         """
         Wrapper for connect to take an extra argument jsroute=True
 
         :param jsroute: boolean, if True will add the route to the pyroutes list
         """
         if kw.pop('jsroute', False):
             if not self._named_route_regex.match(args[0]):
                 raise Exception('only named routes can be added to pyroutes')
             self._jsroutes.append(args[0])
 
         super(JSRoutesMapper, self).connect(*args, **kw)
 
     def _extract_route_information(self, route):
         """
         Convert a route into tuple(name, path, args), eg:
             ('show_user', '/profile/%(username)s', ['username'])
         """
         routepath = route.routepath
         def replace(matchobj):
             if matchobj.group(1):
                 return "%%(%s)s" % matchobj.group(1).split(':')[0]
             else:
                 return "%%(%s)s" % matchobj.group(2)
 
         routepath = self._argument_prog.sub(replace, routepath)
         return (
             route.name,
             routepath,
             [(arg[0].split(':')[0] if arg[0] != '' else arg[1])
               for arg in self._argument_prog.findall(route.routepath)]
         )
 
     def jsroutes(self):
         """
         Return a list of pyroutes.js compatible routes
         """
         for route_name in self._jsroutes:
             yield self._extract_route_information(self._routenames[route_name])
 
 
 def make_map(config):
     """Create, configure and return the routes Mapper"""
     rmap = JSRoutesMapper(directory=config['pylons.paths']['controllers'],
                   always_scan=config['debug'])
     rmap.minimization = False
     rmap.explicit = False
 
     from rhodecode.lib.utils2 import str2bool
     from rhodecode.model import repo, repo_group
 
     def check_repo(environ, match_dict):
         """
         check for valid repository for proper 404 handling
 
         :param environ:
         :param match_dict:
         """
         repo_name = match_dict.get('repo_name')
 
         if match_dict.get('f_path'):
             # fix for multiple initial slashes that causes errors
             match_dict['f_path'] = match_dict['f_path'].lstrip('/')
         repo_model = repo.RepoModel()
         by_name_match = repo_model.get_by_repo_name(repo_name)
         # if we match quickly from database, short circuit the operation,
         # and validate repo based on the type.
         if by_name_match:
             return True
 
         by_id_match = repo_model.get_repo_by_id(repo_name)
         if by_id_match:
             repo_name = by_id_match.repo_name
             match_dict['repo_name'] = repo_name
             return True
 
         return False
 
     def check_group(environ, match_dict):
         """
         check for valid repository group path for proper 404 handling
 
         :param environ:
         :param match_dict:
         """
         repo_group_name = match_dict.get('group_name')
         repo_group_model = repo_group.RepoGroupModel()
         by_name_match = repo_group_model.get_by_group_name(repo_group_name)
         if by_name_match:
             return True
 
         return False
 
     def check_user_group(environ, match_dict):
         """
         check for valid user group for proper 404 handling
 
         :param environ:
         :param match_dict:
         """
         return True
 
     def check_int(environ, match_dict):
         return match_dict.get('id').isdigit()
 
 
     #==========================================================================
     # CUSTOM ROUTES HERE
     #==========================================================================
 
     # MAIN PAGE
     rmap.connect('home', '/', controller='home', action='index', jsroute=True)
 
     # ping and pylons error test
     rmap.connect('ping', '%s/ping' % (ADMIN_PREFIX,), controller='home', action='ping')
     rmap.connect('error_test', '%s/error_test' % (ADMIN_PREFIX,), controller='home', action='error_test')
 
     # ADMIN REPOSITORY ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/repos') as m:
         m.connect('repos', '/repos',
                   action='create', conditions={'method': ['POST']})
         m.connect('repos', '/repos',
                   action='index', conditions={'method': ['GET']})
         m.connect('new_repo', '/create_repository', jsroute=True,
                   action='create_repository', conditions={'method': ['GET']})
         m.connect('delete_repo', '/repos/{repo_name}',
                   action='delete', conditions={'method': ['DELETE']},
                   requirements=URL_NAME_REQUIREMENTS)
         m.connect('repo', '/repos/{repo_name}',
                   action='show', conditions={'method': ['GET'],
                                              'function': check_repo},
                   requirements=URL_NAME_REQUIREMENTS)
 
     # ADMIN REPOSITORY GROUPS ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/repo_groups') as m:
         m.connect('repo_groups', '/repo_groups',
                   action='create', conditions={'method': ['POST']})
         m.connect('repo_groups', '/repo_groups',
                   action='index', conditions={'method': ['GET']})
         m.connect('new_repo_group', '/repo_groups/new',
                   action='new', conditions={'method': ['GET']})
         m.connect('update_repo_group', '/repo_groups/{group_name}',
                   action='update', conditions={'method': ['PUT'],
                                                'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
 
         # EXTRAS REPO GROUP ROUTES
         m.connect('edit_repo_group', '/repo_groups/{group_name}/edit',
                   action='edit',
                   conditions={'method': ['GET'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
         m.connect('edit_repo_group', '/repo_groups/{group_name}/edit',
                   action='edit',
                   conditions={'method': ['PUT'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
 
         m.connect('edit_repo_group_advanced', '/repo_groups/{group_name}/edit/advanced',
                   action='edit_repo_group_advanced',
                   conditions={'method': ['GET'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
         m.connect('edit_repo_group_advanced', '/repo_groups/{group_name}/edit/advanced',
                   action='edit_repo_group_advanced',
                   conditions={'method': ['PUT'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
 
         m.connect('edit_repo_group_perms', '/repo_groups/{group_name}/edit/permissions',
                   action='edit_repo_group_perms',
                   conditions={'method': ['GET'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
         m.connect('edit_repo_group_perms', '/repo_groups/{group_name}/edit/permissions',
                   action='update_perms',
                   conditions={'method': ['PUT'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
 
         m.connect('delete_repo_group', '/repo_groups/{group_name}',
                   action='delete', conditions={'method': ['DELETE'],
                                                'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
 
     # ADMIN USER ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/users') as m:
         m.connect('users', '/users',
                   action='create', conditions={'method': ['POST']})
         m.connect('new_user', '/users/new',
                   action='new', conditions={'method': ['GET']})
         m.connect('update_user', '/users/{user_id}',
                   action='update', conditions={'method': ['PUT']})
         m.connect('delete_user', '/users/{user_id}',
                   action='delete', conditions={'method': ['DELETE']})
         m.connect('edit_user', '/users/{user_id}/edit',
                   action='edit', conditions={'method': ['GET']}, jsroute=True)
         m.connect('user', '/users/{user_id}',
                   action='show', conditions={'method': ['GET']})
         m.connect('force_password_reset_user', '/users/{user_id}/password_reset',
                   action='reset_password', conditions={'method': ['POST']})
         m.connect('create_personal_repo_group', '/users/{user_id}/create_repo_group',
                   action='create_personal_repo_group', conditions={'method': ['POST']})
 
         # EXTRAS USER ROUTES
         m.connect('edit_user_advanced', '/users/{user_id}/edit/advanced',
                   action='edit_advanced', conditions={'method': ['GET']})
         m.connect('edit_user_advanced', '/users/{user_id}/edit/advanced',
                   action='update_advanced', conditions={'method': ['PUT']})
 
         m.connect('edit_user_global_perms', '/users/{user_id}/edit/global_permissions',
                   action='edit_global_perms', conditions={'method': ['GET']})
         m.connect('edit_user_global_perms', '/users/{user_id}/edit/global_permissions',
                   action='update_global_perms', conditions={'method': ['PUT']})
 
         m.connect('edit_user_perms_summary', '/users/{user_id}/edit/permissions_summary',
                   action='edit_perms_summary', conditions={'method': ['GET']})
 
         m.connect('edit_user_emails', '/users/{user_id}/edit/emails',
                   action='edit_emails', conditions={'method': ['GET']})
         m.connect('edit_user_emails', '/users/{user_id}/edit/emails',
                   action='add_email', conditions={'method': ['PUT']})
         m.connect('edit_user_emails', '/users/{user_id}/edit/emails',
                   action='delete_email', conditions={'method': ['DELETE']})
 
         m.connect('edit_user_ips', '/users/{user_id}/edit/ips',
                   action='edit_ips', conditions={'method': ['GET']})
         m.connect('edit_user_ips', '/users/{user_id}/edit/ips',
                   action='add_ip', conditions={'method': ['PUT']})
         m.connect('edit_user_ips', '/users/{user_id}/edit/ips',
                   action='delete_ip', conditions={'method': ['DELETE']})
 
     # ADMIN USER GROUPS REST ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/user_groups') as m:
         m.connect('users_groups', '/user_groups',
                   action='create', conditions={'method': ['POST']})
         m.connect('users_groups', '/user_groups',
                   action='index', conditions={'method': ['GET']})
         m.connect('new_users_group', '/user_groups/new',
                   action='new', conditions={'method': ['GET']})
         m.connect('update_users_group', '/user_groups/{user_group_id}',
                   action='update', conditions={'method': ['PUT']})
         m.connect('delete_users_group', '/user_groups/{user_group_id}',
                   action='delete', conditions={'method': ['DELETE']})
         m.connect('edit_users_group', '/user_groups/{user_group_id}/edit',
                   action='edit', conditions={'method': ['GET']},
                   function=check_user_group)
 
         # EXTRAS USER GROUP ROUTES
         m.connect('edit_user_group_global_perms',
                   '/user_groups/{user_group_id}/edit/global_permissions',
                   action='edit_global_perms', conditions={'method': ['GET']})
         m.connect('edit_user_group_global_perms',
                   '/user_groups/{user_group_id}/edit/global_permissions',
                   action='update_global_perms', conditions={'method': ['PUT']})
         m.connect('edit_user_group_perms_summary',
                   '/user_groups/{user_group_id}/edit/permissions_summary',
                   action='edit_perms_summary', conditions={'method': ['GET']})
 
         m.connect('edit_user_group_perms',
                   '/user_groups/{user_group_id}/edit/permissions',
                   action='edit_perms', conditions={'method': ['GET']})
         m.connect('edit_user_group_perms',
                   '/user_groups/{user_group_id}/edit/permissions',
                   action='update_perms', conditions={'method': ['PUT']})
 
         m.connect('edit_user_group_advanced',
                   '/user_groups/{user_group_id}/edit/advanced',
                   action='edit_advanced', conditions={'method': ['GET']})
 
         m.connect('edit_user_group_advanced_sync',
                   '/user_groups/{user_group_id}/edit/advanced/sync',
                   action='edit_advanced_set_synchronization', conditions={'method': ['POST']})
 
         m.connect('edit_user_group_members',
                   '/user_groups/{user_group_id}/edit/members', jsroute=True,
                   action='user_group_members', conditions={'method': ['GET']})
 
     # ADMIN PERMISSIONS ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/permissions') as m:
         m.connect('admin_permissions_application', '/permissions/application',
                   action='permission_application_update', conditions={'method': ['POST']})
         m.connect('admin_permissions_application', '/permissions/application',
                   action='permission_application', conditions={'method': ['GET']})
 
         m.connect('admin_permissions_global', '/permissions/global',
                   action='permission_global_update', conditions={'method': ['POST']})
         m.connect('admin_permissions_global', '/permissions/global',
                   action='permission_global', conditions={'method': ['GET']})
 
         m.connect('admin_permissions_object', '/permissions/object',
                   action='permission_objects_update', conditions={'method': ['POST']})
         m.connect('admin_permissions_object', '/permissions/object',
                   action='permission_objects', conditions={'method': ['GET']})
 
         m.connect('admin_permissions_ips', '/permissions/ips',
                   action='permission_ips', conditions={'method': ['POST']})
         m.connect('admin_permissions_ips', '/permissions/ips',
                   action='permission_ips', conditions={'method': ['GET']})
 
         m.connect('admin_permissions_overview', '/permissions/overview',
                   action='permission_perms', conditions={'method': ['GET']})
 
     # ADMIN DEFAULTS REST ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/defaults') as m:
         m.connect('admin_defaults_repositories', '/defaults/repositories',
                   action='update_repository_defaults', conditions={'method': ['POST']})
         m.connect('admin_defaults_repositories', '/defaults/repositories',
                   action='index', conditions={'method': ['GET']})
 
     # ADMIN DEBUG STYLE ROUTES
     if str2bool(config.get('debug_style')):
         with rmap.submapper(path_prefix=ADMIN_PREFIX + '/debug_style',
                             controller='debug_style') as m:
             m.connect('debug_style_home', '',
                       action='index', conditions={'method': ['GET']})
             m.connect('debug_style_template', '/t/{t_path}',
                       action='template', conditions={'method': ['GET']})
 
     # ADMIN SETTINGS ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/settings') as m:
 
         # default
         m.connect('admin_settings', '/settings',
                   action='settings_global_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings', '/settings',
                   action='settings_global', conditions={'method': ['GET']})
 
         m.connect('admin_settings_vcs', '/settings/vcs',
                   action='settings_vcs_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_vcs', '/settings/vcs',
                   action='settings_vcs',
                   conditions={'method': ['GET']})
         m.connect('admin_settings_vcs', '/settings/vcs',
                   action='delete_svn_pattern',
                   conditions={'method': ['DELETE']})
 
         m.connect('admin_settings_mapping', '/settings/mapping',
                   action='settings_mapping_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_mapping', '/settings/mapping',
                   action='settings_mapping', conditions={'method': ['GET']})
 
         m.connect('admin_settings_global', '/settings/global',
                   action='settings_global_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_global', '/settings/global',
                   action='settings_global', conditions={'method': ['GET']})
 
         m.connect('admin_settings_visual', '/settings/visual',
                   action='settings_visual_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_visual', '/settings/visual',
                   action='settings_visual', conditions={'method': ['GET']})
 
         m.connect('admin_settings_issuetracker',
                   '/settings/issue-tracker', action='settings_issuetracker',
                   conditions={'method': ['GET']})
         m.connect('admin_settings_issuetracker_save',
                   '/settings/issue-tracker/save',
                   action='settings_issuetracker_save',
                   conditions={'method': ['POST']})
         m.connect('admin_issuetracker_test', '/settings/issue-tracker/test',
                   action='settings_issuetracker_test',
                   conditions={'method': ['POST']})
         m.connect('admin_issuetracker_delete',
                   '/settings/issue-tracker/delete',
                   action='settings_issuetracker_delete',
                   conditions={'method': ['DELETE']})
 
         m.connect('admin_settings_email', '/settings/email',
                   action='settings_email_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_email', '/settings/email',
                   action='settings_email', conditions={'method': ['GET']})
 
         m.connect('admin_settings_hooks', '/settings/hooks',
                   action='settings_hooks_update',
                   conditions={'method': ['POST', 'DELETE']})
         m.connect('admin_settings_hooks', '/settings/hooks',
                   action='settings_hooks', conditions={'method': ['GET']})
 
         m.connect('admin_settings_search', '/settings/search',
                   action='settings_search', conditions={'method': ['GET']})
 
         m.connect('admin_settings_supervisor', '/settings/supervisor',
                   action='settings_supervisor', conditions={'method': ['GET']})
         m.connect('admin_settings_supervisor_log', '/settings/supervisor/{procid}/log',
                   action='settings_supervisor_log', conditions={'method': ['GET']})
 
         m.connect('admin_settings_labs', '/settings/labs',
                   action='settings_labs_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_labs', '/settings/labs',
                   action='settings_labs', conditions={'method': ['GET']})
 
     # ADMIN MY ACCOUNT
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/my_account') as m:
 
         m.connect('my_account_edit', '/my_account/edit',
                   action='my_account_edit', conditions={'method': ['GET']})
         m.connect('my_account', '/my_account/update',
                   action='my_account_update', conditions={'method': ['POST']})
 
         # NOTE(marcink): this needs to be kept for password force flag to be
         # handler, remove after migration to pyramid
         m.connect('my_account_password', '/my_account/password',
                   action='my_account_password', conditions={'method': ['GET']})
 
         m.connect('my_account_repos', '/my_account/repos',
                   action='my_account_repos', conditions={'method': ['GET']})
 
         m.connect('my_account_watched', '/my_account/watched',
                   action='my_account_watched', conditions={'method': ['GET']})
 
         m.connect('my_account_pullrequests', '/my_account/pull_requests',
                   action='my_account_pullrequests', conditions={'method': ['GET']})
 
         m.connect('my_account_perms', '/my_account/perms',
                   action='my_account_perms', conditions={'method': ['GET']})
 
         m.connect('my_account_emails', '/my_account/emails',
                   action='my_account_emails', conditions={'method': ['GET']})
         m.connect('my_account_emails', '/my_account/emails',
                   action='my_account_emails_add', conditions={'method': ['POST']})
         m.connect('my_account_emails', '/my_account/emails',
                   action='my_account_emails_delete', conditions={'method': ['DELETE']})
 
         m.connect('my_account_notifications', '/my_account/notifications',
                   action='my_notifications',
                   conditions={'method': ['GET']})
         m.connect('my_account_notifications_toggle_visibility',
                   '/my_account/toggle_visibility',
                   action='my_notifications_toggle_visibility',
                   conditions={'method': ['POST']})
     m.connect('my_account_notifications_test_channelstream',
               '/my_account/test_channelstream',
               action='my_account_notifications_test_channelstream',
               conditions={'method': ['POST']})
 
     # NOTIFICATION REST ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/notifications') as m:
         m.connect('notifications', '/notifications',
                   action='index', conditions={'method': ['GET']})
         m.connect('notifications_mark_all_read', '/notifications/mark_all_read',
                   action='mark_all_read', conditions={'method': ['POST']})
         m.connect('/notifications/{notification_id}',
                   action='update', conditions={'method': ['PUT']})
         m.connect('/notifications/{notification_id}',
                   action='delete', conditions={'method': ['DELETE']})
         m.connect('notification', '/notifications/{notification_id}',
                   action='show', conditions={'method': ['GET']})
 
     # ADMIN GIST
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/gists') as m:
         m.connect('gists', '/gists',
                   action='create', conditions={'method': ['POST']})
         m.connect('gists', '/gists', jsroute=True,
                   action='index', conditions={'method': ['GET']})
         m.connect('new_gist', '/gists/new', jsroute=True,
                   action='new', conditions={'method': ['GET']})
 
         m.connect('/gists/{gist_id}',
                   action='delete', conditions={'method': ['DELETE']})
         m.connect('edit_gist', '/gists/{gist_id}/edit',
                   action='edit_form', conditions={'method': ['GET']})
         m.connect('edit_gist', '/gists/{gist_id}/edit',
                   action='edit', conditions={'method': ['POST']})
         m.connect(
             'edit_gist_check_revision', '/gists/{gist_id}/edit/check_revision',
             action='check_revision', conditions={'method': ['GET']})
 
         m.connect('gist', '/gists/{gist_id}',
                   action='show', conditions={'method': ['GET']})
         m.connect('gist_rev', '/gists/{gist_id}/{revision}',
                   revision='tip',
                   action='show', conditions={'method': ['GET']})
         m.connect('formatted_gist', '/gists/{gist_id}/{revision}/{format}',
                   revision='tip',
                   action='show', conditions={'method': ['GET']})
         m.connect('formatted_gist_file', '/gists/{gist_id}/{revision}/{format}/{f_path}',
                   revision='tip',
                   action='show', conditions={'method': ['GET']},
                   requirements=URL_NAME_REQUIREMENTS)
 
     # ADMIN MAIN PAGES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/admin') as m:
         m.connect('admin_home', '', action='index')
         m.connect('admin_add_repo', '/add_repo/{new_repo:[a-z0-9\. _-]*}',
                   action='add_repo')
         m.connect(
             'pull_requests_global_0', '/pull_requests/{pull_request_id:[0-9]+}',
             action='pull_requests')
         m.connect(
             'pull_requests_global_1', '/pull-requests/{pull_request_id:[0-9]+}',
             action='pull_requests')
         m.connect(
             'pull_requests_global', '/pull-request/{pull_request_id:[0-9]+}',
             action='pull_requests')
 
     # USER JOURNAL
     rmap.connect('journal', '%s/journal' % (ADMIN_PREFIX,),
                  controller='journal', action='index')
     rmap.connect('journal_rss', '%s/journal/rss' % (ADMIN_PREFIX,),
                  controller='journal', action='journal_rss')
     rmap.connect('journal_atom', '%s/journal/atom' % (ADMIN_PREFIX,),
                  controller='journal', action='journal_atom')
 
     rmap.connect('public_journal', '%s/public_journal' % (ADMIN_PREFIX,),
                  controller='journal', action='public_journal')
 
     rmap.connect('public_journal_rss', '%s/public_journal/rss' % (ADMIN_PREFIX,),
                  controller='journal', action='public_journal_rss')
 
     rmap.connect('public_journal_rss_old', '%s/public_journal_rss' % (ADMIN_PREFIX,),
                  controller='journal', action='public_journal_rss')
 
     rmap.connect('public_journal_atom',
                  '%s/public_journal/atom' % (ADMIN_PREFIX,), controller='journal',
                  action='public_journal_atom')
 
     rmap.connect('public_journal_atom_old',
                  '%s/public_journal_atom' % (ADMIN_PREFIX,), controller='journal',
                  action='public_journal_atom')
 
     rmap.connect('toggle_following', '%s/toggle_following' % (ADMIN_PREFIX,),
                  controller='journal', action='toggle_following', jsroute=True,
                  conditions={'method': ['POST']})
 
     # FEEDS
     rmap.connect('rss_feed_home', '/{repo_name}/feed/rss',
                  controller='feed', action='rss',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('atom_feed_home', '/{repo_name}/feed/atom',
                  controller='feed', action='atom',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     #==========================================================================
     # REPOSITORY ROUTES
     #==========================================================================
 
     rmap.connect('repo_creating_home', '/{repo_name}/repo_creating',
                  controller='admin/repos', action='repo_creating',
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_check_home', '/{repo_name}/crepo_check',
                  controller='admin/repos', action='repo_check',
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('repo_stats', '/{repo_name}/repo_stats/{commit_id}',
                  controller='summary', action='repo_stats',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('repo_refs_data', '/{repo_name}/refs-data',
                  controller='summary', action='repo_refs_data',
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
     rmap.connect('repo_refs_changelog_data', '/{repo_name}/refs-data-changelog',
                  controller='summary', action='repo_refs_changelog_data',
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
     rmap.connect('repo_default_reviewers_data', '/{repo_name}/default-reviewers',
                  controller='summary', action='repo_default_reviewers_data',
                  jsroute=True, requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('changeset_home', '/{repo_name}/changeset/{revision}',
                  controller='changeset', revision='tip',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
     rmap.connect('changeset_children', '/{repo_name}/changeset_children/{revision}',
                  controller='changeset', revision='tip', action='changeset_children',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('changeset_parents', '/{repo_name}/changeset_parents/{revision}',
                  controller='changeset', revision='tip', action='changeset_parents',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     # repo edit options
-    rmap.connect('edit_repo_perms', '/{repo_name}/settings/permissions',
-                 jsroute=True,
-                 controller='admin/repos', action='edit_permissions',
-                 conditions={'method': ['GET'], 'function': check_repo},
-                 requirements=URL_NAME_REQUIREMENTS)
-    rmap.connect('edit_repo_perms_update', '/{repo_name}/settings/permissions',
-                 controller='admin/repos', action='edit_permissions_update',
-                 conditions={'method': ['PUT'], 'function': check_repo},
-                 requirements=URL_NAME_REQUIREMENTS)
-
     rmap.connect('edit_repo_fields', '/{repo_name}/settings/fields',
                  controller='admin/repos', action='edit_fields',
                  conditions={'method': ['GET'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('create_repo_fields', '/{repo_name}/settings/fields/new',
                  controller='admin/repos', action='create_repo_field',
                  conditions={'method': ['PUT'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('delete_repo_fields', '/{repo_name}/settings/fields/{field_id}',
                  controller='admin/repos', action='delete_repo_field',
                  conditions={'method': ['DELETE'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('edit_repo_advanced', '/{repo_name}/settings/advanced',
                  controller='admin/repos', action='edit_advanced',
                  conditions={'method': ['GET'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('edit_repo_advanced_locking', '/{repo_name}/settings/advanced/locking',
                  controller='admin/repos', action='edit_advanced_locking',
                  conditions={'method': ['PUT'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('toggle_locking', '/{repo_name}/settings/advanced/locking_toggle',
                  controller='admin/repos', action='toggle_locking',
                  conditions={'method': ['GET'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('edit_repo_advanced_journal', '/{repo_name}/settings/advanced/journal',
                  controller='admin/repos', action='edit_advanced_journal',
                  conditions={'method': ['PUT'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('edit_repo_advanced_fork', '/{repo_name}/settings/advanced/fork',
                  controller='admin/repos', action='edit_advanced_fork',
                  conditions={'method': ['PUT'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('edit_repo_remote', '/{repo_name}/settings/remote',
                  controller='admin/repos', action='edit_remote_form',
                  conditions={'method': ['GET'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('edit_repo_remote', '/{repo_name}/settings/remote',
                  controller='admin/repos', action='edit_remote',
                  conditions={'method': ['PUT'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('edit_repo_statistics', '/{repo_name}/settings/statistics',
                  controller='admin/repos', action='edit_statistics_form',
                  conditions={'method': ['GET'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('edit_repo_statistics', '/{repo_name}/settings/statistics',
                  controller='admin/repos', action='edit_statistics',
                  conditions={'method': ['PUT'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_settings_issuetracker',
                  '/{repo_name}/settings/issue-tracker',
                  controller='admin/repos', action='repo_issuetracker',
                  conditions={'method': ['GET'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_issuetracker_test',
                  '/{repo_name}/settings/issue-tracker/test',
                  controller='admin/repos', action='repo_issuetracker_test',
                  conditions={'method': ['POST'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_issuetracker_delete',
                  '/{repo_name}/settings/issue-tracker/delete',
                  controller='admin/repos', action='repo_issuetracker_delete',
                  conditions={'method': ['DELETE'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_issuetracker_save',
                  '/{repo_name}/settings/issue-tracker/save',
                  controller='admin/repos', action='repo_issuetracker_save',
                  conditions={'method': ['POST'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_vcs_settings', '/{repo_name}/settings/vcs',
                  controller='admin/repos', action='repo_settings_vcs_update',
                  conditions={'method': ['POST'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_vcs_settings', '/{repo_name}/settings/vcs',
                  controller='admin/repos', action='repo_settings_vcs',
                  conditions={'method': ['GET'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_vcs_settings', '/{repo_name}/settings/vcs',
                  controller='admin/repos', action='repo_delete_svn_pattern',
                  conditions={'method': ['DELETE'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_pullrequest_settings', '/{repo_name}/settings/pullrequest',
                  controller='admin/repos', action='repo_settings_pullrequest',
                  conditions={'method': ['GET', 'POST'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     # still working url for backward compat.
     rmap.connect('raw_changeset_home_depraced',
                  '/{repo_name}/raw-changeset/{revision}',
                  controller='changeset', action='changeset_raw',
                  revision='tip', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     # new URLs
     rmap.connect('changeset_raw_home',
                  '/{repo_name}/changeset-diff/{revision}',
                  controller='changeset', action='changeset_raw',
                  revision='tip', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('changeset_patch_home',
                  '/{repo_name}/changeset-patch/{revision}',
                  controller='changeset', action='changeset_patch',
                  revision='tip', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('changeset_download_home',
                  '/{repo_name}/changeset-download/{revision}',
                  controller='changeset', action='changeset_download',
                  revision='tip', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('changeset_comment',
                  '/{repo_name}/changeset/{revision}/comment', jsroute=True,
                  controller='changeset', revision='tip', action='comment',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('changeset_comment_preview',
                  '/{repo_name}/changeset/comment/preview', jsroute=True,
                  controller='changeset', action='preview_comment',
                  conditions={'function': check_repo, 'method': ['POST']},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('changeset_comment_delete',
                  '/{repo_name}/changeset/comment/{comment_id}/delete',
                  controller='changeset', action='delete_comment',
                  conditions={'function': check_repo, 'method': ['DELETE']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('changeset_info', '/{repo_name}/changeset_info/{revision}',
                  controller='changeset', action='changeset_info',
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('compare_home',
                  '/{repo_name}/compare',
                  controller='compare', action='index',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('compare_url',
                  '/{repo_name}/compare/{source_ref_type}@{source_ref:.*?}...{target_ref_type}@{target_ref:.*?}',
                  controller='compare', action='compare',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest_home',
                  '/{repo_name}/pull-request/new', controller='pullrequests',
                  action='index', conditions={'function': check_repo,
                                              'method': ['GET']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest',
                  '/{repo_name}/pull-request/new', controller='pullrequests',
                  action='create', conditions={'function': check_repo,
                                               'method': ['POST']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest_repo_refs',
                  '/{repo_name}/pull-request/refs/{target_repo_name:.*?[^/]}',
                  controller='pullrequests',
                  action='get_repo_refs',
                  conditions={'function': check_repo, 'method': ['GET']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest_repo_destinations',
                  '/{repo_name}/pull-request/repo-destinations',
                  controller='pullrequests',
                  action='get_repo_destinations',
                  conditions={'function': check_repo, 'method': ['GET']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest_show',
                  '/{repo_name}/pull-request/{pull_request_id}',
                  controller='pullrequests',
                  action='show', conditions={'function': check_repo,
                                             'method': ['GET']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest_update',
                  '/{repo_name}/pull-request/{pull_request_id}',
                  controller='pullrequests',
                  action='update', conditions={'function': check_repo,
                                               'method': ['PUT']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest_merge',
                  '/{repo_name}/pull-request/{pull_request_id}',
                  controller='pullrequests',
                  action='merge', conditions={'function': check_repo,
                                              'method': ['POST']},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('pullrequest_delete',
                  '/{repo_name}/pull-request/{pull_request_id}',
                  controller='pullrequests',
                  action='delete', conditions={'function': check_repo,
                                               'method': ['DELETE']},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('pullrequest_show_all',
                  '/{repo_name}/pull-request',
                  controller='pullrequests',
                  action='show_all', conditions={'function': check_repo,
                                                 'method': ['GET']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest_comment',
                  '/{repo_name}/pull-request-comment/{pull_request_id}',
                  controller='pullrequests',
                  action='comment', conditions={'function': check_repo,
                                                'method': ['POST']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest_comment_delete',
                  '/{repo_name}/pull-request-comment/{comment_id}/delete',
                  controller='pullrequests', action='delete_comment',
                  conditions={'function': check_repo, 'method': ['DELETE']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('summary_home_explicit', '/{repo_name}/summary',
                  controller='summary', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('branches_home', '/{repo_name}/branches',
                  controller='branches', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('tags_home', '/{repo_name}/tags',
                  controller='tags', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('bookmarks_home', '/{repo_name}/bookmarks',
                  controller='bookmarks', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('changelog_home', '/{repo_name}/changelog', jsroute=True,
                  controller='changelog', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('changelog_summary_home', '/{repo_name}/changelog_summary',
                  controller='changelog', action='changelog_summary',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('changelog_file_home',
                  '/{repo_name}/changelog/{revision}/{f_path}',
                  controller='changelog', f_path=None,
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('changelog_elements', '/{repo_name}/changelog_details',
                  controller='changelog', action='changelog_elements',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('files_home',  '/{repo_name}/files/{revision}/{f_path}',
                  controller='files', revision='tip', f_path='',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('files_home_simple_catchrev',
                  '/{repo_name}/files/{revision}',
                  controller='files', revision='tip', f_path='',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_home_simple_catchall',
                  '/{repo_name}/files',
                  controller='files', revision='tip', f_path='',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_history_home',
                  '/{repo_name}/history/{revision}/{f_path}',
                  controller='files', action='history', revision='tip', f_path='',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('files_authors_home',
                  '/{repo_name}/authors/{revision}/{f_path}',
                  controller='files', action='authors', revision='tip', f_path='',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('files_diff_home', '/{repo_name}/diff/{f_path}',
                  controller='files', action='diff', f_path='',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_diff_2way_home',
                  '/{repo_name}/diff-2way/{f_path}',
                  controller='files', action='diff_2way', f_path='',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_rawfile_home',
                  '/{repo_name}/rawfile/{revision}/{f_path}',
                  controller='files', action='rawfile', revision='tip',
                  f_path='', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_raw_home',
                  '/{repo_name}/raw/{revision}/{f_path}',
                  controller='files', action='raw', revision='tip', f_path='',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_render_home',
                  '/{repo_name}/render/{revision}/{f_path}',
                  controller='files', action='index', revision='tip', f_path='',
                  rendered=True, conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_annotate_home',
                  '/{repo_name}/annotate/{revision}/{f_path}',
                  controller='files', action='index', revision='tip',
                  f_path='', annotate=True, conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('files_annotate_previous',
                  '/{repo_name}/annotate-previous/{revision}/{f_path}',
                  controller='files', action='annotate_previous', revision='tip',
                  f_path='', annotate=True, conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('files_edit',
                  '/{repo_name}/edit/{revision}/{f_path}',
                  controller='files', action='edit', revision='tip',
                  f_path='',
                  conditions={'function': check_repo, 'method': ['POST']},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_edit_home',
                  '/{repo_name}/edit/{revision}/{f_path}',
                  controller='files', action='edit_home', revision='tip',
                  f_path='', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_add',
                  '/{repo_name}/add/{revision}/{f_path}',
                  controller='files', action='add', revision='tip',
                  f_path='',
                  conditions={'function': check_repo, 'method': ['POST']},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_add_home',
                  '/{repo_name}/add/{revision}/{f_path}',
                  controller='files', action='add_home', revision='tip',
                  f_path='', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_delete',
                  '/{repo_name}/delete/{revision}/{f_path}',
                  controller='files', action='delete', revision='tip',
                  f_path='',
                  conditions={'function': check_repo, 'method': ['POST']},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_delete_home',
                  '/{repo_name}/delete/{revision}/{f_path}',
                  controller='files', action='delete_home', revision='tip',
                  f_path='', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_archive_home', '/{repo_name}/archive/{fname}',
                  controller='files', action='archivefile',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('files_nodelist_home',
                  '/{repo_name}/nodelist/{revision}/{f_path}',
                  controller='files', action='nodelist',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('files_nodetree_full',
                  '/{repo_name}/nodetree_full/{commit_id}/{f_path}',
                  controller='files', action='nodetree_full',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('repo_fork_create_home', '/{repo_name}/fork',
                  controller='forks', action='fork_create',
                  conditions={'function': check_repo, 'method': ['POST']},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('repo_fork_home', '/{repo_name}/fork',
                  controller='forks', action='fork',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('repo_forks_home', '/{repo_name}/forks',
                  controller='forks', action='forks',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     # must be here for proper group/repo catching pattern
     _connect_with_slash(
         rmap, 'repo_group_home', '/{group_name}',
         controller='home', action='index_repo_group',
         conditions={'function': check_group},
         requirements=URL_NAME_REQUIREMENTS)
 
     # catch all, at the end
     _connect_with_slash(
         rmap, 'summary_home', '/{repo_name}', jsroute=True,
         controller='summary', action='index',
         conditions={'function': check_repo},
         requirements=URL_NAME_REQUIREMENTS)
 
     return rmap
 
 
 def _connect_with_slash(mapper, name, path, *args, **kwargs):
     """
     Connect a route with an optional trailing slash in `path`.
     """
     mapper.connect(name + '_slash', path + '/', *args, **kwargs)
     mapper.connect(name, path, *args, **kwargs)

rhodecode/controllers/admin/repos.py

@@ -1,781 +1,754 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2013-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 
 """
 Repositories controller for RhodeCode
 """
 
 import logging
 import traceback
 
 import formencode
 from formencode import htmlfill
 from pylons import request, tmpl_context as c, url
 from pylons.controllers.util import redirect
 from pylons.i18n.translation import _
 from webob.exc import HTTPForbidden, HTTPNotFound, HTTPBadRequest
 
 import rhodecode
 from rhodecode.lib import auth, helpers as h
 from rhodecode.lib.auth import (
     LoginRequired, HasPermissionAllDecorator,
     HasRepoPermissionAllDecorator, NotAnonymous, HasPermissionAny,
     HasRepoGroupPermissionAny, HasRepoPermissionAnyDecorator)
 from rhodecode.lib.base import BaseRepoController, render
 from rhodecode.lib.ext_json import json
 from rhodecode.lib.exceptions import AttachedForksError
 from rhodecode.lib.utils import action_logger, repo_name_slug, jsonify
 from rhodecode.lib.utils2 import safe_int, str2bool
 from rhodecode.lib.vcs import RepositoryError
 from rhodecode.model.db import (
     User, Repository, UserFollowing, RepoGroup, RepositoryField)
 from rhodecode.model.forms import (
     RepoForm, RepoFieldForm, RepoPermsForm, RepoVcsSettingsForm,
     IssueTrackerPatternsForm)
 from rhodecode.model.meta import Session
 from rhodecode.model.repo import RepoModel
 from rhodecode.model.scm import ScmModel, RepoGroupList, RepoList
 from rhodecode.model.settings import (
     SettingsModel, IssueTrackerSettingsModel, VcsSettingsModel,
     SettingNotFound)
 
 log = logging.getLogger(__name__)
 
 
 class ReposController(BaseRepoController):
     """
     REST Controller styled on the Atom Publishing Protocol"""
     # To properly map this controller, ensure your config/routing.py
     # file has a resource setup:
     #     map.resource('repo', 'repos')
 
     @LoginRequired()
     def __before__(self):
         super(ReposController, self).__before__()
 
     def _load_repo(self, repo_name):
         repo_obj = Repository.get_by_repo_name(repo_name)
 
         if repo_obj is None:
             h.not_mapped_error(repo_name)
             return redirect(url('repos'))
 
         return repo_obj
 
     def __load_defaults(self, repo=None):
         acl_groups = RepoGroupList(RepoGroup.query().all(),
                                perm_set=['group.write', 'group.admin'])
         c.repo_groups = RepoGroup.groups_choices(groups=acl_groups)
         c.repo_groups_choices = map(lambda k: unicode(k[0]), c.repo_groups)
 
         # in case someone no longer have a group.write access to a repository
         # pre fill the list with this entry, we don't care if this is the same
         # but it will allow saving repo data properly.
 
         repo_group = None
         if repo:
             repo_group = repo.group
         if repo_group and unicode(repo_group.group_id) not in c.repo_groups_choices:
             c.repo_groups_choices.append(unicode(repo_group.group_id))
             c.repo_groups.append(RepoGroup._generate_choice(repo_group))
 
         choices, c.landing_revs = ScmModel().get_repo_landing_revs()
         c.landing_revs_choices = choices
 
     def __load_data(self, repo_name=None):
         """
         Load defaults settings for edit, and update
 
         :param repo_name:
         """
         c.repo_info = self._load_repo(repo_name)
         self.__load_defaults(c.repo_info)
 
         # override defaults for exact repo info here git/hg etc
         if not c.repository_requirements_missing:
             choices, c.landing_revs = ScmModel().get_repo_landing_revs(
                 c.repo_info)
             c.landing_revs_choices = choices
         defaults = RepoModel()._get_defaults(repo_name)
 
         return defaults
 
     def _log_creation_exception(self, e, repo_name):
             reason = None
             if len(e.args) == 2:
                 reason = e.args[1]
 
             if reason == 'INVALID_CERTIFICATE':
                 log.exception(
                     'Exception creating a repository: invalid certificate')
                 msg = (_('Error creating repository %s: invalid certificate')
                        % repo_name)
             else:
                 log.exception("Exception creating a repository")
                 msg = (_('Error creating repository %s')
                        % repo_name)
 
             return msg
 
     @NotAnonymous()
     def index(self, format='html'):
         """GET /repos: All items in the collection"""
         # url('repos')
 
         repo_list = Repository.get_all_repos()
         c.repo_list = RepoList(repo_list, perm_set=['repository.admin'])
         repos_data = RepoModel().get_repos_as_dict(
             repo_list=c.repo_list, admin=True, super_user_actions=True)
         # json used to render the grid
         c.data = json.dumps(repos_data)
 
         return render('admin/repos/repos.mako')
 
