session.save()

    log.info('user %s is now authenticated and stored in '

             'session, session attrs %s', user.username, cookie)

    # dumps session attrs back to cookie

    session._update_cookie_out()

    return auth_user

class BasicAuth(paste.auth.basic.AuthBasicAuthenticator):

    def __init__(self, realm, authfunc, auth_http_code=None):

        self.realm = realm

        self.authfunc = authfunc

        self._rc_auth_http_code = auth_http_code

    def build_authentication(self):

        head = paste.httpheaders.WWW_AUTHENTICATE.tuples('Basic realm="%s"' % self.realm)

        if self._rc_auth_http_code and self._rc_auth_http_code == '403':

            # return 403 if alternative http return code is specified in

            # Kallithea config

            return paste.httpexceptions.HTTPForbidden(headers=head)

        return paste.httpexceptions.HTTPUnauthorized(headers=head)

    def authenticate(self, environ):

        authorization = paste.httpheaders.AUTHORIZATION(environ)

        if not authorization:

            return self.build_authentication()

        (authmeth, auth) = authorization.split(' ', 1)

        if 'basic' != authmeth.lower():

            return self.build_authentication()

        auth = auth.strip().decode('base64')

        _parts = auth.split(':', 1)

        if len(_parts) == 2:

            username, password = _parts

            if self.authfunc(username, password, environ) is not None:

                return username

        return self.build_authentication()

    __call__ = authenticate

class BaseVCSController(object):

    def __init__(self, application, config):

        self.application = application

        self.config = config

        # base path of repo locations

        self.basepath = self.config['base_path']

        # authenticate this VCS request using the authentication modules

        self.authenticate = BasicAuth('', auth_modules.authenticate,

                                      config.get('auth_ret_code'))

        self.ip_addr = '0.0.0.0'

    def _handle_request(self, environ, start_response):

        raise NotImplementedError()

    def _get_by_id(self, repo_name):

        """

        Gets a special pattern _<ID> from clone url and tries to replace it

        with a repository_name for support of _<ID> permanent URLs

        :param repo_name:

        """

        data = repo_name.split('/')

        if len(data) >= 2:

            from kallithea.lib.utils import get_repo_by_id

            by_id_match = get_repo_by_id(repo_name)

            if by_id_match:

                data[1] = safe_str(by_id_match)

        return '/'.join(data)

    def _invalidate_cache(self, repo_name):

        """

        Sets cache for this repository for invalidation on next access

        :param repo_name: full repo name, also a cache key

        """

        ScmModel().mark_for_invalidation(repo_name)

    def _check_permission(self, action, user, repo_name, ip_addr=None):

        """

        Checks permissions using action (push/pull) user and repository

        name

        :param action: push or pull action

        :param user: `User` instance

        :param repo_name: repository name

        """

        # check IP

        ip_allowed = AuthUser.check_ip_allowed(user, ip_addr)

        if ip_allowed:

            log.info('Access for IP:%s allowed', ip_addr)

        else:

            return False

        if action == 'push':

            if not HasPermissionAnyMiddleware('repository.write',

                                              'repository.admin')(user,

                                                                  repo_name):

                return False

        else:

            #any other action need at least read permission

            if not HasPermissionAnyMiddleware('repository.read',

                                              'repository.write',

                                              'repository.admin')(user,

                                                                  repo_name):

                return False

        return True

    def _get_ip_addr(self, environ):

        return _get_ip_addr(environ)

    def _check_ssl(self, environ):

        """

        Checks the SSL check flag and returns False if SSL is not present

        and required True otherwise

        """

        #check if we have SSL required  ! if not it's a bad request !

        if str2bool(Ui.get_by_key('push_ssl').ui_value):

            org_proto = environ.get('wsgi._org_proto', environ['wsgi.url_scheme'])

            if org_proto != 'https':

                log.debug('proto is %s and SSL is required BAD REQUEST !',

                          org_proto)

                return False

        return True

    def _check_locking_state(self, environ, action, repo, user_id):

        """

        Checks locking on this repository, if locking is enabled and lock is

        present returns a tuple of make_lock, locked, locked_by.

        make_lock can have 3 states None (do nothing) True, make lock

        False release lock, This value is later propagated to hooks, which

        do the locking. Think about this as signals passed to hooks what to do.

