--- a/server/session.py	Wed Sep 02 10:41:05 2009 +0200
+++ b/server/session.py	Wed Sep 02 15:44:10 2009 +0200
@@ -129,8 +129,11 @@
                 if row[0] == targeteid:
                     break
             else:
-                raise Exception('cache inconsistency for %s %s %s %s' %
-                                (eid, rtype, role, targeteid))
+                # this may occurs if the cache has been filed by a hook
+                # after the database update
+                self.debug('cache inconsistency for %s %s %s %s', eid, rtype,
+                           role, targeteid)
+                return
             del rset.rows[idx]
             if isinstance(rset.description, list): # else description not set
                 del rset.description[idx]

--- a/sobjects/notification.py	Wed Sep 02 10:41:05 2009 +0200
+++ b/sobjects/notification.py	Wed Sep 02 15:44:10 2009 +0200
@@ -21,7 +21,7 @@
 from cubicweb.server.hookhelper import SendMailOp
 from cubicweb.server.hooksmanager import Hook
 
-parse_message_id = deprecated('parse_message_id is now defined in cubicweb.common.mail')
+parse_message_id = deprecated('parse_message_id is now defined in cubicweb.common.mail')(parse_message_id)
 
 
 class RecipientsFinder(Component):

--- a/utils.py	Wed Sep 02 10:41:05 2009 +0200
+++ b/utils.py	Wed Sep 02 15:44:10 2009 +0200
@@ -7,6 +7,8 @@
 """
 __docformat__ = "restructuredtext en"
 
+from logilab.mtconverter import xml_escape
+
 import locale
 from md5 import md5
 from datetime import datetime, timedelta, date
@@ -262,17 +264,18 @@
         # 2/ css files
         for cssfile, media in self.cssfiles:
             w(u'<link rel="stylesheet" type="text/css" media="%s" href="%s"/>\n' %
-              (media, cssfile))
+              (media, xml_escape(cssfile)))
         # 3/ ie css if necessary
         if self.ie_cssfiles:
             w(u'<!--[if lt IE 8]>\n')
             for cssfile, media in self.ie_cssfiles:
                 w(u'<link rel="stylesheet" type="text/css" media="%s" href="%s"/>\n' %
-                  (media, cssfile))
+                  (media, xml_escape(cssfile)))
             w(u'<![endif]--> \n')
         # 4/ js files
         for jsfile in self.jsfiles:
-            w(u'<script type="text/javascript" src="%s"></script>\n' % jsfile)
+            w(u'<script type="text/javascript" src="%s"></script>\n' %
+              xml_escape(jsfile))
         # 5/ post inlined scripts (i.e. scripts depending on other JS files)
         if self.post_inlined_scripts:
             w(u'<script type="text/javascript">\n')

--- a/web/data/cubicweb.ajax.js	Wed Sep 02 10:41:05 2009 +0200
+++ b/web/data/cubicweb.ajax.js	Wed Sep 02 15:44:10 2009 +0200
@@ -390,9 +390,10 @@
 /* convenience function that returns a DOM node based on req's result. */
 function getDomFromResponse(response) {
     if (typeof(response) == 'string') {
-	return html2dom(response);
+	var doc = html2dom(response);
+    } else {
+        var doc = response.documentElement;
     }
-    var doc = response.documentElement;
     var children = doc.childNodes;
     if (!children.length) {
 	// no child (error cases) => return the whole document

--- a/web/views/editcontroller.py	Wed Sep 02 10:41:05 2009 +0200
+++ b/web/views/editcontroller.py	Wed Sep 02 15:44:10 2009 +0200
@@ -191,7 +191,22 @@
             return
         attrtype = rschema.objects(entity.e_schema)[0].type
         # on checkbox or selection, the field may not be in params
-        if attrtype == 'Boolean':
+        # NOTE: raising ValidationError here is not a good solution because
+        #       we can't gather all errors at once. Hopefully, the new 3.6.x
+        #       form handling will fix that
+        if attrtype == 'Int':
+            try:
+                value = int(value)
+            except ValueError:
+                raise ValidationError(entity.eid,
+                                      {attr: self.req._("invalid integer value")})
+        elif attrtype == 'Float':
+            try:
+                value = float(value)
+            except ValueError:
+                raise ValidationError(entity.eid,
+                                      {attr: self.req._("invalid float value")})
+        elif attrtype == 'Boolean':
             value = bool(value)
         elif attrtype == 'Decimal':
             value = Decimal(value)

--- a/web/views/editforms.py	Wed Sep 02 10:41:05 2009 +0200
+++ b/web/views/editforms.py	Wed Sep 02 15:44:10 2009 +0200
@@ -20,7 +20,8 @@
 from cubicweb.utils import make_uid
 from cubicweb.view import EntityView
 from cubicweb.common import tags
-from cubicweb.web import INTERNAL_FIELD_VALUE, stdmsgs, eid_param, uicfg
+from cubicweb.web import INTERNAL_FIELD_VALUE, RequestError, stdmsgs, eid_param
+from cubicweb.web import uicfg
 from cubicweb.web.form import FormViewMixIn, FieldNotFound
 from cubicweb.web.formfields import guess_field
 from cubicweb.web.formwidgets import Button, SubmitButton, ResetButton
@@ -327,13 +328,13 @@
         """creation view for an entity"""
         etype = kwargs.pop('etype', self.req.form.get('etype'))
         try:
-            entity = self.vreg['etypes'].etype_class(etype)(self.req)
-        except:
-            self.w(self.req._('no such entity type %s') % etype)
-        else:
-            self.initialize_varmaker()
-            entity.eid = self.varmaker.next()
-            self.render_form(entity)
+            etype = self.vreg.case_insensitive_etypes[etype.lower()]
+        except KeyError:
+            raise RequestError(self.req._('no such entity type %s') % etype)
+        entity = self.vreg['etypes'].etype_class(etype)(self.req)
+        self.initialize_varmaker()
+        entity.eid = self.varmaker.next()
+        self.render_form(entity)
 
     def form_title(self, entity):
         """the form view title"""