     # perms check inside
     @NotAnonymous()
     @auth.CSRFRequired()
     def create(self):
         """
         POST /repos: Create a new item"""
         # url('repos')
 
         self.__load_defaults()
         form_result = {}
         task_id = None
         c.personal_repo_group = c.rhodecode_user.personal_repo_group
         try:
             # CanWriteToGroup validators checks permissions of this POST
             form_result = RepoForm(repo_groups=c.repo_groups_choices,
                                    landing_revs=c.landing_revs_choices)()\
                             .to_python(dict(request.POST))
 
             # create is done sometimes async on celery, db transaction
             # management is handled there.
             task = RepoModel().create(form_result, c.rhodecode_user.user_id)
             from celery.result import BaseAsyncResult
             if isinstance(task, BaseAsyncResult):
                 task_id = task.task_id
         except formencode.Invalid as errors:
             return htmlfill.render(
                 render('admin/repos/repo_add.mako'),
                 defaults=errors.value,
                 errors=errors.error_dict or {},
                 prefix_error=False,
                 encoding="UTF-8",
                 force_defaults=False)
 
         except Exception as e:
             msg = self._log_creation_exception(e, form_result.get('repo_name'))
             h.flash(msg, category='error')
             return redirect(url('home'))
 
         return redirect(h.url('repo_creating_home',
                               repo_name=form_result['repo_name_full'],
                               task_id=task_id))
 
     # perms check inside
     @NotAnonymous()
     def create_repository(self):
         """GET /_admin/create_repository: Form to create a new item"""
         new_repo = request.GET.get('repo', '')
         parent_group = safe_int(request.GET.get('parent_group'))
         _gr = RepoGroup.get(parent_group)
 
         if not HasPermissionAny('hg.admin', 'hg.create.repository')():
             # you're not super admin nor have global create permissions,
             # but maybe you have at least write permission to a parent group ?
 
             gr_name = _gr.group_name if _gr else None
             # create repositories with write permission on group is set to true
             create_on_write = HasPermissionAny('hg.create.write_on_repogroup.true')()
             group_admin = HasRepoGroupPermissionAny('group.admin')(group_name=gr_name)
             group_write = HasRepoGroupPermissionAny('group.write')(group_name=gr_name)
             if not (group_admin or (group_write and create_on_write)):
                 raise HTTPForbidden
 
         acl_groups = RepoGroupList(RepoGroup.query().all(),
                                perm_set=['group.write', 'group.admin'])
         c.repo_groups = RepoGroup.groups_choices(groups=acl_groups)
         c.repo_groups_choices = map(lambda k: unicode(k[0]), c.repo_groups)
         choices, c.landing_revs = ScmModel().get_repo_landing_revs()
         c.personal_repo_group = c.rhodecode_user.personal_repo_group
         c.new_repo = repo_name_slug(new_repo)
 
         # apply the defaults from defaults page
         defaults = SettingsModel().get_default_repo_settings(strip_prefix=True)
         # set checkbox to autochecked
         defaults['repo_copy_permissions'] = True
 
         parent_group_choice = '-1'
         if not c.rhodecode_user.is_admin and c.rhodecode_user.personal_repo_group:
             parent_group_choice = c.rhodecode_user.personal_repo_group
 
         if parent_group and _gr:
             if parent_group in [x[0] for x in c.repo_groups]:
                 parent_group_choice = unicode(parent_group)
 
         defaults.update({'repo_group': parent_group_choice})
 
         return htmlfill.render(
             render('admin/repos/repo_add.mako'),
             defaults=defaults,
             errors={},
             prefix_error=False,
             encoding="UTF-8",
             force_defaults=False
         )
 
     @NotAnonymous()
     def repo_creating(self, repo_name):
         c.repo = repo_name
         c.task_id = request.GET.get('task_id')
         if not c.repo:
             raise HTTPNotFound()
         return render('admin/repos/repo_creating.mako')
 
     @NotAnonymous()
     @jsonify
     def repo_check(self, repo_name):
         c.repo = repo_name
         task_id = request.GET.get('task_id')
 
         if task_id and task_id not in ['None']:
             import rhodecode
             from celery.result import AsyncResult
             if rhodecode.CELERY_ENABLED:
                 task = AsyncResult(task_id)
                 if task.failed():
                     msg = self._log_creation_exception(task.result, c.repo)
                     h.flash(msg, category='error')
                     return redirect(url('home'), code=501)
 
         repo = Repository.get_by_repo_name(repo_name)
         if repo and repo.repo_state == Repository.STATE_CREATED:
             if repo.clone_uri:
                 clone_uri = repo.clone_uri_hidden
                 h.flash(_('Created repository %s from %s')
                         % (repo.repo_name, clone_uri), category='success')
             else:
                 repo_url = h.link_to(repo.repo_name,
                                      h.url('summary_home',
                                            repo_name=repo.repo_name))
                 fork = repo.fork
                 if fork:
                     fork_name = fork.repo_name
                     h.flash(h.literal(_('Forked repository %s as %s')
                             % (fork_name, repo_url)), category='success')
                 else:
                     h.flash(h.literal(_('Created repository %s') % repo_url),
                             category='success')
             return {'result': True}
         return {'result': False}
 
     @HasRepoPermissionAllDecorator('repository.admin')
     @auth.CSRFRequired()
     def delete(self, repo_name):
         """
         DELETE /repos/repo_name: Delete an existing item"""
         # Forms posted to this method should contain a hidden field:
         #    <input type="hidden" name="_method" value="DELETE" />
         # Or using helpers:
         #    h.form(url('repo', repo_name=ID),
         #           method='delete')
         # url('repo', repo_name=ID)
 
         repo_model = RepoModel()
         repo = repo_model.get_by_repo_name(repo_name)
         if not repo:
             h.not_mapped_error(repo_name)
             return redirect(url('repos'))
         try:
             _forks = repo.forks.count()
             handle_forks = None
             if _forks and request.POST.get('forks'):
                 do = request.POST['forks']
                 if do == 'detach_forks':
                     handle_forks = 'detach'
                     h.flash(_('Detached %s forks') % _forks, category='success')
                 elif do == 'delete_forks':
                     handle_forks = 'delete'
                     h.flash(_('Deleted %s forks') % _forks, category='success')
             repo_model.delete(repo, forks=handle_forks)
             action_logger(c.rhodecode_user, 'admin_deleted_repo',
                   repo_name, self.ip_addr, self.sa)
             ScmModel().mark_for_invalidation(repo_name)
             h.flash(_('Deleted repository %s') % repo_name, category='success')
             Session().commit()
         except AttachedForksError:
             h.flash(_('Cannot delete %s it still contains attached forks')
                         % repo_name, category='warning')
 
         except Exception:
             log.exception("Exception during deletion of repository")
             h.flash(_('An error occurred during deletion of %s') % repo_name,
                     category='error')
 
         return redirect(url('repos'))
 
     @HasPermissionAllDecorator('hg.admin')
     def show(self, repo_name, format='html'):
         """GET /repos/repo_name: Show a specific item"""
         # url('repo', repo_name=ID)
 
     @HasRepoPermissionAllDecorator('repository.admin')
-    def edit_permissions(self, repo_name):
-        """GET /repo_name/settings: Form to edit an existing item"""
-        c.repo_info = self._load_repo(repo_name)
-        c.active = 'permissions'
-        defaults = RepoModel()._get_defaults(repo_name)
-
-        return htmlfill.render(
-            render('admin/repos/repo_edit.mako'),
-            defaults=defaults,
-            encoding="UTF-8",
-            force_defaults=False)
-
-    @HasRepoPermissionAllDecorator('repository.admin')
-    @auth.CSRFRequired()
-    def edit_permissions_update(self, repo_name):
-        form = RepoPermsForm()().to_python(request.POST)
-        RepoModel().update_permissions(repo_name,
-            form['perm_additions'], form['perm_updates'], form['perm_deletions'])
-
-        #TODO: implement this
-        #action_logger(c.rhodecode_user, 'admin_changed_repo_permissions',
-        #              repo_name, self.ip_addr, self.sa)
-        Session().commit()
-        h.flash(_('Repository permissions updated'), category='success')
-        return redirect(url('edit_repo_perms', repo_name=repo_name))
-
-    @HasRepoPermissionAllDecorator('repository.admin')
     def edit_fields(self, repo_name):
         """GET /repo_name/settings: Form to edit an existing item"""
         c.repo_info = self._load_repo(repo_name)
         c.repo_fields = RepositoryField.query()\
             .filter(RepositoryField.repository == c.repo_info).all()
         c.active = 'fields'
         if request.POST:
 
             return redirect(url('repo_edit_fields'))
         return render('admin/repos/repo_edit.mako')
 
     @HasRepoPermissionAllDecorator('repository.admin')
     @auth.CSRFRequired()
     def create_repo_field(self, repo_name):
         try:
             form_result = RepoFieldForm()().to_python(dict(request.POST))
             RepoModel().add_repo_field(
                 repo_name, form_result['new_field_key'],
                 field_type=form_result['new_field_type'],
                 field_value=form_result['new_field_value'],
                 field_label=form_result['new_field_label'],
                 field_desc=form_result['new_field_desc'])
 
             Session().commit()
         except Exception as e:
             log.exception("Exception creating field")
             msg = _('An error occurred during creation of field')
             if isinstance(e, formencode.Invalid):
                 msg += ". " + e.msg
             h.flash(msg, category='error')
         return redirect(url('edit_repo_fields', repo_name=repo_name))
 
     @HasRepoPermissionAllDecorator('repository.admin')
     @auth.CSRFRequired()
     def delete_repo_field(self, repo_name, field_id):
         field = RepositoryField.get_or_404(field_id)
         try:
             RepoModel().delete_repo_field(repo_name, field.field_key)
             Session().commit()
         except Exception as e:
             log.exception("Exception during removal of field")
             msg = _('An error occurred during removal of field')
             h.flash(msg, category='error')
         return redirect(url('edit_repo_fields', repo_name=repo_name))
 
     @HasRepoPermissionAllDecorator('repository.admin')
     def edit_advanced(self, repo_name):
         """GET /repo_name/settings: Form to edit an existing item"""
         c.repo_info = self._load_repo(repo_name)
         c.default_user_id = User.get_default_user().user_id
         c.in_public_journal = UserFollowing.query()\
             .filter(UserFollowing.user_id == c.default_user_id)\
             .filter(UserFollowing.follows_repository == c.repo_info).scalar()
 
         c.active = 'advanced'
         c.has_origin_repo_read_perm = False
         if c.repo_info.fork:
             c.has_origin_repo_read_perm = h.HasRepoPermissionAny(
                 'repository.write', 'repository.read', 'repository.admin')(
                 c.repo_info.fork.repo_name, 'repo set as fork page')
 
         if request.POST:
             return redirect(url('repo_edit_advanced'))
         return render('admin/repos/repo_edit.mako')
 
     @HasRepoPermissionAllDecorator('repository.admin')
     @auth.CSRFRequired()
     def edit_advanced_journal(self, repo_name):
         """
         Set's this repository to be visible in public journal,
         in other words assing default user to follow this repo
 
         :param repo_name:
         """
 
         try:
             repo_id = Repository.get_by_repo_name(repo_name).repo_id
             user_id = User.get_default_user().user_id
             self.scm_model.toggle_following_repo(repo_id, user_id)
             h.flash(_('Updated repository visibility in public journal'),
                     category='success')
             Session().commit()
         except Exception:
             h.flash(_('An error occurred during setting this'
                       ' repository in public journal'),
                     category='error')
 
         return redirect(url('edit_repo_advanced', repo_name=repo_name))
 
     @HasRepoPermissionAllDecorator('repository.admin')
     @auth.CSRFRequired()
     def edit_advanced_fork(self, repo_name):
         """
         Mark given repository as a fork of another
 
         :param repo_name:
         """
 
         new_fork_id = request.POST.get('id_fork_of')
         try:
 
             if new_fork_id and not new_fork_id.isdigit():
                 log.error('Given fork id %s is not an INT', new_fork_id)
 
             fork_id = safe_int(new_fork_id)
             repo = ScmModel().mark_as_fork(repo_name, fork_id,
                                            c.rhodecode_user.username)
             fork = repo.fork.repo_name if repo.fork else _('Nothing')
             Session().commit()
             h.flash(_('Marked repo %s as fork of %s') % (repo_name, fork),
                     category='success')
         except RepositoryError as e:
             log.exception("Repository Error occurred")
             h.flash(str(e), category='error')
         except Exception as e:
             log.exception("Exception while editing fork")
             h.flash(_('An error occurred during this operation'),
                     category='error')
 
         return redirect(url('edit_repo_advanced', repo_name=repo_name))
 
     @HasRepoPermissionAllDecorator('repository.admin')
     @auth.CSRFRequired()
     def edit_advanced_locking(self, repo_name):
         """
         Unlock repository when it is locked !
 
         :param repo_name:
         """
         try:
             repo = Repository.get_by_repo_name(repo_name)
             if request.POST.get('set_lock'):
                 Repository.lock(repo, c.rhodecode_user.user_id,
                                 lock_reason=Repository.LOCK_WEB)
                 h.flash(_('Locked repository'), category='success')
             elif request.POST.get('set_unlock'):
                 Repository.unlock(repo)
                 h.flash(_('Unlocked repository'), category='success')
         except Exception as e:
             log.exception("Exception during unlocking")
             h.flash(_('An error occurred during unlocking'),
                     category='error')
         return redirect(url('edit_repo_advanced', repo_name=repo_name))
 
     @HasRepoPermissionAnyDecorator('repository.write', 'repository.admin')
     @auth.CSRFRequired()
     def toggle_locking(self, repo_name):
         """
         Toggle locking of repository by simple GET call to url
 
         :param repo_name:
         """
 
         try:
             repo = Repository.get_by_repo_name(repo_name)
 
             if repo.enable_locking:
                 if repo.locked[0]:
                     Repository.unlock(repo)
                     action = _('Unlocked')
                 else:
                     Repository.lock(repo, c.rhodecode_user.user_id,
                                     lock_reason=Repository.LOCK_WEB)
                     action = _('Locked')
 
                 h.flash(_('Repository has been %s') % action,
                         category='success')
         except Exception:
             log.exception("Exception during unlocking")
             h.flash(_('An error occurred during unlocking'),
                     category='error')
         return redirect(url('summary_home', repo_name=repo_name))
 
     @HasRepoPermissionAllDecorator('repository.admin')
     @auth.CSRFRequired()
     def edit_remote(self, repo_name):
         """PUT /{repo_name}/settings/remote: edit the repo remote."""
         try:
             ScmModel().pull_changes(repo_name, c.rhodecode_user.username)
             h.flash(_('Pulled from remote location'), category='success')
         except Exception:
             log.exception("Exception during pull from remote")
             h.flash(_('An error occurred during pull from remote location'),
                     category='error')
         return redirect(url('edit_repo_remote', repo_name=c.repo_name))
 
     @HasRepoPermissionAllDecorator('repository.admin')
     def edit_remote_form(self, repo_name):
         """GET /repo_name/settings: Form to edit an existing item"""
         c.repo_info = self._load_repo(repo_name)
         c.active = 'remote'
 
         return render('admin/repos/repo_edit.mako')
 
     @HasRepoPermissionAllDecorator('repository.admin')
     @auth.CSRFRequired()
     def edit_statistics(self, repo_name):
         """PUT /{repo_name}/settings/statistics: reset the repo statistics."""
         try:
             RepoModel().delete_stats(repo_name)
             Session().commit()
         except Exception as e:
             log.error(traceback.format_exc())
             h.flash(_('An error occurred during deletion of repository stats'),
                     category='error')
         return redirect(url('edit_repo_statistics', repo_name=c.repo_name))
 
     @HasRepoPermissionAllDecorator('repository.admin')
     def edit_statistics_form(self, repo_name):
         """GET /repo_name/settings: Form to edit an existing item"""
         c.repo_info = self._load_repo(repo_name)
         repo = c.repo_info.scm_instance()
 
         if c.repo_info.stats:
             # this is on what revision we ended up so we add +1 for count
             last_rev = c.repo_info.stats.stat_on_revision + 1
         else:
             last_rev = 0
         c.stats_revision = last_rev
 
         c.repo_last_rev = repo.count()
 
         if last_rev == 0 or c.repo_last_rev == 0:
             c.stats_percentage = 0
         else:
             c.stats_percentage = '%.2f' % ((float((last_rev)) / c.repo_last_rev) * 100)
 
         c.active = 'statistics'
 
         return render('admin/repos/repo_edit.mako')
 
     @HasRepoPermissionAllDecorator('repository.admin')
     @auth.CSRFRequired()
     def repo_issuetracker_test(self, repo_name):
         if request.is_xhr:
             return h.urlify_commit_message(
                 request.POST.get('test_text', ''),
                 repo_name)
         else:
             raise HTTPBadRequest()
 
     @HasRepoPermissionAllDecorator('repository.admin')
     @auth.CSRFRequired()
     def repo_issuetracker_delete(self, repo_name):
         uid = request.POST.get('uid')
         repo_settings = IssueTrackerSettingsModel(repo=repo_name)
         try:
             repo_settings.delete_entries(uid)
         except Exception:
             h.flash(_('Error occurred during deleting issue tracker entry'),
                     category='error')
         else:
             h.flash(_('Removed issue tracker entry'), category='success')
         return redirect(url('repo_settings_issuetracker',
                         repo_name=repo_name))
 
     def _update_patterns(self, form, repo_settings):
         for uid in form['delete_patterns']:
             repo_settings.delete_entries(uid)
 
         for pattern in form['patterns']:
             for setting, value, type_ in pattern:
                 sett = repo_settings.create_or_update_setting(
                     setting, value, type_)
                 Session().add(sett)
 
             Session().commit()
 
     @HasRepoPermissionAllDecorator('repository.admin')
     @auth.CSRFRequired()
     def repo_issuetracker_save(self, repo_name):
         # Save inheritance
         repo_settings = IssueTrackerSettingsModel(repo=repo_name)
         inherited = (request.POST.get('inherit_global_issuetracker')
                      == "inherited")
         repo_settings.inherit_global_settings = inherited
         Session().commit()
 
         form = IssueTrackerPatternsForm()().to_python(request.POST)
         if form:
             self._update_patterns(form, repo_settings)
 
         h.flash(_('Updated issue tracker entries'), category='success')
         return redirect(url('repo_settings_issuetracker',
                         repo_name=repo_name))
 
     @HasRepoPermissionAllDecorator('repository.admin')
     def repo_issuetracker(self, repo_name):
         """GET /admin/settings/issue-tracker: All items in the collection"""
         c.active = 'issuetracker'
         c.data = 'data'
         c.repo_info = self._load_repo(repo_name)
 
         repo = Repository.get_by_repo_name(repo_name)
         c.settings_model = IssueTrackerSettingsModel(repo=repo)
         c.global_patterns = c.settings_model.get_global_settings()
         c.repo_patterns = c.settings_model.get_repo_settings()
 
         return render('admin/repos/repo_edit.mako')
 
     @HasRepoPermissionAllDecorator('repository.admin')
     def repo_settings_vcs(self, repo_name):
         """GET /{repo_name}/settings/vcs/: All items in the collection"""
 
         model = VcsSettingsModel(repo=repo_name)
 
         c.active = 'vcs'
         c.global_svn_branch_patterns = model.get_global_svn_branch_patterns()
         c.global_svn_tag_patterns = model.get_global_svn_tag_patterns()
         c.svn_branch_patterns = model.get_repo_svn_branch_patterns()
         c.svn_tag_patterns = model.get_repo_svn_tag_patterns()
         c.repo_info = self._load_repo(repo_name)
         defaults = self._vcs_form_defaults(repo_name)
         c.inherit_global_settings = defaults['inherit_global_settings']
         c.labs_active = str2bool(
             rhodecode.CONFIG.get('labs_settings_active', 'true'))
 
         return htmlfill.render(
             render('admin/repos/repo_edit.mako'),
             defaults=defaults,
             encoding="UTF-8",
             force_defaults=False)
 
