:param user_log:

    :param search_term:

    """

    qry = None

    if search_term:

        qp = QueryParser('repository', schema=JOURNAL_SCHEMA)

        qp.add_plugin(DateParserPlugin())

        qry = qp.parse(unicode(search_term))

    def wildcard_handler(col, wc_term):

        if wc_term.startswith('*') and not wc_term.endswith('*'):

            field = getattr(UserLog, 'username')

        else:

            field = getattr(UserLog, field)

        #sql filtering

        if isinstance(term, query.Wildcard):

                if k == 'auth_plugins':

                    # we want to store it comma separated inside our settings

                    v = ','.join(v)

                setting = Setting.create_or_update(k, v)

                Session().add(setting)

            Session().commit()

        #check if this gist is not expired

        if c.gist.gist_expires != -1:

            if time.time() > c.gist.gist_expires:

                raise HTTPNotFound()

        try:

            c.file_changeset, c.files = GistModel().get_gist_files(gist_id,

        #check if this gist is not expired

        if c.gist.gist_expires != -1:

            if time.time() > c.gist.gist_expires:

                raise HTTPNotFound()

        try:

            c.file_changeset, c.files = GistModel().get_gist_files(gist_id)

        ##TODO: maybe move this to model ?

        if revision != last_rev.raw_id:

            # our gist has newer version than we

            success = False

        try:

            import kallithea

            ver = kallithea.__version__

            opener = urllib2.build_opener()

            opener.addheaders = [('User-agent', 'Kallithea-SCM/%s' % ver)]

            response = opener.open(_update_url)

        else:

            length = environ['CONTENT_LENGTH'] or 0

            length = int(environ['CONTENT_LENGTH'])

        if length == 0:

            log.debug("Content-Length is 0")

                self._request_params = {}

            log.debug(

            )

        except KeyError as e:

            return jsonrpc_error(retid=self._req_id,

                return jsonrpc_error(retid=self._req_id,

                        message='request from IP:%s not allowed' % (ip_addr,))

            else:

        except Exception as e:

            return jsonrpc_error(retid=self._req_id,

        except JSONRPCError as e:

            self._error = safe_str(e)

        except Exception as e:

            json_exc = JSONRPCError('Internal server error')

            self._error = safe_str(json_exc)

        try:

            return json.dumps(response)

        except TypeError as e:

            return json.dumps(

                dict(

                    id=self._req_id,

        """

        Return method named by `self._req_method` in controller if able

        """

        if self._req_method.startswith('_'):

            raise AttributeError("Method not allowed")

        try:

            if f_path:

                # get the history for the file !

                tip_cs = c.db_repo_scm_instance.get_changeset()

                try:

            # case we want a simple diff without incoming changesets,

            # previewing what will be merged.

            # Make the diff on the other repo (which is known to have other_rev)

            rev1 = c.ancestor

            org_repo = other_repo

        else: # comparing tips, not necessarily linearly related

        diff_limit = self.cut_off_limit if not c.fulldiff else None

        txtdiff = org_repo.scm_instance.get_diff(rev1=rev1, rev2=c.cs_rev,

                                      ignore_whitespace=ignore_whitespace,

                                      context=line_context)

        resp = request.environ.get('pylons.original_response')

        c.site_name = config.get('title')

        e = request.environ

        c.serv_p = r'%(protocol)s://%(host)s/' % {

                os.makedirs(archive_cache_dir)

            cached_archive_path = os.path.join(archive_cache_dir, archive_name)

            if os.path.isfile(cached_archive_path):

                archive_path = cached_archive_path

            else:

        if archive_path is None:

            # generate new archive

            fd, archive_path = tempfile.mkstemp()

            with os.fdopen(fd, 'wb') as stream:

                cs.fill_archive(stream=stream, kind=fileformat, subrepos=subrepos)

                # stream (and thus fd) has been closed by cs.fill_archive

            if cached_archive_path is not None:

                # we generated the archive - move it to cache

                shutil.move(archive_path, cached_archive_path)

                archive_path = cached_archive_path

                yield data

            stream.close()

            if archive_path != cached_archive_path:

                os.remove(archive_path)

        action_logger(user=c.authuser,

        server_parsed = urlparse.urlparse(url.current())

        allowed_schemes = ['http', 'https']

        if parsed.scheme and parsed.scheme not in allowed_schemes:

            return False

        if server_parsed.netloc != parsed.netloc:

            log.error('Suspicious NETLOC detected %s for url %s server url '

        diff_limit = self.cut_off_limit if not c.fulldiff else None

        # we swap org/other ref since we run a simple diff on one repo

        txtdiff = org_scm_instance.get_diff(rev1=safe_str(c.a_rev), rev2=safe_str(c.cs_rev),

