controllers: simplify request.GET.get for safe_int

Don't specify the default value twice - the one for safe_int is enough.

diff: make sure context parameter is an integer

Prevent Abort in mdiff on malformed URLs.

auth: properly invoke PermFunctions (CVE-2016-3114)

This fixes a vulnerability that allowed logged-in users to edit or
delete open pull requests associated with any repository to which
they had read access, plus a related vulnerability allowing logged-in
users to delete any comment from any repository, provided they could
determine the comment ID and had read access to just one repository.

pullrequests: optimize iteration over reviewers - avoid fetching users one by one

.reviewers was mainly used for iteration and then dereferencing .user one by
one. That gave lots of queries and round trips to the database and was slow.

Instead, do something else. Either query directly or use a new method for
getting the list of reviewer users.

Reviewers will explicitly be shown in the order they have been added (assuming
database id's are monotonic).

pullrequests: restore display of "Current revision - no change" at the bottom of the list of available updates

Helps the user to understand that something can be selected.

pullrequests: make it possible to delete pull requests instead of commenting

Deleting a pull request might however be a bad idea - the reviews on the PR
will be lost.

comments: extract common comment creation functionality for changesets and pullrequests

So far not big but it will grow later ...

cleanup: replace redirect with WebOb exceptions

All redirect does is to log "Generating 302 redirect" with logging the actual
location and raise a WebOb HTTPFound exception, and the logging is redundant,
as WebOb exceptions and their status codes are already logged.

Instead, just raise the exception directly, which is both explicit and simpler
(and finally, gets rid of "return redirect" which never really returns).

pull requests: fix incorrect display of pull requests without updates

avail_revs would contain the top revision and thus not be empty even though no
revs were available for update.

pull requests: blame the right user when an admin adds reviewers to other peoples PRs

Don't send notifications from the PR owner.

pull requests: show 100 pull requests when showing pull requests for a repo

10 was too few.

pull requests: make it possible to make a "pull request" for an arbitrary range

The parent of the range start will be used as ancestor. The "pr" can thus
probably not be merged but will have to be grafted.

pull requests: call it 'owner' instead of 'author'

Prepare for making it possible to transfer ownership of PRs.

pullrequests: remove reviewer list during PR creation

There is not much use for it before the actual diff is shown ... and removing
it also removes a bit of duplicated code that otherwise should be maintained in
two places.

cleanup: fix some risky variable redefinitions

Found with pyflakes.

cleanup: remove unused imports

Found with pyflakes.

cleanup: consistently use 'except ... as ...:'

Use the Python 2.6+ syntax instead of the old confusing 'except ..., ...'
syntax.

cleanup: check for None object identity in cases where that is what the 'contract' says

Avoid applying bool() on complex objects - it might return something unexpected
such as the key (which might be 0 and thus be false). Checking for None is more
safe and faster.

pullrequests: detect invalid reviewers and raise HTTPBadRequest

Normally, the creation of a pullrequest with invalid reviewers is not
possible because the list of reviewers is populated from a form element
that only shows valid reviewers.
However, if creating a pullrequest through an API call, invalid reviewers
can be specified but would not be detected. The reviewer would be encoded
in the database as 'NULL'/None, and opening such a pull request would cause
a server error.

Instead, detect invalid reviewers at pullrequest creation/update time and
raise HTTPBadRequest.

changeset/pullrequest controller: refactor some old variable naming

c.co is a bit cryptic, use the full name c.comment
comm sounds like 'communication', use the full name, comment

tested by adding a single comment on a changeset/pullreques
and running:
* the kallithea/tests/functional/test_changeset_comments.py test

comments: avoid storing 'No comments' text when changing status

When a general comment (with or without status change) is added to a
changeset or pull request, and no text was added, Kallithea automatically
used 'No comments' as text. The stub text is added to the database as if it has
been entered by the user and it can thus not easily be identified as an
automatic comment.

This commit makes following changes:
- allow adding an empty comment to the database when there is a status
change. An empty comment without status change is ignored.
- do not add a stub text to the database, but generate it on demand
- the stub text is shown in italic font to differentiate it from user-entered
text

Currently there is a large amount of duplication between
controllers/changeset.py and controllers/pullrequests.py, which is to be
cleaned up in a later commit.

pullrequests: saving raw_id instead of branch in org_ref

This fixes an issue when the pull request is created while the top commit
included is not the tip. In that case, the faulty code would but
branch:default:default as org_ref, that causes the pull request view to show
all commits on that branch instead of the wanted commit(s) only. The fix will
result in a branch:default:1234567890abcdef1234567890abcdef (e.g)

my pullrequests: line up controller/template handling with repo pullrequests

Currently, the data for 'my pullrequests' is loaded dynamically through
ajax, unlike the way 'repository pullrequests' are loaded (statically).

As there is no good reason to have both treated differently, and as dynamic
loading of 'my pullrequests' is not really needed, rework the handling of
the 'my pullrequests' page with the 'repository pullrequests' page.

This includes lining up the 'show closed pull requests' checkbox/link.

This also fixes issue #102 ('my pull requests' when not logged in:
incorrect handling of login).

controllers: don't pass rendered templates in context variables

Some controllers used the followifng pattern:
- render a data template into a context variable
- for partial (ajax) requests, return the contents of this variable
- for full-page requests, render the full page, which expands the value of
the context variable

Instead, avoid context variables let the controller simply render the full or partial page, and let
the full page template include the partial page.

Remove this context variable for templating and use render exclusively.
From templates, use %include instead of context variables.

This in line with the suggestions in the Pylons documentation:
http://pylons-webframework.readthedocs.org/en/latest/helpers.html#partial-updates-with-ajax

pullrequests on different repos: default to same destination/source branch

When a pull request is initiated between two different repositories, instead
of using the current tip as destination branch, use the same branch as on
the source repository.

pullrequests: when creating a PR for a specific revision, look for updates on the branch name

TODO: consider bookmarks?

gravatar: use font awesome icons

This changes gravatar_url to return an empty string (meaning use an icon)
instead of returning a default image. Since this was a structural change, the
changeset is fairly large.

pullrequests: make top pane one big form with one save button

This will temporarily break the PR update functionality.

pullrequests: use '-- ' as separator before auto text and put latest revisions at top

The update history in pull request descriptions had a confusing ordering.

Instead, use '-- ' as separator between the description and the history so we
can insert new update info in the right place.

pullrequests: reverse the 'available' list - most recent first

Avoid reversing in the templates.

cs_revs should be reversed too. That is for another day.

pullrequests: drop expensive listing of unrelated changesets that cannot be used for update

It rarely gave any relevant info and could take several seconds to compute.

Instead, just warn if the branch name has another head.

Loading a pullrequest page on a slow repo did in one setup go from 7 s to 3.5 s.

pullrequests: store the 'a' branch name in template context

This is not used upstream yet but is useful for customizations. Getting this
change in early avoids conflicts when developing other changes.

pull requests: the node for null is not '0' but 40 * '0'

Fix crash in PR loading

diff: rename template values for org and other for compare and PR

sed -i -e 's,\<\(c\.\(default_\)\?\)org_,\1a_,g' -e 's,\<\(c\.\(default_\)\?\)other_,\1cs_,g' kallithea/controllers/compare.py kallithea/templates/compare/compare_cs.html kallithea/templates/compare/compare_diff.html
sed -i -e 's,\<\(c\.\(default_\)\?\)org_,\1cs_,g' -e 's,\<\(c\.\(default_\)\?\)other_,\1a_,g' kallithea/controllers/pullrequests.py kallithea/templates/pullrequests/pullrequest.html kallithea/templates/pullrequests/pullrequest_show.html kallithea/templates/changeset/diff_block.html

Renaming it differently for compare and PR finally fixes some issues with diffs
and links pointing at wrong revisions and repos - no more whac-a-mole.

pull requests: load repo branch info on demand after changing repo

Visiting a lot of repositories for no reason takes time.

pull requests: rework handling of comments and texts when voting and closing

Close did not leave any records - now it does.

Status changes without comments repeated the status change in text - now it
doesn't repeat itself.

urls: introduce canonical_url config setting

All URLs that are shown or persisted or emailed will use this instead of the
current url.

This is convenient when the server has multiple names - for instance when
transitioning from one protocol or domain or hostname to another.

pull request: fail on form errors - don't redirect

The error page might not be pretty but it is very usable - the user can go back and fix the problem.

pull requests: make it possible to add comments to closed PRs

You can close a PR but you cannot close the discussion of it!

compare: introduce .cs_repo as the repo for .cs_changes - sometimes it is org, sometimes other

Influences pull request creation, display and compare.

pull requests: allow closing of PRs in all states - undo #677

There can be reasons to close a PR without approving or rejecting it -
especially when approving or rejecting a PR overwrites the "review status" of
all changesets in it.

If some code for some reason is interested in PRs that has been closed as
approved or rejected then that is what they should look for ... even though
that is very hard with the current data model.

pull requests: shorten revision numbers in automatic titles

- but it would perhaps be better to use branch names ...

pull requests: store symbolic reference in other_ref ... but ref of ancestor

This both shows correct info and gives correct diff.