release: Merge default into stable for release preparation

docs/auth/auth-saml-duosecurity.rst

@@ -0,0 +1,105
+.. _config-saml-duosecurity-ref:
+
+
+SAML 2.0 with Duo Security
+--------------------------
+
+**This plugin is available only in EE Edition.**
+
+|RCE| supports SAML 2.0 Authentication with Duo Security provider. This allows
+users to log-in to RhodeCode via SSO mechanism of external identity provider
+such as Duo. The login can be triggered either by the external IDP, or internally
+by clicking specific authentication button on the log-in page.
+
+
+Configuration steps
+^^^^^^^^^^^^^^^^^^^
+
+To configure Duo Security SAML authentication, use the following steps:
+
+1. From the |RCE| interface, select
+   :menuselection:`Admin --> Authentication`
+2. Activate the `Duo Security` plugin and select :guilabel:`Save`
+3. Go to newly available menu option called `Duo Security` on the left side.
+4. Check the `enabled` check box in the plugin configuration section,
+   and fill in the required SAML information and :guilabel:`Save`, for more details,
+   see :ref:`config-saml-duosecurity`
+
+
+.. _config-saml-duosecurity:
+
+
+Example SAML Duo Security configuration
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Example configuration for SAML 2.0 with Duo Security provider::
+
+    *option*: `enabled` => `True`
+    # Enable or disable this authentication plugin.
+
+    *option*: `cache_ttl` => `0`
+    # Amount of seconds to cache the authentication and permissions check response call for this plugin.
+    # Useful for expensive calls like LDAP to improve the performance of the system (0 means disabled).
+
+    *option*: `debug` => `True`
+    # Enable or disable debug mode that shows SAML errors in the RhodeCode logs.
+
+    *option*: `entity_id` => `http://rc-app.com/dag/saml2/idp/metadata.php`
+    # Identity Provider entity/metadata URI.
+    # E.g. https://duo-gateway.com/dag/saml2/idp/metadata.php
+
+    *option*: `sso_service_url` => `http://rc-app.com/dag/saml2/idp/SSOService.php?spentityid=http://rc.local.pl/_admin/auth/duosecurity/saml-metadata`
+    # SSO (SingleSignOn) endpoint URL of the IdP. This can be used to initialize login
+    # E.g. https://duo-gateway.com/dag/saml2/idp/SSOService.php?spentityid=<metadata_entity_id>
+
+    *option*: `slo_service_url` => `http://rc-app.com/dag/saml2/idp/SingleLogoutService.php?ReturnTo=http://rc-app.com/dag/module.php/duosecurity/logout.php`
+    # SLO (SingleLogout) endpoint URL of the IdP.
+    # E.g. https://duo-gateway.com/dag/saml2/idp/SingleLogoutService.php?ReturnTo=http://duo-gateway.com/_admin/saml/sign-out-endpoint
+
+    *option*: `x509cert` => `<CERTIFICATE_STRING>`
+    # Identity provider public x509 certificate. It will be converted to single-line format without headers
+
+    *option*: `name_id_format` => `sha-1`
+    # The format that specifies how the NameID is sent to the service provider.
+
+    *option*: `signature_algo` => `sha-256`
+    # Type of Algorithm to use for verification of SAML signature on Identity provider side
+
+    *option*: `digest_algo` => `sha-256`
+    # Type of Algorithm to use for verification of SAML digest on Identity provider side
+
+    *option*: `cert_dir` => `/etc/saml/`
+    # Optional directory to store service provider certificate and private keys.
+    # Expected certs for the SP should be stored in this folder as:
+    #  * sp.key     Private Key
+    #  * sp.crt     Public cert
+    #  * sp_new.crt Future Public cert
+    #
+    # Also you can use other cert to sign the metadata of the SP using the:
+    #  * metadata.key
+    #  * metadata.crt
+
+    *option*: `user_id_attribute` => `PersonImmutableID`
+    # User ID Attribute name. This defines which attribute in SAML response will be used to link accounts via unique id.
+    # Ensure this is returned from DuoSecurity for example via duo_username
+
+    *option*: `username_attribute` => `User.username`
+    # Username Attribute name. This defines which attribute in SAML response will map to an username.
+
+    *option*: `email_attribute` => `User.email`
+    # Email Attribute name. This defines which attribute in SAML response will map to an email address.
+
+
+Below is example setup from DUO Administration page that can be used with above config.
+
+.. image:: ../images/saml-duosecurity-service-provider-example.png
+   :alt: DUO Security SAML setup example
+   :scale: 50 %
+
+
+Below is an example attribute mapping set for IDP provider required by the above config.
+
+
+.. image:: ../images/saml-duosecurity-attributes-example.png
+   :alt: DUO Security SAML setup example
+   :scale: 50 %
  No newline at end of file

