[security] use a stronger encryption algorythm for password, keeping bw compat Administrator should ask their users to reenter new password so they benefit from the new encryption. Also, new encryption is cross-platform compatible, eg you may now move an instance from windows to linux painlessly

[cache] factorize _validate_cache() logic implemented in wsgi and twisted handlers

[fake-request] support `http_method()`

[Web-Request] Use rich header (closes #2204164) Unify header management. All web request use the Headers class now (imported from twisted). Code dedicated to header management have been merged into the base WebRequest class.

http-header: support __contains__ in Headers You can now use:: >>> 'expires" in headers True

[web] Move request handling logic into cubicweb application. (closes #2200684) We improve http status handling in the process: ``application.publish`` have been renamed to ``application.handle`` to better reflect it's roles. The request object gain a status_out attribute to convey the HTTP status of the response. WSGI and etwist code have been updated. Exception gain status attribute

[login] split authentication logic from post authentication logic (closes #2200755) * The Session manager is now only in charge of providing a valid session. * LoginControllers are now used in all case but wrong credential. * The LoginControllers are in charge of redirecting the user to the page wanted to see in the first place, expected to see. * The login form is now always submitted to the login controller with an extra argument pointing to the url we should redirect too after successful authentication. The ``"log out first logic"`` logic on login controller is removed because: 1. Other web actor do not do that. 2. Removed code do not need to be reimplemented. 3. We can only get it to work again in a single case: use do a GET request on http://www.my-cw-stuff.io/login 4. I do not see it's purpose.

[LoginForm] refactor to ease other implementation An Abstract BaseLoginForm is created. It is intended to be used by cubes who want to implement new login form. It gather common login form elements in particular the form action. This will ease redefinition of this form action in later commit.

[request] gather all base_url logic in a single place (closes #2200756) * Handle ``https base-url`` in the core code: ``./req.py`` and ``web/request.py`` * Remove custom ``base_url`` handling if web request

[http] drop use-request-subdomain feature (closes #2251986) This feature do not have any user nowaday and lays in the path to WSGI.

backport stable

[config, undo] Fix undo-support option migration

Added tag cubicweb-debian-version-3.14.6-1 for changeset 75364c099490

Added tag cubicweb-version-3.14.6 for changeset db021578232b

3.14.6

[debian] add a watch file Allows tools like uscan to find the tarball for new debian revisions.

[uilib] don't print timedeltas between 0 and 23h as negative (closes #2236352)

[storage/bfss] ensure bfss never remove a cw_edited item (closes #2236287) When the <old value> == <new value> (not really and update but can happen), the value was popped but never restored. The cw_edited attribut had wrong content for a small time lapse.

[datafeed xml parser] fix typo

[twisted] move out url logic from twisted (closes #2200593) Data, fck and static file are now served by cubicweb controller by default. Some hackish url rewriting is necessary to have them selected. This is necessary because cubicweb does not selection controller on multi level path. - 'Expires' header seems to conflict with Cache-Control set by HTTPCacheManger (don't know yet why HTTPCacheManager is involved here) mod_wsgi is now usable in simple cases (e.g. still requires persisten sessions).

[cwconfig] improve assert error message. Single tuple element are processed in a non trivial way.

rqlrewrite: remove element in rewritten when we remove them from the select (closes #2236985) update _cleanup_inserted to avoid leaving rewritten variable behind when removing a snipset. insert_varmap_snippets was impacted too for unclear reason --- Before A KeyError was raised when: * multiple snipset is to be inserted on a statement * some *supported* snipset adds ambiguity (increase the number of solution) * some *unsupported* snipset adds new variable * The new variable require rewritting :: File "/home/pyves/src/fcw/cubicweb/rqlrewrite.py", line 185, in rewrite newsolutions = self.remove_ambiguities(snippets, newsolutions) File "/home/pyves/src/fcw/cubicweb/rqlrewrite.py", line 436, in remove_ambiguities variantes = self.build_variantes(newsolutions) File "/home/pyves/src/fcw/cubicweb/devtools/repotest.py", line 340, in _build_variantes variantes = _orig_build_variantes(self, newsolutions) File "/home/pyves/src/fcw/cubicweb/rqlrewrite.py", line 470, in build_variantes variante.append( (key, sol[newvar]) ) KeyError: u'D' This happen because the mechanism removing unsupported snipset does not remove entry in ``self.rewritten`` when it removes entry from ``self.select.defined_vars``. Iteration on ``self.rewritten`` then crash because values of ``rewritten`` are expected to be found in solution.

[js] fix $.fullCalendar.regional call (closes #2232028)

Added tag cubicweb-debian-version-3.14.5-1 for changeset 55fc796ed5d5

Added tag cubicweb-version-3.14.5 for changeset f559ab9602e7

[undo, test] fix undohistory selector et related tests

prepare version 3.14.5

fix events display in calendar (closes #2167866)

[repo test] fix test regression introduced by 8286:8b0146e31baa

[css] in old css, more space around the text, and try to make it centered

[js] translate calendar in french (closes #2167866)

[entity url] rest path fallback should be the url used as cwuri. Closes #2186039

[migration] fix add_relation_type in case it already exists, broken by 67660d5f1916

backport 3.14.4-2

Added tag cubicweb-debian-version-3.14.4-2 for changeset 4c8cb2e9d0ee

[debian] prepare 3.14.4-2

[debian] add missing build-deps to generate the documentation (closes #2223062)

[repo services] set cnxset before calling the service then ensure it's freed

[migration] fix migration jumping from pre 3.12 to post 3.13

[migration] add schema obj into assertion failure message so we get a chance to understand the pb

{repository] add documentation explaining ``fix_user_classes`` hook

[devtools/fake] add some https related properties to FakeRequest

[typo] "lod" --> "load"

[dbapi] some documentation

[undo view] fix wrong set operator

[web application] move default path logic inside url publisher Previously, this logic was handle by: * etwist server * wsgi handler * web application

[req, doc] add some documentation of CubicWebRequestBase attributes

[test] more standalone test add a __main__ section to `etwist/test/unittest_server.py`

[web templates] fix invalid html in main-no-top template; closes #2174806

[repository] implement a generic way to call repo-side services; closes #2203418

[web] Exposes the undo feature to user through a undo-history view (closes #893940)

[undo, transactions] Adds a property in the transaction API. (closes #2202953) Required by forthcoming changes in undo_web.diff

[repo, undo] Finish repository-side implementation of the undo feature (closes #893940) 1) Changes API for undo_transaction in order to raise an exception: the previous API returned a sequence of error, the user of the API needed to be careful to check explicitly. We change this for it to raise an UndoException with the list of errors as an attribute. 2) The server-side support for undoing update actions is finished 3) The configuration for `undo-support` is now a simple boolean Beware of the costs, both in DB space and in number of requests on the RDBMS backend, once this feture is activated. 4) Adds a txuuid param/attribute to the existing NoSuchTransaction exception.

[rql rewrite] when a subquery has to be introduced, properly return the snippet expression so that further expressions are properly ored. Closes #2207180

[migration/3.14.4] use the right API else we break sqlserver instances (closes #2211248)

backport stable

[devtools] make a copy of the xvfb-run script so we can kill it properly Since changeset a3d3bdd46463 we don't run firefox directly but through a wrapper script. This meant that on stopping the test, we would kill that wrapper script but leave the Xvfb server and firefox processes running. So make a local copy of xvfb-run, and make it kill Xvfb when it goes down, not just when its client exits.

[ajax] use AJAX_BASE_URL instead of JSON_BASE_URL JSON_BASE_URL / 'json' should be replaced by AJAX_BASE_URL / 'ajax'

[web/config] refactor initialization of the data url Common logic have been moved in a dedicated `data_relpath` function.

backport stable

[test] create temporary directory with meaningfull prefix It will help cleanup temporary directory when cubicweb test failed to cleanup themself.

