implements #237 added password confirmation for my account and admin edit user.

rhodecode/model/forms.py

@@ -1,692 +1,694 b''
 """ this is forms validation classes
 http://formencode.org/module-formencode.validators.html
 for list off all availible validators
 
 we can create our own validators
 
 The table below outlines the options which can be used in a schema in addition to the validators themselves
 pre_validators          []     These validators will be applied before the schema
 chained_validators      []     These validators will be applied after the schema
 allow_extra_fields      False     If True, then it is not an error when keys that aren't associated with a validator are present
 filter_extra_fields     False     If True, then keys that aren't associated with a validator are removed
 if_key_missing          NoDefault If this is given, then any keys that aren't available but are expected will be replaced with this value (and then validated). This does not override a present .if_missing attribute on validators. NoDefault is a special FormEncode class to mean that no default values has been specified and therefore missing keys shouldn't take a default value.
 ignore_key_missing      False     If True, then missing keys will be missing in the result, if the validator doesn't have .if_missing on it already
 
 
 <name> = formencode.validators.<name of validator>
 <name> must equal form name
 list=[1,2,3,4,5]
 for SELECT use formencode.All(OneOf(list), Int())
 
 """
 import os
 import re
 import logging
 import traceback
 
 import formencode
 from formencode import All
 from formencode.validators import UnicodeString, OneOf, Int, Number, Regex, \
     Email, Bool, StringBoolean, Set
 
 from pylons.i18n.translation import _
 from webhelpers.pylonslib.secure_form import authentication_token
 
 from rhodecode.config.routing import ADMIN_PREFIX
 from rhodecode.lib.utils import repo_name_slug
 from rhodecode.lib.auth import authenticate, get_crypt_password
 from rhodecode.lib.exceptions import LdapImportError
 from rhodecode.model.user import UserModel
 from rhodecode.model.repo import RepoModel
 from rhodecode.model.db import User, UsersGroup, Group
 from rhodecode import BACKENDS
 
 log = logging.getLogger(__name__)
 
 #this is needed to translate the messages using _() in validators
 class State_obj(object):
     _ = staticmethod(_)
 
 #==============================================================================
 # VALIDATORS
 #==============================================================================
 class ValidAuthToken(formencode.validators.FancyValidator):
     messages = {'invalid_token':_('Token mismatch')}
 
     def validate_python(self, value, state):
 
         if value != authentication_token():
             raise formencode.Invalid(self.message('invalid_token', state,
                                             search_number=value), value, state)
 
 def ValidUsername(edit, old_data):
     class _ValidUsername(formencode.validators.FancyValidator):
 
         def validate_python(self, value, state):
             if value in ['default', 'new_user']:
                 raise formencode.Invalid(_('Invalid username'), value, state)
             #check if user is unique
             old_un = None
             if edit:
                 old_un = UserModel().get(old_data.get('user_id')).username
 
             if old_un != value or not edit:
                 if User.get_by_username(value, case_insensitive=True):
                     raise formencode.Invalid(_('This username already '
                                                'exists') , value, state)
 
             if re.match(r'^[a-zA-Z0-9]{1}[a-zA-Z0-9\-\_\.]+$', value) is None:
                 raise formencode.Invalid(_('Username may only contain '
                                            'alphanumeric characters '
                                            'underscores, periods or dashes '
                                            'and must begin with alphanumeric '
                                            'character'), value, state)
 
     return _ValidUsername
 
 
 def ValidUsersGroup(edit, old_data):
 
     class _ValidUsersGroup(formencode.validators.FancyValidator):
 
         def validate_python(self, value, state):
             if value in ['default']:
                 raise formencode.Invalid(_('Invalid group name'), value, state)
             #check if group is unique
             old_ugname = None
             if edit:
                 old_ugname = UsersGroup.get(
                             old_data.get('users_group_id')).users_group_name
 
             if old_ugname != value or not edit:
                 if UsersGroup.get_by_group_name(value, cache=False,
                                                case_insensitive=True):
                     raise formencode.Invalid(_('This users group '
                                                'already exists') , value,
                                              state)
 
 
             if re.match(r'^[a-zA-Z0-9]{1}[a-zA-Z0-9\-\_\.]+$', value) is None:
                 raise formencode.Invalid(_('Group name may only contain '
                                            'alphanumeric characters '
                                            'underscores, periods or dashes '
                                            'and must begin with alphanumeric '
                                            'character'), value, state)
 
     return _ValidUsersGroup
 
 
 def ValidReposGroup(edit, old_data):
     class _ValidReposGroup(formencode.validators.FancyValidator):
 
         def validate_python(self, value, state):
             #TODO WRITE VALIDATIONS
             group_name = value.get('group_name')
             group_parent_id = int(value.get('group_parent_id') or -1)
 
             # slugify repo group just in case :)
             slug = repo_name_slug(group_name)
 
             # check for parent of self
             if edit and old_data['group_id'] == group_parent_id:
                     e_dict = {'group_parent_id':_('Cannot assign this group '
                                                   'as parent')}
                     raise formencode.Invalid('', value, state,
                                              error_dict=e_dict)
 
             old_gname = None
             if edit:
                 old_gname = Group.get(
                             old_data.get('group_id')).group_name
 
             if old_gname != group_name or not edit:
                 # check filesystem
                 gr = Group.query().filter(Group.group_name == slug)\
                     .filter(Group.group_parent_id == group_parent_id).scalar()
 
                 if gr:
                     e_dict = {'group_name':_('This group already exists')}
                     raise formencode.Invalid('', value, state,
                                              error_dict=e_dict)
 
     return _ValidReposGroup
 
 class ValidPassword(formencode.validators.FancyValidator):
 
     def to_python(self, value, state):
 
         if value:
 
             if value.get('password'):
                 try:
                     value['password'] = get_crypt_password(value['password'])
                 except UnicodeEncodeError:
                     e_dict = {'password':_('Invalid characters in password')}
                     raise formencode.Invalid('', value, state, error_dict=e_dict)
 
             if value.get('password_confirmation'):
                 try:
                     value['password_confirmation'] = \
                         get_crypt_password(value['password_confirmation'])
                 except UnicodeEncodeError:
                     e_dict = {'password_confirmation':_('Invalid characters in password')}
                     raise formencode.Invalid('', value, state, error_dict=e_dict)
 
             if value.get('new_password'):
                 try:
                     value['new_password'] = \
                         get_crypt_password(value['new_password'])
                 except UnicodeEncodeError:
                     e_dict = {'new_password':_('Invalid characters in password')}
                     raise formencode.Invalid('', value, state, error_dict=e_dict)
 
             return value
 
 class ValidPasswordsMatch(formencode.validators.FancyValidator):
 
     def validate_python(self, value, state):
-
-        if value['password'] != value['password_confirmation']:
+        
+        pass_val = value.get('password') or value.get('new_password')
+        if pass_val != value['password_confirmation']:
             e_dict = {'password_confirmation':
                    _('Passwords do not match')}
             raise formencode.Invalid('', value, state, error_dict=e_dict)
 
 class ValidAuth(formencode.validators.FancyValidator):
     messages = {
         'invalid_password':_('invalid password'),
         'invalid_login':_('invalid user name'),
         'disabled_account':_('Your account is disabled')
     }
     
     # error mapping
     e_dict = {'username':messages['invalid_login'],
               'password':messages['invalid_password']}
     e_dict_disable = {'username':messages['disabled_account']}
 
     def validate_python(self, value, state):
         password = value['password']
         username = value['username']
         user = User.get_by_username(username)
 
         if authenticate(username, password):
             return value
         else:
             if user and user.active is False:
                 log.warning('user %s is disabled', username)
                 raise formencode.Invalid(self.message('disabled_account',
                                          state=State_obj),
                                          value, state,
                                          error_dict=self.e_dict_disable)
             else:
                 log.warning('user %s not authenticated', username)
                 raise formencode.Invalid(self.message('invalid_password',
                                          state=State_obj), value, state,
                                          error_dict=self.e_dict)
 
 class ValidRepoUser(formencode.validators.FancyValidator):
 
     def to_python(self, value, state):
         try:
             User.query().filter(User.active == True)\
                 .filter(User.username == value).one()
         except Exception:
             raise formencode.Invalid(_('This username is not valid'),
                                      value, state)
         return value
 
 def ValidRepoName(edit, old_data):
     class _ValidRepoName(formencode.validators.FancyValidator):
         def to_python(self, value, state):
 
             repo_name = value.get('repo_name')
 
             slug = repo_name_slug(repo_name)
             if slug in [ADMIN_PREFIX, '']:
                 e_dict = {'repo_name': _('This repository name is disallowed')}
                 raise formencode.Invalid('', value, state, error_dict=e_dict)
 
 
             if value.get('repo_group'):
                 gr = Group.get(value.get('repo_group'))
                 group_path = gr.full_path
                 # value needs to be aware of group name in order to check
                 # db key This is an actual just the name to store in the
                 # database
                 repo_name_full = group_path + Group.url_sep() + repo_name
                 
             else:
                 group_path = ''
                 repo_name_full = repo_name
 
 
             value['repo_name_full'] = repo_name_full
             rename = old_data.get('repo_name') != repo_name_full
             create = not edit
             if  rename or create:
 
                 if group_path != '':
                     if RepoModel().get_by_repo_name(repo_name_full,):
                         e_dict = {'repo_name':_('This repository already '
                                                 'exists in a group "%s"') %
                                   gr.group_name}
                         raise formencode.Invalid('', value, state,
                                                  error_dict=e_dict)
                 elif Group.get_by_group_name(repo_name_full):
                         e_dict = {'repo_name':_('There is a group with this'
                                                 ' name already "%s"') %
                                   repo_name_full}
                         raise formencode.Invalid('', value, state,
                                                  error_dict=e_dict)
 
                 elif RepoModel().get_by_repo_name(repo_name_full):
                         e_dict = {'repo_name':_('This repository '
                                                 'already exists')}
                         raise formencode.Invalid('', value, state,
                                                  error_dict=e_dict)
 
             return value
 
     return _ValidRepoName
 
 def ValidForkName():
     class _ValidForkName(formencode.validators.FancyValidator):
         def to_python(self, value, state):
 
             repo_name = value.get('fork_name')
 
             slug = repo_name_slug(repo_name)
             if slug in [ADMIN_PREFIX, '']:
                 e_dict = {'repo_name': _('This repository name is disallowed')}
                 raise formencode.Invalid('', value, state, error_dict=e_dict)
 
             if RepoModel().get_by_repo_name(repo_name):
                 e_dict = {'fork_name':_('This repository '
                                         'already exists')}
                 raise formencode.Invalid('', value, state,
                                          error_dict=e_dict)
             return value
     return _ValidForkName
 
 
 def SlugifyName():
     class _SlugifyName(formencode.validators.FancyValidator):
 
         def to_python(self, value, state):
             return repo_name_slug(value)
 
     return _SlugifyName
 
 def ValidCloneUri():
     from mercurial.httprepo import httprepository, httpsrepository
     from rhodecode.lib.utils import make_ui
 
     class _ValidCloneUri(formencode.validators.FancyValidator):
 
         def to_python(self, value, state):
             if not value:
                 pass
             elif value.startswith('https'):
                 try:
                     httpsrepository(make_ui('db'), value).capabilities
                 except Exception, e:
                     log.error(traceback.format_exc())
                     raise formencode.Invalid(_('invalid clone url'), value,
                                              state)
             elif value.startswith('http'):
                 try:
                     httprepository(make_ui('db'), value).capabilities
                 except Exception, e:
                     log.error(traceback.format_exc())
                     raise formencode.Invalid(_('invalid clone url'), value,
                                              state)
             else:
                 raise formencode.Invalid(_('Invalid clone url, provide a '
                                            'valid clone http\s url'), value,
                                          state)
             return value
 
     return _ValidCloneUri
 
 def ValidForkType(old_data):
     class _ValidForkType(formencode.validators.FancyValidator):
 
         def to_python(self, value, state):
             if old_data['repo_type'] != value:
                 raise formencode.Invalid(_('Fork have to be the same '
                                            'type as original'), value, state)
 
             return value
     return _ValidForkType
 
 class ValidPerms(formencode.validators.FancyValidator):
     messages = {'perm_new_member_name':_('This username or users group name'
                                          ' is not valid')}
 
     def to_python(self, value, state):
         perms_update = []
         perms_new = []
         #build a list of permission to update and new permission to create
         for k, v in value.items():
             #means new added member to permissions
             if k.startswith('perm_new_member'):
                 new_perm = value.get('perm_new_member', False)
                 new_member = value.get('perm_new_member_name', False)
                 new_type = value.get('perm_new_member_type')
 