        """

        locked = False  # defines that locked error should be thrown to user

        make_lock = None

        repo = Repository.get_by_repo_name(repo)

        user = User.get(user_id)

        # this is kind of hacky, but due to how mercurial handles client-server

        # server see all operation on changeset; bookmarks, phases and

        # obsolescence marker in different transaction, we don't want to check

        # locking on those

        obsolete_call = environ['QUERY_STRING'] in ['cmd=listkeys',]

        locked_by = repo.locked

        if repo and repo.enable_locking and not obsolete_call:

            if action == 'push':

                #check if it's already locked !, if it is compare users

                user_id, _date = repo.locked

                if user.user_id == user_id:

                    log.debug('Got push from user %s, now unlocking', user)

                    # unlock if we have push from user who locked

                    make_lock = False

                else:

                    # we're not the same user who locked, ban with 423 !

                    locked = True

            if action == 'pull':

                if repo.locked[0] and repo.locked[1]:

                    locked = True

                else:

                    log.debug('Setting lock on repo %s by %s', repo, user)

                    make_lock = True

        else:

            log.debug('Repository %s do not have locking enabled', repo)

        log.debug('FINAL locking values make_lock:%s,locked:%s,locked_by:%s',

                  make_lock, locked, locked_by)

        return make_lock, locked, locked_by

    def __call__(self, environ, start_response):

        start = time.time()

        try:

            return self._handle_request(environ, start_response)

        finally:

            log = logging.getLogger('kallithea.' + self.__class__.__name__)

            log.debug('Request time: %.3fs', time.time() - start)

            meta.Session.remove()

class BaseController(WSGIController):

    def __before__(self):

        """

        __before__ is called before controller methods and after __call__

        """

        c.kallithea_version = __version__

        rc_config = Setting.get_app_settings()

        # Visual options

        c.visual = AttributeDict({})

        ## DB stored

        c.visual.show_public_icon = str2bool(rc_config.get('show_public_icon'))

        c.visual.show_private_icon = str2bool(rc_config.get('show_private_icon'))

        c.visual.stylify_metatags = str2bool(rc_config.get('stylify_metatags'))

        c.visual.dashboard_items = safe_int(rc_config.get('dashboard_items', 100))

        c.visual.admin_grid_items = safe_int(rc_config.get('admin_grid_items', 100))

        c.visual.repository_fields = str2bool(rc_config.get('repository_fields'))

        c.visual.show_version = str2bool(rc_config.get('show_version'))

        c.visual.use_gravatar = str2bool(rc_config.get('use_gravatar'))

        c.visual.gravatar_url = rc_config.get('gravatar_url')

        c.ga_code = rc_config.get('ga_code')

        # TODO: replace undocumented backwards compatibility hack with db upgrade and rename ga_code

        if c.ga_code and '<' not in c.ga_code:

            c.ga_code = '''<script type="text/javascript">

                var _gaq = _gaq || [];

                _gaq.push(['_setAccount', '%s']);

                _gaq.push(['_trackPageview']);

                (function() {

                    var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;

                    ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';

                    var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);

                    })();

            </script>''' % c.ga_code

        c.site_name = rc_config.get('title')

        c.clone_uri_tmpl = rc_config.get('clone_uri_tmpl')

        ## INI stored

        c.visual.allow_repo_location_change = str2bool(config.get('allow_repo_location_change', True))

        c.visual.allow_custom_hooks_settings = str2bool(config.get('allow_custom_hooks_settings', True))

        c.instance_id = config.get('instance_id')

        c.issues_url = config.get('bugtracker', url('issues_url'))

        # END CONFIG VARS

        c.repo_name = get_repo_slug(request)  # can be empty

        c.backends = BACKENDS.keys()

        c.unread_notifications = NotificationModel()\

                        .get_unread_cnt_for_user(c.authuser.user_id)

        self.cut_off_limit = safe_int(config.get('cut_off_limit'))

        c.my_pr_count = PullRequestModel().get_pullrequest_cnt_for_user(c.authuser.user_id)

        self.sa = meta.Session

        self.scm_model = ScmModel(self.sa)

    @staticmethod

    def _determine_auth_user(api_key, session_authuser):

        """

        Create an `AuthUser` object given the API key (if any) and the

        value of the authuser session cookie.

        """

        # Authenticate by API key

        if api_key:

            # when using API_KEY we are sure user exists.

            return AuthUser(dbuser=User.get_by_api_key(api_key),

                            is_external_auth=True)

        # Authenticate by session cookie

        # In ancient login sessions, 'authuser' may not be a dict.

        # In that case, the user will have to log in again.

        if isinstance(session_authuser, dict):

            try:

                return AuthUser.from_cookie(session_authuser)

            except UserCreationError as e:

                # container auth or other auth functions that create users on

                # the fly can throw UserCreationError to signal issues with

                # user creation. Explanation should be provided in the

                # exception object.

                from kallithea.lib import helpers as h

                h.flash(e, 'error', logf=log.error)

        # Authenticate by auth_container plugin (if enabled)

        if any(

            auth_modules.importplugin(name).is_container_auth

            for name in Setting.get_auth_plugins()

        ):

            try:

                user_info = auth_modules.authenticate('', '', request.environ)

            except UserCreationError as e:

                from kallithea.lib import helpers as h

                h.flash(e, 'error', logf=log.error)

            else:

                if user_info is not None:

                    username = user_info['username']

                    user = User.get_by_username(username, case_insensitive=True)

                    return log_in_user(user, remember=False,

                                       is_external_auth=True)

        # User is anonymous

        return AuthUser()

    def __call__(self, environ, start_response):

        """Invoke the Controller"""

        # WSGIController.__call__ dispatches to the Controller method

        # the request is routed to. This routing information is

        # available in environ['pylons.routes_dict']

        try:

            self.ip_addr = _get_ip_addr(environ)

            # make sure that we update permissions each time we call controller

            #set globals for auth user

            self.authuser = c.authuser = request.user = self._determine_auth_user(

                request.GET.get('api_key'),

                session.get('authuser'),

            )

            log.info('IP: %s User: %s accessed %s',

                self.ip_addr, self.authuser,

                safe_unicode(_get_access_path(environ)),

            )

            return WSGIController.__call__(self, environ, start_response)

        finally:

            meta.Session.remove()

class BaseRepoController(BaseController):

    """

    Base class for controllers responsible for loading all needed data for

    repository loaded items are

    c.db_repo_scm_instance: instance of scm repository

    c.db_repo: instance of db

    c.repository_followers: number of followers

    c.repository_forks: number of forks

    c.repository_following: weather the current user is following the current repo

    """

    def __before__(self):

        super(BaseRepoController, self).__before__()

        if c.repo_name:  # extracted from routes

            _dbr = Repository.get_by_repo_name(c.repo_name)

            if not _dbr:

                return

            log.debug('Found repository in database %s with state `%s`',

                      safe_unicode(_dbr), safe_unicode(_dbr.repo_state))

            route = getattr(request.environ.get('routes.route'), 'name', '')

            # allow to delete repos that are somehow damages in filesystem

            if route in ['delete_repo']:

                return

            if _dbr.repo_state in [Repository.STATE_PENDING]:

                if route in ['repo_creating_home']:

                    return

                check_url = url('repo_creating_home', repo_name=c.repo_name)

                return redirect(check_url)

            dbr = c.db_repo = _dbr

            c.db_repo_scm_instance = c.db_repo.scm_instance

            if c.db_repo_scm_instance is None:

                log.error('%s this repository is present in database but it '

