Add reference from etype table's eid column to the entities table Related to #4846892.

[server] change order of entities table modification vs entity creation/deletion In order to have a foreign key referencing the entities table, the insertion into entities must happen first, and the deletion must happen last. For the deletion case, this means we need to: 1. delete all relations (cascade) 2. delete the entities themselves 3. delete the corresponding lines from the entities table This means the _delete_info{,_multi} methods can't keep doing 1 and 3. Thankfully the "public" delete_info method appears to be unused, so drop it. Related to #4846892.

Use foreign keys for relations tables Closes #4846892

Add foreign key for inline relations Related to #4846892

Use our version of schema2sql Related to #4846892

Steal schema2sql module from yams It has no user inside yams, and we need it here if we want to be able to reference the (cubicweb-only) entities table from other tables. Related to #4846892

[dataimport] fix pylint detected error in SQLGenObjectStore

[restore/portable] properly restore the numrange generator If the dump format version is 1.1, read and restore numranges. Closes #4870338

[backup/portable] properly write the eid numrange generator (the eid is no more a sequence) Bump format version to 1.1. Related to #4870338

Added tag cubicweb-version-3.20.4, cubicweb-debian-version-3.20.4-1, cubicweb-centos-version-3.20.4-1 for changeset 49831fdc84dc

[pkg] 3.20.4

[schema] set permissions that do not allow edition on computed relation. Closes #4903918 Also, drop 'del schema' from test which clutters the code for no benefit.

[computed attribute] ensure attribute's formula apply only to the correct type. Closes #4901163

[schemaserial] fix detection of CWComputedRType table, closes #4901150

[dataimport] source.add_info doesn't take anymore a 'complete' argument Closes #4891550

[dataimport] massive renaming of session to cnx and make NoHookObjectStore working with the new connection handling. Closes #4891547

[web/data] use the right selector for hiding jquery treeview placeholders Closes #4903927

merge 3.19.9 into 3.20 branch

Added tag cubicweb-version-3.19.9, cubicweb-debian-version-3.19.9-1, cubicweb-centos-version-3.19.9-1 for changeset b7c373d74754

[pkg] 3.19.9

[hooks] don't insert use_email relation if the entity on either side is going away Closes #4912946

[undo] fix deletion of cw_source relation Closes #4912882

[hooks] don't insert an owned_by relation for deleted entities If, in the same transaction, a composed entity is created and deleted, we'll have scheduled a SyncOwnersOp which would end up creating an owned_by relation for the deleted entity. Closes #4846883

[etwist/service] adjust for a signature change Closes #4878570.

[rset] fix crash on displaying rset where some symmetric relation is used. Closes #4739253 Avoid a KeyError.

Fix handling of limit within the primary view for related elements. Closes #4723579 * respect limit set by uicfg (like the 'autolimited' view itself does) * set limit in rql query to one more than the specified one so the view knows there are more things to display

[native] Change SQL errors log level. - The SQL error itself is logged as 'info'. - The 'transaction has been rolled back' message is logged as 'debug'. These log entries should not be critical: - If an error occur at the sql level, it will be transmitted as a CW error. The exception is raised and handled in a higher level function, which will decide if it is critical or not. - Admitting that rolling-back automatically on errors is wanted in some cases, it cannot be considered 'critical'. The caller will receive the original exception anyway, it is its job to decide if it is critical or not. Closes #4801120

Added tag cubicweb-version-3.20.3, cubicweb-debian-version-3.20.3-1, cubicweb-centos-version-3.20.3-1 for changeset 7d3a583ed539

[debian] build-depend on markdown for documentation build

[devtools] Make PostgresTestDataBaseHandler multi-use friendly Dont init the pgdb twice on the same datadir - If two test case with the same apphome use a Postgres configuration, the handler is initialised twice, so it has to check if the pgdb directory has already been initialized. - Work with the realpath of the pgdb In some cases, the self.config.apphome will resolve symbolic links, but not always. It can result in an attempt to start twice the pg server for the same directory, in the same test run... resulting in failure. Closes #4875827

[devtools] restore i18n of string removed in 4001cfe2f44d Removing that string from the po files means that after running i18ncube against newer cubicweb, we lose the translation when running on older cubicweb's, which is probably not a good idea.

