auth decorators are not used anymore on __before__

- this will allow to create a whitelist of API enabled controller functions
- moved around functions with _ to beginning of the files to make it cleaner

rhodecode/controllers/bookmarks.py

@@ -1,57 +1,57 b''
 # -*- coding: utf-8 -*-
 """
     rhodecode.controllers.bookmarks
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
     Bookmarks controller for rhodecode
 
     :created_on: Dec 1, 2011
     :author: marcink
     :copyright: (C) 2011-2012 Marcin Kuzminski <[e-mail]>
     :license: GPLv3, see COPYING for more details.
 """
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import logging
 
 from pylons import tmpl_context as c
 
 from rhodecode.lib.auth import LoginRequired, HasRepoPermissionAnyDecorator
 from rhodecode.lib.base import BaseRepoController, render
 from rhodecode.lib.compat import OrderedDict
 from webob.exc import HTTPNotFound
 
 log = logging.getLogger(__name__)
 
 
 class BookmarksController(BaseRepoController):
 
+    def __before__(self):
+        super(BookmarksController, self).__before__()
+
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
-    def __before__(self):
-        super(BookmarksController, self).__before__()
-
     def index(self):
         if c.rhodecode_repo.alias != 'hg':
             raise HTTPNotFound()
 
         c.repo_bookmarks = OrderedDict()
 
         bookmarks = [(name, c.rhodecode_repo.get_changeset(hash_)) for \
                  name, hash_ in c.rhodecode_repo._repo._bookmarks.items()]
         ordered_tags = sorted(bookmarks, key=lambda x: x[1].date, reverse=True)
         for name, cs_book in ordered_tags:
             c.repo_bookmarks[name] = cs_book
 
         return render('bookmarks/bookmarks.html')

rhodecode/controllers/branches.py

@@ -1,76 +1,75 b''
 # -*- coding: utf-8 -*-
 """
     rhodecode.controllers.branches
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
     branches controller for rhodecode
 
     :created_on: Apr 21, 2010
     :author: marcink
     :copyright: (C) 2010-2012 Marcin Kuzminski <[e-mail]>
     :license: GPLv3, see COPYING for more details.
 """
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import logging
 import binascii
 
 from pylons import tmpl_context as c
 
 from rhodecode.lib.auth import LoginRequired, HasRepoPermissionAnyDecorator
 from rhodecode.lib.base import BaseRepoController, render
 from rhodecode.lib.compat import OrderedDict
 from rhodecode.lib.utils2 import safe_unicode
 
 log = logging.getLogger(__name__)
 
 
 class BranchesController(BaseRepoController):
 
+    def __before__(self):
+        super(BranchesController, self).__before__()
+
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
-    def __before__(self):
-        super(BranchesController, self).__before__()
-
     def index(self):
 
         def _branchtags(localrepo):
             bt_closed = {}
             for bn, heads in localrepo.branchmap().iteritems():
                 tip = heads[-1]
                 if 'close' in localrepo.changelog.read(tip)[5]:
                     bt_closed[bn] = tip
             return bt_closed
 
         cs_g = c.rhodecode_repo.get_changeset
 
         c.repo_closed_branches = {}
         if c.rhodecode_db_repo.repo_type == 'hg':
             bt_closed = _branchtags(c.rhodecode_repo._repo)
             _closed_branches = [(safe_unicode(n), cs_g(binascii.hexlify(h)),)
                                 for n, h in bt_closed.items()]
 
             c.repo_closed_branches = OrderedDict(sorted(_closed_branches,
                                                     key=lambda ctx: ctx[0],
                                                     reverse=False))
 
         _branches = [(safe_unicode(n), cs_g(h))
                      for n, h in c.rhodecode_repo.branches.items()]
         c.repo_branches = OrderedDict(sorted(_branches,
                                              key=lambda ctx: ctx[0],
                                              reverse=False))
 
-
         return render('branches/branches.html')

rhodecode/controllers/changelog.py

@@ -1,119 +1,122 b''
 # -*- coding: utf-8 -*-
 """
     rhodecode.controllers.changelog
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
     changelog controller for rhodecode
 
     :created_on: Apr 21, 2010
     :author: marcink
     :copyright: (C) 2010-2012 Marcin Kuzminski <[e-mail]>
     :license: GPLv3, see COPYING for more details.
 """
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import logging
 import traceback
 
 from pylons import request, url, session, tmpl_context as c
 from pylons.controllers.util import redirect
 from pylons.i18n.translation import _
 
 import rhodecode.lib.helpers as h
 from rhodecode.lib.auth import LoginRequired, HasRepoPermissionAnyDecorator
 from rhodecode.lib.base import BaseRepoController, render
 from rhodecode.lib.helpers import RepoPage
 from rhodecode.lib.compat import json
 from rhodecode.lib.graphmod import _colored, _dagwalker
 from rhodecode.lib.vcs.exceptions import RepositoryError, ChangesetDoesNotExistError
 from rhodecode.lib.utils2 import safe_int
 
 log = logging.getLogger(__name__)
 
 
 class ChangelogController(BaseRepoController):
 
-    @LoginRequired()
-    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
-                                   'repository.admin')
     def __before__(self):
         super(ChangelogController, self).__before__()
         c.affected_files_cut_off = 60
 
+    def _graph(self, repo, revs_int, repo_size, size, p):
+        """
+        Generates a DAG graph for repo
+
+        :param repo:
+        :param revs_int:
+        :param repo_size:
+        :param size:
+        :param p:
+        """
+        if not revs_int:
+            c.jsdata = json.dumps([])
+            return
+
+        data = []
+        revs = revs_int
+
+        dag = _dagwalker(repo, revs, repo.alias)
+        dag = _colored(dag)
+        for (id, type, ctx, vtx, edges) in dag:
+            data.append(['', vtx, edges])
+
+        c.jsdata = json.dumps(data)
+
+    @LoginRequired()
+    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
+                                   'repository.admin')
     def index(self):
         limit = 100
         default = 20
         if request.GET.get('size'):
             c.size = max(min(safe_int(request.GET.get('size')), limit), 1)
             session['changelog_size'] = c.size
             session.save()
         else:
             c.size = int(session.get('changelog_size', default))
         # min size must be 1
         c.size = max(c.size, 1)
         p = safe_int(request.GET.get('page', 1), 1)
         branch_name = request.GET.get('branch', None)
         try:
             collection = c.rhodecode_repo.get_changesets(start=0,
                                                     branch_name=branch_name)
             c.total_cs = len(collection)
 
             c.pagination = RepoPage(collection, page=p, item_count=c.total_cs,
                                     items_per_page=c.size, branch=branch_name)
             collection = list(c.pagination)
             page_revisions = [x.raw_id for x in c.pagination]
             c.comments = c.rhodecode_db_repo.get_comments(page_revisions)
             c.statuses = c.rhodecode_db_repo.statuses(page_revisions)
         except (RepositoryError, ChangesetDoesNotExistError, Exception), e:
             log.error(traceback.format_exc())
             h.flash(str(e), category='error')
             return redirect(url('changelog_home', repo_name=c.repo_name))
 
         c.branch_name = branch_name
         c.branch_filters = [('', _('All Branches'))] + \
             [(k, k) for k in c.rhodecode_repo.branches.keys()]
 
         self._graph(c.rhodecode_repo, [x.revision for x in c.pagination],
                     c.total_cs, c.size, p)
 
         return render('changelog/changelog.html')
 
+    @LoginRequired()
+    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
+                                   'repository.admin')
     def changelog_details(self, cs):
         if request.environ.get('HTTP_X_PARTIAL_XHR'):
             c.cs = c.rhodecode_repo.get_changeset(cs)
             return render('changelog/changelog_details.html')
-
-    def _graph(self, repo, revs_int, repo_size, size, p):
-        """
-        Generates a DAG graph for repo
-
-        :param repo:
-        :param revs_int:
-        :param repo_size:
-        :param size:
-        :param p:
-        """
-        if not revs_int:
-            c.jsdata = json.dumps([])
-            return
-
-        data = []
-        revs = revs_int
-
-        dag = _dagwalker(repo, revs, repo.alias)
-        dag = _colored(dag)
-        for (id, type, ctx, vtx, edges) in dag:
-            data.append(['', vtx, edges])
-
-        c.jsdata = json.dumps(data)

rhodecode/controllers/changeset.py

@@ -1,416 +1,437 b''
 # -*- coding: utf-8 -*-
 """
     rhodecode.controllers.changeset
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
     changeset controller for pylons showoing changes beetween
     revisions
 
     :created_on: Apr 25, 2010
     :author: marcink
     :copyright: (C) 2010-2012 Marcin Kuzminski <[e-mail]>
     :license: GPLv3, see COPYING for more details.
 """
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import logging
 import traceback
 from collections import defaultdict
 from webob.exc import HTTPForbidden, HTTPBadRequest, HTTPNotFound
 
 from pylons import tmpl_context as c, url, request, response
 from pylons.i18n.translation import _
 from pylons.controllers.util import redirect
 from rhodecode.lib.utils import jsonify
 
 from rhodecode.lib.vcs.exceptions import RepositoryError, \
     ChangesetDoesNotExistError
 
 import rhodecode.lib.helpers as h
 from rhodecode.lib.auth import LoginRequired, HasRepoPermissionAnyDecorator,\
     NotAnonymous
 from rhodecode.lib.base import BaseRepoController, render
 from rhodecode.lib.utils import action_logger
 from rhodecode.lib.compat import OrderedDict
 from rhodecode.lib import diffs
 from rhodecode.model.db import ChangesetComment, ChangesetStatus
 from rhodecode.model.comment import ChangesetCommentsModel
 from rhodecode.model.changeset_status import ChangesetStatusModel
 from rhodecode.model.meta import Session
 from rhodecode.model.repo import RepoModel
 from rhodecode.lib.diffs import LimitedDiffContainer
 from rhodecode.lib.exceptions import StatusChangeOnClosedPullRequestError
 from rhodecode.lib.vcs.backends.base import EmptyChangeset
 from rhodecode.lib.utils2 import safe_unicode
 
 log = logging.getLogger(__name__)
 
 
 def _update_with_GET(params, GET):
     for k in ['diff1', 'diff2', 'diff']:
         params[k] += GET.getall(k)
 
 
 def anchor_url(revision, path, GET):
     fid = h.FID(revision, path)
     return h.url.current(anchor=fid, **dict(GET))
 
 
 def get_ignore_ws(fid, GET):
     ig_ws_global = GET.get('ignorews')
     ig_ws = filter(lambda k: k.startswith('WS'), GET.getall(fid))
     if ig_ws:
         try:
             return int(ig_ws[0].split(':')[-1])
         except Exception:
             pass
     return ig_ws_global
 
 
 def _ignorews_url(GET, fileid=None):
     fileid = str(fileid) if fileid else None
     params = defaultdict(list)
     _update_with_GET(params, GET)
     lbl = _('Show white space')
     ig_ws = get_ignore_ws(fileid, GET)
     ln_ctx = get_line_ctx(fileid, GET)
     # global option
     if fileid is None:
         if ig_ws is None:
             params['ignorews'] += [1]
             lbl = _('Ignore white space')
         ctx_key = 'context'
         ctx_val = ln_ctx
     # per file options
     else:
         if ig_ws is None:
             params[fileid] += ['WS:1']
             lbl = _('Ignore white space')
 
         ctx_key = fileid
         ctx_val = 'C:%s' % ln_ctx
     # if we have passed in ln_ctx pass it along to our params
     if ln_ctx:
         params[ctx_key] += [ctx_val]
 
     params['anchor'] = fileid
     img = h.image(h.url('/images/icons/text_strikethrough.png'), lbl, class_='icon')
     return h.link_to(img, h.url.current(**params), title=lbl, class_='tooltip')
 
 
 def get_line_ctx(fid, GET):
     ln_ctx_global = GET.get('context')
     if fid:
         ln_ctx = filter(lambda k: k.startswith('C'), GET.getall(fid))
     else:
         _ln_ctx = filter(lambda k: k.startswith('C'), GET)
         ln_ctx = GET.get(_ln_ctx[0]) if _ln_ctx  else ln_ctx_global
         if ln_ctx:
             ln_ctx = [ln_ctx]
 
     if ln_ctx:
         retval = ln_ctx[0].split(':')[-1]
     else:
         retval = ln_ctx_global
 
     try:
         return int(retval)
     except Exception:
         return 3
 
 
 def _context_url(GET, fileid=None):
     """
     Generates url for context lines
 
     :param fileid:
     """
 
     fileid = str(fileid) if fileid else None
     ig_ws = get_ignore_ws(fileid, GET)
     ln_ctx = (get_line_ctx(fileid, GET) or 3) * 2
 
     params = defaultdict(list)
     _update_with_GET(params, GET)
 
     # global option
     if fileid is None:
         if ln_ctx > 0:
             params['context'] += [ln_ctx]
 
         if ig_ws:
             ig_ws_key = 'ignorews'
             ig_ws_val = 1
 
     # per file option
     else:
         params[fileid] += ['C:%s' % ln_ctx]
         ig_ws_key = fileid
         ig_ws_val = 'WS:%s' % 1
 
     if ig_ws:
         params[ig_ws_key] += [ig_ws_val]
 
     lbl = _('%s line context') % ln_ctx
 
     params['anchor'] = fileid
     img = h.image(h.url('/images/icons/table_add.png'), lbl, class_='icon')
     return h.link_to(img, h.url.current(**params), title=lbl, class_='tooltip')
 
 
 class ChangesetController(BaseRepoController):
 
-    @LoginRequired()
-    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
-                                   'repository.admin')
     def __before__(self):
         super(ChangesetController, self).__before__()
         c.affected_files_cut_off = 60
         repo_model = RepoModel()
         c.users_array = repo_model.get_users_js()
         c.users_groups_array = repo_model.get_users_groups_js()
 
+    @LoginRequired()
+    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
+                                   'repository.admin')
     def index(self, revision, method='show'):
         c.anchor_url = anchor_url
         c.ignorews_url = _ignorews_url
         c.context_url = _context_url
         c.fulldiff = fulldiff = request.GET.get('fulldiff')
         #get ranges of revisions if preset
         rev_range = revision.split('...')[:2]
         enable_comments = True
         try:
             if len(rev_range) == 2:
                 enable_comments = False
                 rev_start = rev_range[0]
                 rev_end = rev_range[1]
                 rev_ranges = c.rhodecode_repo.get_changesets(start=rev_start,
                                                              end=rev_end)
             else:
                 rev_ranges = [c.rhodecode_repo.get_changeset(revision)]
 
             c.cs_ranges = list(rev_ranges)
             if not c.cs_ranges:
                 raise RepositoryError('Changeset range returned empty result')
 
         except (RepositoryError, ChangesetDoesNotExistError, Exception), e:
             log.error(traceback.format_exc())
             h.flash(str(e), category='error')
             raise HTTPNotFound()
 
         c.changes = OrderedDict()
 
         c.lines_added = 0  # count of lines added
         c.lines_deleted = 0  # count of lines removes
 
         c.changeset_statuses = ChangesetStatus.STATUSES
         c.comments = []
         c.statuses = []
         c.inline_comments = []
         c.inline_cnt = 0
 
         # Iterate over ranges (default changeset view is always one changeset)
         for changeset in c.cs_ranges:
             inlines = []
             if method == 'show':
                 c.statuses.extend([ChangesetStatusModel().get_status(
                             c.rhodecode_db_repo.repo_id, changeset.raw_id)])
 
                 c.comments.extend(ChangesetCommentsModel()\
                                   .get_comments(c.rhodecode_db_repo.repo_id,
                                                 revision=changeset.raw_id))
 
                 #comments from PR
                 st = ChangesetStatusModel().get_statuses(
                             c.rhodecode_db_repo.repo_id, changeset.raw_id,
                             with_revisions=True)
                 # from associated statuses, check the pull requests, and
                 # show comments from them
 
                 prs = set([x.pull_request for x in
                            filter(lambda x: x.pull_request != None, st)])
 
                 for pr in prs:
                     c.comments.extend(pr.comments)
                 inlines = ChangesetCommentsModel()\
                             .get_inline_comments(c.rhodecode_db_repo.repo_id,
                                                  revision=changeset.raw_id)
                 c.inline_comments.extend(inlines)
 
             c.changes[changeset.raw_id] = []
 
             cs2 = changeset.raw_id
             cs1 = changeset.parents[0].raw_id if changeset.parents else EmptyChangeset()
             context_lcl = get_line_ctx('', request.GET)
             ign_whitespace_lcl = ign_whitespace_lcl = get_ignore_ws('', request.GET)
 
             _diff = c.rhodecode_repo.get_diff(cs1, cs2,
                 ignore_whitespace=ign_whitespace_lcl, context=context_lcl)
             diff_limit = self.cut_off_limit if not fulldiff else None
             diff_processor = diffs.DiffProcessor(_diff,
                                                  vcs=c.rhodecode_repo.alias,
                                                  format='gitdiff',
                                                  diff_limit=diff_limit)
             cs_changes = OrderedDict()
             if method == 'show':
                 _parsed = diff_processor.prepare()
                 c.limited_diff = False
                 if isinstance(_parsed, LimitedDiffContainer):
                     c.limited_diff = True
                 for f in _parsed:
                     st = f['stats']
                     if st[0] != 'b':
                         c.lines_added += st[0]
                         c.lines_deleted += st[1]
                     fid = h.FID(changeset.raw_id, f['filename'])
                     diff = diff_processor.as_html(enable_comments=enable_comments,
                                                   parsed_lines=[f])
                     cs_changes[fid] = [cs1, cs2, f['operation'], f['filename'],
                                        diff, st]
             else:
                 # downloads/raw we only need RAW diff nothing else
                 diff = diff_processor.as_raw()
                 cs_changes[''] = [None, None, None, None, diff, None]
             c.changes[changeset.raw_id] = cs_changes
 
         #sort comments by how they were generated
         c.comments = sorted(c.comments, key=lambda x: x.comment_id)
 
         # count inline comments
         for __, lines in c.inline_comments:
             for comments in lines.values():
                 c.inline_cnt += len(comments)
 
         if len(c.cs_ranges) == 1:
             c.changeset = c.cs_ranges[0]
             c.parent_tmpl = ''.join(['# Parent  %s\n' % x.raw_id
                                      for x in c.changeset.parents])
         if method == 'download':
             response.content_type = 'text/plain'
             response.content_disposition = 'attachment; filename=%s.diff' \
                                             % revision[:12]
             return diff
         elif method == 'patch':
             response.content_type = 'text/plain'
             c.diff = safe_unicode(diff)
             return render('changeset/patch_changeset.html')
         elif method == 'raw':
             response.content_type = 'text/plain'
             return diff
         elif method == 'show':
             if len(c.cs_ranges) == 1:
                 return render('changeset/changeset.html')
             else:
                 return render('changeset/changeset_range.html')
 
+    @LoginRequired()
+    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
+                                   'repository.admin')
     def changeset_raw(self, revision):
         return self.index(revision, method='raw')
 
+    @LoginRequired()
+    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
+                                   'repository.admin')
     def changeset_patch(self, revision):
         return self.index(revision, method='patch')
 
+    @LoginRequired()
+    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
+                                   'repository.admin')
     def changeset_download(self, revision):
         return self.index(revision, method='download')
 
+    @LoginRequired()
     @NotAnonymous()
+    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
+                                   'repository.admin')
     @jsonify
     def comment(self, repo_name, revision):
         status = request.POST.get('changeset_status')
         change_status = request.POST.get('change_changeset_status')
         text = request.POST.get('text')
         if status and change_status:
             text = text or (_('Status change -> %s')
                             % ChangesetStatus.get_status_lbl(status))
 
         c.co = comm = ChangesetCommentsModel().create(
             text=text,
             repo=c.rhodecode_db_repo.repo_id,
             user=c.rhodecode_user.user_id,
             revision=revision,
             f_path=request.POST.get('f_path'),
             line_no=request.POST.get('line'),
             status_change=(ChangesetStatus.get_status_lbl(status)
                            if status and change_status else None)
         )
 
         # get status if set !
         if status and change_status:
             # if latest status was from pull request and it's closed
             # disallow changing status !
             # dont_allow_on_closed_pull_request = True !
 
             try:
                 ChangesetStatusModel().set_status(
                     c.rhodecode_db_repo.repo_id,
                     status,
                     c.rhodecode_user.user_id,
                     comm,
                     revision=revision,
                     dont_allow_on_closed_pull_request=True
                 )
             except StatusChangeOnClosedPullRequestError:
                 log.error(traceback.format_exc())
                 msg = _('Changing status on a changeset associated with '
                         'a closed pull request is not allowed')
                 h.flash(msg, category='warning')
                 return redirect(h.url('changeset_home', repo_name=repo_name,
                                       revision=revision))
         action_logger(self.rhodecode_user,
                       'user_commented_revision:%s' % revision,
                       c.rhodecode_db_repo, self.ip_addr, self.sa)
 
         Session().commit()
 
         if not request.environ.get('HTTP_X_PARTIAL_XHR'):
             return redirect(h.url('changeset_home', repo_name=repo_name,
                                   revision=revision))
         #only ajax below
         data = {
            'target_id': h.safeid(h.safe_unicode(request.POST.get('f_path'))),
         }
         if comm:
             data.update(comm.get_dict())
             data.update({'rendered_text':
                          render('changeset/changeset_comment_block.html')})
 
         return data
 
+    @LoginRequired()
     @NotAnonymous()
+    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
+                                   'repository.admin')
     def preview_comment(self):
         if not request.environ.get('HTTP_X_PARTIAL_XHR'):
             raise HTTPBadRequest()
         text = request.POST.get('text')
         if text:
             return h.rst_w_mentions(text)
         return ''
 
+    @LoginRequired()
     @NotAnonymous()
+    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
+                                   'repository.admin')
     @jsonify
     def delete_comment(self, repo_name, comment_id):
         co = ChangesetComment.get(comment_id)
         owner = co.author.user_id == c.rhodecode_user.user_id
         if h.HasPermissionAny('hg.admin', 'repository.admin')() or owner:
             ChangesetCommentsModel().delete(comment=co)
             Session().commit()
             return True
         else:
             raise HTTPForbidden()
 
+    @LoginRequired()
+    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
+                                   'repository.admin')
     @jsonify
     def changeset_info(self, repo_name, revision):
         if request.is_xhr:
             try:
                 return c.rhodecode_repo.get_changeset(revision)
             except ChangesetDoesNotExistError, e:
                 return EmptyChangeset(message=str(e))
         else:
             raise HTTPBadRequest()

rhodecode/controllers/compare.py

@@ -1,269 +1,269 b''
 # -*- coding: utf-8 -*-
 """
     rhodecode.controllers.compare
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
     compare controller for pylons showing differences between two
     repos, branches, bookmarks or tips
 
     :created_on: May 6, 2012
     :author: marcink
     :copyright: (C) 2010-2012 Marcin Kuzminski <[e-mail]>
     :license: GPLv3, see COPYING for more details.
 """
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import logging
 import traceback
 import re
 
 from webob.exc import HTTPNotFound
 from pylons import request, response, session, tmpl_context as c, url
 from pylons.controllers.util import abort, redirect
 from pylons.i18n.translation import _
 
 from rhodecode.lib.vcs.exceptions import EmptyRepositoryError, RepositoryError
 from rhodecode.lib.vcs.utils import safe_str
 from rhodecode.lib.vcs.utils.hgcompat import scmutil
 from rhodecode.lib import helpers as h
 from rhodecode.lib.base import BaseRepoController, render
 from rhodecode.lib.auth import LoginRequired, HasRepoPermissionAnyDecorator
 from rhodecode.lib import diffs, unionrepo
 
 from rhodecode.model.db import Repository
 from webob.exc import HTTPBadRequest
 from rhodecode.lib.diffs import LimitedDiffContainer
 
 
 log = logging.getLogger(__name__)
 
 
 class CompareController(BaseRepoController):
 
-    @LoginRequired()
-    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
-                                   'repository.admin')
     def __before__(self):
         super(CompareController, self).__before__()
 
     def __get_cs_or_redirect(self, rev, repo, redirect_after=True,
                              partial=False):
         """
         Safe way to get changeset if error occur it redirects to changeset with
         proper message. If partial is set then don't do redirect raise Exception
         instead
 
         :param rev: revision to fetch
         :param repo: repo instance
         """
 
         try:
             type_, rev = rev
             return repo.scm_instance.get_changeset(rev)
         except EmptyRepositoryError, e:
             if not redirect_after:
                 return None
             h.flash(h.literal(_('There are no changesets yet')),
                     category='warning')
             redirect(url('summary_home', repo_name=repo.repo_name))
 
         except RepositoryError, e:
             log.error(traceback.format_exc())
             h.flash(str(e), category='warning')
             if not partial:
                 redirect(h.url('summary_home', repo_name=repo.repo_name))
             raise HTTPBadRequest()
 
+    def _get_changesets(self, alias, org_repo, org_ref, other_repo, other_ref, merge):
+        """
+        Returns a list of changesets that can be merged from org_repo@org_ref
+        to other_repo@other_ref ... and the ancestor that would be used for merge
+
+        :param org_repo:
+        :param org_ref:
+        :param other_repo:
+        :param other_ref:
+        :param tmp:
+        """
+
+        ancestor = None
+
+        if alias == 'hg':
+            # lookup up the exact node id
+            _revset_predicates = {
+                    'branch': 'branch',
+                    'book': 'bookmark',
+                    'tag': 'tag',
+                    'rev': 'id',
+                }
+
+            org_rev_spec = "max(%s('%s'))" % (_revset_predicates[org_ref[0]],
+                                              safe_str(org_ref[1]))
+            org_revs = scmutil.revrange(org_repo._repo, [org_rev_spec])
+            org_rev = org_repo._repo[org_revs[-1] if org_revs else -1].hex()
+
+            other_rev_spec = "max(%s('%s'))" % (_revset_predicates[other_ref[0]],
+                                                safe_str(other_ref[1]))
+            other_revs = scmutil.revrange(other_repo._repo, [other_rev_spec])
+            other_rev = other_repo._repo[other_revs[-1] if other_revs else -1].hex()
+
+            #case two independent repos
+            if org_repo != other_repo:
+                hgrepo = unionrepo.unionrepository(other_repo.baseui,
+                                                   other_repo.path,
+                                                   org_repo.path)
+                # all the changesets we are looking for will be in other_repo,
+                # so rev numbers from hgrepo can be used in other_repo
+
+            #no remote compare do it on the same repository
+            else:
+                hgrepo = other_repo._repo
+
+            if merge:
+                revs = ["ancestors(id('%s')) and not ancestors(id('%s')) and not id('%s')" %
+                        (other_rev, org_rev, org_rev)]
+
+                ancestors = scmutil.revrange(hgrepo,
+                     ["ancestor(id('%s'), id('%s'))" % (org_rev, other_rev)])
+                if ancestors:
+                    # pick arbitrary ancestor - but there is usually only one
+                    ancestor = hgrepo[ancestors[0]].hex()
+            else:
+                # TODO: have both + and - changesets
+                revs = ["id('%s') :: id('%s') - id('%s')" %
+                        (org_rev, other_rev, org_rev)]
+
+            changesets = [other_repo.get_changeset(cs)
+                          for cs in scmutil.revrange(hgrepo, revs)]
+
+        elif alias == 'git':
+            assert org_repo == other_repo, (org_repo, other_repo) # no git support for different repos
+            so, se = org_repo.run_git_command(
+                'log --reverse --pretty="format: %%H" -s -p %s..%s' % (org_ref[1],
+                                                                       other_ref[1])
+            )
+            changesets = [org_repo.get_changeset(cs)
+                          for cs in re.findall(r'[0-9a-fA-F]{40}', so)]
+
+        return changesets, ancestor
+
+    @LoginRequired()
+    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
+                                   'repository.admin')
     def index(self, org_ref_type, org_ref, other_ref_type, other_ref):
         # org_ref will be evaluated in org_repo
         org_repo = c.rhodecode_db_repo.repo_name
         org_ref = (org_ref_type, org_ref)
         # other_ref will be evaluated in other_repo
         other_ref = (other_ref_type, other_ref)
         other_repo = request.GET.get('other_repo', org_repo)
         # If merge is True:
         #   Show what org would get if merged with other:
         #   List changesets that are ancestors of other but not of org.
         #   New changesets in org is thus ignored.
         #   Diff will be from common ancestor, and merges of org to other will thus be ignored.
         # If merge is False:
         #   Make a raw diff from org to other, no matter if related or not.
         #   Changesets in one and not in the other will be ignored
         merge = bool(request.GET.get('merge'))
         # fulldiff disables cut_off_limit
         c.fulldiff = request.GET.get('fulldiff')
         # partial uses compare_cs.html template directly
         partial = request.environ.get('HTTP_X_PARTIAL_XHR')
         # as_form puts hidden input field with changeset revisions
         c.as_form = partial and request.GET.get('as_form')
         # swap url for compare_diff page - never partial and never as_form
         c.swap_url = h.url('compare_url',
             repo_name=other_repo,
             org_ref_type=other_ref[0], org_ref=other_ref[1],
             other_repo=org_repo,
             other_ref_type=org_ref[0], other_ref=org_ref[1],
             merge=merge or '')
 
         org_repo = Repository.get_by_repo_name(org_repo)
         other_repo = Repository.get_by_repo_name(other_repo)
 
         if org_repo is None:
             log.error('Could not find org repo %s' % org_repo)
             raise HTTPNotFound
         if other_repo is None:
             log.error('Could not find other repo %s' % other_repo)
             raise HTTPNotFound
 
         if org_repo != other_repo and h.is_git(org_repo):
             log.error('compare of two remote repos not available for GIT REPOS')
             raise HTTPNotFound
 
         if org_repo.scm_instance.alias != other_repo.scm_instance.alias:
             log.error('compare of two different kind of remote repos not available')
             raise HTTPNotFound
 
         self.__get_cs_or_redirect(rev=org_ref, repo=org_repo, partial=partial)
         self.__get_cs_or_redirect(rev=other_ref, repo=other_repo, partial=partial)
 
         c.org_repo = org_repo
         c.other_repo = other_repo
         c.org_ref = org_ref[1]
         c.other_ref = other_ref[1]
         c.org_ref_type = org_ref[0]
         c.other_ref_type = other_ref[0]
 
         c.cs_ranges, c.ancestor = self._get_changesets(org_repo.scm_instance.alias,
                                                        org_repo.scm_instance, org_ref,
                                                        other_repo.scm_instance, other_ref,
                                                        merge)
 
         c.statuses = c.rhodecode_db_repo.statuses([x.raw_id for x in
                                                    c.cs_ranges])
         if partial:
             assert c.ancestor
             return render('compare/compare_cs.html')
 
         if c.ancestor:
             assert merge
             # case we want a simple diff without incoming changesets,
             # previewing what will be merged.
             # Make the diff on the other repo (which is known to have other_ref)
             log.debug('Using ancestor %s as org_ref instead of %s'
                       % (c.ancestor, org_ref))
             org_ref = ('rev', c.ancestor)
             org_repo = other_repo
 
         diff_limit = self.cut_off_limit if not c.fulldiff else None
 
         log.debug('running diff between %s@%s and %s@%s'
                   % (org_repo.scm_instance.path, org_ref,
                      other_repo.scm_instance.path, other_ref))
         _diff = org_repo.scm_instance.get_diff(rev1=safe_str(org_ref[1]), rev2=safe_str(other_ref[1]))
 
         diff_processor = diffs.DiffProcessor(_diff or '', format='gitdiff',
                                              diff_limit=diff_limit)
         _parsed = diff_processor.prepare()
 
         c.limited_diff = False
         if isinstance(_parsed, LimitedDiffContainer):
             c.limited_diff = True
 
         c.files = []
         c.changes = {}
         c.lines_added = 0
         c.lines_deleted = 0
         for f in _parsed:
             st = f['stats']
             if st[0] != 'b':
                 c.lines_added += st[0]
                 c.lines_deleted += st[1]
             fid = h.FID('', f['filename'])
             c.files.append([fid, f['operation'], f['filename'], f['stats']])
             diff = diff_processor.as_html(enable_comments=False, parsed_lines=[f])
             c.changes[fid] = [f['operation'], f['filename'], diff]
 
         return render('compare/compare_diff.html')
-
-    def _get_changesets(self, alias, org_repo, org_ref, other_repo, other_ref, merge):
-        """
-        Returns a list of changesets that can be merged from org_repo@org_ref
-        to other_repo@other_ref ... and the ancestor that would be used for merge
-
-        :param org_repo:
-        :param org_ref:
-        :param other_repo:
-        :param other_ref:
-        :param tmp:
-        """
-
-        ancestor = None
-
-        if alias == 'hg':
-            # lookup up the exact node id
-            _revset_predicates = {
-                    'branch': 'branch',
-                    'book': 'bookmark',
-                    'tag': 'tag',
-                    'rev': 'id',
-                }
-
-            org_rev_spec = "max(%s('%s'))" % (_revset_predicates[org_ref[0]],
-                                              safe_str(org_ref[1]))
-            org_revs = scmutil.revrange(org_repo._repo, [org_rev_spec])
-            org_rev = org_repo._repo[org_revs[-1] if org_revs else -1].hex()
-
-            other_rev_spec = "max(%s('%s'))" % (_revset_predicates[other_ref[0]],
-                                                safe_str(other_ref[1]))
-            other_revs = scmutil.revrange(other_repo._repo, [other_rev_spec])
-            other_rev = other_repo._repo[other_revs[-1] if other_revs else -1].hex()
-
-            #case two independent repos
-            if org_repo != other_repo:
-                hgrepo = unionrepo.unionrepository(other_repo.baseui,
-                                                   other_repo.path,
-                                                   org_repo.path)
-                # all the changesets we are looking for will be in other_repo,
-                # so rev numbers from hgrepo can be used in other_repo
-
-            #no remote compare do it on the same repository
-            else:
-                hgrepo = other_repo._repo
-
-            if merge:
-                revs = ["ancestors(id('%s')) and not ancestors(id('%s')) and not id('%s')" %
-                        (other_rev, org_rev, org_rev)]
-
-                ancestors = scmutil.revrange(hgrepo,
-                     ["ancestor(id('%s'), id('%s'))" % (org_rev, other_rev)])
-                if ancestors:
-                    # pick arbitrary ancestor - but there is usually only one
-                    ancestor = hgrepo[ancestors[0]].hex()
-            else:
-                # TODO: have both + and - changesets
-                revs = ["id('%s') :: id('%s') - id('%s')" %
-                        (org_rev, other_rev, org_rev)]
-
-            changesets = [other_repo.get_changeset(cs)
-                          for cs in scmutil.revrange(hgrepo, revs)]
-
-        elif alias == 'git':
-            assert org_repo == other_repo, (org_repo, other_repo) # no git support for different repos
-            so, se = org_repo.run_git_command(
-                'log --reverse --pretty="format: %%H" -s -p %s..%s' % (org_ref[1],
-                                                                       other_ref[1])
-            )
-            changesets = [org_repo.get_changeset(cs)
-                          for cs in re.findall(r'[0-9a-fA-F]{40}', so)]
-
-        return changesets, ancestor

rhodecode/controllers/files.py

@@ -1,647 +1,650 b''
 # -*- coding: utf-8 -*-
 """
     rhodecode.controllers.files
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
     Files controller for RhodeCode
 
     :created_on: Apr 21, 2010
     :author: marcink
     :copyright: (C) 2010-2012 Marcin Kuzminski <[e-mail]>
     :license: GPLv3, see COPYING for more details.
 """
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 from __future__ import with_statement
 import os
 import logging
 import traceback
 import tempfile
 import shutil
 
 from pylons import request, response, tmpl_context as c, url
 from pylons.i18n.translation import _
 from pylons.controllers.util import redirect
 from rhodecode.lib.utils import jsonify
 
 from rhodecode.lib import diffs
 from rhodecode.lib import helpers as h
 
 from rhodecode.lib.compat import OrderedDict
 from rhodecode.lib.utils2 import convert_line_endings, detect_mode, safe_str,\
     str2bool
 from rhodecode.lib.auth import LoginRequired, HasRepoPermissionAnyDecorator
 from rhodecode.lib.base import BaseRepoController, render
 from rhodecode.lib.vcs.backends.base import EmptyChangeset
 from rhodecode.lib.vcs.conf import settings
 from rhodecode.lib.vcs.exceptions import RepositoryError, \
     ChangesetDoesNotExistError, EmptyRepositoryError, \
     ImproperArchiveTypeError, VCSError, NodeAlreadyExistsError,\
     NodeDoesNotExistError, ChangesetError, NodeError
 from rhodecode.lib.vcs.nodes import FileNode
 
 from rhodecode.model.repo import RepoModel
 from rhodecode.model.scm import ScmModel
 from rhodecode.model.db import Repository
 
 from rhodecode.controllers.changeset import anchor_url, _ignorews_url,\
     _context_url, get_line_ctx, get_ignore_ws
 from webob.exc import HTTPNotFound
 
 
 log = logging.getLogger(__name__)
 
 
 class FilesController(BaseRepoController):
 
     def __before__(self):
         super(FilesController, self).__before__()
         c.cut_off_limit = self.cut_off_limit
 
     def __get_cs_or_redirect(self, rev, repo_name, redirect_after=True):
         """
         Safe way to get changeset if error occur it redirects to tip with
         proper message
 
         :param rev: revision to fetch
         :param repo_name: repo name to redirect after
         """
 
         try:
             return c.rhodecode_repo.get_changeset(rev)
         except EmptyRepositoryError, e:
             if not redirect_after:
                 return None
             url_ = url('files_add_home',
                        repo_name=c.repo_name,
                        revision=0, f_path='')
             add_new = h.link_to(_('Click here to add new file'), url_)
             h.flash(h.literal(_('There are no files yet %s') % add_new),
                     category='warning')
             redirect(h.url('summary_home', repo_name=repo_name))
 
         except RepositoryError, e:  # including ChangesetDoesNotExistError
             h.flash(str(e), category='error')
             raise HTTPNotFound()
 
     def __get_filenode_or_redirect(self, repo_name, cs, path):
         """
         Returns file_node, if error occurs or given path is directory,
         it'll redirect to top level path
 
         :param repo_name: repo_name
         :param cs: given changeset
         :param path: path to lookup
         """
 
         try:
             file_node = cs.get_node(path)
             if file_node.is_dir():
                 raise RepositoryError('given path is a directory')
         except RepositoryError, e:
             h.flash(str(e), category='error')
             raise HTTPNotFound()
 
         return file_node
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     def index(self, repo_name, revision, f_path, annotate=False):
         # redirect to given revision from form if given
         post_revision = request.POST.get('at_rev', None)
         if post_revision:
             cs = self.__get_cs_or_redirect(post_revision, repo_name)
 
         c.changeset = self.__get_cs_or_redirect(revision, repo_name)
         c.branch = request.GET.get('branch', None)
         c.f_path = f_path
         c.annotate = annotate
         c.changeset = self.__get_cs_or_redirect(revision, repo_name)
         cur_rev = c.changeset.revision
 
         # prev link
         try:
             prev_rev = c.rhodecode_repo.get_changeset(cur_rev).prev(c.branch)
             c.url_prev = url('files_home', repo_name=c.repo_name,
                          revision=prev_rev.raw_id, f_path=f_path)
             if c.branch:
                 c.url_prev += '?branch=%s' % c.branch
         except (ChangesetDoesNotExistError, VCSError):
             c.url_prev = '#'
 
         # next link
         try:
             next_rev = c.rhodecode_repo.get_changeset(cur_rev).next(c.branch)
             c.url_next = url('files_home', repo_name=c.repo_name,
                      revision=next_rev.raw_id, f_path=f_path)
             if c.branch:
                 c.url_next += '?branch=%s' % c.branch
         except (ChangesetDoesNotExistError, VCSError):
             c.url_next = '#'
 
         # files or dirs
         try:
             c.file = c.changeset.get_node(f_path)
 
             if c.file.is_file():
                 c.load_full_history = False
                 file_last_cs = c.file.last_changeset
                 c.file_changeset = (c.changeset
                                     if c.changeset.revision < file_last_cs.revision
                                     else file_last_cs)
                 #determine if we're on branch head
                 _branches = c.rhodecode_repo.branches
                 c.on_branch_head = revision in _branches.keys() + _branches.values()
                 _hist = []
                 c.file_history = []
                 if c.load_full_history:
                     c.file_history, _hist = self._get_node_history(c.changeset, f_path)
 
                 c.authors = []
                 for a in set([x.author for x in _hist]):
                     c.authors.append((h.email(a), h.person(a)))
             else:
                 c.authors = c.file_history = []
         except RepositoryError, e:
             h.flash(str(e), category='error')
             raise HTTPNotFound()
 
         if request.environ.get('HTTP_X_PARTIAL_XHR'):
             return render('files/files_ypjax.html')
 
         return render('files/files.html')
 
+    @LoginRequired()
+    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
+                                   'repository.admin')
     def history(self, repo_name, revision, f_path, annotate=False):
         if request.environ.get('HTTP_X_PARTIAL_XHR'):
             c.changeset = self.__get_cs_or_redirect(revision, repo_name)
             c.f_path = f_path
             c.annotate = annotate
             c.file = c.changeset.get_node(f_path)
             if c.file.is_file():
                 file_last_cs = c.file.last_changeset
                 c.file_changeset = (c.changeset
                                     if c.changeset.revision < file_last_cs.revision
                                     else file_last_cs)
                 c.file_history, _hist = self._get_node_history(c.changeset, f_path)
                 c.authors = []
                 for a in set([x.author for x in _hist]):
                     c.authors.append((h.email(a), h.person(a)))
                 return render('files/files_history_box.html')
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     def rawfile(self, repo_name, revision, f_path):
         cs = self.__get_cs_or_redirect(revision, repo_name)
         file_node = self.__get_filenode_or_redirect(repo_name, cs, f_path)
 
         response.content_disposition = 'attachment; filename=%s' % \
             safe_str(f_path.split(Repository.url_sep())[-1])
 
         response.content_type = file_node.mimetype
         return file_node.content
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     def raw(self, repo_name, revision, f_path):
         cs = self.__get_cs_or_redirect(revision, repo_name)
         file_node = self.__get_filenode_or_redirect(repo_name, cs, f_path)
 
         raw_mimetype_mapping = {
             # map original mimetype to a mimetype used for "show as raw"
             # you can also provide a content-disposition to override the
             # default "attachment" disposition.
             # orig_type: (new_type, new_dispo)
 
             # show images inline:
             'image/x-icon': ('image/x-icon', 'inline'),
             'image/png': ('image/png', 'inline'),
             'image/gif': ('image/gif', 'inline'),
             'image/jpeg': ('image/jpeg', 'inline'),
             'image/svg+xml': ('image/svg+xml', 'inline'),
         }
 
         mimetype = file_node.mimetype
         try:
             mimetype, dispo = raw_mimetype_mapping[mimetype]
         except KeyError:
             # we don't know anything special about this, handle it safely
             if file_node.is_binary:
                 # do same as download raw for binary files
                 mimetype, dispo = 'application/octet-stream', 'attachment'
             else:
                 # do not just use the original mimetype, but force text/plain,
                 # otherwise it would serve text/html and that might be unsafe.
                 # Note: underlying vcs library fakes text/plain mimetype if the
                 # mimetype can not be determined and it thinks it is not
                 # binary.This might lead to erroneous text display in some
                 # cases, but helps in other cases, like with text files
                 # without extension.
                 mimetype, dispo = 'text/plain', 'inline'
 
         if dispo == 'attachment':
             dispo = 'attachment; filename=%s' % \
                         safe_str(f_path.split(os.sep)[-1])
 
         response.content_disposition = dispo
         response.content_type = mimetype
         return file_node.content
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.write', 'repository.admin')
     def edit(self, repo_name, revision, f_path):
         repo = c.rhodecode_db_repo
         if repo.enable_locking and repo.locked[0]:
             h.flash(_('This repository is has been locked by %s on %s')
                 % (h.person_by_id(repo.locked[0]),
                    h.fmt_date(h.time_to_datetime(repo.locked[1]))),
                   'warning')
             return redirect(h.url('files_home',
                                   repo_name=repo_name, revision='tip'))
 
         # check if revision is a branch identifier- basically we cannot
         # create multiple heads via file editing
         _branches = repo.scm_instance.branches
         # check if revision is a branch name or branch hash
         if revision not in _branches.keys() + _branches.values():
             h.flash(_('You can only edit files with revision '
                       'being a valid branch '), category='warning')
             return redirect(h.url('files_home',
                                   repo_name=repo_name, revision='tip',
                                   f_path=f_path))
 
         r_post = request.POST
 
         c.cs = self.__get_cs_or_redirect(revision, repo_name)
         c.file = self.__get_filenode_or_redirect(repo_name, c.cs, f_path)
 
         if c.file.is_binary:
             return redirect(url('files_home', repo_name=c.repo_name,
                          revision=c.cs.raw_id, f_path=f_path))
         c.default_message = _('Edited file %s via RhodeCode') % (f_path)
         c.f_path = f_path
 
         if r_post:
 
             old_content = c.file.content
             sl = old_content.splitlines(1)
             first_line = sl[0] if sl else ''
             # modes:  0 - Unix, 1 - Mac, 2 - DOS
             mode = detect_mode(first_line, 0)
             content = convert_line_endings(r_post.get('content'), mode)
 
             message = r_post.get('message') or c.default_message
             author = self.rhodecode_user.full_contact
 
             if content == old_content:
                 h.flash(_('No changes'), category='warning')
                 return redirect(url('changeset_home', repo_name=c.repo_name,
                                     revision='tip'))
             try:
                 self.scm_model.commit_change(repo=c.rhodecode_repo,
                                              repo_name=repo_name, cs=c.cs,
                                              user=self.rhodecode_user.user_id,
                                              author=author, message=message,
                                              content=content, f_path=f_path)
                 h.flash(_('Successfully committed to %s') % f_path,
                         category='success')
 
             except Exception:
                 log.error(traceback.format_exc())
                 h.flash(_('Error occurred during commit'), category='error')
             return redirect(url('changeset_home',
                                 repo_name=c.repo_name, revision='tip'))
 
         return render('files/files_edit.html')
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.write', 'repository.admin')
     def add(self, repo_name, revision, f_path):
 
         repo = Repository.get_by_repo_name(repo_name)
         if repo.enable_locking and repo.locked[0]:
             h.flash(_('This repository is has been locked by %s on %s')
                 % (h.person_by_id(repo.locked[0]),
                    h.fmt_date(h.time_to_datetime(repo.locked[1]))),
                   'warning')
             return redirect(h.url('files_home',
                                   repo_name=repo_name, revision='tip'))
 
         r_post = request.POST
         c.cs = self.__get_cs_or_redirect(revision, repo_name,
                                          redirect_after=False)
         if c.cs is None:
             c.cs = EmptyChangeset(alias=c.rhodecode_repo.alias)
         c.default_message = (_('Added file via RhodeCode'))
         c.f_path = f_path
 
         if r_post:
             unix_mode = 0
             content = convert_line_endings(r_post.get('content'), unix_mode)
 
             message = r_post.get('message') or c.default_message
             filename = r_post.get('filename')
             location = r_post.get('location')
             file_obj = r_post.get('upload_file', None)
 
             if file_obj is not None and hasattr(file_obj, 'filename'):
                 filename = file_obj.filename
                 content = file_obj.file
 
             if not content:
                 h.flash(_('No content'), category='warning')
                 return redirect(url('changeset_home', repo_name=c.repo_name,
                                     revision='tip'))
             if not filename:
                 h.flash(_('No filename'), category='warning')
                 return redirect(url('changeset_home', repo_name=c.repo_name,
                                     revision='tip'))
             if location.startswith('/') or location.startswith('.') or '../' in location:
                 h.flash(_('Location must be relative path and must not '
                           'contain .. in path'), category='warning')
                 return redirect(url('changeset_home', repo_name=c.repo_name,
                                     revision='tip'))
             if location:
                 location = os.path.normpath(location)
             filename = os.path.basename(filename)
             node_path = os.path.join(location, filename)
             author = self.rhodecode_user.full_contact
 
             try:
                 self.scm_model.create_node(repo=c.rhodecode_repo,
                                            repo_name=repo_name, cs=c.cs,
                                            user=self.rhodecode_user.user_id,
                                            author=author, message=message,
                                            content=content, f_path=node_path)
                 h.flash(_('Successfully committed to %s') % node_path,
                         category='success')
             except (NodeError, NodeAlreadyExistsError), e:
                 h.flash(_(e), category='error')
             except Exception:
                 log.error(traceback.format_exc())
                 h.flash(_('Error occurred during commit'), category='error')
             return redirect(url('changeset_home',
                                 repo_name=c.repo_name, revision='tip'))
 
         return render('files/files_add.html')
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     def archivefile(self, repo_name, fname):
 
         fileformat = None
         revision = None
         ext = None
         subrepos = request.GET.get('subrepos') == 'true'
 
         for a_type, ext_data in settings.ARCHIVE_SPECS.items():
             archive_spec = fname.split(ext_data[1])
             if len(archive_spec) == 2 and archive_spec[1] == '':
                 fileformat = a_type or ext_data[1]
                 revision = archive_spec[0]
                 ext = ext_data[1]
 
         try:
             dbrepo = RepoModel().get_by_repo_name(repo_name)
             if not dbrepo.enable_downloads:
                 return _('Downloads disabled')
 
             if c.rhodecode_repo.alias == 'hg':
                 # patch and reset hooks section of UI config to not run any
                 # hooks on fetching archives with subrepos
                 for k, v in c.rhodecode_repo._repo.ui.configitems('hooks'):
                     c.rhodecode_repo._repo.ui.setconfig('hooks', k, None)
 
             cs = c.rhodecode_repo.get_changeset(revision)
             content_type = settings.ARCHIVE_SPECS[fileformat][0]
         except ChangesetDoesNotExistError:
             return _('Unknown revision %s') % revision
         except EmptyRepositoryError:
             return _('Empty repository')
         except (ImproperArchiveTypeError, KeyError):
             return _('Unknown archive type')
         # archive cache
         from rhodecode import CONFIG
         rev_name = cs.raw_id[:12]
         archive_name = '%s-%s%s' % (safe_str(repo_name.replace('/', '_')),
                                     safe_str(rev_name), ext)
 
         use_cached_archive = False  # defines if we use cached version of archive
         archive_cache_enabled = CONFIG.get('archive_cache_dir')
         if not subrepos and archive_cache_enabled:
             #check if we it's ok to write
             if not os.path.isdir(CONFIG['archive_cache_dir']):
                 os.makedirs(CONFIG['archive_cache_dir'])
             cached_archive_path = os.path.join(CONFIG['archive_cache_dir'], archive_name)
             if os.path.isfile(cached_archive_path):
                 log.debug('Found cached archive in %s' % cached_archive_path)
                 fd, archive = None, cached_archive_path
                 use_cached_archive = True
             else:
                 log.debug('Archive %s is not yet cached' % (archive_name))
 
         if not use_cached_archive:
             #generate new archive
             try:
                 fd, archive = tempfile.mkstemp()
                 t = open(archive, 'wb')
                 log.debug('Creating new temp archive in %s' % archive)
                 cs.fill_archive(stream=t, kind=fileformat, subrepos=subrepos)
                 if archive_cache_enabled:
                     #if we generated the archive and use cache rename that
                     log.debug('Storing new archive in %s' % cached_archive_path)
                     shutil.move(archive, cached_archive_path)
                     archive = cached_archive_path
             finally:
                 t.close()
 
         def get_chunked_archive(archive):
             stream = open(archive, 'rb')
             while True:
                 data = stream.read(16 * 1024)
                 if not data:
                     stream.close()
                     if fd:  # fd means we used temporary file
                         os.close(fd)
                     if not archive_cache_enabled:
                         log.debug('Destroing temp archive %s' % archive)
                         os.remove(archive)
                     break
                 yield data
 
         response.content_disposition = str('attachment; filename=%s' % (archive_name))
         response.content_type = str(content_type)
         return get_chunked_archive(archive)
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     def diff(self, repo_name, f_path):
         ignore_whitespace = request.GET.get('ignorews') == '1'
         line_context = request.GET.get('context', 3)
         diff1 = request.GET.get('diff1', '')
         diff2 = request.GET.get('diff2', '')
         c.action = request.GET.get('diff')
         c.no_changes = diff1 == diff2
         c.f_path = f_path
         c.big_diff = False
         c.anchor_url = anchor_url
         c.ignorews_url = _ignorews_url
         c.context_url = _context_url
         c.changes = OrderedDict()
         c.changes[diff2] = []
 
         #special case if we want a show rev only, it's impl here
         #to reduce JS and callbacks
 
         if request.GET.get('show_rev'):
             if str2bool(request.GET.get('annotate', 'False')):
                 _url = url('files_annotate_home', repo_name=c.repo_name,
                            revision=diff1, f_path=c.f_path)
             else:
                 _url = url('files_home', repo_name=c.repo_name,
                            revision=diff1, f_path=c.f_path)
 
             return redirect(_url)
         try:
             if diff1 not in ['', None, 'None', '0' * 12, '0' * 40]:
                 c.changeset_1 = c.rhodecode_repo.get_changeset(diff1)
                 try:
                     node1 = c.changeset_1.get_node(f_path)
                     if node1.is_dir():
                         raise NodeError('%s path is a %s not a file'
                                         % (node1, type(node1)))
                 except NodeDoesNotExistError:
                     c.changeset_1 = EmptyChangeset(cs=diff1,
                                                    revision=c.changeset_1.revision,
                                                    repo=c.rhodecode_repo)
                     node1 = FileNode(f_path, '', changeset=c.changeset_1)
             else:
                 c.changeset_1 = EmptyChangeset(repo=c.rhodecode_repo)
                 node1 = FileNode(f_path, '', changeset=c.changeset_1)
 
             if diff2 not in ['', None, 'None', '0' * 12, '0' * 40]:
                 c.changeset_2 = c.rhodecode_repo.get_changeset(diff2)
                 try:
                     node2 = c.changeset_2.get_node(f_path)
                     if node2.is_dir():
                         raise NodeError('%s path is a %s not a file'
                                         % (node2, type(node2)))
                 except NodeDoesNotExistError:
                     c.changeset_2 = EmptyChangeset(cs=diff2,
                                                    revision=c.changeset_2.revision,
                                                    repo=c.rhodecode_repo)
                     node2 = FileNode(f_path, '', changeset=c.changeset_2)
             else:
                 c.changeset_2 = EmptyChangeset(repo=c.rhodecode_repo)
                 node2 = FileNode(f_path, '', changeset=c.changeset_2)
         except (RepositoryError, NodeError):
             log.error(traceback.format_exc())
             return redirect(url('files_home', repo_name=c.repo_name,
                                 f_path=f_path))
 
         if c.action == 'download':
             _diff = diffs.get_gitdiff(node1, node2,
                                       ignore_whitespace=ignore_whitespace,
                                       context=line_context)
             diff = diffs.DiffProcessor(_diff, format='gitdiff')
 
             diff_name = '%s_vs_%s.diff' % (diff1, diff2)
             response.content_type = 'text/plain'
             response.content_disposition = (
                 'attachment; filename=%s' % diff_name
             )
             return diff.as_raw()
 
         elif c.action == 'raw':
             _diff = diffs.get_gitdiff(node1, node2,
                                       ignore_whitespace=ignore_whitespace,
                                       context=line_context)
             diff = diffs.DiffProcessor(_diff, format='gitdiff')
             response.content_type = 'text/plain'
             return diff.as_raw()
 
         else:
             fid = h.FID(diff2, node2.path)
             line_context_lcl = get_line_ctx(fid, request.GET)
             ign_whitespace_lcl = get_ignore_ws(fid, request.GET)
 
             lim = request.GET.get('fulldiff') or self.cut_off_limit
             _, cs1, cs2, diff, st = diffs.wrapped_diff(filenode_old=node1,
                                          filenode_new=node2,
                                          cut_off_limit=lim,
                                          ignore_whitespace=ign_whitespace_lcl,
                                          line_context=line_context_lcl,
                                          enable_comments=False)
             op = ''
             filename = node1.path
             cs_changes = {
                 'fid': [cs1, cs2, op, filename, diff, st]
             }
             c.changes = cs_changes
 
         return render('files/file_diff.html')
 
     def _get_node_history(self, cs, f_path, changesets=None):
         """
         get changesets history for given node
 
         :param cs: changeset to calculate history
         :param f_path: path for node to calculate history for
         :param changesets: if passed don't calculate history and take
             changesets defined in this list
         """
         # calculate history based on tip
         tip_cs = c.rhodecode_repo.get_changeset()
         if changesets is None:
             try:
                 changesets = tip_cs.get_file_history(f_path)
             except (NodeDoesNotExistError, ChangesetError):
                 #this node is not present at tip !
                 changesets = cs.get_file_history(f_path)
         hist_l = []
 
         changesets_group = ([], _("Changesets"))
         branches_group = ([], _("Branches"))
         tags_group = ([], _("Tags"))
         _hg = cs.repository.alias == 'hg'
         for chs in changesets:
             #_branch = '(%s)' % chs.branch if _hg else ''
             _branch = chs.branch
             n_desc = 'r%s:%s (%s)' % (chs.revision, chs.short_id, _branch)
             changesets_group[0].append((chs.raw_id, n_desc,))
         hist_l.append(changesets_group)
 
         for name, chs in c.rhodecode_repo.branches.items():
             branches_group[0].append((chs, name),)
         hist_l.append(branches_group)
 
         for name, chs in c.rhodecode_repo.tags.items():
             tags_group[0].append((chs, name),)
         hist_l.append(tags_group)
 
         return hist_l, changesets
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     @jsonify
     def nodelist(self, repo_name, revision, f_path):
         if request.environ.get('HTTP_X_PARTIAL_XHR'):
             cs = self.__get_cs_or_redirect(revision, repo_name)
             _d, _f = ScmModel().get_nodes(repo_name, cs.raw_id, f_path,
                                           flat=False)
             return {'nodes': _d + _f}

rhodecode/controllers/followers.py

@@ -1,58 +1,58 b''
 # -*- coding: utf-8 -*-
 """
     rhodecode.controllers.followers
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
     Followers controller for rhodecode
 
     :created_on: Apr 23, 2011
     :author: marcink
     :copyright: (C) 2011-2012 Marcin Kuzminski <[e-mail]>
     :license: GPLv3, see COPYING for more details.
 """
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import logging
 
 from pylons import tmpl_context as c, request
 
 from rhodecode.lib.helpers import Page
 from rhodecode.lib.auth import LoginRequired, HasRepoPermissionAnyDecorator
 from rhodecode.lib.base import BaseRepoController, render
 from rhodecode.model.db import Repository, User, UserFollowing
 from rhodecode.lib.utils2 import safe_int
 
 log = logging.getLogger(__name__)
 
 
 class FollowersController(BaseRepoController):
 
+    def __before__(self):
+        super(FollowersController, self).__before__()
+
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
-    def __before__(self):
-        super(FollowersController, self).__before__()
-
     def followers(self, repo_name):
         p = safe_int(request.GET.get('page', 1), 1)
         repo_id = c.rhodecode_db_repo.repo_id
         d = UserFollowing.get_repo_followers(repo_id)\
             .order_by(UserFollowing.follows_from)
         c.followers_pager = Page(d, page=p, items_per_page=20)
 
         c.followers_data = render('/followers/followers_data.html')
 
         if request.environ.get('HTTP_X_PARTIAL_XHR'):
             return c.followers_data
 
         return render('/followers/followers.html')

rhodecode/controllers/forks.py

@@ -1,191 +1,193 b''
 # -*- coding: utf-8 -*-
 """
     rhodecode.controllers.forks
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
     forks controller for rhodecode
 
     :created_on: Apr 23, 2011
     :author: marcink
     :copyright: (C) 2011-2012 Marcin Kuzminski <[e-mail]>
     :license: GPLv3, see COPYING for more details.
 """
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import logging
 import formencode
 import traceback
 from formencode import htmlfill
 
 from pylons import tmpl_context as c, request, url
 from pylons.controllers.util import redirect
 from pylons.i18n.translation import _
 
 import rhodecode.lib.helpers as h
 
 from rhodecode.lib.helpers import Page
 from rhodecode.lib.auth import LoginRequired, HasRepoPermissionAnyDecorator, \
     NotAnonymous, HasRepoPermissionAny, HasPermissionAllDecorator,\
     HasPermissionAnyDecorator
 from rhodecode.lib.base import BaseRepoController, render
 from rhodecode.model.db import Repository, RepoGroup, UserFollowing, User,\
     RhodeCodeUi
 from rhodecode.model.repo import RepoModel
 from rhodecode.model.forms import RepoForkForm
 from rhodecode.model.scm import ScmModel, RepoGroupList
 from rhodecode.lib.utils2 import safe_int
 
 log = logging.getLogger(__name__)
 
 
 class ForksController(BaseRepoController):
 
-    @LoginRequired()
     def __before__(self):
         super(ForksController, self).__before__()
 
     def __load_defaults(self):
         acl_groups = RepoGroupList(RepoGroup.query().all(),
                                perm_set=['group.write', 'group.admin'])
         c.repo_groups = RepoGroup.groups_choices(groups=acl_groups)
         c.repo_groups_choices = map(lambda k: unicode(k[0]), c.repo_groups)
         choices, c.landing_revs = ScmModel().get_repo_landing_revs()
         c.landing_revs_choices = choices
         c.can_update = RhodeCodeUi.get_by_key(RhodeCodeUi.HOOK_UPDATE).ui_active
 
     def __load_data(self, repo_name=None):
         """
         Load defaults settings for edit, and update
 
         :param repo_name:
         """
         self.__load_defaults()
 
         c.repo_info = db_repo = Repository.get_by_repo_name(repo_name)
         repo = db_repo.scm_instance
 
         if c.repo_info is None:
             h.not_mapped_error(repo_name)
             return redirect(url('repos'))
 
         c.default_user_id = User.get_default_user().user_id
         c.in_public_journal = UserFollowing.query()\
             .filter(UserFollowing.user_id == c.default_user_id)\
             .filter(UserFollowing.follows_repository == c.repo_info).scalar()
 
         if c.repo_info.stats:
             last_rev = c.repo_info.stats.stat_on_revision+1
         else:
             last_rev = 0
         c.stats_revision = last_rev
 
         c.repo_last_rev = repo.count() if repo.revisions else 0
 
         if last_rev == 0 or c.repo_last_rev == 0:
             c.stats_percentage = 0
         else:
             c.stats_percentage = '%.2f' % ((float((last_rev)) /
                                             c.repo_last_rev) * 100)
 
         defaults = RepoModel()._get_defaults(repo_name)
         # alter the description to indicate a fork
         defaults['description'] = ('fork of repository: %s \n%s'
                                    % (defaults['repo_name'],
                                       defaults['description']))
         # add suffix to fork
         defaults['repo_name'] = '%s-fork' % defaults['repo_name']
 
         return defaults
 
+    @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     def forks(self, repo_name):
         p = safe_int(request.GET.get('page', 1), 1)
         repo_id = c.rhodecode_db_repo.repo_id
         d = []
         for r in Repository.get_repo_forks(repo_id):
             if not HasRepoPermissionAny(
                 'repository.read', 'repository.write', 'repository.admin'
             )(r.repo_name, 'get forks check'):
                 continue
             d.append(r)
         c.forks_pager = Page(d, page=p, items_per_page=20)
 
         c.forks_data = render('/forks/forks_data.html')
 
         if request.environ.get('HTTP_X_PARTIAL_XHR'):
             return c.forks_data
 
         return render('/forks/forks.html')
 
+    @LoginRequired()
     @NotAnonymous()
     @HasPermissionAnyDecorator('hg.admin', 'hg.fork.repository')
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     def fork(self, repo_name):
         c.repo_info = Repository.get_by_repo_name(repo_name)
         if not c.repo_info:
             h.not_mapped_error(repo_name)
             return redirect(url('home'))
 
         defaults = self.__load_data(repo_name)
 
         return htmlfill.render(
             render('forks/fork.html'),
             defaults=defaults,
             encoding="UTF-8",
             force_defaults=False
         )
 
+    @LoginRequired()
     @NotAnonymous()
     @HasPermissionAnyDecorator('hg.admin', 'hg.fork.repository')
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     def fork_create(self, repo_name):
         self.__load_defaults()
         c.repo_info = Repository.get_by_repo_name(repo_name)
         _form = RepoForkForm(old_data={'repo_type': c.repo_info.repo_type},
                              repo_groups=c.repo_groups_choices,
                              landing_revs=c.landing_revs_choices)()
         form_result = {}
         try:
             form_result = _form.to_python(dict(request.POST))
 
             # an approximation that is better than nothing
             if not RhodeCodeUi.get_by_key(RhodeCodeUi.HOOK_UPDATE).ui_active:
                 form_result['update_after_clone'] = False
 
             # create fork is done sometimes async on celery, db transaction
             # management is handled there.
             RepoModel().create_fork(form_result, self.rhodecode_user.user_id)
             fork_url = h.link_to(form_result['repo_name_full'],
                     h.url('summary_home', repo_name=form_result['repo_name_full']))
 
             h.flash(h.literal(_('Forked repository %s as %s') \
                       % (repo_name, fork_url)),
                     category='success')
         except formencode.Invalid, errors:
             c.new_repo = errors.value['repo_name']
 
             return htmlfill.render(
                 render('forks/fork.html'),
                 defaults=errors.value,
                 errors=errors.error_dict or {},
                 prefix_error=False,
                 encoding="UTF-8")
         except Exception:
             log.error(traceback.format_exc())
             h.flash(_('An error occurred during repository forking %s') %
                     repo_name, category='error')
 
         return redirect(h.url('summary_home', repo_name=repo_name))

rhodecode/controllers/home.py

@@ -1,87 +1,89 b''
 # -*- coding: utf-8 -*-
 """
     rhodecode.controllers.home
     ~~~~~~~~~~~~~~~~~~~~~~~~~~
 
     Home controller for Rhodecode
 
     :created_on: Feb 18, 2010
     :author: marcink
     :copyright: (C) 2010-2012 Marcin Kuzminski <[e-mail]>
     :license: GPLv3, see COPYING for more details.
 """
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import logging
 
 from pylons import tmpl_context as c, request
 from pylons.i18n.translation import _
 from webob.exc import HTTPBadRequest
 from sqlalchemy.sql.expression import func
 
 import rhodecode
 from rhodecode.lib import helpers as h
 from rhodecode.lib.compat import json
 from rhodecode.lib.auth import LoginRequired
 from rhodecode.lib.base import BaseController, render
 from rhodecode.model.db import Repository
 from rhodecode.model.repo import RepoModel
 
 
 log = logging.getLogger(__name__)
 
 
 class HomeController(BaseController):
 
-    @LoginRequired()
     def __before__(self):
         super(HomeController, self).__before__()
 
+    @LoginRequired()
     def index(self):
         c.groups = self.scm_model.get_repos_groups()
         c.group = None
 
         if not c.visual.lightweight_dashboard:
             c.repos_list = self.scm_model.get_repos()
         ## lightweight version of dashboard
         else:
             c.repos_list = Repository.query()\
                             .filter(Repository.group_id == None)\
                             .order_by(func.lower(Repository.repo_name))\
                             .all()
 
             repos_data = RepoModel().get_repos_as_dict(repos_list=c.repos_list,
                                                        admin=False)
             #json used to render the grid
             c.data = json.dumps(repos_data)
 
         return render('/index.html')
 
+    @LoginRequired()
     def repo_switcher(self):
         if request.is_xhr:
             all_repos = Repository.query().order_by(Repository.repo_name).all()
             c.repos_list = self.scm_model.get_repos(all_repos,
                                                     sort_key='name_sort',
                                                     simple=True)
             return render('/repo_switcher_list.html')
         else:
             raise HTTPBadRequest()
 
+    @LoginRequired()
     def branch_tag_switcher(self, repo_name):
         if request.is_xhr:
             c.rhodecode_db_repo = Repository.get_by_repo_name(c.repo_name)
             if c.rhodecode_db_repo:
                 c.rhodecode_repo = c.rhodecode_db_repo.scm_instance
                 return render('/switch_to_list.html')
         raise HTTPBadRequest()

rhodecode/controllers/journal.py

@@ -1,379 +1,379 b''
 # -*- coding: utf-8 -*-
 """
     rhodecode.controllers.journal
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
     Journal controller for pylons
 
     :created_on: Nov 21, 2010
     :author: marcink
     :copyright: (C) 2010-2012 Marcin Kuzminski <[e-mail]>
     :license: GPLv3, see COPYING for more details.
 """
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import logging
 from itertools import groupby
 
 from sqlalchemy import or_
 from sqlalchemy.orm import joinedload
 from sqlalchemy.sql.expression import func
 
 from webhelpers.paginate import Page
 from webhelpers.feedgenerator import Atom1Feed, Rss201rev2Feed
 
 from webob.exc import HTTPBadRequest
 from pylons import request, tmpl_context as c, response, url
 from pylons.i18n.translation import _
 
 import rhodecode.lib.helpers as h
 from rhodecode.lib.auth import LoginRequired, NotAnonymous
 from rhodecode.lib.base import BaseController, render
 from rhodecode.model.db import UserLog, UserFollowing, Repository, User
 from rhodecode.model.meta import Session
 from rhodecode.lib.utils2 import safe_int, AttributeDict
 from rhodecode.controllers.admin.admin import _journal_filter
 from rhodecode.model.repo import RepoModel
 from rhodecode.lib.compat import json
 
 log = logging.getLogger(__name__)
 
 
 class JournalController(BaseController):
 
     def __before__(self):
         super(JournalController, self).__before__()
         self.language = 'en-us'
         self.ttl = "5"
         self.feed_nr = 20
         c.search_term = request.GET.get('filter')
 
+    def _get_daily_aggregate(self, journal):
+        groups = []
+        for k, g in groupby(journal, lambda x: x.action_as_day):
+            user_group = []
+            #groupby username if it's a present value, else fallback to journal username
+            for _, g2 in groupby(list(g), lambda x: x.user.username if x.user else x.username):
+                l = list(g2)
+                user_group.append((l[0].user, l))
+
+            groups.append((k, user_group,))
+
+        return groups
+
+    def _get_journal_data(self, following_repos):
+        repo_ids = [x.follows_repository.repo_id for x in following_repos
+                    if x.follows_repository is not None]
+        user_ids = [x.follows_user.user_id for x in following_repos
+                    if x.follows_user is not None]
+
+        filtering_criterion = None
+
+        if repo_ids and user_ids:
+            filtering_criterion = or_(UserLog.repository_id.in_(repo_ids),
+                        UserLog.user_id.in_(user_ids))
+        if repo_ids and not user_ids:
+            filtering_criterion = UserLog.repository_id.in_(repo_ids)
+        if not repo_ids and user_ids:
+            filtering_criterion = UserLog.user_id.in_(user_ids)
+        if filtering_criterion is not None:
+            journal = self.sa.query(UserLog)\
+                .options(joinedload(UserLog.user))\
+                .options(joinedload(UserLog.repository))
+            #filter
+            try:
+                journal = _journal_filter(journal, c.search_term)
+            except Exception:
+                # we want this to crash for now
+                raise
+            journal = journal.filter(filtering_criterion)\
+                        .order_by(UserLog.action_date.desc())
+        else:
+            journal = []
+
+        return journal
+
+    def _atom_feed(self, repos, public=True):
+        journal = self._get_journal_data(repos)
+        if public:
+            _link = url('public_journal_atom', qualified=True)
+            _desc = '%s %s %s' % (c.rhodecode_name, _('public journal'),
+                                  'atom feed')
+        else:
+            _link = url('journal_atom', qualified=True)
+            _desc = '%s %s %s' % (c.rhodecode_name, _('journal'), 'atom feed')
+
+        feed = Atom1Feed(title=_desc,
+                         link=_link,
+                         description=_desc,
+                         language=self.language,
+                         ttl=self.ttl)
+
+        for entry in journal[:self.feed_nr]:
+            user = entry.user
+            if user is None:
+                #fix deleted users
+                user = AttributeDict({'short_contact': entry.username,
+                                      'email': '',
+                                      'full_contact': ''})
+            action, action_extra, ico = h.action_parser(entry, feed=True)
+            title = "%s - %s %s" % (user.short_contact, action(),
+                                    entry.repository.repo_name)
+            desc = action_extra()
+            _url = None
+            if entry.repository is not None:
+                _url = url('changelog_home',
+                           repo_name=entry.repository.repo_name,
+                           qualified=True)
+
+            feed.add_item(title=title,
+                          pubdate=entry.action_date,
+                          link=_url or url('', qualified=True),
+                          author_email=user.email,
+                          author_name=user.full_contact,
+                          description=desc)
+
+        response.content_type = feed.mime_type
+        return feed.writeString('utf-8')
+
+    def _rss_feed(self, repos, public=True):
+        journal = self._get_journal_data(repos)
+        if public:
+            _link = url('public_journal_atom', qualified=True)
+            _desc = '%s %s %s' % (c.rhodecode_name, _('public journal'),
+                                  'rss feed')
+        else:
+            _link = url('journal_atom', qualified=True)
+            _desc = '%s %s %s' % (c.rhodecode_name, _('journal'), 'rss feed')
+
+        feed = Rss201rev2Feed(title=_desc,
+                         link=_link,
+                         description=_desc,
+                         language=self.language,
+                         ttl=self.ttl)
+
+        for entry in journal[:self.feed_nr]:
+            user = entry.user
+            if user is None:
+                #fix deleted users
+                user = AttributeDict({'short_contact': entry.username,
+                                      'email': '',
+                                      'full_contact': ''})
+            action, action_extra, ico = h.action_parser(entry, feed=True)
+            title = "%s - %s %s" % (user.short_contact, action(),
+                                    entry.repository.repo_name)
+            desc = action_extra()
+            _url = None
+            if entry.repository is not None:
+                _url = url('changelog_home',
+                           repo_name=entry.repository.repo_name,
+                           qualified=True)
+
+            feed.add_item(title=title,
+                          pubdate=entry.action_date,
+                          link=_url or url('', qualified=True),
+                          author_email=user.email,
+                          author_name=user.full_contact,
+                          description=desc)
+
+        response.content_type = feed.mime_type
+        return feed.writeString('utf-8')
+
     @LoginRequired()
     @NotAnonymous()
     def index(self):
         # Return a rendered template
         p = safe_int(request.GET.get('page', 1), 1)
         c.user = User.get(self.rhodecode_user.user_id)
         c.following = self.sa.query(UserFollowing)\
             .filter(UserFollowing.user_id == self.rhodecode_user.user_id)\
             .options(joinedload(UserFollowing.follows_repository))\
             .all()
 
         journal = self._get_journal_data(c.following)
 
         def url_generator(**kw):
             return url.current(filter=c.search_term, **kw)
 
         c.journal_pager = Page(journal, page=p, items_per_page=20, url=url_generator)
         c.journal_day_aggreagate = self._get_daily_aggregate(c.journal_pager)
 
         c.journal_data = render('journal/journal_data.html')
         if request.environ.get('HTTP_X_PARTIAL_XHR'):
             return c.journal_data
 
         repos_list = Session().query(Repository)\
                      .filter(Repository.user_id ==
                              self.rhodecode_user.user_id)\
                      .order_by(func.lower(Repository.repo_name)).all()
 
         repos_data = RepoModel().get_repos_as_dict(repos_list=repos_list,
                                                    admin=True)
         #json used to render the grid
         c.data = json.dumps(repos_data)
 
         watched_repos_data = []
 
         ## watched repos
         _render = RepoModel._render_datatable
 
         def quick_menu(repo_name):
             return _render('quick_menu', repo_name)
 
         def repo_lnk(name, rtype, private, fork_of):
             return _render('repo_name', name, rtype, private, fork_of,
                            short_name=False, admin=False)
 
         def last_rev(repo_name, cs_cache):
             return _render('revision', repo_name, cs_cache.get('revision'),
                            cs_cache.get('raw_id'), cs_cache.get('author'),
                            cs_cache.get('message'))
 
         def desc(desc):
             from pylons import tmpl_context as c
             if c.visual.stylify_metatags:
                 return h.urlify_text(h.desc_stylize(h.truncate(desc, 60)))
             else:
                 return h.urlify_text(h.truncate(desc, 60))
 
         def repo_actions(repo_name):
             return _render('repo_actions', repo_name)
 
         def owner_actions(user_id, username):
             return _render('user_name', user_id, username)
 
         def toogle_follow(repo_id):
             return  _render('toggle_follow', repo_id)
 
         for entry in c.following:
             repo = entry.follows_repository
             cs_cache = repo.changeset_cache
             row = {
                 "menu": quick_menu(repo.repo_name),
                 "raw_name": repo.repo_name.lower(),
                 "name": repo_lnk(repo.repo_name, repo.repo_type,
                                  repo.private, repo.fork),
                 "last_changeset": last_rev(repo.repo_name, cs_cache),
                 "raw_tip": cs_cache.get('revision'),
                 "action": toogle_follow(repo.repo_id)
             }
 
             watched_repos_data.append(row)
 
         c.watched_data = json.dumps({
             "totalRecords": len(c.following),
             "startIndex": 0,
             "sort": "name",
             "dir": "asc",
             "records": watched_repos_data
         })
         return render('journal/journal.html')
 
     @LoginRequired(api_access=True)
     @NotAnonymous()
     def journal_atom(self):
         """
         Produce an atom-1.0 feed via feedgenerator module
         """
         following = self.sa.query(UserFollowing)\
             .filter(UserFollowing.user_id == self.rhodecode_user.user_id)\
             .options(joinedload(UserFollowing.follows_repository))\
             .all()
         return self._atom_feed(following, public=False)
 
     @LoginRequired(api_access=True)
     @NotAnonymous()
     def journal_rss(self):
         """
         Produce an rss feed via feedgenerator module
         """
         following = self.sa.query(UserFollowing)\
             .filter(UserFollowing.user_id == self.rhodecode_user.user_id)\
             .options(joinedload(UserFollowing.follows_repository))\
             .all()
         return self._rss_feed(following, public=False)
 
-    def _get_daily_aggregate(self, journal):
-        groups = []
-        for k, g in groupby(journal, lambda x: x.action_as_day):
-            user_group = []
-            #groupby username if it's a present value, else fallback to journal username
-            for _, g2 in groupby(list(g), lambda x: x.user.username if x.user else x.username):
-                l = list(g2)
-                user_group.append((l[0].user, l))
-
-            groups.append((k, user_group,))
-
-        return groups
-
-    def _get_journal_data(self, following_repos):
-        repo_ids = [x.follows_repository.repo_id for x in following_repos
-                    if x.follows_repository is not None]
-        user_ids = [x.follows_user.user_id for x in following_repos
-                    if x.follows_user is not None]
-
-        filtering_criterion = None
-
-        if repo_ids and user_ids:
-            filtering_criterion = or_(UserLog.repository_id.in_(repo_ids),
-                        UserLog.user_id.in_(user_ids))
-        if repo_ids and not user_ids:
-            filtering_criterion = UserLog.repository_id.in_(repo_ids)
-        if not repo_ids and user_ids:
-            filtering_criterion = UserLog.user_id.in_(user_ids)
-        if filtering_criterion is not None:
-            journal = self.sa.query(UserLog)\
-                .options(joinedload(UserLog.user))\
-                .options(joinedload(UserLog.repository))
-            #filter
-            try:
-                journal = _journal_filter(journal, c.search_term)
-            except Exception:
-                # we want this to crash for now
-                raise
-            journal = journal.filter(filtering_criterion)\
-                        .order_by(UserLog.action_date.desc())
-        else:
-            journal = []
-
-        return journal
-
     @LoginRequired()
     @NotAnonymous()
     def toggle_following(self):
         cur_token = request.POST.get('auth_token')
         token = h.get_token()
         if cur_token == token:
 
             user_id = request.POST.get('follows_user_id')
             if user_id:
                 try:
                     self.scm_model.toggle_following_user(user_id,
                                                 self.rhodecode_user.user_id)
                     Session.commit()
                     return 'ok'
                 except Exception:
                     raise HTTPBadRequest()
 
             repo_id = request.POST.get('follows_repo_id')
             if repo_id:
                 try:
                     self.scm_model.toggle_following_repo(repo_id,
                                                 self.rhodecode_user.user_id)
                     Session.commit()
                     return 'ok'
                 except Exception:
                     raise HTTPBadRequest()
 
         log.debug('token mismatch %s vs %s' % (cur_token, token))
         raise HTTPBadRequest()
 
     @LoginRequired()
     def public_journal(self):
         # Return a rendered template
         p = safe_int(request.GET.get('page', 1), 1)
 
         c.following = self.sa.query(UserFollowing)\
             .filter(UserFollowing.user_id == self.rhodecode_user.user_id)\
             .options(joinedload(UserFollowing.follows_repository))\
             .all()
 
         journal = self._get_journal_data(c.following)
 
         c.journal_pager = Page(journal, page=p, items_per_page=20)
 
         c.journal_day_aggreagate = self._get_daily_aggregate(c.journal_pager)
 
         c.journal_data = render('journal/journal_data.html')
         if request.environ.get('HTTP_X_PARTIAL_XHR'):
             return c.journal_data
         return render('journal/public_journal.html')
 
-    def _atom_feed(self, repos, public=True):
-        journal = self._get_journal_data(repos)
-        if public:
-            _link = url('public_journal_atom', qualified=True)
-            _desc = '%s %s %s' % (c.rhodecode_name, _('public journal'),
-                                  'atom feed')
-        else:
-            _link = url('journal_atom', qualified=True)
-            _desc = '%s %s %s' % (c.rhodecode_name, _('journal'), 'atom feed')
-
-        feed = Atom1Feed(title=_desc,
-                         link=_link,
-                         description=_desc,
-                         language=self.language,
-                         ttl=self.ttl)
-
-        for entry in journal[:self.feed_nr]:
-            user = entry.user
-            if user is None:
-                #fix deleted users
-                user = AttributeDict({'short_contact': entry.username,
-                                      'email': '',
-                                      'full_contact': ''})
-            action, action_extra, ico = h.action_parser(entry, feed=True)
-            title = "%s - %s %s" % (user.short_contact, action(),
-                                    entry.repository.repo_name)
-            desc = action_extra()
-            _url = None
-            if entry.repository is not None:
-                _url = url('changelog_home',
-                           repo_name=entry.repository.repo_name,
-                           qualified=True)
-
-            feed.add_item(title=title,
-                          pubdate=entry.action_date,
-                          link=_url or url('', qualified=True),
-                          author_email=user.email,
-                          author_name=user.full_contact,
-                          description=desc)
-
-        response.content_type = feed.mime_type
-        return feed.writeString('utf-8')
-
-    def _rss_feed(self, repos, public=True):
-        journal = self._get_journal_data(repos)
-        if public:
-            _link = url('public_journal_atom', qualified=True)
-            _desc = '%s %s %s' % (c.rhodecode_name, _('public journal'),
-                                  'rss feed')
-        else:
-            _link = url('journal_atom', qualified=True)
-            _desc = '%s %s %s' % (c.rhodecode_name, _('journal'), 'rss feed')
-
-        feed = Rss201rev2Feed(title=_desc,
-                         link=_link,
-                         description=_desc,
-                         language=self.language,
-                         ttl=self.ttl)
-
-        for entry in journal[:self.feed_nr]:
-            user = entry.user
-            if user is None:
-                #fix deleted users
-                user = AttributeDict({'short_contact': entry.username,
-                                      'email': '',
-                                      'full_contact': ''})
-            action, action_extra, ico = h.action_parser(entry, feed=True)
-            title = "%s - %s %s" % (user.short_contact, action(),
-                                    entry.repository.repo_name)
-            desc = action_extra()
-            _url = None
-            if entry.repository is not None:
-                _url = url('changelog_home',
-                           repo_name=entry.repository.repo_name,
-                           qualified=True)
-
-            feed.add_item(title=title,
-                          pubdate=entry.action_date,
-                          link=_url or url('', qualified=True),
-                          author_email=user.email,
-                          author_name=user.full_contact,
-                          description=desc)
-
-        response.content_type = feed.mime_type
-        return feed.writeString('utf-8')
-
     @LoginRequired(api_access=True)
     def public_journal_atom(self):
         """
         Produce an atom-1.0 feed via feedgenerator module
         """
         c.following = self.sa.query(UserFollowing)\
             .filter(UserFollowing.user_id == self.rhodecode_user.user_id)\
             .options(joinedload(UserFollowing.follows_repository))\
             .all()
 
         return self._atom_feed(c.following)
 
     @LoginRequired(api_access=True)
     def public_journal_rss(self):
         """
         Produce an rss2 feed via feedgenerator module
         """
         c.following = self.sa.query(UserFollowing)\
             .filter(UserFollowing.user_id == self.rhodecode_user.user_id)\
             .options(joinedload(UserFollowing.follows_repository))\
             .all()
 
         return self._rss_feed(c.following)

rhodecode/controllers/pullrequests.py

@@ -1,521 +1,542 b''
 # -*- coding: utf-8 -*-
 """
     rhodecode.controllers.pullrequests
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
     pull requests controller for rhodecode for initializing pull requests
 
     :created_on: May 7, 2012
     :author: marcink
     :copyright: (C) 2010-2012 Marcin Kuzminski <[e-mail]>
     :license: GPLv3, see COPYING for more details.
 """
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import logging
 import traceback
 import formencode
 
 from webob.exc import HTTPNotFound, HTTPForbidden
 from collections import defaultdict
 from itertools import groupby
 
 from pylons import request, response, session, tmpl_context as c, url
 from pylons.controllers.util import abort, redirect
 from pylons.i18n.translation import _
 
 from rhodecode.lib.compat import json
 from rhodecode.lib.base import BaseRepoController, render
 from rhodecode.lib.auth import LoginRequired, HasRepoPermissionAnyDecorator,\
     NotAnonymous
 from rhodecode.lib.helpers import Page
 from rhodecode.lib import helpers as h
 from rhodecode.lib import diffs
 from rhodecode.lib.utils import action_logger, jsonify
 from rhodecode.lib.vcs.utils import safe_str
 from rhodecode.lib.vcs.exceptions import EmptyRepositoryError
 from rhodecode.lib.vcs.backends.base import EmptyChangeset
 from rhodecode.lib.diffs import LimitedDiffContainer
 from rhodecode.model.db import User, PullRequest, ChangesetStatus,\
     ChangesetComment
 from rhodecode.model.pull_request import PullRequestModel
 from rhodecode.model.meta import Session
 from rhodecode.model.repo import RepoModel
 from rhodecode.model.comment import ChangesetCommentsModel
 from rhodecode.model.changeset_status import ChangesetStatusModel
 from rhodecode.model.forms import PullRequestForm
 from mercurial import scmutil
 from rhodecode.lib.utils2 import safe_int
 
 log = logging.getLogger(__name__)
 
 
 class PullrequestsController(BaseRepoController):
 
-    @LoginRequired()
-    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
-                                   'repository.admin')
     def __before__(self):
         super(PullrequestsController, self).__before__()
         repo_model = RepoModel()
         c.users_array = repo_model.get_users_js()
         c.users_groups_array = repo_model.get_users_groups_js()
 
     def _get_repo_refs(self, repo, rev=None, branch_rev=None):
         """return a structure with repo's interesting changesets, suitable for
         the selectors in pullrequest.html"""
         # list named branches that has been merged to this named branch - it should probably merge back
         peers = []
 
         if rev:
             rev = safe_str(rev)
 
         if branch_rev:
             branch_rev = safe_str(branch_rev)
             # not restricting to merge() would also get branch point and be better
             # (especially because it would get the branch point) ... but is currently too expensive
             revs = ["sort(parents(branch(id('%s')) and merge()) - branch(id('%s')))" %
                     (branch_rev, branch_rev)]
             otherbranches = {}
             for i in scmutil.revrange(repo._repo, revs):
                 cs = repo.get_changeset(i)
                 otherbranches[cs.branch] = cs.raw_id
             for branch, node in otherbranches.iteritems():
                 selected = 'branch:%s:%s' % (branch, node)
                 peers.append((selected, branch))
 
         selected = None
         branches = []
         for branch, branchrev in repo.branches.iteritems():
             n = 'branch:%s:%s' % (branch, branchrev)
             branches.append((n, branch))
             if rev == branchrev:
                 selected = n
         bookmarks = []
         for bookmark, bookmarkrev in repo.bookmarks.iteritems():
             n = 'book:%s:%s' % (bookmark, bookmarkrev)
             bookmarks.append((n, bookmark))
             if rev == bookmarkrev:
                 selected = n
         tags = []
         for tag, tagrev in repo.tags.iteritems():
             n = 'tag:%s:%s' % (tag, tagrev)
             tags.append((n, tag))
             if rev == tagrev and tag != 'tip': # tip is not a real tag - and its branch is better
                 selected = n
 
         # prio 1: rev was selected as existing entry above
 
         # prio 2: create special entry for rev; rev _must_ be used
         specials = []
         if rev and selected is None:
             selected = 'rev:%s:%s' % (rev, rev)
             specials = [(selected, '%s: %s' % (_("Changeset"), rev[:12]))]
 
         # prio 3: most recent peer branch
         if peers and not selected:
             selected = peers[0][0][0]
 
         # prio 4: tip revision
         if not selected:
             selected = 'tag:tip:%s' % repo.tags['tip']
 
         groups = [(specials, _("Special")),
                   (peers, _("Peer branches")),
                   (bookmarks, _("Bookmarks")),
                   (branches, _("Branches")),
                   (tags, _("Tags")),
                   ]
         return [g for g in groups if g[0]], selected
 
     def _get_is_allowed_change_status(self, pull_request):
         owner = self.rhodecode_user.user_id == pull_request.user_id
         reviewer = self.rhodecode_user.user_id in [x.user_id for x in
                                                    pull_request.reviewers]
         return (self.rhodecode_user.admin or owner or reviewer)
 
-    def show_all(self, repo_name):
-        c.pull_requests = PullRequestModel().get_all(repo_name)
-        c.repo_name = repo_name
-        p = safe_int(request.GET.get('page', 1), 1)
-
-        c.pullrequests_pager = Page(c.pull_requests, page=p, items_per_page=10)
-
-        c.pullrequest_data = render('/pullrequests/pullrequest_data.html')
-
-        if request.environ.get('HTTP_X_PARTIAL_XHR'):
-            return c.pullrequest_data
-
-        return render('/pullrequests/pullrequest_show_all.html')
-
-    @NotAnonymous()
-    def index(self):
-        org_repo = c.rhodecode_db_repo
-
-        if org_repo.scm_instance.alias != 'hg':
-            log.error('Review not available for GIT REPOS')
-            raise HTTPNotFound
-
-        try:
-            org_repo.scm_instance.get_changeset()
-        except EmptyRepositoryError, e:
-            h.flash(h.literal(_('There are no changesets yet')),
-                    category='warning')
-            redirect(url('summary_home', repo_name=org_repo.repo_name))
-
-        org_rev = request.GET.get('rev_end')
-        # rev_start is not directly useful - its parent could however be used
-        # as default for other and thus give a simple compare view
-        #other_rev = request.POST.get('rev_start')
-
-        c.org_repos = []
-        c.org_repos.append((org_repo.repo_name, org_repo.repo_name))
-        c.default_org_repo = org_repo.repo_name
-        c.org_refs, c.default_org_ref = self._get_repo_refs(org_repo.scm_instance, org_rev)
-
-        c.other_repos = []
-        other_repos_info = {}
-
-        def add_other_repo(repo, branch_rev=None):
-            if repo.repo_name in other_repos_info: # shouldn't happen
-                return
-            c.other_repos.append((repo.repo_name, repo.repo_name))
-            other_refs, selected_other_ref = self._get_repo_refs(repo.scm_instance, branch_rev=branch_rev)
-            other_repos_info[repo.repo_name] = {
-                'user': dict(user_id=repo.user.user_id,
-                             username=repo.user.username,
-                             firstname=repo.user.firstname,
-                             lastname=repo.user.lastname,
-                             gravatar_link=h.gravatar_url(repo.user.email, 14)),
-                'description': repo.description.split('\n', 1)[0],
-                'revs': h.select('other_ref', selected_other_ref, other_refs, class_='refs')
-            }
-
-        # add org repo to other so we can open pull request against peer branches on itself
-        add_other_repo(org_repo, branch_rev=org_rev)
-        c.default_other_repo = org_repo.repo_name
-
-        # gather forks and add to this list ... even though it is rare to
-        # request forks to pull from their parent
-        for fork in org_repo.forks:
-            add_other_repo(fork)
-
-        # add parents of this fork also, but only if it's not empty
-        if org_repo.parent and org_repo.parent.scm_instance.revisions:
-            add_other_repo(org_repo.parent)
-            c.default_other_repo = org_repo.parent.repo_name
-
-        c.default_other_repo_info = other_repos_info[c.default_other_repo]
-        c.other_repos_info = json.dumps(other_repos_info)
-
-        return render('/pullrequests/pullrequest.html')
-
-    @NotAnonymous()
-    def create(self, repo_name):
-        repo = RepoModel()._get_repo(repo_name)
-        try:
-            _form = PullRequestForm(repo.repo_id)().to_python(request.POST)
-        except formencode.Invalid, errors:
-            log.error(traceback.format_exc())
-            if errors.error_dict.get('revisions'):
-                msg = 'Revisions: %s' % errors.error_dict['revisions']
-            elif errors.error_dict.get('pullrequest_title'):
-                msg = _('Pull request requires a title with min. 3 chars')
-            else:
-                msg = _('Error creating pull request')
-
-            h.flash(msg, 'error')
-            return redirect(url('pullrequest_home', repo_name=repo_name))
-
-        org_repo = _form['org_repo']
-        org_ref = 'rev:merge:%s' % _form['merge_rev']
-        other_repo = _form['other_repo']
-        other_ref = 'rev:ancestor:%s' % _form['ancestor_rev']
-        revisions = reversed(_form['revisions'])
-        reviewers = _form['review_members']
-
-        title = _form['pullrequest_title']
-        description = _form['pullrequest_desc']
-
-        try:
-            pull_request = PullRequestModel().create(
-                self.rhodecode_user.user_id, org_repo, org_ref, other_repo,
-                other_ref, revisions, reviewers, title, description
-            )
-            Session().commit()
-            h.flash(_('Successfully opened new pull request'),
-                    category='success')
-        except Exception:
-            h.flash(_('Error occurred during sending pull request'),
-                    category='error')
-            log.error(traceback.format_exc())
-            return redirect(url('pullrequest_home', repo_name=repo_name))
-
-        return redirect(url('pullrequest_show', repo_name=other_repo,
-                            pull_request_id=pull_request.pull_request_id))
-
-    @NotAnonymous()
-    @jsonify
-    def update(self, repo_name, pull_request_id):
-        pull_request = PullRequest.get_or_404(pull_request_id)
-        if pull_request.is_closed():
-            raise HTTPForbidden()
-        #only owner or admin can update it
-        owner = pull_request.author.user_id == c.rhodecode_user.user_id
-        if h.HasPermissionAny('hg.admin', 'repository.admin')() or owner:
-            reviewers_ids = map(int, filter(lambda v: v not in [None, ''],
-                       request.POST.get('reviewers_ids', '').split(',')))
-
-            PullRequestModel().update_reviewers(pull_request_id, reviewers_ids)
-            Session().commit()
-            return True
-        raise HTTPForbidden()
-
-    @NotAnonymous()
-    @jsonify
-    def delete(self, repo_name, pull_request_id):
-        pull_request = PullRequest.get_or_404(pull_request_id)
-        #only owner can delete it !
-        if pull_request.author.user_id == c.rhodecode_user.user_id:
-            PullRequestModel().delete(pull_request)
-            Session().commit()
-            h.flash(_('Successfully deleted pull request'),
-                    category='success')
-            return redirect(url('admin_settings_my_account', anchor='pullrequests'))
-        raise HTTPForbidden()
-
     def _load_compare_data(self, pull_request, enable_comments=True):
         """
         Load context data needed for generating compare diff
 
         :param pull_request:
         :type pull_request:
         """
         org_repo = pull_request.org_repo
         (org_ref_type,
          org_ref_name,
          org_ref_rev) = pull_request.org_ref.split(':')
 
         other_repo = org_repo
         (other_ref_type,
          other_ref_name,
          other_ref_rev) = pull_request.other_ref.split(':')
 
         # despite opening revisions for bookmarks/branches/tags, we always
         # convert this to rev to prevent changes after bookmark or branch change
         org_ref = ('rev', org_ref_rev)
         other_ref = ('rev', other_ref_rev)
 
         c.org_repo = org_repo
         c.other_repo = other_repo
 
         c.fulldiff = fulldiff = request.GET.get('fulldiff')
 
         c.cs_ranges = [org_repo.get_changeset(x) for x in pull_request.revisions]
 
         c.statuses = org_repo.statuses([x.raw_id for x in c.cs_ranges])
 
         c.org_ref = org_ref[1]
         c.org_ref_type = org_ref[0]
         c.other_ref = other_ref[1]
         c.other_ref_type = other_ref[0]
 
         diff_limit = self.cut_off_limit if not fulldiff else None
 
         # we swap org/other ref since we run a simple diff on one repo
         log.debug('running diff between %s@%s and %s@%s'
                   % (org_repo.scm_instance.path, org_ref,
                      other_repo.scm_instance.path, other_ref))
         _diff = org_repo.scm_instance.get_diff(rev1=safe_str(other_ref[1]), rev2=safe_str(org_ref[1]))
 
         diff_processor = diffs.DiffProcessor(_diff or '', format='gitdiff',
                                              diff_limit=diff_limit)
         _parsed = diff_processor.prepare()
 
         c.limited_diff = False
         if isinstance(_parsed, LimitedDiffContainer):
             c.limited_diff = True
 
         c.files = []
         c.changes = {}
         c.lines_added = 0
         c.lines_deleted = 0
         for f in _parsed:
             st = f['stats']
             if st[0] != 'b':
                 c.lines_added += st[0]
                 c.lines_deleted += st[1]
             fid = h.FID('', f['filename'])
             c.files.append([fid, f['operation'], f['filename'], f['stats']])
             diff = diff_processor.as_html(enable_comments=enable_comments,
                                           parsed_lines=[f])
             c.changes[fid] = [f['operation'], f['filename'], diff]
 
+    @LoginRequired()
+    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
+                                   'repository.admin')
+    def show_all(self, repo_name):
+        c.pull_requests = PullRequestModel().get_all(repo_name)
+        c.repo_name = repo_name
+        p = safe_int(request.GET.get('page', 1), 1)
+
+        c.pullrequests_pager = Page(c.pull_requests, page=p, items_per_page=10)
+
+        c.pullrequest_data = render('/pullrequests/pullrequest_data.html')
+
+        if request.environ.get('HTTP_X_PARTIAL_XHR'):
+            return c.pullrequest_data
+
+        return render('/pullrequests/pullrequest_show_all.html')
+
+    @LoginRequired()
+    @NotAnonymous()
+    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
+                                   'repository.admin')
+    def index(self):
+        org_repo = c.rhodecode_db_repo
+
+        if org_repo.scm_instance.alias != 'hg':
+            log.error('Review not available for GIT REPOS')
+            raise HTTPNotFound
+
+        try:
+            org_repo.scm_instance.get_changeset()
+        except EmptyRepositoryError, e:
+            h.flash(h.literal(_('There are no changesets yet')),
+                    category='warning')
+            redirect(url('summary_home', repo_name=org_repo.repo_name))
+
+        org_rev = request.GET.get('rev_end')
+        # rev_start is not directly useful - its parent could however be used
+        # as default for other and thus give a simple compare view
+        #other_rev = request.POST.get('rev_start')
+
+        c.org_repos = []
+        c.org_repos.append((org_repo.repo_name, org_repo.repo_name))
+        c.default_org_repo = org_repo.repo_name
+        c.org_refs, c.default_org_ref = self._get_repo_refs(org_repo.scm_instance, org_rev)
+
+        c.other_repos = []
+        other_repos_info = {}
+
+        def add_other_repo(repo, branch_rev=None):
+            if repo.repo_name in other_repos_info: # shouldn't happen
+                return
+            c.other_repos.append((repo.repo_name, repo.repo_name))
+            other_refs, selected_other_ref = self._get_repo_refs(repo.scm_instance, branch_rev=branch_rev)
+            other_repos_info[repo.repo_name] = {
+                'user': dict(user_id=repo.user.user_id,
+                             username=repo.user.username,
+                             firstname=repo.user.firstname,
+                             lastname=repo.user.lastname,
+                             gravatar_link=h.gravatar_url(repo.user.email, 14)),
+                'description': repo.description.split('\n', 1)[0],
+                'revs': h.select('other_ref', selected_other_ref, other_refs, class_='refs')
+            }
+
+        # add org repo to other so we can open pull request against peer branches on itself
+        add_other_repo(org_repo, branch_rev=org_rev)
+        c.default_other_repo = org_repo.repo_name
+
+        # gather forks and add to this list ... even though it is rare to
+        # request forks to pull from their parent
+        for fork in org_repo.forks:
+            add_other_repo(fork)
+
+        # add parents of this fork also, but only if it's not empty
+        if org_repo.parent and org_repo.parent.scm_instance.revisions:
+            add_other_repo(org_repo.parent)
+            c.default_other_repo = org_repo.parent.repo_name
+
+        c.default_other_repo_info = other_repos_info[c.default_other_repo]
+        c.other_repos_info = json.dumps(other_repos_info)
+
+        return render('/pullrequests/pullrequest.html')
+
+    @LoginRequired()
+    @NotAnonymous()
+    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
+                                   'repository.admin')
+    def create(self, repo_name):
+        repo = RepoModel()._get_repo(repo_name)
+        try:
+            _form = PullRequestForm(repo.repo_id)().to_python(request.POST)
+        except formencode.Invalid, errors:
+            log.error(traceback.format_exc())
+            if errors.error_dict.get('revisions'):
+                msg = 'Revisions: %s' % errors.error_dict['revisions']
+            elif errors.error_dict.get('pullrequest_title'):
+                msg = _('Pull request requires a title with min. 3 chars')
+            else:
+                msg = _('Error creating pull request')
+
+            h.flash(msg, 'error')
+            return redirect(url('pullrequest_home', repo_name=repo_name))
+
+        org_repo = _form['org_repo']
+        org_ref = 'rev:merge:%s' % _form['merge_rev']
+        other_repo = _form['other_repo']
+        other_ref = 'rev:ancestor:%s' % _form['ancestor_rev']
+        revisions = reversed(_form['revisions'])
+        reviewers = _form['review_members']
+
+        title = _form['pullrequest_title']
+        description = _form['pullrequest_desc']
+
+        try:
+            pull_request = PullRequestModel().create(
+                self.rhodecode_user.user_id, org_repo, org_ref, other_repo,
+                other_ref, revisions, reviewers, title, description
+            )
+            Session().commit()
+            h.flash(_('Successfully opened new pull request'),
+                    category='success')
+        except Exception:
+            h.flash(_('Error occurred during sending pull request'),
+                    category='error')
+            log.error(traceback.format_exc())
+            return redirect(url('pullrequest_home', repo_name=repo_name))
+
+        return redirect(url('pullrequest_show', repo_name=other_repo,
+                            pull_request_id=pull_request.pull_request_id))
+
+    @LoginRequired()
+    @NotAnonymous()
+    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
+                                   'repository.admin')
+    @jsonify
+    def update(self, repo_name, pull_request_id):
+        pull_request = PullRequest.get_or_404(pull_request_id)
+        if pull_request.is_closed():
+            raise HTTPForbidden()
+        #only owner or admin can update it
+        owner = pull_request.author.user_id == c.rhodecode_user.user_id
+        if h.HasPermissionAny('hg.admin', 'repository.admin')() or owner:
+            reviewers_ids = map(int, filter(lambda v: v not in [None, ''],
+                       request.POST.get('reviewers_ids', '').split(',')))
+
+            PullRequestModel().update_reviewers(pull_request_id, reviewers_ids)
+            Session().commit()
+            return True
+        raise HTTPForbidden()
+
+    @LoginRequired()
+    @NotAnonymous()
+    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
+                                   'repository.admin')
+    @jsonify
+    def delete(self, repo_name, pull_request_id):
+        pull_request = PullRequest.get_or_404(pull_request_id)
+        #only owner can delete it !
+        if pull_request.author.user_id == c.rhodecode_user.user_id:
+            PullRequestModel().delete(pull_request)
+            Session().commit()
+            h.flash(_('Successfully deleted pull request'),
+                    category='success')
+            return redirect(url('admin_settings_my_account', anchor='pullrequests'))
+        raise HTTPForbidden()
+
+    @LoginRequired()
+    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
+                                   'repository.admin')
     def show(self, repo_name, pull_request_id):
         repo_model = RepoModel()
         c.users_array = repo_model.get_users_js()
         c.users_groups_array = repo_model.get_users_groups_js()
         c.pull_request = PullRequest.get_or_404(pull_request_id)
         c.allowed_to_change_status = self._get_is_allowed_change_status(c.pull_request)
         cc_model = ChangesetCommentsModel()
         cs_model = ChangesetStatusModel()
         _cs_statuses = cs_model.get_statuses(c.pull_request.org_repo,
                                             pull_request=c.pull_request,
                                             with_revisions=True)
 
         cs_statuses = defaultdict(list)
         for st in _cs_statuses:
             cs_statuses[st.author.username] += [st]
 
         c.pull_request_reviewers = []
         c.pull_request_pending_reviewers = []
         for o in c.pull_request.reviewers:
             st = cs_statuses.get(o.user.username, None)
             if st:
                 sorter = lambda k: k.version
                 st = [(x, list(y)[0])
                       for x, y in (groupby(sorted(st, key=sorter), sorter))]
             else:
                 c.pull_request_pending_reviewers.append(o.user)
             c.pull_request_reviewers.append([o.user, st])
 
         # pull_requests repo_name we opened it against
         # ie. other_repo must match
         if repo_name != c.pull_request.other_repo.repo_name:
             raise HTTPNotFound
 
         # load compare data into template context
         enable_comments = not c.pull_request.is_closed()
         self._load_compare_data(c.pull_request, enable_comments=enable_comments)
 
         # inline comments
         c.inline_cnt = 0
         c.inline_comments = cc_model.get_inline_comments(
                                 c.rhodecode_db_repo.repo_id,
                                 pull_request=pull_request_id)
         # count inline comments
         for __, lines in c.inline_comments:
             for comments in lines.values():
                 c.inline_cnt += len(comments)
         # comments
         c.comments = cc_model.get_comments(c.rhodecode_db_repo.repo_id,
                                            pull_request=pull_request_id)
 
         try:
             cur_status = c.statuses[c.pull_request.revisions[0]][0]
         except Exception:
             log.error(traceback.format_exc())
             cur_status = 'undefined'
         if c.pull_request.is_closed() and 0:
             c.current_changeset_status = cur_status
         else:
             # changeset(pull-request) status calulation based on reviewers
             c.current_changeset_status = cs_model.calculate_status(
                                             c.pull_request_reviewers,
                                          )
         c.changeset_statuses = ChangesetStatus.STATUSES
 
         c.as_form = False
         c.ancestor = None # there is one - but right here we don't know which
         return render('/pullrequests/pullrequest_show.html')
 
+    @LoginRequired()
     @NotAnonymous()
+    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
+                                   'repository.admin')
     @jsonify
     def comment(self, repo_name, pull_request_id):
         pull_request = PullRequest.get_or_404(pull_request_id)
         if pull_request.is_closed():
             raise HTTPForbidden()
 
         status = request.POST.get('changeset_status')
         change_status = request.POST.get('change_changeset_status')
         text = request.POST.get('text')
         close_pr = request.POST.get('save_close')
 
         allowed_to_change_status = self._get_is_allowed_change_status(pull_request)
         if status and change_status and allowed_to_change_status:
             _def = (_('Status change -> %s')
                             % ChangesetStatus.get_status_lbl(status))
             if close_pr:
                 _def = _('Closing with') + ' ' + _def
             text = text or _def
         comm = ChangesetCommentsModel().create(
             text=text,
             repo=c.rhodecode_db_repo.repo_id,
             user=c.rhodecode_user.user_id,
             pull_request=pull_request_id,
             f_path=request.POST.get('f_path'),
             line_no=request.POST.get('line'),
             status_change=(ChangesetStatus.get_status_lbl(status)
                            if status and change_status
                            and allowed_to_change_status else None),
             closing_pr=close_pr
         )
 
         action_logger(self.rhodecode_user,
                       'user_commented_pull_request:%s' % pull_request_id,
                       c.rhodecode_db_repo, self.ip_addr, self.sa)
 
         if allowed_to_change_status:
             # get status if set !
             if status and change_status:
                 ChangesetStatusModel().set_status(
                     c.rhodecode_db_repo.repo_id,
                     status,
                     c.rhodecode_user.user_id,
                     comm,
                     pull_request=pull_request_id
                 )
 
             if close_pr:
                 if status in ['rejected', 'approved']:
                     PullRequestModel().close_pull_request(pull_request_id)
                     action_logger(self.rhodecode_user,
                               'user_closed_pull_request:%s' % pull_request_id,
                               c.rhodecode_db_repo, self.ip_addr, self.sa)
                 else:
                     h.flash(_('Closing pull request on other statuses than '
                               'rejected or approved forbidden'),
                             category='warning')
 
         Session().commit()
 
         if not request.environ.get('HTTP_X_PARTIAL_XHR'):
             return redirect(h.url('pullrequest_show', repo_name=repo_name,
                                   pull_request_id=pull_request_id))
 
         data = {
            'target_id': h.safeid(h.safe_unicode(request.POST.get('f_path'))),
         }
         if comm:
             c.co = comm
             data.update(comm.get_dict())
             data.update({'rendered_text':
                          render('changeset/changeset_comment_block.html')})
 
         return data
 
+    @LoginRequired()
     @NotAnonymous()
+    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
+                                   'repository.admin')
     @jsonify
     def delete_comment(self, repo_name, comment_id):
         co = ChangesetComment.get(comment_id)
         if co.pull_request.is_closed():
             #don't allow deleting comments on closed pull request
             raise HTTPForbidden()
 
         owner = co.author.user_id == c.rhodecode_user.user_id
         if h.HasPermissionAny('hg.admin', 'repository.admin')() or owner:
             ChangesetCommentsModel().delete(comment=co)
             Session().commit()
             return True
         else:
             raise HTTPForbidden()

rhodecode/controllers/search.py

@@ -1,146 +1,146 b''
 # -*- coding: utf-8 -*-
 """
     rhodecode.controllers.search
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
     Search controller for RhodeCode
 
     :created_on: Aug 7, 2010
     :author: marcink
     :copyright: (C) 2010-2012 Marcin Kuzminski <[e-mail]>
     :license: GPLv3, see COPYING for more details.
 """
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import logging
 import traceback
 import urllib
 from pylons.i18n.translation import _
 from pylons import request, config, tmpl_context as c
 
 from rhodecode.lib.auth import LoginRequired
 from rhodecode.lib.base import BaseRepoController, render
 from rhodecode.lib.indexers import CHGSETS_SCHEMA, SCHEMA, CHGSET_IDX_NAME, \
     IDX_NAME, WhooshResultWrapper
 
 from webhelpers.paginate import Page
 from webhelpers.util import update_params
 
 from whoosh.index import open_dir, EmptyIndexError
 from whoosh.qparser import QueryParser, QueryParserError
 from whoosh.query import Phrase, Wildcard, Term, Prefix
 from rhodecode.model.repo import RepoModel
 from rhodecode.lib.utils2 import safe_str, safe_int
 
 
 log = logging.getLogger(__name__)
 
 
 class SearchController(BaseRepoController):
 
-    @LoginRequired()
     def __before__(self):
         super(SearchController, self).__before__()
 
+    @LoginRequired()
     def index(self, repo_name=None):
         c.repo_name = repo_name
         c.formated_results = []
         c.runtime = ''
         c.cur_query = request.GET.get('q', None)
         c.cur_type = request.GET.get('type', 'content')
         c.cur_search = search_type = {'content': 'content',
                                       'commit': 'message',
                                       'path': 'path',
                                       'repository': 'repository'
                                       }.get(c.cur_type, 'content')
 
         index_name = {
             'content': IDX_NAME,
             'commit': CHGSET_IDX_NAME,
             'path': IDX_NAME
         }.get(c.cur_type, IDX_NAME)
 
         schema_defn = {
             'content': SCHEMA,
             'commit': CHGSETS_SCHEMA,
             'path': SCHEMA
         }.get(c.cur_type, SCHEMA)
 
         log.debug('IDX: %s' % index_name)
         log.debug('SCHEMA: %s' % schema_defn)
 
         if c.cur_query:
             cur_query = c.cur_query.lower()
             log.debug(cur_query)
 
         if c.cur_query:
             p = safe_int(request.GET.get('page', 1), 1)
             highlight_items = set()
             try:
                 idx = open_dir(config['app_conf']['index_dir'],
                                indexname=index_name)
                 searcher = idx.searcher()
 
                 qp = QueryParser(search_type, schema=schema_defn)
                 if c.repo_name:
                     cur_query = u'repository:%s %s' % (c.repo_name, cur_query)
                 try:
                     query = qp.parse(unicode(cur_query))
                     # extract words for highlight
                     if isinstance(query, Phrase):
                         highlight_items.update(query.words)
                     elif isinstance(query, Prefix):
                         highlight_items.add(query.text)
                     else:
                         for i in query.all_terms():
                             if i[0] in ['content', 'message']:
                                 highlight_items.add(i[1])
 
                     matcher = query.matcher(searcher)
 
                     log.debug('query: %s' % query)
                     log.debug('hl terms: %s' % highlight_items)
                     results = searcher.search(query)
                     res_ln = len(results)
                     c.runtime = '%s results (%.3f seconds)' % (
                         res_ln, results.runtime
                     )
 
                     def url_generator(**kw):
                         q = urllib.quote(safe_str(c.cur_query))
                         return update_params("?q=%s&type=%s" \
                         % (q, safe_str(c.cur_type)), **kw)
                     repo_location = RepoModel().repos_path
                     c.formated_results = Page(
                         WhooshResultWrapper(search_type, searcher, matcher,
                                             highlight_items, repo_location),
                         page=p,
                         item_count=res_ln,
                         items_per_page=10,
                         url=url_generator
                     )
 
                 except QueryParserError:
                     c.runtime = _('Invalid search query. Try quoting it.')
                 searcher.close()
             except (EmptyIndexError, IOError):
                 log.error(traceback.format_exc())
                 log.error('Empty Index data')
                 c.runtime = _('There is no index to search in. '
                               'Please run whoosh indexer')
             except (Exception):
                 log.error(traceback.format_exc())
                 c.runtime = _('An error occurred during this search operation')
 
         # Return a rendered template
         return render('/search/search.html')

rhodecode/controllers/shortlog.py

@@ -1,107 +1,107 b''
 # -*- coding: utf-8 -*-
 """
     rhodecode.controllers.shortlog
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
     Shortlog controller for rhodecode
 
     :created_on: Apr 18, 2010
     :author: marcink
     :copyright: (C) 2010-2012 Marcin Kuzminski <[e-mail]>
     :license: GPLv3, see COPYING for more details.
 """
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import logging
 
 from pylons import tmpl_context as c, request, url
 from pylons.i18n.translation import _
 
 from rhodecode.lib import helpers as h
 from rhodecode.lib.auth import LoginRequired, HasRepoPermissionAnyDecorator
 from rhodecode.lib.base import BaseRepoController, render
 from rhodecode.lib.helpers import RepoPage
 from pylons.controllers.util import redirect
 from rhodecode.lib.utils2 import safe_int
 from rhodecode.lib.vcs.exceptions import NodeDoesNotExistError, ChangesetError,\
     RepositoryError
 
 log = logging.getLogger(__name__)
 
 
 class ShortlogController(BaseRepoController):
 
-    @LoginRequired()
-    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
-                                   'repository.admin')
     def __before__(self):
         super(ShortlogController, self).__before__()
 
     def __get_cs_or_redirect(self, rev, repo_name, redirect_after=True):
         """
         Safe way to get changeset if error occur it redirects to tip with
         proper message
 
         :param rev: revision to fetch
         :param repo_name: repo name to redirect after
         """
 
         try:
             return c.rhodecode_repo.get_changeset(rev)
         except RepositoryError, e:
             h.flash(str(e), category='warning')
             redirect(h.url('shortlog_home', repo_name=repo_name))
 
+    @LoginRequired()
+    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
+                                   'repository.admin')
     def index(self, repo_name, revision=None, f_path=None):
         p = safe_int(request.GET.get('page', 1), 1)
         size = safe_int(request.GET.get('size', 20), 20)
         collection = c.rhodecode_repo
         c.file_history = f_path
 
         def url_generator(**kw):
             if f_path:
                 return url('shortlog_file_home', repo_name=repo_name,
                            revision=revision, f_path=f_path, size=size, **kw)
             return url('shortlog_home', repo_name=repo_name, size=size, **kw)
 
         if f_path:
             log.debug('generating shortlog for path %s' % f_path)
             # get the history for the file !
             tip_cs = c.rhodecode_repo.get_changeset()
             try:
                 collection = tip_cs.get_file_history(f_path)
             except (NodeDoesNotExistError, ChangesetError):
                 #this node is not present at tip !
                 try:
                     cs = self.__get_cs_or_redirect(revision, repo_name)
                     collection = cs.get_file_history(f_path)
                 except RepositoryError, e:
                     h.flash(str(e), category='warning')
                     redirect(h.url('shortlog_home', repo_name=repo_name))
             collection = list(reversed(collection))
 
         c.repo_changesets = RepoPage(collection, page=p,
                                      items_per_page=size, url=url_generator)
         page_revisions = [x.raw_id for x in list(c.repo_changesets)]
         c.statuses = c.rhodecode_db_repo.statuses(page_revisions)
 
         if not c.repo_changesets:
             h.flash(_('There are no changesets yet'), category='warning')
             return redirect(url('summary_home', repo_name=repo_name))
 
         c.shortlog_data = render('shortlog/shortlog_data.html')
         if request.environ.get('HTTP_X_PARTIAL_XHR'):
             return c.shortlog_data
         r = render('shortlog/shortlog.html')
         return r

rhodecode/controllers/summary.py

@@ -1,260 +1,264 b''
 # -*- coding: utf-8 -*-
 """
     rhodecode.controllers.summary
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
     Summary controller for Rhodecode
 
     :created_on: Apr 18, 2010
     :author: marcink
     :copyright: (C) 2010-2012 Marcin Kuzminski <[e-mail]>
     :license: GPLv3, see COPYING for more details.
 """
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import traceback
 import calendar
 import logging
 import urllib
 from time import mktime
 from datetime import timedelta, date
 from urlparse import urlparse
 
 from pylons import tmpl_context as c, request, url, config
 from pylons.i18n.translation import _
 from webob.exc import HTTPBadRequest
 
 from beaker.cache import cache_region, region_invalidate
 
 from rhodecode.lib import helpers as h
 from rhodecode.lib.compat import product
 from rhodecode.lib.vcs.exceptions import ChangesetError, EmptyRepositoryError, \
     NodeDoesNotExistError
 from rhodecode.config.conf import ALL_READMES, ALL_EXTS, LANGUAGES_EXTENSIONS_MAP
 from rhodecode.model.db import Statistics, CacheInvalidation
 from rhodecode.lib.utils import jsonify
 from rhodecode.lib.utils2 import safe_unicode, safe_str
 from rhodecode.lib.auth import LoginRequired, HasRepoPermissionAnyDecorator,\
     NotAnonymous
 from rhodecode.lib.base import BaseRepoController, render
 from rhodecode.lib.vcs.backends.base import EmptyChangeset
 from rhodecode.lib.markup_renderer import MarkupRenderer
 from rhodecode.lib.celerylib import run_task
 from rhodecode.lib.celerylib.tasks import get_commits_stats
 from rhodecode.lib.helpers import RepoPage
 from rhodecode.lib.compat import json, OrderedDict
 from rhodecode.lib.vcs.nodes import FileNode
 
 log = logging.getLogger(__name__)
 
 README_FILES = [''.join([x[0][0], x[1][0]]) for x in
                     sorted(list(product(ALL_READMES, ALL_EXTS)),
                            key=lambda y:y[0][1] + y[1][1])]
 
 
 class SummaryController(BaseRepoController):
 
+    def __before__(self):
+        super(SummaryController, self).__before__()
+
+    def _get_download_links(self, repo):
+
+        download_l = []
+
+        branches_group = ([], _("Branches"))
+        tags_group = ([], _("Tags"))
+
+        for name, chs in c.rhodecode_repo.branches.items():
+            #chs = chs.split(':')[-1]
+            branches_group[0].append((chs, name),)
+        download_l.append(branches_group)
+
+        for name, chs in c.rhodecode_repo.tags.items():
+            #chs = chs.split(':')[-1]
+            tags_group[0].append((chs, name),)
+        download_l.append(tags_group)
+
+        return download_l
+
+
+    def __get_readme_data(self, db_repo):
+        repo_name = db_repo.repo_name
+
+        @cache_region('long_term')
+        def _get_readme_from_cache(key):
+            readme_data = None
+            readme_file = None
+            log.debug('Looking for README file')
+            try:
+                # get's the landing revision! or tip if fails
+                cs = db_repo.get_landing_changeset()
+                if isinstance(cs, EmptyChangeset):
+                    raise EmptyRepositoryError()
+                renderer = MarkupRenderer()
+                for f in README_FILES:
+                    try:
+                        readme = cs.get_node(f)
+                        if not isinstance(readme, FileNode):
+                            continue
+                        readme_file = f
+                        log.debug('Found README file `%s` rendering...' %
+                                  readme_file)
+                        readme_data = renderer.render(readme.content, f)
+                        break
+                    except NodeDoesNotExistError:
+                        continue
+            except ChangesetError:
+                log.error(traceback.format_exc())
+                pass
+            except EmptyRepositoryError:
+                pass
+            except Exception:
+                log.error(traceback.format_exc())
+
+            return readme_data, readme_file
+
+        key = repo_name + '_README'
+        inv = CacheInvalidation.invalidate(key)
+        if inv is not None:
+            region_invalidate(_get_readme_from_cache, None, key)
+            CacheInvalidation.set_valid(inv.cache_key)
+        return _get_readme_from_cache(key)
+
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
-    def __before__(self):
-        super(SummaryController, self).__before__()
-
     def index(self, repo_name):
         c.dbrepo = dbrepo = c.rhodecode_db_repo
 
         def url_generator(**kw):
             return url('shortlog_home', repo_name=repo_name, size=10, **kw)
 
         c.repo_changesets = RepoPage(c.rhodecode_repo, page=1,
                                      items_per_page=10, url=url_generator)
         page_revisions = [x.raw_id for x in list(c.repo_changesets)]
         c.statuses = c.rhodecode_db_repo.statuses(page_revisions)
 
         if self.rhodecode_user.username == 'default':
             # for default(anonymous) user we don't need to pass credentials
             username = ''
             password = ''
         else:
             username = str(self.rhodecode_user.username)
             password = '@'
 
         parsed_url = urlparse(url.current(qualified=True))
 
         default_clone_uri = '{scheme}://{user}{pass}{netloc}{path}'
 
         uri_tmpl = config.get('clone_uri', default_clone_uri)
         uri_tmpl = uri_tmpl.replace('{', '%(').replace('}', ')s')
         decoded_path = safe_unicode(urllib.unquote(parsed_url.path))
         uri_dict = {
            'user': urllib.quote(username),
            'pass': password,
            'scheme': parsed_url.scheme,
            'netloc': parsed_url.netloc,
            'path': urllib.quote(safe_str(decoded_path))
         }
 
         uri = (uri_tmpl % uri_dict)
         # generate another clone url by id
         uri_dict.update(
          {'path': decoded_path.replace(repo_name, '_%s' % c.dbrepo.repo_id)}
         )
         uri_id = uri_tmpl % uri_dict
 
         c.clone_repo_url = uri
         c.clone_repo_url_id = uri_id
         c.repo_tags = OrderedDict()
         for name, hash_ in c.rhodecode_repo.tags.items()[:10]:
             try:
                 c.repo_tags[name] = c.rhodecode_repo.get_changeset(hash_)
             except ChangesetError:
                 c.repo_tags[name] = EmptyChangeset(hash_)
 
         c.repo_branches = OrderedDict()
         for name, hash_ in c.rhodecode_repo.branches.items()[:10]:
             try:
                 c.repo_branches[name] = c.rhodecode_repo.get_changeset(hash_)
             except ChangesetError:
                 c.repo_branches[name] = EmptyChangeset(hash_)
 
         td = date.today() + timedelta(days=1)
         td_1m = td - timedelta(days=calendar.mdays[td.month])
         td_1y = td - timedelta(days=365)
 
         ts_min_m = mktime(td_1m.timetuple())
         ts_min_y = mktime(td_1y.timetuple())
         ts_max_y = mktime(td.timetuple())
 
         if dbrepo.enable_statistics:
             c.show_stats = True
             c.no_data_msg = _('No data loaded yet')
             recurse_limit = 500  # don't recurse more than 500 times when parsing
             run_task(get_commits_stats, c.dbrepo.repo_name, ts_min_y,
                      ts_max_y, recurse_limit)
         else:
             c.show_stats = False
             c.no_data_msg = _('Statistics are disabled for this repository')
         c.ts_min = ts_min_m
         c.ts_max = ts_max_y
 
         stats = self.sa.query(Statistics)\
             .filter(Statistics.repository == dbrepo)\
             .scalar()
 
         c.stats_percentage = 0
 
         if stats and stats.languages:
             c.no_data = False is dbrepo.enable_statistics
             lang_stats_d = json.loads(stats.languages)
             c.commit_data = stats.commit_activity
             c.overview_data = stats.commit_activity_combined
 
             lang_stats = ((x, {"count": y,
                                "desc": LANGUAGES_EXTENSIONS_MAP.get(x)})
                           for x, y in lang_stats_d.items())
 
             c.trending_languages = json.dumps(
                 sorted(lang_stats, reverse=True, key=lambda k: k[1])[:10]
             )
             last_rev = stats.stat_on_revision + 1
             c.repo_last_rev = c.rhodecode_repo.count()\
                 if c.rhodecode_repo.revisions else 0
             if last_rev == 0 or c.repo_last_rev == 0:
                 pass
             else:
                 c.stats_percentage = '%.2f' % ((float((last_rev)) /
                                                 c.repo_last_rev) * 100)
         else:
             c.commit_data = json.dumps({})
             c.overview_data = json.dumps([[ts_min_y, 0], [ts_max_y, 10]])
             c.trending_languages = json.dumps({})
             c.no_data = True
 
         c.enable_downloads = dbrepo.enable_downloads
         if c.enable_downloads:
             c.download_options = self._get_download_links(c.rhodecode_repo)
 
         c.readme_data, c.readme_file = \
             self.__get_readme_data(c.rhodecode_db_repo)
         return render('summary/summary.html')
 
+    @LoginRequired()
     @NotAnonymous()
+    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
+                                   'repository.admin')
     @jsonify
     def repo_size(self, repo_name):
         if request.is_xhr:
             return c.rhodecode_db_repo._repo_size()
         else:
             raise HTTPBadRequest()
-
-    def __get_readme_data(self, db_repo):
-        repo_name = db_repo.repo_name
-
-        @cache_region('long_term')
-        def _get_readme_from_cache(key):
-            readme_data = None
-            readme_file = None
-            log.debug('Looking for README file')
-            try:
-                # get's the landing revision! or tip if fails
-                cs = db_repo.get_landing_changeset()
-                if isinstance(cs, EmptyChangeset):
-                    raise EmptyRepositoryError()
-                renderer = MarkupRenderer()
-                for f in README_FILES:
-                    try:
-                        readme = cs.get_node(f)
-                        if not isinstance(readme, FileNode):
-                            continue
-                        readme_file = f
-                        log.debug('Found README file `%s` rendering...' %
-                                  readme_file)
-                        readme_data = renderer.render(readme.content, f)
-                        break
-                    except NodeDoesNotExistError:
-                        continue
-            except ChangesetError:
-                log.error(traceback.format_exc())
-                pass
-            except EmptyRepositoryError:
-                pass
-            except Exception:
-                log.error(traceback.format_exc())
-
-            return readme_data, readme_file
-
-        key = repo_name + '_README'
-        inv = CacheInvalidation.invalidate(key)
-        if inv is not None:
-            region_invalidate(_get_readme_from_cache, None, key)
-            CacheInvalidation.set_valid(inv.cache_key)
-        return _get_readme_from_cache(key)
-
-    def _get_download_links(self, repo):
-
-        download_l = []
-
-        branches_group = ([], _("Branches"))
-        tags_group = ([], _("Tags"))
-
-        for name, chs in c.rhodecode_repo.branches.items():
-            #chs = chs.split(':')[-1]
-            branches_group[0].append((chs, name),)
-        download_l.append(branches_group)
-
-        for name, chs in c.rhodecode_repo.tags.items():
-            #chs = chs.split(':')[-1]
-            tags_group[0].append((chs, name),)
-        download_l.append(tags_group)
-
-        return download_l

rhodecode/controllers/tags.py

@@ -1,53 +1,53 b''
 # -*- coding: utf-8 -*-
 """
     rhodecode.controllers.tags
     ~~~~~~~~~~~~~~~~~~~~~~~~~~
 
     Tags controller for rhodecode
 
     :created_on: Apr 21, 2010
     :author: marcink
     :copyright: (C) 2010-2012 Marcin Kuzminski <[e-mail]>
     :license: GPLv3, see COPYING for more details.
 """
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import logging
 
 from pylons import tmpl_context as c
 
 from rhodecode.lib.auth import LoginRequired, HasRepoPermissionAnyDecorator
 from rhodecode.lib.base import BaseRepoController, render
 from rhodecode.lib.compat import OrderedDict
 
 log = logging.getLogger(__name__)
 
 
 class TagsController(BaseRepoController):
 
+    def __before__(self):
+        super(TagsController, self).__before__()
+
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
-    def __before__(self):
-        super(TagsController, self).__before__()
-
     def index(self):
         c.repo_tags = OrderedDict()
 
         tags = [(name, c.rhodecode_repo.get_changeset(hash_)) for \
                  name, hash_ in c.rhodecode_repo.tags.items()]
         ordered_tags = sorted(tags, key=lambda x: x[1].date, reverse=True)
         for name, cs_tag in ordered_tags:
             c.repo_tags[name] = cs_tag
 
         return render('tags/tags.html')