[source storage] on deletion, entity has no edited_attributes

[cleanup] rename dbms_helper to dbhelper for consistency

[entity] we also have to override dict.pop to properly maintain edited_attributes consistency

[bfss test] some minor refactoring. Test deletion + creation/update/deletion rollback

don't put hooks deleting orphan composites into the 'integrity' category, we usually want it when integrity is deactivated

[facet] allow to specify a target type on relation facets for case such as Keyword/CodeKeyword where we only targets Keyword

don't rewrite config's url during migration

le patch rql26 a été importé

backport stable

[D] book: update backup procedures in additional tips

[cleanup] remove accidentaly commited print

[test] don't try to reset session manager during test, this leads to weird failures when running multiple tests

don't update dontcheck until everything went fine: see usage in after_update_entity, where if we got an Unauthorized at hook time, we will retry and commit time.

[test] having two eid relations is now forbiden by rql

[web test] a basic test, to be completed

[test] don't clear rtags during tests, may cause breakage with manually import appobjects modules (see unittest_tracker for instance)

[web] move workflow related uicfg stuff to the workflow module

dont get eid from entity's dict

[notification] don't create 'changes' in transaction data until actually needed

backport pending_operations on hi-jacked session, see comment

[entity] fix dumb name error on .set_relations(rel=None)

[security] don't add attribute into skip_security if already in edited_attributes, else we may accidentaly skip a desired security check

[repo entity] we have to provide a __delitem__ implementation as well, see example in the docstring

[yams] on creation, specify relations anyway so we don't get spurious warning for accessing eid through the dict api on yams validation

[repo] fix warning message and implementation of bw compat unsafe_execute

stable is now 3.7

oldstable is now 3.6

backport stable

merge

Added tag cubicweb-debian-version-3.6.3-1 for changeset f9fce56d6a0c

Added tag cubicweb-version-3.6.3 for changeset 9c342fa4f1b7

Added tag cubicweb-debian-version-3.7.1-1 for changeset 9194740f070e

Added tag cubicweb-version-3.7.1 for changeset 6b0832bbd1da

backport debian control changes done in 3.7

3.6.3

ticket #636927, add ajaxhtmlhead in controller js_component

[widget] allow kwargs passed to Select widget

take care to empty breadcrumbs

fix bug with damned transmutation functionality, occuring when using an INSERT query which also add relation to the entity

update skeleton for __pkginfo__.py

don't use optional on final relation

fix security issue introduced by 4967:04543ed0bbdc: attributes explicitly set by hooks should not be checked by security hooks

[form js] apply vgodard patch fixing #750056: reorderTabindex js function crashes when form dom id is not 'entityForm'

missing unittest_main

[server] add unit tests for storages

[registry] trigger reload events on set_schema()

[source] only consider edited_attributes in source.preprocess_entity()

[source] implement storages right in the source rather than in hooks The problem is that Storage objects will most probably change entity's dictionary so that values are correctly set before the source's corresponding method (e.g. entity_added()) is called. For instance, the BFSFileStorage will change the original binary data and replace it with the destination file path in order to store the file path in the database. This change must be local to the source in order not to impact other hooks or attribute access during the transaction, the whole idea being that the same application code should work exactly the same whether or not a BFSStorage is used or not.

i18n update

3.7.1

backport stable

[etwist] cleanup, use cProfile instead of hotshot

[repo] start looping task on repo only config (though I bet more work is needed to get it actually working

[repo] call server_startup event in start_looping_task the repo is fully started (registered in pyro for instance)

[security] take care uidrels may contains a relation targetting something else than a constant node (eg IN function)

[ms] this test is already done before putting a relation in uidrels

cleanup

[security] experimental rqlst cache for read security: to activate using a 'security-rqlst-cache' flag in transaction data when you'll issue a lot of identic queries with only kwargs varying

[read security] minor optimizations

[web] get rid of spurious '[Errno 2] No such file or directory' on load This was caused by can_do_pdf_conversion() which tries to use '/usr/bin/fop'. When fop was not available, an OSError was raised by suprocess.Popen. This changeset first checks for /usr/bin/fop presence, then tries to run fop. If an error occurs, log it instead of printing it. NOTE for later: why do we test explicitly for "/usr/bin/fop" rather than simply "fop" ?

backport stable

[schema sync] fix another potential name error on synchronizing rdefs

[schema sync] don't try to synchronize infered relation defs, fixing a name error on the way

cleanup

don't update constraints when it's not necessary

[repo] don't call server_shutdown hooks when creating/repairing instance to be consistence with server_startup hooks

[migration] new build_descr argument to rqlexec on the migration helper

fix migration when upgrading from cw < 3.6 to cw 3.7

disable security when undoing

merge

[sql] fix FSPATH implementation plpy.execute() returns a list of dictionaries with column names as keys and corresponding values as values.

[web deletion] must use set_message

fix limited_rql w/ UNION query

backport stable

fix import

Fixed some of the documentation warnings when building the book with sphinx.

move pdf icon component with it's template so we don't see it when the template isn't available due to missing dependancies

backport stable

add missing warn imports

add missing warn imports

improve documentation for uicfg and rtags

backport stable

merge

[cleanup] objtype not used

[schema sync] test and fix bug when updating multiple constraint for the same rdef in the same transaction

3.6 want __regid__, not id

[migration] disable notification by default during migration

[session] fix hijack_user: most transaction_data should be copied (everything but the entity cache

Added tag cubicweb-debian-version-3.7.0-1 for changeset 0c9ff7e496ce

Added tag cubicweb-version-3.7.0 for changeset 270aba1e6fa2

fix control file by using virtual packages

fix common/rql dependencies

3.7.0

test fixes

merge

fix tests

fix test broken by recent rql rewrite / querier changes

backport stable into default

server/web api for accessing to deleted_entites

[R] dataimport: changes - deprecate checkpoint() in favour of commit() - filter on None value in mk_entity - rearrange log messages order

#750055: make it easier to change post logout url

[web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)

[web server] simplify base-url handling on startup. Ensure config['base-url'] is correctly set once started

[rql rewrite] until a better solution is found raise BadSchemaDefinition when two inlined relations with security on an optional variable is used, explaining how to bypass it

[rql rewriting] handle case where we've and optional inlined relation in the original query. Also, we should append EXISTS even in subquery to avoid inserting duplicates in results

[rql rewriting] handle case where we want to insert snippet on a variable that has previously been moved to a subquery

backport stable

[backup] fix misplaced paren

fix bad conflict resolution

backport stable

LazySuggestField : remote version of RestrictedSuggestField

typo

backport stable

Add a rssitem_id attribut to RSSView to easly choose the view used for items.

[web] start a new message system based on id of message stored in session's data instead of using __message as today, which is problematic (allow message injection). Also we can have html in messages. Removed the __createdpath hack used to escape those limitation. The old system should still work though (and will probably for a while, though we should progressivly move to the new system where it's possible). Cleanup request paramaters handling on the way.

[notification] fix dumb name error in hijack user

[dbapi] return default argument instead of None when no connection set yet

[cleanup selectors] use authenticated_user, check for form params instead of handling potential key error on missing params

[db backup] fix name error in backup_to_file: we've to pass .confirm all along the chain as for restore

[cleanup] use iteritems

[url] new rebuild_url method on base request

typo

fix apycot detection

provide logilab.database compat when creating database

update debian changelog

[db creation] fix some bugs introduced by the migration to logilab.database

[debian] packaging fixes * remove postgresql-contrib from cubicweb dependency (using tsearch which is included with postgres >= 8.3) * add postgresql-client | mysql-client to cubicweb-server dependencies, necessary for dump/restore of database

[web] yes this is used

[web] cleanup: move delete_entities to the edit controller

[web] stop using deprecated merge_dicts

[utils] improve dump_class by copying back original class doc and module name

[utils] make_uid imrovment: using .hex already remove '-', make key argument optional, document it

deprecates merge_dicts

kill unused method

merge

Added tag cubicweb-debian-version-3.6.2-1 for changeset f3b4bb9121a0

Added tag cubicweb-version-3.6.2 for changeset bfebe3d14d53

[form] fix bug introduced by 4871:a34b76593ab2 with field using multiple input with different suffix: the suffix should be considered in the cache key

i18nupdate

prepare 3.6.2

[form fields] fix severe memory leak due to @cached on field.input_name occuring on forms with persistent fields. Has been triggered in 3.6.1 on our public sites because: * the login form use persistent field since 3.6 * it's displayed on every anonymous request * another bug (fixed during the latest mini-sprint) made it also displayed for authenticated user see explanation in code for more detail. moral: be very careful with @cached...

[debug] allow to specify maxlevel to gc_info

[write security] we must check perm with read security disabled + add missing eid argument to check_perm

merge

[session] del session's thread local store on close

[debug] a new view to help debugging memory leaks

[debug] minor improvments to the registry view

[web req] check latest url in breadcrumbs is not the same as the current one to keep more valuable information

[pyviews] add thead/tbody to pyvaltable view

[repo stats] add cache size

[javascript] upgrade from version 1.0.2 to 1.1 of jquery.autocomplete.js

[web] fix #736332: iespec functionality for add_css Patch provided by vgodard.

[javascript] use jQuery.one('ajax-loaded') instead of jQuery.bind() in add_onload to avoid multiple callback executions

[widgets] fix typo

merge

req has no more a cursor attribute

when some authentication plugin fail, we may try another one

logilab.db compat

[goa] i know goa is broken but that's still that we won't have to fix later :)

[documentation] fix errors in book chapter instance-config

remove deprecation warning introduced by add_onload api change

[refactor] drop rset.vreg attribute, vreg should be accessed through rset.req. Also kill decorate_rset, simply set rset.req where we were calling this method.

missing rename

rename logilab.db into logilab.database

move devtools.dataimport at the cw level since we don't want cubes using it to depends on cubicweb-dev

[widget] allow to specify hour/minute separator on the JQueryTimePicker (vgodard patch)

backport stable

merge

fix hooks control method name + other litle cleanups

cleanup

move SLINK_DIRECTORIES creation to a function avoid unnecessary import (and kill that damed warning of psyco not being installed)

cleanup

[schema hooks] properly check for changes of schema properties avoid useless costly operation (such as full-text reindexing all entities of a type). Refactor inlined handling and fix a bug trying to reindex a final entity type on the way.

[hook] entity_oldnew_value may cause bug on attributes explicitly set to None

misc fixes to ensure logilab.db compatibility

[sql generation] fti_need_distinct quere was not anymore used, potentially causing duplicates on has_text queries with sqlite backend

[repo] enhanced security handling: deprecates unsafe_execute, in favor of explicit read/write security control using the `enabled_security` context manager. Also code executed on the repository side is now unsafe by default.

move hooks activation control on session object, so we can have a per transaction control. Added a new `hooks_control` context manager for usual modification of hooks activation.

3.7 depends on python >= 2.5

rename deprecated file

[repo] use logilab.db instead of lgc.adbh/lgc.db/lgc.sqlgen/indexer, test new date extranction functions

[javascript] fix #736185: add_onload / jQuery.bind() vs. jQuery.one() This patch introduces a new 'server-response' event and deprecates the 'ajax-loaded' event. - 'server-response' is triggered by postAjaxLoad() (instead of 'ajax-loaded'). - 'server-response' is also triggered on document.ready(). - The add_onload() method binds the javascript code the 'server-response' event whether or not it's an ajax request, thus removing the need of the jsoncall hackish parameter. The binding is done with jQuery.one() instead of jQuery.bind(). - The javascript callbacks will be passed two extra parameters : a boolean to indicate if it's an ajax request or not, the DOM node (result of the HTTP query). As javascript is what it is, callbacks can safely ignore those two parameters if they don't need them. Backward compatibility is maintained by triggerring an 'ajax-loaded' event when a 'server-response' is emitted.