[pkg] fix setup.py install One day I'll get this thing right. Maybe.

[pkg] 3.20.3

[server] Increase the stacklevel (due to @_open_only decorator)

[pkg] install jquery-treeview

[migration/3.20] sync rtypes before etypes We need to make sure the rtypes are inlined before adding unique indices.

[doc] Fix class name for ComputedRelation; fix code block about computed attributes

[web] Allow propagating 'klass' parameter on tree views recursively Closes #4881302

[utils] Fix define_var in ajax context (closes #4881301) Use namespaced <cubicweb:script> instead of just <script>

[web/data] Never hide JS errors in our Deferred implementation Modern browsers have good debugging tools, let exceptions go all the way up. This only affects exceptions raised in the js code, if there's an issue on the server/python side, they'll keep going through our error callbacks. Closes #4881300

[web/data] Fix userCallbackThenUpdateUI to completely replace old DOM elements Without the 'swap' parameter, userCallbackThenUpdateUI() would replace the _children_ of the component with a new version of the componenent, thus creating nested divs/spans/buttons/etc. Closes #4881299

[web/views] Stop mishandling the fieldset name in the default form renderer While not really documented, it is generally assumed that: * the fieldset is a user-visible string (much like a title), * it will be translated by whichever piece of code uses it. So: * fix AutomaticEntityForm to generate untranslated fieldset names, * fix FormRenderer to properly translate the fieldset name before rendering it, * stop using the field set (which may contain whitespace) as a CSS class name (the feature was unusable, so just drop it), * properly handle the colon as part of the translated fieldset name Closes #4881298

Added tag cubicweb-version-3.20.2, cubicweb-debian-version-3.20.2-1, cubicweb-centos-version-3.20.2-1 for changeset 138464fc1c33

merge 3.19.8 into 3.20 branch

[pkg] fix mistake in c7b218125c25 We ended up with the wrong filenames

Added tag cubicweb-version-3.19.8, cubicweb-debian-version-3.19.8-1, cubicweb-centos-version-3.19.8-1 for changeset efc8645ece43

[server/test] convert new test to 3.19 API

[pkg] 3.19.9

merge 3.18.8 into 3.19 branch

Added tag cubicweb-version-3.18.8, cubicweb-debian-version-3.18.8-1, cubicweb-centos-version-3.18.8-1 for changeset 231094063d62

[pkg] 3.18.8

[security] Test case and fix for an INSERT security hole 7099bbd685aa introduced a untested corner case in which an Entity with no attribute specified could be created whatever the permissions. Report and test case by Christophe de Vienne, fix by Aurelien Campeas. Thanks! Closes #4854359

[pkg] 3.20.2

[debian] cubicweb 3.20 breaks cubicweb-bootstrap << 0.6.6 Closes #4842316

[pkg] don't include extra files in tarballs Blind wildcards for dirs that may contain generated or temporary files can lead to trouble and unreproducible results.

[pkg] exclude generated js_api documentation from tarballs

[doc] remove old and unused argouml files

[web/data] remove unused xcf files

[doc] remove nonexistent css from theme

[doc] Drop autoclass directive for IDownloadableLineView This class has been dropped in 3.20.

[pkg] include missing files from doc/book/ in release tarballs Closes #4832700

[datafeed] Set headers parameter to an empty dict in DataFeedParser.retrieve_url This parameter is then passed to urllib2.Request, which expects a dict and won't check for None. Closes #4842333.

[views/forms] Fix EntityFieldsForm.link_to when parent entity is being created When the parent entity is being created and the inlined form is displayed, the parent entity has no eid yet and `peid` is usually 'A'. So int() raises a ValueError. Closes #4627739.

[entities] Optimize CWUser.properties. This property gets called each time a user connects to a repository, which means a lot. This optimisation cuts its execution time by 5 according to my tests

[schema] Typo and indentation fix in RQLVocabularyConstraint doc string

Added tag cubicweb-version-3.20.1, cubicweb-debian-version-3.20.1-1, cubicweb-centos-version-3.20.1-1 for changeset 43eef610ef11

[pkg] 3.20.1

i18n update (closes #4826490)

merge 3.19.7 into 3.20

merge two default heads

Added tag cubicweb-version-3.19.7, cubicweb-debian-version-3.19.7-1, cubicweb-centos-version-3.19.7-1 for changeset ac4f5f615597

[pkg] 3.19.7

Added tag cubicweb-version-3.20.0, cubicweb-debian-version-3.20.0-1, cubicweb-centos-version-3.20.0-1 for changeset 7e6b7739afe6

[pkg] prepare 3.20 release

[skeleton] simplify debian rules file

[migration] don't crash when deleting a non-existing rtype When asked to delete a relation type, instead of checking if it was computed or not, just delete both the CWRType and CWComputedRType.

