pyramid: if possible fetch csrf tokens from pyramid session.

- we need to explicitly pass in requests into secure forms
- allows to not use pylons global session for fetching csrf tokens

rhodecode/lib/helpers.py

@@ -1,2026 +1,2031 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 Helper functions
 
 Consists of functions to typically be used within templates, but also
 available to Controllers. This module is available to both as 'h'.
 """
 
 import random
 import hashlib
 import StringIO
 import urllib
 import math
 import logging
 import re
 import urlparse
 import time
 import string
 import hashlib
 from collections import OrderedDict
 
 import pygments
 import itertools
 import fnmatch
 
 from datetime import datetime
 from functools import partial
 from pygments.formatters.html import HtmlFormatter
 from pygments import highlight as code_highlight
 from pygments.lexers import (
     get_lexer_by_name, get_lexer_for_filename, get_lexer_for_mimetype)
 
 from pyramid.threadlocal import get_current_request
 
 from webhelpers.html import literal, HTML, escape
 from webhelpers.html.tools import *
 from webhelpers.html.builder import make_tag
 from webhelpers.html.tags import auto_discovery_link, checkbox, css_classes, \
     end_form, file, form as wh_form, hidden, image, javascript_link, link_to, \
     link_to_if, link_to_unless, ol, required_legend, select, stylesheet_link, \
     submit, text, password, textarea, title, ul, xml_declaration, radio
 from webhelpers.html.tools import auto_link, button_to, highlight, \
     js_obfuscate, mail_to, strip_links, strip_tags, tag_re
 from webhelpers.pylonslib import Flash as _Flash
 from webhelpers.text import chop_at, collapse, convert_accented_entities, \
     convert_misc_entities, lchop, plural, rchop, remove_formatting, \
     replace_whitespace, urlify, truncate, wrap_paragraphs
 from webhelpers.date import time_ago_in_words
 from webhelpers.paginate import Page as _Page
 from webhelpers.html.tags import _set_input_attrs, _set_id_attr, \
     convert_boolean_attrs, NotGiven, _make_safe_id_component
 from webhelpers2.number import format_byte_size
 
 from rhodecode.lib.action_parser import action_parser
 from rhodecode.lib.ext_json import json
 from rhodecode.lib.utils import repo_name_slug, get_custom_lexer
 from rhodecode.lib.utils2 import str2bool, safe_unicode, safe_str, \
     get_commit_safe, datetime_to_time, time_to_datetime, time_to_utcdatetime, \
     AttributeDict, safe_int, md5, md5_safe
 from rhodecode.lib.markup_renderer import MarkupRenderer, relative_links
 from rhodecode.lib.vcs.exceptions import CommitDoesNotExistError
 from rhodecode.lib.vcs.backends.base import BaseChangeset, EmptyCommit
 from rhodecode.config.conf import DATE_FORMAT, DATETIME_FORMAT
 from rhodecode.model.changeset_status import ChangesetStatusModel
 from rhodecode.model.db import Permission, User, Repository
 from rhodecode.model.repo_group import RepoGroupModel
 from rhodecode.model.settings import IssueTrackerSettingsModel
 
 log = logging.getLogger(__name__)
 
 
 DEFAULT_USER = User.DEFAULT_USER
 DEFAULT_USER_EMAIL = User.DEFAULT_USER_EMAIL
 
 
 def url(*args, **kw):
     from pylons import url as pylons_url
     return pylons_url(*args, **kw)
 
 
 def pylons_url_current(*args, **kw):
     """
     This function overrides pylons.url.current() which returns the current
     path so that it will also work from a pyramid only context. This
     should be removed once port to pyramid is complete.
     """
     from pylons import url as pylons_url
     if not args and not kw:
         request = get_current_request()
         return request.path
     return pylons_url.current(*args, **kw)
 
 url.current = pylons_url_current
 
 
 def url_replace(**qargs):
     """ Returns the current request url while replacing query string args """
 
     request = get_current_request()
     new_args = request.GET.mixed()
     new_args.update(qargs)
     return url('', **new_args)
 
 
 def asset(path, ver=None, **kwargs):
     """
     Helper to generate a static asset file path for rhodecode assets
 
     eg. h.asset('images/image.png', ver='3923')
 
     :param path: path of asset
     :param ver: optional version query param to append as ?ver=
     """
     request = get_current_request()
     query = {}
     query.update(kwargs)
     if ver:
         query = {'ver': ver}
     return request.static_path(
         'rhodecode:public/{}'.format(path), _query=query)
 
 
 default_html_escape_table = {
     ord('&'): u'&amp;',
     ord('<'): u'&lt;',
     ord('>'): u'&gt;',
     ord('"'): u'&quot;',
     ord("'"): u'&#39;',
 }
 
 
 def html_escape(text, html_escape_table=default_html_escape_table):
     """Produce entities within text."""
     return text.translate(html_escape_table)
 
 
 def chop_at_smart(s, sub, inclusive=False, suffix_if_chopped=None):
     """
     Truncate string ``s`` at the first occurrence of ``sub``.
 
     If ``inclusive`` is true, truncate just after ``sub`` rather than at it.
     """
     suffix_if_chopped = suffix_if_chopped or ''
     pos = s.find(sub)
     if pos == -1:
         return s
 
     if inclusive:
         pos += len(sub)
 
     chopped = s[:pos]
     left = s[pos:].strip()
 
     if left and suffix_if_chopped:
         chopped += suffix_if_chopped
 
     return chopped
 
 
 def shorter(text, size=20):
     postfix = '...'
     if len(text) > size:
         return text[:size - len(postfix)] + postfix
     return text
 
 
 def _reset(name, value=None, id=NotGiven, type="reset", **attrs):
     """
     Reset button
     """
     _set_input_attrs(attrs, type, name, value)
     _set_id_attr(attrs, id, name)
     convert_boolean_attrs(attrs, ["disabled"])
     return HTML.input(**attrs)
 
 reset = _reset
 safeid = _make_safe_id_component
 
 
 def branding(name, length=40):
     return truncate(name, length, indicator="")
 
 
 def FID(raw_id, path):
     """
     Creates a unique ID for filenode based on it's hash of path and commit
     it's safe to use in urls
 
     :param raw_id:
     :param path:
     """
 
     return 'c-%s-%s' % (short_id(raw_id), md5_safe(path)[:12])
 
 
 class _GetError(object):
     """Get error from form_errors, and represent it as span wrapped error
     message
 
     :param field_name: field to fetch errors for
     :param form_errors: form errors dict
     """
 
     def __call__(self, field_name, form_errors):
         tmpl = """<span class="error_msg">%s</span>"""
         if form_errors and field_name in form_errors:
             return literal(tmpl % form_errors.get(field_name))
 
 get_error = _GetError()
 
 
 class _ToolTip(object):
 
     def __call__(self, tooltip_title, trim_at=50):
         """
         Special function just to wrap our text into nice formatted
         autowrapped text
 
         :param tooltip_title:
         """
         tooltip_title = escape(tooltip_title)
         tooltip_title = tooltip_title.replace('<', '&lt;').replace('>', '&gt;')
         return tooltip_title
 tooltip = _ToolTip()
 
 
 def files_breadcrumbs(repo_name, commit_id, file_path):
     if isinstance(file_path, str):
         file_path = safe_unicode(file_path)
 
     # TODO: johbo: Is this always a url like path, or is this operating
     # system dependent?
     path_segments = file_path.split('/')
 
     repo_name_html = escape(repo_name)
     if len(path_segments) == 1 and path_segments[0] == '':
         url_segments = [repo_name_html]
     else:
         url_segments = [
             link_to(
                 repo_name_html,
                 url('files_home',
                     repo_name=repo_name,
                     revision=commit_id,
                     f_path=''),
                 class_='pjax-link')]
 
     last_cnt = len(path_segments) - 1
     for cnt, segment in enumerate(path_segments):
         if not segment:
             continue
         segment_html = escape(segment)
 
         if cnt != last_cnt:
             url_segments.append(
                 link_to(
                     segment_html,
                     url('files_home',
                         repo_name=repo_name,
                         revision=commit_id,
                         f_path='/'.join(path_segments[:cnt + 1])),
                     class_='pjax-link'))
         else:
             url_segments.append(segment_html)
 
     return literal('/'.join(url_segments))
 
 
 class CodeHtmlFormatter(HtmlFormatter):
     """
     My code Html Formatter for source codes
     """
 
     def wrap(self, source, outfile):
         return self._wrap_div(self._wrap_pre(self._wrap_code(source)))
 
     def _wrap_code(self, source):
         for cnt, it in enumerate(source):
             i, t = it
             t = '<div id="L%s">%s</div>' % (cnt + 1, t)
             yield i, t
 
     def _wrap_tablelinenos(self, inner):
         dummyoutfile = StringIO.StringIO()
         lncount = 0
         for t, line in inner:
             if t:
                 lncount += 1
             dummyoutfile.write(line)
 
         fl = self.linenostart
         mw = len(str(lncount + fl - 1))
         sp = self.linenospecial
         st = self.linenostep
         la = self.lineanchors
         aln = self.anchorlinenos
         nocls = self.noclasses
         if sp:
             lines = []
 
             for i in range(fl, fl + lncount):
                 if i % st == 0:
                     if i % sp == 0:
                         if aln:
                             lines.append('<a href="#%s%d" class="special">%*d</a>' %
                                          (la, i, mw, i))
                         else:
                             lines.append('<span class="special">%*d</span>' % (mw, i))
                     else:
                         if aln:
                             lines.append('<a href="#%s%d">%*d</a>' % (la, i, mw, i))
                         else:
                             lines.append('%*d' % (mw, i))
                 else:
                     lines.append('')
             ls = '\n'.join(lines)
         else:
             lines = []
             for i in range(fl, fl + lncount):
                 if i % st == 0:
                     if aln:
                         lines.append('<a href="#%s%d">%*d</a>' % (la, i, mw, i))
                     else:
                         lines.append('%*d' % (mw, i))
                 else:
                     lines.append('')
             ls = '\n'.join(lines)
 
         # in case you wonder about the seemingly redundant <div> here: since the
         # content in the other cell also is wrapped in a div, some browsers in
         # some configurations seem to mess up the formatting...
         if nocls:
             yield 0, ('<table class="%stable">' % self.cssclass +
                       '<tr><td><div class="linenodiv" '
                       'style="background-color: #f0f0f0; padding-right: 10px">'
                       '<pre style="line-height: 125%">' +
                       ls + '</pre></div></td><td id="hlcode" class="code">')
         else:
             yield 0, ('<table class="%stable">' % self.cssclass +
                       '<tr><td class="linenos"><div class="linenodiv"><pre>' +
                       ls + '</pre></div></td><td id="hlcode" class="code">')
         yield 0, dummyoutfile.getvalue()
         yield 0, '</td></tr></table>'
 
 
 class SearchContentCodeHtmlFormatter(CodeHtmlFormatter):
     def __init__(self, **kw):
         # only show these line numbers if set
         self.only_lines = kw.pop('only_line_numbers', [])
         self.query_terms = kw.pop('query_terms', [])
         self.max_lines = kw.pop('max_lines', 5)
         self.line_context = kw.pop('line_context', 3)
         self.url = kw.pop('url', None)
 
         super(CodeHtmlFormatter, self).__init__(**kw)
 
     def _wrap_code(self, source):
         for cnt, it in enumerate(source):
             i, t = it
             t = '<pre>%s</pre>' % t
             yield i, t
 
     def _wrap_tablelinenos(self, inner):
         yield 0, '<table class="code-highlight %stable">' % self.cssclass
 
         last_shown_line_number = 0
         current_line_number = 1
 
         for t, line in inner:
             if not t:
                 yield t, line
                 continue
 
             if current_line_number in self.only_lines:
                 if last_shown_line_number + 1 != current_line_number:
                     yield 0, '<tr>'
                     yield 0, '<td class="line">...</td>'
                     yield 0, '<td id="hlcode" class="code"></td>'
                     yield 0, '</tr>'
 
                 yield 0, '<tr>'
                 if self.url:
                     yield 0, '<td class="line"><a href="%s#L%i">%i</a></td>' % (
                         self.url, current_line_number, current_line_number)
                 else:
                     yield 0, '<td class="line"><a href="">%i</a></td>' % (
                         current_line_number)
                 yield 0, '<td id="hlcode" class="code">' + line + '</td>'
                 yield 0, '</tr>'
 
                 last_shown_line_number = current_line_number
 
             current_line_number += 1
 
 
         yield 0, '</table>'
 
 
 def extract_phrases(text_query):
     """
     Extracts phrases from search term string making sure phrases
     contained in double quotes are kept together - and discarding empty values
     or fully whitespace values eg.
 
     'some   text "a phrase" more' => ['some', 'text', 'a phrase', 'more']
 
     """
 
     in_phrase = False
     buf = ''
     phrases = []
     for char in text_query:
         if in_phrase:
             if char == '"': # end phrase
                 phrases.append(buf)
                 buf = ''
                 in_phrase = False
                 continue
             else:
                 buf += char
                 continue
         else:
             if char == '"': # start phrase
                 in_phrase = True
                 phrases.append(buf)
                 buf = ''
                 continue
             elif char == ' ':
                 phrases.append(buf)
                 buf = ''
                 continue
             else:
                 buf += char
 
     phrases.append(buf)
     phrases = [phrase.strip() for phrase in phrases if phrase.strip()]
     return phrases
 
 
 def get_matching_offsets(text, phrases):
     """
     Returns a list of string offsets in `text` that the list of `terms` match
 
     >>> get_matching_offsets('some text here', ['some', 'here'])
     [(0, 4), (10, 14)]
 
     """
     offsets = []
     for phrase in phrases:
         for match in re.finditer(phrase, text):
             offsets.append((match.start(), match.end()))
 
     return offsets
 
 
 def normalize_text_for_matching(x):
     """
     Replaces all non alnum characters to spaces and lower cases the string,
     useful for comparing two text strings without punctuation
     """
     return re.sub(r'[^\w]', ' ', x.lower())
 
 
 def get_matching_line_offsets(lines, terms):
     """ Return a set of `lines` indices (starting from 1) matching a
     text search query, along with `context` lines above/below matching lines
 
     :param lines: list of strings representing lines
     :param terms: search term string to match in lines eg. 'some text'
     :param context: number of lines above/below a matching line to add to result
     :param max_lines: cut off for lines of interest
      eg.
 
     text = '''
     words words words
     words words words
     some text some
     words words words
     words words words
     text here what
     '''
     get_matching_line_offsets(text, 'text', context=1)
     {3: [(5, 9)], 6: [(0, 4)]]
 
     """
     matching_lines = {}
     phrases = [normalize_text_for_matching(phrase)
                for phrase in extract_phrases(terms)]
 
     for line_index, line in enumerate(lines, start=1):
         match_offsets = get_matching_offsets(
             normalize_text_for_matching(line), phrases)
         if match_offsets:
             matching_lines[line_index] = match_offsets
 
     return matching_lines
 
 
 def hsv_to_rgb(h, s, v):
     """ Convert hsv color values to rgb """
 
     if s == 0.0:
         return v, v, v
     i = int(h * 6.0)  # XXX assume int() truncates!
     f = (h * 6.0) - i
     p = v * (1.0 - s)
     q = v * (1.0 - s * f)
     t = v * (1.0 - s * (1.0 - f))
     i = i % 6
     if i == 0:
         return v, t, p
     if i == 1:
         return q, v, p
     if i == 2:
         return p, v, t
     if i == 3:
         return p, q, v
     if i == 4:
         return t, p, v
     if i == 5:
         return v, p, q
 
 
 def unique_color_generator(n=10000, saturation=0.10, lightness=0.95):
     """
     Generator for getting n of evenly distributed colors using
     hsv color and golden ratio. It always return same order of colors
 
     :param n: number of colors to generate
     :param saturation: saturation of returned colors
     :param lightness: lightness of returned colors
     :returns: RGB tuple
     """
 
     golden_ratio = 0.618033988749895
     h = 0.22717784590367374
 
     for _ in xrange(n):
         h += golden_ratio
         h %= 1
         HSV_tuple = [h, saturation, lightness]
         RGB_tuple = hsv_to_rgb(*HSV_tuple)
         yield map(lambda x: str(int(x * 256)), RGB_tuple)
 
 
 def color_hasher(n=10000, saturation=0.10, lightness=0.95):
     """
     Returns a function which when called with an argument returns a unique
     color for that argument, eg.
 
     :param n: number of colors to generate
     :param saturation: saturation of returned colors
     :param lightness: lightness of returned colors
     :returns: css RGB string
 
     >>> color_hash = color_hasher()
     >>> color_hash('hello')
     'rgb(34, 12, 59)'
     >>> color_hash('hello')
     'rgb(34, 12, 59)'
     >>> color_hash('other')
     'rgb(90, 224, 159)'
     """
 
     color_dict = {}
     cgenerator = unique_color_generator(
         saturation=saturation, lightness=lightness)
 
     def get_color_string(thing):
         if thing in color_dict:
             col = color_dict[thing]
         else:
             col = color_dict[thing] = cgenerator.next()
         return "rgb(%s)" % (', '.join(col))
 
     return get_color_string
 
 
 def get_lexer_safe(mimetype=None, filepath=None):
     """
     Tries to return a relevant pygments lexer using mimetype/filepath name,
     defaulting to plain text if none could be found
     """
     lexer = None
     try:
         if mimetype:
             lexer = get_lexer_for_mimetype(mimetype)
         if not lexer:
             lexer = get_lexer_for_filename(filepath)
     except pygments.util.ClassNotFound:
         pass
 
     if not lexer:
         lexer = get_lexer_by_name('text')
 
     return lexer
 
 
 def get_lexer_for_filenode(filenode):
     lexer = get_custom_lexer(filenode.extension) or filenode.lexer
     return lexer
 
 
 def pygmentize(filenode, **kwargs):
     """
     pygmentize function using pygments
 
     :param filenode:
     """
     lexer = get_lexer_for_filenode(filenode)
     return literal(code_highlight(filenode.content, lexer,
                                   CodeHtmlFormatter(**kwargs)))
 
 
 def is_following_repo(repo_name, user_id):
     from rhodecode.model.scm import ScmModel
     return ScmModel().is_following_repo(repo_name, user_id)
 
 
 class _Message(object):
     """A message returned by ``Flash.pop_messages()``.
 
     Converting the message to a string returns the message text. Instances
     also have the following attributes:
 
     * ``message``: the message text.
     * ``category``: the category specified when the message was created.
     """
 
     def __init__(self, category, message):
         self.category = category
         self.message = message
 
     def __str__(self):
         return self.message
 
     __unicode__ = __str__
 
     def __html__(self):
         return escape(safe_unicode(self.message))
 
 
 class Flash(_Flash):
 
     def pop_messages(self, request=None):
         """Return all accumulated messages and delete them from the session.
 
         The return value is a list of ``Message`` objects.
         """
         messages = []
 
         if request:
             session = request.session
         else:
             from pylons import session
 
         # Pop the 'old' pylons flash messages. They are tuples of the form
         # (category, message)
         for cat, msg in session.pop(self.session_key, []):
             messages.append(_Message(cat, msg))
 
         # Pop the 'new' pyramid flash messages for each category as list
         # of strings.
         for cat in self.categories:
             for msg in session.pop_flash(queue=cat):
                 messages.append(_Message(cat, msg))
         # Map messages from the default queue to the 'notice' category.
         for msg in session.pop_flash():
             messages.append(_Message('notice', msg))
 
         session.save()
         return messages
 
     def json_alerts(self, request=None):
         payloads = []
         messages = flash.pop_messages(request=request)
         if messages:
             for message in messages:
                 subdata = {}
                 if hasattr(message.message, 'rsplit'):
                     flash_data = message.message.rsplit('|DELIM|', 1)
                     org_message = flash_data[0]
                     if len(flash_data) > 1:
                         subdata = json.loads(flash_data[1])
                 else:
                     org_message = message.message
                 payloads.append({
                     'message': {
                         'message': u'{}'.format(org_message),
                         'level': message.category,
                         'force': True,
                         'subdata': subdata
                     }
                 })
         return json.dumps(payloads)
 
 flash = Flash()
 
 #==============================================================================
 # SCM FILTERS available via h.
 #==============================================================================
 from rhodecode.lib.vcs.utils import author_name, author_email
 from rhodecode.lib.utils2 import credentials_filter, age as _age
 from rhodecode.model.db import User, ChangesetStatus
 
 age = _age
 capitalize = lambda x: x.capitalize()
 email = author_email
 short_id = lambda x: x[:12]
 hide_credentials = lambda x: ''.join(credentials_filter(x))
 
 
 def age_component(datetime_iso, value=None, time_is_local=False):
     title = value or format_date(datetime_iso)
     tzinfo = '+00:00'
 
     # detect if we have a timezone info, otherwise, add it
     if isinstance(datetime_iso, datetime) and not datetime_iso.tzinfo:
         if time_is_local:
             tzinfo = time.strftime("+%H:%M",
                 time.gmtime(
                     (datetime.now() - datetime.utcnow()).seconds + 1
                 )
             )
 
     return literal(
         '<time class="timeago tooltip" '
         'title="{1}{2}" datetime="{0}{2}">{1}</time>'.format(
             datetime_iso, title, tzinfo))
 
 
 def _shorten_commit_id(commit_id):
     from rhodecode import CONFIG
     def_len = safe_int(CONFIG.get('rhodecode_show_sha_length', 12))
     return commit_id[:def_len]
 
 
 def show_id(commit):
     """
     Configurable function that shows ID
     by default it's r123:fffeeefffeee
 
     :param commit: commit instance
     """
     from rhodecode import CONFIG
     show_idx = str2bool(CONFIG.get('rhodecode_show_revision_number', True))
 
     raw_id = _shorten_commit_id(commit.raw_id)
     if show_idx:
         return 'r%s:%s' % (commit.idx, raw_id)
     else:
         return '%s' % (raw_id, )
 
 
 def format_date(date):
     """
     use a standardized formatting for dates used in RhodeCode
 
     :param date: date/datetime object
     :return: formatted date
     """
 
     if date:
         _fmt = "%a, %d %b %Y %H:%M:%S"
         return safe_unicode(date.strftime(_fmt))
 
     return u""
 
 
 class _RepoChecker(object):
 
     def __init__(self, backend_alias):
         self._backend_alias = backend_alias
 
     def __call__(self, repository):
         if hasattr(repository, 'alias'):
             _type = repository.alias
         elif hasattr(repository, 'repo_type'):
             _type = repository.repo_type
         else:
             _type = repository
         return _type == self._backend_alias
 
 is_git = _RepoChecker('git')
 is_hg = _RepoChecker('hg')
 is_svn = _RepoChecker('svn')
 
 
 def get_repo_type_by_name(repo_name):
     repo = Repository.get_by_repo_name(repo_name)
     return repo.repo_type
 
 
 def is_svn_without_proxy(repository):
     if is_svn(repository):
         from rhodecode.model.settings import VcsSettingsModel
         conf = VcsSettingsModel().get_ui_settings_as_config_obj()
         return not str2bool(conf.get('vcs_svn_proxy', 'http_requests_enabled'))
     return False
 
 
 def discover_user(author):
     """
     Tries to discover RhodeCode User based on the autho string. Author string
     is typically `FirstName LastName <[e-mail]>`
     """
 
     # if author is already an instance use it for extraction
     if isinstance(author, User):
         return author
 
     # Valid email in the attribute passed, see if they're in the system
     _email = author_email(author)
     if _email != '':
         user = User.get_by_email(_email, case_insensitive=True, cache=True)
         if user is not None:
             return user
 
     # Maybe it's a username, we try to extract it and fetch by username ?
     _author = author_name(author)
     user = User.get_by_username(_author, case_insensitive=True, cache=True)
     if user is not None:
         return user
 
     return None
 
 
 def email_or_none(author):
     # extract email from the commit string
     _email = author_email(author)
 
     # If we have an email, use it, otherwise
     # see if it contains a username we can get an email from
     if _email != '':
         return _email
     else:
         user = User.get_by_username(
             author_name(author), case_insensitive=True, cache=True)
 
     if user is not None:
             return user.email
 
     # No valid email, not a valid user in the system, none!
     return None
 
 
 def link_to_user(author, length=0, **kwargs):
     user = discover_user(author)
     # user can be None, but if we have it already it means we can re-use it
     # in the person() function, so we save 1 intensive-query
     if user:
         author = user
 
     display_person = person(author, 'username_or_name_or_email')
     if length:
         display_person = shorter(display_person, length)
 
     if user:
         return link_to(
             escape(display_person),
             route_path('user_profile', username=user.username),
             **kwargs)
     else:
         return escape(display_person)
 
 
 def person(author, show_attr="username_and_name"):
     user = discover_user(author)
     if user:
         return getattr(user, show_attr)
     else:
         _author = author_name(author)
         _email = email(author)
         return _author or _email
 
 
 def author_string(email):
     if email:
         user = User.get_by_email(email, case_insensitive=True, cache=True)
         if user:
             if user.first_name or user.last_name:
                 return '%s %s &lt;%s&gt;' % (
                     user.first_name, user.last_name, email)
             else:
                 return email
         else:
             return email
     else:
         return None
 
 
 def person_by_id(id_, show_attr="username_and_name"):
     # attr to return from fetched user
     person_getter = lambda usr: getattr(usr, show_attr)
 
     #maybe it's an ID ?
     if str(id_).isdigit() or isinstance(id_, int):
         id_ = int(id_)
         user = User.get(id_)
         if user is not None:
             return person_getter(user)
     return id_
 
 
 def gravatar_with_user(author, show_disabled=False):
     from rhodecode.lib.utils import PartialRenderer
     _render = PartialRenderer('base/base.mako')
     return _render('gravatar_with_user', author, show_disabled=show_disabled)
 
 
 def desc_stylize(value):
     """
     converts tags from value into html equivalent
 