     @HasRepoPermissionAllDecorator('repository.admin')
     @auth.CSRFRequired()
     def repo_settings_vcs_update(self, repo_name):
         """POST /{repo_name}/settings/vcs/: All items in the collection"""
         c.active = 'vcs'
 
         model = VcsSettingsModel(repo=repo_name)
         c.global_svn_branch_patterns = model.get_global_svn_branch_patterns()
         c.global_svn_tag_patterns = model.get_global_svn_tag_patterns()
         c.svn_branch_patterns = model.get_repo_svn_branch_patterns()
         c.svn_tag_patterns = model.get_repo_svn_tag_patterns()
         c.repo_info = self._load_repo(repo_name)
         defaults = self._vcs_form_defaults(repo_name)
         c.inherit_global_settings = defaults['inherit_global_settings']
 
         application_form = RepoVcsSettingsForm(repo_name)()
         try:
             form_result = application_form.to_python(dict(request.POST))
         except formencode.Invalid as errors:
             h.flash(
                 _("Some form inputs contain invalid data."),
                 category='error')
             return htmlfill.render(
                 render('admin/repos/repo_edit.mako'),
                 defaults=errors.value,
                 errors=errors.error_dict or {},
                 prefix_error=False,
                 encoding="UTF-8",
                 force_defaults=False
             )
 
         try:
             inherit_global_settings = form_result['inherit_global_settings']
             model.create_or_update_repo_settings(
                 form_result, inherit_global_settings=inherit_global_settings)
         except Exception:
             log.exception("Exception while updating settings")
             h.flash(
                 _('Error occurred during updating repository VCS settings'),
                 category='error')
         else:
             Session().commit()
             h.flash(_('Updated VCS settings'), category='success')
             return redirect(url('repo_vcs_settings', repo_name=repo_name))
 
         return htmlfill.render(
             render('admin/repos/repo_edit.mako'),
             defaults=self._vcs_form_defaults(repo_name),
             encoding="UTF-8",
             force_defaults=False)
 
     @HasRepoPermissionAllDecorator('repository.admin')
     @auth.CSRFRequired()
     @jsonify
     def repo_delete_svn_pattern(self, repo_name):
         if not request.is_xhr:
             return False
 
         delete_pattern_id = request.POST.get('delete_svn_pattern')
         model = VcsSettingsModel(repo=repo_name)
         try:
             model.delete_repo_svn_pattern(delete_pattern_id)
         except SettingNotFound:
             raise HTTPBadRequest()
 
         Session().commit()
         return True
 
     def _vcs_form_defaults(self, repo_name):
         model = VcsSettingsModel(repo=repo_name)
         global_defaults = model.get_global_settings()
 
         repo_defaults = {}
         repo_defaults.update(global_defaults)
         repo_defaults.update(model.get_repo_settings())
 
         global_defaults = {
             '{}_inherited'.format(k): global_defaults[k]
             for k in global_defaults}
 
         defaults = {
             'inherit_global_settings': model.inherit_global_settings
         }
         defaults.update(global_defaults)
         defaults.update(repo_defaults)
         defaults.update({
             'new_svn_branch': '',
             'new_svn_tag': '',
         })
         return defaults

rhodecode/lib/audit_logger.py

@@ -1,147 +1,148 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2017-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import logging
 import datetime
 
 from rhodecode.model import meta
 from rhodecode.model.db import User, UserLog
 
 
 log = logging.getLogger(__name__)
 
 
 ACTIONS = {
     'user.login.success': {},
     'user.login.failure': {},
     'user.logout': {},
     'user.password.reset_request': {},
 
     'repo.add': {},
     'repo.edit': {},
+    'repo.edit.permissions': {},
     'repo.commit.strip': {}
 }
 
 
 class UserWrap(object):
     """
     Fake object used to imitate AuthUser
     """
 
     def __init__(self, user_id=None, username=None, ip_addr=None):
         self.user_id = user_id
         self.username = username
         self.ip_addr = ip_addr
 
 
 def _store_log(action_name, action_data, user_id, username, user_data,
                ip_address, repository_id, repository_name):
     user_log = UserLog()
     user_log.version = UserLog.VERSION_2
 
     user_log.action = action_name
     user_log.action_data = action_data
 
     user_log.user_ip = ip_address
 
     user_log.user_id = user_id
     user_log.username = username
     user_log.user_data = user_data
 
     user_log.repository_id = repository_id
     user_log.repository_name = repository_name
 
     user_log.action_date = datetime.datetime.now()
 
     log.info('AUDIT: Logging action: `%s` by user:id:%s[%s] ip:%s',
              action_name, user_id, username, ip_address)
 
     return user_log
 
 
 def store(
         action, user, action_data=None, user_data=None, ip_addr=None,
         repo=None, sa_session=None, commit=False):
     """
     Audit logger for various actions made by users, typically this results in a call such::
 
         from rhodecode.lib import audit_logger
 
         audit_logger.store(action='repo.edit', user=self._rhodecode_user)
         audit_logger.store(action='repo.delete', user=audit_logger.UserWrap(username='itried-to-login', ip_addr='8.8.8.8'))
 
         # without an user ?
         audit_user = audit_logger.UserWrap(
             username=self.request.params.get('username'),
             ip_addr=self.request.remote_addr)
         audit_logger.store(action='user.login.failure', user=audit_user)
     """
     from rhodecode.lib.utils2 import safe_unicode
     from rhodecode.lib.auth import AuthUser
 
     if action not in ACTIONS:
         raise ValueError('Action `{}` not in valid actions'.format(action))
 
     if not sa_session:
         sa_session = meta.Session()
 
     try:
         username = getattr(user, 'username', None)
         if not username:
             pass
 
         user_id = getattr(user, 'user_id', None)
         if not user_id:
             # maybe we have username ? Try to figure user_id from username
             if username:
                 user_id = getattr(
                     User.get_by_username(username), 'user_id', None)
 
         ip_addr = ip_addr or getattr(user, 'ip_addr', None)
         if not ip_addr:
             pass
 
         if not user_data:
             # try to get this from the auth user
             if isinstance(user, AuthUser):
                 user_data = {
                     'username': user.username,
                     'email': user.email,
                 }
 
         repository_id = getattr(repo, 'repo_id', None)
         repository_name = getattr(repo, 'repo_name', None)
 
         user_log = _store_log(
             action_name=safe_unicode(action),
             action_data=action_data or {},
             user_id=user_id,
             username=username,
             user_data=user_data or {},
             ip_address=safe_unicode(ip_addr),
             repository_id=repository_id,
             repository_name=repository_name
         )
         sa_session.add(user_log)
         if commit:
             sa_session.commit()
 
     except Exception:
         log.exception('AUDIT: failed to store audit log')

rhodecode/model/repo.py

@@ -1,993 +1,999 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 Repository model for rhodecode
 """
 
 import logging
 import os
 import re
 import shutil
 import time
 import traceback
 from datetime import datetime, timedelta
 
 from zope.cachedescriptors.property import Lazy as LazyProperty
 
 from rhodecode import events
 from rhodecode.lib import helpers as h
 from rhodecode.lib.auth import HasUserGroupPermissionAny
 from rhodecode.lib.caching_query import FromCache
 from rhodecode.lib.exceptions import AttachedForksError
 from rhodecode.lib.hooks_base import log_delete_repository
 from rhodecode.lib.utils import make_db_config
 from rhodecode.lib.utils2 import (
     safe_str, safe_unicode, remove_prefix, obfuscate_url_pw,
     get_current_rhodecode_user, safe_int, datetime_to_time, action_logger_generic)
 from rhodecode.lib.vcs.backends import get_backend
 from rhodecode.model import BaseModel
 from rhodecode.model.db import (
     Repository, UserRepoToPerm, UserGroupRepoToPerm, UserRepoGroupToPerm,
     UserGroupRepoGroupToPerm, User, Permission, Statistics, UserGroup,
     RepoGroup, RepositoryField)
 
 from rhodecode.model.settings import VcsSettingsModel
 
 
 log = logging.getLogger(__name__)
 
 
 class RepoModel(BaseModel):
 
     cls = Repository
 
     def _get_user_group(self, users_group):
         return self._get_instance(UserGroup, users_group,
                                   callback=UserGroup.get_by_group_name)
 
     def _get_repo_group(self, repo_group):
         return self._get_instance(RepoGroup, repo_group,
                                   callback=RepoGroup.get_by_group_name)
 
     def _create_default_perms(self, repository, private):
         # create default permission
         default = 'repository.read'
         def_user = User.get_default_user()
         for p in def_user.user_perms:
             if p.permission.permission_name.startswith('repository.'):
                 default = p.permission.permission_name
                 break
 
         default_perm = 'repository.none' if private else default
 
         repo_to_perm = UserRepoToPerm()
         repo_to_perm.permission = Permission.get_by_key(default_perm)
 
         repo_to_perm.repository = repository
         repo_to_perm.user_id = def_user.user_id
 
         return repo_to_perm
 
     @LazyProperty
     def repos_path(self):
         """
         Gets the repositories root path from database
         """
         settings_model = VcsSettingsModel(sa=self.sa)
         return settings_model.get_repos_location()
 
     def get(self, repo_id, cache=False):
         repo = self.sa.query(Repository) \
             .filter(Repository.repo_id == repo_id)
 
         if cache:
             repo = repo.options(FromCache("sql_cache_short",
                                           "get_repo_%s" % repo_id))
         return repo.scalar()
 
     def get_repo(self, repository):
         return self._get_repo(repository)
 
     def get_by_repo_name(self, repo_name, cache=False):
         repo = self.sa.query(Repository) \
             .filter(Repository.repo_name == repo_name)
 
         if cache:
             repo = repo.options(FromCache("sql_cache_short",
                                           "get_repo_%s" % repo_name))
         return repo.scalar()
 
     def _extract_id_from_repo_name(self, repo_name):
         if repo_name.startswith('/'):
             repo_name = repo_name.lstrip('/')
         by_id_match = re.match(r'^_(\d{1,})', repo_name)
         if by_id_match:
             return by_id_match.groups()[0]
 
     def get_repo_by_id(self, repo_name):
         """
         Extracts repo_name by id from special urls.
         Example url is _11/repo_name
 
         :param repo_name:
         :return: repo object if matched else None
         """
         try:
             _repo_id = self._extract_id_from_repo_name(repo_name)
             if _repo_id:
                 return self.get(_repo_id)
         except Exception:
             log.exception('Failed to extract repo_name from URL')
 
         return None
 
     def get_repos_for_root(self, root, traverse=False):
         if traverse:
             like_expression = u'{}%'.format(safe_unicode(root))
             repos = Repository.query().filter(
                 Repository.repo_name.like(like_expression)).all()
         else:
             if root and not isinstance(root, RepoGroup):
                 raise ValueError(
                     'Root must be an instance '
                     'of RepoGroup, got:{} instead'.format(type(root)))
             repos = Repository.query().filter(Repository.group == root).all()
         return repos
 
     def get_url(self, repo):
         return h.url('summary_home', repo_name=safe_str(repo.repo_name),
             qualified=True)
 
     @classmethod
     def update_repoinfo(cls, repositories=None):
         if not repositories:
             repositories = Repository.getAll()
         for repo in repositories:
             repo.update_commit_cache()
 
     def get_repos_as_dict(self, repo_list=None, admin=False,
                           super_user_actions=False):
 
         from rhodecode.lib.utils import PartialRenderer
         _render = PartialRenderer('data_table/_dt_elements.mako')
         c = _render.c
 
         def quick_menu(repo_name):
             return _render('quick_menu', repo_name)
 
         def repo_lnk(name, rtype, rstate, private, fork_of):
             return _render('repo_name', name, rtype, rstate, private, fork_of,
                            short_name=not admin, admin=False)
 
         def last_change(last_change):
             if admin and isinstance(last_change, datetime) and not last_change.tzinfo:
                 last_change = last_change + timedelta(seconds=
                     (datetime.now() - datetime.utcnow()).seconds)
             return _render("last_change", last_change)
 
         def rss_lnk(repo_name):
             return _render("rss", repo_name)
 
         def atom_lnk(repo_name):
             return _render("atom", repo_name)
 
         def last_rev(repo_name, cs_cache):
             return _render('revision', repo_name, cs_cache.get('revision'),
                            cs_cache.get('raw_id'), cs_cache.get('author'),
                            cs_cache.get('message'))
 
         def desc(desc):
             if c.visual.stylify_metatags:
                 desc = h.urlify_text(h.escaped_stylize(desc))
             else:
                 desc = h.urlify_text(h.html_escape(desc))
 
             return _render('repo_desc', desc)
 
         def state(repo_state):
             return _render("repo_state", repo_state)
 
         def repo_actions(repo_name):
             return _render('repo_actions', repo_name, super_user_actions)
 
         def user_profile(username):
             return _render('user_profile', username)
 
         repos_data = []
         for repo in repo_list:
             cs_cache = repo.changeset_cache
             row = {
                 "menu": quick_menu(repo.repo_name),
 
                 "name": repo_lnk(repo.repo_name, repo.repo_type,
                                  repo.repo_state, repo.private, repo.fork),
                 "name_raw": repo.repo_name.lower(),
 
                 "last_change": last_change(repo.last_db_change),
                 "last_change_raw": datetime_to_time(repo.last_db_change),
 
                 "last_changeset": last_rev(repo.repo_name, cs_cache),
                 "last_changeset_raw": cs_cache.get('revision'),
 
                 "desc": desc(repo.description),
                 "owner": user_profile(repo.user.username),
 
                 "state": state(repo.repo_state),
                 "rss": rss_lnk(repo.repo_name),
 
                 "atom": atom_lnk(repo.repo_name),
             }
             if admin:
                 row.update({
                     "action": repo_actions(repo.repo_name),
                 })
             repos_data.append(row)
 
         return repos_data
 
     def _get_defaults(self, repo_name):
         """
         Gets information about repository, and returns a dict for
         usage in forms
 
         :param repo_name:
         """
 
         repo_info = Repository.get_by_repo_name(repo_name)
 
         if repo_info is None:
             return None
 
         defaults = repo_info.get_dict()
         defaults['repo_name'] = repo_info.just_name
 
-        groups  = repo_info.groups_with_parents
+        groups = repo_info.groups_with_parents
         parent_group = groups[-1] if groups else None
 
         # we use -1 as this is how in HTML, we mark an empty group
         defaults['repo_group'] = getattr(parent_group, 'group_id', -1)
 
         keys_to_process = (
             {'k': 'repo_type', 'strip': False},
             {'k': 'repo_enable_downloads', 'strip': True},
             {'k': 'repo_description', 'strip': True},
             {'k': 'repo_enable_locking', 'strip': True},
             {'k': 'repo_landing_rev', 'strip': True},
             {'k': 'clone_uri', 'strip': False},
             {'k': 'repo_private', 'strip': True},
             {'k': 'repo_enable_statistics', 'strip': True}
         )
 
         for item in keys_to_process:
             attr = item['k']
             if item['strip']:
                 attr = remove_prefix(item['k'], 'repo_')
 
             val = defaults[attr]
             if item['k'] == 'repo_landing_rev':
                 val = ':'.join(defaults[attr])
             defaults[item['k']] = val
             if item['k'] == 'clone_uri':
                 defaults['clone_uri_hidden'] = repo_info.clone_uri_hidden
 
         # fill owner
         if repo_info.user:
             defaults.update({'user': repo_info.user.username})
         else:
             replacement_user = User.get_first_super_admin().username
             defaults.update({'user': replacement_user})
 
-        # fill repository users
-        for p in repo_info.repo_to_perm:
-            defaults.update({'u_perm_%s' % p.user.user_id:
-                            p.permission.permission_name})
-
-        # fill repository groups
-        for p in repo_info.users_group_to_perm:
-            defaults.update({'g_perm_%s' % p.users_group.users_group_id:
-                            p.permission.permission_name})
-
         return defaults
 
     def update(self, repo, **kwargs):
         try:
             cur_repo = self._get_repo(repo)
             source_repo_name = cur_repo.repo_name
             if 'user' in kwargs:
                 cur_repo.user = User.get_by_username(kwargs['user'])
 
             if 'repo_group' in kwargs:
                 cur_repo.group = RepoGroup.get(kwargs['repo_group'])
             log.debug('Updating repo %s with params:%s', cur_repo, kwargs)
 
             update_keys = [
                 (1, 'repo_description'),
                 (1, 'repo_landing_rev'),
                 (1, 'repo_private'),
                 (1, 'repo_enable_downloads'),
                 (1, 'repo_enable_locking'),
                 (1, 'repo_enable_statistics'),
                 (0, 'clone_uri'),
                 (0, 'fork_id')
             ]
             for strip, k in update_keys:
                 if k in kwargs:
                     val = kwargs[k]
                     if strip:
                         k = remove_prefix(k, 'repo_')
 
                     setattr(cur_repo, k, val)
 
             new_name = cur_repo.get_new_name(kwargs['repo_name'])
             cur_repo.repo_name = new_name
 
             # if private flag is set, reset default permission to NONE
             if kwargs.get('repo_private'):
                 EMPTY_PERM = 'repository.none'
                 RepoModel().grant_user_permission(
                     repo=cur_repo, user=User.DEFAULT_USER, perm=EMPTY_PERM
                 )
 
             # handle extra fields
             for field in filter(lambda k: k.startswith(RepositoryField.PREFIX),
                                 kwargs):
                 k = RepositoryField.un_prefix_key(field)
                 ex_field = RepositoryField.get_by_key_name(
                     key=k, repo=cur_repo)
                 if ex_field:
                     ex_field.field_value = kwargs[field]
                     self.sa.add(ex_field)
             self.sa.add(cur_repo)
 
             if source_repo_name != new_name:
                 # rename repository
                 self._rename_filesystem_repo(
                     old=source_repo_name, new=new_name)
 
             return cur_repo
         except Exception:
             log.error(traceback.format_exc())
             raise
 
     def _create_repo(self, repo_name, repo_type, description, owner,
                      private=False, clone_uri=None, repo_group=None,
                      landing_rev='rev:tip', fork_of=None,
                      copy_fork_permissions=False, enable_statistics=False,
                      enable_locking=False, enable_downloads=False,
                      copy_group_permissions=False,
                      state=Repository.STATE_PENDING):
         """
         Create repository inside database with PENDING state, this should be
         only executed by create() repo. With exception of importing existing
         repos
         """
         from rhodecode.model.scm import ScmModel
 
         owner = self._get_user(owner)
         fork_of = self._get_repo(fork_of)
         repo_group = self._get_repo_group(safe_int(repo_group))
 
         try:
             repo_name = safe_unicode(repo_name)
             description = safe_unicode(description)
             # repo name is just a name of repository
             # while repo_name_full is a full qualified name that is combined
             # with name and path of group
             repo_name_full = repo_name
             repo_name = repo_name.split(Repository.NAME_SEP)[-1]
 
             new_repo = Repository()
             new_repo.repo_state = state
             new_repo.enable_statistics = False
             new_repo.repo_name = repo_name_full
             new_repo.repo_type = repo_type
             new_repo.user = owner
             new_repo.group = repo_group
             new_repo.description = description or repo_name
             new_repo.private = private
             new_repo.clone_uri = clone_uri
             new_repo.landing_rev = landing_rev
 
             new_repo.enable_statistics = enable_statistics
             new_repo.enable_locking = enable_locking
             new_repo.enable_downloads = enable_downloads
 
             if repo_group:
                 new_repo.enable_locking = repo_group.enable_locking
 
             if fork_of:
                 parent_repo = fork_of
                 new_repo.fork = parent_repo
 
             events.trigger(events.RepoPreCreateEvent(new_repo))
 
             self.sa.add(new_repo)
 