[debian] include "metapackage" in the cubicweb package's description Lets lintian know it's ok for it to be empty.

[debian] ensure all packages use ${misc:Depends} and ${python:Depends}

[debian] update cubicweb-dev's lintian override Switching from python-support to dh-python changed the installation path.

[server] add a db-namespace option in source definition (closes #1631339) "namespace" is preferred to the postgresql term "schema" to try and avoid confusion with cubicweb's schema. cubicweb now depends on logilab-database >= 1.13.0

[serverctl] add db_transaction context manager

[server] refactor cleanup() code used by "cubicweb-ctl delete" Try to make each logical step (i.e. "delete database" and "delete user") a bit more visible and explicit. This is a preparatory work to easily plug the "delete namespace" feature.

[views] visual refactorings (closes #3803685) - pageContent: - remove the shadow - add a light border - slightly round the corners - left column: - ensure width make it aligned with the logo (header) - ensure the top border of the first box is aligned with the pageContent div - do not use serif font for box headers

[web] everything old is new again Kill the "new" cubicweb.css, and move cubicweb.old.css back in its place. Closes #4763360.

[pkg] bump version to 3.20.0

[views] use icons for user menu and login (header) (closes #3803684) - use icons from the embedded pictograms font for: - authenticated user menu (userActionsBox) - login (CookieLoginComponent) - do not display "anonymous" when not logged in

[utils] provide a function to return an admin connection from an appid Closes #4723580.

[debian] Install wsgi directory in cubicweb-web package Closes #4752375.

[test] fixes to make tests pass with recent lxml lxml (on jessie at least, ie. 3.4.0) does not remove endlines anymore.

[server] Remove useless 'is None' checks 'pb' is never none since 3386fd89c914 when support for the 'APYCOT_ROOT' env var was removed.

[security] check attributes: dispatch on the "add" action if entity was just created cw_set on a just-created entity (i.e. created in the same transaction) should behave the same as setting the attribute directly on creation: check the 'add' permissions, not 'update'. Closes #4740310.

[doc] Add BigInt to the list of built-in types

[devtools] call turn_repo_off in tearDown (closes #4673491) lets it catch leaked sessions even when running a single test

[book] typos / clarifications in create-instance section Clarify that cubicweb-ctl upgrade needs to be run whenever cubicweb or a cube is upgraded. Related to #2632425.

[repository] don't mangle the stack trace on exception

[pkg] Make twisted recommended only It's not necessary when using wsgi or pyramid. Closes #4639508

[devtools] Use the pause_trace context manager instead of pause_tracing/resume_tracing The later were deprecated in logilab-common 0.63.1

[serverctl] rename remove_cube to drop_cube (closes #4545093) For the sake of consistency, since commands are currently named: - add_{cube,entity,attribute,relation} - drop_{entity,attribute,relation} - remove_cube

[wsgi] add tornado http server

[wsgi] add message about the active interface Similarly to what done in "stdlib".

[cwctl] rewrite wsgi method choices This will help devs to add new choices by adding their callback to WSGI_CHOICES. Note: ``options`` becomes a property because ``wsgichoices()`` should be evaluated at the last-minute.

[skeleton/debian] use dh_python2 instead of dh_pysupport for new cubes The former is deprecated.

[web] Add source for jquery.qtip.js Downloaded from https://github.com/Craga89/qTip1/raw/master/1.0.0-rc3/jquery.qtip-1.0.0-rc3.js Related to #3851121.

[web] Replace minified copy of jquery.flot.js 0.6 with non-minified version Related to #3851121

[web] Update jquery-treeview to the latest version Files copied from commit 61f230828ace1b54c2cc54bc549ece261b11842e of https://github.com/jzaefferer/jquery-treeview

[web/css] move jquery.treeview.css override to a separate file Patched embedded code copies are a maintenance disaster (even more so than plain embedded code copies). Let's not do that.