                          'cannot be created as an scm instance', c.repo_name)

                from kallithea.lib import helpers as h

                h.flash(h.literal(_('Repository not found in the filesystem')),

                        category='error')

                raise paste.httpexceptions.HTTPNotFound()

            # some globals counter for menu

            c.repository_followers = self.scm_model.get_followers(dbr)

            c.repository_forks = self.scm_model.get_forks(dbr)

            c.repository_pull_requests = self.scm_model.get_pull_requests(dbr)

            c.repository_following = self.scm_model.is_following_repo(

                                    c.repo_name, self.authuser.user_id)

    @staticmethod

    def _get_ref_rev(repo, ref_type, ref_name, returnempty=False):

        """

        Safe way to get changeset. If error occurs show error.

        """

        from kallithea.lib import helpers as h

        try:

            return repo.scm_instance.get_ref_revision(ref_type, ref_name)

        except EmptyRepositoryError as e:

            if returnempty:

                return repo.scm_instance.EMPTY_CHANGESET

            h.flash(h.literal(_('There are no changesets yet')),

                    category='error')

            raise webob.exc.HTTPNotFound()

        except ChangesetDoesNotExistError as e:

                    category='error')

            raise webob.exc.HTTPNotFound()

        except RepositoryError as e:

            log.error(traceback.format_exc())

            h.flash(safe_str(e), category='error')

            raise webob.exc.HTTPBadRequest()

class WSGIResultCloseCallback(object):

    """Wrap a WSGI result and let close call close after calling the

    close method on the result.

    """

    def __init__(self, result, close):

        self._result = result

        self._close = close

    def __iter__(self):

        return iter(self._result)

    def close(self):

        if hasattr(self._result, 'close'):

            self._result.close()

        self._close()

        # content in the other cell also is wrapped in a div, some browsers in

        # some configurations seem to mess up the formatting...

        if nocls:

            yield 0, ('<table class="%stable">' % self.cssclass +

                      '<tr><td><div class="linenodiv" '

                      'style="background-color: #f0f0f0; padding-right: 10px">'

                      '<pre style="line-height: 125%">' +

                      ls + '</pre></div></td><td id="hlcode" class="code">')

        else:

            yield 0, ('<table class="%stable">' % self.cssclass +

                      '<tr><td class="linenos"><div class="linenodiv"><pre>' +

                      ls + '</pre></div></td><td id="hlcode" class="code">')

        yield 0, dummyoutfile.getvalue()

        yield 0, '</td></tr></table>'

_whitespace_re = re.compile(r'(\t)|( )(?=\n|</div>)')

def _markup_whitespace(m):

    groups = m.groups()

    if groups[0]:

        return '<u>\t</u>'

    if groups[1]:

        return ' <i></i>'

def markup_whitespace(s):

    return _whitespace_re.sub(_markup_whitespace, s)

def pygmentize(filenode, **kwargs):

    """

    pygmentize function using pygments

    :param filenode:

    """

    lexer = get_custom_lexer(filenode.extension) or filenode.lexer

    return literal(markup_whitespace(

        code_highlight(filenode.content, lexer, CodeHtmlFormatter(**kwargs))))

def pygmentize_annotation(repo_name, filenode, **kwargs):

    """

    pygmentize function for annotation

    :param filenode:

    """

    color_dict = {}

    def gen_color(n=10000):

        """generator for getting n of evenly distributed colors using

        hsv color and golden ratio. It always return same order of colors

        :returns: RGB tuple

        """

        def hsv_to_rgb(h, s, v):

            if s == 0.0:

                return v, v, v

            i = int(h * 6.0)  # XXX assume int() truncates!

