api: make update_repo check permissions to check owner like create_repo does

Close loophole for reassigning repository owners.

Test by Thomas De Schampheleire.

api: check repo create permissions for update_repo and fork_repo as for create-repo

Close loophole for creating repos everywhere.

Tests by Thomas De Schampheleire.

auth: ignore permissions from in-active user groups (Issue #138)

Tests by Thomas De Schampheleire.

Additionally, rename the unused and seemingly search-replace-massacred
function revokehas_permrevoke_permgrant_perm_perm into revoke_perm.

tooltips: fix unsafe insertion of userdata into the DOM as html

This fixes js injection in the admin journal ... and probably also in other places.

Tooltips are used both with hardcoded strings (which is safe and simple) and
with user provided strings wrapped in html formatting (which requires careful
escaping before being put into the DOM as html). The templating will
automatically take care of one level of escaping, but here it requires two
levels to do it correctly ... and that was not always done correctly.

Instead, by default, just insert it into the DOM as text, not as html.

The few places where we know the tooltip contains safe html are handled
specially - the element is given the safe-html-title class. That is the case in
file annotation and in display of tip revision in repo lists.

auth: only API keys with 40 alpha-numeric characters are valid

This makes it easy to disable API keys in the database without violating the
uniqueness constraint, using something like:

UPDATE users SET api_key='-'||api_key;
UPDATE user_api_keys SET api_key='-'||api_key;

utils: make API key generator more random

The API key generator abused temporary filenames in what seems to be an attempt
of creating keys that unambiguously specified the user and thus were unique
across users. A final hashing did however remove that property.

More importantly, tempfile is not documented to use secure random numbers ...
and it only uses 6 characters, giving approximately 36 bits of entropy.

Instead, use the cryptographically secure os.urandom directly to generate keys
with the same length but with the full 160 bits of entropy.

Reported and fixed by Andrew Bartlett.

auth: make random password generator more random

Use the secure os.urandom instead of the pseudo-random 'random' module.

archive: fix archive failing first time on Windows - close file descriptor early

File descriptors is not used correctly - this is just a minimal stop gap.

privacy: on password reset, don't tell strangers if email is valid or not

Password reset form might be used to check if users with specific email
addresses have accounts in the system by requesting their password to be
reset. It's probably not a good idea to give this sort of information to
complete strangers.

changeset comment: fix delete button issue

issue:
when deleting comments in a list of comments on the same line,
sometimes the add new comment button stops working

root cause:
when deleting a comment in a list of comments that are all on the same line,
the wrong previous tr is chosen, the chosen tr could be an inline comments
instead of a line tr, resulting in the fact that injectinlineform function
will return immediatly

solution:
loop over the found tr until its no longer an inline comment

remark:
could probably be optimised futher to immediatly search for the line tr object

files: fix invalid links to Last Revision

The Last Revision column of the file browser linked to URLs with the
changeset as:
r14:abcdef0123
which is not a valid changeset id. Instead, use .raw_id.

repos: fix superfluous escaping of urlified URLs in repo descriptions

The h.escape usage introduced in a8f2986afc18 was too aggressive and magic.

vcs: added proper windows quoting to git commands (Issue #135)

Git repositories could not be forked on windows.

settings: show bullet indicating the currently selected sub page

With this indication, some page headings are no longer relevant.

This was apparently lost when Kallithea started.

api_keys: Update 'New api key' label target so clicking the label focuses the input element

Like d9747a04c74a but for my account.

middleware: apply HttpsFixup to Hg/Git operations too (Issue #132)

Fix regression from 6a0964373a30. 'Require SSL for vcs operations' might make
the protocol operations depend on the protocol type reported by a proxy even
though they don't generate URLs.

comments: don't eat character before @mention when rendering to rst

The character before @ should not only be ungrouped it should also not be eaten
so re.sub still works as expected.

graph: fix graph drawing if there is less than one pixel available per branch

The branch width would be rounded down and the graph would be 0 pixels wide and
thus even more unreadable than it should have been.

pullrequests: use correct References header when adding reviewers to (new?) PRs

Use the same message id when inviting to a PR as we do when commenting on a PR.

reposcan: avoid infinite recursion - don't follow symlinks when scanning

The whole reposcan mechanism is a mess and should be rewritten ...

changeset: hack to "reload" page to make #target links work first time

Like 9dfd9d242728 did for pull requests.

files: fix hiding of old content while reloading

Fixing typo from 43cafe348c9a.

diff view: improve appearance of line numbers

* display the ellipsis just once and centered
instead of showing in twice in both - and + columns
* expand column width as needed to accomodate longer numbers
(previously, the column width was fixed)
* enable box-sizing: border-box for the number links to
make it easier to set paddings

comments: remove line breaks after user mentions in comment previews

Previously, the preview might look like this:

@username

, have you seen it?

Now it should look like this:

@username, have you seen it?

rst: in @mention parser, escape spaces so they don't go to HTML

This eliminates extra spaces around @mentions. Every time mention was followed
by a comma, for example:

@username, have you seen it?

it turned into:

@username , have you seen it?

So an extra space was inserted. It was inserted because otherwise rst parser
might not recognise the markup (i.e. @user1,@user2 is replaced by
**user1**,**user2** — that would be interpreted as <b>user1**,**user2</b>).

See http://docutils.sf.net/docs/ref/rst/restructuredtext.html#character-level-inline-markup

diff view: do not hide overflow on very long lines that cannot be wrapped

When a change contains very long lines that cannot be wrapped because they
contain very long 'words' without spaces, the overflow is currently not
visible at all. This occurrence of such very long non-wrappable words is
pretty uncommon, but can for example happen in comma-separated value files.

Not touching the existing behavior of trying to wrap long lines, this patch
adds horizontal scrollbars for these exceptional cases of unavoidable
overflow.
On normal lines and long lines that can be wrapped, the diff block remains
the same as before.

templates: only bind pager event handlers once - avoid "leaks" and repeated page loads

Summary page ended up hammering the server and when pages were loaded one time
extra for each paging click.

Just moving javascript code from the data template (where it would be re-run on
each paging) and to the main page template.

pullrequest overview: fix 'my pullrequests' overview

Commit bd4f453a0055 fixed the pager links on pullrequest overviews, but
broke the 'my pull requests' page due to insufficient testing and
incomplete Python understanding.

pullrequest overview: fix missing pager links

Commit 0f9a48e0adc3 refactored the pullrequest overview pages, but has a
bug causing no more than 10 pull requests to be shown, without pager links.
The code assumed that 'pager' was a variable, rather than a method, of the
pullrequests structure.

setup: bump mercurial requirement to 2.9

Commit 1cd9bdf1362d started using iterbranches() method of branchmap

security: Fix HTML and JavaScript injection.

This fixes CVE-2015-1864