     :param value:
     """
     if not value:
         return ''
 
     value = re.sub(r'\[see\ \=\>\ *([a-zA-Z0-9\/\=\?\&\ \:\/\.\-]*)\]',
                    '<div class="metatag" tag="see">see =&gt; \\1 </div>', value)
     value = re.sub(r'\[license\ \=\>\ *([a-zA-Z0-9\/\=\?\&\ \:\/\.\-]*)\]',
                    '<div class="metatag" tag="license"><a href="http:\/\/www.opensource.org/licenses/\\1">\\1</a></div>', value)
     value = re.sub(r'\[(requires|recommends|conflicts|base)\ \=\>\ *([a-zA-Z0-9\-\/]*)\]',
                    '<div class="metatag" tag="\\1">\\1 =&gt; <a href="/\\2">\\2</a></div>', value)
     value = re.sub(r'\[(lang|language)\ \=\>\ *([a-zA-Z\-\/\#\+]*)\]',
                    '<div class="metatag" tag="lang">\\2</div>', value)
     value = re.sub(r'\[([a-z]+)\]',
                    '<div class="metatag" tag="\\1">\\1</div>', value)
 
     return value
 
 
 def escaped_stylize(value):
     """
     converts tags from value into html equivalent, but escaping its value first
     """
     if not value:
         return ''
 
     # Using default webhelper escape method, but has to force it as a
     # plain unicode instead of a markup tag to be used in regex expressions
     value = unicode(escape(safe_unicode(value)))
 
     value = re.sub(r'\[see\ \=\&gt;\ *([a-zA-Z0-9\/\=\?\&amp;\ \:\/\.\-]*)\]',
                    '<div class="metatag" tag="see">see =&gt; \\1 </div>', value)
     value = re.sub(r'\[license\ \=\&gt;\ *([a-zA-Z0-9\/\=\?\&amp;\ \:\/\.\-]*)\]',
                    '<div class="metatag" tag="license"><a href="http:\/\/www.opensource.org/licenses/\\1">\\1</a></div>', value)
     value = re.sub(r'\[(requires|recommends|conflicts|base)\ \=\&gt;\ *([a-zA-Z0-9\-\/]*)\]',
                    '<div class="metatag" tag="\\1">\\1 =&gt; <a href="/\\2">\\2</a></div>', value)
     value = re.sub(r'\[(lang|language)\ \=\&gt;\ *([a-zA-Z\-\/\#\+]*)\]',
                    '<div class="metatag" tag="lang">\\2</div>', value)
     value = re.sub(r'\[([a-z]+)\]',
                    '<div class="metatag" tag="\\1">\\1</div>', value)
 
     return value
 
 
 def bool2icon(value):
     """
     Returns boolean value of a given value, represented as html element with
     classes that will represent icons
 
     :param value: given value to convert to html node
     """
 
     if value:  # does bool conversion
         return HTML.tag('i', class_="icon-true")
     else:  # not true as bool
         return HTML.tag('i', class_="icon-false")
 
 
 #==============================================================================
 # PERMS
 #==============================================================================
 from rhodecode.lib.auth import HasPermissionAny, HasPermissionAll, \
 HasRepoPermissionAny, HasRepoPermissionAll, HasRepoGroupPermissionAll, \
 HasRepoGroupPermissionAny, HasRepoPermissionAnyApi, get_csrf_token, \
 csrf_token_key
 
 
 #==============================================================================
 # GRAVATAR URL
 #==============================================================================
 class InitialsGravatar(object):
     def __init__(self, email_address, first_name, last_name, size=30,
                  background=None, text_color='#fff'):
         self.size = size
         self.first_name = first_name
         self.last_name = last_name
         self.email_address = email_address
         self.background = background or self.str2color(email_address)
         self.text_color = text_color
 
     def get_color_bank(self):
         """
         returns a predefined list of colors that gravatars can use.
         Those are randomized distinct colors that guarantee readability and
         uniqueness.
 
         generated with: http://phrogz.net/css/distinct-colors.html
         """
         return [
             '#bf3030', '#a67f53', '#00ff00', '#5989b3', '#392040', '#d90000',
             '#402910', '#204020', '#79baf2', '#a700b3', '#bf6060', '#7f5320',
             '#008000', '#003059', '#ee00ff', '#ff0000', '#8c4b00', '#007300',
             '#005fb3', '#de73e6', '#ff4040', '#ffaa00', '#3df255', '#203140',
             '#47004d', '#591616', '#664400', '#59b365', '#0d2133', '#83008c',
             '#592d2d', '#bf9f60', '#73e682', '#1d3f73', '#73006b', '#402020',
             '#b2862d', '#397341', '#597db3', '#e600d6', '#a60000', '#736039',
             '#00b318', '#79aaf2', '#330d30', '#ff8080', '#403010', '#16591f',
             '#002459', '#8c4688', '#e50000', '#ffbf40', '#00732e', '#102340',
             '#bf60ac', '#8c4646', '#cc8800', '#00a642', '#1d3473', '#b32d98',
             '#660e00', '#ffd580', '#80ffb2', '#7391e6', '#733967', '#d97b6c',
             '#8c5e00', '#59b389', '#3967e6', '#590047', '#73281d', '#665200',
             '#00e67a', '#2d50b3', '#8c2377', '#734139', '#b2982d', '#16593a',
             '#001859', '#ff00aa', '#a65e53', '#ffcc00', '#0d3321', '#2d3959',
             '#731d56', '#401610', '#4c3d00', '#468c6c', '#002ca6', '#d936a3',
             '#d94c36', '#403920', '#36d9a3', '#0d1733', '#592d4a', '#993626',
             '#cca300', '#00734d', '#46598c', '#8c005e', '#7f1100', '#8c7000',
             '#00a66f', '#7382e6', '#b32d74', '#d9896c', '#ffe680', '#1d7362',
             '#364cd9', '#73003d', '#d93a00', '#998a4d', '#59b3a1', '#5965b3',
             '#e5007a', '#73341d', '#665f00', '#00b38f', '#0018b3', '#59163a',
             '#b2502d', '#bfb960', '#00ffcc', '#23318c', '#a6537f', '#734939',
             '#b2a700', '#104036', '#3d3df2', '#402031', '#e56739', '#736f39',
             '#79f2ea', '#000059', '#401029', '#4c1400', '#ffee00', '#005953',
             '#101040', '#990052', '#402820', '#403d10', '#00ffee', '#0000d9',
             '#ff80c4', '#a66953', '#eeff00', '#00ccbe', '#8080ff', '#e673a1',
             '#a62c00', '#474d00', '#1a3331', '#46468c', '#733950', '#662900',
             '#858c23', '#238c85', '#0f0073', '#b20047', '#d9986c', '#becc00',
             '#396f73', '#281d73', '#ff0066', '#ff6600', '#dee673', '#59adb3',
             '#6559b3', '#590024', '#b2622d', '#98b32d', '#36ced9', '#332d59',
             '#40001a', '#733f1d', '#526600', '#005359', '#242040', '#bf6079',
             '#735039', '#cef23d', '#007780', '#5630bf', '#66001b', '#b24700',
             '#acbf60', '#1d6273', '#25008c', '#731d34', '#a67453', '#50592d',
             '#00ccff', '#6600ff', '#ff0044', '#4c1f00', '#8a994d', '#79daf2',
             '#a173e6', '#d93662', '#402310', '#aaff00', '#2d98b3', '#8c40ff',
             '#592d39', '#ff8c40', '#354020', '#103640', '#1a0040', '#331a20',
             '#331400', '#334d00', '#1d5673', '#583973', '#7f0022', '#4c3626',
             '#88cc00', '#36a3d9', '#3d0073', '#d9364c', '#33241a', '#698c23',
             '#5995b3', '#300059', '#e57382', '#7f3300', '#366600', '#00aaff',
             '#3a1659', '#733941', '#663600', '#74b32d', '#003c59', '#7f53a6',
             '#73000f', '#ff8800', '#baf279', '#79caf2', '#291040', '#a6293a',
             '#b2742d', '#587339', '#0077b3', '#632699', '#400009', '#d9a66c',
             '#294010', '#2d4a59', '#aa00ff', '#4c131b', '#b25f00', '#5ce600',
             '#267399', '#a336d9', '#990014', '#664e33', '#86bf60', '#0088ff',
             '#7700b3', '#593a16', '#073300', '#1d4b73', '#ac60bf', '#e59539',
             '#4f8c46', '#368dd9', '#5c0073'
         ]
 
     def rgb_to_hex_color(self, rgb_tuple):
         """
         Converts an rgb_tuple passed to an hex color.
 
         :param rgb_tuple: tuple with 3 ints represents rgb color space
         """
         return '#' + ("".join(map(chr, rgb_tuple)).encode('hex'))
 
     def email_to_int_list(self, email_str):
         """
         Get every byte of the hex digest value of email and turn it to integer.
         It's going to be always between 0-255
         """
         digest = md5_safe(email_str.lower())
         return [int(digest[i * 2:i * 2 + 2], 16) for i in range(16)]
 
     def pick_color_bank_index(self, email_str, color_bank):
         return self.email_to_int_list(email_str)[0] % len(color_bank)
 
     def str2color(self, email_str):
         """
         Tries to map in a stable algorithm an email to color
 
         :param email_str:
         """
         color_bank = self.get_color_bank()
         # pick position (module it's length so we always find it in the
         # bank even if it's smaller than 256 values
         pos = self.pick_color_bank_index(email_str, color_bank)
         return color_bank[pos]
 
     def normalize_email(self, email_address):
         import unicodedata
         # default host used to fill in the fake/missing email
         default_host = u'localhost'
 
         if not email_address:
             email_address = u'%s@%s' % (User.DEFAULT_USER, default_host)
 
         email_address = safe_unicode(email_address)
 
         if u'@' not in email_address:
             email_address = u'%s@%s' % (email_address, default_host)
 
         if email_address.endswith(u'@'):
             email_address = u'%s%s' % (email_address, default_host)
 
         email_address = unicodedata.normalize('NFKD', email_address)\
             .encode('ascii', 'ignore')
         return email_address
 
     def get_initials(self):
         """
         Returns 2 letter initials calculated based on the input.
         The algorithm picks first given email address, and takes first letter
         of part before @, and then the first letter of server name. In case
         the part before @ is in a format of `somestring.somestring2` it replaces
         the server letter with first letter of somestring2
 
         In case function was initialized with both first and lastname, this
         overrides the extraction from email by first letter of the first and
         last name. We add special logic to that functionality, In case Full name
         is compound, like Guido Von Rossum, we use last part of the last name
         (Von Rossum) picking `R`.
 
         Function also normalizes the non-ascii characters to they ascii
         representation, eg Ą => A
         """
         import unicodedata
         # replace non-ascii to ascii
         first_name = unicodedata.normalize(
             'NFKD', safe_unicode(self.first_name)).encode('ascii', 'ignore')
         last_name = unicodedata.normalize(
             'NFKD', safe_unicode(self.last_name)).encode('ascii', 'ignore')
 
         # do NFKD encoding, and also make sure email has proper format
         email_address = self.normalize_email(self.email_address)
 
         # first push the email initials
         prefix, server = email_address.split('@', 1)
 
         # check if prefix is maybe a 'first_name.last_name' syntax
         _dot_split = prefix.rsplit('.', 1)
         if len(_dot_split) == 2:
             initials = [_dot_split[0][0], _dot_split[1][0]]
         else:
             initials = [prefix[0], server[0]]
 
         # then try to replace either first_name or last_name
         fn_letter = (first_name or " ")[0].strip()
         ln_letter = (last_name.split(' ', 1)[-1] or " ")[0].strip()
 
         if fn_letter:
             initials[0] = fn_letter
 
         if ln_letter:
             initials[1] = ln_letter
 
         return ''.join(initials).upper()
 
     def get_img_data_by_type(self, font_family, img_type):
         default_user = """
         <svg xmlns="http://www.w3.org/2000/svg"
         version="1.1" x="0px" y="0px" width="{size}" height="{size}"
         viewBox="-15 -10 439.165 429.164"
 
         xml:space="preserve"
         style="background:{background};" >
 
         <path d="M204.583,216.671c50.664,0,91.74-48.075,
                  91.74-107.378c0-82.237-41.074-107.377-91.74-107.377
                  c-50.668,0-91.74,25.14-91.74,107.377C112.844,
                  168.596,153.916,216.671,
                  204.583,216.671z" fill="{text_color}"/>
         <path d="M407.164,374.717L360.88,
                  270.454c-2.117-4.771-5.836-8.728-10.465-11.138l-71.83-37.392
                  c-1.584-0.823-3.502-0.663-4.926,0.415c-20.316,
                  15.366-44.203,23.488-69.076,23.488c-24.877,
                  0-48.762-8.122-69.078-23.488
                  c-1.428-1.078-3.346-1.238-4.93-0.415L58.75,
                  259.316c-4.631,2.41-8.346,6.365-10.465,11.138L2.001,374.717
                  c-3.191,7.188-2.537,15.412,1.75,22.005c4.285,
                  6.592,11.537,10.526,19.4,10.526h362.861c7.863,0,15.117-3.936,
                  19.402-10.527 C409.699,390.129,
                  410.355,381.902,407.164,374.717z" fill="{text_color}"/>
         </svg>""".format(
             size=self.size,
             background='#979797',  # @grey4
             text_color=self.text_color,
             font_family=font_family)
 
         return {
             "default_user": default_user
         }[img_type]
 
     def get_img_data(self, svg_type=None):
         """
         generates the svg metadata for image
         """
 
         font_family = ','.join([
             'proximanovaregular',
             'Proxima Nova Regular',
             'Proxima Nova',
             'Arial',
             'Lucida Grande',
             'sans-serif'
             ])
         if svg_type:
             return self.get_img_data_by_type(font_family, svg_type)
 
         initials = self.get_initials()
         img_data = """
         <svg xmlns="http://www.w3.org/2000/svg" pointer-events="none"
              width="{size}" height="{size}"
              style="width: 100%; height: 100%; background-color: {background}"
              viewBox="0 0 {size} {size}">
             <text text-anchor="middle" y="50%" x="50%" dy="0.35em"
                   pointer-events="auto" fill="{text_color}"
                   font-family="{font_family}"
                   style="font-weight: 400; font-size: {f_size}px;">{text}
             </text>
         </svg>""".format(
             size=self.size,
             f_size=self.size/1.85,  # scale the text inside the box nicely
             background=self.background,
             text_color=self.text_color,
             text=initials.upper(),
             font_family=font_family)
 
         return img_data
 
     def generate_svg(self, svg_type=None):
         img_data = self.get_img_data(svg_type)
         return "data:image/svg+xml;base64,%s" % img_data.encode('base64')
 
 
 def initials_gravatar(email_address, first_name, last_name, size=30):
     svg_type = None
     if email_address == User.DEFAULT_USER_EMAIL:
         svg_type = 'default_user'
     klass = InitialsGravatar(email_address, first_name, last_name, size)
     return klass.generate_svg(svg_type=svg_type)
 
 
 def gravatar_url(email_address, size=30, request=None):
     request = get_current_request()
     if request and hasattr(request, 'call_context'):
         _use_gravatar = request.call_context.visual.use_gravatar
         _gravatar_url = request.call_context.visual.gravatar_url
     else:
         # doh, we need to re-import those to mock it later
         from pylons import tmpl_context as c
 
         _use_gravatar = c.visual.use_gravatar
         _gravatar_url = c.visual.gravatar_url
 
     _gravatar_url = _gravatar_url or User.DEFAULT_GRAVATAR_URL
 
     email_address = email_address or User.DEFAULT_USER_EMAIL
     if isinstance(email_address, unicode):
         # hashlib crashes on unicode items
         email_address = safe_str(email_address)
 
     # empty email or default user
     if not email_address or email_address == User.DEFAULT_USER_EMAIL:
         return initials_gravatar(User.DEFAULT_USER_EMAIL, '', '', size=size)
 
     if _use_gravatar:
         # TODO: Disuse pyramid thread locals. Think about another solution to
         # get the host and schema here.
         request = get_current_request()
         tmpl = safe_str(_gravatar_url)
         tmpl = tmpl.replace('{email}', email_address)\
                    .replace('{md5email}', md5_safe(email_address.lower())) \
                    .replace('{netloc}', request.host)\
                    .replace('{scheme}', request.scheme)\
                    .replace('{size}', safe_str(size))
         return tmpl
     else:
         return initials_gravatar(email_address, '', '', size=size)
 
 
 class Page(_Page):
     """
     Custom pager to match rendering style with paginator
     """
 
     def _get_pos(self, cur_page, max_page, items):
         edge = (items / 2) + 1
         if (cur_page <= edge):
             radius = max(items / 2, items - cur_page)
         elif (max_page - cur_page) < edge:
             radius = (items - 1) - (max_page - cur_page)
         else:
             radius = items / 2
 
         left = max(1, (cur_page - (radius)))
         right = min(max_page, cur_page + (radius))
         return left, cur_page, right
 
     def _range(self, regexp_match):
         """
         Return range of linked pages (e.g. '1 2 [3] 4 5 6 7 8').
 
         Arguments:
 
         regexp_match
             A "re" (regular expressions) match object containing the
             radius of linked pages around the current page in
             regexp_match.group(1) as a string
 
         This function is supposed to be called as a callable in
         re.sub.
 
         """
         radius = int(regexp_match.group(1))
 
         # Compute the first and last page number within the radius
         # e.g. '1 .. 5 6 [7] 8 9 .. 12'
         # -> leftmost_page  = 5
         # -> rightmost_page = 9
         leftmost_page, _cur, rightmost_page = self._get_pos(self.page,
                                                             self.last_page,
                                                             (radius * 2) + 1)
         nav_items = []
 
         # Create a link to the first page (unless we are on the first page
         # or there would be no need to insert '..' spacers)
         if self.page != self.first_page and self.first_page < leftmost_page:
             nav_items.append(self._pagerlink(self.first_page, self.first_page))
 
         # Insert dots if there are pages between the first page
         # and the currently displayed page range
         if leftmost_page - self.first_page > 1:
             # Wrap in a SPAN tag if nolink_attr is set
             text = '..'
             if self.dotdot_attr:
                 text = HTML.span(c=text, **self.dotdot_attr)
             nav_items.append(text)
 
         for thispage in xrange(leftmost_page, rightmost_page + 1):
             # Hilight the current page number and do not use a link
             if thispage == self.page:
                 text = '%s' % (thispage,)
                 # Wrap in a SPAN tag if nolink_attr is set
                 if self.curpage_attr:
                     text = HTML.span(c=text, **self.curpage_attr)
                 nav_items.append(text)
             # Otherwise create just a link to that page
             else:
                 text = '%s' % (thispage,)
                 nav_items.append(self._pagerlink(thispage, text))
 
         # Insert dots if there are pages between the displayed
         # page numbers and the end of the page range
         if self.last_page - rightmost_page > 1:
             text = '..'
             # Wrap in a SPAN tag if nolink_attr is set
             if self.dotdot_attr:
                 text = HTML.span(c=text, **self.dotdot_attr)
             nav_items.append(text)
 
         # Create a link to the very last page (unless we are on the last
         # page or there would be no need to insert '..' spacers)
         if self.page != self.last_page and rightmost_page < self.last_page:
             nav_items.append(self._pagerlink(self.last_page, self.last_page))
 
         ## prerender links
         #_page_link = url.current()
         #nav_items.append(literal('<link rel="prerender" href="%s?page=%s">' % (_page_link, str(int(self.page)+1))))
         #nav_items.append(literal('<link rel="prefetch" href="%s?page=%s">' % (_page_link, str(int(self.page)+1))))
         return self.separator.join(nav_items)
 
     def pager(self, format='~2~', page_param='page', partial_param='partial',
         show_if_single_page=False, separator=' ', onclick=None,
         symbol_first='<<', symbol_last='>>',
         symbol_previous='<', symbol_next='>',
         link_attr={'class': 'pager_link', 'rel': 'prerender'},
         curpage_attr={'class': 'pager_curpage'},
         dotdot_attr={'class': 'pager_dotdot'}, **kwargs):
 
         self.curpage_attr = curpage_attr
         self.separator = separator
         self.pager_kwargs = kwargs
         self.page_param = page_param
         self.partial_param = partial_param
         self.onclick = onclick
         self.link_attr = link_attr
         self.dotdot_attr = dotdot_attr
 
         # Don't show navigator if there is no more than one page
         if self.page_count == 0 or (self.page_count == 1 and not show_if_single_page):
             return ''
 
         from string import Template
         # Replace ~...~ in token format by range of pages
         result = re.sub(r'~(\d+)~', self._range, format)
 
         # Interpolate '%' variables
         result = Template(result).safe_substitute({
             'first_page': self.first_page,
             'last_page': self.last_page,
             'page': self.page,
             'page_count': self.page_count,
             'items_per_page': self.items_per_page,
             'first_item': self.first_item,
             'last_item': self.last_item,
             'item_count': self.item_count,
             'link_first': self.page > self.first_page and \
                     self._pagerlink(self.first_page, symbol_first) or '',
             'link_last': self.page < self.last_page and \
                     self._pagerlink(self.last_page, symbol_last) or '',
             'link_previous': self.previous_page and \
                     self._pagerlink(self.previous_page, symbol_previous) \
                     or HTML.span(symbol_previous, class_="pg-previous disabled"),
             'link_next': self.next_page and \
                     self._pagerlink(self.next_page, symbol_next) \
                     or HTML.span(symbol_next, class_="pg-next disabled")
         })
 
         return literal(result)
 
 
 #==============================================================================
 # REPO PAGER, PAGER FOR REPOSITORY
 #==============================================================================
 class RepoPage(Page):
 
     def __init__(self, collection, page=1, items_per_page=20,
                  item_count=None, url=None, **kwargs):
 
         """Create a "RepoPage" instance. special pager for paging
         repository
         """
         self._url_generator = url
 
         # Safe the kwargs class-wide so they can be used in the pager() method
         self.kwargs = kwargs
 
         # Save a reference to the collection
         self.original_collection = collection
 
         self.collection = collection
 
         # The self.page is the number of the current page.
         # The first page has the number 1!
         try:
             self.page = int(page)  # make it int() if we get it as a string
         except (ValueError, TypeError):
             self.page = 1
 
         self.items_per_page = items_per_page
 
         # Unless the user tells us how many items the collections has
         # we calculate that ourselves.
         if item_count is not None:
             self.item_count = item_count
         else:
             self.item_count = len(self.collection)
 
         # Compute the number of the first and last available page
         if self.item_count > 0:
             self.first_page = 1
             self.page_count = int(math.ceil(float(self.item_count) /
                                             self.items_per_page))
             self.last_page = self.first_page + self.page_count - 1
 
             # Make sure that the requested page number is the range of
             # valid pages
             if self.page > self.last_page:
                 self.page = self.last_page
             elif self.page < self.first_page:
                 self.page = self.first_page
 
             # Note: the number of items on this page can be less than
             #       items_per_page if the last page is not full
             self.first_item = max(0, (self.item_count) - (self.page *
                                                           items_per_page))
             self.last_item = ((self.item_count - 1) - items_per_page *
                               (self.page - 1))
 
             self.items = list(self.collection[self.first_item:self.last_item + 1])
 
             # Links to previous and next page
             if self.page > self.first_page:
                 self.previous_page = self.page - 1
             else:
                 self.previous_page = None
 
             if self.page < self.last_page:
                 self.next_page = self.page + 1
             else:
                 self.next_page = None
 
         # No items available
         else:
             self.first_page = None
             self.page_count = 0
             self.last_page = None
             self.first_item = None
             self.last_item = None
             self.previous_page = None
             self.next_page = None
             self.items = []
 
         # This is a subclass of the 'list' type. Initialise the list now.
         list.__init__(self, reversed(self.items))
 
 
 def breadcrumb_repo_link(repo):
     """
     Makes a breadcrumbs path link to repo
 
     ex::
         group >> subgroup >> repo
 
     :param repo: a Repository instance
     """
 
     path = [
         link_to(group.name, route_path('repo_group_home', repo_group_name=group.group_name))
         for group in repo.groups_with_parents
     ] + [
         link_to(repo.just_name, route_path('repo_summary', repo_name=repo.repo_name))
     ]
 
     return literal(' &raquo; '.join(path))
 
 
 def format_byte_size_binary(file_size):
     """
     Formats file/folder sizes to standard.
     """
     formatted_size = format_byte_size(file_size, binary=True)
     return formatted_size
 
 
 def urlify_text(text_, safe=True):
     """
     Extrac urls from text and make html links out of them
 
     :param text_:
     """
 
     url_pat = re.compile(r'''(http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@#.&+]'''
                          '''|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+)''')
 
     def url_func(match_obj):
         url_full = match_obj.groups()[0]
         return '<a href="%(url)s">%(url)s</a>' % ({'url': url_full})
     _newtext = url_pat.sub(url_func, text_)
     if safe:
         return literal(_newtext)
     return _newtext
 
 
 def urlify_commits(text_, repository):
     """
     Extract commit ids from text and make link from them
 
     :param text_:
     :param repository: repo name to build the URL with
     """
     from pylons import url  # doh, we need to re-import url to mock it later
     URL_PAT = re.compile(r'(^|\s)([0-9a-fA-F]{12,40})($|\s)')
 
     def url_func(match_obj):
         commit_id = match_obj.groups()[1]
         pref = match_obj.groups()[0]
         suf = match_obj.groups()[2]
 
         tmpl = (
             '%(pref)s<a class="%(cls)s" href="%(url)s">'
             '%(commit_id)s</a>%(suf)s'
         )
         return tmpl % {
             'pref': pref,
             'cls': 'revision-link',
             'url': url('changeset_home', repo_name=repository,
                        revision=commit_id, qualified=True),
             'commit_id': commit_id,
             'suf': suf
         }
 
     newtext = URL_PAT.sub(url_func, text_)
 
     return newtext
 
 
 def _process_url_func(match_obj, repo_name, uid, entry,
                       return_raw_data=False, link_format='html'):
     pref = ''
     if match_obj.group().startswith(' '):
         pref = ' '
 
     issue_id = ''.join(match_obj.groups())
 
     if link_format == 'html':
         tmpl = (
             '%(pref)s<a class="%(cls)s" href="%(url)s">'
             '%(issue-prefix)s%(id-repr)s'
             '</a>')
     elif link_format == 'rst':
         tmpl = '`%(issue-prefix)s%(id-repr)s <%(url)s>`_'
     elif link_format == 'markdown':
         tmpl = '[%(issue-prefix)s%(id-repr)s](%(url)s)'
     else:
         raise ValueError('Bad link_format:{}'.format(link_format))
 