            f = (h * 6.0) - i

            p = v * (1.0 - s)

            q = v * (1.0 - s * f)

            t = v * (1.0 - s * (1.0 - f))

            i = i % 6

            if i == 0:

                return v, t, p

            if i == 1:

                return q, v, p

            if i == 2:

                return p, v, t

            if i == 3:

                return p, q, v

            if i == 4:

                return t, p, v

            if i == 5:

                return v, p, q

        golden_ratio = 0.618033988749895

        h = 0.22717784590367374

        for _unused in xrange(n):

            h += golden_ratio

            h %= 1

            HSV_tuple = [h, 0.95, 0.95]

            RGB_tuple = hsv_to_rgb(*HSV_tuple)

            yield map(lambda x: str(int(x * 256)), RGB_tuple)

    cgenerator = gen_color()

    def get_color_string(cs):

        if cs in color_dict:

            col = color_dict[cs]

        else:

            col = color_dict[cs] = cgenerator.next()

        return "color: rgb(%s)! important;" % (', '.join(col))

    def url_func(repo_name):

        def _url_func(changeset):

            author = escape(changeset.author)

            date = changeset.date

            message = escape(changeset.message)

            tooltip_html = ("<div style='font-size:0.8em'><b>Author:</b>"

                            " %s<br/><b>Date:</b> %s</b><br/><b>Message:"

                            "</b> %s<br/></div>") % (author, date, message)

            lnk_format = show_id(changeset)

            uri = link_to(

                    lnk_format,

                    url('changeset_home', repo_name=repo_name,

                        revision=changeset.raw_id),

                    style=get_color_string(changeset.raw_id),

                    class_='tooltip safe-html-title',

                    title=tooltip_html

                  )

            uri += '\n'

            return uri

        return _url_func

    return literal(markup_whitespace(annotate_highlight(filenode, url_func(repo_name), **kwargs)))

def is_following_repo(repo_name, user_id):

    from kallithea.model.scm import ScmModel

    return ScmModel().is_following_repo(repo_name, user_id)

class _Message(object):

    """A message returned by ``Flash.pop_messages()``.

    Converting the message to a string returns the message text. Instances

    also have the following attributes:

    * ``message``: the message text.

    * ``category``: the category specified when the message was created.

    """

    def __init__(self, category, message):

        self.category = category

        self.message = message

    def __str__(self):

        return self.message

    __unicode__ = __str__

    def __html__(self):

        return escape(safe_unicode(self.message))

class Flash(_Flash):

    def __call__(self, message, category=None, ignore_duplicate=False, logf=None):

        """

        Show a message to the user _and_ log it through the specified function

        category: notice (default), warning, error, success

        logf: a custom log function - such as log.debug

        logf defaults to log.info, unless category equals 'success', in which

        case logf defaults to log.debug.

        """

        if logf is None:

            logf = log.info

            if category == 'success':

                logf = log.debug

        logf('Flash %s: %s', category, message)

        super(Flash, self).__call__(message, category, ignore_duplicate)

    def pop_messages(self):

        """Return all accumulated messages and delete them from the session.

        The return value is a list of ``Message`` objects.

        """

        from pylons import session

        messages = session.pop(self.session_key, [])

        session.save()

        return [_Message(*m) for m in messages]

flash = Flash()

#==============================================================================

# SCM FILTERS available via h.

#==============================================================================

from kallithea.lib.vcs.utils import author_name, author_email

from kallithea.lib.utils2 import credentials_filter, age as _age

from kallithea.model.db import User, ChangesetStatus, PullRequest

age = lambda  x, y=False: _age(x, y)

capitalize = lambda x: x.capitalize()

email = author_email

short_id = lambda x: x[:12]

hide_credentials = lambda x: ''.join(credentials_filter(x))

def show_id(cs):

    """

    Configurable function that shows ID

    by default it's r123:fffeeefffeee

    :param cs: changeset instance

    """

    from kallithea import CONFIG

    def_len = safe_int(CONFIG.get('show_sha_length', 12))

    show_rev = str2bool(CONFIG.get('show_revision_number', False))

    raw_id = cs.raw_id[:def_len]

    if show_rev:

        return 'r%s:%s' % (cs.revision, raw_id)

    else:

        return raw_id

def fmt_date(date):

    if date:

        return date.strftime("%Y-%m-%d %H:%M:%S").decode('utf8')

    return ""

def is_git(repository):

    if hasattr(repository, 'alias'):

        _type = repository.alias

    elif hasattr(repository, 'repo_type'):

        _type = repository.repo_type

    else:

        _type = repository

    return _type == 'git'

def is_hg(repository):

    if hasattr(repository, 'alias'):

        _type = repository.alias

    elif hasattr(repository, 'repo_type'):

        _type = repository.repo_type

    else:

        _type = repository

    return _type == 'hg'

def user_or_none(author):

    email = author_email(author)

    if email:

        user = User.get_by_email(email, case_insensitive=True, cache=True)

        if user is not None:

            return user

    user = User.get_by_username(author_name(author), case_insensitive=True, cache=True)

    if user is not None:

        return user

    return None

def email_or_none(author):

    if not author:

        return None

    user = user_or_none(author)

    if user is not None:

        return user.email # always use main email address - not necessarily the one used to find user

    # extract email from the commit string

    email = author_email(author)

    if email:

        return email

    # No valid email, not a valid user in the system, none!

    return None

def person(author, show_attr="username"):

    """Find the user identified by 'author', return one of the users attributes,

    default to the username attribute, None if there is no user"""

    # attr to return from fetched user

    person_getter = lambda usr: getattr(usr, show_attr)

    # if author is already an instance use it for extraction

    if isinstance(author, User):

        return person_getter(author)

    user = user_or_none(author)

    if user is not None:

        return person_getter(user)

    # Still nothing?  Just pass back the author name if any, else the email

    return author_name(author) or email(author)

def person_by_id(id_, show_attr="username"):

    # attr to return from fetched user

    person_getter = lambda usr: getattr(usr, show_attr)

    #maybe it's an ID ?

    if str(id_).isdigit() or isinstance(id_, int):

        id_ = int(id_)

        user = User.get(id_)

        if user is not None:

            return person_getter(user)

    return id_

def desc_stylize(value):

    """

    converts tags from value into html equivalent

    :param value:

    """

    if not value:

        return ''

    value = re.sub(r'\[see\ \=>\ *([a-zA-Z0-9\/\=\?\&\ \:\/\.\-]*)\]',

                   '<div class="metatag" tag="see">see =&gt; \\1 </div>', value)

    value = re.sub(r'\[license\ \=>\ *([a-zA-Z0-9\/\=\?\&\ \:\/\.\-]*)\]',

                   '<div class="metatag" tag="license"><a href="http:\/\/www.opensource.org/licenses/\\1">\\1</a></div>', value)

    value = re.sub(r'\[(requires|recommends|conflicts|base)\ \=>\ *([a-zA-Z0-9\-\/]*)\]',

                   '<div class="metatag" tag="\\1">\\1 =&gt; <a href="/\\2">\\2</a></div>', value)

    value = re.sub(r'\[(lang|language)\ \=>\ *([a-zA-Z\-\/\#\+]*)\]',

                   '<div class="metatag" tag="lang">\\2</div>', value)

    value = re.sub(r'\[([a-z]+)\]',

                  '<div class="metatag" tag="\\1">\\1</div>', value)

    return value

def boolicon(value):

    """Returns boolean value of a value, represented as small html image of true/false

    icons

    :param value: value

    """

    if value:

        return HTML.tag('i', class_="icon-ok")

    else:

        return HTML.tag('i', class_="icon-minus-circled")

def action_parser(user_log, feed=False, parse_cs=False):

    """

    This helper will action_map the specified string action into translated

    fancy names with icons and links

    :param user_log: user log instance

    :param feed: use output for feeds (no html and fancy icons)

