return settings

    @HasPermissionAnyDecorator('hg.admin')

    def settings_vcs(self):

        c.active = 'vcs'

        if request.POST:

            application_form = ApplicationUiSettingsForm()()

            try:

                form_result = application_form.to_python(dict(request.POST))

            except formencode.Invalid as errors:

                return htmlfill.render(

                     render('admin/settings/settings.html'),

                     defaults=errors.value,

                     errors=errors.error_dict or {},

                     prefix_error=False,

                     encoding="UTF-8",

                     force_defaults=False)

            try:

                if c.visual.allow_repo_location_change:

                    sett = Ui.get_by_key('paths', '/')

                    sett.ui_value = form_result['paths_root_path']

                # HOOKS

                sett = Ui.get_by_key('hooks', Ui.HOOK_UPDATE)

                sett.ui_active = form_result['hooks_changegroup_update']

                sett = Ui.get_by_key('hooks', Ui.HOOK_REPO_SIZE)

                sett.ui_active = form_result['hooks_changegroup_repo_size']

                ## EXTENSIONS

                sett = Ui.get_or_create('extensions', 'largefiles')

                sett.ui_active = form_result['extensions_largefiles']

                sett = Ui.get_or_create('extensions', 'hgsubversion')

                sett.ui_active = form_result['extensions_hgsubversion']

                if sett.ui_active:

                    try:

                        import hgsubversion  # pragma: no cover

                    except ImportError:

                        raise HgsubversionImportError

#                sett = Ui.get_or_create('extensions', 'hggit')

#                sett.ui_active = form_result['extensions_hggit']

                Session().commit()

                h.flash(_('Updated VCS settings'), category='success')

            except HgsubversionImportError:

                log.error(traceback.format_exc())

                h.flash(_('Unable to activate hgsubversion support. '

                          'The "hgsubversion" library is missing'),

                        category='error')

            except Exception:

                log.error(traceback.format_exc())

                h.flash(_('Error occurred while updating '

                          'application settings'), category='error')

        defaults = Setting.get_app_settings()

        defaults.update(self._get_hg_ui_settings())

        return htmlfill.render(

            render('admin/settings/settings.html'),

            defaults=defaults,

            encoding="UTF-8",

            force_defaults=False)

    @HasPermissionAnyDecorator('hg.admin')

    def settings_mapping(self):

        c.active = 'mapping'

        if request.POST:

            rm_obsolete = request.POST.get('destroy', False)

            install_git_hooks = request.POST.get('hooks', False)

            overwrite_git_hooks = request.POST.get('hooks_overwrite', False)

            invalidate_cache = request.POST.get('invalidate', False)

            log.debug('rescanning repo location with destroy obsolete=%s, '

                      'install git hooks=%s and '

                      'overwrite git hooks=%s' % (rm_obsolete, install_git_hooks, overwrite_git_hooks))

            filesystem_repos = ScmModel().repo_scan()

            added, removed = repo2db_mapper(filesystem_repos, rm_obsolete,

                                            install_git_hooks=install_git_hooks,

                                            user=request.authuser.username,

                                            overwrite_git_hooks=overwrite_git_hooks)

            added_msg = h.HTML(', ').join(

                h.link_to(safe_unicode(repo_name), h.url('summary_home', repo_name=repo_name)) for repo_name in added

            ) or '-'

            removed_msg = h.HTML(', ').join(

                safe_unicode(repo_name) for repo_name in removed

            ) or '-'

            h.flash(h.HTML(_('Repositories successfully rescanned. Added: %s. Removed: %s.')) %

                    (added_msg, removed_msg), category='success')

            if invalidate_cache:

                log.debug('invalidating all repositories cache')

                i = 0

                for repo in Repository.query():

                    try:

                        ScmModel().mark_for_invalidation(repo.repo_name)

                        i += 1

                    except VCSError as e:

                        log.warning('VCS error invalidating %s: %s', repo.repo_name, e)

                h.flash(_('Invalidated %s repositories') % i, category='success')

            raise HTTPFound(location=url('admin_settings_mapping'))

        defaults = Setting.get_app_settings()

        defaults.update(self._get_hg_ui_settings())

        return htmlfill.render(

            render('admin/settings/settings.html'),

            defaults=defaults,

            encoding="UTF-8",

            force_defaults=False)