docs/auth/auth-saml-generic.rst

@@ -0,0 +1,18
+.. _config-saml-generic-ref:
+
+
+SAML 2.0 Authentication
+-----------------------
+
+
+**This plugin is available only in EE Edition.**
+
+RhodeCode Supports standard SAML 2.0 SSO for the web-application part.
+
+Please check for reference two example providers:
+
+.. toctree::
+
+   auth-saml-duosecurity
+   auth-saml-onelogin
+

docs/auth/auth-saml-onelogin.rst

@@ -0,0 +1,106
+.. _config-saml-onelogin-ref:
+
+
+SAML 2.0 with One Login
+-----------------------
+
+**This plugin is available only in EE Edition.**
+
+|RCE| supports SAML 2.0 Authentication with OneLogin provider. This allows
+users to log-in to RhodeCode via SSO mechanism of external identity provider
+such as OneLogin. The login can be triggered either by the external IDP, or internally
+by clicking specific authentication button on the log-in page.
+
+
+Configuration steps
+^^^^^^^^^^^^^^^^^^^
+
+To configure OneLogin SAML authentication, use the following steps:
+
+1. From the |RCE| interface, select
+   :menuselection:`Admin --> Authentication`
+2. Activate the `OneLogin` plugin and select :guilabel:`Save`
+3. Go to newly available menu option called `OneLogin` on the left side.
+4. Check the `enabled` check box in the plugin configuration section,
+   and fill in the required SAML information and :guilabel:`Save`, for more details,
+   see :ref:`config-saml-onelogin`
+
+
+.. _config-saml-onelogin:
+
+
+Example SAML OneLogin configuration
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Example configuration for SAML 2.0 with OneLogin provider::
+
+    *option*: `enabled` => `True`
+    # Enable or disable this authentication plugin.
+
+    *option*: `cache_ttl` => `0`
+    # Amount of seconds to cache the authentication and permissions check response call for this plugin.
+    # Useful for expensive calls like LDAP to improve the performance of the system (0 means disabled).
+
+    *option*: `debug` => `True`
+    # Enable or disable debug mode that shows SAML errors in the RhodeCode logs.
+
+    *option*: `entity_id` => `https://app.onelogin.com/saml/metadata/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`
+    # Identity Provider entity/metadata URI.
+    # E.g. https://app.onelogin.com/saml/metadata/<onelogin_connector_id>
+
+    *option*: `sso_service_url` => `https://customer-domain.onelogin.com/trust/saml2/http-post/sso/xxxxxx`
+    # SSO (SingleSignOn) endpoint URL of the IdP. This can be used to initialize login
+    # E.g. https://app.onelogin.com/trust/saml2/http-post/sso/<onelogin_connector_id>
+
+    *option*: `slo_service_url` => `https://customer-domain.onelogin.com/trust/saml2/http-redirect/slo/xxxxxx`
+    # SLO (SingleLogout) endpoint URL of the IdP.
+    # E.g. https://app.onelogin.com/trust/saml2/http-redirect/slo/<onelogin_connector_id>
+
+    *option*: `x509cert` => `<CERTIFICATE_STRING>`
+    # Identity provider public x509 certificate. It will be converted to single-line format without headers
+
+    *option*: `name_id_format` => `sha-1`
+    # The format that specifies how the NameID is sent to the service provider.
+
+    *option*: `signature_algo` => `sha-256`
+    # Type of Algorithm to use for verification of SAML signature on Identity provider side
+
+    *option*: `digest_algo` => `sha-256`
+    # Type of Algorithm to use for verification of SAML digest on Identity provider side
+
+    *option*: `cert_dir` => `/etc/saml/`
+    # Optional directory to store service provider certificate and private keys.
+    # Expected certs for the SP should be stored in this folder as:
+    #  * sp.key     Private Key
+    #  * sp.crt     Public cert
+    #  * sp_new.crt Future Public cert
+    #
+    # Also you can use other cert to sign the metadata of the SP using the:
+    #  * metadata.key
+    #  * metadata.crt
+
+    *option*: `user_id_attribute` => `PersonImmutableID`
+    # User ID Attribute name. This defines which attribute in SAML response will be used to link accounts via unique id.
+    # Ensure this is returned from OneLogin for example via Internal ID
+
+    *option*: `username_attribute` => `User.username`
+    # Username Attribute name. This defines which attribute in SAML response will map to an username.
+
+    *option*: `email_attribute` => `User.email`
+    # Email Attribute name. This defines which attribute in SAML response will map to an email address.
+
+
+
+Below is example setup that can be used with OneLogin SAML authentication that can be used with above config..
+
+.. image:: ../images/saml-onelogin-config-example.png
+   :alt: OneLogin SAML setup example
+   :scale: 50 %
+
+
+Below is an example attribute mapping set for IDP provider required by the above config.
+
+
+.. image:: ../images/saml-onelogin-attributes-example.png
+   :alt: OneLogin SAML setup example
+   :scale: 50 %
  No newline at end of file