                 if new_member and new_perm:
                     if (new_member, new_perm, new_type) not in perms_new:
                         perms_new.append((new_member, new_perm, new_type))
             elif k.startswith('u_perm_') or k.startswith('g_perm_'):
                 member = k[7:]
                 t = {'u':'user',
                      'g':'users_group'}[k[0]]
                 if member == 'default':
                     if value['private']:
                         #set none for default when updating to private repo
                         v = 'repository.none'
                 perms_update.append((member, v, t))
 
         value['perms_updates'] = perms_update
         value['perms_new'] = perms_new
 
         #update permissions
         for k, v, t in perms_new:
             try:
                 if t is 'user':
                     self.user_db = User.query()\
                         .filter(User.active == True)\
                         .filter(User.username == k).one()
                 if t is 'users_group':
                     self.user_db = UsersGroup.query()\
                         .filter(UsersGroup.users_group_active == True)\
                         .filter(UsersGroup.users_group_name == k).one()
 
             except Exception:
                 msg = self.message('perm_new_member_name',
                                      state=State_obj)
                 raise formencode.Invalid(msg, value, state,
                                          error_dict={'perm_new_member_name':msg})
         return value
 
 class ValidSettings(formencode.validators.FancyValidator):
 
     def to_python(self, value, state):
         #settings  form can't edit user
         if value.has_key('user'):
             del['value']['user']
 
         return value
 
 class ValidPath(formencode.validators.FancyValidator):
     def to_python(self, value, state):
 
         if not os.path.isdir(value):
             msg = _('This is not a valid path')
             raise formencode.Invalid(msg, value, state,
                                      error_dict={'paths_root_path':msg})
         return value
 
 def UniqSystemEmail(old_data):
     class _UniqSystemEmail(formencode.validators.FancyValidator):
         def to_python(self, value, state):
             value = value.lower()
             if old_data.get('email') != value:
                 user = User.query().filter(User.email == value).scalar()
                 if user:
                     raise formencode.Invalid(
                                     _("This e-mail address is already taken"),
                                     value, state)
             return value
 
     return _UniqSystemEmail
 
 class ValidSystemEmail(formencode.validators.FancyValidator):
     def to_python(self, value, state):
         value = value.lower()
         user = User.query().filter(User.email == value).scalar()
         if  user is None:
             raise formencode.Invalid(_("This e-mail address doesn't exist.") ,
                                      value, state)
 
         return value
 
 class LdapLibValidator(formencode.validators.FancyValidator):
 
     def to_python(self, value, state):
 
         try:
             import ldap
         except ImportError:
             raise LdapImportError
         return value
 
 class AttrLoginValidator(formencode.validators.FancyValidator):
 
     def to_python(self, value, state):
 
         if not value or not isinstance(value, (str, unicode)):
             raise formencode.Invalid(_("The LDAP Login attribute of the CN "
                                        "must be specified - this is the name "
                                        "of the attribute that is equivalent "
                                        "to 'username'"),
                                      value, state)
 
         return value
 
 #===============================================================================
 # FORMS
 #===============================================================================
 class LoginForm(formencode.Schema):
     allow_extra_fields = True
     filter_extra_fields = True
     username = UnicodeString(
                              strip=True,
                              min=1,
                              not_empty=True,
                              messages={
                                 'empty':_('Please enter a login'),
                                 'tooShort':_('Enter a value %(min)i characters long or more')}
                             )
 
     password = UnicodeString(
                             strip=True,
                             min=3,
                             not_empty=True,
                             messages={
                                 'empty':_('Please enter a password'),
                                 'tooShort':_('Enter %(min)i characters or more')}
                                 )
 
-
-    #chained validators have access to all data
     chained_validators = [ValidAuth]
 
 def UserForm(edit=False, old_data={}):
     class _UserForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
         username = All(UnicodeString(strip=True, min=1, not_empty=True),
                        ValidUsername(edit, old_data))
         if edit:
             new_password = All(UnicodeString(strip=True, min=6, not_empty=False))
+            password_confirmation = All(UnicodeString(strip=True, min=6, not_empty=False))
             admin = StringBoolean(if_missing=False)
         else:
             password = All(UnicodeString(strip=True, min=6, not_empty=True))
+            password_confirmation = All(UnicodeString(strip=True, min=6, not_empty=False))
+            
         active = StringBoolean(if_missing=False)
         name = UnicodeString(strip=True, min=1, not_empty=True)
         lastname = UnicodeString(strip=True, min=1, not_empty=True)
         email = All(Email(not_empty=True), UniqSystemEmail(old_data))
 
-        chained_validators = [ValidPassword]
+        chained_validators = [ValidPasswordsMatch, ValidPassword]
 
     return _UserForm
 
 
 def UsersGroupForm(edit=False, old_data={}, available_members=[]):
     class _UsersGroupForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
 
         users_group_name = All(UnicodeString(strip=True, min=1, not_empty=True),
                        ValidUsersGroup(edit, old_data))
 
         users_group_active = StringBoolean(if_missing=False)
 
         if edit:
             users_group_members = OneOf(available_members, hideList=False,
                                         testValueList=True,
                                         if_missing=None, not_empty=False)
 
     return _UsersGroupForm
 
 def ReposGroupForm(edit=False, old_data={}, available_groups=[]):
     class _ReposGroupForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
 
         group_name = All(UnicodeString(strip=True, min=1, not_empty=True),
                                SlugifyName())
         group_description = UnicodeString(strip=True, min=1,
                                                 not_empty=True)
         group_parent_id = OneOf(available_groups, hideList=False,
                                         testValueList=True,
                                         if_missing=None, not_empty=False)
 
         chained_validators = [ValidReposGroup(edit, old_data)]
 
     return _ReposGroupForm
 
 def RegisterForm(edit=False, old_data={}):
     class _RegisterForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
         username = All(ValidUsername(edit, old_data),
                        UnicodeString(strip=True, min=1, not_empty=True))
         password = All(UnicodeString(strip=True, min=6, not_empty=True))
         password_confirmation = All(UnicodeString(strip=True, min=6, not_empty=True))
         active = StringBoolean(if_missing=False)
         name = UnicodeString(strip=True, min=1, not_empty=True)
         lastname = UnicodeString(strip=True, min=1, not_empty=True)
         email = All(Email(not_empty=True), UniqSystemEmail(old_data))
 
         chained_validators = [ValidPasswordsMatch, ValidPassword]
 
     return _RegisterForm
 
 def PasswordResetForm():
     class _PasswordResetForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
         email = All(ValidSystemEmail(), Email(not_empty=True))
     return _PasswordResetForm
 
 def RepoForm(edit=False, old_data={}, supported_backends=BACKENDS.keys(),
              repo_groups=[]):
     class _RepoForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         repo_name = All(UnicodeString(strip=True, min=1, not_empty=True),
                         SlugifyName())
         clone_uri = All(UnicodeString(strip=True, min=1, not_empty=False),
                         ValidCloneUri()())
         repo_group = OneOf(repo_groups, hideList=True)
         repo_type = OneOf(supported_backends)
         description = UnicodeString(strip=True, min=1, not_empty=True)
         private = StringBoolean(if_missing=False)
         enable_statistics = StringBoolean(if_missing=False)
         enable_downloads = StringBoolean(if_missing=False)
 
         if edit:
             #this is repo owner
             user = All(UnicodeString(not_empty=True), ValidRepoUser)
 
         chained_validators = [ValidRepoName(edit, old_data), ValidPerms]
     return _RepoForm
 
 def RepoForkForm(edit=False, old_data={}, supported_backends=BACKENDS.keys()):
     class _RepoForkForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         fork_name = All(UnicodeString(strip=True, min=1, not_empty=True),
                         SlugifyName())
         description = UnicodeString(strip=True, min=1, not_empty=True)
         private = StringBoolean(if_missing=False)
         repo_type = All(ValidForkType(old_data), OneOf(supported_backends))
 
         chained_validators = [ValidForkName()]
 
     return _RepoForkForm
 
 def RepoSettingsForm(edit=False, old_data={}, supported_backends=BACKENDS.keys(),
                      repo_groups=[]):
     class _RepoForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         repo_name = All(UnicodeString(strip=True, min=1, not_empty=True),
                         SlugifyName())
         description = UnicodeString(strip=True, min=1, not_empty=True)
         repo_group = OneOf(repo_groups, hideList=True)
         private = StringBoolean(if_missing=False)
 
         chained_validators = [ValidRepoName(edit, old_data), ValidPerms, 
                               ValidSettings]
     return _RepoForm
 
 
 def ApplicationSettingsForm():
     class _ApplicationSettingsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         rhodecode_title = UnicodeString(strip=True, min=1, not_empty=True)
         rhodecode_realm = UnicodeString(strip=True, min=1, not_empty=True)
         rhodecode_ga_code = UnicodeString(strip=True, min=1, not_empty=False)
 
     return _ApplicationSettingsForm
 
 def ApplicationUiSettingsForm():
     class _ApplicationUiSettingsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         web_push_ssl = OneOf(['true', 'false'], if_missing='false')
         paths_root_path = All(ValidPath(), UnicodeString(strip=True, min=1, not_empty=True))
         hooks_changegroup_update = OneOf(['True', 'False'], if_missing=False)
         hooks_changegroup_repo_size = OneOf(['True', 'False'], if_missing=False)
         hooks_pretxnchangegroup_push_logger = OneOf(['True', 'False'], if_missing=False)
         hooks_preoutgoing_pull_logger = OneOf(['True', 'False'], if_missing=False)
 
     return _ApplicationUiSettingsForm
 
 def DefaultPermissionsForm(perms_choices, register_choices, create_choices):
     class _DefaultPermissionsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
         overwrite_default = StringBoolean(if_missing=False)
         anonymous = OneOf(['True', 'False'], if_missing=False)
         default_perm = OneOf(perms_choices)
         default_register = OneOf(register_choices)
         default_create = OneOf(create_choices)
 
     return _DefaultPermissionsForm
 
 
 def LdapSettingsForm(tls_reqcert_choices, search_scope_choices, tls_kind_choices):
     class _LdapSettingsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
         pre_validators = [LdapLibValidator]
         ldap_active = StringBoolean(if_missing=False)
         ldap_host = UnicodeString(strip=True,)
         ldap_port = Number(strip=True,)
         ldap_tls_kind = OneOf(tls_kind_choices)
         ldap_tls_reqcert = OneOf(tls_reqcert_choices)
         ldap_dn_user = UnicodeString(strip=True,)
         ldap_dn_pass = UnicodeString(strip=True,)
         ldap_base_dn = UnicodeString(strip=True,)
         ldap_filter = UnicodeString(strip=True,)
         ldap_search_scope = OneOf(search_scope_choices)
         ldap_attr_login = All(AttrLoginValidator, UnicodeString(strip=True,))
         ldap_attr_firstname = UnicodeString(strip=True,)
         ldap_attr_lastname = UnicodeString(strip=True,)
         ldap_attr_email = UnicodeString(strip=True,)
 
     return _LdapSettingsForm

rhodecode/templates/admin/users/user_add.html

@@ -1,91 +1,100 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="/base/base.html"/>
 
 <%def name="title()">
     ${_('Add user')} - ${c.rhodecode_name}
 </%def>
 <%def name="breadcrumbs_links()">
     ${h.link_to(_('Admin'),h.url('admin_home'))} 
     &raquo; 
     ${h.link_to(_('Users'),h.url('users'))} 
     &raquo;
     ${_('add new user')}
 </%def>
 
 <%def name="page_nav()">
 	${self.menu('admin')}
 </%def>
 
 <%def name="main()">
 <div class="box">
     <!-- box / title -->
     <div class="title">
         ${self.breadcrumbs()}       
     </div>
     <!-- end box / title -->
     ${h.form(url('users'))}
     <div class="form">
         <!-- fields -->
         <div class="fields">
              <div class="field">
                 <div class="label">
                     <label for="username">${_('Username')}:</label>
                 </div>
                 <div class="input">
                     ${h.text('username',class_='small')}
                 </div>
              </div>
             
              <div class="field">
                 <div class="label">
                     <label for="password">${_('Password')}:</label>
                 </div>
                 <div class="input">
                     ${h.password('password',class_='small')}
                 </div>
              </div>
-            
+             
+             <div class="field">
+                <div class="label">
+                    <label for="password_confirmation">${_('Password confirmation')}:</label>
+                </div>
+                <div class="input">
+                    ${h.password('password_confirmation',class_="small",autocomplete="off")}
+                </div>
+             </div>    
+                         
              <div class="field">
                 <div class="label">
                     <label for="name">${_('First Name')}:</label>
                 </div>
                 <div class="input">
                     ${h.text('name',class_='small')}
                 </div>
              </div>
             