    @HasPermissionAnyDecorator('hg.admin')

    def settings_global(self):

        c.active = 'global'

        if request.POST:

            application_form = ApplicationSettingsForm()()

            try:

                form_result = application_form.to_python(dict(request.POST))

            except formencode.Invalid as errors:

                return htmlfill.render(

                    render('admin/settings/settings.html'),

                    defaults=errors.value,

                    errors=errors.error_dict or {},

                    prefix_error=False,

                    encoding="UTF-8",

                    force_defaults=False)

            try:

                for setting in (

                    'title',

                    'realm',

                    'ga_code',

                    'captcha_public_key',

                    'captcha_private_key',

                ):

                    Setting.create_or_update(setting, form_result[setting])

                Session().commit()

                set_app_settings(config)

                h.flash(_('Updated application settings'), category='success')

            except Exception:

                log.error(traceback.format_exc())

                h.flash(_('Error occurred while updating '

                          'application settings'),

                          category='error')

            raise HTTPFound(location=url('admin_settings_global'))

        defaults = Setting.get_app_settings()

        defaults.update(self._get_hg_ui_settings())

        return htmlfill.render(

            render('admin/settings/settings.html'),

            defaults=defaults,

            encoding="UTF-8",

            force_defaults=False)

    @HasPermissionAnyDecorator('hg.admin')

    def settings_visual(self):

        c.active = 'visual'

        if request.POST:

            application_form = ApplicationVisualisationForm()()

            try:

                form_result = application_form.to_python(dict(request.POST))

            except formencode.Invalid as errors:

                return htmlfill.render(

                    render('admin/settings/settings.html'),

                    defaults=errors.value,

                    errors=errors.error_dict or {},

                    prefix_error=False,

                    encoding="UTF-8",

                    force_defaults=False)

            try:

                settings = [

                    ('show_public_icon', 'show_public_icon', 'bool'),

                    ('show_private_icon', 'show_private_icon', 'bool'),

                    ('stylify_metalabels', 'stylify_metalabels', 'bool'),

                    ('repository_fields', 'repository_fields', 'bool'),

                    ('dashboard_items', 'dashboard_items', 'int'),

                    ('admin_grid_items', 'admin_grid_items', 'int'),

                    ('show_version', 'show_version', 'bool'),

                    ('use_gravatar', 'use_gravatar', 'bool'),

                    ('gravatar_url', 'gravatar_url', 'unicode'),

                    ('clone_uri_tmpl', 'clone_uri_tmpl', 'unicode'),

                ]

                for setting, form_key, type_ in settings:

                    Setting.create_or_update(setting, form_result[form_key], type_)

                Session().commit()

                set_app_settings(config)

                h.flash(_('Updated visualisation settings'),

                        category='success')

            except Exception:

                log.error(traceback.format_exc())

                h.flash(_('Error occurred during updating '

                          'visualisation settings'),

                        category='error')

            raise HTTPFound(location=url('admin_settings_visual'))

        defaults = Setting.get_app_settings()

        defaults.update(self._get_hg_ui_settings())

        return htmlfill.render(

            render('admin/settings/settings.html'),

            defaults=defaults,

            encoding="UTF-8",

            force_defaults=False)

    @HasPermissionAnyDecorator('hg.admin')

    def settings_email(self):

        c.active = 'email'

        if request.POST:

            test_email = request.POST.get('test_email')

            test_email_subj = 'Kallithea test email'

            test_body = ('Kallithea Email test, '

                               'Kallithea version: %s' % c.kallithea_version)

            if not test_email:

                h.flash(_('Please enter email address'), category='error')

                raise HTTPFound(location=url('admin_settings_email'))

            test_email_txt_body = EmailNotificationModel() \

                .get_email_tmpl(EmailNotificationModel.TYPE_DEFAULT,

                                'txt', body=test_body)

            test_email_html_body = EmailNotificationModel() \

                .get_email_tmpl(EmailNotificationModel.TYPE_DEFAULT,

                                'html', body=test_body)

            recipients = [test_email] if test_email else None

            tasks.send_email(recipients, test_email_subj,

                             test_email_txt_body, test_email_html_body)

            h.flash(_('Send email task created'), category='success')

            raise HTTPFound(location=url('admin_settings_email'))

        defaults = Setting.get_app_settings()

        defaults.update(self._get_hg_ui_settings())

        import kallithea

        c.ini = kallithea.CONFIG

        return htmlfill.render(

            render('admin/settings/settings.html'),

            defaults=defaults,

            encoding="UTF-8",

            force_defaults=False)