             EMPTY_PERM = 'repository.none'
             if fork_of and copy_fork_permissions:
                 repo = fork_of
                 user_perms = UserRepoToPerm.query() \
                     .filter(UserRepoToPerm.repository == repo).all()
                 group_perms = UserGroupRepoToPerm.query() \
                     .filter(UserGroupRepoToPerm.repository == repo).all()
 
                 for perm in user_perms:
                     UserRepoToPerm.create(
                         perm.user, new_repo, perm.permission)
 
                 for perm in group_perms:
                     UserGroupRepoToPerm.create(
                         perm.users_group, new_repo, perm.permission)
                 # in case we copy permissions and also set this repo to private
                 # override the default user permission to make it a private
                 # repo
                 if private:
                     RepoModel(self.sa).grant_user_permission(
                         repo=new_repo, user=User.DEFAULT_USER, perm=EMPTY_PERM)
 
             elif repo_group and copy_group_permissions:
                 user_perms = UserRepoGroupToPerm.query() \
                     .filter(UserRepoGroupToPerm.group == repo_group).all()
 
                 group_perms = UserGroupRepoGroupToPerm.query() \
                     .filter(UserGroupRepoGroupToPerm.group == repo_group).all()
 
                 for perm in user_perms:
                     perm_name = perm.permission.permission_name.replace(
                         'group.', 'repository.')
                     perm_obj = Permission.get_by_key(perm_name)
                     UserRepoToPerm.create(perm.user, new_repo, perm_obj)
 
                 for perm in group_perms:
                     perm_name = perm.permission.permission_name.replace(
                         'group.', 'repository.')
                     perm_obj = Permission.get_by_key(perm_name)
                     UserGroupRepoToPerm.create(
                         perm.users_group, new_repo, perm_obj)
 
                 if private:
                     RepoModel(self.sa).grant_user_permission(
                         repo=new_repo, user=User.DEFAULT_USER, perm=EMPTY_PERM)
 
             else:
                 perm_obj = self._create_default_perms(new_repo, private)
                 self.sa.add(perm_obj)
 
             # now automatically start following this repository as owner
             ScmModel(self.sa).toggle_following_repo(new_repo.repo_id,
                                                     owner.user_id)
 
             # we need to flush here, in order to check if database won't
             # throw any exceptions, create filesystem dirs at the very end
             self.sa.flush()
             events.trigger(events.RepoCreateEvent(new_repo))
             return new_repo
 
         except Exception:
             log.error(traceback.format_exc())
             raise
 
     def create(self, form_data, cur_user):
         """
         Create repository using celery tasks
 
         :param form_data:
         :param cur_user:
         """
         from rhodecode.lib.celerylib import tasks, run_task
         return run_task(tasks.create_repo, form_data, cur_user)
 
     def update_permissions(self, repo, perm_additions=None, perm_updates=None,
                            perm_deletions=None, check_perms=True,
                            cur_user=None):
         if not perm_additions:
             perm_additions = []
         if not perm_updates:
             perm_updates = []
         if not perm_deletions:
             perm_deletions = []
 
         req_perms = ('usergroup.read', 'usergroup.write', 'usergroup.admin')
 
+        changes = {
+            'added': [],
+            'updated': [],
+            'deleted': []
+        }
         # update permissions
         for member_id, perm, member_type in perm_updates:
             member_id = int(member_id)
             if member_type == 'user':
+                member_name = User.get(member_id).username
                 # this updates also current one if found
                 self.grant_user_permission(
                     repo=repo, user=member_id, perm=perm)
             else:  # set for user group
                 # check if we have permissions to alter this usergroup
                 member_name = UserGroup.get(member_id).users_group_name
                 if not check_perms or HasUserGroupPermissionAny(
                         *req_perms)(member_name, user=cur_user):
                     self.grant_user_group_permission(
                         repo=repo, group_name=member_id, perm=perm)
 
+            changes['updated'].append({'type': member_type, 'id': member_id,
+                                       'name': member_name, 'new_perm': perm})
+
         # set new permissions
         for member_id, perm, member_type in perm_additions:
             member_id = int(member_id)
             if member_type == 'user':
+                member_name = User.get(member_id).username
                 self.grant_user_permission(
                     repo=repo, user=member_id, perm=perm)
             else:  # set for user group
                 # check if we have permissions to alter this usergroup
                 member_name = UserGroup.get(member_id).users_group_name
                 if not check_perms or HasUserGroupPermissionAny(
                         *req_perms)(member_name, user=cur_user):
                     self.grant_user_group_permission(
                         repo=repo, group_name=member_id, perm=perm)
-
+            changes['added'].append({'type': member_type, 'id': member_id,
+                                     'name': member_name, 'new_perm': perm})
         # delete permissions
         for member_id, perm, member_type in perm_deletions:
             member_id = int(member_id)
             if member_type == 'user':
+                member_name = User.get(member_id).username
                 self.revoke_user_permission(repo=repo, user=member_id)
             else:  # set for user group
                 # check if we have permissions to alter this usergroup
                 member_name = UserGroup.get(member_id).users_group_name
                 if not check_perms or HasUserGroupPermissionAny(
                         *req_perms)(member_name, user=cur_user):
                     self.revoke_user_group_permission(
                         repo=repo, group_name=member_id)
 
+            changes['deleted'].append({'type': member_type, 'id': member_id,
+                                       'name': member_name, 'new_perm': perm})
+        return changes
+
     def create_fork(self, form_data, cur_user):
         """
         Simple wrapper into executing celery task for fork creation
 
         :param form_data:
         :param cur_user:
         """
         from rhodecode.lib.celerylib import tasks, run_task
         return run_task(tasks.create_repo_fork, form_data, cur_user)
 
     def delete(self, repo, forks=None, fs_remove=True, cur_user=None):
         """
         Delete given repository, forks parameter defines what do do with
         attached forks. Throws AttachedForksError if deleted repo has attached
         forks
 
         :param repo:
         :param forks: str 'delete' or 'detach'
         :param fs_remove: remove(archive) repo from filesystem
         """
         if not cur_user:
             cur_user = getattr(get_current_rhodecode_user(), 'username', None)
         repo = self._get_repo(repo)
         if repo:
             if forks == 'detach':
                 for r in repo.forks:
                     r.fork = None
                     self.sa.add(r)
             elif forks == 'delete':
                 for r in repo.forks:
                     self.delete(r, forks='delete')
             elif [f for f in repo.forks]:
                 raise AttachedForksError()
 
             old_repo_dict = repo.get_dict()
             events.trigger(events.RepoPreDeleteEvent(repo))
             try:
                 self.sa.delete(repo)
                 if fs_remove:
                     self._delete_filesystem_repo(repo)
                 else:
                     log.debug('skipping removal from filesystem')
                 old_repo_dict.update({
                     'deleted_by': cur_user,
                     'deleted_on': time.time(),
                 })
                 log_delete_repository(**old_repo_dict)
                 events.trigger(events.RepoDeleteEvent(repo))
             except Exception:
                 log.error(traceback.format_exc())
                 raise
 
     def grant_user_permission(self, repo, user, perm):
         """
         Grant permission for user on given repository, or update existing one
         if found
 
         :param repo: Instance of Repository, repository_id, or repository name
         :param user: Instance of User, user_id or username
         :param perm: Instance of Permission, or permission_name
         """
         user = self._get_user(user)
         repo = self._get_repo(repo)
         permission = self._get_perm(perm)
 
         # check if we have that permission already
         obj = self.sa.query(UserRepoToPerm) \
             .filter(UserRepoToPerm.user == user) \
             .filter(UserRepoToPerm.repository == repo) \
             .scalar()
         if obj is None:
             # create new !
             obj = UserRepoToPerm()
         obj.repository = repo
         obj.user = user
         obj.permission = permission
         self.sa.add(obj)
         log.debug('Granted perm %s to %s on %s', perm, user, repo)
         action_logger_generic(
             'granted permission: {} to user: {} on repo: {}'.format(
                 perm, user, repo), namespace='security.repo')
         return obj
 
     def revoke_user_permission(self, repo, user):
         """
         Revoke permission for user on given repository
 
         :param repo: Instance of Repository, repository_id, or repository name
         :param user: Instance of User, user_id or username
         """
 
         user = self._get_user(user)
         repo = self._get_repo(repo)
 
         obj = self.sa.query(UserRepoToPerm) \
             .filter(UserRepoToPerm.repository == repo) \
             .filter(UserRepoToPerm.user == user) \
             .scalar()
         if obj:
             self.sa.delete(obj)
             log.debug('Revoked perm on %s on %s', repo, user)
             action_logger_generic(
                 'revoked permission from user: {} on repo: {}'.format(
                     user, repo), namespace='security.repo')
 
     def grant_user_group_permission(self, repo, group_name, perm):
         """
         Grant permission for user group on given repository, or update
         existing one if found
 
         :param repo: Instance of Repository, repository_id, or repository name
         :param group_name: Instance of UserGroup, users_group_id,
             or user group name
         :param perm: Instance of Permission, or permission_name
         """
         repo = self._get_repo(repo)
         group_name = self._get_user_group(group_name)
         permission = self._get_perm(perm)
 
         # check if we have that permission already
         obj = self.sa.query(UserGroupRepoToPerm) \
             .filter(UserGroupRepoToPerm.users_group == group_name) \
             .filter(UserGroupRepoToPerm.repository == repo) \
             .scalar()
 
         if obj is None:
             # create new
             obj = UserGroupRepoToPerm()
 
         obj.repository = repo
         obj.users_group = group_name
         obj.permission = permission
         self.sa.add(obj)
         log.debug('Granted perm %s to %s on %s', perm, group_name, repo)
         action_logger_generic(
             'granted permission: {} to usergroup: {} on repo: {}'.format(
                 perm, group_name, repo), namespace='security.repo')
 
         return obj
 
     def revoke_user_group_permission(self, repo, group_name):
         """
         Revoke permission for user group on given repository
 
         :param repo: Instance of Repository, repository_id, or repository name
         :param group_name: Instance of UserGroup, users_group_id,
             or user group name
         """
         repo = self._get_repo(repo)
         group_name = self._get_user_group(group_name)
 
         obj = self.sa.query(UserGroupRepoToPerm) \
             .filter(UserGroupRepoToPerm.repository == repo) \
             .filter(UserGroupRepoToPerm.users_group == group_name) \
             .scalar()
         if obj:
             self.sa.delete(obj)
             log.debug('Revoked perm to %s on %s', repo, group_name)
             action_logger_generic(
                 'revoked permission from usergroup: {} on repo: {}'.format(
                     group_name, repo), namespace='security.repo')
 
     def delete_stats(self, repo_name):
         """
         removes stats for given repo
 
         :param repo_name:
         """
         repo = self._get_repo(repo_name)
         try:
             obj = self.sa.query(Statistics) \
                 .filter(Statistics.repository == repo).scalar()
             if obj:
                 self.sa.delete(obj)
         except Exception:
             log.error(traceback.format_exc())
             raise
 
     def add_repo_field(self, repo_name, field_key, field_label, field_value='',
                        field_type='str', field_desc=''):
 
         repo = self._get_repo(repo_name)
 
         new_field = RepositoryField()
         new_field.repository = repo
         new_field.field_key = field_key
         new_field.field_type = field_type  # python type
         new_field.field_value = field_value
         new_field.field_desc = field_desc
         new_field.field_label = field_label
         self.sa.add(new_field)
         return new_field
 
     def delete_repo_field(self, repo_name, field_key):
         repo = self._get_repo(repo_name)
         field = RepositoryField.get_by_key_name(field_key, repo)
         if field:
             self.sa.delete(field)
 
     def _create_filesystem_repo(self, repo_name, repo_type, repo_group,
                                 clone_uri=None, repo_store_location=None,
                                 use_global_config=False):
         """
         makes repository on filesystem. It's group aware means it'll create
         a repository within a group, and alter the paths accordingly of
         group location
 
         :param repo_name:
         :param alias:
         :param parent:
         :param clone_uri:
         :param repo_store_location:
         """
         from rhodecode.lib.utils import is_valid_repo, is_valid_repo_group
         from rhodecode.model.scm import ScmModel
 
         if Repository.NAME_SEP in repo_name:
             raise ValueError(
                 'repo_name must not contain groups got `%s`' % repo_name)
 
         if isinstance(repo_group, RepoGroup):
             new_parent_path = os.sep.join(repo_group.full_path_splitted)
         else:
             new_parent_path = repo_group or ''
 
         if repo_store_location:
             _paths = [repo_store_location]
         else:
             _paths = [self.repos_path, new_parent_path, repo_name]
             # we need to make it str for mercurial
         repo_path = os.path.join(*map(lambda x: safe_str(x), _paths))
 
         # check if this path is not a repository
         if is_valid_repo(repo_path, self.repos_path):
             raise Exception('This path %s is a valid repository' % repo_path)
 
         # check if this path is a group
         if is_valid_repo_group(repo_path, self.repos_path):
             raise Exception('This path %s is a valid group' % repo_path)
 
         log.info('creating repo %s in %s from url: `%s`',
                  repo_name, safe_unicode(repo_path),
                  obfuscate_url_pw(clone_uri))
 
         backend = get_backend(repo_type)
 
         config_repo = None if use_global_config else repo_name
         if config_repo and new_parent_path:
             config_repo = Repository.NAME_SEP.join(
                 (new_parent_path, config_repo))
         config = make_db_config(clear_session=False, repo=config_repo)
         config.set('extensions', 'largefiles', '')
 
         # patch and reset hooks section of UI config to not run any
         # hooks on creating remote repo
         config.clear_section('hooks')
 
         # TODO: johbo: Unify this, hardcoded "bare=True" does not look nice
         if repo_type == 'git':
             repo = backend(
                 repo_path, config=config, create=True, src_url=clone_uri,
                 bare=True)
         else:
             repo = backend(
                 repo_path, config=config, create=True, src_url=clone_uri)
 
         ScmModel().install_hooks(repo, repo_type=repo_type)
 
         log.debug('Created repo %s with %s backend',
                   safe_unicode(repo_name), safe_unicode(repo_type))
         return repo
 
     def _rename_filesystem_repo(self, old, new):
         """
         renames repository on filesystem
 
         :param old: old name
         :param new: new name
         """
         log.info('renaming repo from %s to %s', old, new)
 
         old_path = os.path.join(self.repos_path, old)
         new_path = os.path.join(self.repos_path, new)
         if os.path.isdir(new_path):
             raise Exception(
                 'Was trying to rename to already existing dir %s' % new_path
             )
         shutil.move(old_path, new_path)
 
     def _delete_filesystem_repo(self, repo):
         """
         removes repo from filesystem, the removal is acctually made by
         added rm__ prefix into dir, and rename internat .hg/.git dirs so this
         repository is no longer valid for rhodecode, can be undeleted later on
         by reverting the renames on this repository
 
         :param repo: repo object
         """
         rm_path = os.path.join(self.repos_path, repo.repo_name)
         repo_group = repo.group
         log.info("Removing repository %s", rm_path)
         # disable hg/git internal that it doesn't get detected as repo
         alias = repo.repo_type
 
         config = make_db_config(clear_session=False)
         config.set('extensions', 'largefiles', '')
         bare = getattr(repo.scm_instance(config=config), 'bare', False)
 
         # skip this for bare git repos
         if not bare:
             # disable VCS repo
             vcs_path = os.path.join(rm_path, '.%s' % alias)
             if os.path.exists(vcs_path):
                 shutil.move(vcs_path, os.path.join(rm_path, 'rm__.%s' % alias))
 
         _now = datetime.now()
         _ms = str(_now.microsecond).rjust(6, '0')
         _d = 'rm__%s__%s' % (_now.strftime('%Y%m%d_%H%M%S_' + _ms),
                              repo.just_name)
         if repo_group:
             # if repository is in group, prefix the removal path with the group
             args = repo_group.full_path_splitted + [_d]
             _d = os.path.join(*args)
 
         if os.path.isdir(rm_path):
             shutil.move(rm_path, os.path.join(self.repos_path, _d))
 
 
 class ReadmeFinder:
     """
     Utility which knows how to find a readme for a specific commit.
 
     The main idea is that this is a configurable algorithm. When creating an
     instance you can define parameters, currently only the `default_renderer`.
     Based on this configuration the method :meth:`search` behaves slightly
     different.
     """
 
     readme_re = re.compile(r'^readme(\.[^\.]+)?$', re.IGNORECASE)
     path_re = re.compile(r'^docs?', re.IGNORECASE)
 
     default_priorities = {
         None: 0,
         '.text': 2,
         '.txt': 3,
         '.rst': 1,
         '.rest': 2,
         '.md': 1,
         '.mkdn': 2,
         '.mdown': 3,
         '.markdown': 4,
     }
 
     path_priority = {
         'doc': 0,
         'docs': 1,
     }
 
     FALLBACK_PRIORITY = 99
 
     RENDERER_TO_EXTENSION = {
         'rst': ['.rst', '.rest'],
         'markdown': ['.md', 'mkdn', '.mdown', '.markdown'],
     }
 
     def __init__(self, default_renderer=None):
         self._default_renderer = default_renderer
         self._renderer_extensions = self.RENDERER_TO_EXTENSION.get(
             default_renderer, [])
 
     def search(self, commit, path='/'):
         """
         Find a readme in the given `commit`.
         """
         nodes = commit.get_nodes(path)
         matches = self._match_readmes(nodes)
         matches = self._sort_according_to_priority(matches)
         if matches:
             return matches[0].node
 
         paths = self._match_paths(nodes)
         paths = self._sort_paths_according_to_priority(paths)
         for path in paths:
             match = self.search(commit, path=path)
             if match:
                 return match
 
         return None
 
     def _match_readmes(self, nodes):
         for node in nodes:
             if not node.is_file():
                 continue
             path = node.path.rsplit('/', 1)[-1]
             match = self.readme_re.match(path)
             if match:
                 extension = match.group(1)
                 yield ReadmeMatch(node, match, self._priority(extension))
 
     def _match_paths(self, nodes):
         for node in nodes:
             if not node.is_dir():
                 continue
             match = self.path_re.match(node.path)
             if match:
                 yield node.path
 
     def _priority(self, extension):
         renderer_priority = (
             0 if extension in self._renderer_extensions else 1)
         extension_priority = self.default_priorities.get(
             extension, self.FALLBACK_PRIORITY)
         return (renderer_priority, extension_priority)
 
     def _sort_according_to_priority(self, matches):
 
         def priority_and_path(match):
             return (match.priority, match.path)
 
         return sorted(matches, key=priority_and_path)
 
     def _sort_paths_according_to_priority(self, paths):
 
         def priority_and_path(path):
             return (self.path_priority.get(path, self.FALLBACK_PRIORITY), path)
 
         return sorted(paths, key=priority_and_path)
 
 
 class ReadmeMatch:
 
     def __init__(self, node, match, priority):
         self.node = node
         self._match = match
         self.priority = priority
 
     @property
     def path(self):
         return self.node.path
 
     def __repr__(self):
         return '<ReadmeMatch {} priority={}'.format(self.path, self.priority)

rhodecode/model/validators.py

@@ -1,1109 +1,1122 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 Set of generic validators
 """
 
 import logging
 import os
 import re
 from collections import defaultdict
 
 import formencode
 import ipaddress
 from formencode.validators import (
     UnicodeString, OneOf, Int, Number, Regex, Email, Bool, StringBoolean, Set,
     NotEmpty, IPAddress, CIDR, String, FancyValidator
 )
 from pylons.i18n.translation import _
 from sqlalchemy.sql.expression import true
 from sqlalchemy.util import OrderedSet
 from webhelpers.pylonslib.secure_form import authentication_token
 
 from rhodecode.authentication import (
     legacy_plugin_prefix, _import_legacy_plugin)
 from rhodecode.authentication.base import loadplugin
 from rhodecode.config.routing import ADMIN_PREFIX
 from rhodecode.lib.auth import HasRepoGroupPermissionAny, HasPermissionAny
 from rhodecode.lib.utils import repo_name_slug, make_db_config
 from rhodecode.lib.utils2 import safe_int, str2bool, aslist, md5
 from rhodecode.lib.vcs.backends.git.repository import GitRepository
 from rhodecode.lib.vcs.backends.hg.repository import MercurialRepository
 from rhodecode.lib.vcs.backends.svn.repository import SubversionRepository
 from rhodecode.model.db import (
     RepoGroup, Repository, UserGroup, User, ChangesetStatus, Gist)
 from rhodecode.model.settings import VcsSettingsModel
 
 # silence warnings and pylint
 UnicodeString, OneOf, Int, Number, Regex, Email, Bool, StringBoolean, Set, \
     NotEmpty, IPAddress, CIDR, String, FancyValidator
 
 log = logging.getLogger(__name__)
 
 
 class _Missing(object):
     pass
 
 Missing = _Missing()
 
 
 class StateObj(object):
     """
     this is needed to translate the messages using _() in validators
     """
     _ = staticmethod(_)
 
 
 def M(self, key, state=None, **kwargs):
     """
     returns string from self.message based on given key,
     passed kw params are used to substitute %(named)s params inside
     translated strings
 
     :param msg:
     :param state:
     """
     if state is None:
         state = StateObj()
     else:
         state._ = staticmethod(_)
     # inject validator into state object
     return self.message(key, state, **kwargs)
 
 
 def UniqueList(convert=None):
     class _UniqueList(formencode.FancyValidator):
         """
         Unique List !
         """
         messages = {
             'empty': _(u'Value cannot be an empty list'),
             'missing_value': _(u'Value cannot be an empty list'),
         }
 
         def _to_python(self, value, state):
             ret_val = []
 
             def make_unique(value):
                 seen = []
                 return [c for c in value if not (c in seen or seen.append(c))]
 
             if isinstance(value, list):
                 ret_val = make_unique(value)
             elif isinstance(value, set):
                 ret_val = make_unique(list(value))
             elif isinstance(value, tuple):
                 ret_val = make_unique(list(value))
             elif value is None:
                 ret_val = []
             else:
                 ret_val = [value]
 
             if convert:
                 ret_val = map(convert, ret_val)
             return ret_val
 
         def empty_value(self, value):
             return []
 
     return _UniqueList
 
 
 def UniqueListFromString():
     class _UniqueListFromString(UniqueList()):
         def _to_python(self, value, state):
             if isinstance(value, basestring):
                 value = aslist(value, ',')
             return super(_UniqueListFromString, self)._to_python(value, state)
     return _UniqueListFromString
 
 
 def ValidSvnPattern(section, repo_name=None):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'pattern_exists': _(u'Pattern already exists'),
         }
 
         def validate_python(self, value, state):
             if not value:
                 return
             model = VcsSettingsModel(repo=repo_name)
             ui_settings = model.get_svn_patterns(section=section)
             for entry in ui_settings:
                 if value == entry.value:
                     msg = M(self, 'pattern_exists', state)
                     raise formencode.Invalid(msg, value, state)
     return _validator
 
 
 def ValidUsername(edit=False, old_data={}):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'username_exists': _(u'Username "%(username)s" already exists'),
             'system_invalid_username':
                 _(u'Username "%(username)s" is forbidden'),
             'invalid_username':
                 _(u'Username may only contain alphanumeric characters '
                     u'underscores, periods or dashes and must begin with '
                     u'alphanumeric character or underscore')
         }
 
         def validate_python(self, value, state):
             if value in ['default', 'new_user']:
                 msg = M(self, 'system_invalid_username', state, username=value)
                 raise formencode.Invalid(msg, value, state)
             # check if user is unique
             old_un = None
             if edit:
                 old_un = User.get(old_data.get('user_id')).username
 
             if old_un != value or not edit:
                 if User.get_by_username(value, case_insensitive=True):
                     msg = M(self, 'username_exists', state, username=value)
                     raise formencode.Invalid(msg, value, state)
 
             if (re.match(r'^[\w]{1}[\w\-\.]{0,254}$', value)
                     is None):
                 msg = M(self, 'invalid_username', state)
                 raise formencode.Invalid(msg, value, state)
     return _validator
 
 
 def ValidRegex(msg=None):
     class _validator(formencode.validators.Regex):
         messages = {'invalid': msg or _(u'The input is not valid')}
     return _validator
 
 
 def ValidRepoUser(allow_disabled=False):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_username': _(u'Username %(username)s is not valid'),
             'disabled_username': _(u'Username %(username)s is disabled')
         }
 
         def validate_python(self, value, state):
             try:
                 user = User.query().filter(User.username == value).one()
             except Exception:
                 msg = M(self, 'invalid_username', state, username=value)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'username': msg}
                 )
             if user and (not allow_disabled and not user.active):
                 msg = M(self, 'disabled_username', state, username=value)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'username': msg}
                 )
 
     return _validator
 
 
 def ValidUserGroup(edit=False, old_data={}):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_group': _(u'Invalid user group name'),
             'group_exist': _(u'User group "%(usergroup)s" already exists'),
             'invalid_usergroup_name':
                 _(u'user group name may only contain alphanumeric '
                   u'characters underscores, periods or dashes and must begin '
                   u'with alphanumeric character')
         }
 
         def validate_python(self, value, state):
             if value in ['default']:
                 msg = M(self, 'invalid_group', state)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'users_group_name': msg}
                 )
             # check if group is unique
             old_ugname = None
             if edit:
                 old_id = old_data.get('users_group_id')
                 old_ugname = UserGroup.get(old_id).users_group_name
 
             if old_ugname != value or not edit:
                 is_existing_group = UserGroup.get_by_group_name(
                     value, case_insensitive=True)
                 if is_existing_group:
                     msg = M(self, 'group_exist', state, usergroup=value)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'users_group_name': msg}
                     )
 
             if re.match(r'^[a-zA-Z0-9]{1}[a-zA-Z0-9\-\_\.]+$', value) is None:
                 msg = M(self, 'invalid_usergroup_name', state)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'users_group_name': msg}
                 )
 
     return _validator
 
 
 def ValidRepoGroup(edit=False, old_data={}, can_create_in_root=False):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'group_parent_id': _(u'Cannot assign this group as parent'),
             'group_exists': _(u'Group "%(group_name)s" already exists'),
             'repo_exists': _(u'Repository with name "%(group_name)s" '
                              u'already exists'),
             'permission_denied': _(u"no permission to store repository group"
                                    u"in this location"),
             'permission_denied_root': _(
                 u"no permission to store repository group "
                 u"in root location")
         }
 
         def _to_python(self, value, state):
             group_name = repo_name_slug(value.get('group_name', ''))
             group_parent_id = safe_int(value.get('group_parent_id'))
             gr = RepoGroup.get(group_parent_id)
             if gr:
                 parent_group_path = gr.full_path
                 # value needs to be aware of group name in order to check
                 # db key This is an actual just the name to store in the
                 # database
                 group_name_full = (
                     parent_group_path + RepoGroup.url_sep() + group_name)
             else:
                 group_name_full = group_name
 
             value['group_name'] = group_name
             value['group_name_full'] = group_name_full
             value['group_parent_id'] = group_parent_id
             return value
 
         def validate_python(self, value, state):
 
             old_group_name = None
             group_name = value.get('group_name')
             group_name_full = value.get('group_name_full')
             group_parent_id = safe_int(value.get('group_parent_id'))
             if group_parent_id == -1:
                 group_parent_id = None
 
             group_obj = RepoGroup.get(old_data.get('group_id'))
             parent_group_changed = False
             if edit:
                 old_group_name = group_obj.group_name
                 old_group_parent_id = group_obj.group_parent_id
 
                 if group_parent_id != old_group_parent_id:
                     parent_group_changed = True
 
                 # TODO: mikhail: the following if statement is not reached
                 # since group_parent_id's OneOf validation fails before.
                 # Can be removed.
 
                 # check against setting a parent of self
                 parent_of_self = (
                     old_data['group_id'] == group_parent_id
                     if group_parent_id else False
                 )
                 if parent_of_self:
                     msg = M(self, 'group_parent_id', state)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'group_parent_id': msg}
                     )
 
             # group we're moving current group inside
             child_group = None
             if group_parent_id:
                 child_group = RepoGroup.query().filter(
                     RepoGroup.group_id == group_parent_id).scalar()
 
             # do a special check that we cannot move a group to one of
             # it's children
             if edit and child_group:
                 parents = [x.group_id for x in child_group.parents]
                 move_to_children = old_data['group_id'] in parents
                 if move_to_children:
                     msg = M(self, 'group_parent_id', state)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'group_parent_id': msg})
 
             # Check if we have permission to store in the parent.
             # Only check if the parent group changed.
             if parent_group_changed:
                 if child_group is None:
                     if not can_create_in_root:
                         msg = M(self, 'permission_denied_root', state)
                         raise formencode.Invalid(
                             msg, value, state,
                             error_dict={'group_parent_id': msg})
                 else:
                     valid = HasRepoGroupPermissionAny('group.admin')
                     forbidden = not valid(
                         child_group.group_name, 'can create group validator')
                     if forbidden:
                         msg = M(self, 'permission_denied', state)
                         raise formencode.Invalid(
                             msg, value, state,
                             error_dict={'group_parent_id': msg})
 
             # if we change the name or it's new group, check for existing names
             # or repositories with the same name
             if old_group_name != group_name_full or not edit:
                 # check group
                 gr = RepoGroup.get_by_group_name(group_name_full)
                 if gr:
                     msg = M(self, 'group_exists', state, group_name=group_name)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'group_name': msg})
 
                 # check for same repo
                 repo = Repository.get_by_repo_name(group_name_full)
                 if repo:
                     msg = M(self, 'repo_exists', state, group_name=group_name)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'group_name': msg})
 
     return _validator
 
 
 def ValidPassword():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_password':
                 _(u'Invalid characters (non-ascii) in password')
         }
 
         def validate_python(self, value, state):
             try:
                 (value or '').decode('ascii')
             except UnicodeError:
                 msg = M(self, 'invalid_password', state)
                 raise formencode.Invalid(msg, value, state,)
     return _validator
 
 
 def ValidOldPassword(username):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_password': _(u'Invalid old password')
         }
 
         def validate_python(self, value, state):
             from rhodecode.authentication.base import authenticate, HTTP_TYPE
             if not authenticate(username, value, '', HTTP_TYPE):
                 msg = M(self, 'invalid_password', state)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'current_password': msg}
                 )
     return _validator
 
 
 def ValidPasswordsMatch(
         passwd='new_password', passwd_confirmation='password_confirmation'):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'password_mismatch': _(u'Passwords do not match'),
         }
 
         def validate_python(self, value, state):
 
             pass_val = value.get('password') or value.get(passwd)
             if pass_val != value[passwd_confirmation]:
                 msg = M(self, 'password_mismatch', state)
                 raise formencode.Invalid(
                     msg, value, state,
                     error_dict={passwd: msg, passwd_confirmation: msg}
                 )
     return _validator
 
 
 def ValidAuth():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_password': _(u'invalid password'),
             'invalid_username': _(u'invalid user name'),
             'disabled_account': _(u'Your account is disabled')
         }
 
         def validate_python(self, value, state):
             from rhodecode.authentication.base import authenticate, HTTP_TYPE
 
             password = value['password']
             username = value['username']
 
             if not authenticate(username, password, '', HTTP_TYPE,
                                 skip_missing=True):
                 user = User.get_by_username(username)
                 if user and not user.active:
                     log.warning('user %s is disabled', username)
                     msg = M(self, 'disabled_account', state)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'username': msg}
                     )
                 else:
                     log.warning('user `%s` failed to authenticate', username)
                     msg = M(self, 'invalid_username', state)
                     msg2 = M(self, 'invalid_password', state)
                     raise formencode.Invalid(
                         msg, value, state,
                         error_dict={'username': msg, 'password': msg2}
                     )
     return _validator
 
 
 def ValidAuthToken():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_token': _(u'Token mismatch')
         }
 
         def validate_python(self, value, state):
             if value != authentication_token():
                 msg = M(self, 'invalid_token', state)
                 raise formencode.Invalid(msg, value, state)
     return _validator
 
 
 def ValidRepoName(edit=False, old_data={}):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_repo_name':
                 _(u'Repository name %(repo)s is disallowed'),
             # top level
             'repository_exists': _(u'Repository with name %(repo)s '
                                    u'already exists'),
             'group_exists': _(u'Repository group with name "%(repo)s" '
                               u'already exists'),
             # inside a group
             'repository_in_group_exists': _(u'Repository with name %(repo)s '
                                             u'exists in group "%(group)s"'),
             'group_in_group_exists': _(
                 u'Repository group with name "%(repo)s" '
                 u'exists in group "%(group)s"'),
         }
 
         def _to_python(self, value, state):
             repo_name = repo_name_slug(value.get('repo_name', ''))
             repo_group = value.get('repo_group')
             if repo_group:
                 gr = RepoGroup.get(repo_group)
                 group_path = gr.full_path
                 group_name = gr.group_name
                 # value needs to be aware of group name in order to check
                 # db key This is an actual just the name to store in the
                 # database
                 repo_name_full = group_path + RepoGroup.url_sep() + repo_name
             else:
                 group_name = group_path = ''
                 repo_name_full = repo_name
 
             value['repo_name'] = repo_name
             value['repo_name_full'] = repo_name_full
             value['group_path'] = group_path
             value['group_name'] = group_name
             return value
 
         def validate_python(self, value, state):
 
             repo_name = value.get('repo_name')
             repo_name_full = value.get('repo_name_full')
             group_path = value.get('group_path')
             group_name = value.get('group_name')
 
             if repo_name in [ADMIN_PREFIX, '']:
                 msg = M(self, 'invalid_repo_name', state, repo=repo_name)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'repo_name': msg})
 
             rename = old_data.get('repo_name') != repo_name_full
             create = not edit
             if rename or create:
 
                 if group_path:
                     if Repository.get_by_repo_name(repo_name_full):
                         msg = M(self, 'repository_in_group_exists', state,
                                 repo=repo_name, group=group_name)
                         raise formencode.Invalid(
                             msg, value, state, error_dict={'repo_name': msg})
                     if RepoGroup.get_by_group_name(repo_name_full):
                         msg = M(self, 'group_in_group_exists', state,
                                 repo=repo_name, group=group_name)
                         raise formencode.Invalid(
                             msg, value, state, error_dict={'repo_name': msg})
                 else:
                     if RepoGroup.get_by_group_name(repo_name_full):
                         msg = M(self, 'group_exists', state, repo=repo_name)
                         raise formencode.Invalid(
                             msg, value, state, error_dict={'repo_name': msg})
 
                     if Repository.get_by_repo_name(repo_name_full):
                         msg = M(
                             self, 'repository_exists', state, repo=repo_name)
                         raise formencode.Invalid(
                             msg, value, state, error_dict={'repo_name': msg})
             return value
     return _validator
 
 
 def ValidForkName(*args, **kwargs):
     return ValidRepoName(*args, **kwargs)
 
 
 def SlugifyName():
     class _validator(formencode.validators.FancyValidator):
 
         def _to_python(self, value, state):
             return repo_name_slug(value)
 
         def validate_python(self, value, state):
             pass
 
     return _validator
 
 
 def CannotHaveGitSuffix():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'has_git_suffix':
                 _(u'Repository name cannot end with .git'),
         }
 
         def _to_python(self, value, state):
             return value
 
         def validate_python(self, value, state):
             if value and value.endswith('.git'):
                 msg = M(
                     self, 'has_git_suffix', state)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'repo_name': msg})
 
     return _validator
 
 
 def ValidCloneUri():
     class InvalidCloneUrl(Exception):
         allowed_prefixes = ()
 
     def url_handler(repo_type, url):
         config = make_db_config(clear_session=False)
         if repo_type == 'hg':
             allowed_prefixes = ('http', 'svn+http', 'git+http')
 
             if 'http' in url[:4]:
                 # initially check if it's at least the proper URL
                 # or does it pass basic auth
                 MercurialRepository.check_url(url, config)
             elif 'svn+http' in url[:8]:  # svn->hg import
                 SubversionRepository.check_url(url, config)
             elif 'git+http' in url[:8]:  # git->hg import
                 raise NotImplementedError()
             else:
                 exc = InvalidCloneUrl('Clone from URI %s not allowed. '
                                       'Allowed url must start with one of %s'
                                       % (url, ','.join(allowed_prefixes)))
                 exc.allowed_prefixes = allowed_prefixes
                 raise exc
 
         elif repo_type == 'git':
             allowed_prefixes = ('http', 'svn+http', 'hg+http')
             if 'http' in url[:4]:
                 # initially check if it's at least the proper URL
                 # or does it pass basic auth
                 GitRepository.check_url(url, config)
             elif 'svn+http' in url[:8]:  # svn->git import
                 raise NotImplementedError()
             elif 'hg+http' in url[:8]:  # hg->git import
                 raise NotImplementedError()
             else:
                 exc = InvalidCloneUrl('Clone from URI %s not allowed. '
                                       'Allowed url must start with one of %s'
                                       % (url, ','.join(allowed_prefixes)))
                 exc.allowed_prefixes = allowed_prefixes
                 raise exc
 
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'clone_uri': _(u'invalid clone url for %(rtype)s repository'),
             'invalid_clone_uri': _(
                 u'Invalid clone url, provide a valid clone '
                 u'url starting with one of %(allowed_prefixes)s')
         }
 
         def validate_python(self, value, state):
             repo_type = value.get('repo_type')
             url = value.get('clone_uri')
 
             if url:
                 try:
                     url_handler(repo_type, url)
                 except InvalidCloneUrl as e:
                     log.warning(e)
                     msg = M(self, 'invalid_clone_uri', rtype=repo_type,
                             allowed_prefixes=','.join(e.allowed_prefixes))
                     raise formencode.Invalid(msg, value, state,
                                              error_dict={'clone_uri': msg})
                 except Exception:
                     log.exception('Url validation failed')
                     msg = M(self, 'clone_uri', rtype=repo_type)
                     raise formencode.Invalid(msg, value, state,
                                              error_dict={'clone_uri': msg})
     return _validator
 
 
 def ValidForkType(old_data={}):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_fork_type': _(u'Fork have to be the same type as parent')
         }
 
         def validate_python(self, value, state):
             if old_data['repo_type'] != value:
                 msg = M(self, 'invalid_fork_type', state)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'repo_type': msg}
                 )
     return _validator
 
 
 def CanWriteGroup(old_data=None):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'permission_denied': _(
                 u"You do not have the permission "
                 u"to create repositories in this group."),
             'permission_denied_root': _(
                 u"You do not have the permission to store repositories in "
                 u"the root location.")
         }
 
         def _to_python(self, value, state):
             # root location
             if value in [-1, "-1"]:
                 return None
             return value
 
         def validate_python(self, value, state):
             gr = RepoGroup.get(value)
             gr_name = gr.group_name if gr else None  # None means ROOT location
             # create repositories with write permission on group is set to true
             create_on_write = HasPermissionAny(
                 'hg.create.write_on_repogroup.true')()
             group_admin = HasRepoGroupPermissionAny('group.admin')(
                 gr_name, 'can write into group validator')
             group_write = HasRepoGroupPermissionAny('group.write')(
                 gr_name, 'can write into group validator')
             forbidden = not (group_admin or (group_write and create_on_write))
             can_create_repos = HasPermissionAny(
                 'hg.admin', 'hg.create.repository')
             gid = (old_data['repo_group'].get('group_id')
                    if (old_data and 'repo_group' in old_data) else None)
             value_changed = gid != safe_int(value)
             new = not old_data
             # do check if we changed the value, there's a case that someone got
             # revoked write permissions to a repository, he still created, we
             # don't need to check permission if he didn't change the value of
             # groups in form box
             if value_changed or new:
                 # parent group need to be existing
                 if gr and forbidden:
                     msg = M(self, 'permission_denied', state)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'repo_type': msg}
                     )
                 # check if we can write to root location !
                 elif gr is None and not can_create_repos():
                     msg = M(self, 'permission_denied_root', state)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'repo_type': msg}
                     )
 
     return _validator
 
 
 def ValidPerms(type_='repo'):
     if type_ == 'repo_group':
         EMPTY_PERM = 'group.none'
     elif type_ == 'repo':
         EMPTY_PERM = 'repository.none'
     elif type_ == 'user_group':
         EMPTY_PERM = 'usergroup.none'
 
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'perm_new_member_name':
                 _(u'This username or user group name is not valid')
         }
 
         def _to_python(self, value, state):
             perm_updates = OrderedSet()
             perm_additions = OrderedSet()
             perm_deletions = OrderedSet()
             # build a list of permission to update/delete and new permission
 