                                      ignore_whitespace=ignore_whitespace,

                                      context=line_context)

            'path': SCHEMA

        }.get(c.cur_type, SCHEMA)

        if c.cur_query:

            cur_query = c.cur_query.lower()

                    matcher = query.matcher(searcher)

                    results = searcher.search(query)

                    res_ln = len(results)

                    c.runtime = '%s results (%.3f seconds)' % (

                        if not isinstance(readme, FileNode):

                            continue

                        readme_file = f

                                  readme_file)

                        readme_data = renderer.render(readme.content,

                                                      filename=f)

        from kallithea import CONFIG

        whitelist = aslist(CONFIG.get('api_access_controllers_whitelist'),

                           sep=',')

    api_access_valid = controller_name in whitelist

    if api_access_valid:

    else:

        msg = 'controller: %s is *NOT* in API whitelist' % (controller_name)

        if api_key:

        # Look up database user, if necessary.

        if user_id is not None:

            dbuser = user_model.get(user_id)

        else:

            # Note: dbuser is allowed to be None.

        if not self.username:

            self.username = 'None'

    def _fill_data(self, dbuser):

        """

        allowed_ips = AuthUser.get_allowed_ips(user.user_id, cache=True,

            inherit_from_default=user.inherit_default_permissions)

        if check_ip_access(source_ip=ip_addr, allowed_ips=allowed_ips):

            return True

        else:

            log.info('Access for IP:%s forbidden, '

    p = url.current()

    if message:

        h.flash(h.literal(message), category='warning')

    return redirect(url('login_home', came_from=p, **request.GET))

class LoginRequired(object):

        controller = fargs[0]

        user = controller.authuser

        loc = "%s:%s" % (controller.__class__.__name__, func.__name__)

        if not AuthUser.check_ip_allowed(user, controller.ip_addr):

            return redirect_to_login(_('IP %s not allowed') % controller.ip_addr)

            # explicit controller is enabled or API is in our whitelist

            if self.api_access or allowed_api_access(loc, api_key=api_key):

                if api_key in user.api_keys:

                    return func(*fargs, **fkwargs)

                else:

                    return redirect_to_login(_('Invalid API key'))

            else:

                # controller does not allow API access

                return abort(403)

        # CSRF protection - POSTs with session auth must contain correct token

        # regular user authentication

        if user.is_authenticated:

            return func(*fargs, **fkwargs)

        else:

            return redirect_to_login()

class NotAnonymous(object):

        cls = fargs[0]

        self.user = cls.authuser

        anonymous = self.user.username == User.DEFAULT_USER

        self.user = cls.authuser

        self.user_perms = self.user.permissions

        log.debug('checking %s permissions %s for %s %s',

        if self.check_permissions():

            return func(*fargs, **fkwargs)

        else:

            anonymous = self.user.username == User.DEFAULT_USER

            if anonymous:

            return False

        self.user_perms = user.permissions

        if self.check_permissions():

            return True

        else:

            return False

    def check_permissions(self):

                  'permissions %s for user:%s repository:%s', self.user_perms,

                                                self.username, self.repo_name)

        if self.required_perms.intersection(self.user_perms):

            return True

        return False

        if group_name:

            check_scope += ', repo group:%s' % (group_name)

        if not user:

            log.debug('Empty User passed into arguments')

            return False

        if not check_location:

            check_location = 'unspecified'

        if self.check_permissions(user.permissions, repo_name, group_name):

            return True

        else:

            return False

    def check_permissions(self, perm_defs, repo_name=None, group_name=None):

    :param allowed_ips: list of allowed ips together with mask

    """

    from kallithea.lib import ipaddr

    if isinstance(allowed_ips, (tuple, list, set)):

        for ip in allowed_ips:

            if ipaddr.IPAddress(source_ip) in ipaddr.IPNetwork(ip):

                return True

    return False

            def __call__(self, *args, **kwargs):

                from kallithea.model import validators as v

                obj = getattr(v, self.validator_name)

                return LazyFormencode(obj, *args, **kwargs)

            return False

        if user and user.extern_type and user.extern_type != plugin_name:

            return False

        return True

        :param kwargs: extra arguments needed for user fetching.

        """

        user = None

        if username:

            user = User.get_by_username(username)

            if not user:

                log.debug('Fallback to fetch user in case insensitive mode')

                user = User.get_by_username(username, case_insensitive=True)

        else:

        return user

    def settings(self):

            # external authentication, but if it's inactive user we shouldn't

            # create that user anyway

            if user_data['active_from_extern'] is False:

                return None

            if self.use_fake_password():

                # them blank either

                passwd = PasswordGenerator().gen_password(length=8)

            user = UserModel().create_or_update(

                username=username,

                password=passwd,

        TypeError -- if the KallitheaAuthPlugin is not a subclass of ours KallitheaAuthPluginBase

        ImportError -- if we couldn't import the plugin at all

    """

    if not plugin.startswith(u'kallithea.lib.auth_modules.auth_'):

        parts = plugin.split(u'.lib.auth_modules.auth_', 1)

        if len(parts) == 2:

        # the plugin name, the crash is pretty bad and hard to recover

        raise

    pluginclass = getattr(module, PLUGIN_CLASS_NAME)

    if not issubclass(pluginclass, KallitheaAuthPluginBase):

    """

    auth_plugins = Setting.get_auth_plugins()

    for module in auth_plugins:

        try:

            plugin = loadplugin(module)

        except (ImportError, AttributeError, TypeError) as e:

            raise ImportError('Failed to load authentication module %s : %s'

                              % (module, str(e)))

        # load plugin settings from Kallithea database

        plugin_name = plugin.name

        plugin_settings = {}

            conf_key = "auth_%s_%s" % (plugin_name, v["name"])

            setting = Setting.get_by_name(conf_key)

            plugin_settings[v["name"]] = setting.app_settings_value if setting else None

        if not str2bool(plugin_settings["enabled"]):

            continue

        # use plugin's method of user extraction.

        user = plugin.get_user(username, environ=environ,

                               settings=plugin_settings)

        if not plugin.accepts(user):

            continue

        else:

        # _authenticate is a wrapper for .auth() method of plugin.

        # it checks if .auth() sends proper data. For KallitheaExternalAuthPlugin

        # it also maps users to Database and maps the attributes returned

        user_data = plugin._authenticate(user, username, password,

                                           plugin_settings,

                                           environ=environ or {})

        if user_data is not None:

            log.debug('Plugin returned proper authentication data')

        # we failed to Auth because .auth() method didn't return the user

        if username:

    return None

def get_managed_fields(user):

        username = None

        environ = environ or {}

        if not environ:

        settings = settings or {}

        if settings.get('header'):

            header = settings.get('header')

            username = environ.get(header)

        # fallback mode

        if not username and settings.get('fallback_header'):

            header = settings.get('fallback_header')

            username = environ.get(header)

        if username and str2bool(settings.get('clean_username')):

            username = self._clean_username(username)

        return username

    def get_user(self, username=None, **kwargs):

            'extern_name': username,

        }

        return user_data

    def get_managed_fields(self):

            _headers["Authorization"] = "Basic %s" % authstring

        if headers:

            _headers.update(headers)

        request = urllib2.Request(url, body, _headers)

        if method:

            request.get_method = lambda: method

            log.debug('Empty username or password skipping...')

            return None

        server = CrowdServer(**settings)

        server.set_credentials(settings["app_name"], settings["app_password"])

        crowd_user = server.user_auth(username, password)

        if not crowd_user["status"]:

            return None

        res = server.user_groups(crowd_user["name"])

        crowd_user["groups"] = [x["name"] for x in res["groups"]]

        # old attrs fetched from Kallithea database

        for group in settings["admin_groups"].split(","):

            if group in user_data["groups"]:

                user_data["admin"] = True

        return user_data

    def get_managed_fields(self):

    def auth(self, userobj, username, password, settings, **kwargs):

        if not userobj:

            return None

        if userobj.extern_type != self.name:

            return None

        user_data = {

            from kallithea.lib import auth

            password_match = auth.KallitheaCrypto.hash_check(password, userobj.password)

            if userobj.username == User.DEFAULT_USER and userobj.active:

                         username)

                return user_data

            elif userobj.username == username and password_match:

                return user_data

            return None

        else:

            return None

    def get_managed_fields(self):

                server.start_tls_s()

            if self.LDAP_BIND_DN and self.LDAP_BIND_PASS:

                server.simple_bind_s(self.LDAP_BIND_DN, self.LDAP_BIND_PASS)

            filter_ = '(&%s(%s=%s))' % (self.LDAP_FILTER, self.attr_login,

                    continue

                try:

                    server.simple_bind_s(dn, safe_str(password))

                    attrs = server.search_ext_s(dn, ldap.SCOPE_BASE,

                                                '(objectClass=*)')[0][1]

                    break

                except ldap.INVALID_CREDENTIALS:

            else: