[ui messages, xss] Start migration towards use of _msgid instead of __message (prone to XSS injection) closes #1698245

backport stable

[ui messages] make application message component works when request has no cnx set and support for explicit message given through render argument

backport stable

[web session] fix session handling so we get a chance to have for instance the 'forgotpwd' feature working on a site where anonymous are not allowed fix several pbs: * we need a session id and a session cookie anyway, else subsequent http queries are unrelated * this imply some changes in the session attribution workflow for session without a cnx * some views/selectors must be fixed for cases where session has no cnx On the way, avoid unnecessary Redirect on successful login. closes #750543

[ajax js/css] modconcat fix: load code exactly once (auc, fcayre) * introduces cw.ajax namespace (currently hosts only recent modconcat functionality) * handle load-one/load-many-at-once edge case * properly handle already-loaded js resource * avoid .appendTo to trigger script evaluation since from jquery 1.5 this results in uncached ajax calls

[test] update test broken by previous commit

[entity fetch_attrs] remove ambiguous relations on different etypes from fetched attrs or it may produce wrong related results; closes #1700896

typo : s/undoed/undone/

[cwvreg] inline function dump_class() Grepping the entire code base (cubicweb+all the known cubes) shows that inlining this function is harmless: no one is using it.

[js/ajax] undeprecate (async)remoteExec. closes #1381205

[rql2sql] closes #1697862: ORDERBY SUM(C) cancel GROUPBY by wrongly adding C to grouped variables

backport stable

Added tag cubicweb-debian-version-3.12.5-1 for changeset 6dfe78a0797c

Added tag cubicweb-version-3.12.5 for changeset ae33197db1f0

3.12.5

i18nupdate

[views/table (facetform)] introduced in facetbox, was missing in tableview form filter

[web.facet] self.w -> w

[web/facet|views/table] bump a bit some heights, split table view methods for easier subclassing

backport stable

cleanup and update some copyright

[migractions] fix change_attribute_type

[migractions] dropped_constraints should accept only droprequired without cstrtype

[form rendering] some refactoring to ease FormRenderer overriding

[deprecation] drop remaining warnings

backport stable

[session] new methods on session to ease access to security/hooks control context managers

[workflow] new 'fire_transition_if_possible' method on IWorkflowable to fire a transition if it's possible

[workflow] new 'incontext-state' view for IWorkflowable entities

[facets/table] vertically group facets by two when possible in order to have a more compact horizontal layout in table filter form

[workflow] add method on IWorkflowable to set initial state of an entity (closes #1686357)

[web test] fix test broken by making cw_source editable by managers

[multi-sources] support for moving an entity from an external source (closes #343818) Original need is to move a user from a ldap source to the system source so we can delete it from ldap without loosing information into the cubicweb instance. We can't wait for the user to be deleted from the ldap since it will be too late then to get back user attributes, so it has to be a manual operation to operate before actual deletion. This makes sense for other sources as well. So the idea is to make the "Any cw_source CWSource" relation editable by managers, and to watch changes of it. We then check the move is possible (ie from an external source to the system source) and do necessary stuff (essentially changing source information and copying data into the system source). Remaining pb is that we don't want the moved entity to be reimported later. To distinguish this state, the trick is to change the associated record in the 'entities' system table with eid=-eid while leaving other fields unchanged, and to add a new record with eid=eid, source='system'. External source will then have consider case where `extid2eid` return a negative eid as 'this entity was known but has been moved, ignore it'. Notice no ui is provided yet, it has currently to be done in a c-c shell.

[repository api] definitly kill usage of word 'pool' to refer to connections set used by a session Also document session's data storage and some other internals. Hopefuly things will get clearer. Closes #1684860: vocabulary confusion in repository code: notion of 'pool'

backport stable

[rql2sql] fix in 7394:d11d88bd08e8 was actually not needed

[rset] close #1683703: rset.get_entity crash on rql query with subquery and aggregat

[rql2sql] fix generated sql for eid comparison. closes #1638695

fix some deprecation warnings

[querier test] test groupby function call / column number

backport stable

[plot views] don't paginate

backport oldstable

[url rewriting] fix nasty bug in build_rset inner function: the same dictionary is used by all queries, hence triggering potentially important bugs on concurrent requests (this dictionary goes back and forth the repository)

[hooks selection optimization] prune hooks when multiple entities are concerned by a hm.call_hooks() (closes: #1672022) the idea is to make a first pass over all the hooks in the registry and to mark put some of them in a disabled list. The disabled hooks are the one which: * are disabled at the session level * have a match_rtype or an is_instance selector which does not match the rtype / etype of the relations / entities for which we are calling the hooks. This works because the repository calls the hooks grouped by rtype or by etype when using the entities or eids_to_from keyword arguments Only hooks with a simple selector or an AndSelector of simple selectors (is_instance and match_rtype) are considered for disabling.