[schema] make cubicweb 3.14 compatible with yams 0.35

[test] fix ReST extensions tests

[web/controller] fix some cases where _cwmsgid may appears twice the Way the URL was build led to double _cwmsgid parameter in the URL query, which led in turn to a crash. We use _cw.rebuild_url to update new params instead of append_url_params which merely does a textual concatenation.

[reledit, autoform] move reledit_form definition in reledit.py No deprecation handling needed, reledit_form is new in CW 3.15

[hg] ignore ldap database

[ldap migration] use unicode strings

[ldapfeed] fix synchronisation crash: ldap attributes are given while we want cw attributes and name errors in method checking if a dn still exists in ldap

backport stable

Fix bug about missing Interval field (closes #1463996). Implement Field and Widget dedicated to the yams entity 'Interval': - TimeIntervalField - IntervalTimeWidget Allow to set an integer with a character as a period of time '20s', '48h' or '3d' for instance (turn into seconds).

[cubicweb-ctl] i18ncube return 2 (failed command) on failure (closes #2192336) i18ncube command previously returned 0 even on failure. Bisect i18n breakage was hard.

[book] document the WEEKDAY rql function Added in 3.14.

[rql2sql] correctly handle modulo operator (closes #2192457) rql has % as a modulo operator. The string we output gets passed to a substitution function so the % needs to be escaped.

[web-repo] use transaction data, not session data to inform ui about sources error. Closes #2192577

Added tag cubicweb-debian-version-3.14.4-1 for changeset bc40991b7f13

Added tag cubicweb-version-3.14.4 for changeset 508645a54287

prepare version 3.14.4

[vreg] restore bw compat, eg container expect to find Selector in appobject module

backport stable

[spelling] fix dictionnary -> dictionary typo

[tabs] use eid parameter instead of rql when an eid is given. Closes #2186288

backport stable

[system source] fix authentication: don't allow login whatever the given password if user password is NULL in database. Closes #2186099

[binary] use seek(0) in `from_file` Binary creation method (closes #2189183)

[c-c] use subprocess instead of os.system to start repository

backport oldstable

[bfss, migration] fix storage migration (closes #2189206) The storage migration intend to clean the attributes cache but in practice it was trying to discard attribut edition. As no attribut were edited this lead to a crash.

[datafeed] fix dumb name error introduced by recent deletion handling refactoring

[ldapfeed] make authentication actually working

[sources] include source's class in its repr

[email notifications] send notification at post-commit time (closes #2119248)

[devtools] Use Xvfb to run firefox in js tests on posix platforms This way we don't require running tests under X.

[i18n] fix pb with non-ascii chars in cwd. closes #2149063

[repository] add a ``gc_stats`` method and 2 more cache size for ``stats`` (closes #2179735) This method returns memory informations in a dictionnary (same informations as the content displayed by the GCView).

[test] fix test broken by RichString handling changes in yams #default

[test] fix test broken by EmailAddress read permissions change

[test] fix test broken by renaming of module containing the cwxml parser and handling of vid in urls

[test] fix test broken by selectors/predicates changes coming with the move of registry to lgc

[repo test] fix test broken by recent changes on EmailAddress read permissions

backport stable

[server test] fix test broken by recent changes in lgdb

backport stable

[schema sync hooks] fix format string

[event bus] event has been renamed to publish

[schema view] properly display inheritance (closes #870073).

[workflow view] Display a non-localized version of state/transition names (closes #1912537).

[repo] Add a publish/subscribe mechanism for inter-instance communication using zmq Each repo can have a publishing and any number of subscribing sockets whose addresses are specified in the instance's configuration. An application or cube can subscribe to some 'topics', and give a callback that gets called when a message matching that topic is received. As a proof of concept, this introduces a hook to clean up the caches associated with the repository when an entity is deleted. A subscription is added using Repository::zmq::add_subscription; the callback receives a list representing the received multi-part message as argument (the first element of the message is its topic).

[migration] fire hooks in postcreate by default (closes #1417110) also turn usage of hooks_control to relevent session's method

[migration] `add_relation_type` warns and add missing definitions on already existing rtypes (closes #2121979)

[i18n] fix translations of login actions in french (closes #1546397)

([config] add file encoding information to python files (closes #1942655)

[primary view] delete PrimaryView.skip_none attribute (closes #2093250) it was already broken anyway, since introduction of reledit (a while ago)

[entities system table] change asource and source column size (closes #1951819)

[view] fix error messages of NotImplementedError

kill dead code in Workflow view This looks like it's been missed in r5224:34e669b6fd95.

[bw compat] add compatibility for import of former VRegistry

[views/attribute] role parameter must default to "subject" (closes #2175427)

[windows service] Copied the 3 lines from etwist/twctl into etwist/service in order to also clean the cache in Windows service mode. Could be factorised with etwist/server.run

[entity] fix crash when using cw_instantiate with empty related entity list; closes #2094462

[pylint] correctly detect uiprops module when it's not in a package

backport https-deny-anonymous option type fix done in default

Added tag cubicweb-debian-version-3.14.3-1 for changeset 4d0f5d18e8a0

Added tag cubicweb-version-3.14.3 for changeset 60efdbb45520

3.14.3

[web/formwidgets] make default_size a tunable, fix code layout (closes #2165936)

[hooks/syncschema] do not crash if the schema did not learn (yet) some new META rtype (closes #2171313)

[js] better support for no js in tabs (closes #2162092)

[vreg] move base registry implementation to logilab.common. Closes #1916014 A new logilab.common.registry module has been created with content from * cw.vreg (the whole things that was in there) * cw.appobject (base selectors and all). In the process, we've done some renaming: * former selector functions are now known as "predicate", though you still use predicates to build an object'selector * hence `objectify_selector` decorator is now `objectify_predicate` * the top level registry is now `RegistryStore` (was `VRegistry`) Also there is no more need for the @lltrace decorator. On the CubicWeb side, the `selectors` module has been renamed to `predicates`. There should be full backward compat with proper deprecation warnings.

[datafeed] when checking for deletion using cwentity xml parser, use vid=xml to limit resources consumption

[repository] ldap-feed source. Closes #2086984 datafeed based source which copy a subtree of the ldap directory into the system database. Authentication still go through ldap though. Pros: * don't need temporary tables and such for multi-sources RQL queries execution * much more flexible to enhance / configure behaviour (you simply have to replace the parser) * run better when ldap isn't reachable Cons: * no more 'on the fly' discovery of users (though a user authenticating itself will be automatically added if it doesn't exist in the db yet) * synchronization may be heavy if there are a lot of users A new cw.server.ldaputils containing code in common between former ldapuser and new ldapfeed sources has been introduced. Also ldapuser source now uses url instead of custom host/protocol option so it looks like a datafeed source (could be improved).

[datafeed] set delete-entities=yes is now safer, by checking each entity actually seems deleted. Closes #2165381 Parsers now have to implement the `is_deleted(extid, etype, eid)` method that should return a boolean telling if the given entity exists in the external source or not.

[config, migration] fix https-deny-anonymous option type

[js, i18n] translated strings should use " not ' else they are discarded by xgettext. Closes #1892489

[book] Fix typos in rql datetime functions documentation

[search box] allow to specify domid in select arguments. Closes #2162166 needed when one want to display search box twice in a page (eg logilabfr)

[config] fix rql-cache-size initial values (closes #2162160)

[migractions] fix comment to avoid ambiguity. Closes #2015260

[storage] BFSS now create read only file (closes #2151672) In the process binary.to_file now takes a file instead of a file-path. As storage was currently the only user it should not impact anyone.