     (repo_name_cleaned,
      parent_group_name) = RepoGroupModel().\
         _get_group_name_and_parent(repo_name)
 
     # variables replacement
     named_vars = {
         'id': issue_id,
         'repo': repo_name,
         'repo_name': repo_name_cleaned,
         'group_name': parent_group_name
     }
     # named regex variables
     named_vars.update(match_obj.groupdict())
     _url = string.Template(entry['url']).safe_substitute(**named_vars)
 
     data = {
         'pref': pref,
         'cls': 'issue-tracker-link',
         'url': _url,
         'id-repr': issue_id,
         'issue-prefix': entry['pref'],
         'serv': entry['url'],
     }
     if return_raw_data:
         return {
             'id': issue_id,
             'url': _url
         }
     return tmpl % data
 
 
 def process_patterns(text_string, repo_name, link_format='html'):
     allowed_formats = ['html', 'rst', 'markdown']
     if link_format not in allowed_formats:
         raise ValueError('Link format can be only one of:{} got {}'.format(
                          allowed_formats, link_format))
 
     repo = None
     if repo_name:
         # Retrieving repo_name to avoid invalid repo_name to explode on
         # IssueTrackerSettingsModel but still passing invalid name further down
         repo = Repository.get_by_repo_name(repo_name, cache=True)
 
     settings_model = IssueTrackerSettingsModel(repo=repo)
     active_entries = settings_model.get_settings(cache=True)
 
     issues_data = []
     newtext = text_string
 
     for uid, entry in active_entries.items():
         log.debug('found issue tracker entry with uid %s' % (uid,))
 
         if not (entry['pat'] and entry['url']):
             log.debug('skipping due to missing data')
             continue
 
         log.debug('issue tracker entry: uid: `%s` PAT:%s URL:%s PREFIX:%s'
                   % (uid, entry['pat'], entry['url'], entry['pref']))
 
         try:
             pattern = re.compile(r'%s' % entry['pat'])
         except re.error:
             log.exception(
                 'issue tracker pattern: `%s` failed to compile',
                 entry['pat'])
             continue
 
         data_func = partial(
             _process_url_func, repo_name=repo_name, entry=entry, uid=uid,
             return_raw_data=True)
 
         for match_obj in pattern.finditer(text_string):
             issues_data.append(data_func(match_obj))
 
         url_func = partial(
             _process_url_func, repo_name=repo_name, entry=entry, uid=uid,
             link_format=link_format)
 
         newtext = pattern.sub(url_func, newtext)
         log.debug('processed prefix:uid `%s`' % (uid,))
 
     return newtext, issues_data
 
 
 def urlify_commit_message(commit_text, repository=None):
     """
     Parses given text message and makes proper links.
     issues are linked to given issue-server, and rest is a commit link
 
     :param commit_text:
     :param repository:
     """
     from pylons import url  # doh, we need to re-import url to mock it later
 
     def escaper(string):
         return string.replace('<', '&lt;').replace('>', '&gt;')
 
     newtext = escaper(commit_text)
 
     # extract http/https links and make them real urls
     newtext = urlify_text(newtext, safe=False)
 
     # urlify commits - extract commit ids and make link out of them, if we have
     # the scope of repository present.
     if repository:
         newtext = urlify_commits(newtext, repository)
 
     # process issue tracker patterns
     newtext, issues = process_patterns(newtext, repository or '')
 
     return literal(newtext)
 
 
 def render_binary(repo_name, file_obj):
     """
     Choose how to render a binary file
     """
     filename = file_obj.name
 
     # images
     for ext in ['*.png', '*.jpg', '*.ico', '*.gif']:
         if fnmatch.fnmatch(filename, pat=ext):
             alt = filename
             src = url('files_raw_home', repo_name=repo_name,
                       revision=file_obj.commit.raw_id, f_path=file_obj.path)
             return literal('<img class="rendered-binary" alt="{}" src="{}">'.format(alt, src))
 
 
 def renderer_from_filename(filename, exclude=None):
     """
     choose a renderer based on filename, this works only for text based files
     """
 
     # ipython
     for ext in ['*.ipynb']:
         if fnmatch.fnmatch(filename, pat=ext):
             return 'jupyter'
 
     is_markup = MarkupRenderer.renderer_from_filename(filename, exclude=exclude)
     if is_markup:
         return is_markup
     return None
 
 
 def render(source, renderer='rst', mentions=False, relative_url=None,
            repo_name=None):
 
     def maybe_convert_relative_links(html_source):
         if relative_url:
             return relative_links(html_source, relative_url)
         return html_source
 
     if renderer == 'rst':
         if repo_name:
             # process patterns on comments if we pass in repo name
             source, issues = process_patterns(
                 source, repo_name, link_format='rst')
 
         return literal(
             '<div class="rst-block">%s</div>' %
             maybe_convert_relative_links(
                 MarkupRenderer.rst(source, mentions=mentions)))
     elif renderer == 'markdown':
         if repo_name:
             # process patterns on comments if we pass in repo name
             source, issues = process_patterns(
                 source, repo_name, link_format='markdown')
 
         return literal(
             '<div class="markdown-block">%s</div>' %
             maybe_convert_relative_links(
                 MarkupRenderer.markdown(source, flavored=True,
                                         mentions=mentions)))
     elif renderer == 'jupyter':
         return literal(
             '<div class="ipynb">%s</div>' %
             maybe_convert_relative_links(
                 MarkupRenderer.jupyter(source)))
 
     # None means just show the file-source
     return None
 
 
 def commit_status(repo, commit_id):
     return ChangesetStatusModel().get_status(repo, commit_id)
 
 
 def commit_status_lbl(commit_status):
     return dict(ChangesetStatus.STATUSES).get(commit_status)
 
 
 def commit_time(repo_name, commit_id):
     repo = Repository.get_by_repo_name(repo_name)
     commit = repo.get_commit(commit_id=commit_id)
     return commit.date
 
 
 def get_permission_name(key):
     return dict(Permission.PERMS).get(key)
 
 
 def journal_filter_help(request):
     _ = request.translate
 
     return _(
         'Example filter terms:\n' +
         '     repository:vcs\n' +
         '     username:marcin\n' +
         '     username:(NOT marcin)\n' +
         '     action:*push*\n' +
         '     ip:127.0.0.1\n' +
         '     date:20120101\n' +
         '     date:[20120101100000 TO 20120102]\n' +
         '\n' +
         'Generate wildcards using \'*\' character:\n' +
         '     "repository:vcs*" - search everything starting with \'vcs\'\n' +
         '     "repository:*vcs*" - search for repository containing \'vcs\'\n' +
         '\n' +
         'Optional AND / OR operators in queries\n' +
         '     "repository:vcs OR repository:test"\n' +
         '     "username:test AND repository:test*"\n'
     )
 
 
 def search_filter_help(searcher, request):
     _ = request.translate
 
     terms = ''
     return _(
         'Example filter terms for `{searcher}` search:\n' +
         '{terms}\n' +
         'Generate wildcards using \'*\' character:\n' +
         '     "repo_name:vcs*" - search everything starting with \'vcs\'\n' +
         '     "repo_name:*vcs*" - search for repository containing \'vcs\'\n' +
         '\n' +
         'Optional AND / OR operators in queries\n' +
         '     "repo_name:vcs OR repo_name:test"\n' +
         '     "owner:test AND repo_name:test*"\n' +
         'More: {search_doc}'
     ).format(searcher=searcher.name,
              terms=terms, search_doc=searcher.query_lang_doc)
 
 
 def not_mapped_error(repo_name):
     from rhodecode.translation import _
     flash(_('%s repository is not mapped to db perhaps'
             ' it was created or renamed from the filesystem'
             ' please run the application again'
             ' in order to rescan repositories') % repo_name, category='error')
 
 
 def ip_range(ip_addr):
     from rhodecode.model.db import UserIpMap
     s, e = UserIpMap._get_ip_range(ip_addr)
     return '%s - %s' % (s, e)
 
 
 def form(url, method='post', needs_csrf_token=True, **attrs):
     """Wrapper around webhelpers.tags.form to prevent CSRF attacks."""
     if method.lower() != 'get' and needs_csrf_token:
         raise Exception(
             'Forms to POST/PUT/DELETE endpoints should have (in general) a ' +
             'CSRF token. If the endpoint does not require such token you can ' +
             'explicitly set the parameter needs_csrf_token to false.')
 
     return wh_form(url, method=method, **attrs)
 
 
 def secure_form(url, method="POST", multipart=False, **attrs):
     """Start a form tag that points the action to an url. This
     form tag will also include the hidden field containing
     the auth token.
 
     The url options should be given either as a string, or as a
     ``url()`` function. The method for the form defaults to POST.
 
     Options:
 
     ``multipart``
         If set to True, the enctype is set to "multipart/form-data".
     ``method``
         The method to use when submitting the form, usually either
         "GET" or "POST". If "PUT", "DELETE", or another verb is used, a
         hidden input with name _method is added to simulate the verb
         over POST.
 
     """
     from webhelpers.pylonslib.secure_form import insecure_form
     form = insecure_form(url, method, multipart, **attrs)
-    token = csrf_input()
+
+    session = None
+    # TODO(marcink): after pyramid migration require request variable ALWAYS
+    if 'request' in attrs:
+        session = attrs['request'].session
+
+    token = literal(
+        '<input type="hidden" id="{}" name="{}" value="{}">'.format(
+        csrf_token_key, csrf_token_key, get_csrf_token(session)))
+
     return literal("%s\n%s" % (form, token))
 
-def csrf_input():
-    return literal(
-        '<input type="hidden" id="{}" name="{}" value="{}">'.format(
-        csrf_token_key, csrf_token_key, get_csrf_token()))
 
 def dropdownmenu(name, selected, options, enable_filter=False, **attrs):
     select_html = select(name, selected, options, **attrs)
     select2 = """
         <script>
             $(document).ready(function() {
                   $('#%s').select2({
                       containerCssClass: 'drop-menu',
                       dropdownCssClass: 'drop-menu-dropdown',
                       dropdownAutoWidth: true%s
                   });
             });
         </script>
     """
     filter_option = """,
                         minimumResultsForSearch: -1
     """
     input_id = attrs.get('id') or name
     filter_enabled = "" if enable_filter else filter_option
     select_script = literal(select2 % (input_id, filter_enabled))
 
     return literal(select_html+select_script)
 
 
 def get_visual_attr(tmpl_context_var, attr_name):
     """
     A safe way to get a variable from visual variable of template context
 
     :param tmpl_context_var: instance of tmpl_context, usually present as `c`
     :param attr_name: name of the attribute we fetch from the c.visual
     """
     visual = getattr(tmpl_context_var, 'visual', None)
     if not visual:
         return
     else:
         return getattr(visual, attr_name, None)
 
 
 def get_last_path_part(file_node):
     if not file_node.path:
         return u''
 
     path = safe_unicode(file_node.path.split('/')[-1])
     return u'../' + path
 
 
 def route_url(*args, **kwargs):
     """
     Wrapper around pyramids `route_url` (fully qualified url) function. 
     It is used to generate URLs from within pylons views or templates. 
     This will be removed when pyramid migration if finished.
     """
     req = get_current_request()
     return req.route_url(*args, **kwargs)
 
 
 def route_path(*args, **kwargs):
     """
     Wrapper around pyramids `route_path` function. It is used to generate
     URLs from within pylons views or templates. This will be removed when
     pyramid migration if finished.
     """
     req = get_current_request()
     return req.route_path(*args, **kwargs)
 
 
 def route_path_or_none(*args, **kwargs):
     try:
         return route_path(*args, **kwargs)
     except KeyError:
         return None
 
 
 def static_url(*args, **kwds):
     """
     Wrapper around pyramids `route_path` function. It is used to generate
     URLs from within pylons views or templates. This will be removed when
     pyramid migration if finished.
     """
     req = get_current_request()
     return req.static_url(*args, **kwds)
 
 
 def resource_path(*args, **kwds):
     """
     Wrapper around pyramids `route_path` function. It is used to generate
     URLs from within pylons views or templates. This will be removed when
     pyramid migration if finished.
     """
     req = get_current_request()
     return req.resource_path(*args, **kwds)
 
 
 def api_call_example(method, args):
     """
     Generates an API call example via CURL
     """
     args_json = json.dumps(OrderedDict([
         ('id', 1),
         ('auth_token', 'SECRET'),
         ('method', method),
         ('args', args)
     ]))
     return literal(
         "curl {api_url} -X POST -H 'content-type:text/plain' --data-binary '{data}'"
         "<br/><br/>SECRET can be found in <a href=\"{token_url}\">auth-tokens</a> page, "
         "and needs to be of `api calls` role."
         .format(
             api_url=route_url('apiv2'),
             token_url=route_url('my_account_auth_tokens'),
             data=args_json))

rhodecode/model/forms.py

@@ -1,563 +1,565 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 this is forms validation classes
 http://formencode.org/module-formencode.validators.html
 for list off all availible validators
 
 we can create our own validators
 
 The table below outlines the options which can be used in a schema in addition to the validators themselves
 pre_validators          []     These validators will be applied before the schema
 chained_validators      []     These validators will be applied after the schema
 allow_extra_fields      False     If True, then it is not an error when keys that aren't associated with a validator are present
 filter_extra_fields     False     If True, then keys that aren't associated with a validator are removed
 if_key_missing          NoDefault If this is given, then any keys that aren't available but are expected will be replaced with this value (and then validated). This does not override a present .if_missing attribute on validators. NoDefault is a special FormEncode class to mean that no default values has been specified and therefore missing keys shouldn't take a default value.
 ignore_key_missing      False     If True, then missing keys will be missing in the result, if the validator doesn't have .if_missing on it already
 
 
 <name> = formencode.validators.<name of validator>
 <name> must equal form name
 list=[1,2,3,4,5]
 for SELECT use formencode.All(OneOf(list), Int())
 
 """
 
 import deform
 import logging
 import formencode
 
 from pkg_resources import resource_filename
 from formencode import All, Pipe
 
 from pylons.i18n.translation import _
+from pyramid.threadlocal import get_current_request
 
 from rhodecode import BACKENDS
 from rhodecode.lib import helpers
 from rhodecode.model import validators as v
 
 log = logging.getLogger(__name__)
 
 
 deform_templates = resource_filename('deform', 'templates')
 rhodecode_templates = resource_filename('rhodecode', 'templates/forms')
 search_path = (rhodecode_templates, deform_templates)
 
 
 class RhodecodeFormZPTRendererFactory(deform.ZPTRendererFactory):
     """ Subclass of ZPTRendererFactory to add rhodecode context variables """
     def __call__(self, template_name, **kw):
         kw['h'] = helpers
+        kw['request'] = get_current_request()
         return self.load(template_name)(**kw)
 
 
 form_renderer = RhodecodeFormZPTRendererFactory(search_path)
 deform.Form.set_default_renderer(form_renderer)
 
 
 def LoginForm():
     class _LoginForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
         username = v.UnicodeString(
             strip=True,
             min=1,
             not_empty=True,
             messages={
                 'empty': _(u'Please enter a login'),
                 'tooShort': _(u'Enter a value %(min)i characters long or more')
             }
         )
 
         password = v.UnicodeString(
             strip=False,
             min=3,
             not_empty=True,
             messages={
                 'empty': _(u'Please enter a password'),
                 'tooShort': _(u'Enter %(min)i characters or more')}
         )
 
         remember = v.StringBoolean(if_missing=False)
 
         chained_validators = [v.ValidAuth()]
     return _LoginForm
 
 
 def UserForm(edit=False, available_languages=[], old_data={}):
     class _UserForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
         username = All(v.UnicodeString(strip=True, min=1, not_empty=True),
                        v.ValidUsername(edit, old_data))
         if edit:
             new_password = All(
                 v.ValidPassword(),
                 v.UnicodeString(strip=False, min=6, not_empty=False)
             )
             password_confirmation = All(
                 v.ValidPassword(),
                 v.UnicodeString(strip=False, min=6, not_empty=False),
             )
             admin = v.StringBoolean(if_missing=False)
         else:
             password = All(
                 v.ValidPassword(),
                 v.UnicodeString(strip=False, min=6, not_empty=True)
             )
             password_confirmation = All(
                 v.ValidPassword(),
                 v.UnicodeString(strip=False, min=6, not_empty=False)
             )
 
         password_change = v.StringBoolean(if_missing=False)
         create_repo_group = v.StringBoolean(if_missing=False)
 
         active = v.StringBoolean(if_missing=False)
         firstname = v.UnicodeString(strip=True, min=1, not_empty=False)
         lastname = v.UnicodeString(strip=True, min=1, not_empty=False)
         email = All(v.Email(not_empty=True), v.UniqSystemEmail(old_data))
         extern_name = v.UnicodeString(strip=True)
         extern_type = v.UnicodeString(strip=True)
         language = v.OneOf(available_languages, hideList=False,
                            testValueList=True, if_missing=None)
         chained_validators = [v.ValidPasswordsMatch()]
     return _UserForm
 
 
 def UserGroupForm(edit=False, old_data=None, allow_disabled=False):
     old_data = old_data or {}
 
     class _UserGroupForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
 
         users_group_name = All(
             v.UnicodeString(strip=True, min=1, not_empty=True),
             v.ValidUserGroup(edit, old_data)
         )
         user_group_description = v.UnicodeString(strip=True, min=1,
                                                  not_empty=False)
 
         users_group_active = v.StringBoolean(if_missing=False)
 
         if edit:
             # this is user group owner
             user = All(
                 v.UnicodeString(not_empty=True),
                 v.ValidRepoUser(allow_disabled))
     return _UserGroupForm
 
 
 def RepoGroupForm(edit=False, old_data=None, available_groups=None,
                    can_create_in_root=False, allow_disabled=False):
     old_data = old_data or {}
     available_groups = available_groups or []
 
     class _RepoGroupForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
 
         group_name = All(v.UnicodeString(strip=True, min=1, not_empty=True),
                          v.SlugifyName(),)
         group_description = v.UnicodeString(strip=True, min=1,
                                             not_empty=False)
         group_copy_permissions = v.StringBoolean(if_missing=False)
 
         group_parent_id = v.OneOf(available_groups, hideList=False,
                                   testValueList=True, not_empty=True)
         enable_locking = v.StringBoolean(if_missing=False)
         chained_validators = [
             v.ValidRepoGroup(edit, old_data, can_create_in_root)]
 
         if edit:
             # this is repo group owner
             user = All(
                 v.UnicodeString(not_empty=True),
                 v.ValidRepoUser(allow_disabled))
 
     return _RepoGroupForm
 
 
 def RegisterForm(edit=False, old_data={}):
     class _RegisterForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
         username = All(
             v.ValidUsername(edit, old_data),
             v.UnicodeString(strip=True, min=1, not_empty=True)
         )
         password = All(
             v.ValidPassword(),
             v.UnicodeString(strip=False, min=6, not_empty=True)
         )
         password_confirmation = All(
             v.ValidPassword(),
             v.UnicodeString(strip=False, min=6, not_empty=True)
         )
         active = v.StringBoolean(if_missing=False)
         firstname = v.UnicodeString(strip=True, min=1, not_empty=False)
         lastname = v.UnicodeString(strip=True, min=1, not_empty=False)
         email = All(v.Email(not_empty=True), v.UniqSystemEmail(old_data))
 
         chained_validators = [v.ValidPasswordsMatch()]
 
     return _RegisterForm
 
 
 def PasswordResetForm():
     class _PasswordResetForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
         email = All(v.ValidSystemEmail(), v.Email(not_empty=True))
     return _PasswordResetForm
 
 
 def RepoForm(edit=False, old_data=None, repo_groups=None, landing_revs=None,
              allow_disabled=False):
     old_data = old_data or {}
     repo_groups = repo_groups or []
     landing_revs = landing_revs or []
     supported_backends = BACKENDS.keys()
 
     class _RepoForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         repo_name = All(v.UnicodeString(strip=True, min=1, not_empty=True),
                         v.SlugifyName(), v.CannotHaveGitSuffix())
         repo_group = All(v.CanWriteGroup(old_data),
                          v.OneOf(repo_groups, hideList=True))
         repo_type = v.OneOf(supported_backends, required=False,
                             if_missing=old_data.get('repo_type'))
         repo_description = v.UnicodeString(strip=True, min=1, not_empty=False)
         repo_private = v.StringBoolean(if_missing=False)
         repo_landing_rev = v.OneOf(landing_revs, hideList=True)
         repo_copy_permissions = v.StringBoolean(if_missing=False)
         clone_uri = All(v.UnicodeString(strip=True, min=1, not_empty=False))
 
         repo_enable_statistics = v.StringBoolean(if_missing=False)
         repo_enable_downloads = v.StringBoolean(if_missing=False)
         repo_enable_locking = v.StringBoolean(if_missing=False)
 
         if edit:
             # this is repo owner
             user = All(
                 v.UnicodeString(not_empty=True),
                 v.ValidRepoUser(allow_disabled))
             clone_uri_change = v.UnicodeString(
                 not_empty=False, if_missing=v.Missing)
 
         chained_validators = [v.ValidCloneUri(),
                               v.ValidRepoName(edit, old_data)]
     return _RepoForm
 
 
 def RepoPermsForm():
     class _RepoPermsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         chained_validators = [v.ValidPerms(type_='repo')]
     return _RepoPermsForm
 
 
 def RepoGroupPermsForm(valid_recursive_choices):
     class _RepoGroupPermsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         recursive = v.OneOf(valid_recursive_choices)
         chained_validators = [v.ValidPerms(type_='repo_group')]
     return _RepoGroupPermsForm
 
 
 def UserGroupPermsForm():
     class _UserPermsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         chained_validators = [v.ValidPerms(type_='user_group')]
     return _UserPermsForm
 
 
 def RepoFieldForm():
     class _RepoFieldForm(formencode.Schema):
         filter_extra_fields = True
         allow_extra_fields = True
 
         new_field_key = All(v.FieldKey(),
                             v.UnicodeString(strip=True, min=3, not_empty=True))
         new_field_value = v.UnicodeString(not_empty=False, if_missing=u'')
         new_field_type = v.OneOf(['str', 'unicode', 'list', 'tuple'],
                                  if_missing='str')
         new_field_label = v.UnicodeString(not_empty=False)
         new_field_desc = v.UnicodeString(not_empty=False)
 
     return _RepoFieldForm
 
 
 def RepoForkForm(edit=False, old_data={}, supported_backends=BACKENDS.keys(),
                  repo_groups=[], landing_revs=[]):
     class _RepoForkForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         repo_name = All(v.UnicodeString(strip=True, min=1, not_empty=True),
                         v.SlugifyName())
         repo_group = All(v.CanWriteGroup(),
                          v.OneOf(repo_groups, hideList=True))
         repo_type = All(v.ValidForkType(old_data), v.OneOf(supported_backends))
         description = v.UnicodeString(strip=True, min=1, not_empty=True)
         private = v.StringBoolean(if_missing=False)
         copy_permissions = v.StringBoolean(if_missing=False)
         fork_parent_id = v.UnicodeString()
         chained_validators = [v.ValidForkName(edit, old_data)]
         landing_rev = v.OneOf(landing_revs, hideList=True)
 
     return _RepoForkForm
 
 
 def ApplicationSettingsForm():
     class _ApplicationSettingsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         rhodecode_title = v.UnicodeString(strip=True, max=40, not_empty=False)
         rhodecode_realm = v.UnicodeString(strip=True, min=1, not_empty=True)
         rhodecode_pre_code = v.UnicodeString(strip=True, min=1, not_empty=False)
         rhodecode_post_code = v.UnicodeString(strip=True, min=1, not_empty=False)
         rhodecode_captcha_public_key = v.UnicodeString(strip=True, min=1, not_empty=False)
         rhodecode_captcha_private_key = v.UnicodeString(strip=True, min=1, not_empty=False)
         rhodecode_create_personal_repo_group = v.StringBoolean(if_missing=False)
         rhodecode_personal_repo_group_pattern = v.UnicodeString(strip=True, min=1, not_empty=False)
 
     return _ApplicationSettingsForm
 
 
 def ApplicationVisualisationForm():
     class _ApplicationVisualisationForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         rhodecode_show_public_icon = v.StringBoolean(if_missing=False)
         rhodecode_show_private_icon = v.StringBoolean(if_missing=False)
         rhodecode_stylify_metatags = v.StringBoolean(if_missing=False)
 
         rhodecode_repository_fields = v.StringBoolean(if_missing=False)
         rhodecode_lightweight_journal = v.StringBoolean(if_missing=False)
         rhodecode_dashboard_items = v.Int(min=5, not_empty=True)
         rhodecode_admin_grid_items = v.Int(min=5, not_empty=True)
         rhodecode_show_version = v.StringBoolean(if_missing=False)
         rhodecode_use_gravatar = v.StringBoolean(if_missing=False)
         rhodecode_markup_renderer = v.OneOf(['markdown', 'rst'])
         rhodecode_gravatar_url = v.UnicodeString(min=3)
         rhodecode_clone_uri_tmpl = v.UnicodeString(min=3)
         rhodecode_support_url = v.UnicodeString()
         rhodecode_show_revision_number = v.StringBoolean(if_missing=False)
         rhodecode_show_sha_length = v.Int(min=4, not_empty=True)
 
     return _ApplicationVisualisationForm
 
 
 class _BaseVcsSettingsForm(formencode.Schema):
     allow_extra_fields = True
     filter_extra_fields = False
     hooks_changegroup_repo_size = v.StringBoolean(if_missing=False)
     hooks_changegroup_push_logger = v.StringBoolean(if_missing=False)
     hooks_outgoing_pull_logger = v.StringBoolean(if_missing=False)
 
