Julien Cristau <julien.cristau@logilab.fr> [Wed, 05 Feb 2014 16:34:21 +0100] rev 9523
[ajax] use a custom tag to handle dynamically loaded js
Using <pre class="script"> makes it trivial for a malicious user to
inject arbitrary javascript into a html or rest text element (because it
looks innocent to the html sanitizer). Using a custom tag we can be
sure that it actually comes from our code and not from untrusted user
data. IE ignores custom tags, though, so we put it in its own namespace.
https://extranet.logilab.fr/1530578
Aurelien Campeas <aurelien.campeas@logilab.fr> [Mon, 03 Feb 2014 19:07:58 +0100] rev 9522
[dataimport] fix comment
Aurelien Campeas <aurelien.campeas@logilab.fr> [Wed, 12 Feb 2014 18:15:32 +0100] rev 9521
[hooks/security, devtools/fill] silence yams 0.38.0 warnings
Florent Cayré <florent.cayre@logilab.fr> [Mon, 03 Feb 2014 16:30:07 +0100] rev 9520
Drop 3.13 incomplete backward compat in edit controller.
It is very old and broken (there is another non-backward-copmpatible
usage of `_cw_entity_fields`), better to remove it instead of fixing.
Closes #3515223.
Julien Cristau <julien.cristau@logilab.fr> [Mon, 10 Feb 2014 16:06:16 +0100] rev 9519
[devtools] force locale to C for postgresql test clusters
Avoids initdb failure with e.g. iso8859-X locale and utf-8 encoding.
Sylvain Thénault <sylvain.thenault@logilab.fr> [Fri, 20 Dec 2013 08:39:03 +0100] rev 9518
[rql2sql] remove special behaviour of symmetric relation vs DISTINCT
0542a85fe667 replacing SQL OR by hooks for symmetric relations allows that.
This involve a single test value change for a border case: when querying a
symmetric relation without specifying the subject nor the object, you may get
some duplicated result. IMO this is fine to let the user explicitly use DISTINCT
or not and to remove the dedicated handling we had which didn't let any choice.
Related to #3259713
Dimitri Papadopoulos <dimitri.papadopoulos@cea.fr> [Tue, 11 Feb 2014 11:03:01 +0100] rev 9517
Typo in comments and error messages
Dimitri Papadopoulos <dimitri.papadopoulos@cea.fr> [Thu, 13 Feb 2014 15:11:07 +0100] rev 9516
Fix typo in a setup.py comment
Dimitri Papadopoulos <dimitri.papadopoulos@cea.fr> [Thu, 13 Feb 2014 15:09:30 +0100] rev 9515
[dataimport, migration] more fixes in the spirit of a6c32edabc8d:
[entity, metadata] huuum, use resolvable url as cwuri... And fix existing ones.
Closes #3390388
Denis Laxalde <denis.laxalde@logilab.fr> [Thu, 06 Feb 2014 15:04:57 +0100] rev 9514
[doc] Fix typo in devrepo/fti
Denis Laxalde <denis.laxalde@logilab.fr> [Tue, 04 Feb 2014 11:23:58 +0100] rev 9513
[doc/3.19] Clarify repoapi.get_repository usage
Followup for 9a62c52d167e.
Julien Cristau <julien.cristau@logilab.fr> [Wed, 29 Jan 2014 13:43:42 +0100] rev 9512
[server] use a connection instead of a session for user authentication
Julien Cristau <julien.cristau@logilab.fr> [Tue, 11 Feb 2014 17:29:58 +0100] rev 9511
Use repoapi instead of dbapi for cwctl shell, upgrade and db-init
Hopefully nobody uses dbapi-specific API in their migration scripts. I
guess we'll find out.
Julien Cristau <julien.cristau@logilab.fr> [Tue, 28 Jan 2014 16:07:06 +0100] rev 9510
[server/repo] use internal_cnx in init_sources_from_database