docs/release-notes/release-notes-4.15.0.rst

@@ -0,0 +1,81
+|RCE| 4.15.0 |RNS|
+------------------
+
+Release Date
+^^^^^^^^^^^^
+
+- 2018-12-10
+
+
+New Features
+^^^^^^^^^^^^
+
+- Authentication: Added SAML 2.0 Authentication, with support of OneLogin and DUO Security.
+- Core: add debug mode that switches logging to debug.
+  It's no longer required to reconfigure all logging. A `debug=true` set in .ini file
+  does it automatically.
+
+
+General
+^^^^^^^
+
+- Authentication: rename oauth to external identity as it would now be serving both
+  oAuth and SAML.
+- Authentication: allow setting extern type with registration.
+  This will allow external identity plugins to define proper externs instead of always
+  using "rhodecode" one.
+- Authentication: show if plugin is activated and enabled in the list.
+- Authentication: add better logging for ldap related attributes to help track
+  LDAP connection problems more easily.
+- Visual: add change logo header template
+- UI: updated error pages style to be consistent with other pages.
+- Utils: updated request generation so ishell can run some automation scripts.
+- Docs: updated documentation for SVN 1.10 Wandisco repositories.
+- System info: expose base_url set in .ini file.
+- Style: update pygments template styling.
+- Style: updated li style and markdown style.
+- Dependencies: added python-saml library.
+- Dependencies: bumped hgsubversion to 1.9.3 release.
+- Dependencies: bumped gevent to 1.3.7 release.
+- Dependencies: bumped lxml to 4.2.5 release.
+- Dependencies: bumped gevent to 1.3.7 release.
+- Dependencies: bumped alembic to 1.0.5 release.
+- Dependencies: bumped peppercorn to 0.6 release.
+- Dependencies: bumped pyotp to 2.2.7 release.
+- Dependencies: bumped deform to 2.0.7 release
+- Dependencies: bumped py-gfm to 0.1.4 release.
+- Dependencies: bumped colander to 1.5.1 release
+- Dependencies: bumped appenlight-client to 0.6.26 release.
+- Dependencies: bumped bleach to 3.0.2 release.
+- Dependencies: bumped pygments to 2.3.0
+
+
+Security
+^^^^^^^^
+
+- Mercurial: support evolve sub-commands when checking for permissions.
+  Those defaulted to write, while only read is required for evolve.
+- auth/security: enforce that external users cannot reset their password.
+  External users don't use RhodeCode passwords, so resetting them shouldn't be allowed.
+
+
+Performance
+^^^^^^^^^^^
+
+- Markdown: use lazy loaded markdown initialization to speed up app startup.
+- Gevent: changed DNS resolver to ares for better stability on long running processes.
+
+
+Fixes
+^^^^^
+
+- Default Reviewers: use target repo owner as default reviewer in case of CE edition.
+- LDAP: ensure the proper cert files and dirs are set.
+  It's also now possible to specify custom paths for those.
+- Markdown: fixed auto checkbox generation from markdown code
+
+
+Upgrade notes
+^^^^^^^^^^^^^
+
+- LDAP cert dirs
  No newline at end of file