    :param parse_cs: parse Changesets into VCS instances

    """

    action = user_log.action

    action_params = ' '

    x = action.split(':')

    if len(x) > 1:

        action, action_params = x

    def get_cs_links():

        revs_limit = 3  # display this amount always

        revs_top_limit = 50  # show upto this amount of changesets hidden

        revs_ids = action_params.split(',')

        deleted = user_log.repository is None

        if deleted:

            return ','.join(revs_ids)

        repo_name = user_log.repository.repo_name

        def lnk(rev, repo_name):

            lazy_cs = False

            title_ = None

            url_ = '#'

            if isinstance(rev, BaseChangeset) or isinstance(rev, AttributeDict):

                if rev.op and rev.ref_name:

                    if rev.op == 'delete_branch':

                        lbl = _('Deleted branch: %s') % rev.ref_name

                    elif rev.op == 'tag':

                        lbl = _('Created tag: %s') % rev.ref_name

                    else:

                        lbl = 'Unknown operation %s' % rev.op

                else:

                    lazy_cs = True

                    lbl = rev.short_id[:8]

                    url_ = url('changeset_home', repo_name=repo_name,

                               revision=rev.raw_id)

            else:

                # changeset cannot be found - it might have been stripped or removed

                lbl = rev[:12]

            if parse_cs:

                return link_to(lbl, url_, title=title_, class_='tooltip')

            return link_to(lbl, url_, raw_id=rev.raw_id, repo_name=repo_name,

                           class_='lazy-cs' if lazy_cs else '')

        def _get_op(rev_txt):

            _op = None

            _name = rev_txt

            if len(rev_txt.split('=>')) == 2:

                _op, _name = rev_txt.split('=>')

            return _op, _name

        revs = []

        if len(filter(lambda v: v != '', revs_ids)) > 0:

            repo = None

            for rev in revs_ids[:revs_top_limit]:

                _op, _name = _get_op(rev)

                # we want parsed changesets, or new log store format is bad

                if parse_cs:

                    try:

                        if repo is None:

                            repo = user_log.repository.scm_instance

                        _rev = repo.get_changeset(rev)

                        revs.append(_rev)

                    except ChangesetDoesNotExistError:

                        log.error('cannot find revision %s in this repo', rev)

                        revs.append(rev)

                else:

                    _rev = AttributeDict({

                        'short_id': rev[:12],

                        'raw_id': rev,

                        'message': '',

                        'op': _op,

                        'ref_name': _name

                    })

                    revs.append(_rev)

        cs_links = [" " + ', '.join(

            [lnk(rev, repo_name) for rev in revs[:revs_limit]]

        )]

        _op1, _name1 = _get_op(revs_ids[0])

        _op2, _name2 = _get_op(revs_ids[-1])

        _rev = '%s...%s' % (_name1, _name2)

        compare_view = (

            ' <div class="compare_view tooltip" title="%s">'

            '<a href="%s">%s</a> </div>' % (

                _('Show all combined changesets %s->%s') % (

                    revs_ids[0][:12], revs_ids[-1][:12]

                ),

                url('changeset_home', repo_name=repo_name,

                    revision=_rev

                ),

                _('Compare view')

            )

        )

        # if we have exactly one more than normally displayed

        # just display it, takes less space than displaying

        # "and 1 more revisions"

        if len(revs_ids) == revs_limit + 1:

            cs_links.append(", " + lnk(revs[revs_limit], repo_name))

        # hidden-by-default ones

        if len(revs_ids) > revs_limit + 1:

            uniq_id = revs_ids[0]

            html_tmpl = (

                '<span> %s <a class="show_more" id="_%s" '

                'href="#more">%s</a> %s</span>'

            )

            if not feed:

                cs_links.append(html_tmpl % (

                      _('and'),

                      uniq_id, _('%s more') % (len(revs_ids) - revs_limit),

                      _('revisions')