    @HasPermissionAnyDecorator('hg.admin')

    def settings_hooks(self):

        c.active = 'hooks'

        if request.POST:

            if c.visual.allow_custom_hooks_settings:

                ui_key = request.POST.get('new_hook_ui_key')

                ui_value = request.POST.get('new_hook_ui_value')

                hook_id = request.POST.get('hook_id')

                try:

                    ui_key = ui_key and ui_key.strip()

                    if ui_key in (x.ui_key for x in Ui.get_custom_hooks()):

                        h.flash(_('Hook already exists'), category='error')

                    elif ui_key in (x.ui_key for x in Ui.get_builtin_hooks()):

                        h.flash(_('Builtin hooks are read-only. Please use another hook name.'), category='error')

                    elif ui_value and ui_key:

                        Ui.create_or_update_hook(ui_key, ui_value)

                        h.flash(_('Added new hook'), category='success')

                    elif hook_id:

                        Ui.delete(hook_id)

                        Session().commit()

                    # check for edits

                    update = False

                    _d = request.POST.dict_of_lists()

                    for k, v, ov in zip(_d.get('hook_ui_key', []),

                                        _d.get('hook_ui_value_new', []),

                                        _d.get('hook_ui_value', [])):

                        if v != ov:

                            Ui.create_or_update_hook(k, v)

                            update = True

                    if update:

                        h.flash(_('Updated hooks'), category='success')

                    Session().commit()

                except Exception:

                    log.error(traceback.format_exc())

                    h.flash(_('Error occurred during hook creation'),

                            category='error')

                raise HTTPFound(location=url('admin_settings_hooks'))

        defaults = Setting.get_app_settings()

        defaults.update(self._get_hg_ui_settings())

        c.hooks = Ui.get_builtin_hooks()

        c.custom_hooks = Ui.get_custom_hooks()

        return htmlfill.render(

            render('admin/settings/settings.html'),

            defaults=defaults,

            encoding="UTF-8",

            force_defaults=False)

    @HasPermissionAnyDecorator('hg.admin')

    def settings_search(self):

        c.active = 'search'

        if request.POST:

            repo_location = self._get_hg_ui_settings()['paths_root_path']

            full_index = request.POST.get('full_index', False)

            tasks.whoosh_index(repo_location, full_index)

            h.flash(_('Whoosh reindex task scheduled'), category='success')

            raise HTTPFound(location=url('admin_settings_search'))

        defaults = Setting.get_app_settings()

        defaults.update(self._get_hg_ui_settings())

        return htmlfill.render(

            render('admin/settings/settings.html'),

            defaults=defaults,

            encoding="UTF-8",

            force_defaults=False)

    @HasPermissionAnyDecorator('hg.admin')

    def settings_system(self):

        c.active = 'system'

        defaults = Setting.get_app_settings()

        defaults.update(self._get_hg_ui_settings())

        import kallithea

        c.ini = kallithea.CONFIG

        c.update_url = defaults.get('update_url')

        server_info = Setting.get_server_info()

        for key, val in server_info.iteritems():

            setattr(c, key, val)

        return htmlfill.render(

            render('admin/settings/settings.html'),

            defaults=defaults,

            encoding="UTF-8",

            force_defaults=False)

    @HasPermissionAnyDecorator('hg.admin')

    def settings_system_update(self):

        import json

        import urllib2

        from kallithea.lib.verlib import NormalizedVersion

        from kallithea import __version__

        defaults = Setting.get_app_settings()

        defaults.update(self._get_hg_ui_settings())

        _update_url = defaults.get('update_url', '')

        _update_url = "" # FIXME: disabled

        _err = lambda s: '<div class="alert alert-danger">%s</div>' % (s)

        try:

            import kallithea

            ver = kallithea.__version__

            log.debug('Checking for upgrade on `%s` server', _update_url)

            opener = urllib2.build_opener()

            opener.addheaders = [('User-agent', 'Kallithea-SCM/%s' % ver)]

            response = opener.open(_update_url)

            response_data = response.read()

            data = json.loads(response_data)

        except urllib2.URLError as e:

            log.error(traceback.format_exc())

            return _err('Failed to contact upgrade server: %r' % e)

        except ValueError as e:

            log.error(traceback.format_exc())

            return _err('Bad data sent from update server')

        latest = data['versions'][0]

        c.update_url = _update_url

        c.latest_data = latest

# -*- coding: utf-8 -*-

# This program is free software: you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

"""

kallithea.controllers.summary

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Summary controller for Kallithea

This file was forked by the Kallithea project in July 2014.