              <div class="field">
                 <div class="label">
                     <label for="lastname">${_('Last Name')}:</label>
                 </div>
                 <div class="input">
                     ${h.text('lastname',class_='small')}
                 </div>
              </div>
             
              <div class="field">
                 <div class="label">
                     <label for="email">${_('Email')}:</label>
                 </div>
                 <div class="input">
                     ${h.text('email',class_='small')}
                 </div>
              </div>
             
              <div class="field">
                 <div class="label label-checkbox">
                     <label for="active">${_('Active')}:</label>
                 </div>
                 <div class="checkboxes">
                     ${h.checkbox('active',value=True)}
                 </div>
              </div>
             
             <div class="buttons">
               ${h.submit('save',_('save'),class_="ui-button")}
             </div>             
     	</div>
     </div>
     ${h.end_form()}
 </div>    
 </%def>    

rhodecode/templates/admin/users/user_edit.html

@@ -1,149 +1,158 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="/base/base.html"/>
 
 <%def name="title()">
     ${_('Edit user')} ${c.user.username} - ${c.rhodecode_name}
 </%def>
 
 <%def name="breadcrumbs_links()">
     ${h.link_to(_('Admin'),h.url('admin_home'))} 
     &raquo; 
     ${h.link_to(_('Users'),h.url('users'))} 
     &raquo;
     ${_('edit')} "${c.user.username}"
 </%def>
 
 <%def name="page_nav()">
 	${self.menu('admin')}
 </%def>
 
 <%def name="main()">
 <div class="box box-left">
     <!-- box / title -->
     <div class="title">
         ${self.breadcrumbs()}       
     </div>
     <!-- end box / title -->
     ${h.form(url('update_user', id=c.user.user_id),method='put')}
     <div class="form">
         <div class="field">
            <div class="gravatar_box">
                <div class="gravatar"><img alt="gravatar" src="${h.gravatar_url(c.user.email)}"/></div>
                <p>
                <strong>${_('Change your avatar at')} <a href="http://gravatar.com">gravatar.com</a></strong><br/> 
                ${_('Using')} ${c.user.email}
                </p>
            </div>
         </div>
         <div class="field">
             <div class="label">
                 <label>${_('API key')}</label> ${c.user.api_key}
             </div>
         </div>
                  
         <div class="fields">
              <div class="field">
                 <div class="label">
                     <label for="username">${_('Username')}:</label>
                 </div>
                 <div class="input">
                     ${h.text('username',class_='medium')}
                 </div>
              </div>
             
              <div class="field">
                 <div class="label">
                     <label for="ldap_dn">${_('LDAP DN')}:</label>
                 </div>
                 <div class="input">
                     ${h.text('ldap_dn',class_='medium')}
                 </div>
              </div>
             
              <div class="field">
                 <div class="label">
                     <label for="new_password">${_('New password')}:</label>
                 </div>
                 <div class="input">
                     ${h.password('new_password',class_='medium',autocomplete="off")}
                 </div>
              </div>
-            
+             
+             <div class="field">
+                <div class="label">
+                    <label for="password_confirmation">${_('New password confirmation')}:</label>
+                </div>
+                <div class="input">
+                    ${h.password('password_confirmation',class_="medium",autocomplete="off")}
+                </div>
+             </div>
+                         
              <div class="field">
                 <div class="label">
                     <label for="name">${_('First Name')}:</label>
                 </div>
                 <div class="input">
                     ${h.text('name',class_='medium')}
                 </div>
              </div>
             
              <div class="field">
                 <div class="label">
                     <label for="lastname">${_('Last Name')}:</label>
                 </div>
                 <div class="input">
                     ${h.text('lastname',class_='medium')}
                 </div>
              </div>
             
              <div class="field">
                 <div class="label">
                     <label for="email">${_('Email')}:</label>
                 </div>
                 <div class="input">
                     ${h.text('email',class_='medium')}
                 </div>
              </div>
             
              <div class="field">
                 <div class="label label-checkbox">
                     <label for="active">${_('Active')}:</label>
                 </div>
                 <div class="checkboxes">
                     ${h.checkbox('active',value=True)}
                 </div>
              </div>
              
              <div class="field">
                 <div class="label label-checkbox">
                     <label for="admin">${_('Admin')}:</label>
                 </div>
                 <div class="checkboxes">
                     ${h.checkbox('admin',value=True)}
                 </div>
              </div>             
             <div class="buttons">
               ${h.submit('save',_('Save'),class_="ui-button")}
               ${h.reset('reset',_('Reset'),class_="ui-button")}
             </div>             
     	</div>    
     </div>
     ${h.end_form()}
 </div>
 <div class="box box-right">
     <!-- box / title -->
     <div class="title">
         <h5>${_('Permissions')}</h5>       
     </div>
     ${h.form(url('user_perm', id=c.user.user_id),method='put')}
     <div class="form">
         <!-- fields -->
         <div class="fields">
              <div class="field">
                 <div class="label label-checkbox">
                     <label for="create_repo_perm">${_('Create repositories')}:</label>
                 </div>
                 <div class="checkboxes">
                     ${h.checkbox('create_repo_perm',value=True)}
                 </div>
              </div>
             <div class="buttons">
               ${h.submit('save',_('Save'),class_="ui-button")}
               ${h.reset('reset',_('Reset'),class_="ui-button")}
             </div>             
         </div>    
     </div>
     ${h.end_form()}    
 </div>
 </%def>

rhodecode/templates/admin/users/user_edit_my_account.html

@@ -1,211 +1,222 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="/base/base.html"/>
 
 <%def name="title()">
     ${_('My account')} ${c.rhodecode_user.username} - ${c.rhodecode_name}
 </%def>
 
 <%def name="breadcrumbs_links()">
     ${_('My Account')}
 </%def>
 
 <%def name="page_nav()">
 	${self.menu('admin')}
 </%def>
 
 <%def name="main()">
 
 <div class="box box-left">
     <!-- box / title -->
     <div class="title">
         ${self.breadcrumbs()}       
     </div>
     <!-- end box / title -->
     <div>
     ${h.form(url('admin_settings_my_account_update'),method='put')}
 	    <div class="form">
 	    
              <div class="field">
                 <div class="gravatar_box">
                     <div class="gravatar"><img alt="gravatar" src="${h.gravatar_url(c.user.email)}"/></div>
                     <p>
                     <strong>${_('Change your avatar at')} <a href="http://gravatar.com">gravatar.com</a></strong><br/> 
                     ${_('Using')} ${c.user.email}
                     </p>
                 </div>
              </div>   	    
 	        <div class="field">
 	            <div class="label">
 	                <label>${_('API key')}</label> ${c.user.api_key}
 	            </div>
 	        </div>	    
 	        <div class="fields">
 	             <div class="field">
 	                <div class="label">
 	                    <label for="username">${_('Username')}:</label>
 	                </div>
 	                <div class="input">
 	                    ${h.text('username',class_="medium")}
 	                </div>
 	             </div>
 	            
 	             <div class="field">
 	                <div class="label">
 	                    <label for="new_password">${_('New password')}:</label>
 	                </div>
 	                <div class="input">
 	                    ${h.password('new_password',class_="medium",autocomplete="off")}
 	                </div>
 	             </div>
-	            
+                 
+                 <div class="field">
+                    <div class="label">
+                        <label for="password_confirmation">${_('New password confirmation')}:</label>
+                    </div>
+                    <div class="input">
+                        ${h.password('password_confirmation',class_="medium",autocomplete="off")}
+                    </div>
+                 </div>
+                 	            
 	             <div class="field">
 	                <div class="label">
 	                    <label for="name">${_('First Name')}:</label>
 	                </div>
 	                <div class="input">
 	                    ${h.text('name',class_="medium")}
 	                </div>
 	             </div>
 	            
 	             <div class="field">
 	                <div class="label">
 	                    <label for="lastname">${_('Last Name')}:</label>
 	                </div>
 	                <div class="input">
 	                    ${h.text('lastname',class_="medium")}
 	                </div>
 	             </div>
 	            
 	             <div class="field">
 	                <div class="label">
 	                    <label for="email">${_('Email')}:</label>
 	                </div>
 	                <div class="input">
 	                    ${h.text('email',class_="medium")}
 	                </div>
 	             </div>
 	            
 	            <div class="buttons">
 	              ${h.submit('save',_('Save'),class_="ui-button")}
 	              ${h.reset('reset',_('Reset'),class_="ui-button")}
 	            </div>             
 	    	</div>
 	    </div>    	
     ${h.end_form()}
     </div>
 </div>    
 
 <div class="box box-right">
     <!-- box / title -->
     <div class="title">
         <h5>${_('My repositories')} 
         <input class="top-right-rounded-corner top-left-rounded-corner bottom-left-rounded-corner bottom-right-rounded-corner" id="q_filter" size="15" type="text" name="filter" value="${_('quick filter...')}"/>
         </h5>
          %if h.HasPermissionAny('hg.admin','hg.create.repository')():
          <ul class="links">
            <li>
              <span>${h.link_to(_('ADD REPOSITORY'),h.url('admin_settings_create_repository'))}</span>
            </li>          
          </ul>           
          %endif        
     </div>
     <!-- end box / title -->
     <div class="table">
 	    <table>
 	    <thead>
             <tr>
             <th class="left">${_('Name')}</th>
             <th class="left">${_('revision')}</th>
             <th colspan="2" class="left">${_('action')}</th>            
 	    </thead>
 	     <tbody>
 	     %if c.user_repos:
 		     %for repo in c.user_repos:
 		        <tr>
 		            <td>
                      %if repo['dbrepo']['repo_type'] =='hg':
                        <img class="icon" title="${_('Mercurial repository')}" alt="${_('Mercurial repository')}" src="${h.url("/images/icons/hgicon.png")}"/>
                      %elif repo['dbrepo']['repo_type'] =='git':
                        <img class="icon" title="${_('Git repository')}" alt="${_('Git repository')}" src="${h.url("/images/icons/giticon.png")}"/>
                      %else:
                        
                      %endif 		            
 		             %if repo['dbrepo']['private']:
 		                <img class="icon" alt="${_('private')}" src="${h.url("/images/icons/lock.png")}"/>
 		             %else:
 		                <img class="icon" alt="${_('public')}" src="${h.url("/images/icons/lock_open.png")}"/>
 		             %endif
 		                                             
 		            ${h.link_to(repo['name'], h.url('summary_home',repo_name=repo['name']),class_="repo_name")}
 		            %if repo['dbrepo_fork']:
 		            	<a href="${h.url('summary_home',repo_name=repo['dbrepo_fork']['repo_name'])}">
 		            	<img class="icon" alt="${_('public')}"
 		            	title="${_('Fork of')} ${repo['dbrepo_fork']['repo_name']}" 
 		            	src="${h.url('/images/icons/arrow_divide.png')}"/></a>
 		            %endif		            
 		            </td> 
 		            <td><span class="tooltip" title="${repo['last_change']}">${("r%s:%s") % (repo['rev'],h.short_id(repo['tip']))}</span></td>
 		            <td><a href="${h.url('repo_settings_home',repo_name=repo['name'])}" title="${_('edit')}"><img class="icon" alt="${_('private')}" src="${h.url('/images/icons/application_form_edit.png')}"/></a></td>
 		            <td>
 	                  ${h.form(url('repo_settings_delete', repo_name=repo['name']),method='delete')}
 	                    ${h.submit('remove_%s' % repo['name'],'',class_="delete_icon action_button",onclick="return confirm('Confirm to delete this repository');")}
 	                  ${h.end_form()}	            
 		            </td>
 		        </tr>
 		     %endfor
 	     %else:
+            <div style="padding:5px 0px 10px 0px;">
 	     	${_('No repositories yet')} 
 	     	%if h.HasPermissionAny('hg.admin','hg.create.repository')():
-	     		${h.link_to(_('create one now'),h.url('admin_settings_create_repository'))}
+	     		${h.link_to(_('create one now'),h.url('admin_settings_create_repository'),class_="ui-button-small")}
 	     	%endif
+            </div>
 	     %endif
 	     </tbody>
 	     </table>
     </div>
     
 </div>
     <script type="text/javascript">
      var D = YAHOO.util.Dom;
      var E = YAHOO.util.Event;
      var S = YAHOO.util.Selector;
      
      var q_filter = D.get('q_filter');
      var F = YAHOO.namespace('q_filter'); 
      