[web] Stop patching jquery.treeview.js This logically reverts part of e9b7cd2e9012 "allow treeview to work correctly in a tab #345293". The treeview and ajax code have suffered a number of changes since then, this change doesn't seem to be necessary anymore. It is most likely unneeded since f65208c9dbdc "[javascript] use jQuery.one('ajax-loaded') instead of jQuery.bind() in add_onload to avoid multiple callback executions".

[web] Beautify jquery.treeview.js Fully mechanical, just whitespace changes.

[entities/wfobjs] add missing `DBG_SEC` debugging informations and a new `transition` capability

[warnings] put an end to warnings in the sqlite driver over `str` being sent instead of unicode strings

[web/request] clearly mark user_callback-related methods as deprecated The deprecated decorator not only emits a warning at run-time but above all makes the deprecation immediately apparent in the source. closes #3567793.

[book] document __unique_together__, remove bad RQLUniqueConstraint example RQLUniqueConstraint should be avoided whenever possible. Related to #3753250.

[schema] stop using RQLUniqueConstraint (closes #3753250) The last uses are replaced with unique together constraints.

[dataimport] Have ucsvreader's API match that of csv.reader (closes #3705701) 'separator' and 'quote' are replaced with 'delimiter' and 'quotechar'.

[utils] Add a '_cwtracehtml' GET parameter to trace self._cw.w() calls (closes #4601327) The core of this patch is in UStringIO.write(). When tracing is enabled, write() doesn't just append the 'value' argument to the underlying list. Instead, a stack trace is recorded and a special HTML "source" is formatted. The output with tracing enabled is an HTML page, with the original HTML escaped, and made clickable to show the stack trace when the write() call was done. This allows answering the recurring question: "who wrote this tag here?!"

[datafeed] Add a raise_on_error parameter to DataFeedSource.extid2entity And pass the option from various `process_` methods in existing parsers. This makes debugging in tests easier. Closes #4601191.

[test/view forms] use the official, undeprecated API

[rset] kill the rset._rqlst cache Right now it "works" for the standard, internal uses. However when we will fold ClientConnection and Connection, it will hurt, because suddenly we get more cache hits, and the following situation would become commonplace: * there is an un-annotated _rqlst given by the querier * some view (e.g. facets) requests the .syntax_tree, which takes a copy of _rqlst * the view actually expects the rql syntax tree to be annotated, but it was not, hence we crash. Related to #3837233.

[source/native] session -> cnx Also swap process_results arguments order to make cnx come earlier.

[hookstests] change got/expected order

[config] kill a getattr

[tests/web] switch previous commit (136b5f995f8) to the new test api Related to #3670209.

[web] remove unused argument from treeview._init_headers

[doc/3.20] mention CWEP-002

[web] stop accepting the magic __message form parameter This has been deprecated for a while, and replaced by _cwmsgid, which doesn't allow arbitrary content.

[web/request] add security_enabled method Just forward to the underlying repo connection. This can be useful in the ORM when dealing with a "code-only" attribute, i.e. something that shouldn't be directly user-visible but must be accessible from a web request.

[dataimport] Fix use of _create_copyfrom_buffer() (related to #3845572) This is used indirectly by SQLGenObjectStore when running on a PostgreSQL database. Regression introduced by commit 70056633085c.

[c-c configure] make it possible to specify the section for sources configuration (closes #3477678)

[server] fix 'cnx' variable confusion in DBG_SQL exception case The rollback handling expects 'cnx' to be the cubicweb Connection, but the DBG_SQL block was replacing it with an sql connection, leading to lulz down the line. Also remove obsolete getattr (the sqlite wrapping is now done at the cnxset level, so cnx.cnxset.cnx should be the right thing already).

Provide sufficient context to check 'delete' permission in AjaxEditRelationCtxComponent Call rdef.check only when both fromeid and toeid are available. Though only call it once (for the first encountered related entity). Factorize a bit to keep handling of CSS/JS addition the same. Closes #3670209.

merge 3.19.6 into 3.20 branch

Added tag cubicweb-version-3.19.6, cubicweb-debian-version-3.19.6-1, cubicweb-centos-version-3.19.6-1 for changeset 934341b848a6

[test] missing unittest.main() call in unittest_http_headers.py

[test] make unittest_webconfig independant of CWD if apphome is unset in ApptestConfiguration constructor, this later looks for a 'data' directory in CWD, making this test runnable only from web/test (and pytest do chdir before executing tests, so we did not noticed this problem).

[webctl] do not ask questions if verbosity is at 0 Closes #4641960.

[web] Slight tweak on jQueryUI's colors on links (related to #4564046) Follow up to commit 16f550b48d57 which was somewhat brutal. This change only overrides jQueryUI's CSS rules inside tab panes and leaves actual tab buttons alone.

[view] Remove unused imports

Remove obsolete __future__ imports Generators have been available since 2.3, "with" statements since 2.6.

[devtools] Remove unused local function Unused since cw's first commit.

[uihelper] Fix a possible NameError in meta_formconfig could occur when using FormConfig with a custom uicfg object. Closes #3802298.

[devtools] Avoid db_cache collisions and mis-loading This is done by stopping to share the db_cache between TestDataBaseHandler instances It may seem overkill, but is the only way I could get it to work properly. I think the whole db caching code needs some rework to better work with different db handlers. Closes #4601328

[devtools][pg] Remove a wrong assertion in _backup_database When using pre_setup_database, a repo gets initialised before calling backup_database. Hence self._repo is NOT None it that case.

[pkg] prepare 3.19.6

[merge] backport 3.18 fixes

Accept '==' operator in cubes dependencies '==' is the operator used in the python dependencies specifications. See PEP 440 http://legacy.python.org/dev/peps/pep-0440/#version-specifiers Using the same operator in cubes dependencies allow to make setuptools handle the cubes dependencies while keeping cubicweb happy about the dependencies. Closes #4375144

[session] don't silently ignore commits commits while in the precommit or postcommit phase are silently ignored. This is OK in precommit since there'll be a commit afterwards anyway; OTOH in postcommit it may surprise the developer who didn't read the documentation for postcommit operations carefully enough. Related to #4383922.

[migration/bootstrap] add explicit index removal for sqlserver, be tolerant to migration replay Closes #4618944.

Added tag cubicweb-version-3.18.7, cubicweb-debian-version-3.18.7-1, cubicweb-centos-version-3.18.7-1 for changeset cb96f4403cf2

[pkg] prepare 3.18.7

[migration/3.18] speed up the migration and be a little bit more informative Closes #4619277.

[schemaserial] be robust against duplicated CWUniqueTogetherConstrain entities arising from bug in the pre 3.18 era Closes #4619278.

[server] Handle unique constraint violations under recent sqlite The error message changed from "columns foo, bar, baz are not unique" to "UNIQUE constraint failed: table.foo, table.bar, table.baz". Closes #3564510

[merge] backport 3.17 fixes

Added tag cubicweb-version-3.17.18, cubicweb-debian-version-3.17.18-1, cubicweb-centos-version-3.17.18-1 for changeset cda4b066933f

[pkg] prepare 3.17.18

[source/native] handle newer Integrity error messages from sqlite > 3.7 Similar to a0cf2993b6d3 that was done for 3.18.

[source/native/backup_restore] have a unique tunable blocksize for the dump phase Thus we make memory errors much less likely. Closes #4618949.

[urlpublishing] handle sub-types in RestPathEvaluator Since commit 31a1813d53f3 "[entity/url publishing] fetch_rqlst should use 'is_instance_of' instead of 'is'", the RestPathEvaluator's input rset can have more than one etype, so it can't always use sameetypelist. Related to #3825488

[views] fix ecsvexport selector introduced by e48e5a597ccc Fix the view and make web/test/test_views.py pass again.

Add custom checker for Password values We override the default converter to pass Binary values through, but don't do anything about the checker. This worked previously because yams allowed StringIO instances, although its converter didn't do the right thing for them. Fixing this in yams requires that we properly register a checker.

[component] give Links a __repr__

[debian] move markdown dependency from cubicweb-web to cubicweb-common Pointed out by David Douard.

[web/auth] stop playing games with locals() We only want to know if any retriever found something.

[entity] rather than crashing with an IndexError on entity creation, raise a meaningful exception

[web] partial backout of #8391bf718485 to restore RelatedObjectsVComponent Apparently the intended deprecation did not work, and this component is used in at least the tracker cube.