Original author and date, and relevant copyright and licensing information is below:

:created_on: Apr 18, 2010

:author: marcink

:copyright: (c) 2013 RhodeCode GmbH, and others.

:license: GPLv3, see LICENSE.md for more details.

"""

import traceback

import calendar

import logging

import itertools

from time import mktime

from datetime import timedelta, date

from tg import tmpl_context as c, request

from tg.i18n import ugettext as _

from webob.exc import HTTPBadRequest

from beaker.cache import cache_region, region_invalidate

from kallithea.lib.vcs.exceptions import ChangesetError, EmptyRepositoryError, \

    NodeDoesNotExistError

from kallithea.config.conf import ALL_READMES, ALL_EXTS, LANGUAGES_EXTENSIONS_MAP

from kallithea.model.db import Statistics, CacheInvalidation, User

from kallithea.lib.utils2 import safe_int, safe_str

from kallithea.lib.auth import LoginRequired, HasRepoPermissionLevelDecorator

from kallithea.lib.base import BaseRepoController, render, jsonify

from kallithea.lib.vcs.backends.base import EmptyChangeset

from kallithea.lib.markup_renderer import MarkupRenderer

from kallithea.lib.celerylib.tasks import get_commits_stats

from kallithea.lib.compat import json

from kallithea.lib.vcs.nodes import FileNode

from kallithea.lib.page import RepoPage

log = logging.getLogger(__name__)

README_FILES = [''.join([x[0][0], x[1][0]]) for x in

                    sorted(list(itertools.product(ALL_READMES, ALL_EXTS)),

                           key=lambda y:y[0][1] + y[1][1])]

class SummaryController(BaseRepoController):

    def __get_readme_data(self, db_repo):

        repo_name = db_repo.repo_name

        log.debug('Looking for README file')

        @cache_region('long_term', '_get_readme_from_cache')

        def _get_readme_from_cache(key, kind):

            readme_data = None

            readme_file = None

            try:

                # gets the landing revision! or tip if fails

                cs = db_repo.get_landing_changeset()

                if isinstance(cs, EmptyChangeset):

                    raise EmptyRepositoryError()

                renderer = MarkupRenderer()

                for f in README_FILES:

                    try:

                        readme = cs.get_node(f)

                        if not isinstance(readme, FileNode):

                            continue

                        readme_file = f

                        log.debug('Found README file `%s` rendering...',

                                  readme_file)

                        readme_data = renderer.render(readme.content,

                                                      filename=f)

                        break

                    except NodeDoesNotExistError:

                        continue

            except ChangesetError:

                log.error(traceback.format_exc())

                pass

            except EmptyRepositoryError:

                pass

            return readme_data, readme_file

        kind = 'README'

        valid = CacheInvalidation.test_and_set_valid(repo_name, kind)

        if not valid:

            region_invalidate(_get_readme_from_cache, None, '_get_readme_from_cache', repo_name, kind)

        return _get_readme_from_cache(repo_name, kind)

    @LoginRequired(allow_default_user=True)

    @HasRepoPermissionLevelDecorator('read')

    def index(self, repo_name):

        p = safe_int(request.GET.get('page'), 1)

        size = safe_int(request.GET.get('size'), 10)

        collection = c.db_repo_scm_instance

        c.cs_pagination = RepoPage(collection, page=p, items_per_page=size)

        page_revisions = [x.raw_id for x in list(c.cs_pagination)]

        c.cs_comments = c.db_repo.get_comments(page_revisions)

        c.cs_statuses = c.db_repo.statuses(page_revisions)

        if request.authuser.is_default_user:

            username = None

        else:

            username = request.authuser.username

        c.clone_repo_url = c.db_repo.clone_url(clone_uri_tmpl=c.clone_uri_tmpl, with_id=False, username=username)

        c.clone_repo_url_id = c.db_repo.clone_url(clone_uri_tmpl=c.clone_uri_tmpl, with_id=True, username=username)

        if c.db_repo.enable_statistics:

            c.show_stats = True

        else:

            c.show_stats = False

        stats = Statistics.query() \

            .filter(Statistics.repository == c.db_repo) \

            .scalar()

        c.stats_percentage = 0

        if stats and stats.languages:

            c.no_data = False is c.db_repo.enable_statistics

            lang_stats_d = json.loads(stats.languages)

            lang_stats = ((x, {"count": y,

                               "desc": LANGUAGES_EXTENSIONS_MAP.get(x)})

