[test api] rename _user_session to user_groups_session, fix its arguments and return only the session, not (user, session) to make things clearer

auto-delete relation with single cardinality using execute, not unsafe_execute, so permissions are correctly checked

fix tests

add */*.py to default MANIFEST.in to avoid pb such as #719282 in the future

fix #615379 by checking admin user exists instead of making think everything is fine

cleanup, typos

[form] fix #719285, due to multiple calls to restore_previous_post, by proper refactorings * move __init__ code from FieldsForm to Form. Must behaviour here should actually be in the Form base class * avoid buggy duplicated call to restore_previous_post * move some code that was in the form renderer to the form'__init__ method (__redirectpath & __form_id hidden input handling)) * 'formvid' should now be specified on form selection, not on form rendering

[fix] Apply fulltextindexed change in the actual index Change of the fulltextindexed attribute of a CWAttribute did actually change anything for already existing entity (but apply to new one). This patch fix this behaviour: * A new SingleLastOperation, UpdateFTIndexOp, to reindex entity whose ftindexation changed during a commit. This data is read from session.transaction_data['fti_update_etypes'] * The SourceDbRDefUpdate operation to store Etype who modify they fulltextindexed of attribute in session.transaction_data['fti_update_etypes']. * A new test is added to check the behaviour

3.6 api update (introduced by merge)

when validating a form, we should properly call 'actual_fields(form) on edited field else compound field are not correctly processed

#714109: [selectors] non_final_entity should implement score_class

merge

add XXX note

[form] cache field value in form.formvalues using (field, form) key since in some case the same field instance may be shared accross multiple forms, which may share the formvalues dict in case of sub-forms

cleanup

[form] complete 25de2eb0432b by ignore req parameters by default for all hidden fields

[form] add a new ignore_req_params attribute on field controlling value's retreival for such field, such as eid/__type in entity forms, we don't want to consider values from req.form since we may get undesired value (as reported by #714766). This new attribute allow do specify that we don't want to consider req.form in such case. Also, it seems that retreival of form values after a validation error suffer from the same problem, so don't use form_previous_values for field with ignore_req_params set to True (XXX though I suppose that may not be correct in some cases).

[css] fix disappearing image in menu when a:hover

[cwctl] modify command list to check for cube dependency problems

merge

docstring improvement

import cleanup

restore 3.5 compat for date functions moved to lgc.date in 3.6 (closes #716055)

[devtools/fill] fix date generation and its test

typo: capitalize migration confirmation messages

[views/deleteconf] remove action ppty (useless & clashes with form attr, replace buggy non_final_entity selector with implements workaround

merge

[workflow] fix potential destination for go back transition

[workflow] finish refactoring introduced by 021035b9a7ab for 'go back' transition: * fix SubWorkflowTransition.destination() prototype (must now take an entity as argument) * fix the change state for to give the entity to the transition's destination() method * we need a new method to draw workflow since we've no entity to give and 'go back' transition usually go back to multiple states

deprecate Transition.set_transition_permissions in favor of set_permissions (after all we know we're on a transition entity)

introduce 'go back' transition: transition without destination state will go to the state we were coming from

fix optimisation with super session that may lead to integrity loss at some point I've decided to stop ensuring ?1 cardinality was respected when adding a new relation using a super session, to avoid the cost of the delete query. That was yet discussable because it introduced unexpected difference between execute and unsafe_execute, which is imo not worth it. Also, now that rql() in migration script default to unsafe_execute, we definitly don't want that implicit behaviour change (which already cause bug when for instance adding another default workflow for an entity type: without that fix we end up with *two* default workflows while the schema tells we can have only one. IMO we should go to the direction that super session skip all security check, but nothing else, unless explicitly asked.

[auto/inline forms] reallow nested inline forms #703910

[reledit] fix #713217: reledit doesn't check 'update' permission on attributes

fix dumb name error

cleanup internal forms parameters in postlogin

grmmbl, bad resolve

missed conflict

backport lost stable head

fix sync_schema_props_perms test

fix create_user function introduced in d6ae30c5d055 for database initialization: messup admin user groups when anon is created due to missing restriction

3.6 api update

fix unittest_hooks: attributes have now update_permission instead of [add/delete]_permission

when modifying a persistent schema, erschema may miss some permissions which wil trigger a key error, but we don't want to crash on such cases

fix #694445: related entity generates weird RQL which in turn generates weird SQL which fails on SQL Server quick fix to reuse modification_date if already retreived by the rql query.

fix 4626:c26b4df9fc90 (#703911): use can't rely on peid since it's not an actual eid when we're creating the parent entity

[form fields] nicer behaviour of the password field: don't put internal field value on edition (triggering validation error if one validation without removing the value, due to confirmation mismatch), and don't show the field as required in such case

minor cleanup: don't use builtin 'id' as variable name

[forms/inline] fix #703911: add new link disappears if inline box removed. Since we've the information, we must specify the target type else we get random cardinality on ambiguous relations

this is not the form renderer responsability to check for update permissions. Move this to autoform editable_attributes relation

turn default logging threshold to warning (we usually want them), and log 'no schema for eid' pb using warning instead of error, so we see them in logs but not during migration

pfff, sorry to keep messing with default/stable...

specify db port on backup/restore commands (require forth comming lgc 0.48.1)

move captcha view to a place where it will be loaded by the registry...

backport stable

[security] allow to call .check on rql expression with a user eid specified

[facet] rqlst should be the select node

oops, should have been in my previous commit

fix table view facet retreival, necessary since 95ccd84c892b. Also some cleanup in facet box

Fix: RangeFacet is selected (valid rset) but without any values

fix the bad rqlst syntax tree usage during facets initialization by copying it

[R] dataimport: refine error detection Consider only None as non-expected value after parsing the input file. False is now allowed because of the boolean yesno checker that returns False by default.

added a function to create admin/anon user during db initialization process so one get a chance to monkey patch it

fix unittest_schema, remove deprecation warning

when creating an instance, ask for cubes specific options properly (fix #607349)

avoid loading twice site_cubicweb files on instance creation

oops

[schema security] fix so that when cheking attributes perms for an entity being created, 'owners' and has_*_permission in erqlexpr are considered satisfied

dont add CUBES_DIR to cubes search path if it doesn't exists

fix dumb name error triggering crash when some directory in cubes search path doesn't exist

remove 3.6 deprecation warning

login form style fixes

proper deprecation of TabedPrimaryView

missing call to toolbox in tabbed primary view

use needs_css so you can change login form css without redefining LogFormView

bw compat

backport fixes done accidentaly in default

use class, not klass, in widget.attrs

specify login form dom id, don't render progress div

backport crypto/captcha utilities from the registration cube

use an actual form for the login form ease customization from external cubes (eg rememberme)

add space between a checkbox and its label

ensure cnx is set first (necessary to introduce of a form object to handle the login form)

don't let set_schema making commit_event fail

use constant

fix permission of the condition permission

fix *_permissions schema: using the same cardinality/composite properties for cwgroup/rqlexpr leads to important pbs...

backport stable

DEFAULT_ATTRPERMS is now public

[inlined formos] don't pop attributes from kwargs, so they end-up in cw_extra_kwargs which is then passed to the edition form

[notification] we should use unsafe_execute here

cleanup

[calendar view] fix related to the date_range mess (max value exclusion). Calendar views authors should check if more similar fixes needed

[forms] fix RelationField bug with pending eids (eg inlined forms): we have to override process_form_value to avoid caching when recomputing is needed

[shell] rql() should use unsafe_execute when possible

[autoform] we should consider role when checking delete permission

don't update modification_date in repairing_mode (eg upgrade or shell)

[security] we should save back edited_attributes in case of multiple modification of an entity during the same transaction

tune startup logging

[schema] fix RelationSchema.has_perm to properly works with attribute relations

[schema] refactor/cleanup check_permissions

use a close_form method for consistency w/ open_form and allow overriding

add version info to deprecation warning

remove debug print

follow yams api change: attributes permissions are now defined for an 'update' action, no more 'add' / 'delete' which makes no sense in such case. fix afs.relations_by_section permissions checking of object relation on the way.

fix dumb name error causing error when non managers try to change his properties

fix typo in deprecation warning

remove crappy basket specific code

[views] toolbox must be rendered before the title to appear at top right

[uicfg] make deprecation message easier to understand

[uicfg] allow autoform_section's formtype parameter to be a tuple Typical usage is: afs.tag_attribute(('X', 'y'), formtype=('main', 'muledit'), section='attributes')

merge

branch oldstable

create oldstable branch, remove 3.5 tag

merge 3.6 default/stable

merge 3.5/stable heads

Added tag 3.5 for changeset a0571ff0cb5d

[http cache/json controller] ensure json_view does proper cache validation #390986

merge

typo fix in help string

use subprocess instead of os.popen to run diff this avoids argument quoting issues (spaces in path, etc)

[migration] abort becomes possible when asked for confirmation before migration script

sort on sortvalue, not dc_title to allow customization

merge

fix bug when value is None

Added tag cubicweb-debian-version-3.6.0-1 for changeset 17e88f2485d1

Added tag cubicweb-version-3.6.0 for changeset 5f957e351b0a

added jquery.ui image files

provides a fallback_on_none_attribute field attribute, allowing to specify default value for attributes of *existing* entities

fix match_transition selector: for instance w/ forge version change state form overiding, we want the form with the publication_date selected by the editcontroller, whatever the transition

split introduced in the wrong place

packaging fix: no more test in common (2).

packaging fix: no more test in common. Should remove test from the hooks subpackage in rules for hardy

drop cubicweb-client package (there was only hercule.py inside)

remove ref to hercule.py

cw 3.6, itself

i18nupdate

i18n msg fix

cleanup 2.5 __future__ imports

update translatable docstring

fix test

rephrase

fix auto-rollback on unauthorized error: * don't rollback if a commit is processing * don't free pool on rollback

fix ldap test, our ldap server name has changed

fix name error introduced by bad merging of stable

fix 'click here to see the created entity' link, which may not appear according to language settings

quick fix for typed formfield validation: accept empty string, split

[R] devtools: improve default data import mechanism Validation chain is now possible with checkers Before that the expected values needed to be coherent. Now, we can use ObjectStore to validate the input data * add new input transformers: - uppercase - lowercase * add new input checkers (raise AssertionError on error): - decimal: take care of possible comma character as number separator - integer: cast to int() - yesno: to validate boolean value - isalpha - required: input value *must* not be empty * new control checker: - optional: block possible exception we delete field in the returned dict instead of raising AssertionError (exclusive with required) Helper methods to manipulate indexes: * build_rqlindex() is used to build index based on already created entities * fetch() replace get_one()/get_many() methods by factorizing code Minor changes in reporting: * use tell() for all printing * let new value for askerrors to display automatically the report (used in crontab)

merge

backport stable branch

[cw-shell] do not set arbitrary limit on number of arguments

use 'edit' as defaut path for expect_redirect_publish

propagation hooks cleanup

missing import for 2.4 compat

don't play with the custom_workflow relation in autofill

fix bug w/ object relation used as inlined form

cleanup

backport stable

turn down some info logs into debug

turn down some info logs into debug

fix constraint hook: a session may be involved in multiple transaction at time

fix and begin to document autofill algorithm

unset_attribute_storage, for testing purpose at least

oops

backport stable

when no context specified, should return non-zero score as documented

typo

no need for a specific vid argument here

backport stable

merge

merge

add a note about modifying read only attribute cf. syt's commit message in 81021d62138f

merge

use calendar.gmtime instead of time.mktime to avoid UTC/localtime issues with Flot This is suggested by the Flot documentation on http://people.iola.dk/olau/flot/API.txt

must use in-place modification, pending_operations is a read-only property

avoid to see the same warning twice, one for 3.6 another for 3.3

backport stable

fix session's commit handling: when an operation failed in [pre]commit, call rollback_event as well for already processed operation, not only the revert<event> callback

race condition may makes this assertion fail, we don't want that

unvisible field may have been modified, for instance relation added by an hidden input

AdaptedList -> SameETypeList *NO BW COMPAT*, benefit from cw 3.6 releasing of folder,file and blog which use it to get update at the same time. CMHN and PEGASE will need update (but won't go to 3.6 without update, so seem fine).

now raise UnknownProperty, not KeyError

fix test broken by introduction of ViewSameEType action

kill register_appobject_class method, simplifying autoregistration. Update test accordingly (test which manually registers object should also properly call there __register__ method). Drop the disable-appobjects config file entry: no one used it since its introduction years ago.

backport stable branch and some vreg cleanups: * move initialization_completed from cwvreg to base VRegistry class allowing simplification of CWVregistry * cleanup initialization process: __registered__ is now called after initialization completed, by the relevant registry. * fix/remove deprecated tests

fix security issue #36564 (integrity error w/ RQLUniqueConstraint) by using a global lock serializing commit when some RQLUniqueConstraint is encountered.

errors on postcommit should never occurs, log it as critical

missing test data

reminder, cleanup

initialize property once initialization has been fully completed, close #666573

fix duplicated vregistry initialization during tests

cleanup, don't fail if no context set on the sourcecode directive

we should not use inheritance there but proper view redirection, so if one adapt listitem view, he gets the same thing by default with the adapted list

hidden usage of datetime function which has been moved to lgc

i18nupdate

replace DevCubeConfiguration/DevDepsConfiguration by a single DevConfiguration, fixing recently introduced by w/ i18ncube command on the way

moved to lgc.date as well

oops, forgot that part of 3.2 bw compat

hercule (aka c-c client command) have not (ever?) been used for years, stop supporting it

kill most pre 3.2 bw compat code

kill mx compat code (dropped since 3.2), more efficient merge_args implementation

this test is now useless here

3.6 test api update

db fill api has changed, update test accordingly

no needs for a views package, 3.6 api update

need post_build_callbacks attribute with earlier yams version

update yams/rql dependencies

fix long-waiting symetric typo: should be spelled symmetric. Add auto database migration on schema deserialization

moved generic datetime manipulation function to lgc

fix wrong autoclass inclusion

fix rest syntax error

more selectors doc in the book, mostly extracted from code

reorganize, cleanup and properly document base selectors. Kill the may_add_relation selector.

3.6 api update

clear rest_path __unique cache in clear_all_caches, fix related test

backport stable

copy back __doc__ for proper sphinx doc generation

mimick actual request set_header method

fix typo

[views/treeview] fix non-ITree nodes last element computation

[request] add a note about the encoding mgmt (or lack thereof)

[views/plot] replace bogus jsoncall computation by something (statistically) more reliable (json_request being set to True in the JSoncontroller

[doc] small fixes on security part

misc typos found on my way: NameError / SyntaxError / double __select__, <sigh ...>

fix bad rest

fix bad rest

more details on selectors debugging

add_state/add_transition are now deprecated, only add_workflow remaining

damn me, more stupid sed fix...

add note telling you don't et an UStreamIO for binary views

document the ~ operator

start documenting forms

fix stupid sed

moved content to the dbapi section

nicer docstring

live-server doesn't work, don't make think it does

more stuff in doc's README

update exemples using the 3.6 api and add/fix some sections (schema, vreg, talk about CW_MODE in concepts...). So much to do :'(

backport stable

discriminate against None, not False-ish values