[server] typo fix

[devtools][pg] Activate the non-durability settings of Postgresql. It speed up the PG tests by a factor of 3. See http://www.postgresql.org/docs/current/static/non-durability.html.

[server] fix LoginPasswordAuthentifier.authenticate some kind of typo there.

[web] Override jQueryUI's colors on links (closes #4564046)

[hooks] Fix precommit event logging message

[service] allow repo_stats for users It's used by the siteinfo view, which is available to managers and users. This change prevents a crash in that view.

[views] Escape class attribute value in CWGroup incontext view

[devtools] use a specific test_db_id when disabling anon The anonymous user is created (or not) in postcreate, which for tests means when creating the cached empty database. The anonymous_allowed=False test classes should thus not share their template db with other test classes, otherwise either they end up with an unexpected anonymous user, or the others miss theirs and things fall apart.

Restrict yams version CW 3.19 is not compatible with yams >= 0.40

[facets] Honor 'start_unfolded' facet attribute (closes #4502799)

[facets] Correctly look for inputs of type "hidden" (closes #4502768) jQuery ':hidden' selector looks at CSS visual properties (eg, 'display', 'visibility'). The intent here was probably to look for inputs of type "hidden", which many facets use to store user selection data (eg, FacetRangeWidget). The problem is that regular text inputs (eg the "has_text" facet which has a '<input type="text"/>') will be picked up by this selector if they are inside a folded facet. Chaos and destruction ensue.

[web] Cache results from 'i18n' ajax controller (closes #4487856) This is a simple transient cache which will be forgotten as soon as the user leaves the current page.

[web] There is no global noop(), use jQuery's instead (closes #4487832)

[server] Add missing import of logilab.database Closes #4469407.

[migration] hackish black magic to bootstrap addition of formula attr during migration Turns out we can't add an attribute to CWAttribute before the attribute exists. add_attribute generates rql with a 'formula' relation, which CW doesn't know about yet, so things get unhappy. Once that is fixed, we need to make the CWAttribute addition operation deal with CWAttribute entities that don't have a formula yet. Finally, move the migration to bootstrapmigration_repository so it happens early on, and use add_entity_type rather than add_relation_type for CWComputedRType.

[server] commit after serializing schema Use separate transactions for schema serialization and postcreate scripts execution, so that the latter can rely on the schema being persistently stored. This matters e.g. if something in a postcreate violates a unique_together constraint, we need the constraint persisted in order to raise a meaningful error. See #4525069.

[book] fix docstrings to please sphinx example rst roles in docstring must be protected (in a literal).

[book] several fixes in the rst files - prevent duplicate markup definitions, - use existing Workflow markup instead of redefining one (in baseschema.rst) - include dataimport - fix non-existant directive autodocfunction - remove the empty 'embedding.rst' file

[book] activate the viewcode extension Automagically make link to class/modules/etc. it finds in the documents.

[book] new theme based on pyramid theme (closes #4291287)

Remove unused lgc.interface imports and leftovers

[repository] provide a .new_session entry point The current .connect only returns a `sessionid` which must be given to repo._get_session(...) to get the real session object. Related to #4151635.

[devtools/testlib] Use actual 'admin' user configuration values Previously ``db-user`` and ``db-password`` configuration values were used to fill ``admlogin`` and `admpassword`` attributes of CubicWebTC. The correct data for these should read from `[admin]` section. Closes #4065070.

[forms] closes #2437859 - Detect and prevent concurrent edition of the same entity. Add the timestamp of form generation to each entity's meta-information fields. On form validation, check that no concurrent change is overwritten and raises a ValidationError in case of concurrent change. A nicer handling with a message and a link to the new version of the entity would be a good thing...

[migration] make sure the repo knows about all constraint types Adding new constraint types is cumbersome. It's easy to forget to do it in a migration script. So sync the constraint types at the beginning of each migration. Closes #3724892

[migration] stop caching the mapping from constraint type name to eid It's not so frequent that a cache seems necessary, and we were not invalidating that cache when adding a new constraint type. Related to #3724892.

[web/json] an empty rset is just fine for ejsonexport The ejsonexport view can just return an empty list for an empty rset. Closes #4005518

[RichString] Add markdown support Supporting markdown requires the 'Markdown' python packages, and since it widely available on the target platforms adding it as a strong requirements will not be a big constraint. Closes #3814302

[ldapfeed] Reduce default value for user-attrs-map option (closes #3824889) This is needed because lgc.configuration.Configuration does not allow removing key/value pairs from the default (due to its use of dict.update() internally). Since CWUser.login is required, users of the add-source command will always be able to override it.

[serverctl] Ask for URL when adding a new source (closes #3824868)

[serverctl] Ask for parser type when adding a new source (closes #3484231) Remove 'quick_start' option to load all AppObjects, including feed parsers.

[doc/3.20] more details on removed code related to #3799117

remove 3.11 bw compat Closes #3799117.

remove most 3.10 bw compat Related to #3799117. The boxes and entityvcomponent objects cannot really be removed as they are still used throughout the code base (and possible cubes). This may be caused by a non-working deprecation and needs some more work.

remove leftover pre 3.9 deprecation warnings

[utils] Remove function-in-the-middle call

[web] set Vary response header to "Accept-Language" when using content negotiation This is slightly annoying because the response actually only varies based on the language we decide to send, which has much fewer possible values than Accept-Language, but that's not in the request, so we can't easily use it. Deployments using varnish or similar and controlling the set of available languages will likely want to override this to allow reasonable amounts of caching. Closes #2105812

[web/cors] don't overwrite other Vary headers Vary is a list of request headers, we shouldn't override others.

[web] add support for HttpOnly cookie flag And use it for session cookies. Closes #4142521.

merge 3.19.5 into 3.20 branch

Added tag cubicweb-version-3.19.5, cubicweb-debian-version-3.19.5-1, cubicweb-centos-version-3.19.5-1 for changeset 3ac86df519af

i18n update 4 strings have disappeared.

[pkg] 3.19.5

[server] hold connection to the db in tx_actions We can be called without a cnxset (e.g. from repoapi).

[wsgi] If multipart cannot parse the POST content, let it pass. multipart can only parse html form data. It the content_type is, for example, "application/json", get_posted_data should not fail but just stop trying to read the content. Closes #4421845

[devtools] Fix JS tests' HTML code

[devtools] "Keep" some temporary files/dirs around to help with debugging The whole QUnitTestCase runs with an @with_tempdir so it's redundant anyway.

[devtools] Fix Firefox launcher in QUnitTestCase (closes #4294727) The main changes are: - stop creating the profile, firefox will create it - point firefox to a profile directory instead of giving it a profile name (this has the added bonus of not polluting the user's profile list) - start firefox once and kill it 5 seconds later to let it finish its profile creation (along with system-wide extensions setup)

[devtools] allow cross-origin requests for qunit We have a mix of file:// html and http:// ajax calls. Which we should at some point fix to all be http, but. Related to #4294727.

merge 3.19.4 in 3.20 branch

[cors] Fix CORS headers generators The Access-Control-Allow-* and Access-Control-Expose-Headers are response headers, not request headers. Hence, we need generators for them. Closes #4412575.

[wsgi] Fix posted files filename reading The filenames are parsed by multipart.parse_form_data, which does the unicode decoding. Trying to re-decode the filename was leading to an error.

[pkg] Depend on Pillow instead of PIL The Pillow library is becoming the de-facto replacement for PIL. It also is way simpler to install with pip than PIL. Closes #4411354.

Added tag cubicweb-version-3.19.4, cubicweb-debian-version-3.19.4-1, cubicweb-centos-version-3.19.4-1 for changeset c4e740e50fc7

[pkg] 3.19.4

merge 3.18.6 into 3.19

Added tag cubicweb-version-3.18.6, cubicweb-debian-version-3.18.6-1, cubicweb-centos-version-3.18.6-1 for changeset d91501356742

[pkg] 3.18.6

[hooks/security] allow edition of attributes with permissive permissions If an attribute has more permissive security rules than the entity type itself, we should be green and not deny action because of an early global entity permission check (with the more restrictive rules). Only if one attribute with the entity-level permission rules is edited will the global check be performed. Note: * the "if action == 'delete'" check at the entry of check_entity_attributes is a guard for a condition currently not happening in cubicweb itself (but application hooks could conceivably call this function with a 'delete' action) Closes #3489895.