rhodecode/config/rcextensions/examples/custom_email_integration_template.py

@@ -0,0 +1,175
+# This code allows override the integrations templates. Put this into the __init__.py
+# file of rcextensions
+
+
+# EMAIL
+from rhodecode.integrations import email
+email.REPO_PUSH_TEMPLATE_HTML = email.Template('''
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
+    <title>${subject}</title>
+    <style type="text/css">
+        /* Based on The MailChimp Reset INLINE: Yes. */
+        #outlook a {padding:0;} /* Force Outlook to provide a "view in browser" menu link. */
+        body{width:100% !important; -webkit-text-size-adjust:100%; -ms-text-size-adjust:100%; margin:0; padding:0;}
+        /* Prevent Webkit and Windows Mobile platforms from changing default font sizes.*/
+        .ExternalClass {width:100%;} /* Force Hotmail to display emails at full width */
+        .ExternalClass, .ExternalClass p, .ExternalClass span, .ExternalClass font, .ExternalClass td, .ExternalClass div {line-height: 100%;}
+        /* Forces Hotmail to display normal line spacing.  More on that: http://www.emailonacid.com/forum/viewthread/43/ */
+        #backgroundTable {margin:0; padding:0; line-height: 100% !important;}
+        /* End reset */
+
+        /* defaults for images*/
+        img {outline:none; text-decoration:none; -ms-interpolation-mode: bicubic;}
+        a img {border:none;}
+        .image_fix {display:block;}
+
+        body {line-height:1.2em;}
+        p {margin: 0 0 20px;}
+        h1, h2, h3, h4, h5, h6 {color:#323232!important;}
+        a {color:#427cc9;text-decoration:none;outline:none;cursor:pointer;}
+        a:focus {outline:none;}
+        a:hover {color: #305b91;}
+        h1 a, h2 a, h3 a, h4 a, h5 a, h6 a {color:#427cc9!important;text-decoration:none!important;}
+        h1 a:active, h2 a:active,  h3 a:active, h4 a:active, h5 a:active, h6 a:active {color: #305b91!important;}
+        h1 a:visited, h2 a:visited,  h3 a:visited, h4 a:visited, h5 a:visited, h6 a:visited {color: #305b91!important;}
+        table {font-size:13px;border-collapse:collapse;mso-table-lspace:0pt;mso-table-rspace:0pt;}
+        table td {padding:.65em 1em .65em 0;border-collapse:collapse;vertical-align:top;text-align:left;}
+        input {display:inline;border-radius:2px;border-style:solid;border: 1px solid #dbd9da;padding:.5em;}
+        input:focus {outline: 1px solid #979797}
+        @media only screen and (-webkit-min-device-pixel-ratio: 2) {
+        /* Put your iPhone 4g styles in here */
+        }
+
+        /* Android targeting */
+        @media only screen and (-webkit-device-pixel-ratio:.75){
+        /* Put CSS for low density (ldpi) Android layouts in here */
+        }
+        @media only screen and (-webkit-device-pixel-ratio:1){
+        /* Put CSS for medium density (mdpi) Android layouts in here */
+        }
+        @media only screen and (-webkit-device-pixel-ratio:1.5){
+        /* Put CSS for high density (hdpi) Android layouts in here */
+        }
+        /* end Android targeting */
+
+    </style>
+
+    <!-- Targeting Windows Mobile -->
+    <!--[if IEMobile 7]>
+    <style type="text/css">
+
+    </style>
+    <![endif]-->
+
+    <!--[if gte mso 9]>
+        <style>
+        /* Target Outlook 2007 and 2010 */
+        </style>
+    <![endif]-->
+</head>
+<body>
+<!-- Wrapper/Container Table: Use a wrapper table to control the width and the background color consistently of your email. Use this approach instead of setting attributes on the body tag. -->
+<table cellpadding="0" cellspacing="0" border="0" id="backgroundTable" align="left" style="margin:1%;width:97%;padding:0;font-family:sans-serif;font-weight:100;border:1px solid #dbd9da">
+    <tr>
+        <td valign="top" style="padding:0;">
+            <table cellpadding="0" cellspacing="0" border="0" align="left" width="100%">
+                <tr><td style="width:100%;padding:7px;background-color:#202020" valign="top">
+                    <a style="color:#eeeeee;text-decoration:none;" href="${instance_url}">
+                        ${'RhodeCode'}
+                    </a>
+                </td></tr>
+                <tr>
+                    <td style="padding:15px;" valign="top">
+                        % if data['push']['commits']:
+                            % for commit in data['push']['commits']:
+                            <a href="${commit['url']}">${commit['short_id']}</a> by ${commit['author']} at ${commit['date']} <br/>
+                            ${commit['message_html']} <br/>
+                            <br/>
+                            % endfor
+                        % else:
+                            No commit data
+                        % endif
+                    </td>
+                </tr>
+            </table>
+        </td>
+    </tr>
+</table>
+<!-- End of wrapper table -->
+<p><a style="margin-top:15px;margin-left:1%;font-family:sans-serif;font-weight:100;font-size:11px;color:#666666;text-decoration:none;" href="${instance_url}">
+    ${'This is a notification from RhodeCode. %(instance_url)s' % {'instance_url': instance_url}}
+</a></p>
+</body>
+</html>
+''')
+
+
+# JIRA (EE ONLY)
+from rc_integrations import jira_tracker
+
+jira_tracker.COMMENT_TEMPLATE_PULL_REQUEST = jira_tracker.Template('''
+${action} by ${author} (status: ${status}). \n
+pull-request: ${url}
+''')
+
+
+jira_tracker.COMMENT_TEMPLATE_COMMIT = jira_tracker.Template('''
+Commit `${short_id}` by ${author} on `${branch}` branch references this issue. \n
+${url}\n
+
+## MODIFICATION add custom COMMIT message to the comment
+${commit['message']}
+''')
+
+
+jira_tracker.COMMENT_TEMPLATE_COMMIT_WITH_STATUS = jira_tracker.Template('''
+Commit `${short_id}` by ${author} on `${branch}` branch changed this issue. \n
+'{url}\n
+
+## MODIFICATION add custom COMMIT message to the comment
+${commit['message']} 
+''')
+
+
+# REDMINE (EE ONLY)
+from rc_integrations import redmine_tracker
+
+redmine_tracker.COMMENT_TEMPLATE_COMMIT = redmine_tracker.Template('''
+Commit `${short_id}` by ${author} on `${branch}` branch references this issue. \n
+commit: ${url}\n
+
+## MODIFICATION add custom COMMIT message to the comment
+message:
+```
+${commit['message']}
+```
+
+''')
+
+redmine_tracker.COMMENT_TEMPLATE_COMMIT_WITH_STATUS = redmine_tracker.Template('''
+Commit `${short_id}` by ${author} on `${branch}` branch changed this issue. \n
+commit: ${url}\n
+
+## MODIFICATION add custom COMMIT message to the comment
+message:
+```
+${commit['message']}
+```
+
+''')
+
+redmine_tracker.COMMENT_TEMPLATE_PULL_REQUEST = redmine_tracker.Template('''
+${action} by ${author} (status: ${status}). \n'
+${url}\n
+
+## MODIFICATION add custom COMMIT message to the comment
+message:
+```
+${commit['message']}
+```
+
+''')