             # Read the perm_new_member/perm_del_member attributes and group
             # them by they IDs
             new_perms_group = defaultdict(dict)
             del_perms_group = defaultdict(dict)
             for k, v in value.copy().iteritems():
                 if k.startswith('perm_del_member'):
                     # delete from org storage so we don't process that later
                     del value[k]
                     # part is `id`, `type`
                     _type, part = k.split('perm_del_member_')
                     args = part.split('_')
                     if len(args) == 2:
                         _key, pos = args
                         del_perms_group[pos][_key] = v
                 if k.startswith('perm_new_member'):
                     # delete from org storage so we don't process that later
                     del value[k]
                     # part is `id`, `type`, `perm`
                     _type, part = k.split('perm_new_member_')
                     args = part.split('_')
                     if len(args) == 2:
                         _key, pos = args
                         new_perms_group[pos][_key] = v
 
             # store the deletes
             for k in sorted(del_perms_group.keys()):
                 perm_dict = del_perms_group[k]
                 del_member = perm_dict.get('id')
                 del_type = perm_dict.get('type')
                 if del_member and del_type:
-                    perm_deletions.add((del_member, None, del_type))
+                    perm_deletions.add(
+                        (del_member, None, del_type))
 
             # store additions in order of how they were added in web form
             for k in sorted(new_perms_group.keys()):
                 perm_dict = new_perms_group[k]
                 new_member = perm_dict.get('id')
                 new_type = perm_dict.get('type')
                 new_perm = perm_dict.get('perm')
                 if new_member and new_perm and new_type:
-                    perm_additions.add((new_member, new_perm, new_type))
+                    perm_additions.add(
+                        (new_member, new_perm, new_type))
 
             # get updates of permissions
             # (read the existing radio button states)
+            default_user_id = User.get_default_user().user_id
             for k, update_value in value.iteritems():
                 if k.startswith('u_perm_') or k.startswith('g_perm_'):
                     member = k[7:]
                     update_type = {'u': 'user',
                                    'g': 'users_group'}[k[0]]
-                    if member == User.DEFAULT_USER:
+
+                    if safe_int(member) == default_user_id:
                         if str2bool(value.get('repo_private')):
-                            # set none for default when updating to
-                            # private repo protects agains form manipulation
+                            # prevent from updating default user permissions
+                            # when this repository is marked as private
                             update_value = EMPTY_PERM
-                    perm_updates.add((member, update_value, update_type))
-            # check the deletes
 
-            value['perm_additions'] = list(perm_additions)
+                    perm_updates.add(
+                        (member, update_value, update_type))
+
+            value['perm_additions'] = []  # propagated later
             value['perm_updates'] = list(perm_updates)
             value['perm_deletions'] = list(perm_deletions)
 
-            # validate users they exist and they are active !
-            for member_id, _perm, member_type in perm_additions:
+            updates_map = dict(
+                (x[0], (x[1], x[2])) for x in value['perm_updates'])
+            # make sure Additions don't override updates.
+            for member_id, perm, member_type in list(perm_additions):
+                if member_id in updates_map:
+                    perm = updates_map[member_id][0]
+                value['perm_additions'].append((member_id, perm, member_type))
+
+                # on new entries validate users they exist and they are active !
+                # this leaves feedback to the form
                 try:
                     if member_type == 'user':
-                        self.user_db = User.query()\
+                        User.query()\
                             .filter(User.active == true())\
                             .filter(User.user_id == member_id).one()
                     if member_type == 'users_group':
-                        self.user_db = UserGroup.query()\
+                        UserGroup.query()\
                             .filter(UserGroup.users_group_active == true())\
                             .filter(UserGroup.users_group_id == member_id)\
                             .one()
 
                 except Exception:
                     log.exception('Updated permission failed: org_exc:')
                     msg = M(self, 'perm_new_member_type', state)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={
                             'perm_new_member_name': msg}
                     )
             return value
     return _validator
 
 
 def ValidSettings():
     class _validator(formencode.validators.FancyValidator):
         def _to_python(self, value, state):
             # settings  form for users that are not admin
             # can't edit certain parameters, it's extra backup if they mangle
             # with forms
 
             forbidden_params = [
                 'user', 'repo_type', 'repo_enable_locking',
                 'repo_enable_downloads', 'repo_enable_statistics'
             ]
 
             for param in forbidden_params:
                 if param in value:
                     del value[param]
             return value
 
         def validate_python(self, value, state):
             pass
     return _validator
 
 
 def ValidPath():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_path': _(u'This is not a valid path')
         }
 
         def validate_python(self, value, state):
             if not os.path.isdir(value):
                 msg = M(self, 'invalid_path', state)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'paths_root_path': msg}
                 )
     return _validator
 
 
 def UniqSystemEmail(old_data={}):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'email_taken': _(u'This e-mail address is already taken')
         }
 
         def _to_python(self, value, state):
             return value.lower()
 
         def validate_python(self, value, state):
             if (old_data.get('email') or '').lower() != value:
                 user = User.get_by_email(value, case_insensitive=True)
                 if user:
                     msg = M(self, 'email_taken', state)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'email': msg}
                     )
     return _validator
 
 
 def ValidSystemEmail():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'non_existing_email': _(u'e-mail "%(email)s" does not exist.')
         }
 
         def _to_python(self, value, state):
             return value.lower()
 
         def validate_python(self, value, state):
             user = User.get_by_email(value, case_insensitive=True)
             if user is None:
                 msg = M(self, 'non_existing_email', state, email=value)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'email': msg}
                 )
 
     return _validator
 
 
 def NotReviewedRevisions(repo_id):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'rev_already_reviewed':
                 _(u'Revisions %(revs)s are already part of pull request '
                   u'or have set status'),
         }
 
         def validate_python(self, value, state):
             # check revisions if they are not reviewed, or a part of another
             # pull request
             statuses = ChangesetStatus.query()\
                 .filter(ChangesetStatus.revision.in_(value))\
                 .filter(ChangesetStatus.repo_id == repo_id)\
                 .all()
 
             errors = []
             for status in statuses:
                 if status.pull_request_id:
                     errors.append(['pull_req', status.revision[:12]])
                 elif status.status:
                     errors.append(['status', status.revision[:12]])
 
             if errors:
                 revs = ','.join([x[1] for x in errors])
                 msg = M(self, 'rev_already_reviewed', state, revs=revs)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'revisions': revs})
 
     return _validator
 
 
 def ValidIp():
     class _validator(CIDR):
         messages = {
             'badFormat': _(u'Please enter a valid IPv4 or IpV6 address'),
             'illegalBits': _(
                 u'The network size (bits) must be within the range '
                 u'of 0-32 (not %(bits)r)'),
         }
 
         # we ovveride the default to_python() call
         def to_python(self, value, state):
             v = super(_validator, self).to_python(value, state)
             v = v.strip()
             net = ipaddress.ip_network(address=v, strict=False)
             return str(net)
 
         def validate_python(self, value, state):
             try:
                 addr = value.strip()
                 # this raises an ValueError if address is not IpV4 or IpV6
                 ipaddress.ip_network(addr, strict=False)
             except ValueError:
                 raise formencode.Invalid(self.message('badFormat', state),
                                          value, state)
 
     return _validator
 
 
 def FieldKey():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'badFormat': _(
                 u'Key name can only consist of letters, '
                 u'underscore, dash or numbers'),
         }
 
         def validate_python(self, value, state):
             if not re.match('[a-zA-Z0-9_-]+$', value):
                 raise formencode.Invalid(self.message('badFormat', state),
                                          value, state)
     return _validator
 
 
 def ValidAuthPlugins():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'import_duplicate': _(
                 u'Plugins %(loaded)s and %(next_to_load)s '
                 u'both export the same name'),
             'missing_includeme': _(
                 u'The plugin "%(plugin_id)s" is missing an includeme '
                 u'function.'),
             'import_error': _(
                 u'Can not load plugin "%(plugin_id)s"'),
             'no_plugin': _(
                 u'No plugin available with ID "%(plugin_id)s"'),
         }
 
         def _to_python(self, value, state):
             # filter empty values
             return filter(lambda s: s not in [None, ''], value)
 
         def _validate_legacy_plugin_id(self, plugin_id, value, state):
             """
             Validates that the plugin import works. It also checks that the
             plugin has an includeme attribute.
             """
             try:
                 plugin = _import_legacy_plugin(plugin_id)
             except Exception as e:
                 log.exception(
                     'Exception during import of auth legacy plugin "{}"'
                     .format(plugin_id))
                 msg = M(self, 'import_error', plugin_id=plugin_id)
                 raise formencode.Invalid(msg, value, state)
 
             if not hasattr(plugin, 'includeme'):
                 msg = M(self, 'missing_includeme', plugin_id=plugin_id)
                 raise formencode.Invalid(msg, value, state)
 
             return plugin
 
         def _validate_plugin_id(self, plugin_id, value, state):
             """
             Plugins are already imported during app start up. Therefore this
             validation only retrieves the plugin from the plugin registry and
             if it returns something not None everything is OK.
             """
             plugin = loadplugin(plugin_id)
 
             if plugin is None:
                 msg = M(self, 'no_plugin', plugin_id=plugin_id)
                 raise formencode.Invalid(msg, value, state)
 
             return plugin
 
         def validate_python(self, value, state):
             unique_names = {}
             for plugin_id in value:
 
                 # Validate legacy or normal plugin.
                 if plugin_id.startswith(legacy_plugin_prefix):
                     plugin = self._validate_legacy_plugin_id(
                         plugin_id, value, state)
                 else:
                     plugin = self._validate_plugin_id(plugin_id, value, state)
 
                 # Only allow unique plugin names.
                 if plugin.name in unique_names:
                     msg = M(self, 'import_duplicate', state,
                             loaded=unique_names[plugin.name],
                             next_to_load=plugin)
                     raise formencode.Invalid(msg, value, state)
                 unique_names[plugin.name] = plugin
 
     return _validator
 
 
 def ValidPattern():
 
     class _Validator(formencode.validators.FancyValidator):
 
         def _to_python(self, value, state):
             patterns = []
 
             prefix = 'new_pattern'
             for name, v in value.iteritems():
                 pattern_name = '_'.join((prefix, 'pattern'))
                 if name.startswith(pattern_name):
                     new_item_id = name[len(pattern_name)+1:]
 
                     def _field(name):
                         return '%s_%s_%s' % (prefix, name, new_item_id)
 
                     values = {
                         'issuetracker_pat': value.get(_field('pattern')),
                         'issuetracker_pat': value.get(_field('pattern')),
                         'issuetracker_url': value.get(_field('url')),
                         'issuetracker_pref': value.get(_field('prefix')),
                         'issuetracker_desc': value.get(_field('description'))
                     }
                     new_uid = md5(values['issuetracker_pat'])
 
                     has_required_fields = (
                         values['issuetracker_pat']
                         and values['issuetracker_url'])
 
                     if has_required_fields:
                         settings = [
                             ('_'.join((key, new_uid)), values[key], 'unicode')
                             for key in values]
                         patterns.append(settings)
 
             value['patterns'] = patterns
             delete_patterns = value.get('uid') or []
             if not isinstance(delete_patterns, (list, tuple)):
                 delete_patterns = [delete_patterns]
             value['delete_patterns'] = delete_patterns
             return value
     return _Validator

rhodecode/public/js/rhodecode/routes.js

@@ -1,118 +1,118 b''
 
 /******************************************************************************
  *                                                                            *
  *                      DO NOT CHANGE THIS FILE MANUALLY                      *
  *                                                                            *
  *                                                                            *
  *        This file is automatically generated when the app starts up with    *
  *                         generate_js_files = true                           *
  *                                                                            *
  *  To add a route here pass jsroute=True to the route definition in the app  *
  *                                                                            *
  ******************************************************************************/
 function registerRCRoutes() {
     // routes registration
     pyroutes.register('home', '/', []);
     pyroutes.register('new_repo', '/_admin/create_repository', []);
     pyroutes.register('edit_user', '/_admin/users/%(user_id)s/edit', ['user_id']);
     pyroutes.register('edit_user_group_members', '/_admin/user_groups/%(user_group_id)s/edit/members', ['user_group_id']);
     pyroutes.register('gists', '/_admin/gists', []);
     pyroutes.register('new_gist', '/_admin/gists/new', []);
     pyroutes.register('toggle_following', '/_admin/toggle_following', []);
     pyroutes.register('repo_stats', '/%(repo_name)s/repo_stats/%(commit_id)s', ['repo_name', 'commit_id']);
     pyroutes.register('repo_refs_data', '/%(repo_name)s/refs-data', ['repo_name']);
     pyroutes.register('repo_refs_changelog_data', '/%(repo_name)s/refs-data-changelog', ['repo_name']);
     pyroutes.register('repo_default_reviewers_data', '/%(repo_name)s/default-reviewers', ['repo_name']);
     pyroutes.register('changeset_home', '/%(repo_name)s/changeset/%(revision)s', ['repo_name', 'revision']);
-    pyroutes.register('edit_repo_perms', '/%(repo_name)s/settings/permissions', ['repo_name']);
     pyroutes.register('changeset_comment', '/%(repo_name)s/changeset/%(revision)s/comment', ['repo_name', 'revision']);
     pyroutes.register('changeset_comment_preview', '/%(repo_name)s/changeset/comment/preview', ['repo_name']);
     pyroutes.register('changeset_comment_delete', '/%(repo_name)s/changeset/comment/%(comment_id)s/delete', ['repo_name', 'comment_id']);
     pyroutes.register('changeset_info', '/%(repo_name)s/changeset_info/%(revision)s', ['repo_name', 'revision']);
     pyroutes.register('compare_url', '/%(repo_name)s/compare/%(source_ref_type)s@%(source_ref)s...%(target_ref_type)s@%(target_ref)s', ['repo_name', 'source_ref_type', 'source_ref', 'target_ref_type', 'target_ref']);
     pyroutes.register('pullrequest_home', '/%(repo_name)s/pull-request/new', ['repo_name']);
     pyroutes.register('pullrequest', '/%(repo_name)s/pull-request/new', ['repo_name']);
     pyroutes.register('pullrequest_repo_refs', '/%(repo_name)s/pull-request/refs/%(target_repo_name)s', ['repo_name', 'target_repo_name']);
     pyroutes.register('pullrequest_repo_destinations', '/%(repo_name)s/pull-request/repo-destinations', ['repo_name']);
     pyroutes.register('pullrequest_show', '/%(repo_name)s/pull-request/%(pull_request_id)s', ['repo_name', 'pull_request_id']);
     pyroutes.register('pullrequest_update', '/%(repo_name)s/pull-request/%(pull_request_id)s', ['repo_name', 'pull_request_id']);
     pyroutes.register('pullrequest_show_all', '/%(repo_name)s/pull-request', ['repo_name']);
     pyroutes.register('pullrequest_comment', '/%(repo_name)s/pull-request-comment/%(pull_request_id)s', ['repo_name', 'pull_request_id']);
     pyroutes.register('pullrequest_comment_delete', '/%(repo_name)s/pull-request-comment/%(comment_id)s/delete', ['repo_name', 'comment_id']);
     pyroutes.register('changelog_home', '/%(repo_name)s/changelog', ['repo_name']);
     pyroutes.register('changelog_file_home', '/%(repo_name)s/changelog/%(revision)s/%(f_path)s', ['repo_name', 'revision', 'f_path']);
     pyroutes.register('changelog_elements', '/%(repo_name)s/changelog_details', ['repo_name']);
     pyroutes.register('files_home', '/%(repo_name)s/files/%(revision)s/%(f_path)s', ['repo_name', 'revision', 'f_path']);
     pyroutes.register('files_history_home', '/%(repo_name)s/history/%(revision)s/%(f_path)s', ['repo_name', 'revision', 'f_path']);
     pyroutes.register('files_authors_home', '/%(repo_name)s/authors/%(revision)s/%(f_path)s', ['repo_name', 'revision', 'f_path']);
     pyroutes.register('files_annotate_home', '/%(repo_name)s/annotate/%(revision)s/%(f_path)s', ['repo_name', 'revision', 'f_path']);
     pyroutes.register('files_annotate_previous', '/%(repo_name)s/annotate-previous/%(revision)s/%(f_path)s', ['repo_name', 'revision', 'f_path']);
     pyroutes.register('files_archive_home', '/%(repo_name)s/archive/%(fname)s', ['repo_name', 'fname']);
     pyroutes.register('files_nodelist_home', '/%(repo_name)s/nodelist/%(revision)s/%(f_path)s', ['repo_name', 'revision', 'f_path']);
     pyroutes.register('files_nodetree_full', '/%(repo_name)s/nodetree_full/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('summary_home_slash', '/%(repo_name)s/', ['repo_name']);
     pyroutes.register('summary_home', '/%(repo_name)s', ['repo_name']);
     pyroutes.register('favicon', '/favicon.ico', []);
     pyroutes.register('robots', '/robots.txt', []);
     pyroutes.register('auth_home', '/_admin/auth*traverse', []);
     pyroutes.register('global_integrations_new', '/_admin/integrations/new', []);
     pyroutes.register('global_integrations_home', '/_admin/integrations', []);
     pyroutes.register('global_integrations_list', '/_admin/integrations/%(integration)s', ['integration']);
     pyroutes.register('global_integrations_create', '/_admin/integrations/%(integration)s/new', ['integration']);
     pyroutes.register('global_integrations_edit', '/_admin/integrations/%(integration)s/%(integration_id)s', ['integration', 'integration_id']);
     pyroutes.register('repo_group_integrations_home', '%(repo_group_name)s/settings/integrations', ['repo_group_name']);
     pyroutes.register('repo_group_integrations_list', '%(repo_group_name)s/settings/integrations/%(integration)s', ['repo_group_name', 'integration']);
     pyroutes.register('repo_group_integrations_new', '%(repo_group_name)s/settings/integrations/new', ['repo_group_name']);
     pyroutes.register('repo_group_integrations_create', '%(repo_group_name)s/settings/integrations/%(integration)s/new', ['repo_group_name', 'integration']);
     pyroutes.register('repo_group_integrations_edit', '%(repo_group_name)s/settings/integrations/%(integration)s/%(integration_id)s', ['repo_group_name', 'integration', 'integration_id']);
     pyroutes.register('repo_integrations_home', '%(repo_name)s/settings/integrations', ['repo_name']);
     pyroutes.register('repo_integrations_list', '%(repo_name)s/settings/integrations/%(integration)s', ['repo_name', 'integration']);
     pyroutes.register('repo_integrations_new', '%(repo_name)s/settings/integrations/new', ['repo_name']);
     pyroutes.register('repo_integrations_create', '%(repo_name)s/settings/integrations/%(integration)s/new', ['repo_name', 'integration']);
     pyroutes.register('repo_integrations_edit', '%(repo_name)s/settings/integrations/%(integration)s/%(integration_id)s', ['repo_name', 'integration', 'integration_id']);
     pyroutes.register('ops_ping', '_admin/ops/ping', []);
     pyroutes.register('admin_settings_open_source', '_admin/settings/open_source', []);
     pyroutes.register('admin_settings_vcs_svn_generate_cfg', '_admin/settings/vcs/svn_generate_cfg', []);
     pyroutes.register('admin_settings_system', '_admin/settings/system', []);
     pyroutes.register('admin_settings_system_update', '_admin/settings/system/updates', []);
     pyroutes.register('admin_settings_sessions', '_admin/settings/sessions', []);
     pyroutes.register('admin_settings_sessions_cleanup', '_admin/settings/sessions/cleanup', []);
     pyroutes.register('users', '_admin/users', []);
     pyroutes.register('users_data', '_admin/users_data', []);
     pyroutes.register('edit_user_auth_tokens', '_admin/users/%(user_id)s/edit/auth_tokens', ['user_id']);
     pyroutes.register('edit_user_auth_tokens_add', '_admin/users/%(user_id)s/edit/auth_tokens/new', ['user_id']);
     pyroutes.register('edit_user_auth_tokens_delete', '_admin/users/%(user_id)s/edit/auth_tokens/delete', ['user_id']);
     pyroutes.register('edit_user_groups_management', '_admin/users/%(user_id)s/edit/groups_management', ['user_id']);
     pyroutes.register('edit_user_groups_management_updates', '_admin/users/%(user_id)s/edit/edit_user_groups_management/updates', ['user_id']);
     pyroutes.register('edit_user_audit_logs', '_admin/users/%(user_id)s/edit/audit', ['user_id']);
     pyroutes.register('channelstream_connect', '/_admin/channelstream/connect', []);
     pyroutes.register('channelstream_subscribe', '/_admin/channelstream/subscribe', []);
     pyroutes.register('channelstream_proxy', '/_channelstream', []);
     pyroutes.register('login', '/_admin/login', []);
     pyroutes.register('logout', '/_admin/logout', []);
     pyroutes.register('register', '/_admin/register', []);
     pyroutes.register('reset_password', '/_admin/password_reset', []);
     pyroutes.register('reset_password_confirmation', '/_admin/password_reset_confirmation', []);
     pyroutes.register('user_autocomplete_data', '/_users', []);
     pyroutes.register('user_group_autocomplete_data', '/_user_groups', []);
     pyroutes.register('repo_list_data', '/_repos', []);
     pyroutes.register('goto_switcher_data', '/_goto_data', []);
     pyroutes.register('edit_repo', '/%(repo_name)s/settings', ['repo_name']);
     pyroutes.register('edit_repo_caches', '/%(repo_name)s/settings/caches', ['repo_name']);
+    pyroutes.register('edit_repo_perms', '/%(repo_name)s/settings/permissions', ['repo_name']);
     pyroutes.register('repo_reviewers', '/%(repo_name)s/settings/review/rules', ['repo_name']);
     pyroutes.register('repo_maintenance', '/%(repo_name)s/maintenance', ['repo_name']);
     pyroutes.register('repo_maintenance_execute', '/%(repo_name)s/maintenance/execute', ['repo_name']);
     pyroutes.register('strip', '/%(repo_name)s/strip', ['repo_name']);
     pyroutes.register('strip_check', '/%(repo_name)s/strip_check', ['repo_name']);
     pyroutes.register('strip_execute', '/%(repo_name)s/strip_execute', ['repo_name']);
     pyroutes.register('search', '/_admin/search', []);
     pyroutes.register('search_repo', '/%(repo_name)s/search', ['repo_name']);
     pyroutes.register('user_profile', '/_profiles/%(username)s', ['username']);
     pyroutes.register('my_account_profile', '/_admin/my_account/profile', []);
     pyroutes.register('my_account_password', '/_admin/my_account/password', []);
     pyroutes.register('my_account_password_update', '/_admin/my_account/password', []);
     pyroutes.register('my_account_auth_tokens', '/_admin/my_account/auth_tokens', []);
     pyroutes.register('my_account_auth_tokens_add', '/_admin/my_account/auth_tokens/new', []);
     pyroutes.register('my_account_auth_tokens_delete', '/_admin/my_account/auth_tokens/delete', []);
     pyroutes.register('apiv2', '/_admin/api', []);
 }

rhodecode/templates/admin/repos/repo_edit.mako

@@ -1,95 +1,95 b''
 ## -*- coding: utf-8 -*-
 ##
 ## See also repo_settings.html
 ##
 <%inherit file="/base/base.mako"/>
 
 <%def name="title()">
     ${_('%s repository settings') % c.repo_info.repo_name}
     %if c.rhodecode_name:
         &middot; ${h.branding(c.rhodecode_name)}
     %endif
 </%def>
 
 <%def name="breadcrumbs_links()">
     ${_('Settings')}
 </%def>
 
 <%def name="menu_bar_nav()">
     ${self.menu_items(active='repositories')}
 </%def>
 
 <%def name="menu_bar_subnav()">
     ${self.repo_menu(active='options')}
 </%def>
 
 <%def name="main_content()">
   <%include file="/admin/repos/repo_edit_${c.active}.mako"/>
 </%def>
 
 
 <%def name="main()">
 <div class="box">
   <div class="title">
       ${self.repo_page_title(c.rhodecode_db_repo)}
       ${self.breadcrumbs()}
   </div>
 
   <div class="sidebar-col-wrapper scw-small">
     <div class="sidebar">
         <ul class="nav nav-pills nav-stacked">
           <li class="${'active' if c.active=='settings' else ''}">
               <a href="${h.route_path('edit_repo', repo_name=c.repo_name)}">${_('Settings')}</a>
           </li>
           <li class="${'active' if c.active=='permissions' else ''}">
-              <a href="${h.url('edit_repo_perms', repo_name=c.repo_name)}">${_('Permissions')}</a>
+              <a href="${h.route_path('edit_repo_perms', repo_name=c.repo_name)}">${_('Permissions')}</a>
           </li>
           <li class="${'active' if c.active=='advanced' else ''}">
               <a href="${h.url('edit_repo_advanced', repo_name=c.repo_name)}">${_('Advanced')}</a>
           </li>
           <li class="${'active' if c.active=='vcs' else ''}">
               <a href="${h.url('repo_vcs_settings', repo_name=c.repo_name)}">${_('VCS')}</a>
           </li>
           <li class="${'active' if c.active=='fields' else ''}">
               <a href="${h.url('edit_repo_fields', repo_name=c.repo_name)}">${_('Extra Fields')}</a>
           </li>
           <li class="${'active' if c.active=='issuetracker' else ''}">
               <a href="${h.url('repo_settings_issuetracker', repo_name=c.repo_name)}">${_('Issue Tracker')}</a>
           </li>
           <li class="${'active' if c.active=='caches' else ''}">
               <a href="${h.route_path('edit_repo_caches', repo_name=c.repo_name)}">${_('Caches')}</a>
           </li>
           %if c.repo_info.repo_type != 'svn':
           <li class="${'active' if c.active=='remote' else ''}">
               <a href="${h.url('edit_repo_remote', repo_name=c.repo_name)}">${_('Remote')}</a>
           </li>
           %endif
           <li class="${'active' if c.active=='statistics' else ''}">
               <a href="${h.url('edit_repo_statistics', repo_name=c.repo_name)}">${_('Statistics')}</a>
           </li>
           <li class="${'active' if c.active=='integrations' else ''}">
               <a href="${h.route_path('repo_integrations_home', repo_name=c.repo_name)}">${_('Integrations')}</a>
           </li>
           %if c.repo_info.repo_type != 'svn':
           <li class="${'active' if c.active=='reviewers' else ''}">
               <a href="${h.route_path('repo_reviewers', repo_name=c.repo_name)}">${_('Reviewer Rules')}</a>
           </li>
           %endif
           <li class="${'active' if c.active=='maintenance' else ''}">
               <a href="${h.route_path('repo_maintenance', repo_name=c.repo_name)}">${_('Maintenance')}</a>
           </li>
           <li class="${'active' if c.active=='strip' else ''}">
               <a href="${h.route_path('strip', repo_name=c.repo_name)}">${_('Strip')}</a>
           </li>
 
         </ul>
     </div>
 
     <div class="main-content-full-width">
       ${self.main_content()}
     </div>
 
   </div>
 </div>
 
 </%def>
  No newline at end of file

rhodecode/templates/admin/repos/repo_edit_permissions.mako

@@ -1,124 +1,123 b''
 <%namespace name="base" file="/base/base.mako"/>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Repository Permissions')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(url('edit_repo_perms_update', repo_name=c.repo_name), method='put')}
-        ${h.hidden('repo_private')}
+        ${h.secure_form(h.route_path('edit_repo_perms', repo_name=c.repo_name), method='POST')}
         <table id="permissions_manage" class="rctable permissions">
             <tr>
                 <th class="td-radio">${_('None')}</th>
                 <th class="td-radio">${_('Read')}</th>
                 <th class="td-radio">${_('Write')}</th>
                 <th class="td-radio">${_('Admin')}</th>
                 <th class="td-owner">${_('User/User Group')}</th>
                 <th></th>
             </tr>
             ## USERS
             %for _user in c.repo_info.permissions():
                 %if getattr(_user, 'admin_row', None) or getattr(_user, 'owner_row', None):
                     <tr class="perm_admin_row">
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.none', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.read', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.write', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.admin', 'repository.admin', disabled="disabled")}</td>
                         <td class="td-user">
                             ${base.gravatar(_user.email, 16)}
                             ${h.link_to_user(_user.username)}
                             %if getattr(_user, 'admin_row', None):
                                 (${_('super admin')})
                             %endif
                             %if getattr(_user, 'owner_row', None):
                                 (${_('owner')})
                             %endif
                         </td>
                         <td></td>
                     </tr>
                 %elif _user.username == h.DEFAULT_USER and c.repo_info.private:
                     <tr>
                         <td colspan="4">
                             <span class="private_repo_msg">
-                            <strong>${_('private repository')}</strong>
+                            <strong title="${_user.permission}">${_('private repository')}</strong>
                             </span>
                         </td>
                         <td class="private_repo_msg">
                             ${base.gravatar(h.DEFAULT_USER_EMAIL, 16)}
                             ${h.DEFAULT_USER} - ${_('only users/user groups explicitly added here will have access')}</td>
                         <td></td>
                     </tr>
                 %else:
                     <tr>
-                        <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.none')}</td>
-                        <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.read')}</td>
-                        <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.write')}</td>
-                        <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.admin')}</td>
+                        <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.none', checked=_user.permission=='repository.none')}</td>
+                        <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.read', checked=_user.permission=='repository.read')}</td>
+                        <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.write', checked=_user.permission=='repository.write')}</td>
+                        <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.admin', checked=_user.permission=='repository.admin')}</td>
                         <td class="td-user">
                             ${base.gravatar(_user.email, 16)}
                             <span class="user">
                                 % if _user.username == h.DEFAULT_USER:
                                     ${h.DEFAULT_USER} <span class="user-perm-help-text"> - ${_('permission for all other users')}</span>
                                 % else:
                                     ${h.link_to_user(_user.username)}
                                 % endif
                             </span>
                         </td>
                         <td class="td-action">
                           %if _user.username != h.DEFAULT_USER:
                             <span class="btn btn-link btn-danger revoke_perm"
                                   member="${_user.user_id}" member_type="user">
                             <i class="icon-remove"></i> ${_('Revoke')}
                             </span>
                           %endif
                         </td>
                     </tr>
                 %endif
             %endfor
 
             ## USER GROUPS
             %for _user_group in c.repo_info.permission_user_groups():
                 <tr>
-                    <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.none')}</td>
-                    <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.read')}</td>
-                    <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.write')}</td>
-                    <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.admin')}</td>
+                    <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.none', checked=_user_group.permission=='repository.none')}</td>
+                    <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.read', checked=_user_group.permission=='repository.read')}</td>
+                    <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.write', checked=_user_group.permission=='repository.write')}</td>
+                    <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.admin', checked=_user_group.permission=='repository.admin')}</td>
                     <td class="td-componentname">
                         <i class="icon-group" ></i>
                         %if h.HasPermissionAny('hg.admin')():
                          <a href="${h.url('edit_users_group',user_group_id=_user_group.users_group_id)}">
                              ${_user_group.users_group_name}
                          </a>
                         %else:
                          ${_user_group.users_group_name}
                         %endif
                     </td>
                     <td class="td-action">
                         <span class="btn btn-link btn-danger revoke_perm"
                               member="${_user_group.users_group_id}" member_type="user_group">
                         <i class="icon-remove"></i> ${_('Revoke')}
                         </span>
                     </td>
                 </tr>
             %endfor
             <tr class="new_members" id="add_perm_input"></tr>
         </table>
         <div id="add_perm" class="link">
             ${_('Add new')}
         </div>
         <div class="buttons">
           ${h.submit('save',_('Save'),class_="btn btn-primary")}
           ${h.reset('reset',_('Reset'),class_="btn btn-danger")}
         </div>
         ${h.end_form()}
     </div>
 </div>
 
 <script type="text/javascript">
     $('#add_perm').on('click', function(e){
         addNewPermInput($(this), 'repository');
     });
     $('.revoke_perm').on('click', function(e){
         markRevokePermInput($(this), 'repository');
     });
 </script>

rhodecode/templates/base/perms_summary.mako

@@ -1,207 +1,207 b''
 ## snippet for displaying permissions overview for users
 ## usage:
 ##    <%namespace name="p" file="/base/perms_summary.mako"/>
 ##    ${p.perms_summary(c.perm_user.permissions)}
 
 <%def name="perms_summary(permissions, show_all=False, actions=True)">
 <div id="perms" class="table fields">
   %for section in sorted(permissions.keys()):
   <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${section.replace("_"," ").capitalize()}</h3>
     </div>
     <div class="panel-body">
       <div class="perms_section_head field">
         <div class="radios">
           %if section != 'global':
               <span class="permissions_boxes">
               <span class="desc">${_('show')}: </span>
               ${h.checkbox('perms_filter_none_%s' % section, 'none', 'checked', class_='perm_filter filter_%s' % section, section=section, perm_type='none')}   <label for="${'perms_filter_none_%s' % section}"><span class="perm_tag none">${_('none')}</span></label>
               ${h.checkbox('perms_filter_read_%s' % section, 'read', 'checked', class_='perm_filter filter_%s' % section, section=section, perm_type='read')}   <label for="${'perms_filter_read_%s' % section}"><span class="perm_tag read">${_('read')}</span></label>
               ${h.checkbox('perms_filter_write_%s' % section, 'write', 'checked', class_='perm_filter filter_%s' % section, section=section, perm_type='write')} <label for="${'perms_filter_write_%s' % section}"> <span class="perm_tag write">${_('write')}</span></label>
               ${h.checkbox('perms_filter_admin_%s' % section, 'admin', 'checked', class_='perm_filter filter_%s' % section, section=section, perm_type='admin')} <label for="${'perms_filter_admin_%s' % section}"><span class="perm_tag admin">${_('admin')}</span></label>
               </span>
           %endif
         </div>
       </div>
       <div class="field">
         %if not permissions[section]:
             <p class="empty_data help-block">${_('No permissions defined')}</p>
         %else:
         <div id='tbl_list_wrap_${section}'>
          <table id="tbl_list_${section}" class="rctable">
           ## global permission box
           %if section == 'global':
             <thead>
                 <tr>
                 <th colspan="2" class="left">${_('Permission')}</th>
                 %if actions:
                 <th>${_('Edit Permission')}</th>
                 %endif
             </thead>
             <tbody>
 
             <%
               def get_section_perms(prefix, opts):
                   _selected = []
                   for op in opts:
                       if op.startswith(prefix) and not op.startswith('hg.create.write_on_repogroup'):
                           _selected.append(op)
                   admin = 'hg.admin' in opts
                   _selected_vals = [x.partition(prefix)[-1] for x in _selected]
                   return admin, _selected_vals, _selected
             %>
             <%def name="glob(lbl, val, val_lbl=None, custom_url=None)">
               <tr>
                 <td class="td-tags">
                     ${lbl}
                 </td>
                 <td class="td-tags">
                     %if val[0]:
                       %if not val_lbl:
                           ${h.bool2icon(True)}
                       %else:
                           <span class="perm_tag admin">${val_lbl}.admin</span>
                       %endif
                     %else:
                       %if not val_lbl:
                           ${h.bool2icon({'false': False,
                                          'true': True,
                                          'none': False,
                                          'repository': True}.get(val[1][0] if 0 < len(val[1]) else 'false'))}
                       %else:
                           <span class="perm_tag ${val[1][0]}">${val_lbl}.${val[1][0]}</span>
                       %endif
                     %endif
                 </td>
                 %if actions:
                 <td class="td-action">
                      <a href="${custom_url or h.url('admin_permissions_global')}">${_('edit')}</a>
                 </td>
                 %endif
               </tr>
             </%def>
 
            ${glob(_('Super admin'), get_section_perms('hg.admin', permissions[section]))}
 
            ${glob(_('Repository default permission'), get_section_perms('repository.', permissions[section]), 'repository', h.url('admin_permissions_object'))}
            ${glob(_('Repository group default permission'), get_section_perms('group.', permissions[section]), 'group', h.url('admin_permissions_object'))}
            ${glob(_('User group default permission'), get_section_perms('usergroup.', permissions[section]), 'usergroup', h.url('admin_permissions_object'))}
 
            ${glob(_('Create repositories'), get_section_perms('hg.create.', permissions[section]), custom_url=h.url('admin_permissions_global'))}
            ${glob(_('Fork repositories'), get_section_perms('hg.fork.', permissions[section]), custom_url=h.url('admin_permissions_global'))}
            ${glob(_('Create repository groups'), get_section_perms('hg.repogroup.create.', permissions[section]), custom_url=h.url('admin_permissions_global'))}
            ${glob(_('Create user groups'), get_section_perms('hg.usergroup.create.', permissions[section]), custom_url=h.url('admin_permissions_global'))}
 
 
            </tbody>
           %else:
            ## none/read/write/admin permissions on groups/repos etc
             <thead>
                 <tr>
                 <th>${_('Name')}</th>
                 <th>${_('Permission')}</th>
                 %if actions:
                 <th>${_('Edit Permission')}</th>
                 %endif
             </thead>
             <tbody class="section_${section}">
             <%
                 def sorter(permissions):
                     def custom_sorter(item):
                        ## read/write/admin
                        section = item[1].split('.')[-1]
                        section_importance = {'none': u'0',
                                              'read': u'1',
                                              'write':u'2',
                                              'admin':u'3'}.get(section)
                        ## sort by group importance+name
                        return section_importance+item[0]
                     return sorted(permissions, key=custom_sorter)
             %>
             %for k, section_perm in sorter(permissions[section].items()):
                 %if section_perm.split('.')[-1] != 'none' or show_all:
                 <tr class="perm_row ${'%s_%s' % (section, section_perm.split('.')[-1])}">
                     <td class="td-componentname">
                         %if section == 'repositories':
                             <a href="${h.url('summary_home',repo_name=k)}">${k}</a>
                         %elif section == 'repositories_groups':
                             <a href="${h.url('repo_group_home',group_name=k)}">${k}</a>
                         %elif section == 'user_groups':
                             ##<a href="${h.url('edit_users_group',user_group_id=k)}">${k}</a>
                             ${k}
                         %endif
                     </td>
                     <td class="td-tags">
                       %if hasattr(permissions[section], 'perm_origin_stack'):
                          %for i, (perm, origin) in enumerate(reversed(permissions[section].perm_origin_stack[k])):
                          <span class="${i > 0 and 'perm_overriden' or ''} perm_tag ${perm.split('.')[-1]}">
                           ${perm} (${origin})
                         </span>
                          %endfor
                       %else:
                          <span class="perm_tag ${section_perm.split('.')[-1]}">${section_perm}</span>
                       %endif
                     </td>
                     %if actions:
                     <td class="td-action">
                         %if section == 'repositories':
-                            <a href="${h.url('edit_repo_perms',repo_name=k,anchor='permissions_manage')}">${_('edit')}</a>
+                            <a href="${h.route_path('edit_repo_perms',repo_name=k,anchor='permissions_manage')}">${_('edit')}</a>
                         %elif section == 'repositories_groups':
                             <a href="${h.url('edit_repo_group_perms',group_name=k,anchor='permissions_manage')}">${_('edit')}</a>
                         %elif section == 'user_groups':
                             ##<a href="${h.url('edit_users_group',user_group_id=k)}">${_('edit')}</a>
                         %endif
                     </td>
                     %endif
                 </tr>
                 %endif
             %endfor
 
             <tr id="empty_${section}" class="noborder" style="display:none;">
               <td colspan="6">${_('No permission defined')}</td>
             </tr>
 
             </tbody>
           %endif
          </table>
         </div>
         %endif
       </div>
     </div>
   </div>
   %endfor
 </div>
 
 <script>
     $(document).ready(function(){
         var show_empty = function(section){
             var visible = $('.section_{0} tr.perm_row:visible'.format(section)).length;
             if(visible == 0){
                 $('#empty_{0}'.format(section)).show();
             }
             else{
                 $('#empty_{0}'.format(section)).hide();
             }
         };
         $('.perm_filter').on('change', function(e){
             var self = this;
             var section = $(this).attr('section');
 
             var opts = {};
             var elems = $('.filter_' + section).each(function(el){
                 var perm_type = $(this).attr('perm_type');
                 var checked = this.checked;
                 opts[perm_type] = checked;
                 if(checked){
                     $('.'+section+'_'+perm_type).show();
                 }
                 else{
                     $('.'+section+'_'+perm_type).hide();
                 }
             });
             show_empty(section);
         })
     })
 </script>
 </%def>