Filters sqlalchemy user_log based on search_term with whoosh Query language

    http://packages.python.org/Whoosh/querylang.html

    :param user_log:

    :param search_term:

    """

    qry = None

    if search_term:

        qp = QueryParser('repository', schema=JOURNAL_SCHEMA)

        qp.add_plugin(DateParserPlugin())

        qry = qp.parse(unicode(search_term))

    def wildcard_handler(col, wc_term):

        if wc_term.startswith('*') and not wc_term.endswith('*'):

            #postfix == endswith

            wc_term = remove_prefix(wc_term, prefix='*')

            return func.lower(col).endswith(wc_term)

        elif field == 'date':

            field = getattr(UserLog, 'action_date')

        elif field == 'username':

            field = getattr(UserLog, 'username')

        else:

            field = getattr(UserLog, field)

        #sql filtering

        if isinstance(term, query.Wildcard):

            return wildcard_handler(field, val)

        elif isinstance(term, query.Prefix):

            return func.lower(field).startswith(func.lower(val))

        try:

            form_result = _form.to_python(dict(request.POST))

            for k, v in form_result.items():

                if k == 'auth_plugins':

                    # we want to store it comma separated inside our settings

                    v = ','.join(v)

                setting = Setting.create_or_update(k, v)

                Session().add(setting)

            Session().commit()

            h.flash(_('Auth settings updated successfully'),

                       category='success')

        except formencode.Invalid as errors:

        # url('gist', gist_id=ID)

        c.gist = Gist.get_or_404(gist_id)

        #check if this gist is not expired

        if c.gist.gist_expires != -1:

            if time.time() > c.gist.gist_expires:

                raise HTTPNotFound()

        try:

            c.file_changeset, c.files = GistModel().get_gist_files(gist_id,

                                                            revision=revision)

        except VCSError:

            log.error(traceback.format_exc())

        # url('edit_gist', gist_id=ID)

        c.gist = Gist.get_or_404(gist_id)

        #check if this gist is not expired

        if c.gist.gist_expires != -1:

            if time.time() > c.gist.gist_expires:

                raise HTTPNotFound()

        try:

            c.file_changeset, c.files = GistModel().get_gist_files(gist_id)

        except VCSError:

            log.error(traceback.format_exc())

            raise HTTPNotFound()

        last_rev = c.gist.scm_instance.get_changeset()

        success = True

        revision = request.POST.get('revision')

        ##TODO: maybe move this to model ?

        if revision != last_rev.raw_id:

            # our gist has newer version than we

            success = False

        return {'success': success}

        _update_url = "" # FIXME: disabled

        _err = lambda s: '<div style="color:#ff8888; padding:4px 0px">%s</div>' % (s)

        try:

            import kallithea

            ver = kallithea.__version__

            opener = urllib2.build_opener()

            opener.addheaders = [('User-agent', 'Kallithea-SCM/%s' % ver)]

            response = opener.open(_update_url)

            response_data = response.read()

            data = json.loads(response_data)

        except urllib2.URLError as e:

            log.debug("No Content-Length")

            return jsonrpc_error(retid=self._req_id,

                                 message="No Content-Length in request")

        else:

            length = environ['CONTENT_LENGTH'] or 0

            length = int(environ['CONTENT_LENGTH'])

        if length == 0:

            log.debug("Content-Length is 0")

            return jsonrpc_error(retid=self._req_id,

                                 message="Content-Length is 0")

            self._req_method = json_body['method']

            self._request_params = json_body['args']

            if not isinstance(self._request_params, dict):

                self._request_params = {}

            log.debug(

            )

        except KeyError as e:

            return jsonrpc_error(retid=self._req_id,

                                 message='Incorrect JSON query missing %s' % e)

        # check if we can find this session using api_key

            auth_u = AuthUser(dbuser=u)

            if not AuthUser.check_ip_allowed(auth_u, ip_addr):

                return jsonrpc_error(retid=self._req_id,

                        message='request from IP:%s not allowed' % (ip_addr,))

            else:

        except Exception as e:

            return jsonrpc_error(retid=self._req_id,

                                 message='Invalid API key')

        self._error = None

            raw_response = self._inspect_call(self._func)

            if isinstance(raw_response, HTTPError):

                self._error = str(raw_response)

        except JSONRPCError as e:

            self._error = safe_str(e)

        except Exception as e:

            json_exc = JSONRPCError('Internal server error')

            self._error = safe_str(json_exc)

        if self._error is not None:

            raw_response = None

        response = dict(id=self._req_id, result=raw_response, error=self._error)

        try:

            return json.dumps(response)

        except TypeError as e:

            return json.dumps(

                dict(

                    id=self._req_id,

                    result=None,

                    error="Error encoding response"

                )

            )

    def _find_method(self):

        """

        Return method named by `self._req_method` in controller if able

        """

        if self._req_method.startswith('_'):

            raise AttributeError("Method not allowed")

        try:

            func = getattr(self, self._req_method, None)

        except UnicodeEncodeError:

            revision = None

        c.changelog_for_path = f_path

        try:

            if f_path:

                # get the history for the file !

                tip_cs = c.db_repo_scm_instance.get_changeset()

                try:

                    collection = tip_cs.get_file_history(f_path)

                except (NodeDoesNotExistError, ChangesetError):

                    #this node is not present at tip !

        if partial:

            return render('compare/compare_cs.html')

        if merge and c.ancestor:

            # case we want a simple diff without incoming changesets,

            # previewing what will be merged.

            # Make the diff on the other repo (which is known to have other_rev)

            rev1 = c.ancestor

            org_repo = other_repo

        else: # comparing tips, not necessarily linearly related

            if merge:

                log.error('Unable to find ancestor revision')

            if org_repo != other_repo:

                h.flash(_('Cannot compare repositories without using common ancestor'), category='error')

                raise HTTPBadRequest

            rev1 = c.a_rev

        diff_limit = self.cut_off_limit if not c.fulldiff else None

        txtdiff = org_repo.scm_instance.get_diff(rev1=rev1, rev2=c.cs_rev,

                                      ignore_whitespace=ignore_whitespace,

                                      context=line_context)

        diff_processor = diffs.DiffProcessor(txtdiff or '', format='gitdiff',

                                             diff_limit=diff_limit)

        pass

    def document(self):

        resp = request.environ.get('pylons.original_response')

        c.site_name = config.get('title')

        e = request.environ

        c.serv_p = r'%(protocol)s://%(host)s/' % {

            'protocol': e.get('wsgi.url_scheme'),

            'host': e.get('HTTP_HOST'), }

        if resp:

        archive_cache_dir = CONFIG.get('archive_cache_dir')

        if archive_cache_dir and not subrepos: # TOOD: subrepo caching?

            if not os.path.isdir(archive_cache_dir):

                os.makedirs(archive_cache_dir)

            cached_archive_path = os.path.join(archive_cache_dir, archive_name)

            if os.path.isfile(cached_archive_path):

                archive_path = cached_archive_path

            else:

        if archive_path is None:

            # generate new archive

            fd, archive_path = tempfile.mkstemp()

            with os.fdopen(fd, 'wb') as stream:

                cs.fill_archive(stream=stream, kind=fileformat, subrepos=subrepos)

                # stream (and thus fd) has been closed by cs.fill_archive

            if cached_archive_path is not None:

                # we generated the archive - move it to cache

                shutil.move(archive_path, cached_archive_path)

                archive_path = cached_archive_path

        def get_chunked_archive(archive_path):

            stream = open(archive_path, 'rb')

            while True:

                data = stream.read(16 * 1024)

                if not data:

                    break

                yield data

            stream.close()

            if archive_path != cached_archive_path:

                os.remove(archive_path)

        action_logger(user=c.authuser,

                      action='user_downloaded_archive:%s' % (archive_name),

                      repo=repo_name, ipaddr=self.ip_addr, commit=True)

            return False

        parsed = urlparse.urlparse(came_from)

        server_parsed = urlparse.urlparse(url.current())

        allowed_schemes = ['http', 'https']

        if parsed.scheme and parsed.scheme not in allowed_schemes:

            return False

        if server_parsed.netloc != parsed.netloc:

            log.error('Suspicious NETLOC detected %s for url %s server url '

                      'is: %s' % (parsed.netloc, parsed, server_parsed))

            return False

        return True

        c.ignorews_url = _ignorews_url

        c.context_url = _context_url

        c.fulldiff = request.GET.get('fulldiff')

        diff_limit = self.cut_off_limit if not c.fulldiff else None

        # we swap org/other ref since we run a simple diff on one repo

        txtdiff = org_scm_instance.get_diff(rev1=safe_str(c.a_rev), rev2=safe_str(c.cs_rev),