     # PR/Code-review
     rhodecode_pr_merge_enabled = v.StringBoolean(if_missing=False)
     rhodecode_use_outdated_comments = v.StringBoolean(if_missing=False)
 
     # hg
     extensions_largefiles = v.StringBoolean(if_missing=False)
     extensions_evolve = v.StringBoolean(if_missing=False)
     phases_publish = v.StringBoolean(if_missing=False)
     rhodecode_hg_use_rebase_for_merging = v.StringBoolean(if_missing=False)
 
     # git
     vcs_git_lfs_enabled = v.StringBoolean(if_missing=False)
 
     # svn
     vcs_svn_proxy_http_requests_enabled = v.StringBoolean(if_missing=False)
     vcs_svn_proxy_http_server_url = v.UnicodeString(strip=True, if_missing=None)
 
 
 def ApplicationUiSettingsForm():
     class _ApplicationUiSettingsForm(_BaseVcsSettingsForm):
         web_push_ssl = v.StringBoolean(if_missing=False)
         paths_root_path = All(
             v.ValidPath(),
             v.UnicodeString(strip=True, min=1, not_empty=True)
         )
         largefiles_usercache = All(
             v.ValidPath(),
             v.UnicodeString(strip=True, min=2, not_empty=True))
         vcs_git_lfs_store_location = All(
             v.ValidPath(),
             v.UnicodeString(strip=True, min=2, not_empty=True))
         extensions_hgsubversion = v.StringBoolean(if_missing=False)
         extensions_hggit = v.StringBoolean(if_missing=False)
         new_svn_branch = v.ValidSvnPattern(section='vcs_svn_branch')
         new_svn_tag = v.ValidSvnPattern(section='vcs_svn_tag')
 
     return _ApplicationUiSettingsForm
 
 
 def RepoVcsSettingsForm(repo_name):
     class _RepoVcsSettingsForm(_BaseVcsSettingsForm):
         inherit_global_settings = v.StringBoolean(if_missing=False)
         new_svn_branch = v.ValidSvnPattern(
             section='vcs_svn_branch', repo_name=repo_name)
         new_svn_tag = v.ValidSvnPattern(
             section='vcs_svn_tag', repo_name=repo_name)
 
     return _RepoVcsSettingsForm
 
 
 def LabsSettingsForm():
     class _LabSettingsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
 
     return _LabSettingsForm
 
 
 def ApplicationPermissionsForm(
         register_choices, password_reset_choices, extern_activate_choices):
     class _DefaultPermissionsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
 
         anonymous = v.StringBoolean(if_missing=False)
         default_register = v.OneOf(register_choices)
         default_register_message = v.UnicodeString()
         default_password_reset = v.OneOf(password_reset_choices)
         default_extern_activate = v.OneOf(extern_activate_choices)
 
     return _DefaultPermissionsForm
 
 
 def ObjectPermissionsForm(repo_perms_choices, group_perms_choices,
                           user_group_perms_choices):
     class _ObjectPermissionsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
         overwrite_default_repo = v.StringBoolean(if_missing=False)
         overwrite_default_group = v.StringBoolean(if_missing=False)
         overwrite_default_user_group = v.StringBoolean(if_missing=False)
         default_repo_perm = v.OneOf(repo_perms_choices)
         default_group_perm = v.OneOf(group_perms_choices)
         default_user_group_perm = v.OneOf(user_group_perms_choices)
 
     return _ObjectPermissionsForm
 
 
 def UserPermissionsForm(create_choices, create_on_write_choices,
                         repo_group_create_choices, user_group_create_choices,
                         fork_choices, inherit_default_permissions_choices):
     class _DefaultPermissionsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
 
         anonymous = v.StringBoolean(if_missing=False)
 
         default_repo_create = v.OneOf(create_choices)
         default_repo_create_on_write = v.OneOf(create_on_write_choices)
         default_user_group_create = v.OneOf(user_group_create_choices)
         default_repo_group_create = v.OneOf(repo_group_create_choices)
         default_fork_create = v.OneOf(fork_choices)
         default_inherit_default_permissions = v.OneOf(inherit_default_permissions_choices)
 
     return _DefaultPermissionsForm
 
 
 def UserIndividualPermissionsForm():
     class _DefaultPermissionsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
 
         inherit_default_permissions = v.StringBoolean(if_missing=False)
 
     return _DefaultPermissionsForm
 
 
 def DefaultsForm(edit=False, old_data={}, supported_backends=BACKENDS.keys()):
     class _DefaultsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
         default_repo_type = v.OneOf(supported_backends)
         default_repo_private = v.StringBoolean(if_missing=False)
         default_repo_enable_statistics = v.StringBoolean(if_missing=False)
         default_repo_enable_downloads = v.StringBoolean(if_missing=False)
         default_repo_enable_locking = v.StringBoolean(if_missing=False)
 
     return _DefaultsForm
 
 
 def AuthSettingsForm():
     class _AuthSettingsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
         auth_plugins = All(v.ValidAuthPlugins(),
                            v.UniqueListFromString()(not_empty=True))
 
     return _AuthSettingsForm
 
 
 def UserExtraEmailForm():
     class _UserExtraEmailForm(formencode.Schema):
         email = All(v.UniqSystemEmail(), v.Email(not_empty=True))
     return _UserExtraEmailForm
 
 
 def UserExtraIpForm():
     class _UserExtraIpForm(formencode.Schema):
         ip = v.ValidIp()(not_empty=True)
     return _UserExtraIpForm
 
 
 
 def PullRequestForm(repo_id):
     class ReviewerForm(formencode.Schema):
         user_id = v.Int(not_empty=True)
         reasons = All()
         mandatory = v.StringBoolean()
 
     class _PullRequestForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
 
         common_ancestor = v.UnicodeString(strip=True, required=True)
         source_repo = v.UnicodeString(strip=True, required=True)
         source_ref = v.UnicodeString(strip=True, required=True)
         target_repo = v.UnicodeString(strip=True, required=True)
         target_ref = v.UnicodeString(strip=True, required=True)
         revisions = All(#v.NotReviewedRevisions(repo_id)(),
                         v.UniqueList()(not_empty=True))
         review_members = formencode.ForEach(ReviewerForm())
         pullrequest_title = v.UnicodeString(strip=True, required=True)
         pullrequest_desc = v.UnicodeString(strip=True, required=False)
 
     return _PullRequestForm
 
 
 def IssueTrackerPatternsForm():
     class _IssueTrackerPatternsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         chained_validators = [v.ValidPattern()]
     return _IssueTrackerPatternsForm

rhodecode/templates/admin/auth/auth_settings.mako

@@ -1,116 +1,116 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="/base/base.mako"/>
 
 <%def name="title()">
     ${_('Authentication Settings')}
     %if c.rhodecode_name:
         &middot; ${h.branding(c.rhodecode_name)}}
     %endif
 </%def>
 
 <%def name="breadcrumbs_links()">
     ${h.link_to(_('Admin'),h.route_path('admin_home'))}
     &raquo;
     ${_('Authentication Plugins')}
 </%def>
 
 <%def name="menu_bar_nav()">
     ${self.menu_items(active='admin')}
 </%def>
 
 <%def name="main()">
 
 <div class="box">
   <div class="title">
     ${self.breadcrumbs()}
   </div>
 
   <div class='sidebar-col-wrapper'>
 
     <div class="sidebar">
         <ul class="nav nav-pills nav-stacked">
           % for item in resource.get_root().get_nav_list():
             <li ${'class=active' if item == resource else ''}>
               <a href="${request.resource_path(item, route_name='auth_home')}">${item.display_name}</a>
             </li>
           % endfor
         </ul>
     </div>
 
     <div class="main-content-full-width">
-      ${h.secure_form(request.resource_path(resource, route_name='auth_home'))}
+      ${h.secure_form(request.resource_path(resource, route_name='auth_home'), request=request)}
       <div class="form">
 
         <div class="panel panel-default">
 
           <div class="panel-heading">
             <h3 class="panel-title">${_("Enabled and Available Plugins")}</h3>
           </div>
 
           <div class="fields panel-body">
 
             <div class="field">
               <div class="label">${_("Enabled Plugins")}</div>
               <div class="textarea text-area editor">
                   ${h.textarea('auth_plugins',cols=23,rows=5,class_="medium")}
               </div>
               <p class="help-block">
               ${_('Add a list of plugins, separated by commas. '
                   'The order of the plugins is also the order in which '
                   'RhodeCode Enterprise will try to authenticate a user.')}
               </p>
             </div>
 
             <div class="field">
               <div class="label">${_('Available Built-in Plugins')}</div>
               <ul class="auth_plugins">
               %for plugin in available_plugins:
                   <li>
                     <div class="auth_buttons">
                         <span plugin_id="${plugin.get_id()}" class="toggle-plugin btn ${'btn-success' if plugin.get_id() in enabled_plugins else ''}">
                           ${_('enabled') if plugin.get_id() in enabled_plugins else _('disabled')}
                         </span>
                         ${plugin.get_display_name()} (${plugin.get_id()})
                     </div>
                   </li>
               %endfor
               </ul>
             </div>
 
             <div class="buttons">
               ${h.submit('save',_('Save'),class_="btn")}
             </div>
           </div>
         </div>
       </div>
       ${h.end_form()}
     </div>
   </div>
 </div>
 
 <script>
   $('.toggle-plugin').click(function(e){
     var auth_plugins_input = $('#auth_plugins');
     var notEmpty = function(element, index, array) {
       return (element != "");
     };
     var elems = auth_plugins_input.val().split(',').filter(notEmpty);
     var cur_button = e.currentTarget;
     var plugin_id = $(cur_button).attr('plugin_id');
     if($(cur_button).hasClass('btn-success')){
       elems.splice(elems.indexOf(plugin_id), 1);
       auth_plugins_input.val(elems.join(','));
       $(cur_button).removeClass('btn-success');
       cur_button.innerHTML = _gettext('disabled');
     }
     else{
       if(elems.indexOf(plugin_id) == -1){
         elems.push(plugin_id);
       }
       auth_plugins_input.val(elems.join(','));
       $(cur_button).addClass('btn-success');
       cur_button.innerHTML = _gettext('enabled');
     }
   });
 </script>
 </%def>

rhodecode/templates/admin/auth/plugin_settings.mako

@@ -1,118 +1,118 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="/base/base.mako"/>
 
 <%def name="title()">
   ${_('Authentication Settings')}
   %if c.rhodecode_name:
     &middot; ${h.branding(c.rhodecode_name)}}
   %endif
 </%def>
 
 <%def name="breadcrumbs_links()">
   ${h.link_to(_('Admin'),h.route_path('admin_home'))}
   &raquo;
   ${h.link_to(_('Authentication Plugins'),request.resource_path(resource.__parent__, route_name='auth_home'))}
   &raquo;
   ${resource.display_name}
 </%def>
 
 <%def name="menu_bar_nav()">
   ${self.menu_items(active='admin')}
 </%def>
 
 <%def name="main()">
   <div class="box">
     <div class="title">
       ${self.breadcrumbs()}
     </div>
     <div class='sidebar-col-wrapper'>
 
       ## TODO: This is repeated in the auth root template and should be merged
       ##       into a single solution.
       <div class="sidebar">
         <ul class="nav nav-pills nav-stacked">
           % for item in resource.get_root().get_nav_list():
             <li ${'class=active' if item == resource else ''}>
               <a href="${request.resource_path(item, route_name='auth_home')}">${item.display_name}</a>
             </li>
           % endfor
         </ul>
       </div>
 
       <div class="main-content-full-width">
         <div class="panel panel-default">
           <div class="panel-heading">
             <h3 class="panel-title">${_('Plugin')}: ${resource.display_name}</h3>
           </div>
           <div class="panel-body">
             <div class="plugin_form">
               <div class="fields">
-                ${h.secure_form(request.resource_path(resource, route_name='auth_home'))}
+                ${h.secure_form(request.resource_path(resource, route_name='auth_home'), request=request)}
                 <div class="form">
 
                   %for node in plugin.get_settings_schema():
                     <% label_css_class = ("label-checkbox" if (node.widget == "bool") else "") %>
                     <div class="field">
                       <div class="label ${label_css_class}"><label for="${node.name}">${node.title}</label></div>
                       <div class="input">
                         %if node.widget in ["string", "int", "unicode"]:
                           ${h.text(node.name, defaults.get(node.name), class_="medium")}
                         %elif node.widget == "password":
                           ${h.password(node.name, defaults.get(node.name), class_="medium")}
                         %elif node.widget == "bool":
                           <div class="checkbox">${h.checkbox(node.name, True, checked=defaults.get(node.name))}</div>
                         %elif node.widget == "select":
                           ${h.select(node.name, defaults.get(node.name), node.validator.choices)}
                         %elif node.widget == "readonly":
                           ${node.default}
                         %else:
                           This field is of type ${node.typ}, which cannot be displayed. Must be one of [string|int|bool|select].
                         %endif
                         %if node.name in errors:
                           <span class="error-message">${errors.get(node.name)}</span>
                           <br />
                         %endif
                         <p class="help-block pre-formatting">${node.description}</p>
                       </div>
                     </div>
                   %endfor
 
                   ## Allow derived templates to add something below the form
                   ## input fields
                   %if hasattr(next, 'below_form_fields'):
                     ${next.below_form_fields()}
                   %endif
 
                   <div class="buttons">
                     ${h.submit('save',_('Save'),class_="btn")}
                   </div>
 
                 </div>
                 ${h.end_form()}
               </div>
             </div>
           </div>
         </div>
       </div>
 
     </div>
   </div>
 
 ## TODO: Ugly hack to get ldap select elements to work.
 ##       Find a solution to integrate this nicely.
 <script>
 $(document).ready(function() {
   var select2Options = {
         containerCssClass: 'drop-menu',
         dropdownCssClass: 'drop-menu-dropdown',
         dropdownAutoWidth: true,
         minimumResultsForSearch: -1
     };
     $("#tls_kind").select2(select2Options);
     $("#tls_reqcert").select2(select2Options);
     $("#search_scope").select2(select2Options);
     $("#group_extraction_type").select2(select2Options);
     $("#admin_groups_sync").select2(select2Options);
 });
 </script>
 </%def>

rhodecode/templates/admin/gists/edit.mako

@@ -1,139 +1,139 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="/base/base.mako"/>
 
 <%def name="title()">
     ${_('Edit Gist')} &middot; ${c.gist.gist_access_id}
     %if c.rhodecode_name:
         &middot; ${h.branding(c.rhodecode_name)}
     %endif
 </%def>
 
 <%def name="breadcrumbs_links()">
     ${_('Edit Gist')} &middot; ${c.gist.gist_access_id}
 </%def>
 
 <%def name="menu_bar_nav()">
     ${self.menu_items(active='gists')}
 </%def>
 
 <%def name="main()">
 <div class="box">
     <!-- box / title -->
     <div class="title">
         ${self.breadcrumbs()}
     </div>
 
     <div class="table">
 
         <div id="files_data">
-          ${h.secure_form(h.route_path('gist_update', gist_id=c.gist.gist_access_id), id='eform', method='POST')}
+          ${h.secure_form(h.route_path('gist_update', gist_id=c.gist.gist_access_id), id='eform', method='POST', request=request)}
             <div>
                 <input type="hidden" value="${c.file_last_commit.raw_id}" name="parent_hash">
                 <textarea id="description" name="description"
                           placeholder="${_('Gist description ...')}">${c.gist.gist_description}</textarea>
                 <div>
                     <span class="gist-gravatar">
                       ${self.gravatar(h.email_or_none(c.rhodecode_user.full_contact), 30)}
                     </span>
                     <label for='lifetime'>${_('Gist lifetime')}</label>
                     ${h.dropdownmenu('lifetime', '0', c.lifetime_options)}
 
                     <label for='gist_acl_level'>${_('Gist access level')}</label>
                     ${h.dropdownmenu('gist_acl_level', c.gist.acl_level, c.acl_options)}
                 </div>
             </div>
 
             ## peppercorn schema
             <input type="hidden" name="__start__" value="nodes:sequence"/>
             % for cnt, file in enumerate(c.files):
                 <input type="hidden" name="__start__" value="file:mapping"/>
                 <div id="codeblock" class="codeblock" >
                   <div class="code-header">
                     <div class="form">
                       <div class="fields">
                         <input type="hidden" name="filename_org" value="${file.path}" >
                         <input id="filename_${h.FID('f',file.path)}" name="filename" size="30" type="text" value="${file.path}">
                           ${h.dropdownmenu('mimetype' ,'plain',[('plain',_('plain'))],enable_filter=True, id='mimetype_'+h.FID('f',file.path))}
                       </div>
                     </div>
                   </div>
                   <div class="editor_container">
                       <pre id="editor_pre"></pre>
                       <textarea id="editor_${h.FID('f',file.path)}" name="content" >${file.content}</textarea>
                   </div>
                 </div>
                 <input type="hidden" name="__end__" />
 
                 ## dynamic edit box.
                 <script type="text/javascript">
                 $(document).ready(function(){
                     var myCodeMirror = initCodeMirror(
                             "editor_${h.FID('f',file.path)}", '');
 
                     var modes_select = $("#mimetype_${h.FID('f',file.path)}");
                     fillCodeMirrorOptions(modes_select);
 
                     // try to detect the mode based on the file we edit
                     var mimetype = "${file.mimetype}";
                     var detected_mode = detectCodeMirrorMode(
                             "${file.path}", mimetype);
 
                     if(detected_mode){
                         $(modes_select).select2("val", mimetype);
                         $(modes_select).change();
                         setCodeMirrorMode(myCodeMirror, detected_mode);
                     }
 
                     var filename_selector = "#filename_${h.FID('f',file.path)}";
                     // on change of select field set mode
                     setCodeMirrorModeFromSelect(
                             modes_select, filename_selector, myCodeMirror, null);
 
                     // on entering the new filename set mode, from given extension
                     setCodeMirrorModeFromInput(
                         modes_select, filename_selector, myCodeMirror, null);
                 });
                 </script>
             %endfor
             <input type="hidden" name="__end__" />
 
             <div class="pull-right">
             ${h.submit('update',_('Update Gist'),class_="btn btn-success")}
             <a class="btn" href="${h.route_path('gist_show', gist_id=c.gist.gist_access_id)}">${_('Cancel')}</a>
             </div>
           ${h.end_form()}
         </div>
     </div>
 
 </div>
 <script>
   $('#update').on('click', function(e){
       e.preventDefault();
 
       $(this).val('Updating...');
       $(this).attr('disabled', 'disabled');
       // check for newer version.
       $.ajax({
         url: "${h.route_path('gist_edit_check_revision', gist_id=c.gist.gist_access_id)}",
         data: {
             'revision': '${c.file_last_commit.raw_id}'
         },
         dataType: 'json',
         type: 'GET',
         success: function(data) {
           if(data.success === false){
             message = '${h.literal(_('Gist was updated since you started editing. Copy your changes and click %(here)s to reload the new version.')
               % {'here': h.link_to('here', h.route_path('gist_edit', gist_id=c.gist.gist_access_id))})}'
             alertMessage = [{"message": {
               "message": message, "force": "true", "level": "warning"}}];
             $.Topic('/notifications').publish(alertMessage[0]);
           }
           else{
             $('#eform').submit();
           }
         }
       });
   })
 
 </script>
 </%def>

rhodecode/templates/admin/gists/new.mako

@@ -1,86 +1,86 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="/base/base.mako"/>
 
 <%def name="title()">
     ${_('New Gist')}
     %if c.rhodecode_name:
         &middot; ${h.branding(c.rhodecode_name)}
     %endif
 </%def>
 
 <%def name="breadcrumbs_links()">
     ${_('New Gist')}
 </%def>
 
 <%def name="menu_bar_nav()">
     ${self.menu_items(active='gists')}
 </%def>
 
 <%def name="main()">
 <div class="box">
     <!-- box / title -->
     <div class="title">
         ${self.breadcrumbs()}
     </div>
 
     <div class="table">
         <div id="files_data">
-          ${h.secure_form(h.route_path('gists_create'), id='eform', method='POST')}
+          ${h.secure_form(h.route_path('gists_create'), id='eform', method='POST', request=request)}
             <div>
                 <textarea id="description" name="description" placeholder="${_('Gist description ...')}"></textarea>
 
                 <span class="gist-gravatar">
                     ${self.gravatar(c.rhodecode_user.email, 30)}
                 </span>
                  <label for='gistid'>${_('Gist id')}</label>
                  ${h.text('gistid', placeholder=_('Auto generated'))}
 
                  <label for='lifetime'>${_('Gist lifetime')}</label>
                  ${h.dropdownmenu('lifetime', '', c.lifetime_options)}
 
                  <label for='acl_level'>${_('Gist access level')}</label>
                  ${h.dropdownmenu('gist_acl_level', '', c.acl_options)}
 
             </div>
             <div id="codeblock" class="codeblock">
                 <div class="code-header">
                     <div class="form">
                         <div class="fields">
                             ${h.text('filename', size=30, placeholder=_('name this file...'))}
                             ${h.dropdownmenu('mimetype','plain',[('plain',_('plain'))],enable_filter=True)}
                         </div>
                     </div>
                 </div>
                 <div id="editor_container">
                     <div id="editor_pre"></div>
                     <textarea id="editor" name="content" ></textarea>
                 </div>
             </div>
             <div class="pull-right">
             ${h.submit('private',_('Create Private Gist'),class_="btn")}
             ${h.submit('public',_('Create Public Gist'),class_="btn")}
             ${h.reset('reset',_('Reset'),class_="btn")}
             </div>
             ${h.end_form()}
         </div>
     </div>
 
 </div>
 
 <script type="text/javascript">
     var myCodeMirror = initCodeMirror('editor', '');
 
     var modes_select = $('#mimetype');
     fillCodeMirrorOptions(modes_select);
 
     var filename_selector = '#filename';
     // on change of select field set mode
     setCodeMirrorModeFromSelect(
             modes_select, filename_selector, myCodeMirror, null);
 
     // on entering the new filename set mode, from given extension
     setCodeMirrorModeFromInput(
         modes_select, filename_selector, myCodeMirror, null);
 
 </script>
 </%def>

rhodecode/templates/admin/gists/show.mako

@@ -1,110 +1,110 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="/base/base.mako"/>
 
 <%def name="robots()">
     %if c.gist.gist_type != 'public':
       <meta name="robots" content="noindex, nofollow">
     %else:
       ${parent.robots()}
     %endif
 </%def>
 
 <%def name="title()">
     ${_('Gist')} &middot; ${c.gist.gist_access_id}
     %if c.rhodecode_name:
         &middot; ${h.branding(c.rhodecode_name)}
     %endif
 </%def>
 
 <%def name="breadcrumbs_links()">
     ${_('Gist')} &middot; ${c.gist.gist_access_id}
 </%def>
 
 <%def name="menu_bar_nav()">
     ${self.menu_items(active='gists')}
 </%def>
 
 <%def name="main()">
 <div class="box">
     <!-- box / title -->
     <div class="title">
         ${self.breadcrumbs()}
         %if c.rhodecode_user.username != h.DEFAULT_USER:
         <ul class="links">
           <li>
               <a href="${h.route_path('gists_new')}" class="btn btn-primary">${_(u'Create New Gist')}</a>
           </li>
         </ul>
         %endif
     </div>
     <code>${c.gist.gist_url()}</code>
     <div class="table">
         <div id="files_data">
             <div id="codeblock" class="codeblock">
                 <div class="code-header">
                     <div class="stats">
                        %if h.HasPermissionAny('hg.admin')() or c.gist.gist_owner == c.rhodecode_user.user_id:
                         <div class="remove_gist">
-                            ${h.secure_form(h.route_path('gist_delete', gist_id=c.gist.gist_access_id), method='POST')}
+                            ${h.secure_form(h.route_path('gist_delete', gist_id=c.gist.gist_access_id), method='POST', request=request)}
                                 ${h.submit('remove_gist', _('Delete'),class_="btn btn-mini btn-danger",onclick="return confirm('"+_('Confirm to delete this Gist')+"');")}
                             ${h.end_form()}
                         </div>
                        %endif
                         <div class="buttons">
                           ## only owner should see that
                           %if h.HasPermissionAny('hg.admin')() or c.gist.gist_owner == c.rhodecode_user.user_id:
                             ${h.link_to(_('Edit'), h.route_path('gist_edit', gist_id=c.gist.gist_access_id), class_="btn btn-mini")}
                           %endif
                           ${h.link_to(_('Show as Raw'), h.route_path('gist_show_formatted', gist_id=c.gist.gist_access_id, revision='tip', format='raw'), class_="btn btn-mini")}
                         </div>
                         <div class="left" >
                           %if c.gist.gist_type != 'public':
                             <span class="tag tag-ok disabled">${_('Private Gist')}</span>
                           %endif
                           <span> ${c.gist.gist_description}</span>
                            <span>${_('Expires')}:
                            %if c.gist.gist_expires == -1:
                              ${_('never')}
                            %else:
                               ${h.age_component(h.time_to_utcdatetime(c.gist.gist_expires))}
                           %endif
                           </span>
                        </div>
                     </div>
 
                     <div class="author">
                         <div title="${h.tooltip(c.file_last_commit.author)}">
                           ${self.gravatar_with_user(c.file_last_commit.author, 16)} - ${_('created')} ${h.age_component(c.file_last_commit.date)}
                         </div>
 
                     </div>
                     <div class="commit">${h.urlify_commit_message(c.file_last_commit.message, None)}</div>
                 </div>
 