      E.on(q_filter,'click',function(){
         q_filter.value = '';
      });
 
      F.filterTimeout = null;
      
      F.updateFilter  = function() { 
         // Reset timeout 
         F.filterTimeout = null;
         
         var obsolete = [];
         var nodes = S.query('div.table tr td a.repo_name');
         var req = q_filter.value.toLowerCase();
         for (n in nodes){
             D.setStyle(nodes[n].parentNode.parentNode,'display','')
         }
         if (req){
             for (n in nodes){
                 if (nodes[n].innerHTML.toLowerCase().indexOf(req) == -1) {
                     obsolete.push(nodes[n]); 
                 }
             }
             if(obsolete){
                 for (n in obsolete){
                     D.setStyle(obsolete[n].parentNode.parentNode,'display','none');
                 }
             }
         }
      }
      
      E.on(q_filter,'keyup',function(e){
          clearTimeout(F.filterTimeout); 
          F.filterTimeout = setTimeout(F.updateFilter,600); 
      });
      
     </script>
 </%def>  

rhodecode/tests/functional/test_admin_settings.py

@@ -1,208 +1,212 b''
 # -*- coding: utf-8 -*-
 
 from rhodecode.lib.auth import get_crypt_password, check_password
 from rhodecode.model.db import User, RhodeCodeSettings
 from rhodecode.tests import *
 
 class TestAdminSettingsController(TestController):
 
     def test_index(self):
         response = self.app.get(url('admin_settings'))
         # Test response...
 
     def test_index_as_xml(self):
         response = self.app.get(url('formatted_admin_settings', format='xml'))
 
     def test_create(self):
         response = self.app.post(url('admin_settings'))
 
     def test_new(self):
         response = self.app.get(url('admin_new_setting'))
 
     def test_new_as_xml(self):
         response = self.app.get(url('formatted_admin_new_setting', format='xml'))
 
     def test_update(self):
         response = self.app.put(url('admin_setting', setting_id=1))
 
     def test_update_browser_fakeout(self):
         response = self.app.post(url('admin_setting', setting_id=1), params=dict(_method='put'))
 
     def test_delete(self):
         response = self.app.delete(url('admin_setting', setting_id=1))
 
     def test_delete_browser_fakeout(self):
         response = self.app.post(url('admin_setting', setting_id=1), params=dict(_method='delete'))
 
     def test_show(self):
         response = self.app.get(url('admin_setting', setting_id=1))
 
     def test_show_as_xml(self):
         response = self.app.get(url('formatted_admin_setting', setting_id=1, format='xml'))
 
     def test_edit(self):
         response = self.app.get(url('admin_edit_setting', setting_id=1))
 
     def test_edit_as_xml(self):
         response = self.app.get(url('formatted_admin_edit_setting',
                                     setting_id=1, format='xml'))
 
 
     def test_ga_code_active(self):
         self.log_user()
         old_title = 'RhodeCode'
         old_realm = 'RhodeCode authentication'
         new_ga_code = 'ga-test-123456789'
         response = self.app.post(url('admin_setting', setting_id='global'),
                                      params=dict(
                                                  _method='put',
                                                  rhodecode_title=old_title,
                                                  rhodecode_realm=old_realm,
                                                  rhodecode_ga_code=new_ga_code
                                                  ))
 
         self.checkSessionFlash(response, 'Updated application settings')
 
         self.assertEqual(RhodeCodeSettings
                          .get_app_settings()['rhodecode_ga_code'], new_ga_code)
 
         response = response.follow()
         self.assertTrue("""_gaq.push(['_setAccount', '%s']);""" % new_ga_code
                         in response.body)
 
     def test_ga_code_inactive(self):
         self.log_user()
         old_title = 'RhodeCode'
         old_realm = 'RhodeCode authentication'
         new_ga_code = ''
         response = self.app.post(url('admin_setting', setting_id='global'),
                                      params=dict(
                                                  _method='put',
                                                  rhodecode_title=old_title,
                                                  rhodecode_realm=old_realm,
                                                  rhodecode_ga_code=new_ga_code
                                                  ))
 
         self.assertTrue('Updated application settings' in
                         response.session['flash'][0][1])
         self.assertEqual(RhodeCodeSettings
                         .get_app_settings()['rhodecode_ga_code'], new_ga_code)
 
         response = response.follow()
         self.assertTrue("""_gaq.push(['_setAccount', '%s']);""" % new_ga_code
                         not in response.body)
 
 
     def test_title_change(self):
         self.log_user()
         old_title = 'RhodeCode'
         new_title = old_title + '_changed'
         old_realm = 'RhodeCode authentication'
 
         for new_title in ['Changed', 'Żółwik', old_title]:
             response = self.app.post(url('admin_setting', setting_id='global'),
                                          params=dict(
                                                      _method='put',
                                                      rhodecode_title=new_title,
                                                      rhodecode_realm=old_realm,
                                                      rhodecode_ga_code=''
                                                      ))
 
             self.checkSessionFlash(response, 'Updated application settings')
             self.assertEqual(RhodeCodeSettings
                              .get_app_settings()['rhodecode_title'],
                              new_title.decode('utf-8'))
 
             response = response.follow()
             self.assertTrue("""<h1><a href="/">%s</a></h1>""" % new_title
                         in response.body)
 
 
     def test_my_account(self):
         self.log_user()
         response = self.app.get(url('admin_settings_my_account'))
 
         self.assertTrue('value="test_admin' in response.body)
 
     def test_my_account_update(self):
         self.log_user()
 
         new_email = '[e-mail]'
         new_name = 'NewName'
         new_lastname = 'NewLastname'
         new_password = 'test123'
 
 
         response = self.app.post(url('admin_settings_my_account_update'),
                                  params=dict(_method='put',
                                              username='test_admin',
                                              new_password=new_password,
+                                             password_confirmation = new_password,
                                              password='',
                                              name=new_name,
                                              lastname=new_lastname,
                                              email=new_email,))
         response.follow()
 
         assert 'Your account was updated successfully' in response.session['flash'][0][1], 'no flash message about success of change'
         user = self.sa.query(User).filter(User.username == 'test_admin').one()
         assert user.email == new_email , 'incorrect user email after update got %s vs %s' % (user.email, new_email)
         assert user.name == new_name, 'updated field mismatch %s vs %s' % (user.name, new_name)
         assert user.lastname == new_lastname, 'updated field mismatch %s vs %s' % (user.lastname, new_lastname)
         assert check_password(new_password, user.password) is True, 'password field mismatch %s vs %s' % (user.password, new_password)
 
         #bring back the admin settings
         old_email = '[e-mail]'
         old_name = 'RhodeCode'
         old_lastname = 'Admin'
         old_password = 'test12'
 
         response = self.app.post(url('admin_settings_my_account_update'), params=dict(
                                                             _method='put',
                                                             username='test_admin',
                                                             new_password=old_password,
+                                                            password_confirmation = old_password,
                                                             password='',
                                                             name=old_name,
                                                             lastname=old_lastname,
                                                             email=old_email,))
 
         response.follow()
         self.checkSessionFlash(response,
                                'Your account was updated successfully')
 
         user = self.sa.query(User).filter(User.username == 'test_admin').one()
         assert user.email == old_email , 'incorrect user email after update got %s vs %s' % (user.email, old_email)
 
         assert user.email == old_email , 'incorrect user email after update got %s vs %s' % (user.email, old_email)
         assert user.name == old_name, 'updated field mismatch %s vs %s' % (user.name, old_name)
         assert user.lastname == old_lastname, 'updated field mismatch %s vs %s' % (user.lastname, old_lastname)
         assert check_password(old_password, user.password) is True , 'password updated field mismatch %s vs %s' % (user.password, old_password)
 
 
     def test_my_account_update_err_email_exists(self):
         self.log_user()
 
         new_email = '[e-mail]'#already exisitn email
         response = self.app.post(url('admin_settings_my_account_update'), params=dict(
                                                             _method='put',
                                                             username='test_admin',
                                                             new_password='test12',
+                                                            password_confirmation = 'test122',
                                                             name='NewName',
                                                             lastname='NewLastname',
                                                             email=new_email,))
 
         assert 'This e-mail address is already taken' in response.body, 'Missing error message about existing email'
 
 
     def test_my_account_update_err(self):
         self.log_user('test_regular2', 'test12')
 
         new_email = 'newmail.pl'
         response = self.app.post(url('admin_settings_my_account_update'), params=dict(
                                                             _method='put',
                                                             username='test_admin',
                                                             new_password='test12',
+                                                            password_confirmation = 'test122',
                                                             name='NewName',
                                                             lastname='NewLastname',
                                                             email=new_email,))
         assert 'An email address must contain a single @' in response.body, 'Missing error message about wrong email'
         assert 'This username already exists' in response.body, 'Missing error message about existing user'

rhodecode/tests/functional/test_admin_users.py

@@ -1,119 +1,122 b''
 from rhodecode.tests import *
 from rhodecode.model.db import User
 from rhodecode.lib.auth import check_password
 from sqlalchemy.orm.exc import NoResultFound
 
 class TestAdminUsersController(TestController):
 
     def test_index(self):
         response = self.app.get(url('users'))
         # Test response...
 
     def test_index_as_xml(self):
         response = self.app.get(url('formatted_users', format='xml'))
 
     def test_create(self):
         self.log_user()
         username = 'newtestuser'
         password = 'test12'
+        password_confirmation = password
         name = 'name'
         lastname = 'lastname'
         email = '[e-mail]'
 
         response = self.app.post(url('users'), {'username':username,
                                                'password':password,
+                                               'password_confirmation':password_confirmation,
                                                'name':name,
                                                'active':True,
                                                'lastname':lastname,
                                                'email':email})
 
 
         assert '''created user %s''' % (username) in response.session['flash'][0], 'No flash message about new user'
 
         new_user = self.sa.query(User).filter(User.username == username).one()
 
 
         assert new_user.username == username, 'wrong info about username'
         assert check_password(password, new_user.password) == True , 'wrong info about password'
         assert new_user.name == name, 'wrong info about name'
         assert new_user.lastname == lastname, 'wrong info about lastname'
         assert new_user.email == email, 'wrong info about email'
 
 
         response.follow()
         response = response.follow()
         assert """edit">newtestuser</a>""" in response.body
 
     def test_create_err(self):
         self.log_user()
         username = 'new_user'
         password = ''
         name = 'name'
         lastname = 'lastname'
         email = 'errmail.com'
 
         response = self.app.post(url('users'), {'username':username,
                                                'password':password,
                                                'name':name,
                                                'active':False,
                                                'lastname':lastname,
                                                'email':email})
 
         assert """<span class="error-message">Invalid username</span>""" in response.body
         assert """<span class="error-message">Please enter a value</span>""" in response.body
         assert """<span class="error-message">An email address must contain a single @</span>""" in response.body
 
         def get_user():
             self.sa.query(User).filter(User.username == username).one()
 
         self.assertRaises(NoResultFound, get_user), 'found user in database'
 
     def test_new(self):
         response = self.app.get(url('new_user'))
 
     def test_new_as_xml(self):
         response = self.app.get(url('formatted_new_user', format='xml'))
 
     def test_update(self):
         response = self.app.put(url('user', id=1))
 
     def test_update_browser_fakeout(self):
         response = self.app.post(url('user', id=1), params=dict(_method='put'))
 
     def test_delete(self):
         self.log_user()
         username = 'newtestuserdeleteme'
         password = 'test12'
         name = 'name'
         lastname = 'lastname'
         email = '[e-mail]'
 
         response = self.app.post(url('users'), {'username':username,
                                                'password':password,
+                                               'password_confirmation':password,
                                                'name':name,
                                                'active':True,
                                                'lastname':lastname,
                                                'email':email})
 
         response = response.follow()
 
         new_user = self.sa.query(User).filter(User.username == username).one()
         response = self.app.delete(url('user', id=new_user.user_id))
 
         assert """successfully deleted user""" in response.session['flash'][0], 'No info about user deletion'
 
 
     def test_delete_browser_fakeout(self):
         response = self.app.post(url('user', id=1), params=dict(_method='delete'))
 
     def test_show(self):
         response = self.app.get(url('user', id=1))
 
     def test_show_as_xml(self):
         response = self.app.get(url('formatted_user', id=1, format='xml'))
 
     def test_edit(self):
         response = self.app.get(url('edit_user', id=1))
 
     def test_edit_as_xml(self):
         response = self.app.get(url('formatted_edit_user', id=1, format='xml'))