backport stable

[cleanup] fti_* method already try/except exception, no need for additional catch here

[hook] use entity instead of values dict, check for edited_attributes on rtype change

[schema hook] fulltext_container is a relation *type* property. Test and fix (+ more fti properties change testing)

fix name error fixed in wrong branch

[test] don't use an internal url for test

backport stable

merge

Added tag cubicweb-debian-version-3.6.1-2 for changeset 0a16f07112b9

[pkg/debian] prepare 3.6.1-2

[pkg/debian] Remove python-elementtree from Depends elementTree is included in python2.5 and all supported distrib are 2.5 or above.

le patch massiveimport a été importé

fix bad test fix

repair stuff broken by fti handling changes

update test broken by fulltextindexed change on workflow entities

fix another name error

fix name error

backport stable

eschema_type_eid become eschema_eid and always get a schema as argument + misc cleanup

don't issue critical warning about missing text index when we're creating the instance

merge

backport stable

[cleanup] add index_entity to abstract source, add docstring

[fti] refactor and fix full text indexation handling * moved logic from repository to the native source * avoid creating a FTIndexOp when no full text indexation is needed * entities with fulltext_container set are not indexed even when not related to a container * avoid duplicated unindexation

[schema] do not fulltext index workflow entities'description

no key error subsequent to test module import error

merge

[views/breadcrumbs] fix bad signature

merge

nicer explanation

fix schema serialization bug: groupmap considered as addrdef argument

[cwctl] list will warn about a badly formatted version constraint instead of crashing

backport stable

oops, 'not' missing

[repo] fix bug introduced by 4757:ec9c20c6b9f7, testing for select.selection is not enough to avoid the substep query, we should check there is no interesting restriction (test added)

[rql2sql] fix potential crash when testing _q_invariant on a ColumnAlias instead of a Variable by always considering _q_invariant to false for them

backport stable

fix test broken by meta relation permissions tweaks

fix schema serialization, bad repartition of changes between stable and default

backport stable

remove stuff from default introduced accidentally in stable

applied vgodard patch for jquery rounded corner w/ MSIE >= 8

backport stable

[fix] #731915 use add_onload instead of plain <script> tag for progress bar. This changeset fixes : #731915: missing inprogress style on the project page Content fetched with ajax have their <script> tags removed. (see #734414) We now use the _cw.html_headers.add_onload method to execute the javascript code necessary to draw the progress bar. In the process we removed the ProgressBarWidget and merged it in ProgressTableView.

add render_description method to RSSItemView to improve modularity. The construction of the description marker of and rss entry is currently built by the main cell_call function. This make the job hard for RSSItemView subclass to change the default behaviour. The changeset fix this issue by extracting the description creation into a render_description method. Such extraction are already in place for various rss marquer.

le patch documentation-admin-tips a été importé

[F] views: fix 2 unicode errors 1. You can now use valid unicode strings in ValidationError exception. Previously, if 'err' contains unicode, UnicodeDecodeError was raised by format_errors() >>> templstr = '<li>%s</li>\n' >>> e = ValidationError(None, {None: u'oué, une exception en unicode!'}) >>> templstr % e '<li>None (None): ou\xc3\xa9, une exception en unicode!</li>\n' >>> templstr = u'<li>%s</li>\n' >>> templstr % e u'<li>None (None): ou\xe9, une exception en unicode!</li>\n' 2. The message of an Exception can contains unicode. But it now properly managed by “informal” string representation. We can easily fix the problem by using the Exception.message attribute that still contains the original message. >>> a = AssertionError(u'séfdsdf') >>> a.message u's\xe9fdsdf' >>> str(a) Traceback (most recent call last): File "<stdin>", line 1, in <module> UnicodeEncodeError: 'ascii' codec can't encode character u'\xe9' in position 1: ordinal not in range(128) >>> a = ValueError(u'fsdfsdéfsdfs') >>> str(a) Traceback (most recent call last): File "<stdin>", line 1, in <module> UnicodeEncodeError: 'ascii' codec can't encode character u'\xe9' in position 6: ordinal not in range(128) >>> a ValueError(u'fsdfsd\xe9fsdfs',) >>> unicode(a) Traceback (most recent call last): File "<stdin>", line 1, in <module> UnicodeEncodeError: 'ascii' codec can't encode character u'\xe9' in position 6: ordinal not in range(128) >>> a.message u'fsdfsd\xe9fsdfs'

le patch fix-3.6-deprecation-warning a été importé

Suppress the hidden logform when the user is already connected by adding a conditionned logform

fix a Depression Warning replace self.req._(... by self._cw._(...

fix: Prevent multi pass in restore_previous_post by adding a conditional return add the top of the methode.

merge

[test] check _shutting_down, not empty dict (empty dict test should go in pytestgc patch)

assert we are not already shutting down

[test] call super class teardown after perms restoration

[test] get a chance to get proper garbage collection when running pytest on whole cw

[testlib] properly close dumb sessions

[debug] more (dirty) gc debuging

custom rest publisher instead of using rest_publish. Avoid to keep a ref on the latest context

cleanup

[rest] cleanup, avoid deprecation warning

delete pyro proxy on connection close, properly raise programming error when working on a closed connection

cleanup

[test] get a chance to get proper garbage collection when running pytest on whole cw

more tests

[repo] improve planning of insert/update queries: do not select affected constants so the don't go and back to/from the source.

schema serialization optimization by using eids instead of type names. Heavy refactoring/cleanup on the way

backport stable

[testlib] automatic test shouldn't try to populate default_workflow

minor schema serialization optimization: * remove verbose handling, no more necessary since server.set_debug * remove old bw compat code * other cleanups

cleanups

fix code and tests broken by 4744:13a5d3a7410e (proper permission on eid/has_text/identity relations)

do not check for use template permission when session is super session or integrity hooks are deactivated

do not check for existant entity when relation of single card is added but integrity hooks are deactivated

[schema] tweaks meta-relations and schema/workflow entities attributes permissions

[schema] new constants for permissions definitions

[book/ldap] note on the role of two options

[book/cwctl] reorganize a bit this page (very messy)

[book] more id -> __regid__

[book/entities] a bit of flesh to the interface chapter

[book/admin/pyro] fix pyro options, give a small setup example

[book/faq] cleanup & complete a bit

[book/admin/setup] notes about configuration of sql server

[book] remove seemingly unused old cruft

merge

[book] cleanup (deleting/moving) old stuff

[book] a few autoclasses for renderers, misc tweaks

[primary] navcontentbottom sections should be in the content table as navcontenttop

[book/controllers] add some content (overview, api super sketch) for the cubicweb controllers

[book/ldap] add missing LDAP section

[reledit] add ajax html head div, which allows to get additional css/js up to the browser #620569

fix open/close/open subnode bug #730709

backport stable to default

Added tag cubicweb-debian-version-3.6.1-1 for changeset b9cdfe3341d1

Added tag cubicweb-version-3.6.1 for changeset 4ae30c9ca11b

typo

3.6.1 depending on yams 0.28

merge

Added tag cubicweb-debian-version-3.6.0-1 for changeset d2ba93fcb8da

Added tag cubicweb-version-3.6.0 for changeset 450804da3ab2

3.6.1

merge

tabs/lazy views: provide a link for the no js user agents (lynx, blinds, google) #693670

[test] XXX fix to have pytest succeed on whole cw

typo

fix test, broken by the merge of debug and info views

ensure we don't break xhtml

pylint suggested refactorings

pylint style fixes

don't use module doc string as usage string

kill dead/useless code as suggested by pylint

avoid module import in c-c plugins module, and remind it

proper deprecation warning when import class that should be imported from yams

fix some pylint detected errors

[test] fix test broken by arthur processinfo patch

merge debug and info views plus enhancements: * nicer presentation * proper translations * kill dead (modpython!) code * fix repository stats (active thread count / add looping tasks information)

[i18n] nothing to translate here

i18nupdate

[test] we should properly use vreg method to compute solutions

[pool] properly close existing connection before reconnection

[web] fix #724769: Use RemoteCallFailed in the publisher's error_handler On json_request, errors handled by the publisher should raise RemoteCallFailed exceptions instead of standard StatusResponse so that errbacks get called normally on the client side.

#687194: cubicweb-ctl exlog : fix help message

merge

added stats for munin collecting #615844 - from 027bbff3659f

[dbapi] no more need to monkey patch this in 3.6: vreg/schema/config are all properly accessed through ._cw

[session] fix memory leak: local thread data living in a thread that never finishes (eg, the main thread) may not be properly freed

[session] user.login is usually an unicode string, so implements __unicode__ instead of __str__

fix docstring

[facet] before 3.6 we were sure to have a cw_rset attribute. Restore this for facets

[iprogress] missing js file

[hooks] match_rtype and match_rtype_sets don't need to extend match_search_state The only method actually used by those 2 classes is __str__ that is defined on ExpectedValueSelector, not match_search_state.

[uicfg] section='inlined' is acceptable for inlined forms

[web] fix muledit rendering bug form.cw_col might be None and explicitly passing None to the selector chain may crash. Most __call__ methods of selectors are defined as in : def __call__(self, cls, req, rset, row=None, col=0, **kwargs) and then manipulate col as if it's an integer.

merge

3.6 api update

simplejson may not be available with python 2.4

ensure make_uid return something that may be used as dom id

[test] also hide this message during test

[test] fix test inter-dependancies pb. Pytest ok in each individual test dir, though not yet for whole cubicweb, but for different reasons

[testlib] provide ability to control schema/vreg reset using reset_schema/reset_vreg test class attributes

[test] skipping versions checking during test is enough, no need for monkey patch

[goa] we don't use mx anymore

[integrity] skip auto-delete for internal sessions (but *not* for super session, see 4642:921737d2e3a8)

[integrity] temporary fix auto-delete relation (see 4673:6f8b925a29f4 and 4642:921737d2e3a8): we want no read perms, though we want to check delete perms. Should be properly fixed in 3.7 once we've proper security control and [unsafe_]execute behaviour on the repository side

use set_action_permissions is clearer and avoid @cached issue across tests

[cwctl] use l.c.changelog for version comparison

[form] only set __form_id for the main form, not for sub-forms. Should fix regression introduced by 4668:9f82f81bf13d

don't issue critical message when trying to alter sqlite db during test

[test] cleanup

[test] update tests broken by changes on attributes permissions handling in yams (add/delete replaced by update

remove #<formid> from url used to redirect after a validation error

[test] no more __cubicweb_internal_field__ value displayed on password widget

[test] inline-creation requires petype argument to be selectable. Fix arguments order to make it clearer that 'template' is an argument of the test class .view method

[test] skip test when fop failed

[test] don't display progress bar when testing checkintegrity

[test api] rename _user_session to user_groups_session, fix its arguments and return only the session, not (user, session) to make things clearer

auto-delete relation with single cardinality using execute, not unsafe_execute, so permissions are correctly checked

fix tests

add */*.py to default MANIFEST.in to avoid pb such as #719282 in the future

fix #615379 by checking admin user exists instead of making think everything is fine

cleanup, typos

[form] fix #719285, due to multiple calls to restore_previous_post, by proper refactorings * move __init__ code from FieldsForm to Form. Must behaviour here should actually be in the Form base class * avoid buggy duplicated call to restore_previous_post * move some code that was in the form renderer to the form'__init__ method (__redirectpath & __form_id hidden input handling)) * 'formvid' should now be specified on form selection, not on form rendering

[fix] Apply fulltextindexed change in the actual index Change of the fulltextindexed attribute of a CWAttribute did actually change anything for already existing entity (but apply to new one). This patch fix this behaviour: * A new SingleLastOperation, UpdateFTIndexOp, to reindex entity whose ftindexation changed during a commit. This data is read from session.transaction_data['fti_update_etypes'] * The SourceDbRDefUpdate operation to store Etype who modify they fulltextindexed of attribute in session.transaction_data['fti_update_etypes']. * A new test is added to check the behaviour

3.6 api update (introduced by merge)

when validating a form, we should properly call 'actual_fields(form) on edited field else compound field are not correctly processed

#714109: [selectors] non_final_entity should implement score_class

merge

add XXX note

[form] cache field value in form.formvalues using (field, form) key since in some case the same field instance may be shared accross multiple forms, which may share the formvalues dict in case of sub-forms

cleanup

[form] complete 25de2eb0432b by ignore req parameters by default for all hidden fields

[form] add a new ignore_req_params attribute on field controlling value's retreival for such field, such as eid/__type in entity forms, we don't want to consider values from req.form since we may get undesired value (as reported by #714766). This new attribute allow do specify that we don't want to consider req.form in such case. Also, it seems that retreival of form values after a validation error suffer from the same problem, so don't use form_previous_values for field with ignore_req_params set to True (XXX though I suppose that may not be correct in some cases).

[css] fix disappearing image in menu when a:hover

[cwctl] modify command list to check for cube dependency problems

merge

docstring improvement

import cleanup

restore 3.5 compat for date functions moved to lgc.date in 3.6 (closes #716055)

[devtools/fill] fix date generation and its test

typo: capitalize migration confirmation messages

[views/deleteconf] remove action ppty (useless & clashes with form attr, replace buggy non_final_entity selector with implements workaround

merge

[workflow] fix potential destination for go back transition

[workflow] finish refactoring introduced by 021035b9a7ab for 'go back' transition: * fix SubWorkflowTransition.destination() prototype (must now take an entity as argument) * fix the change state for to give the entity to the transition's destination() method * we need a new method to draw workflow since we've no entity to give and 'go back' transition usually go back to multiple states

deprecate Transition.set_transition_permissions in favor of set_permissions (after all we know we're on a transition entity)

introduce 'go back' transition: transition without destination state will go to the state we were coming from

fix optimisation with super session that may lead to integrity loss at some point I've decided to stop ensuring ?1 cardinality was respected when adding a new relation using a super session, to avoid the cost of the delete query. That was yet discussable because it introduced unexpected difference between execute and unsafe_execute, which is imo not worth it. Also, now that rql() in migration script default to unsafe_execute, we definitly don't want that implicit behaviour change (which already cause bug when for instance adding another default workflow for an entity type: without that fix we end up with *two* default workflows while the schema tells we can have only one. IMO we should go to the direction that super session skip all security check, but nothing else, unless explicitly asked.

[auto/inline forms] reallow nested inline forms #703910

[reledit] fix #713217: reledit doesn't check 'update' permission on attributes

fix dumb name error

cleanup internal forms parameters in postlogin

grmmbl, bad resolve

missed conflict

backport lost stable head

fix sync_schema_props_perms test

fix create_user function introduced in d6ae30c5d055 for database initialization: messup admin user groups when anon is created due to missing restriction

3.6 api update

fix unittest_hooks: attributes have now update_permission instead of [add/delete]_permission

when modifying a persistent schema, erschema may miss some permissions which wil trigger a key error, but we don't want to crash on such cases

fix #694445: related entity generates weird RQL which in turn generates weird SQL which fails on SQL Server quick fix to reuse modification_date if already retreived by the rql query.

fix 4626:c26b4df9fc90 (#703911): use can't rely on peid since it's not an actual eid when we're creating the parent entity

[form fields] nicer behaviour of the password field: don't put internal field value on edition (triggering validation error if one validation without removing the value, due to confirmation mismatch), and don't show the field as required in such case