                                      ignore_whitespace=ignore_whitespace,

                                      context=line_context)

        diff_processor = diffs.DiffProcessor(txtdiff or '', format='gitdiff',

                                             diff_limit=diff_limit)

        schema_defn = {

            'content': SCHEMA,

            'commit': CHGSETS_SCHEMA,

            'path': SCHEMA

        }.get(c.cur_type, SCHEMA)

        if c.cur_query:

            cur_query = c.cur_query.lower()

            log.debug(cur_query)

        if c.cur_query:

                        for i in query.all_terms():

                            if i[0] in ['content', 'message']:

                                highlight_items.add(i[1])

                    matcher = query.matcher(searcher)

                    results = searcher.search(query)

                    res_ln = len(results)

                    c.runtime = '%s results (%.3f seconds)' % (

                        res_ln, results.runtime

                    )

                for f in README_FILES:

                    try:

                        readme = cs.get_node(f)

                        if not isinstance(readme, FileNode):

                            continue

                        readme_file = f

                                  readme_file)

                        readme_data = renderer.render(readme.content,

                                                      filename=f)

                        break

                    except NodeDoesNotExistError:

                        continue

    Check if given controller_name is in whitelist API access

    """

    if not whitelist:

        from kallithea import CONFIG

        whitelist = aslist(CONFIG.get('api_access_controllers_whitelist'),

                           sep=',')

    api_access_valid = controller_name in whitelist

    if api_access_valid:

    else:

        msg = 'controller: %s is *NOT* in API whitelist' % (controller_name)

        if api_key:

            #if we use API key and don't have access it's a warning

            log.warning(msg)

        else:

        self.email = ''

        self.admin = False

        self.inherit_default_permissions = False

        # Look up database user, if necessary.

        if user_id is not None:

            dbuser = user_model.get(user_id)

        else:

            # Note: dbuser is allowed to be None.

            log.debug('Auth User lookup by database user %s', dbuser)

        is_user_loaded = self._fill_data(dbuser)

        if self.user_id == self.anonymous_user.user_id:

            self.is_authenticated = True

        if not self.username:

            self.username = 'None'

    def _fill_data(self, dbuser):

        """

        Copies database fields from a `db.User` to this `AuthUser`. Does

        not copy `api_keys` and `permissions` attributes.

        Check if the given IP address (a `str`) is allowed for the given

        user (an `AuthUser` or `db.User`).

        """

        allowed_ips = AuthUser.get_allowed_ips(user.user_id, cache=True,

            inherit_from_default=user.inherit_default_permissions)

        if check_ip_access(source_ip=ip_addr, allowed_ips=allowed_ips):

            return True

        else:

            log.info('Access for IP:%s forbidden, '

                     'not in %s' % (ip_addr, allowed_ips))

            return False

def redirect_to_login(message=None):

    from kallithea.lib import helpers as h

    p = url.current()

    if message:

        h.flash(h.literal(message), category='warning')

    return redirect(url('login_home', came_from=p, **request.GET))

class LoginRequired(object):

    """

    Must be logged in to execute this function else

    redirect to login page

        return decorator(self.__wrapper, func)

    def __wrapper(self, func, *fargs, **fkwargs):

        controller = fargs[0]

        user = controller.authuser

        loc = "%s:%s" % (controller.__class__.__name__, func.__name__)

        if not AuthUser.check_ip_allowed(user, controller.ip_addr):

            return redirect_to_login(_('IP %s not allowed') % controller.ip_addr)

        # check if we used an API key and it's a valid one

        api_key = request.GET.get('api_key')

        if api_key is not None:

            # explicit controller is enabled or API is in our whitelist

            if self.api_access or allowed_api_access(loc, api_key=api_key):

                if api_key in user.api_keys:

                    return func(*fargs, **fkwargs)

                else:

                    return redirect_to_login(_('Invalid API key'))

            else:

                # controller does not allow API access

                return abort(403)

        # CSRF protection - POSTs with session auth must contain correct token

        if request.POST and user.is_authenticated:

            token = request.POST.get(secure_form.token_key)

            if not token or token != secure_form.authentication_token():

                log.error('CSRF check failed')

                return abort(403)

        # regular user authentication

        if user.is_authenticated:

            return func(*fargs, **fkwargs)

        else:

            return redirect_to_login()

class NotAnonymous(object):

    """

    Must be logged in to execute this function else

    redirect to login page"""

        return decorator(self.__wrapper, func)

    def __wrapper(self, func, *fargs, **fkwargs):

        cls = fargs[0]

        self.user = cls.authuser

        anonymous = self.user.username == User.DEFAULT_USER

        if anonymous:

            return redirect_to_login(_('You need to be a registered user to '

                    'perform this action'))

        self.user = cls.authuser

        self.user_perms = self.user.permissions

        log.debug('checking %s permissions %s for %s %s',

           self.__class__.__name__, self.required_perms, cls, self.user)

        if self.check_permissions():

            return func(*fargs, **fkwargs)

        else:

            anonymous = self.user.username == User.DEFAULT_USER

            if anonymous:

                return redirect_to_login(_('You need to be signed in to view this page'))

            else:

                # redirect with forbidden ret code

                  check_location or 'unspecified location')

        if not user:

            log.debug('Empty request user')

            return False

        self.user_perms = user.permissions

        if self.check_permissions():

            return True

        else:

            return False

    def check_permissions(self):

        """Dummy function for overriding"""

        raise Exception('You have to write this function in child class')

    def check_permissions(self):

        log.debug('checking VCS protocol '

                  'permissions %s for user:%s repository:%s', self.user_perms,

                                                self.username, self.repo_name)

        if self.required_perms.intersection(self.user_perms):

            return True

        return False

#==============================================================================

# SPECIAL VERSION TO HANDLE API AUTH

#==============================================================================

        if repo_name:

            check_scope += ', repo:%s' % (repo_name)

        if group_name:

            check_scope += ', repo group:%s' % (group_name)

        if not user:

            log.debug('Empty User passed into arguments')

            return False

        ## process user

        if not isinstance(user, AuthUser):

            user = AuthUser(user.user_id)

        if not check_location:

            check_location = 'unspecified'

        if self.check_permissions(user.permissions, repo_name, group_name):

            return True

        else:

            return False

    def check_permissions(self, perm_defs, repo_name=None, group_name=None):

        """

        implement in child class should return True if permissions are ok,

        False otherwise

    Checks if source_ip is a subnet of any of allowed_ips.

    :param source_ip:

    :param allowed_ips: list of allowed ips together with mask

    """

    from kallithea.lib import ipaddr

    if isinstance(allowed_ips, (tuple, list, set)):

        for ip in allowed_ips:

            if ipaddr.IPAddress(source_ip) in ipaddr.IPNetwork(ip):

                return True

    return False

            def __init__(self, name):

                self.validator_name = name

            def __call__(self, *args, **kwargs):

                from kallithea.model import validators as v

                obj = getattr(v, self.validator_name)

                return LazyFormencode(obj, *args, **kwargs)

        class ProxyGet(object):

            def __getattribute__(self, name):

                return LazyCaller(name)

        plugin_name = self.name

        if not user and not accepts_empty:

            log.debug('User is empty not allowed to authenticate')

            return False

        if user and user.extern_type and user.extern_type != plugin_name:

            return False

        return True

    def get_user(self, username=None, **kwargs):

        """

        eg. container auth plugin to fetch user by environ params

        :param username: username if given to fetch from database

        :param kwargs: extra arguments needed for user fetching.

        """

        user = None

        if username:

            user = User.get_by_username(username)

            if not user:

                log.debug('Fallback to fetch user in case insensitive mode')

                user = User.get_by_username(username, case_insensitive=True)

        else:

        return user

    def settings(self):

        """

        Return a list of the form:

        [

            username = user_data['username']

            # if user is not active from our extern type we should fail to auth

            # this can prevent from creating users in Kallithea when using

            # external authentication, but if it's inactive user we shouldn't

            # create that user anyway

            if user_data['active_from_extern'] is False:

                return None

            if self.use_fake_password():

                # Randomize the PW because we don't need it, but don't want

                # them blank either

                passwd = PasswordGenerator().gen_password(length=8)

            user = UserModel().create_or_update(

                username=username,

                password=passwd,

                email=user_data["email"],

                firstname=user_data["firstname"],

                lastname=user_data["lastname"],

    raises:

        AttributeError -- no KallitheaAuthPlugin class in the module

        TypeError -- if the KallitheaAuthPlugin is not a subclass of ours KallitheaAuthPluginBase

        ImportError -- if we couldn't import the plugin at all

    """

    if not plugin.startswith(u'kallithea.lib.auth_modules.auth_'):

        parts = plugin.split(u'.lib.auth_modules.auth_', 1)

        if len(parts) == 2:

            _module, pn = parts

            if pn == EXTERN_TYPE_INTERNAL:

                pn = "internal"

    except (ImportError, TypeError):

        log.error(traceback.format_exc())

        # TODO: make this more error prone, if by some accident we screw up