rhodecode/config/rcextensions/examples/validate_commit_message_author.py

@@ -0,0 +1,91
+# Example to validate commit message or author using some sort of rules
+
+
+@has_kwargs({
+    'server_url': 'url of instance that triggered this hook',
+    'config': 'path to .ini config used',
+    'scm': 'type of version control "git", "hg", "svn"',
+    'username': 'username of actor who triggered this event',
+    'ip': 'ip address of actor who triggered this hook',
+    'action': '',
+    'repository': 'repository name',
+    'repo_store_path': 'full path to where repositories are stored',
+    'commit_ids': 'pre transaction metadata for commit ids',
+    'hook_type': '',
+    'user_agent': 'Client user agent, e.g git or mercurial CLI version',
+})
+@has_kwargs({
+    'server_url': 'url of instance that triggered this hook',
+    'config': 'path to .ini config used',
+    'scm': 'type of version control "git", "hg", "svn"',
+    'username': 'username of actor who triggered this event',
+    'ip': 'ip address of actor who triggered this hook',
+    'action': '',
+    'repository': 'repository name',
+    'repo_store_path': 'full path to where repositories are stored',
+    'commit_ids': 'pre transaction metadata for commit ids',
+    'hook_type': '',
+    'user_agent': 'Client user agent, e.g git or mercurial CLI version',
+})
+def _pre_push_hook(*args, **kwargs):
+    """
+    Post push hook
+    To stop version control from storing the transaction and send a message to user
+    use non-zero HookResponse with a message, e.g return HookResponse(1, 'Not allowed')
+
+    This message will be shown back to client during PUSH operation
+
+    Commit ids might look like that::
+
+    [{u'hg_env|git_env': ...,
+      u'multiple_heads': [],
+      u'name': u'default',
+      u'new_rev': u'd0befe0692e722e01d5677f27a104631cf798b69',
+      u'old_rev': u'd0befe0692e722e01d5677f27a104631cf798b69',
+      u'ref': u'',
+      u'total_commits': 2,
+      u'type': u'branch'}]
+    """
+    import re
+    from .helpers import extra_fields, extract_pre_commits
+    from .utils import str2bool
+
+    # returns list of dicts with key-val fetched from extra fields
+    repo_extra_fields = extra_fields.run(**kwargs)
+
+    # optionally use 'extra fields' to control the logic per repo
+    should_validate = str2bool(repo_extra_fields.get('validate_author', True))
+
+    # optionally store validation regex into extra fields
+    validation_regex = repo_extra_fields.get('validation_regex', '')
+
+    def validate_commit_message(commit_message, message_regex=None):
+        """
+        This function validates commit_message against some sort of rules.
+        It should return a valid boolean, and a reason for failure
+        """
+
+        if "secret_string" in commit_message:
+            msg = "!!Push forbidden: secret string found in commit messages"
+            return False, msg
+
+        if validation_regex:
+            regexp = re.compile(validation_regex)
+            if not regexp.match(message):
+                msg = "!!Push forbidden: commit message does not match regexp"
+                return False, msg
+
+        return True, ''
+
+    if should_validate:
+        # returns list of dicts with key-val fetched from extra fields
+        commit_list = extract_pre_commits.run(**kwargs)
+
+        for commit_data in commit_list:
+            message = commit_data['message']
+
+            message_valid, reason = validate_commit_message(message, validation_regex)
+            if not message_valid:
+                return HookResponse(1, reason)
+
+    return HookResponse(0, '')

.bumpversion.cfg

@@ -1,5 +1,5
 [bumpversion]
-current_version = 4.14.1
+current_version = 4.15.0
 message = release: Bump version {current_version} to {new_version}
 
 [bumpversion:file:rhodecode/VERSION]

.release.cfg

@@ -5,25 +5,20 done = false
 done = true
 
 [task:rc_tools_pinned]
-done = true
 
 [task:fixes_on_stable]
-done = true
 
 [task:pip2nix_generated]
-done = true
 
 [task:changelog_updated]
-done = true
 
 [task:generate_api_docs]
-done = true
+
+[task:updated_translation]
 
 [release]
-state = prepared
-version = 4.14.1
-
-[task:updated_translation]
+state = in_progress
+version = 4.15.0
 
 [task:generate_js_routes]
 

README.rst

@@ -7,18 +7,20 About
 
 ``RhodeCode`` is a fast and powerful management tool for Mercurial_ and GIT_
 and Subversion_ with a built in push/pull server, full text search,
-pull requests and powerful code-review system. It works on http/https and
+pull requests and powerful code-review system. It works on http/https, SSH and
 has a few unique features like:
 
- - plugable architecture
- - advanced permission system with IP restrictions
- - rich set of authentication plugins including LDAP,
-   ActiveDirectory, Atlassian Crowd, Http-Headers, Pam, Token-Auth.
- - live code-review chat
- - full web based file editing
- - unified multi vcs support
- - snippets (gist) system
- - integration with all 3rd party issue trackers
+- plugable architecture from Pyramid web-framework.
+- advanced permission system with IP restrictions, inheritation, and user-groups.
+- rich set of authentication plugins including LDAP, ActiveDirectory, SAML 2.0,
+  Atlassian Crowd, Http-Headers, Pam, Token-Auth, OAuth.
+- live code-review chat, and reviewer rules.
+- full web based file editing.
+- unified multi vcs support.
+- snippets (gist) system.
+- integration framework for Slack, CI systems, Webhooks.
+- integration with all 3rd party issue trackers.
+
 
 RhodeCode also provides rich API, and multiple event hooks so it's easy
 integrable with existing external systems.

configs/development.ini

@@ -1,10 +1,11
 
 
 ################################################################################
-##                 RHODECODE COMMUNITY EDITION CONFIGURATION                  ##
+##                RHODECODE COMMUNITY  EDITION CONFIGURATION                  ##
 ################################################################################
 
 [DEFAULT]
+## Debug flag sets all loggers to debug, and enables request tracking
 debug = true
 
 ################################################################################
@@ -414,6 +415,7 search.location = %(here)s/data/index
 ########################################
 ## channelstream enables persistent connections and live notification
 ## in the system. It's also used by the chat system
+
 channelstream.enabled = false
 
 ## server address for channelstream server on the backend
@@ -490,14 +492,6 appenlight.request_keys_blacklist =
 ## (by default the client ignores own entries: appenlight_client.client)
 appenlight.log_namespace_blacklist =
 
-
-################################################################################
-## WARNING: *THE LINE BELOW MUST BE UNCOMMENTED ON A PRODUCTION ENVIRONMENT*  ##
-## Debug mode will enable the interactive debugging tool, allowing ANYONE to  ##
-## execute malicious code after an exception is raised.                       ##
-################################################################################
-#set debug = false
-
 # enable debug style page
 debug_style = true
 

configs/production.ini

@@ -1,11 +1,12
 
 
 ################################################################################
-##                 RHODECODE COMMUNITY EDITION CONFIGURATION                  ##
+##                RHODECODE COMMUNITY  EDITION CONFIGURATION                  ##
 ################################################################################
 
 [DEFAULT]
-debug = true
+## Debug flag sets all loggers to debug, and enables request tracking
+debug = false
 
 ################################################################################
 ##                            EMAIL CONFIGURATION                             ##
@@ -389,6 +390,7 search.location = %(here)s/data/index
 ########################################
 ## channelstream enables persistent connections and live notification
 ## in the system. It's also used by the chat system
+
 channelstream.enabled = false
 
 ## server address for channelstream server on the backend
@@ -466,14 +468,6 appenlight.request_keys_blacklist =
 appenlight.log_namespace_blacklist =
 
 
-################################################################################
-## WARNING: *THE LINE BELOW MUST BE UNCOMMENTED ON A PRODUCTION ENVIRONMENT*  ##
-## Debug mode will enable the interactive debugging tool, allowing ANYONE to  ##
-## execute malicious code after an exception is raised.                       ##
-################################################################################
-set debug = false
-
-
 ###########################################
 ###   MAIN RHODECODE DATABASE CONFIG    ###
 ###########################################
@@ -524,6 +518,7 vcs.scm_app_implementation = http
 ## Push/Pull operations hooks protocol, available options are:
 ## `http` - use http-rpc backend (default)
 vcs.hooks.protocol = http
+
 ## Host on which this instance is listening for hooks. If vcsserver is in other location
 ## this should be adjusted.
 vcs.hooks.host = 127.0.0.1

docs/admin/adding-anonymous-user.rst

@@ -3,19 +3,19
 Anonymous Users
 ---------------
 
-By default, |RCM| provides |repo| access for registered users only. It can be
+By default, |RCE| provides |repo| access for registered users only. It can be
 configured to be **world-open** in terms of read and write permissions. This
-configuration is called "Anonymous Access" and allows |RCM| to be used as a
+configuration is called "Anonymous Access" and allows |RCE| to be used as a
 public hub where unregistered users have access to your |repos|.
 
 Anonymous access is useful for open source projects, universities,
 or if running inside a restricted internal corporate network to serve
 documents to all employees. Anonymous users get the default user permission
14