                          for x, y in lang_stats_d.items())

            c.trending_languages = (

                sorted(lang_stats, reverse=True, key=lambda k: k[1])[:10]

            )

        else:

            c.no_data = True

            c.trending_languages = []

        c.enable_downloads = c.db_repo.enable_downloads

        c.readme_data, c.readme_file = \

            self.__get_readme_data(c.db_repo)

        return render('summary/summary.html')

    @LoginRequired()

    @HasRepoPermissionLevelDecorator('read')

    @jsonify

    def repo_size(self, repo_name):

        if request.is_xhr:

            return c.db_repo._repo_size()

        else:

            raise HTTPBadRequest()

    @LoginRequired(allow_default_user=True)

    @HasRepoPermissionLevelDecorator('read')

    def statistics(self, repo_name):

        if c.db_repo.enable_statistics:

            c.show_stats = True

            c.no_data_msg = _('No data ready yet')

        else:

            c.show_stats = False

            c.no_data_msg = _('Statistics are disabled for this repository')

        td = date.today() + timedelta(days=1)

        td_1m = td - timedelta(days=calendar.mdays[td.month])

        td_1y = td - timedelta(days=365)

        ts_min_m = mktime(td_1m.timetuple())

        ts_min_y = mktime(td_1y.timetuple())

        ts_max_y = mktime(td.timetuple())

        c.ts_min = ts_min_m

        c.ts_max = ts_max_y

        stats = Statistics.query() \

            .filter(Statistics.repository == c.db_repo) \

            .scalar()

        c.stats_percentage = 0

        if stats and stats.languages:

            c.no_data = False is c.db_repo.enable_statistics

            lang_stats_d = json.loads(stats.languages)

            c.commit_data = json.loads(stats.commit_activity)

            c.overview_data = json.loads(stats.commit_activity_combined)

            lang_stats = ((x, {"count": y,

                               "desc": LANGUAGES_EXTENSIONS_MAP.get(x)})

                          for x, y in lang_stats_d.items())

            c.trending_languages = (

                sorted(lang_stats, reverse=True, key=lambda k: k[1])[:10]

            )

            last_rev = stats.stat_on_revision + 1

            c.repo_last_rev = c.db_repo_scm_instance.count() \

                if c.db_repo_scm_instance.revisions else 0

            if last_rev == 0 or c.repo_last_rev == 0:

                pass

            else:

                c.stats_percentage = '%.2f' % ((float((last_rev)) /

                                                c.repo_last_rev) * 100)

        else:

            c.commit_data = {}

            c.overview_data = ([[ts_min_y, 0], [ts_max_y, 10]])

            c.trending_languages = {}

            c.no_data = True

        recurse_limit = 500  # don't recurse more than 500 times when parsing

        get_commits_stats(c.db_repo.repo_name, ts_min_y, ts_max_y, recurse_limit)

        return render('summary/statistics.html')

        Since we're dealing with a VCS client and not a browser, we only

        support HTTP basic authentication, either directly via raw header

        inspection, or by using container authentication to delegate the

        authentication to the web server.

        Returns (user, None) on successful authentication and authorization.

        Returns (None, wsgi_app) to send the wsgi_app response to the client.

        """

        # Use anonymous access if allowed for action on repo.

        default_user = User.get_default_user(cache=True)

        default_authuser = AuthUser.make(dbuser=default_user, ip_addr=ip_addr)

        if default_authuser is None:

            log.debug('No anonymous access at all') # move on to proper user auth

        else:

            if self._check_permission(action, default_authuser, repo_name):

                return default_authuser, None

            log.debug('Not authorized to access this repository as anonymous user')

        username = None

        #==============================================================

        # DEFAULT PERM FAILED OR ANONYMOUS ACCESS IS DISABLED SO WE

        # NEED TO AUTHENTICATE AND ASK FOR AUTH USER PERMISSIONS

        #==============================================================

        # try to auth based on environ, container auth methods

        log.debug('Running PRE-AUTH for container based authentication')

        pre_auth = auth_modules.authenticate('', '', environ)

        if pre_auth is not None and pre_auth.get('username'):

            username = pre_auth['username']

        log.debug('PRE-AUTH got %s as username', username)