backport stable

[schema synchronization] don't use sql for TODAY/NOW in keyword arg. Closes #2154815 Also consider TZDatetime on the way

backport oldstable

[req cookie] fix remove_cookie expires which was leading to expires computed to 0 in set_cookie and the Cookie class interpret that has no expires. Closes #2154654

[testlib, postgres] take care, _repo is None when backuping postgres test db, crashing database generation

[base views] make it easier to override EntityStartupView behaviour when the rset is empty; closes #2126364

[excanvas js] missing comma

backport stable

[datafeed] Don't pretend all columns are sortable in datafeed sources import log view. Closes #2146387

[facets] Make hiding facet body optional (closes #2105862)

[manage/index view] fix sources management view appearing in index view although it should not; closes #2126335

[book] add doc about request, session and connection management you need to know when writing tests

[test] test/demonstrate relation permissions overriding

[datafeed] Don't pretend all columns are sortable in datafeed sources import log view. Closes #2146387

[facets] Make hiding facet body optional (closes #2105862)

gmap: fix regression from 151058945234 Send zoomlevel as an int, and move closing brace to the right place.

gmap: fix regression from 151058945234 Send zoomlevel as an int, and move closing brace to the right place.

[deprecation] add cw version number to deprecation warning

[test] fix test broken by 8158:2ee254e74382 and add a test for that change

[doc] Add a small docstring to RQLExpression constructor

backport stable

[schema] restrictive email address read permission. Closes #2148141 You may have to update your application schema if you were based on previous settings!

[tableview] drop useless code: cellvid systematically given by RsetTableView, according to its .[non]finalview attribute

[tableviews] use ``select_or_none`` instead of ``try: select() except:`` select_or_none is here to avoid multiplying try: except: context in the code.

[bw compat] json_request setter is necessary for some cubes which has json_request (eg preview)

gmap: set center and zoomlevel automatically (closes #2144255) Instead of hardcoding the default zoomlevel and setting the center to the average of all markers, let gmap compute them so all markers fit in the map.

[views] calendar id in CalendarView must be unique (closes #2143864)

[debian] cubicweb works with python 2.7 (which become the standard on some distros). Closes #2142050

[multi-sources] call doexec rather than sqlexec since we do not want to call process_result (as there aren't any and this breaks with lgdb default)

[sources] hide some attributes from source edition form. Closes #2144160

[https] Allow configuration of anonymous access on https (closes #1971992) For now any anonymous access in denied on secured connection (https-url). This patch introduce a configuration option to control this behaviour. New instance will allow it. Old instance should stay as is during migration.

[bfss] convert root BFSS directory to str in constructor (closes #2137793) otherwise you can get crashed with AssertionError: Binary objects must use raw strings, not <type 'unicode'>

[rql, security] fix buggy rqlstr cleanup when some introduced snippet create an unresolvable query. Closes #2142041

[ldap test] test actual ldap authentication instead of monkey-patching also drop usage of not-anymore-necessary constants.

[book] Add some details about usage of EXISTS

backport stable

Added tag cubicweb-debian-version-3.14.2-1 for changeset 17ebd836cee3

Added tag cubicweb-version-3.14.2 for changeset 049a3819f03d

3.14.2

[i18n] fix french for 'action menu'

[server] use lgd.process_cursor to optimize processing of large resultsets update lgdb dependency to ensure we've a fix necessary for proper behaviour of the previous changeset

[css] fix typo in uiprops/css

backport stable

[sources management] fix crash mapping tab because chain() is not indexable. Closes #2124077

[css] use listingHeaderBgColor in old css this also fix inconsistency between background image / bg color

add instance to not implemented error

[repo cache] fix cache clearing for an eid: keys are now always a tuple

missing import statement

fix potential problems when BFSS uses a Windows SMB share (closes #2131435) files on windows network share must be read / written by chunks of reasonable size or you get some unusual os level errors.

[views] (in/outof)context views now use directly dc_(long)_title() (closes #2110235)

[table] use cell text content when cubicweb:sortvalue is not defined (closes #2093183)

[controllers] deprecate JSonController and implement AjaxController / ajax-func registry (closes #2110265)

[rql2sql] None for attributes in kwargs generate IS NULL, so should be considered in sql cache key. Closes #2116693

[tableview] cubicweb:sortvalue should not have 'json:' in its value anymore. This breaks old tables.

[schema] React to yams improvement of metadata attribute handling. * Change the way RichString is deprecated. * Add documentation about metadata attribute

stable is 3.14.X

oldstable is 3.13.X

Added tag cubicweb-debian-version-3.14.1-1 for changeset 6928210da4fc

Added tag cubicweb-version-3.14.1 for changeset 793d2d327b3e

3.14.1

backport stable

Added tag cubicweb-debian-version-3.13.10-1 for changeset 2eab9a5a6bf8

Added tag cubicweb-version-3.13.10 for changeset 2ad4e5173c73

[ajax] make navigation component appear both above and below the view (closes #2110266)

3.13.10

Link to python docs about strftime instead of pointing at "man" (closes #2106415) Not ideal, but better than pointing all users at Unix command-line tools.

[test] reindent

[rqlrewrite] fix comment

[server test] Fix tests regression from changeset 7980b36fb1aa

Tweak message to clarify it gets the pagination back http://www.cubicweb.org/task/2106487

fix tests broken by lgdb update

[migration] Ignore IOError from readline.write_history_file (closes #2106621) We already ignore them when reading the histfile, no reason writing it back should be any different.

[migration] make remove_cube('foo') not fail if foo is already removed. Closes #2106532

[cwconfig] absolute import (closes #2091068)

[schema sync] Update repo._type_source_cache when renaming an entity (closes #2094470) When an entity type is renamed as part of a migration, it leaves stale entries in repo._type_source_cache, which makes subsequent operations on those entities fail (they look for the old entity name instead of the new one).

[facets] forcing a fixed height to the group is a bad idea: the container will not properly overflow

[views/tabs] tests absolutely want an alt attribute (even if meaningless)

[navigation] provide a link back from the full view to the paginated one provide a better marker for navigation induced call detection Closes #2103687

[sorted navigation] refactor code so that when an attribute is found, nb_chars may be recomputed anyway according to variable type

[reledit] implements entity_call instead of cell_call

[merge] backport stable

[skel] default debian/rules use pysupport to compile python files Drop the unused python-dev build-dependency (only necessary for binary extensions)

use dbhelper functions to get default date / datetime (closes #2094544)

actually a bad idea, sorry

[web/views/tabs] improve non graphical experince with tabs (closes #2097405)

[tableview] fix action menu layout (closes #2099011) * on the left instead of the right of the table * remove the arrow and the bullets

[facets] do no stretch to the right when there are many facets; instead use a floating layout (closes #2093160)

[views/table] fix typo

fix typo

added log when operation precommit fails

[EntityTableView] smarter header for MainEntityColRenderer: use plural form only when necessary. Closes #2093182

[tableview] enhance RelationColRenderer. Closes #2093184 * subvid should only be explicitly specified, or default when main view (vid) is known to support it (eg 'list' / 'csv') * new is_rtype_view boolean flag to ease usage of view based on original entity with a relation name and role, as the 'reledit' view for instance

backport stable

[reledit] default label should be translated, I don't thing we've an opportunity to do it another way as uicfg objects are static

[rset] fix crash while building entity from rset w/ some subquery. Closes #2089055

[email bug report] _cw.config bw compat has been dropped, use _cw.vreg.config (+ small cleanup). Closes #2086985

[users management view] return None if no entity related, not an empty tuple. Closes #2089085

merge stable changes to default

[http, windows] fix remove_cookie trying to expire a cookie before the Epoch (closes: #2087998) time.gmtime on windows will raise a ValueError if a negative argument is supplied

[etype restriction component] rql 0.31 doesn't accept anymore a variable ref as add_type_restriction argument. Closes #2086983

[3.14 migration] strip constraint value to avoid extra new lines

merge