[dataimport, migration] silence find_entities / find_one_entity warning Deprecate associated methods to unify the API

[repo] fix extid2entity to ensure connection's has a cnxset else we'll call source.doexec, which attempt to access to cnxset.cu, and crash in some case (eg unittest_cwxmlparser in sobjects/test). Also, manually switch to 'write' mode to ensure cnxset is not released until commit/rollback when some entity is inserted.

[test] update sobjects/test/unittest_cwxmlparser to cw 3.19 api

[repo] make it clear in internal_cnx that security is disabled as explained in its docstring. It was previously relying on internal connection's fake user (InternalManager) for read security and on disabling security hooks for write security. Using the security_enabled context manager is more readable and more reliable: while the older implementation works thanks to the InternalManager associated to the session, custom hooks should rely on session.[read|write]_security being correctly set. This change also allows selecting Password attributes in internal connections without explicitly disabling read security.

[datafeed] update datafeed internals to use connection instead of session

[test] update sobjects/test/unittest_notification to cw 3.19 api

[test] simplify setup of sobjects/test/unittest_supervising.py

[test] update sobjects/test/unittest_supervising to cw 3.19 api

[test] update sobjects/test/unittest_email to cw 3.19 api

[wsgi] the spec says wsgi.url_scheme *must* be provided No need to be defensive, anything else is a bug in the gateway.

[shell] provide autocompletion for rql queries in cubicweb-ctl shell (closes #3560541) Use the ``rql.suggestions`` component to complete user's input - readline calls the ``complete`` method with user's input, - the ``complete`` method asks for each known completers if it can suggest completions for user's input.

[book] avoid '~' in all-in-one.conf, it is not expanded Closes #3753213

[book] uicfg moved from web to web.views a while ago

[wsgi] look at wsgi.url_scheme to decide if we're on https The server/gateway is supposed to fill it in for us.

[web] Fix HEAD request handling (closes #3677949) Don't special-case HEAD in CubicWebRequestBase.is_client_cache_valid so we don't return garbage. HEAD is supposed to return the actual headers that a GET would return, which we can't do if we bypass all the normal cubicweb logic. In particular, we no longer always return 200, and return the right Content-Length/Content-Type/...

[wsgi] avoid reading the entire request body in memory Import POST form handling code from https://raw.github.com/defnull/multipart/master/multipart.py to avoid reading arbitrary amounts of data from the network in memory. NOTES: - In the twisted case we limit the max request content-length to 100MB (by default), which seems kind of arbitrary, but avoids this issue - werkzeug.formparser has suitable code as well, but I don't know if we want to add it as a dependency

Added tag cubicweb-version-3.17.15, cubicweb-debian-version-3.17.15-1, cubicweb-centos-version-3.17.15-1 for changeset ee413076752b

[pkg] also bump __pkginfo__

[pkg] prepare 3.17.15

[cache] fix a cache issue with an entity created without relation cache prefill Prefilling the relation cache has its benefits sometimes, but for massive imports it may be a memory hog. The caches should be kept coherent even if there was no prefill. Closes #3828155.

[web/test] add a test for some http response codes Related to #3648809

[views] remove reference to the MAPPING_CHECKERS dict (closes #3810219) Was removed by by the changeset 65d93a4fd11c ([multi-sources-removal] Drop pyrorql and zmqrql sources)

[web/ajax] Always return a json dict with a 'reason' key in case of ajax errors Sending sometimes a bare unicode string and sometimes a json-encoded dict seems like a bad idea.

[web/ajax] don't override any status code with 500 in ajax_error_handler If the request produced an error such as Unauthorized or NotFound, core_handle sets an appropriate status_out. Which is then overridden by the ajax error handler.

[web] Add asserts to the raw header conversion functions This API is terrible, but at least this might help us catch some errors in our conversion definitions.

[view] Delete dead(?) code from ReloadableMixIn Nothing seems to ever call user_callback on the Component, only on the request. Related to #3567793

Add a db-statement-timeout option for postgresql sources Use that new option to set the statement_timeout option when creating connections, except for maintenance operations (shell and upgrade). Closes #2547026

[test] use assertNotIsInstance instead of assert_(not isinstance(...))

[services] register_user now returns the new CWUser Closes #3804444

[server/session] remove json dumps around call_service This backouts changeset b151beea9cb6. With call_service being in-process and synchronous, there's no RPC use case.