        # If not authenticated by the container, running basic auth

        if not username:

            self.authenticate.realm = safe_str(self.config['realm'])

            result = self.authenticate(environ)

            if isinstance(result, str):

                paste.httpheaders.AUTH_TYPE.update(environ, 'basic')

                paste.httpheaders.REMOTE_USER.update(environ, result)

                username = result

            else:

                return None, result.wsgi_application

        #==============================================================

        # CHECK PERMISSIONS FOR THIS REQUEST USING GIVEN USERNAME

        #==============================================================

        try:

            user = User.get_by_username_or_email(username)

        except Exception:

            log.error(traceback.format_exc())

            return None, webob.exc.HTTPInternalServerError()

        authuser = AuthUser.make(dbuser=user, ip_addr=ip_addr)

        if authuser is None:

            return None, webob.exc.HTTPForbidden()

        if not self._check_permission(action, authuser, repo_name):

            return None, webob.exc.HTTPForbidden()

        return user, None

    def _handle_request(self, environ, start_response):

        raise NotImplementedError()

    def _check_permission(self, action, authuser, repo_name):

        """

        Checks permissions using action (push/pull) user and repository

        name

        :param action: 'push' or 'pull' action

        :param user: `User` instance

        :param repo_name: repository name

        """

        if action == 'push':

            if not HasPermissionAnyMiddleware('repository.write',

                                              'repository.admin')(authuser,

                                                                  repo_name):

                return False

        else:

            #any other action need at least read permission

            if not HasPermissionAnyMiddleware('repository.read',

                                              'repository.write',

                                              'repository.admin')(authuser,

                                                                  repo_name):

                return False

        return True

    def _get_ip_addr(self, environ):

        return _get_ip_addr(environ)

    def __call__(self, environ, start_response):

        start = time.time()

        try:

            # try parsing a request for this VCS - if it fails, call the wrapped app

            parsed_request = self.parse_request(environ)

            if parsed_request is None:

                return self.application(environ, start_response)

            # skip passing error to error controller

            environ['pylons.status_code_redirect'] = True

            # quick check if repo exists...

            if not is_valid_repo(parsed_request.repo_name, self.basepath, self.scm_alias):

                raise webob.exc.HTTPNotFound()

            if parsed_request.action is None:

                # Note: the client doesn't get the helpful error message

                raise webob.exc.HTTPBadRequest('Unable to detect pull/push action for %r! Are you using a nonstandard command or client?' % parsed_request.repo_name)

            #======================================================================

            # CHECK PERMISSIONS

            #======================================================================

            ip_addr = self._get_ip_addr(environ)

            user, response_app = self._authorize(environ, parsed_request.action, parsed_request.repo_name, ip_addr)

            if response_app is not None:

                return response_app(environ, start_response)

            #======================================================================

            # REQUEST HANDLING

            #======================================================================

            set_hook_environment(user.username, ip_addr,

                parsed_request.repo_name, self.scm_alias, parsed_request.action)

            try:

                log.info('%s action on %s repo "%s" by "%s" from %s',

                         parsed_request.action, self.scm_alias, parsed_request.repo_name, safe_str(user.username), ip_addr)

                app = self._make_app(parsed_request)

                return app(environ, start_response)

            except Exception:

                log.error(traceback.format_exc())

                raise webob.exc.HTTPInternalServerError()

        except webob.exc.HTTPException as e:

            return e(environ, start_response)

        finally:

            log_ = logging.getLogger('kallithea.' + self.__class__.__name__)

            log_.debug('Request time: %.3fs', time.time() - start)

            meta.Session.remove()

class BaseController(TGController):

    def _before(self, *args, **kwargs):

        """

        _before is called before controller methods and after __call__

        """

        if request.needs_csrf_check:

            # CSRF protection: Whenever a request has ambient authority (whether

            # through a session cookie or its origin IP address), it must include

            # the correct token, unless the HTTP method is GET or HEAD (and thus

            # guaranteed to be side effect free. In practice, the only situation

            # where we allow side effects without ambient authority is when the

            # authority comes from an API key; and that is handled above.

            token = request.POST.get(secure_form.token_key)

            if not token or token != secure_form.authentication_token():

                log.error('CSRF check failed')

                raise webob.exc.HTTPForbidden()

        c.kallithea_version = __version__

        rc_config = Setting.get_app_settings()