[repo test] datafeed parser's process method should now take raise_on_error argument

[datafeed] propagate raise_on_error to parser's process method

[http] Make a better __repr__ for Status responce exception. This help debug.

[schema] fix imprecise error message

fix name error introduced in previous changeset

[server test] restore logging level after test end

[web data] fix datadir handling to avoid web test failure introduced somewhere in default branch

remove debug print

[datafeed] extract a generic DataFeedXMLParser from CWEntityXMLParser

backport stable

[entity] fix cw_instantiate w/ reverse_ relation crash when either multiple entities are given or an eid instead of an entity

[cw source ui] fix mapping checking for datafeed source (avoid false positive error, but doesn't check that much things)

[web request] don't define pageid js variable when one is found in form parameters (eg, page ajax call)

[repo cache] there are some relations we don't want to cache, they may cause memory leak

[c-c shell] we should commit the migration handler, cnx is not None unless connected through pyro

[cwpermission, cwgroup] convenience method on CWGroup to grant a local permission (ie CWPermission) on an entity

[cleanup] kill some remaining traces of goa

[c-c shell] closes #1669147: autocommit in maintenance scripts

backport stable

Added tag cubicweb-debian-version-3.12.4-1 for changeset 7c4d34a5ec57

Added tag cubicweb-version-3.12.4 for changeset 5cd0dbc26882

3.12.4

missing future import

don't let windmill/qunit test break apycot warning for all web/test

[selectors] enhance rql_condition to make it usable as a condition on request's user

[repo test] fix test broken by c2452cd57026 by using proper fake session

[testlib] fake session can be given a vreg

backport stable

fix some test failures introduced by 7350:c2452cd57026

[rql2sql] fix bug avoiding outer join relation to be used as a variable principal. Closes #1659395

resurrect code lost by too much patch manipulation

backport stable

[parsers] various refactorings - inline method process_one - rename value to others in action methods - turn _complete_url into _complete_item - turn _related_link callbacks into a boolean parameter create_when_not_found - fix spelling

backport oldstable

backport stable

fix _set_relation when no target eids, update datafeed source pull_data arguments to raise on error during tests

[session] enhance session's transaction storage handling to fix cases where commit/rollback is done while in the context of hooks_control/security_enabled managers. Closes #1412648: commit or rollback during postcreate reset hooks control state

[session] nicer local variable names

[web server] #1642893 issue a 403 instead of a 500 on Unauthorized exception To do so, we allow an arbitrary code to be passed to ``error_handler``. Default error code is still 500.

[css] repair selected slice distinctiveness (with a nice, discrete bg color)

[view] ability to define a column header through custom label_column_<colindex> method, useful for table view to customize a specific column without specifying others

[selectors] test/fix rql_condition to make it works when entity is specified via 'entity' keyword argument instead of rset, row and col

[etwist] fix bug w/ new resources concantenation and https-url enabled sites

oops

adds support for a portable db import/export format (closes: #1521112) the db-dump and db-restore cwctl commands are enhanced with a --format option (defaults to 'native'). If the format is 'portable', then the system database dump / restore is performed using pure SQL queries and the storage uses picked Python objects in a zip archive.

add a new method iter_process_result which does the same as proces_result but is a generator (closes #1625374) process_result is reimplemented using the new method, and the two helper methods are turned into generators. These generators use cursor.fetchmany instead of cursor.fetchall after setting cursor.arraysize to 100. This means that the whole result set should never loaded in memory when using the iter_process_result method. This is used in the "portable" database dump implementation when we typically to 'SELECT * FROM table', but could probably be used too in other parts of cubicweb.

[session] lock self._closed and session.close to avoid race conditions

[server test] use a lock instead of sleep to have higher green probability :/

backport stable

[testlib] create_user may now create user's email address

enhanced comment

[i18n] en translation fixes

[users management] use an existing msgid...

[cwgroup views] uicfg rules cleanup

backport stable

[testlib] grant_permission now accept either an entity or en eid

[session selector] missing not

[session] new selectors according to session type (eg user or internal

[ajax] reload method should return underlying deferred

[user mgmt] should show user login in first column in any case (e.g. application specific override)

[component|i18n] give imgs an alt attribute, refresh i18n po files

[i18n/es] repair es.po

[testlib] fix deprecation warning stack level

[nav component/cosmetics] have nice looking arrows insteads of << / >>

backport stable

Added tag cubicweb-debian-version-3.12.3-1 for changeset ba8fe4f2e408