                ## iterate over the files
                % for file in c.files:
                 <% renderer = c.render and h.renderer_from_filename(file.path, exclude=['.txt', '.TXT'])%>
                 <!--
                 <div id="${h.FID('G', file.path)}" class="stats" >
                     <a href="${c.gist.gist_url()}">¶</a>
                     <b >${file.path}</b>
                     <div>
                        ${h.link_to(_('Show as raw'), h.route_path('gist_show_formatted_path', gist_id=c.gist.gist_access_id, revision=file.commit.raw_id, format='raw', f_path=file.path), class_="btn btn-mini")}
                     </div>
                 </div>
                 -->
                 <div class="code-body textarea text-area editor">
                     %if renderer:
                         ${h.render(file.content, renderer=renderer)}
                     %else:
                         ${h.pygmentize(file,linenos=True,anchorlinenos=True,lineanchors='L',cssclass="code-highlight")}
                     %endif
                 </div>
                %endfor
             </div>
         </div>
     </div>
 
 
 </div>
 </%def>

rhodecode/templates/admin/my_account/my_account_auth_tokens.mako

@@ -1,160 +1,160 b''
 <div class="panel panel-default">
   <div class="panel-heading">
     <h3 class="panel-title">${_('Authentication Tokens')}</h3>
   </div>
   <div class="panel-body">
     <div class="apikeys_wrap">
       <p>
          ${_('Each token can have a role. Token with a role can be used only in given context, '
          'e.g. VCS tokens can be used together with the authtoken auth plugin for git/hg/svn operations only.')}
       </p>
       <table class="rctable auth_tokens">
         <tr>
             <th>${_('Token')}</th>
             <th>${_('Scope')}</th>
             <th>${_('Description')}</th>
             <th>${_('Role')}</th>
             <th>${_('Expiration')}</th>
             <th>${_('Action')}</th>
         </tr>
         %if c.user_auth_tokens:
             %for auth_token in c.user_auth_tokens:
               <tr class="${'expired' if auth_token.expired else ''}">
                 <td class="truncate-wrap td-authtoken">
                     <div class="user_auth_tokens truncate autoexpand">
                     <code>${auth_token.api_key}</code>
                     </div>
                 </td>
                 <td class="td">${auth_token.scope_humanized}</td>
                 <td class="td-wrap">${auth_token.description}</td>
                 <td class="td-tags">
                     <span class="tag disabled">${auth_token.role_humanized}</span>
                 </td>
                 <td class="td-exp">
                      %if auth_token.expires == -1:
                       ${_('never')}
                      %else:
                         %if auth_token.expired:
                             <span style="text-decoration: line-through">${h.age_component(h.time_to_utcdatetime(auth_token.expires))}</span>
                         %else:
                             ${h.age_component(h.time_to_utcdatetime(auth_token.expires))}
                         %endif
                      %endif
                 </td>
                 <td class="td-action">
-                    ${h.secure_form(h.route_path('my_account_auth_tokens_delete'), method='post')}
+                    ${h.secure_form(h.route_path('my_account_auth_tokens_delete'), method='POST', request=request)}
                         ${h.hidden('del_auth_token', auth_token.user_api_key_id)}
                         <button class="btn btn-link btn-danger" type="submit"
                                 onclick="return confirm('${_('Confirm to remove this auth token: %s') % auth_token.token_obfuscated}');">
                             ${_('Delete')}
                         </button>
                     ${h.end_form()}
                 </td>
               </tr>
             %endfor
         %else:
         <tr><td><div class="ip">${_('No additional auth tokens specified')}</div></td></tr>
         %endif
       </table>
     </div>
 
         <div class="user_auth_tokens">
-            ${h.secure_form(h.route_path('my_account_auth_tokens_add'), method='post')}
+            ${h.secure_form(h.route_path('my_account_auth_tokens_add'), method='POST', request=request)}
             <div class="form form-vertical">
                 <!-- fields -->
                 <div class="fields">
                      <div class="field">
                         <div class="label">
                             <label for="new_email">${_('New authentication token')}:</label>
                         </div>
                         <div class="input">
                             ${h.text('description', class_='medium', placeholder=_('Description'))}
                             ${h.select('lifetime', '', c.lifetime_options)}
                             ${h.select('role', '', c.role_options)}
 
                             % if c.allow_scoped_tokens:
                                 ${h.hidden('scope_repo_id')}
                             % else:
                                 ${h.select('scope_repo_id_disabled', '', ['Scopes available in EE edition'], disabled='disabled')}
                             % endif
                         </div>
                         <p class="help-block">
                           ${_('Repository scope works only with tokens with VCS type.')}
                         </p>
                      </div>
                     <div class="buttons">
                       ${h.submit('save',_('Add'),class_="btn")}
                       ${h.reset('reset',_('Reset'),class_="btn")}
                     </div>
                 </div>
             </div>
             ${h.end_form()}
         </div>
     </div>
 </div>
 <script>
 $(document).ready(function(){
 
 var select2Options = {
     'containerCssClass': "drop-menu",
     'dropdownCssClass': "drop-menu-dropdown",
     'dropdownAutoWidth': true
 };
 $("#lifetime").select2(select2Options);
 $("#role").select2(select2Options);
 
 var repoFilter = function(data) {
     var results = [];
 
     if (!data.results[0]) {
         return data
     }
 
     $.each(data.results[0].children, function() {
         // replace name to ID for submision
         this.id = this.obj.repo_id;
         results.push(this);
     });
 
     data.results[0].children = results;
     return data;
 };
 
 $("#scope_repo_id_disabled").select2(select2Options);
 
 $("#scope_repo_id").select2({
     cachedDataSource: {},
     minimumInputLength: 2,
     placeholder: "${_('repository scope')}",
     dropdownAutoWidth: true,
     containerCssClass: "drop-menu",
     dropdownCssClass: "drop-menu-dropdown",
     formatResult: formatResult,
     query: $.debounce(250, function(query){
         self = this;
         var cacheKey = query.term;
         var cachedData = self.cachedDataSource[cacheKey];
 
         if (cachedData) {
             query.callback({results: cachedData.results});
         } else {
             $.ajax({
                 url: pyroutes.url('repo_list_data'),
                 data: {'query': query.term},
                 dataType: 'json',
                 type: 'GET',
                 success: function(data) {
                     data = repoFilter(data);
                     self.cachedDataSource[cacheKey] = data;
                     query.callback({results: data.results});
                 },
                 error: function(data, textStatus, errorThrown) {
                     alert("Error while fetching entries.\nError code {0} ({1}).".format(data.status, data.statusText));
                 }
             })
         }
     })
 });
 
 });
 </script>

rhodecode/templates/admin/my_account/my_account_emails.mako

@@ -1,72 +1,72 b''
 <%namespace name="base" file="/base/base.mako"/>
 
 <div class="panel panel-default">
   <div class="panel-heading">
     <h3 class="panel-title">${_('Account Emails')}</h3>
   </div>
 
     <div class="panel-body">
         <div class="emails_wrap">
           <table class="rctable account_emails">
             <tr>
             <td class="td-user">
                 ${base.gravatar(c.user.email, 16)}
                 <span class="user email">${c.user.email}</span>
             </td>
             <td class="td-tags">
                 <span class="tag tag1">${_('Primary')}</span>
             </td>
             </tr>
             %if c.user_email_map:
                 %for em in c.user_email_map:
                   <tr>
                     <td class="td-user">
                         ${base.gravatar(em.email, 16)}
                         <span class="user email">${em.email}</span>
                     </td>
                     <td class="td-action">
-                        ${h.secure_form(h.route_path('my_account_emails_delete'), method='POST')}
+                        ${h.secure_form(h.route_path('my_account_emails_delete'), method='POST', request=request)}
                             ${h.hidden('del_email_id',em.email_id)}
                             <button class="btn btn-link btn-danger" type="submit" id="${'remove_email_%s'.format(em.email_id)}"
                                     onclick="return confirm('${_('Confirm to delete this email: {}').format(em.email)}');">
                                 ${_('Delete')}
                             </button>
                         ${h.end_form()}
                     </td>
                   </tr>
                 %endfor
             %else:
                 <tr class="noborder">
                     <td colspan="3">
                         <div class="td-email">
                             ${_('No additional emails specified')}
                         </div>
                     </td>
                 </tr>
             %endif
           </table>
         </div>
 
         <div>
-            ${h.secure_form(h.route_path('my_account_emails_add'), method='POST')}
+            ${h.secure_form(h.route_path('my_account_emails_add'), method='POST', request=request)}
             <div class="form">
                 <!-- fields -->
                 <div class="fields">
                      <div class="field">
                         <div class="label">
                             <label for="new_email">${_('New email address')}:</label>
                         </div>
                         <div class="input">
                             ${h.text('new_email', class_='medium')}
                         </div>
                      </div>
                     <div class="buttons">
                       ${h.submit('save',_('Add'),class_="btn")}
                       ${h.reset('reset',_('Reset'),class_="btn")}
                     </div>
                 </div>
             </div>
             ${h.end_form()}
         </div>
     </div>
 </div>

rhodecode/templates/admin/my_account/my_account_profile_edit.mako

@@ -1,113 +1,113 b''
 <%namespace name="base" file="/base/base.mako"/>
 <div class="panel panel-default user-profile">
     <div class="panel-heading">
         <h3 class="panel-title">${_('My Profile')}</h3>
         <a href="${h.route_path('my_account_profile')}" class="panel-edit">Close</a>
     </div>
 
     <div class="panel-body">
-    ${h.secure_form(h.route_path('my_account_update'), class_='form', method='POST')}
+    ${h.secure_form(h.route_path('my_account_update'), class_='form', method='POST', request=request)}
     <% readonly = None %>
     <% disabled = "" %>
 
     % if c.extern_type != 'rhodecode':
         <% readonly = "readonly" %>
         <% disabled = "disabled" %>
         <div class="infoform">
           <div class="fields">
             <p>${_('Your user account details are managed by an external source. Details cannot be managed here.')}
                <br/>${_('Source type')}: <strong>${c.extern_type}</strong>
             </p>
 
             <div class="field">
                <div class="label">
                    <label for="username">${_('Username')}:</label>
                </div>
                <div class="input">
                  ${h.text('username', class_='input-valuedisplay', readonly=readonly)}
                </div>
             </div>
     
             <div class="field">
                <div class="label">
                    <label for="name">${_('First Name')}:</label>
                </div>
                <div class="input">
                    ${h.text('firstname', class_='input-valuedisplay', readonly=readonly)}
                </div>
             </div>
     
             <div class="field">
                <div class="label">
                    <label for="lastname">${_('Last Name')}:</label>
                </div>
                <div class="input-valuedisplay">
                    ${h.text('lastname', class_='input-valuedisplay', readonly=readonly)}
                </div>
             </div>
           </div>
         </div>
     % else:
         <div class="form">
           <div class="fields">
             <div class="field">
                 <div class="label photo">
                     ${_('Photo')}:
                 </div>
                 <div class="input profile">
                     %if c.visual.use_gravatar:
                         ${base.gravatar(c.user.email, 100)}
                         <p class="help-block">${_('Change your avatar at')} <a href="http://gravatar.com">gravatar.com</a>.</p>
                     %else:
                         ${base.gravatar(c.user.email, 20)}
                         ${_('Avatars are disabled')}
                     %endif
                 </div>
             </div>
             <div class="field">
                <div class="label">
                    <label for="username">${_('Username')}:</label>
                </div>
                <div class="input">
                  ${h.text('username', class_='medium%s' % disabled, readonly=readonly)}
                  ${h.hidden('extern_name', c.extern_name)}
                  ${h.hidden('extern_type', c.extern_type)}
                </div>
             </div>
             <div class="field">
                <div class="label">
                    <label for="name">${_('First Name')}:</label>
                </div>
                <div class="input">
                    ${h.text('firstname', class_="medium")}
                </div>
             </div>
     
             <div class="field">
                <div class="label">
                    <label for="lastname">${_('Last Name')}:</label>
                </div>
                <div class="input">
                    ${h.text('lastname', class_="medium")}
                </div>
             </div>
     
             <div class="field">
                <div class="label">
                    <label for="email">${_('Email')}:</label>
                </div>
                <div class="input">
                    ## we should be able to edit email !
                    ${h.text('email', class_="medium")}
                </div>
             </div>
     
             <div class="buttons">
               ${h.submit('save', _('Save'), class_="btn")}
               ${h.reset('reset', _('Reset'), class_="btn")}
             </div>
           </div>
         </div>
     % endif
     </div>
 </div>
  No newline at end of file

rhodecode/templates/admin/permissions/permissions_ips.mako

@@ -1,67 +1,67 b''
 
 
 <div class="panel panel-default">
   <div class="panel-heading">
       <h3 class="panel-title">${_('Default IP Whitelist For All Users')}</h3>
   </div>
   <div class="panel-body">
     <div class="ips_wrap">
       <table class="rctable ip-whitelist">
         <tr>
           <th>IP Address</th>
           <th>IP Range</th>
           <th>Description</th>
           <th></th>
         </tr>
       %if c.user_ip_map:
         %for ip in c.user_ip_map:
           <tr>
               <td class="td-ip"><div class="ip">${ip.ip_addr}</div></td>
               <td class="td-iprange"><div class="ip">${h.ip_range(ip.ip_addr)}</div></td>
               <td class="td-description"><div class="ip">${ip.description}</div></td>
               <td class="td-action">
-                ${h.secure_form(h.route_path('edit_user_ips_delete', user_id=c.user.user_id), method='POST')}
+                ${h.secure_form(h.route_path('edit_user_ips_delete', user_id=c.user.user_id), method='POST', request=request)}
                     ${h.hidden('del_ip_id',ip.ip_id)}
                     ${h.hidden('default_user', 'True')}
                     ${h.submit('remove_',_('Delete'),id="remove_ip_%s" % ip.ip_id,
                     class_="btn btn-link btn-danger", onclick="return confirm('"+_('Confirm to delete this ip: %s') % ip.ip_addr+"');")}
                 ${h.end_form()}
               </td>
           </tr>
         %endfor
        %else:
           <tr>
             <td class="ip">${_('All IP addresses are allowed')}</td>
             <td></td>
             <td></td>
             <td></td>
           </tr>
        %endif
       </table>
     </div>
 
-    ${h.secure_form(h.route_path('edit_user_ips_add', user_id=c.user.user_id), method='POST')}
+    ${h.secure_form(h.route_path('edit_user_ips_add', user_id=c.user.user_id), method='POST', request=request)}
       <div class="form">
         <!-- fields -->
         <div class="fields">
           <div class="field">
             <div class="label">
               <label for="new_ip">${_('New IP Address')}:</label>
             </div>
             <div class="input">
               ${h.hidden('default_user', 'True')}
               ${h.text('new_ip')} ${h.text('description', placeholder=_('Description...'))}
               <span class="help-block">${_('Enter a comma separated list of IP Addresses like 127.0.0.1,\n'
                'or use an IP Address with a mask 127.0.0.1/24, to create a network range.\n'
                'To specify multiple addresses in a range, use the 127.0.0.1-127.0.0.10 syntax')}</span>
             </div>
            </div>
           <div class="buttons">
             ${h.submit('save',_('Add'),class_="btn")}
             ${h.reset('reset',_('Reset'),class_="btn")}
           </div>
         </div>
       </div>
     ${h.end_form()}
   </div>
 </div>

rhodecode/templates/admin/repos/repo_edit_advanced.mako

@@ -1,210 +1,210 b''
 <%namespace name="base" file="/base/base.mako"/>
 
 <%
  elems = [
     (_('Owner'), lambda:base.gravatar_with_user(c.repo_info.user.email), '', ''),
     (_('Created on'), h.format_date(c.repo_info.created_on), '', ''),
     (_('Updated on'), h.format_date(c.repo_info.updated_on), '', ''),
     (_('Cached Commit id'), lambda: h.link_to(c.repo_info.changeset_cache.get('short_id'), h.url('changeset_home',repo_name=c.repo_name,revision=c.repo_info.changeset_cache.get('raw_id'))), '', ''),
  ]
 %>
 
 <div class="panel panel-default">
     <div class="panel-heading" id="advanced-info" >
         <h3 class="panel-title">${_('Repository: %s') % c.repo_info.repo_name} <a class="permalink" href="#advanced-info"> ¶</a></h3>
     </div>
     <div class="panel-body">
         ${base.dt_info_panel(elems)}
     </div>
 </div>
 
 
 <div class="panel panel-default">
     <div class="panel-heading" id="advanced-fork">
         <h3 class="panel-title">${_('Fork Reference')} <a class="permalink" href="#advanced-fork"> ¶</a></h3>
     </div>
     <div class="panel-body">
-      ${h.secure_form(h.route_path('edit_repo_advanced_fork', repo_name=c.repo_info.repo_name), method='POST')}
+      ${h.secure_form(h.route_path('edit_repo_advanced_fork', repo_name=c.repo_info.repo_name), method='POST', request=request)}
 
         % if c.repo_info.fork:
             <div class="panel-body-title-text">${h.literal(_('This repository is a fork of %(repo_link)s') % {'repo_link': h.link_to_if(c.has_origin_repo_read_perm,c.repo_info.fork.repo_name, h.route_path('repo_summary', repo_name=c.repo_info.fork.repo_name))})}
             | <button class="btn btn-link btn-danger" type="submit">Remove fork reference</button></div>
         % endif
 
          <div class="field">
              ${h.hidden('id_fork_of')}
              ${h.submit('set_as_fork_%s' % c.repo_info.repo_name,_('Set'),class_="btn btn-small",)}
          </div>
          <div class="field">
              <span class="help-block">${_('Manually set this repository as a fork of another from the list')}</span>
          </div>
       ${h.end_form()}
     </div>
 </div>
 
 
 <div class="panel panel-default">
     <div class="panel-heading" id="advanced-journal">
         <h3 class="panel-title">${_('Public Journal Visibility')} <a class="permalink" href="#advanced-journal"> ¶</a></h3>
     </div>
     <div class="panel-body">
-      ${h.secure_form(h.route_path('edit_repo_advanced_journal', repo_name=c.repo_info.repo_name), method='POST')}
+      ${h.secure_form(h.route_path('edit_repo_advanced_journal', repo_name=c.repo_info.repo_name), method='POST', request=request)}
         <div class="field">
         %if c.in_public_journal:
           <button class="btn btn-small" type="submit">
               ${_('Remove from Public Journal')}
           </button>
         %else:
           <button class="btn btn-small" type="submit">
               ${_('Add to Public Journal')}
           </button>
         %endif
         </div>
        <div class="field" >
        <span class="help-block">${_('All actions made on this repository will be visible to everyone following the public journal.')}</span>
        </div>
       ${h.end_form()}
     </div>
 </div>
 
 
 <div class="panel panel-default">
     <div class="panel-heading" id="advanced-locking">
         <h3 class="panel-title">${_('Locking state')} <a class="permalink" href="#advanced-locking"> ¶</a></h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.route_path('edit_repo_advanced_locking', repo_name=c.repo_info.repo_name), method='POST')}
+        ${h.secure_form(h.route_path('edit_repo_advanced_locking', repo_name=c.repo_info.repo_name), method='POST', request=request)}
 
         %if c.repo_info.locked[0]:
              <div class="panel-body-title-text">${'Locked by %s on %s. Lock reason: %s' % (h.person_by_id(c.repo_info.locked[0]),
              h.format_date(h. time_to_datetime(c.repo_info.locked[1])), c.repo_info.locked[2])}</div>
         %else:
             <div class="panel-body-title-text">${_('This Repository is not currently locked.')}</div>
         %endif
 
         <div class="field" >
             %if c.repo_info.locked[0]:
               ${h.hidden('set_unlock', '1')}
               <button class="btn btn-small" type="submit"
                       onclick="return confirm('${_('Confirm to unlock repository.')}');">
                   <i class="icon-unlock"></i>
                   ${_('Unlock repository')}
               </button>
             %else:
               ${h.hidden('set_lock', '1')}
               <button class="btn btn-small" type="submit"
                       onclick="return confirm('${_('Confirm to lock repository.')}');">
                   <i class="icon-lock"></i>
                   ${_('Lock Repository')}
               </button>
             %endif
          </div>
          <div class="field" >
             <span class="help-block">
                 ${_('Force repository locking. This only works when anonymous access is disabled. Pulling from the repository locks the repository to that user until the same user pushes to that repository again.')}
             </span>
          </div>
         ${h.end_form()}
     </div>
 </div>
 
 <div class="panel panel-danger">
     <div class="panel-heading" id="advanced-delete">
         <h3 class="panel-title">${_('Delete repository')} <a class="permalink" href="#advanced-delete"> ¶</a></h3>
     </div>
     <div class="panel-body">
-      ${h.secure_form(h.route_path('edit_repo_advanced_delete', repo_name=c.repo_name), method='POST')}
+      ${h.secure_form(h.route_path('edit_repo_advanced_delete', repo_name=c.repo_name), method='POST', request=request)}
         <table class="display">
             <tr>
                 <td>
                     ${_ungettext('This repository has %s fork.', 'This repository has %s forks.', c.repo_info.forks.count()) % c.repo_info.forks.count()}
                 </td>
                 <td>
                     %if c.repo_info.forks.count():
                         <input type="radio" name="forks" value="detach_forks" checked="checked"/> <label for="forks">${_('Detach forks')}</label>
                     %endif
                 </td>
                 <td>
                     %if c.repo_info.forks.count():
                         <input type="radio" name="forks" value="delete_forks"/> <label for="forks">${_('Delete forks')}</label>
                     %endif
                 </td>
             </tr>
         </table>
         <div style="margin: 0 0 20px 0" class="fake-space"></div>
 
         <div class="field">
             <button class="btn btn-small btn-danger" type="submit"
                     onclick="return confirm('${_('Confirm to delete this repository: %s') % c.repo_name}');">
                 <i class="icon-remove-sign"></i>
                 ${_('Delete This Repository')}
             </button>
         </div>
         <div class="field">
             <span class="help-block">
                 ${_('This repository will be renamed in a special way in order to make it inaccessible to RhodeCode Enterprise and its VCS systems. If you need to fully delete it from the file system, please do it manually, or with rhodecode-cleanup-repos command available in rhodecode-tools.')}
             </span>
         </div>
 
       ${h.end_form()}
     </div>
 </div>
 
 
 <script>
 
 var currentRepoId = ${c.repo_info.repo_id};
 
 var repoTypeFilter = function(data) {
     var results = [];
 
     if (!data.results[0]) {
         return data
     }
 
     $.each(data.results[0].children, function() {
         // filter out the SAME repo, it cannot be used as fork of itself
         if (this.obj.repo_id != currentRepoId) {
             this.id = this.obj.repo_id;
             results.push(this)
         }
     });
     data.results[0].children = results;
     return data;
 };
 
 $("#id_fork_of").select2({
     cachedDataSource: {},
     minimumInputLength: 2,
     placeholder: "${_('Change repository') if c.repo_info.fork else _('Pick repository')}",
     dropdownAutoWidth: true,
     containerCssClass: "drop-menu",
     dropdownCssClass: "drop-menu-dropdown",
     formatResult: formatResult,
     query: $.debounce(250, function(query){
         self = this;
         var cacheKey = query.term;
         var cachedData = self.cachedDataSource[cacheKey];
 
         if (cachedData) {
             query.callback({results: cachedData.results});
         } else {
             $.ajax({
                 url: pyroutes.url('repo_list_data'),
                 data: {'query': query.term, repo_type: '${c.repo_info.repo_type}'},
                 dataType: 'json',
                 type: 'GET',
                 success: function(data) {
                     data = repoTypeFilter(data);
                     self.cachedDataSource[cacheKey] = data;
                     query.callback({results: data.results});
                 },
                 error: function(data, textStatus, errorThrown) {
                     alert("Error while fetching entries.\nError code {0} ({1}).".format(data.status, data.statusText));
                 }
             })
         }
     })
 });
 </script>
 

rhodecode/templates/admin/repos/repo_edit_caches.mako

@@ -1,53 +1,53 b''
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Invalidate Cache for Repository')}</h3>
     </div>
     <div class="panel-body">
 
         <h4>${_('Manually invalidate the repository cache. On the next access a repository cache will be recreated.')}</h4>
 
         <p>
             ${_('Cache purge can be automated by such api call. Can be called periodically in crontab etc.')}
             <br/>
             <code>
             ${h.api_call_example(method='invalidate_cache', args={"repoid": c.repo_info.repo_name})}
             </code>
         </p>
 
-        ${h.secure_form(h.route_path('edit_repo_caches', repo_name=c.repo_name), method='POST')}
+        ${h.secure_form(h.route_path('edit_repo_caches', repo_name=c.repo_name), method='POST', request=request)}
         <div class="form">
            <div class="fields">
                ${h.submit('reset_cache_%s' % c.repo_info.repo_name,_('Invalidate repository cache'),class_="btn btn-small",onclick="return confirm('"+_('Confirm to invalidate repository cache')+"');")}
            </div>
         </div>
         ${h.end_form()}
 
     </div>
 </div>
 
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">
             ${(_ungettext('List of repository caches (%(count)s entry)', 'List of repository caches (%(count)s entries)' ,len(c.repo_info.cache_keys)) % {'count': len(c.repo_info.cache_keys)})}
         </h3>
     </div>
     <div class="panel-body">
       <div class="field" >
            <table class="rctable edit_cache">
            <tr>
             <th>${_('Prefix')}</th>
             <th>${_('Key')}</th>
             <th>${_('Active')}</th>
             </tr>
           %for cache in c.repo_info.cache_keys:
               <tr>
                 <td class="td-prefix">${cache.get_prefix() or '-'}</td>
                 <td class="td-cachekey">${cache.cache_key}</td>
                 <td class="td-active">${h.bool2icon(cache.cache_active)}</td>
               </tr>
           %endfor
           </table>
       </div>
     </div>
 </div>

rhodecode/templates/admin/repos/repo_edit_permissions.mako

@@ -1,123 +1,123 b''
 <%namespace name="base" file="/base/base.mako"/>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Repository Permissions')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.route_path('edit_repo_perms', repo_name=c.repo_name), method='POST')}
+        ${h.secure_form(h.route_path('edit_repo_perms', repo_name=c.repo_name), method='POST', request=request)}
         <table id="permissions_manage" class="rctable permissions">
             <tr>
                 <th class="td-radio">${_('None')}</th>
                 <th class="td-radio">${_('Read')}</th>
                 <th class="td-radio">${_('Write')}</th>
                 <th class="td-radio">${_('Admin')}</th>
                 <th class="td-owner">${_('User/User Group')}</th>
                 <th></th>
             </tr>
             ## USERS
             %for _user in c.repo_info.permissions():
                 %if getattr(_user, 'admin_row', None) or getattr(_user, 'owner_row', None):
                     <tr class="perm_admin_row">
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.none', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.read', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.write', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.admin', 'repository.admin', disabled="disabled")}</td>
                         <td class="td-user">
                             ${base.gravatar(_user.email, 16)}
                             ${h.link_to_user(_user.username)}
                             %if getattr(_user, 'admin_row', None):
                                 (${_('super admin')})
                             %endif
                             %if getattr(_user, 'owner_row', None):
                                 (${_('owner')})
                             %endif
                         </td>
                         <td></td>
                     </tr>
                 %elif _user.username == h.DEFAULT_USER and c.repo_info.private:
                     <tr>
                         <td colspan="4">
                             <span class="private_repo_msg">
                             <strong title="${h.tooltip(_user.permission)}">${_('private repository')}</strong>
                             </span>
                         </td>
                         <td class="private_repo_msg">
                             ${base.gravatar(h.DEFAULT_USER_EMAIL, 16)}
                             ${h.DEFAULT_USER} - ${_('only users/user groups explicitly added here will have access')}</td>
                         <td></td>
                     </tr>
                 %else:
                     <tr>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.none', checked=_user.permission=='repository.none')}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.read', checked=_user.permission=='repository.read')}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.write', checked=_user.permission=='repository.write')}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.admin', checked=_user.permission=='repository.admin')}</td>
                         <td class="td-user">
                             ${base.gravatar(_user.email, 16)}
                             <span class="user">
                                 % if _user.username == h.DEFAULT_USER:
                                     ${h.DEFAULT_USER} <span class="user-perm-help-text"> - ${_('permission for all other users')}</span>
                                 % else:
                                     ${h.link_to_user(_user.username)}
                                 % endif
                             </span>
                         </td>
                         <td class="td-action">
                           %if _user.username != h.DEFAULT_USER:
                             <span class="btn btn-link btn-danger revoke_perm"
                                   member="${_user.user_id}" member_type="user">
                             <i class="icon-remove"></i> ${_('Revoke')}
                             </span>
                           %endif
                         </td>
                     </tr>
                 %endif
             %endfor
 
             ## USER GROUPS
             %for _user_group in c.repo_info.permission_user_groups():
                 <tr>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.none', checked=_user_group.permission=='repository.none')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.read', checked=_user_group.permission=='repository.read')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.write', checked=_user_group.permission=='repository.write')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.admin', checked=_user_group.permission=='repository.admin')}</td>
                     <td class="td-componentname">
                         <i class="icon-group" ></i>
                         %if h.HasPermissionAny('hg.admin')():
                          <a href="${h.url('edit_users_group',user_group_id=_user_group.users_group_id)}">
                              ${_user_group.users_group_name}
                          </a>
                         %else:
                          ${_user_group.users_group_name}
                         %endif
                     </td>
                     <td class="td-action">
                         <span class="btn btn-link btn-danger revoke_perm"
                               member="${_user_group.users_group_id}" member_type="user_group">
                         <i class="icon-remove"></i> ${_('Revoke')}
                         </span>
                     </td>
                 </tr>
             %endfor
             <tr class="new_members" id="add_perm_input"></tr>
         </table>
         <div id="add_perm" class="link">
             ${_('Add new')}
         </div>
         <div class="buttons">
           ${h.submit('save',_('Save'),class_="btn btn-primary")}
           ${h.reset('reset',_('Reset'),class_="btn btn-danger")}
         </div>
         ${h.end_form()}
     </div>
 </div>
 
 <script type="text/javascript">
     $('#add_perm').on('click', function(e){
         addNewPermInput($(this), 'repository');
     });
     $('.revoke_perm').on('click', function(e){
         markRevokePermInput($(this), 'repository');
     });
 </script>

rhodecode/templates/admin/repos/repo_edit_settings.mako

@@ -1,260 +1,260 b''
 ## -*- coding: utf-8 -*-
 <%namespace name="base" file="/base/base.mako"/>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Settings for Repository: %s') % c.rhodecode_db_repo.repo_name}</h3>
     </div>
     <div class="panel-body">
-    ${h.secure_form(h.route_path('edit_repo', repo_name=c.rhodecode_db_repo.repo_name), method='POST')}
+    ${h.secure_form(h.route_path('edit_repo', repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
     <div class="form">
         <!-- fields -->
         <div class="fields">
 
             <div class="field">
                 <div class="label">
                     <label for="repo_name">${_('Name')}:</label>
                 </div>
                 <div class="input">
                     ${c.form['repo_name'].render(css_class='medium', oid='repo_name')|n}
                     ${c.form.render_error(request, c.form['repo_name'])|n}
 
                     <p class="help-block">${_('Non-changeable id')}: `_${c.rhodecode_db_repo.repo_id}` <span><a href="#" onclick="$('#clone_id').toggle();return false">${_('what is that ?')}</a></span></p>
                     <p id="clone_id" style="display:none;">
                         ${_('URL by id')}: `${c.rhodecode_db_repo.clone_url(with_id=True)}` <br/>
                         ${_('''In case this repository is renamed or moved into another group the repository url changes.
                                Using above url guarantees that this repository will always be accessible under such url.
                                Useful for CI systems, or any other cases that you need to hardcode the url into 3rd party service.''')}</p>
                 </div>
            </div>
 
            <div class="field">
                 <div class="label">
                     <label for="repo_group">${_('Repository group')}:</label>
                 </div>
                 <div class="select">
                     ${c.form['repo_group'].render(css_class='medium', oid='repo_group')|n}
                     ${c.form.render_error(request, c.form['repo_group'])|n}
 
                     % if c.personal_repo_group:
                          <a class="btn" href="#" data-personal-group-name="${c.personal_repo_group.group_name}" data-personal-group-id="${c.personal_repo_group.group_id}" onclick="selectMyGroup(this); return false">
                              ${_('Select my personal group (`%(repo_group_name)s`)') % {'repo_group_name': c.personal_repo_group.group_name}}
                          </a>
                     % endif
                     <p class="help-block">${_('Optional select a group to put this repository into.')}</p>
                 </div>
            </div>
 
            % if c.rhodecode_db_repo.repo_type != 'svn':
            <div class="field">
                <div class="label">
                    <label for="clone_uri">${_('Remote uri')}:</label>
                </div>
                <div class="input">
                    %if c.rhodecode_db_repo.clone_uri:
                     ## display, if we don't have any errors
                     % if not c.form['repo_clone_uri'].error:
                     <div id="clone_uri_hidden" class='text-as-placeholder'>
                         <span id="clone_uri_hidden_value">${c.rhodecode_db_repo.clone_uri_hidden}</span>
                         <span class="link" id="edit_clone_uri"><i class="icon-edit"></i>${_('edit')}</span>
                     </div>
                     % endif
 
                     ## alter field
                     <div id="alter_clone_uri" style="${'' if c.form['repo_clone_uri'].error else 'display: none'}">
                         ${c.form['repo_clone_uri'].render(css_class='medium', oid='clone_uri', placeholder=_('enter new value, or leave empty to remove'))|n}
                         ${c.form.render_error(request, c.form['repo_clone_uri'])|n}
                         % if c.form['repo_clone_uri'].error:
                             ## we got error from form subit, means we modify the url
                             ${h.hidden('repo_clone_uri_change', 'MOD')}
                         % else:
                             ${h.hidden('repo_clone_uri_change', 'OLD')}
                         % endif
 
                         % if not c.form['repo_clone_uri'].error:
                         <span class="link" id="cancel_edit_clone_uri">${_('cancel')}</span>
                         % endif
 
                     </div>
                    %else:
                     ## not set yet, display form to set it
                     ${c.form['repo_clone_uri'].render(css_class='medium', oid='clone_uri')|n}
                     ${c.form.render_error(request, c.form['repo_clone_uri'])|n}
                     ${h.hidden('repo_clone_uri_change', 'NEW')}
                    %endif
                  <p id="alter_clone_uri_help_block" class="help-block">
                      <% pull_link = h.literal(h.link_to('remote sync', h.url('edit_repo_remote', repo_name=c.repo_name))) %>
                      ${_('http[s] url where from repository was imported, this field can used for doing {pull_link}.').format(pull_link=pull_link)|n} <br/>
                      ${_('This field is stored encrypted inside Database, a format of http://user:[e-mail]/repo_name can be used and will be hidden from display.')}
                  </p>
                </div>
             </div>
            % else:
            ${h.hidden('repo_clone_uri', '')}
            % endif
 
             <div class="field">
                 <div class="label">
                     <label for="repo_landing_commit_ref">${_('Landing commit')}:</label>
                 </div>
                 <div class="select">
                     ${c.form['repo_landing_commit_ref'].render(css_class='medium', oid='repo_landing_commit_ref')|n}
                     ${c.form.render_error(request, c.form['repo_landing_commit_ref'])|n}
                     <p class="help-block">${_('Default commit for files page, downloads, full text search index and readme')}</p>
                 </div>
             </div>
 
             <div class="field badged-field">
                 <div class="label">
                     <label for="repo_owner">${_('Owner')}:</label>
                 </div>
                 <div class="input">
                     <div class="badge-input-container">
                         <div class="user-badge">
                             ${base.gravatar_with_user(c.rhodecode_db_repo.user.email or c.rhodecode_db_repo.user.username, show_disabled=not c.rhodecode_db_repo.user.active)}
                         </div>
                         <div class="badge-input-wrap">
                             ${c.form['repo_owner'].render(css_class='medium', oid='repo_owner')|n}
                         </div>
                     </div>
                     ${c.form.render_error(request, c.form['repo_owner'])|n}
                     <p class="help-block">${_('Change owner of this repository.')}</p>
                 </div>
             </div>
 
             <div class="field">
                 <div class="label label-textarea">
                     <label for="repo_description">${_('Description')}:</label>
                 </div>
                 <div class="textarea text-area editor">
                     ${c.form['repo_description'].render(css_class='medium', oid='repo_description')|n}
                     ${c.form.render_error(request, c.form['repo_description'])|n}
                     <p class="help-block">${_('Keep it short and to the point. Use a README file for longer descriptions.')}</p>
                 </div>
             </div>
 
             <div class="field">
                 <div class="label label-checkbox">
                     <label for="${c.form['repo_private'].oid}">${_('Private repository')}:</label>
                 </div>
                 <div class="checkboxes">
                     ${c.form['repo_private'].render(css_class='medium')|n}
                     ${c.form.render_error(request, c.form['repo_private'])|n}
                     <span class="help-block">${_('Private repositories are only visible to people explicitly added as collaborators.')}</span>
                 </div>
             </div>
             <div class="field">
                 <div class="label label-checkbox">
                     <label for="${c.form['repo_enable_statistics'].oid}">${_('Enable statistics')}:</label>
                 </div>
                 <div class="checkboxes">
                     ${c.form['repo_enable_statistics'].render(css_class='medium')|n}
                     ${c.form.render_error(request, c.form['repo_enable_statistics'])|n}
                     <span class="help-block">${_('Enable statistics window on summary page.')}</span>
                 </div>
             </div>
             <div class="field">
                 <div class="label label-checkbox">
                     <label for="${c.form['repo_enable_downloads'].oid}">${_('Enable downloads')}:</label>
                 </div>
                 <div class="checkboxes">
                     ${c.form['repo_enable_downloads'].render(css_class='medium')|n}
                     ${c.form.render_error(request, c.form['repo_enable_downloads'])|n}
                     <span class="help-block">${_('Enable download menu on summary page.')}</span>
                 </div>
             </div>
             <div class="field">
                 <div class="label label-checkbox">
                     <label for="${c.form['repo_enable_locking'].oid}">${_('Enable automatic locking')}:</label>
                 </div>
                 <div class="checkboxes">
                     ${c.form['repo_enable_locking'].render(css_class='medium')|n}
                     ${c.form.render_error(request, c.form['repo_enable_locking'])|n}
                     <span class="help-block">${_('Enable automatic locking on repository. Pulling from this repository creates a lock that can be released by pushing back by the same user')}</span>
                 </div>
             </div>
 
             %if c.visual.repository_fields:
               ## EXTRA FIELDS
               %for field in c.repo_fields:
                 <div class="field">
                     <div class="label">
                         <label for="${field.field_key_prefixed}">${field.field_label} (${field.field_key}):</label>
                     </div>
                     <div class="input input-medium">
                         ${h.text(field.field_key_prefixed, field.field_value, class_='medium')}
                         %if field.field_desc:
                           <span class="help-block">${field.field_desc}</span>
                         %endif
                     </div>
                  </div>
               %endfor
             %endif
             <div class="buttons">
               ${h.submit('save',_('Save'),class_="btn")}
               ${h.reset('reset',_('Reset'),class_="btn")}
             </div>
         </div>
     </div>
     ${h.end_form()}
   </div>
 </div>
 
 <script>
     $(document).ready(function(){
         var cloneUrl = function() {
           var alterButton = $('#alter_clone_uri');
           var editButton = $('#edit_clone_uri');
           var cancelEditButton = $('#cancel_edit_clone_uri');
           var hiddenUrl = $('#clone_uri_hidden');
           var hiddenUrlValue = $('#clone_uri_hidden_value');
           var input = $('#clone_uri');
           var helpBlock = $('#alter_clone_uri_help_block');
           var changedFlag = $('#repo_clone_uri_change');
           var originalText = helpBlock.html();
           var obfuscatedUrl = hiddenUrlValue.html();
 
           var edit = function(e) {
             alterButton.show();
             editButton.hide();
             hiddenUrl.hide();
 
             //add the old value next to input for verification
             helpBlock.html("(" + obfuscatedUrl + ")" + "<br\>" + originalText);
             changedFlag.val('MOD');
           };
 
           var cancelEdit = function(e) {
             alterButton.hide();
             editButton.show();
             hiddenUrl.show();
 
             helpBlock.html(originalText);
             changedFlag.val('OLD');
             input.val('');
           };
 
           var initEvents = function() {
             editButton.on('click', edit);
             cancelEditButton.on('click', cancelEdit);
           };
 
           var setInitialState = function() {
             if (input.hasClass('error')) {
               alterButton.show();
               editButton.hide();
               hiddenUrl.hide();
             }
           };
 
           setInitialState();
           initEvents();
         }();
 
         selectMyGroup = function(element) {
             $("#repo_group").val($(element).data('personalGroupId')).trigger("change");
         };
 
         UsersAutoComplete('repo_owner', '${c.rhodecode_user.user_id}');
     });
 </script>

rhodecode/templates/admin/repos/repo_edit_strip.mako

@@ -1,197 +1,197 b''
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Strip commits from repository')}</h3>
     </div>
     <div class="panel-body">
         %if c.repo_info.repo_type != 'svn':
             <h4>${_('Please provide up to %d commits commits to strip') % c.strip_limit}</h4>
             <p>
                 ${_('In the first step commits will be verified for existance in the repository')}. </br>
                 ${_('In the second step, correct commits will be available for stripping')}.
             </p>
-            ${h.secure_form(h.route_path('strip_check', repo_name=c.repo_info.repo_name), method='post')}
+            ${h.secure_form(h.route_path('strip_check', repo_name=c.repo_info.repo_name), method='POST', request=request)}
                 <div id="change_body" class="field">
                     <div id="box-1" class="inputx locked_input">
                         <input class="text" id="changeset_id-1" name="changeset_id-1" size="59"
                               placeholder="${_('Enter full 40 character commit sha')}" type="text" value="">
                         <div id="plus_icon-1" class="btn btn-default plus_input_button" onclick="addNew(1);return false">
                             <i class="icon-plus">${_('Add another commit')}</i>
                         </div>
                     </div>
                 </div>
 
                 <div id="results" style="display:none; padding: 10px 0px;"></div>
 
                 <div class="buttons">
                    <button id="strip_action" class="btn btn-small btn-primary" onclick="checkCommits();return false">
                    ${_('Check commits')}
                    </button>
                 </div>
 
             ${h.end_form()}
         %else:
            <h4>${_('Sorry this functionality is not available for SVN repository')}</h4>
         %endif
     </div>
 </div>
 
 
 <script>
 var plus_leaf = 1;
 
 addNew = function(number){
     if (number >= ${c.strip_limit}){
         return;
     }
     var minus = '<i class="icon-minus">${_('Remove')}</i>';
     $('#plus_icon-'+number).detach();
     number++;
 
     var input = '<div id="box-'+number+'" class="inputx locked_input">'+
                '<input class="text" id="changeset_id-'+number+'" name="changeset_id-'+number+'"  size="59" type="text" value=""' +
             'placeholder="${_('Enter full 40 character commit sha')}">'+
                '<div  id="plus_icon-'+number+'" class="btn btn-default plus_input_button" onclick="addNew('+number+');return false">'+
                    '<i class="icon-plus">${_('Add another commit')}</i>'+
                '</div>'+
                '<div  id="minus_icon-'+number+'" class="btn btn-default minus_input_button" onclick="delOld('+(number)+');return false">'+
                 minus +
                '</div>' +
             '</div>';
     $('#change_body').append(input);
     plus_leaf++;
 };
 
 reIndex = function(number){
     for(var i=number;i<=plus_leaf;i++){
         var check = $('#box-'+i);
         if (check.length == 0){
             var change = $('#box-'+(i+1));
             change.attr('id','box-'+i);
             var plus = $('#plus_icon-'+(i+1));
 
             if (plus.length != 0){
                 plus.attr('id','plus_icon-'+i);
                 plus.attr('onclick','addNew('+i+');return false');
                 plus_leaf--;
             }
             var minus = $('#minus_icon-'+(i+1));
 
             minus.attr('id','minus_icon-'+i);
 
             minus.attr('onclick','delOld('+i+');re' +
             'turn false');
             var input = $('input#changeset_id-'+(i+1));
             input.attr('name','changeset_id-'+i);
             input.attr('id','changeset_id-'+i);
         }
     }
 };
 
 delOld = function(number){
     $('#box-'+number).remove();
     number = number - 1;
     var box = $('#box-'+number);
     var plus =  '<div  id="plus_icon-'+number+'" class="btn btn-default plus_input_button" onclick="addNew('+number +');return false">'+
             '<i id="i_plus_icon-'+number+'" class="icon-plus">${_('Add another commit')}</i></div>';
     var minus = $('#minus_icon-'+number);
     if(number +1 == plus_leaf){
         minus.detach();
         box.append(plus);
         box.append(minus);
         plus_leaf --;
     }
     reIndex(number+1);
 
 };
 
 var resultData = {
     'csrf_token': CSRF_TOKEN
 };
 
 checkCommits = function() {
     var postData = $('form').serialize();
     $('#results').show();
     $('#results').html('<h4>${_('Checking commits')}...</h4>');
     var url = "${h.route_path('strip_check', repo_name=c.repo_info.repo_name)}";
     var btn = $('#strip_action');
     btn.attr('disabled', 'disabled');
     btn.addClass('disabled');
 
     var success = function (data) {
         resultData = {
             'csrf_token': CSRF_TOKEN
         };
         var i = 0;
         var result = '<ol>';
         $.each(data, function(index, value){
             i= index;
             var box = $('#box-'+index);
             if (value.rev){
                 resultData[index] = JSON.stringify(value);
 
                 var verifiedHtml = (
                         '<li style="line-height:1.2em">' +
                             '<code>{0}</code>' +
                             '{1}' +
                             '<div style="white-space:pre">' +
                             'author: {2}\n' +
                             'description: {3}' +
                             '</div>' +
                         '</li>').format(
                             value.rev,
                             "${_(' commit verified positive')}",
                             value.author, value.comment
                             );
                 result += verifiedHtml;
             }
             else {
                 var verifiedHtml = (
                         '<li style="line-height:1.2em">' +
                             '<code><strike>{0}</strike></code>' +
                             '{1}' +
                         '</li>').format(
                             value.commit,
                             "${_(' commit verified negative')}"
                             );
                 result += verifiedHtml;
             }
             box.remove();
         });
         result += '</ol>';
         var box = $('#box-'+(parseInt(i)+1));
         box.remove();
         $('#results').html(result);
     };
 
     btn.html('Strip');
     btn.removeAttr('disabled');
     btn.removeClass('disabled');
     btn.attr('onclick','strip();return false;');
     ajaxPOST(url, postData, success, null);
 };
 
 strip = function() {
     var url = "${h.route_path('strip_execute', repo_name=c.repo_info.repo_name)}";
     var success = function(data) {
         var result = '<h4>Strip executed</h4><ol>';
         $.each(data, function(index, value){
              if(data[index]) {
                  result += '<li><code>' +index+ '</code> ${_(' commit striped successfully')}' + '</li>';
              }
              else {
                  result += '<li><code>' +index+ '</code> ${_(' commit strip failed')}' + '</li>';
              }
         });
         if ($.isEmptyObject(data)) {
             result += '<li>Nothing done...</li>'
         }
         result += '</ol>';
         $('#results').html(result);
 
     };
     ajaxPOST(url, resultData, success, null);
     var btn = $('#strip_action');
     btn.remove();
 
 };
 </script>

rhodecode/templates/admin/settings/settings_sessions.mako

@@ -1,62 +1,62 b''
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('User Sessions Configuration')}</h3>
     </div>
     <div class="panel-body">
         <%
          elems = [
             (_('Session type'), c.session_model.SESSION_TYPE, ''),
             (_('Session expiration period'), '{} seconds'.format(c.session_conf.get('beaker.session.timeout', 0)), ''),
 
             (_('Total sessions'), c.session_count, ''),
             (_('Expired sessions ({} days)').format(c.cleanup_older_days ), c.session_expired_count, ''),
 
         ]
         %>
         <dl class="dl-horizontal settings">
         %for dt, dd, tt in elems:
           <dt>${dt}:</dt>
           <dd title="${h.tooltip(tt)}">${dd}</dd>
         %endfor
         </dl>
     </div>
 </div>
 
 
 <div class="panel panel-warning">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Cleanup Old Sessions')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.route_path('admin_settings_sessions_cleanup'), method='post')}
+        ${h.secure_form(h.route_path('admin_settings_sessions_cleanup'), method='POST', request=request)}
 
             <p>
             ${_('Cleanup user sessions that were not active during chosen time frame.')} <br/>
             ${_('After performing this action users whose session will be removed will be required to log in again.')} <br/>
             <strong>${_('Picking `All` will log-out you, and all users in the system.')}</strong>
            </p>
 
             <script type="text/javascript">
               $(document).ready(function() {
                   $('#expire_days').select2({
                       containerCssClass: 'drop-menu',
                       dropdownCssClass: 'drop-menu-dropdown',
                       dropdownAutoWidth: true,
                       minimumResultsForSearch: -1
                   });
               });
             </script>
             <select id="expire_days" name="expire_days">
                 % for n in [60, 90, 30, 7, 0]:
                     <option value="${n}">${'{} days'.format(n) if n != 0 else 'All'}</option>
                 % endfor
             </select>
             <button class="btn btn-small" type="submit"
                 onclick="return confirm('${_('Confirm to cleanup user sessions')}');">
                 ${_('Cleanup sessions')}
             </button>
         ${h.end_form()}
     </div>
 </div>
 
 

rhodecode/templates/admin/users/user_edit_auth_tokens.mako

@@ -1,157 +1,157 b''
 <div class="panel panel-default">
     <div class="panel-heading">
       <h3 class="panel-title">${_('Authentication Tokens')}</h3>
     </div>
     <div class="panel-body">
         <div class="apikeys_wrap">
           <p>
              ${_('Each token can have a role. Token with a role can be used only in given context, '
              'e.g. VCS tokens can be used together with the authtoken auth plugin for git/hg/svn operations only.')}
           </p>
           <table class="rctable auth_tokens">
             <tr>
                 <th>${_('Token')}</th>
                 <th>${_('Scope')}</th>
                 <th>${_('Description')}</th>
                 <th>${_('Role')}</th>
                 <th>${_('Expiration')}</th>
                 <th>${_('Action')}</th>
             </tr>
             %if c.user_auth_tokens:
                 %for auth_token in c.user_auth_tokens:
                   <tr class="${'expired' if auth_token.expired else ''}">
                     <td class="truncate-wrap td-authtoken"><div class="user_auth_tokens truncate autoexpand"><code>${auth_token.api_key}</code></div></td>
                     <td class="td">${auth_token.scope_humanized}</td>
                     <td class="td-wrap">${auth_token.description}</td>
                     <td class="td-tags">
                         <span class="tag disabled">${auth_token.role_humanized}</span>
                     </td>
                     <td class="td-exp">
                          %if auth_token.expires == -1:
                           ${_('never')}
                          %else:
                             %if auth_token.expired:
                                 <span style="text-decoration: line-through">${h.age_component(h.time_to_utcdatetime(auth_token.expires))}</span>
                             %else:
                                 ${h.age_component(h.time_to_utcdatetime(auth_token.expires))}
                             %endif
                          %endif
                     </td>
                     <td class="td-action">
-                        ${h.secure_form(h.route_path('edit_user_auth_tokens_delete', user_id=c.user.user_id), method='POST')}
+                        ${h.secure_form(h.route_path('edit_user_auth_tokens_delete', user_id=c.user.user_id), method='POST', request=request)}
                             ${h.hidden('del_auth_token', auth_token.user_api_key_id)}
                             <button class="btn btn-link btn-danger" type="submit"
                                     onclick="return confirm('${_('Confirm to remove this auth token: %s') % auth_token.token_obfuscated}');">
                                 ${_('Delete')}
                             </button>
                         ${h.end_form()}
                     </td>
                   </tr>
                 %endfor
             %else:
             <tr><td><div class="ip">${_('No additional auth tokens specified')}</div></td></tr>
             %endif
           </table>
         </div>
 
         <div class="user_auth_tokens">
-            ${h.secure_form(h.route_path('edit_user_auth_tokens_add', user_id=c.user.user_id), method='POST')}
+            ${h.secure_form(h.route_path('edit_user_auth_tokens_add', user_id=c.user.user_id), method='POST', request=request)}
             <div class="form form-vertical">
                 <!-- fields -->
                 <div class="fields">
                      <div class="field">
                         <div class="label">
                             <label for="new_email">${_('New authentication token')}:</label>
                         </div>
                         <div class="input">
                             ${h.text('description', class_='medium', placeholder=_('Description'))}
                             ${h.select('lifetime', '', c.lifetime_options)}
                             ${h.select('role', '', c.role_options)}
 
                             % if c.allow_scoped_tokens:
                                 ${h.hidden('scope_repo_id')}
                             % else:
                                 ${h.select('scope_repo_id_disabled', '', ['Scopes available in EE edition'], disabled='disabled')}
                             % endif
                         </div>
                         <p class="help-block">
                           ${_('Repository scope works only with tokens with VCS type.')}
                         </p>
                      </div>
                     <div class="buttons">
                       ${h.submit('save',_('Add'),class_="btn")}
                       ${h.reset('reset',_('Reset'),class_="btn")}
                     </div>
                 </div>
             </div>
             ${h.end_form()}
         </div>
     </div>
 </div>
 
 <script>
 
 $(document).ready(function(){
 var select2Options = {
     'containerCssClass': "drop-menu",
     'dropdownCssClass': "drop-menu-dropdown",
     'dropdownAutoWidth': true
 };
 $("#lifetime").select2(select2Options);
 $("#role").select2(select2Options);
 
 var repoFilter = function(data) {
     var results = [];
 
     if (!data.results[0]) {
         return data
     }
 
     $.each(data.results[0].children, function() {
         // replace name to ID for submision
         this.id = this.obj.repo_id;
         results.push(this);
     });
 
     data.results[0].children = results;
     return data;
 };
 
 $("#scope_repo_id_disabled").select2(select2Options);
 
 $("#scope_repo_id").select2({
     cachedDataSource: {},
     minimumInputLength: 2,
     placeholder: "${_('repository scope')}",
     dropdownAutoWidth: true,
     containerCssClass: "drop-menu",
     dropdownCssClass: "drop-menu-dropdown",
     formatResult: formatResult,
     query: $.debounce(250, function(query){
         self = this;
         var cacheKey = query.term;
         var cachedData = self.cachedDataSource[cacheKey];
 
         if (cachedData) {
             query.callback({results: cachedData.results});
         } else {
             $.ajax({
                 url: pyroutes.url('repo_list_data'),
                 data: {'query': query.term},
                 dataType: 'json',
                 type: 'GET',
                 success: function(data) {
                     data = repoFilter(data);
                     self.cachedDataSource[cacheKey] = data;
                     query.callback({results: data.results});
                 },
                 error: function(data, textStatus, errorThrown) {
                     alert("Error while fetching entries.\nError code {0} ({1}).".format(data.status, data.statusText));
                 }
 })
         }
     })
 });
 
 });
 </script>

rhodecode/templates/admin/users/user_edit_emails.mako

@@ -1,71 +1,71 b''
 <%namespace name="base" file="/base/base.mako"/>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Additional Email Addresses')}</h3>
     </div>
     <div class="panel-body">
         <div class="emails_wrap">
           <table class="rctable account_emails useremails">
             <tr>
             <td class="td-user">
                 ${base.gravatar(c.user.email, 16)}
                 <span class="user email">${c.user.email}</span>
             </td>
             <td class="td-tags">
                 <span class="tag">${_('Primary')}</span>
             </td>
             </tr>
             %if c.user_email_map:
                 %for em in c.user_email_map:
                   <tr>
                     <td class="td-user">
                         ${base.gravatar(em.email, 16)}
                         <span class="user email">${em.email}</span>
                     </td>
                     <td class="td-action">
-                        ${h.secure_form(h.route_path('edit_user_emails_delete', user_id=c.user.user_id), method='POST')}
+                        ${h.secure_form(h.route_path('edit_user_emails_delete', user_id=c.user.user_id), method='POST', request=request)}
                             ${h.hidden('del_email_id', em.email_id)}
                             <button class="btn btn-link btn-danger" type="submit"
                                     onclick="return confirm('${_('Confirm to delete this email: %s') % em.email}');">
                                 ${_('Delete')}
                             </button>
                         ${h.end_form()}
                     </td>
                   </tr>
                 %endfor
             %else:
             <tr class="noborder">
                 <td colspan="3">
                     <div class="td-email">
                         ${_('No additional emails specified')}
                     </div>
                 </td>
             </tr>
             %endif
           </table>
         </div>
 
-        ${h.secure_form(h.route_path('edit_user_emails_add', user_id=c.user.user_id), method='POST')}
+        ${h.secure_form(h.route_path('edit_user_emails_add', user_id=c.user.user_id), method='POST', request=request)}
         <div class="form">
             <!-- fields -->
             <div class="fields">
                  <div class="field">
                     <div class="label">
                         <label for="new_email">${_('New email address')}:</label>
                     </div>
                     <div class="input">
                         ${h.text('new_email', class_='medium')}
                     </div>
                  </div>
                 <div class="buttons">
                   ${h.submit('save',_('Add'),class_="btn btn-small")}
                   ${h.reset('reset',_('Reset'),class_="btn btn-small")}
                 </div>
             </div>
         </div>
         ${h.end_form()}
     </div>
 </div>
 
 

rhodecode/templates/admin/users/user_edit_groups.mako

@@ -1,147 +1,147 b''
 ## -*- coding: utf-8 -*-
 
 
 <div class="panel panel-default">
     <div class="panel-heading">
       <h3 class="panel-title">${_('User groups administration')}</h3>
     </div>
     <div class="panel-body">
         <div class="fields">
             <div class="field">
                 <div class="label label-checkbox">
                     <label for="users_group_active">${_('Add `%s` to user group') % c.user.username}:</label>
                 </div>
                 <div class="input">
                     ${h.text('add_user_to_group', placeholder="user group name", class_="medium")}
                 </div>
 
             </div>
         </div>
 
         <div class="groups_management">
-            ${h.secure_form(h.route_path('edit_user_groups_management_updates', user_id=c.user.user_id), method='post')}
+            ${h.secure_form(h.route_path('edit_user_groups_management_updates', user_id=c.user.user_id), method='POST', request=request)}
             <div id="repos_list_wrap">
                 <table id="user_group_list_table" class="display"></table>
             </div>
             <div class="buttons">
                 ${h.submit('save',_('Save'),class_="btn")}
             </div>
             ${h.end_form()}
         </div>
         </div>
 </div>
 <script>
 var api;
 $(document).ready(function() {
 
     var get_datatable_count = function(){
         $('#user_group_count').text(api.page.info().recordsDisplay);
     };
 
     $('#user_group_list_table').on('click', 'a.editor_remove', function (e) {
         e.preventDefault();
         var row = api.row($(this).closest('tr'));
         row.remove().draw();
     } );
 
     $('#user_group_list_table').DataTable({
       data: ${c.groups|n},
       dom: 'rtp',
       pageLength: ${c.visual.admin_grid_items},
       order: [[ 0, "asc" ]],
       columns: [
          { data: {"_": "group_name",
                   "sort": "group_name"}, title: "${_('Name')}", className: "td-componentname," ,
             render: function (data,type,full,meta)
                     {return '<div><i class="icon-group" title="User group">'+data+'</i></div>'}},
 
          { data: {"_": "group_description",
                   "sort": "group_description"}, title: "${_('Description')}", className: "td-description" },
          { data: {"_": "users_group_id"}, className: "td-user",
                  render: function (data,type,full,meta)
                     {return '<input type="hidden" name="users_group_id" value="'+data+'">'}},
          { data: {"_": "active",
                   "sort": "active"}, title: "${_('Active')}", className: "td-active", className: "td-number"},
          { data: {"_": "owner_data"}, title: "${_('Owner')}", className: "td-user",
              render: function (data,type,full,meta)
                     {return '<div class="rc-user tooltip">'+
                             '<img class="gravatar" src="'+ data.owner_icon +'" height="16" width="16">'+
                              data.owner +'</div>'
                     }
 },
          { data: null,
              title: "${_('Action')}",
              className: "td-action",
              defaultContent: '<a href="" class="btn btn-link btn-danger">Delete</a>'
          },
       ],
       language: {
           paginate: DEFAULT_GRID_PAGINATION,
           emptyTable: _gettext("No user groups available yet.")
       },
       "initComplete": function( settings, json ) {
           var data_grid = $('#user_group_list_table').dataTable();
           api = data_grid.api();
           get_datatable_count();
       }
     });
 
     // update the counter when doing search
     $('#user_group_list_table').on( 'search.dt', function (e,settings) {
         get_datatable_count();
     });
 
     // filter, filter both grids
     $('#q_filter').on( 'keyup', function () {
       var user_api = $('#user_group_list_table').dataTable().api();
       user_api
         .columns(0)
         .search(this.value)
         .draw();
     });
 
     // refilter table if page load via back button
     $("#q_filter").trigger('keyup');
 
   });
 
     $('#language').select2({
         'containerCssClass': "drop-menu",
         'dropdownCssClass': "drop-menu-dropdown",
         'dropdownAutoWidth': true
     });
 
 
 
 $(document).ready(function(){
     $("#group_parent_id").select2({
         'containerCssClass': "drop-menu",
         'dropdownCssClass': "drop-menu-dropdown",
         'dropdownAutoWidth': true
     });
 
     $('#add_user_to_group').autocomplete({
         serviceUrl: pyroutes.url('user_group_autocomplete_data'),
         minChars:2,
         maxHeight:400,
         width:300,
         deferRequestBy: 300, //miliseconds
         showNoSuggestionNotice: true,
         params: { user_groups:true },
         formatResult: autocompleteFormatResult,
         lookupFilter: autocompleteFilterResult,
         onSelect: function(element, suggestion){
             var owner = {owner_icon: suggestion.owner_icon, owner:suggestion.owner};
             api.row.add(
                     {"active": suggestion.active,
                         "owner_data": owner,
                         "users_group_id": suggestion.id,
                         "group_description": suggestion.description,
                         "group_name": suggestion.value}).draw();
         }
     });
 })
 
 </script>
 
 

rhodecode/templates/admin/users/user_edit_ips.mako

@@ -1,78 +1,78 b''
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Custom IP Whitelist')}</h3>
     </div>
     <div class="panel-body">
         <div class="ips_wrap">
         <h5>${_('Current IP address')}: <code>${c.rhodecode_user.ip_addr}</code></h5>
   <table class="rctable ip-whitelist">
     <tr>
       <th>${_('IP Address')}</th>
       <th>${_('IP Range')}</th>
       <th>${_('Description')}</th>
       <th></th>
     </tr>
     %if c.default_user_ip_map and c.inherit_default_ips:
         %for ip in c.default_user_ip_map:
           <tr>
             <td class="td-ip"><div class="ip">${ip.ip_addr}</div></td>
             <td class="td-iprange"><div class="ip">${h.ip_range(ip.ip_addr)}</div></td>
             <td class="td-description">${h.literal(_('Inherited from %s') % h.link_to('*default*',h.url('admin_permissions_ips')))}</td>
             <td></td>
           </tr>
         %endfor
     %endif
 
     %if c.user_ip_map:
         %for ip in c.user_ip_map:
           <tr>
             <td class="td-ip"><div class="ip">${ip.ip_addr}</div></td>
             <td class="td-iprange"><div class="ip">${h.ip_range(ip.ip_addr)}</div></td>
             <td class="td-description"><div class="ip">${ip.description}</div></td>
             <td class="td-action">
-                ${h.secure_form(h.route_path('edit_user_ips_delete', user_id=c.user.user_id), method='POST')}
+                ${h.secure_form(h.route_path('edit_user_ips_delete', user_id=c.user.user_id), method='POST', request=request)}
                     ${h.hidden('del_ip_id', ip.ip_id)}
                     ${h.submit('remove_', _('Delete'),id="remove_ip_%s" % ip.ip_id,
                     class_="btn btn-link btn-danger", onclick="return confirm('"+_('Confirm to delete this ip: %s') % ip.ip_addr+"');")}
                 ${h.end_form()}
             </td>
           </tr>
         %endfor
     %endif
     %if not c.default_user_ip_map and not c.user_ip_map:
         <tr>
           <td><h2 class="ip">${_('All IP addresses are allowed')}</h2></td>
           <td></td>
           <td></td>
           <td></td>
         </tr>
     %endif
   </table>
 </div>
 
         <div>
-    ${h.secure_form(h.route_path('edit_user_ips_add', user_id=c.user.user_id), method='POST')}
+    ${h.secure_form(h.route_path('edit_user_ips_add', user_id=c.user.user_id), method='POST', request=request)}
     <div class="form">
         <!-- fields -->
         <div class="fields">
              <div class="field">
                 <div class="label">
                     <label for="new_ip">${_('New IP Address')}:</label>
                 </div>
                 <div class="input">
                     ${h.text('new_ip')} ${h.text('description', placeholder=_('Description...'))}
                     <span class="help-block">${_('Enter comma separated list of ip addresses like 127.0.0.1,\n'
                      'or use a ip address with a mask 127.0.0.1/24, to create a network range.\n'
                      'To specify multiple address range use 127.0.0.1-127.0.0.10 syntax')}</span>
                 </div>
              </div>
             <div class="buttons">
               ${h.submit('save',_('Add'),class_="btn btn-small")}
               ${h.reset('reset',_('Reset'),class_="btn btn-small")}
             </div>
         </div>
     </div>
     ${h.end_form()}
 </div>
     </div>
 </div>

rhodecode/templates/base/base.mako

@@ -1,604 +1,604 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="root.mako"/>
 
 <div class="outerwrapper">
   <!-- HEADER -->
   <div class="header">
       <div id="header-inner" class="wrapper">
           <div id="logo">
               <div class="logo-wrapper">
                   <a href="${h.route_path('home')}"><img src="${h.asset('images/rhodecode-logo-white-216x60.png')}" alt="RhodeCode"/></a>
               </div>
               %if c.rhodecode_name:
                <div class="branding">- ${h.branding(c.rhodecode_name)}</div>
               %endif
           </div>
           <!-- MENU BAR NAV -->
           ${self.menu_bar_nav()}
           <!-- END MENU BAR NAV -->
       </div>
   </div>
   ${self.menu_bar_subnav()}
   <!-- END HEADER -->
 
   <!-- CONTENT -->
   <div id="content" class="wrapper">
 
       <rhodecode-toast id="notifications"></rhodecode-toast>
 
       <div class="main">
           ${next.main()}
       </div>
   </div>
   <!-- END CONTENT -->
 
 </div>
 <!-- FOOTER -->
 <div id="footer">
    <div id="footer-inner" class="title wrapper">
        <div>
            <p class="footer-link-right">
                % if c.visual.show_version:
                    RhodeCode Enterprise ${c.rhodecode_version} ${c.rhodecode_edition}
                % endif
                &copy; 2010-${h.datetime.today().year}, <a href="${h.route_url('rhodecode_official')}" target="_blank">RhodeCode GmbH</a>. All rights reserved.
                % if c.visual.rhodecode_support_url:
                   <a href="${c.visual.rhodecode_support_url}" target="_blank">${_('Support')}</a>
                % endif
            </p>
            <% sid = 'block' if request.GET.get('showrcid') else 'none' %>
            <p class="server-instance" style="display:${sid}">
                ## display hidden instance ID if specially defined
                % if c.rhodecode_instanceid:
                    ${_('RhodeCode instance id: %s') % c.rhodecode_instanceid}
                % endif
            </p>
        </div>
    </div>
 </div>
 
 <!-- END FOOTER -->
 
 ### MAKO DEFS ###
 
 <%def name="menu_bar_subnav()">
 </%def>
 
 <%def name="breadcrumbs(class_='breadcrumbs')">
     <div class="${class_}">
     ${self.breadcrumbs_links()}
     </div>
 </%def>
 
 <%def name="admin_menu()">
   <ul class="admin_menu submenu">
       <li><a href="${h.route_path('admin_audit_logs')}">${_('Admin audit logs')}</a></li>
       <li><a href="${h.url('repos')}">${_('Repositories')}</a></li>
       <li><a href="${h.url('repo_groups')}">${_('Repository groups')}</a></li>
       <li><a href="${h.route_path('users')}">${_('Users')}</a></li>
       <li><a href="${h.url('users_groups')}">${_('User groups')}</a></li>
       <li><a href="${h.url('admin_permissions_application')}">${_('Permissions')}</a></li>
       <li><a href="${h.route_path('auth_home', traverse='')}">${_('Authentication')}</a></li>
       <li><a href="${h.route_path('global_integrations_home')}">${_('Integrations')}</a></li>
       <li><a href="${h.url('admin_defaults_repositories')}">${_('Defaults')}</a></li>
       <li class="last"><a href="${h.url('admin_settings')}">${_('Settings')}</a></li>
   </ul>
 </%def>
 
 
 <%def name="dt_info_panel(elements)">
     <dl class="dl-horizontal">
     %for dt, dd, title, show_items in elements:
       <dt>${dt}:</dt>
       <dd title="${h.tooltip(title)}">
       %if callable(dd):
           ## allow lazy evaluation of elements
           ${dd()}
       %else:
           ${dd}
       %endif
       %if show_items:
           <span class="btn-collapse" data-toggle="item-${h.md5_safe(dt)[:6]}-details">${_('Show More')} </span>
       %endif
       </dd>
 
       %if show_items:
           <div class="collapsable-content" data-toggle="item-${h.md5_safe(dt)[:6]}-details" style="display: none">
           %for item in show_items:
               <dt></dt>
               <dd>${item}</dd>
           %endfor
           </div>
       %endif
 
     %endfor
     </dl>
 </%def>
 
 
 <%def name="gravatar(email, size=16)">
   <%
     if (size > 16):
         gravatar_class = 'gravatar gravatar-large'
     else:
         gravatar_class = 'gravatar'
   %>
   <%doc>
     TODO: johbo: For now we serve double size images to make it smooth
     for retina. This is how it worked until now. Should be replaced
     with a better solution at some point.
   </%doc>
   <img class="${gravatar_class}" src="${h.gravatar_url(email, size * 2)}" height="${size}" width="${size}">
 </%def>
 
 
 <%def name="gravatar_with_user(contact, size=16, show_disabled=False)">
   <% email = h.email_or_none(contact) %>
   <div class="rc-user tooltip" title="${h.tooltip(h.author_string(email))}">
     ${self.gravatar(email, size)}
     <span class="${'user user-disabled' if show_disabled else 'user'}"> ${h.link_to_user(contact)}</span>
   </div>
 </%def>
 
 
 ## admin menu used for people that have some admin resources
 <%def name="admin_menu_simple(repositories=None, repository_groups=None, user_groups=None)">
   <ul class="submenu">
    %if repositories:
       <li class="local-admin-repos"><a href="${h.url('repos')}">${_('Repositories')}</a></li>
    %endif
    %if repository_groups:
       <li class="local-admin-repo-groups"><a href="${h.url('repo_groups')}">${_('Repository groups')}</a></li>
    %endif
    %if user_groups:
       <li class="local-admin-user-groups"><a href="${h.url('users_groups')}">${_('User groups')}</a></li>
    %endif
   </ul>
 </%def>
 
 <%def name="repo_page_title(repo_instance)">
 <div class="title-content">
     <div class="title-main">
         ## SVN/HG/GIT icons
         %if h.is_hg(repo_instance):
             <i class="icon-hg"></i>
         %endif
         %if h.is_git(repo_instance):
             <i class="icon-git"></i>
         %endif
         %if h.is_svn(repo_instance):
             <i class="icon-svn"></i>
         %endif
 
         ## public/private
         %if repo_instance.private:
             <i class="icon-repo-private"></i>
         %else:
             <i class="icon-repo-public"></i>
         %endif
 
         ## repo name with group name
         ${h.breadcrumb_repo_link(c.rhodecode_db_repo)}
 
     </div>
 
     ## FORKED
     %if repo_instance.fork:
     <p>
         <i class="icon-code-fork"></i> ${_('Fork of')}
         <a href="${h.route_path('repo_summary',repo_name=repo_instance.fork.repo_name)}">${repo_instance.fork.repo_name}</a>
     </p>
     %endif
 
     ## IMPORTED FROM REMOTE
     %if repo_instance.clone_uri:
     <p>
        <i class="icon-code-fork"></i> ${_('Clone from')}
        <a href="${h.url(h.safe_str(h.hide_credentials(repo_instance.clone_uri)))}">${h.hide_credentials(repo_instance.clone_uri)}</a>
     </p>
     %endif
 
     ## LOCKING STATUS
      %if repo_instance.locked[0]:
        <p class="locking_locked">
            <i class="icon-repo-lock"></i>
            ${_('Repository locked by %(user)s') % {'user': h.person_by_id(repo_instance.locked[0])}}
        </p>
      %elif repo_instance.enable_locking:
          <p class="locking_unlocked">
              <i class="icon-repo-unlock"></i>
              ${_('Repository not locked. Pull repository to lock it.')}
          </p>
      %endif
 
 </div>
 </%def>
 
 <%def name="repo_menu(active=None)">
     <%
     def is_active(selected):
         if selected == active:
             return "active"
     %>
 
   <!--- CONTEXT BAR -->
   <div id="context-bar">
     <div class="wrapper">
       <ul id="context-pages" class="horizontal-list navigation">
         <li class="${is_active('summary')}"><a class="menulink" href="${h.route_path('repo_summary', repo_name=c.repo_name)}"><div class="menulabel">${_('Summary')}</div></a></li>
         <li class="${is_active('changelog')}"><a class="menulink" href="${h.url('changelog_home', repo_name=c.repo_name)}"><div class="menulabel">${_('Changelog')}</div></a></li>
         <li class="${is_active('files')}"><a class="menulink" href="${h.url('files_home', repo_name=c.repo_name, revision=c.rhodecode_db_repo.landing_rev[1])}"><div class="menulabel">${_('Files')}</div></a></li>
         <li class="${is_active('compare')}">
             <a class="menulink" href="${h.url('compare_home',repo_name=c.repo_name)}"><div class="menulabel">${_('Compare')}</div></a>
         </li>
         ## TODO: anderson: ideally it would have a function on the scm_instance "enable_pullrequest() and enable_fork()"
         %if c.rhodecode_db_repo.repo_type in ['git','hg']:
           <li class="${is_active('showpullrequest')}">
             <a class="menulink" href="${h.route_path('pullrequest_show_all', repo_name=c.repo_name)}" title="${h.tooltip(_('Show Pull Requests for %s') % c.repo_name)}">
               %if c.repository_pull_requests:
                 <span class="pr_notifications">${c.repository_pull_requests}</span>
               %endif
               <div class="menulabel">${_('Pull Requests')}</div>
             </a>
           </li>
         %endif
         <li class="${is_active('options')}">
           <a class="menulink dropdown">
               <div class="menulabel">${_('Options')} <div class="show_more"></div></div>
           </a>
           <ul class="submenu">
              %if h.HasRepoPermissionAll('repository.admin')(c.repo_name):
                    <li><a href="${h.route_path('edit_repo',repo_name=c.repo_name)}">${_('Settings')}</a></li>
              %endif
               %if c.rhodecode_db_repo.fork:
                <li><a href="${h.url('compare_url',repo_name=c.rhodecode_db_repo.fork.repo_name,source_ref_type=c.rhodecode_db_repo.landing_rev[0],source_ref=c.rhodecode_db_repo.landing_rev[1], target_repo=c.repo_name,target_ref_type='branch' if request.GET.get('branch') else c.rhodecode_db_repo.landing_rev[0],target_ref=request.GET.get('branch') or c.rhodecode_db_repo.landing_rev[1], merge=1)}">
                    ${_('Compare fork')}</a></li>
               %endif
 
               <li><a href="${h.route_path('search_repo',repo_name=c.repo_name)}">${_('Search')}</a></li>
 
               %if h.HasRepoPermissionAny('repository.write','repository.admin')(c.repo_name) and c.rhodecode_db_repo.enable_locking:
                 %if c.rhodecode_db_repo.locked[0]:
                   <li><a class="locking_del" href="${h.url('toggle_locking',repo_name=c.repo_name)}">${_('Unlock')}</a></li>
                 %else:
                   <li><a class="locking_add" href="${h.url('toggle_locking',repo_name=c.repo_name)}">${_('Lock')}</a></li>
                 %endif
               %endif
               %if c.rhodecode_user.username != h.DEFAULT_USER:
                 %if c.rhodecode_db_repo.repo_type in ['git','hg']:
                   <li><a href="${h.url('repo_fork_home',repo_name=c.repo_name)}">${_('Fork')}</a></li>
                   <li><a href="${h.url('pullrequest_home',repo_name=c.repo_name)}">${_('Create Pull Request')}</a></li>
                 %endif
               %endif
              </ul>
         </li>
       </ul>
     </div>
     <div class="clear"></div>
   </div>
   <!--- END CONTEXT BAR -->
 
 </%def>
 
 <%def name="usermenu(active=False)">
     ## USER MENU
     <li id="quick_login_li" class="${'active' if active else ''}">
       <a id="quick_login_link" class="menulink childs">
         ${gravatar(c.rhodecode_user.email, 20)}
         <span class="user">
           %if c.rhodecode_user.username != h.DEFAULT_USER:
             <span class="menu_link_user">${c.rhodecode_user.username}</span><div class="show_more"></div>
           %else:
             <span>${_('Sign in')}</span>
           %endif
         </span>
       </a>
 
   <div class="user-menu submenu">
       <div id="quick_login">
         %if c.rhodecode_user.username == h.DEFAULT_USER:
             <h4>${_('Sign in to your account')}</h4>
             ${h.form(h.route_path('login', _query={'came_from': h.url.current()}), needs_csrf_token=False)}
             <div class="form form-vertical">
                 <div class="fields">
                     <div class="field">
                         <div class="label">
                             <label for="username">${_('Username')}:</label>
                         </div>
                         <div class="input">
                             ${h.text('username',class_='focus',tabindex=1)}
                         </div>
 
                     </div>
                     <div class="field">
                         <div class="label">
                             <label for="password">${_('Password')}:</label>
                             %if h.HasPermissionAny('hg.password_reset.enabled')():
                               <span class="forgot_password">${h.link_to(_('(Forgot password?)'),h.route_path('reset_password'), class_='pwd_reset')}</span>
                             %endif
                         </div>
                         <div class="input">
                             ${h.password('password',class_='focus',tabindex=2)}
                         </div>
                     </div>
                     <div class="buttons">
                         <div class="register">
                         %if h.HasPermissionAny('hg.admin', 'hg.register.auto_activate', 'hg.register.manual_activate')():
                          ${h.link_to(_("Don't have an account?"),h.route_path('register'))} <br/>
                         %endif
                         ${h.link_to(_("Using external auth? Sign In here."),h.route_path('login'))}
                         </div>
                         <div class="submit">
                             ${h.submit('sign_in',_('Sign In'),class_="btn btn-small",tabindex=3)}
                         </div>
                     </div>
                 </div>
             </div>
             ${h.end_form()}
         %else:
             <div class="">
                 <div class="big_gravatar">${gravatar(c.rhodecode_user.email, 48)}</div>
                 <div class="full_name">${c.rhodecode_user.full_name_or_username}</div>
                 <div class="email">${c.rhodecode_user.email}</div>
             </div>
             <div class="">
             <ol class="links">
               <li>${h.link_to(_(u'My account'),h.route_path('my_account_profile'))}</li>
               % if c.rhodecode_user.personal_repo_group:
                 <li>${h.link_to(_(u'My personal group'), h.route_path('repo_group_home', repo_group_name=c.rhodecode_user.personal_repo_group.group_name))}</li>
               % endif
               <li class="logout">
-              ${h.secure_form(h.route_path('logout'))}
+              ${h.secure_form(h.route_path('logout'), request=request)}
                   ${h.submit('log_out', _(u'Sign Out'),class_="btn btn-primary")}
               ${h.end_form()}
               </li>
             </ol>
             </div>
         %endif
       </div>
   </div>
       %if c.rhodecode_user.username != h.DEFAULT_USER:
         <div class="pill_container">
         % if c.unread_notifications == 0:
           <a class="menu_link_notifications empty" href="${h.url('notifications')}">${c.unread_notifications}</a>
         % else:
           <a class="menu_link_notifications" href="${h.url('notifications')}">${c.unread_notifications}</a>
         % endif
         </div>
       % endif
     </li>
 </%def>
 
 <%def name="menu_items(active=None)">
     <%
     def is_active(selected):
         if selected == active:
             return "active"
         return ""
     %>
     <ul id="quick" class="main_nav navigation horizontal-list">
       <!-- repo switcher -->
       <li class="${is_active('repositories')} repo_switcher_li has_select2">
         <input id="repo_switcher" name="repo_switcher" type="hidden">
       </li>
 
       ## ROOT MENU
       %if c.rhodecode_user.username != h.DEFAULT_USER:
         <li class="${is_active('journal')}">
           <a class="menulink" title="${_('Show activity journal')}" href="${h.url('journal')}">
             <div class="menulabel">${_('Journal')}</div>
           </a>
         </li>
       %else:
         <li class="${is_active('journal')}">
           <a class="menulink" title="${_('Show Public activity journal')}" href="${h.url('public_journal')}">
             <div class="menulabel">${_('Public journal')}</div>
           </a>
         </li>
       %endif
         <li class="${is_active('gists')}">
           <a class="menulink childs" title="${_('Show Gists')}" href="${h.route_path('gists_show')}">
             <div class="menulabel">${_('Gists')}</div>
           </a>
         </li>
       <li class="${is_active('search')}">
           <a class="menulink" title="${_('Search in repositories you have access to')}" href="${h.route_path('search')}">
             <div class="menulabel">${_('Search')}</div>
           </a>
       </li>
       % if h.HasPermissionAll('hg.admin')('access admin main page'):
         <li class="${is_active('admin')}">
           <a class="menulink childs" title="${_('Admin settings')}" href="#" onclick="return false;">
             <div class="menulabel">${_('Admin')} <div class="show_more"></div></div>
           </a>
           ${admin_menu()}
         </li>
       % elif c.rhodecode_user.repositories_admin or c.rhodecode_user.repository_groups_admin or c.rhodecode_user.user_groups_admin:
       <li class="${is_active('admin')}">
           <a class="menulink childs" title="${_('Delegated Admin settings')}">
             <div class="menulabel">${_('Admin')} <div class="show_more"></div></div>
           </a>
           ${admin_menu_simple(c.rhodecode_user.repositories_admin,
                               c.rhodecode_user.repository_groups_admin,
                               c.rhodecode_user.user_groups_admin or h.HasPermissionAny('hg.usergroup.create.true')())}
       </li>
       % endif
       % if c.debug_style:
       <li class="${is_active('debug_style')}">
           <a class="menulink" title="${_('Style')}" href="${h.route_path('debug_style_home')}">
             <div class="menulabel">${_('Style')}</div>
           </a>
       </li>
       % endif
       ## render extra user menu
       ${usermenu(active=(active=='my_account'))}
     </ul>
 
     <script type="text/javascript">
         var visual_show_public_icon = "${c.visual.show_public_icon}" == "True";
 
         /*format the look of items in the list*/
         var format = function(state, escapeMarkup){
             if (!state.id){
               return state.text; // optgroup
             }
             var obj_dict = state.obj;
             var tmpl = '';
 
             if(obj_dict && state.type == 'repo'){
                 if(obj_dict['repo_type'] === 'hg'){
                     tmpl += '<i class="icon-hg"></i> ';
                 }
                 else if(obj_dict['repo_type'] === 'git'){
                     tmpl += '<i class="icon-git"></i> ';
                 }
                 else if(obj_dict['repo_type'] === 'svn'){
                     tmpl += '<i class="icon-svn"></i> ';
                 }
                 if(obj_dict['private']){
                     tmpl += '<i class="icon-lock" ></i> ';
                 }
                 else if(visual_show_public_icon){
                     tmpl += '<i class="icon-unlock-alt"></i> ';
                 }
             }
             if(obj_dict && state.type == 'commit') {
                 tmpl += '<i class="icon-tag"></i>';
             }
             if(obj_dict && state.type == 'group'){
                 tmpl += '<i class="icon-folder-close"></i> ';
             }
             tmpl += escapeMarkup(state.text);
             return tmpl;
         };
 
         var formatResult = function(result, container, query, escapeMarkup) {
             return format(result, escapeMarkup);
         };
 
         var formatSelection = function(data, container, escapeMarkup) {
             return format(data, escapeMarkup);
         };
 
         $("#repo_switcher").select2({
             cachedDataSource: {},
             minimumInputLength: 2,
             placeholder: '<div class="menulabel">${_('Go to')} <div class="show_more"></div></div>',
             dropdownAutoWidth: true,
             formatResult: formatResult,
             formatSelection: formatSelection,
             containerCssClass: "repo-switcher",
             dropdownCssClass: "repo-switcher-dropdown",
             escapeMarkup: function(m){
                 // don't escape our custom placeholder
                 if(m.substr(0,23) == '<div class="menulabel">'){
                     return m;
                 }
 
                 return Select2.util.escapeMarkup(m);
             },
             query: $.debounce(250, function(query){
                 self = this;
                 var cacheKey = query.term;
                 var cachedData = self.cachedDataSource[cacheKey];
 
                 if (cachedData) {
                     query.callback({results: cachedData.results});
                 } else {
                     $.ajax({
                         url: pyroutes.url('goto_switcher_data'),
                         data: {'query': query.term},
                         dataType: 'json',
                         type: 'GET',
                         success: function(data) {
                             self.cachedDataSource[cacheKey] = data;
                             query.callback({results: data.results});
                         },
                         error: function(data, textStatus, errorThrown) {
                             alert("Error while fetching entries.\nError code {0} ({1}).".format(data.status, data.statusText));
                         }
                     })
                 }
             })
         });
 
         $("#repo_switcher").on('select2-selecting', function(e){
             e.preventDefault();
             window.location = e.choice.url;
         });
 
     </script>
     <script src="${h.asset('js/rhodecode/base/keyboard-bindings.js', ver=c.rhodecode_version_hash)}"></script>
 </%def>
 
 <div class="modal" id="help_kb" tabindex="-1" role="dialog" aria-labelledby="myModalLabel" aria-hidden="true">
     <div class="modal-dialog">
       <div class="modal-content">
         <div class="modal-header">
           <button type="button" class="close" data-dismiss="modal" aria-hidden="true">&times;</button>
           <h4 class="modal-title" id="myModalLabel">${_('Keyboard shortcuts')}</h4>
         </div>
         <div class="modal-body">
               <div class="block-left">
                 <table class="keyboard-mappings">
                     <tbody>
                   <tr>
                     <th></th>
                     <th>${_('Site-wide shortcuts')}</th>
                   </tr>
                   <%
                      elems = [
                          ('/', 'Open quick search box'),
                          ('g h', 'Goto home page'),
                          ('g g', 'Goto my private gists page'),
                          ('g G', 'Goto my public gists page'),
                          ('n r', 'New repository page'),
                          ('n g', 'New gist page'),
                      ]
                   %>
                   %for key, desc in elems:
                   <tr>
                     <td class="keys">
                       <span class="key tag">${key}</span>
                     </td>
                     <td>${desc}</td>
                   </tr>
                 %endfor
                 </tbody>
                   </table>
               </div>
               <div class="block-left">
                 <table class="keyboard-mappings">
                 <tbody>
                   <tr>
                     <th></th>
                     <th>${_('Repositories')}</th>
                   </tr>
                   <%
                      elems = [
                          ('g s', 'Goto summary page'),
                          ('g c', 'Goto changelog page'),
                          ('g f', 'Goto files page'),
                          ('g F', 'Goto files page with file search activated'),
                          ('g p', 'Goto pull requests page'),
                          ('g o', 'Goto repository settings'),
                          ('g O', 'Goto repository permissions settings'),
                      ]
                   %>
                   %for key, desc in elems:
                   <tr>
                     <td class="keys">
                       <span class="key tag">${key}</span>
                     </td>
                     <td>${desc}</td>
                   </tr>
                 %endfor
                 </tbody>
               </table>
             </div>
         </div>
         <div class="modal-footer">
         </div>
       </div><!-- /.modal-content -->
     </div><!-- /.modal-dialog -->
 </div><!-- /.modal -->

rhodecode/templates/data_table/_dt_elements.mako

@@ -1,317 +1,317 b''
 ## DATA TABLE RE USABLE ELEMENTS
 ## usage:
 ## <%namespace name="dt" file="/data_table/_dt_elements.mako"/>
 <%namespace name="base" file="/base/base.mako"/>
 
 ## REPOSITORY RENDERERS
 <%def name="quick_menu(repo_name)">
   <i class="pointer icon-more"></i>
   <div class="menu_items_container hidden">
     <ul class="menu_items">
       <li>
          <a title="${_('Summary')}" href="${h.route_path('repo_summary',repo_name=repo_name)}">
          <span>${_('Summary')}</span>
          </a>
       </li>
       <li>
          <a title="${_('Changelog')}" href="${h.url('changelog_home',repo_name=repo_name)}">
          <span>${_('Changelog')}</span>
          </a>
       </li>
       <li>
          <a title="${_('Files')}" href="${h.url('files_home',repo_name=repo_name)}">
          <span>${_('Files')}</span>
          </a>
       </li>
       <li>
          <a title="${_('Fork')}" href="${h.url('repo_fork_home',repo_name=repo_name)}">
          <span>${_('Fork')}</span>
          </a>
       </li>
     </ul>
   </div>
 </%def>
 
 <%def name="repo_name(name,rtype,rstate,private,fork_of,short_name=False,admin=False)">
     <%
     def get_name(name,short_name=short_name):
       if short_name:
         return name.split('/')[-1]
       else:
         return name
     %>
   <div class="${'repo_state_pending' if rstate == 'repo_state_pending' else ''} truncate">
     ##NAME
     <a href="${h.route_path('edit_repo',repo_name=name) if admin else h.route_path('repo_summary',repo_name=name)}">
 
     ##TYPE OF REPO
     %if h.is_hg(rtype):
         <span title="${_('Mercurial repository')}"><i class="icon-hg"></i></span>
     %elif h.is_git(rtype):
         <span title="${_('Git repository')}"><i class="icon-git"></i></span>
     %elif h.is_svn(rtype):
         <span title="${_('Subversion repository')}"><i class="icon-svn"></i></span>
     %endif
 
     ##PRIVATE/PUBLIC
     %if private and c.visual.show_private_icon:
       <i class="icon-lock" title="${_('Private repository')}"></i>
     %elif not private and c.visual.show_public_icon:
       <i class="icon-unlock-alt" title="${_('Public repository')}"></i>
     %else:
       <span></span>
     %endif
     ${get_name(name)}
     </a>
     %if fork_of:
       <a href="${h.route_path('repo_summary',repo_name=fork_of.repo_name)}"><i class="icon-code-fork"></i></a>
     %endif
     %if rstate == 'repo_state_pending':
       <i class="icon-cogs" title="${_('Repository creating in progress...')}"></i>
     %endif
   </div>
 </%def>
 
 <%def name="repo_desc(description)">
     <div class="truncate-wrap">${description}</div>
 </%def>
 
 <%def name="last_change(last_change)">
     ${h.age_component(last_change)}
 </%def>
 
 <%def name="revision(name,rev,tip,author,last_msg)">
   <div>
   %if rev >= 0:
       <code><a title="${h.tooltip('%s:\n\n%s' % (author,last_msg))}" class="tooltip" href="${h.url('changeset_home',repo_name=name,revision=tip)}">${'r%s:%s' % (rev,h.short_id(tip))}</a></code>
   %else:
       ${_('No commits yet')}
   %endif
   </div>
 </%def>
 
 <%def name="rss(name)">
   %if c.rhodecode_user.username != h.DEFAULT_USER:
     <a title="${h.tooltip(_('Subscribe to %s rss feed')% name)}" href="${h.route_path('rss_feed_home', repo_name=name, _query=dict(auth_token=c.rhodecode_user.feed_token))}"><i class="icon-rss-sign"></i></a>
   %else:
     <a title="${h.tooltip(_('Subscribe to %s rss feed')% name)}" href="${h.route_path('rss_feed_home', repo_name=name)}"><i class="icon-rss-sign"></i></a>
   %endif
 </%def>
 
 <%def name="atom(name)">
   %if c.rhodecode_user.username != h.DEFAULT_USER:
     <a title="${h.tooltip(_('Subscribe to %s atom feed')% name)}" href="${h.route_path('atom_feed_home', repo_name=name, _query=dict(auth_token=c.rhodecode_user.feed_token))}"><i class="icon-rss-sign"></i></a>
   %else:
     <a title="${h.tooltip(_('Subscribe to %s atom feed')% name)}" href="${h.route_path('atom_feed_home', repo_name=name)}"><i class="icon-rss-sign"></i></a>
   %endif
 </%def>
 
 <%def name="user_gravatar(email, size=16)">
   <div class="rc-user tooltip" title="${h.tooltip(h.author_string(email))}">
     ${base.gravatar(email, 16)}
   </div>
 </%def>
 
 <%def name="repo_actions(repo_name, super_user=True)">
   <div>
     <div class="grid_edit">
       <a href="${h.route_path('edit_repo',repo_name=repo_name)}" title="${_('Edit')}">
         <i class="icon-pencil"></i>Edit</a>
     </div>
     <div class="grid_delete">
-      ${h.secure_form(h.route_path('edit_repo_advanced_delete', repo_name=repo_name), method='POST')}
+      ${h.secure_form(h.route_path('edit_repo_advanced_delete', repo_name=repo_name), method='POST', request=request)}
         ${h.submit('remove_%s' % repo_name,_('Delete'),class_="btn btn-link btn-danger",
         onclick="return confirm('"+_('Confirm to delete this repository: %s') % repo_name+"');")}
       ${h.end_form()}
     </div>
   </div>
 </%def>
 
 <%def name="repo_state(repo_state)">
   <div>
     %if repo_state == 'repo_state_pending':
         <div class="tag tag4">${_('Creating')}</div>
     %elif repo_state == 'repo_state_created':
         <div class="tag tag1">${_('Created')}</div>
     %else:
         <div class="tag alert2" title="${h.tooltip(repo_state)}">invalid</div>
     %endif
   </div>
 </%def>
 
 
 ## REPO GROUP RENDERERS
 <%def name="quick_repo_group_menu(repo_group_name)">
   <i class="pointer icon-more"></i>
   <div class="menu_items_container hidden">
     <ul class="menu_items">
       <li>
          <a href="${h.route_path('repo_group_home', repo_group_name=repo_group_name)}">
          <span class="icon">
              <i class="icon-file-text"></i>
          </span>
          <span>${_('Summary')}</span>
          </a>
       </li>
 
     </ul>
   </div>
 </%def>
 
 <%def name="repo_group_name(repo_group_name, children_groups=None)">
   <div>
     <a href="${h.route_path('repo_group_home', repo_group_name=repo_group_name)}">
     <i class="icon-folder-close" title="${_('Repository group')}"></i>
       %if children_groups:
           ${h.literal(' &raquo; '.join(children_groups))}
       %else:
           ${repo_group_name}
       %endif
   </a>
   </div>
 </%def>
 
 <%def name="repo_group_desc(description)">
     <div class="truncate-wrap">${description}</div>
 </%def>
 
 <%def name="repo_group_actions(repo_group_id, repo_group_name, gr_count)">
  <div class="grid_edit">
     <a href="${h.url('edit_repo_group',group_name=repo_group_name)}" title="${_('Edit')}">Edit</a>
  </div>
  <div class="grid_delete">
     ${h.secure_form(h.url('delete_repo_group', group_name=repo_group_name),method='delete')}
         ${h.submit('remove_%s' % repo_group_name,_('Delete'),class_="btn btn-link btn-danger",
         onclick="return confirm('"+ungettext('Confirm to delete this group: %s with %s repository','Confirm to delete this group: %s with %s repositories',gr_count) % (repo_group_name, gr_count)+"');")}
     ${h.end_form()}
  </div>
 </%def>
 
 
 <%def name="user_actions(user_id, username)">
  <div class="grid_edit">
    <a href="${h.url('edit_user',user_id=user_id)}" title="${_('Edit')}">
      <i class="icon-pencil"></i>Edit</a>
  </div>
  <div class="grid_delete">
   ${h.secure_form(h.url('delete_user', user_id=user_id),method='delete')}
     ${h.submit('remove_',_('Delete'),id="remove_user_%s" % user_id, class_="btn btn-link btn-danger",
     onclick="return confirm('"+_('Confirm to delete this user: %s') % username+"');")}
   ${h.end_form()}
  </div>
 </%def>
 
 <%def name="user_group_actions(user_group_id, user_group_name)">
  <div class="grid_edit">
     <a href="${h.url('edit_users_group', user_group_id=user_group_id)}" title="${_('Edit')}">Edit</a>
  </div>
  <div class="grid_delete">
     ${h.secure_form(h.url('delete_users_group', user_group_id=user_group_id),method='delete')}
       ${h.submit('remove_',_('Delete'),id="remove_group_%s" % user_group_id, class_="btn btn-link btn-danger",
       onclick="return confirm('"+_('Confirm to delete this user group: %s') % user_group_name+"');")}
     ${h.end_form()}
  </div>
 </%def>
 
 
 <%def name="user_name(user_id, username)">
     ${h.link_to(h.person(username, 'username_or_name_or_email'), h.url('edit_user', user_id=user_id))}
 </%def>
 
 <%def name="user_profile(username)">
     ${base.gravatar_with_user(username, 16)}
 </%def>
 
 <%def name="user_group_name(user_group_id, user_group_name)">
   <div>
   <a href="${h.url('edit_users_group', user_group_id=user_group_id)}">
     <i class="icon-group" title="${_('User group')}"></i> ${user_group_name}</a>
   </div>
 </%def>
 
 
 ## GISTS
 
 <%def name="gist_gravatar(full_contact)">
     <div class="gist_gravatar">
       ${base.gravatar(full_contact, 30)}
     </div>
 </%def>
 
 <%def name="gist_access_id(gist_access_id, full_contact)">
     <div>
       <b>
         <a href="${h.route_path('gist_show', gist_id=gist_access_id)}">gist: ${gist_access_id}</a>
       </b>
     </div>
 </%def>
 
 <%def name="gist_author(full_contact, created_on, expires)">
     ${base.gravatar_with_user(full_contact, 16)}
 </%def>
 
 
 <%def name="gist_created(created_on)">
     <div class="created">
       ${h.age_component(created_on, time_is_local=True)}
     </div>
 </%def>
 
 <%def name="gist_expires(expires)">
     <div class="created">
           %if expires == -1:
             ${_('never')}
           %else:
             ${h.age_component(h.time_to_utcdatetime(expires))}
           %endif
     </div>
 </%def>
 
 <%def name="gist_type(gist_type)">
     %if gist_type != 'public':
       <div class="tag">${_('Private')}</div>
     %endif
 </%def>
 
 <%def name="gist_description(gist_description)">
   ${gist_description}
 </%def>
 
 
 ## PULL REQUESTS GRID RENDERERS
 
 <%def name="pullrequest_target_repo(repo_name)">
     <div class="truncate">
       ${h.link_to(repo_name,h.route_path('repo_summary',repo_name=repo_name))}
     </div>
 </%def>
 <%def name="pullrequest_status(status)">
     <div class="${'flag_status %s' % status} pull-left"></div>
 </%def>
 
 <%def name="pullrequest_title(title, description)">
     ${title} <br/>
     ${h.shorter(description, 40)}
 </%def>
 
 <%def name="pullrequest_comments(comments_nr)">
     <i class="icon-comment"></i> ${comments_nr}
 </%def>
 
 <%def name="pullrequest_name(pull_request_id, target_repo_name, short=False)">
     <a href="${h.route_path('pullrequest_show',repo_name=target_repo_name,pull_request_id=pull_request_id)}">
       % if short:
         #${pull_request_id}
       % else:
         ${_('Pull request #%(pr_number)s') % {'pr_number': pull_request_id,}}
       % endif
     </a>
 </%def>
 
 <%def name="pullrequest_updated_on(updated_on)">
     ${h.age_component(h.time_to_utcdatetime(updated_on))}
 </%def>
 
 <%def name="pullrequest_author(full_contact)">
     ${base.gravatar_with_user(full_contact, 16)}
 </%def>

rhodecode/templates/forms/form.pt

@@ -1,100 +1,100 b''
 <form
   tal:define="style style|field.widget.style;
               css_class css_class|string:${field.widget.css_class or field.css_class or ''};
               item_template item_template|field.widget.item_template;
               autocomplete autocomplete|field.autocomplete;
               title title|field.title;
               errormsg errormsg|field.errormsg;
               description description|field.description;
               buttons buttons|field.buttons;
               use_ajax use_ajax|field.use_ajax;
               ajax_options ajax_options|field.ajax_options;
               formid formid|field.formid;
               action action|field.action or None;
               method method|field.method;"
   tal:attributes="autocomplete autocomplete;
                   style style;
                   class css_class;
                   action action;"
   id="${formid}"
   method="${method}"
   enctype="multipart/form-data"
   accept-charset="utf-8"
   i18n:domain="deform"
   >
 
   <fieldset class="deform-form-fieldset">
 
     <legend tal:condition="title">${title}</legend>
 
-    <input type="hidden" name="${h.csrf_token_key}" value="${h.get_csrf_token()}" />
+    <input type="hidden" name="${h.csrf_token_key}" value="${h.get_csrf_token(request.session)}" />
     <input type="hidden" name="_charset_" />
     <input type="hidden" name="__formid__" value="${formid}"/>
 
     <!--
     <div class="alert alert-danger" tal:condition="field.error">
       <div class="error-msg-lbl" i18n:translate=""
         >There was a problem with your submission</div>
       <div class="error-msg-detail" i18n:translate=""
         >Errors have been highlighted below</div>
       <p class="error-msg">${field.errormsg}</p>
     </div>
     -->
 
     <p class="section first" tal:condition="description">
       ${description}
     </p>
 
     <div tal:repeat="child field"
          tal:replace="structure child.render_template(item_template)"/>
 
     <div class="form-group">
       <tal:loop tal:repeat="button buttons">
         <button
               tal:define="btn_disposition repeat.button.start and 'btn-primary' or (button.name == 'delete' and 'btn-danger' or 'btn-default');
               btn_icon button.icon|None"
               tal:attributes="disabled button.disabled if button.disabled else None"
               id="${formid+button.name}"
               name="${button.name}"
               type="${button.type}"
               class="btn ${button.css_class or btn_disposition}"
               value="${button.value}">
           <i tal:condition="btn_icon" class="${btn_icon}"> </i>
           ${button.title}
         </button>
       </tal:loop>
     </div>
 
   </fieldset>
 
   <script type="text/javascript" tal:condition="use_ajax">
    deform.addCallback(
      '${formid}',
      function(oid) {
        var target = '#' + oid;
        var options = {
          target: target,
          replaceTarget: true,
          success: function() {
            deform.processCallbacks();
            deform.focusFirstInput(target);
          },
          beforeSerialize: function() {
            // See http://bit.ly/1agBs9Z (hack to fix tinymce-related ajax bug)
            if ('tinymce' in window) {
              $(tinymce.get()).each(
                function(i, el) {
                  var content = el.getContent();
                  var editor_input = document.getElementById(el.id);
                  editor_input.value = content;
              });
            }
          }
        };
        var extra_options = ${ajax_options} || {};
        $('#' + oid).ajaxForm($.extend(options, extra_options));
      }
    );
   </script>
 
 </form>
  No newline at end of file