        # Visual options

        c.visual = AttributeDict({})

        ## DB stored

        c.visual.show_public_icon = str2bool(rc_config.get('show_public_icon'))

        c.visual.show_private_icon = str2bool(rc_config.get('show_private_icon'))

        c.visual.stylify_metalabels = str2bool(rc_config.get('stylify_metalabels'))

        c.visual.page_size = safe_int(rc_config.get('dashboard_items', 100))

        c.visual.admin_grid_items = safe_int(rc_config.get('admin_grid_items', 100))

        c.visual.repository_fields = str2bool(rc_config.get('repository_fields'))

        c.visual.show_version = str2bool(rc_config.get('show_version'))

        c.visual.use_gravatar = str2bool(rc_config.get('use_gravatar'))

        c.visual.gravatar_url = rc_config.get('gravatar_url')

        c.ga_code = rc_config.get('ga_code')

        # TODO: replace undocumented backwards compatibility hack with db upgrade and rename ga_code

        if c.ga_code and '<' not in c.ga_code:

            c.ga_code = '''<script type="text/javascript">

                var _gaq = _gaq || [];

                _gaq.push(['_setAccount', '%s']);

                _gaq.push(['_trackPageview']);

                (function() {

                    var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;

                    ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';

                    var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);

                    })();

            </script>''' % c.ga_code

        c.site_name = rc_config.get('title')

        c.clone_uri_tmpl = rc_config.get('clone_uri_tmpl') or Repository.DEFAULT_CLONE_URI

        ## INI stored

        c.visual.allow_repo_location_change = str2bool(config.get('allow_repo_location_change', True))

        c.visual.allow_custom_hooks_settings = str2bool(config.get('allow_custom_hooks_settings', True))

        c.ssh_enabled = str2bool(config.get('ssh_enabled', False))

        c.instance_id = config.get('instance_id')

        c.issues_url = config.get('bugtracker', url('issues_url'))

        # END CONFIG VARS

        c.repo_name = get_repo_slug(request)  # can be empty

        c.backends = BACKENDS.keys()

        self.cut_off_limit = safe_int(config.get('cut_off_limit'))

        c.my_pr_count = PullRequest.query(reviewer_id=request.authuser.user_id, include_closed=False).count()

        self.scm_model = ScmModel()

    @staticmethod

    def _determine_auth_user(session_authuser, ip_addr):

        """

        Create an `AuthUser` object given the API key/bearer token

        (if any) and the value of the authuser session cookie.

        Returns None if no valid user is found (like not active or no access for IP).

        """

        # Authenticate by session cookie

        # In ancient login sessions, 'authuser' may not be a dict.

        # In that case, the user will have to log in again.

        # v0.3 and earlier included an 'is_authenticated' key; if present,

        # this must be True.

        if isinstance(session_authuser, dict) and session_authuser.get('is_authenticated', True):

            return AuthUser.from_cookie(session_authuser, ip_addr=ip_addr)

        # Authenticate by auth_container plugin (if enabled)

        if any(

            plugin.is_container_auth

            for plugin in auth_modules.get_auth_plugins()

        ):

            try:

                user_info = auth_modules.authenticate('', '', request.environ)

            except UserCreationError as e:

                from kallithea.lib import helpers as h

                h.flash(e, 'error', logf=log.error)

            else:

                if user_info is not None:

                    username = user_info['username']

                    user = User.get_by_username(username, case_insensitive=True)

                    return log_in_user(user, remember=False, is_external_auth=True, ip_addr=ip_addr)

        # User is default user (if active) or anonymous

        default_user = User.get_default_user(cache=True)

        authuser = AuthUser.make(dbuser=default_user, ip_addr=ip_addr)

        if authuser is None: # fall back to anonymous

            authuser = AuthUser(dbuser=default_user) # TODO: somehow use .make?

        return authuser

    @staticmethod

    def _basic_security_checks():

        """Perform basic security/sanity checks before processing the request."""

        # Only allow the following HTTP request methods.

        if request.method not in ['GET', 'HEAD', 'POST']:

            raise webob.exc.HTTPMethodNotAllowed()

        # Also verify the _method override - no longer allowed.

        if request.params.get('_method') is None: