release: Merge stable into default

.release.cfg

@@ -1,27 +1,30 @@
 [DEFAULT]
 done = false
 
+[task:bump_version]
+done = true
+
+[task:rc_tools_pinned]
+done = true
+
 [task:fixes_on_stable]
 done = true
 
+[task:pip2nix_generated]
+done = true
+
 [task:changelog_updated]
 done = true
 
-[task:nix_dependencies_moved]
-done = true
-
-[task:bump_version]
+[task:generate_api_docs]
 done = true
 
 [task:generate_js_routes]
 done = true
 
-[task:generate_api_docs]
-done = true
-
 [release]
 state = prepared
-version = 3.8.3
+version = 4.1.1
 
 [task:updated_translation]
 

docs/release-notes/release-notes-4.1.1.rst

@@ -0,0 +1,15 @@
+|RCE| 4.1.1 |RNS|
+-----------------
+
+Release Date
+^^^^^^^^^^^^
+
+- 2016-06-14
+
+Fixes
+^^^^^
+
+- security: fixed permissions issues on pyramid auth-plugins views.
+  They no longer raise an internal server error page when accessed unauthorized.
+
+- search: use better ElasticSearch repo filters. (EE only)

docs/release-notes/release-notes.rst

@@ -9,6 +9,7 @@ Release Notes
 .. toctree::
    :maxdepth: 1
 
+   release-notes-4.1.1.rst
    release-notes-4.1.0.rst
    release-notes-4.0.1.rst
    release-notes-4.0.0.rst

pkgs/python-packages.nix

@@ -950,13 +950,13 @@
     };
   };
   python-editor = super.buildPythonPackage {
-    name = "python-editor-1.0";
+    name = "python-editor-1.0.1";
     buildInputs = with self; [];
     doCheck = false;
     propagatedBuildInputs = with self; [];
     src = fetchurl {
-      url = "https://pypi.python.org/packages/f5/d9/01eb441489c8bd2adb33ee4f3aea299a3db531a584cb39c57a0ecf516d9c/python-editor-1.0.tar.gz";
-      md5 = "a5ead611360b17b52507297d8590b4e8";
+      url = "https://pypi.python.org/packages/2b/c0/df7b87d5cf016f82eab3b05cd35f53287c1178ad8c42bfb6fa61b89b22f6/python-editor-1.0.1.tar.gz";
+      md5 = "e1fa63535b40e022fa4fd646fd8b511a";
     };
   };
   python-ldap = super.buildPythonPackage {
@@ -1040,7 +1040,7 @@
     };
   };
   rhodecode-enterprise-ce = super.buildPythonPackage {
-    name = "rhodecode-enterprise-ce-4.1.0";
+    name = "rhodecode-enterprise-ce-4.1.1";
     buildInputs = with self; [WebTest configobj cssselect flake8 lxml mock pytest pytest-cov pytest-runner];
     doCheck = true;
     propagatedBuildInputs = with self; [Babel Beaker FormEncode Mako Markdown MarkupSafe MySQL-python Paste PasteDeploy PasteScript Pygments Pylons Pyro4 Routes SQLAlchemy Tempita URLObject WebError WebHelpers WebHelpers2 WebOb WebTest Whoosh alembic amqplib anyjson appenlight-client authomatic backport-ipaddress celery colander decorator docutils gunicorn infrae.cache ipython iso8601 kombu msgpack-python packaging psycopg2 pycrypto pycurl pyparsing pyramid pyramid-debugtoolbar pyramid-mako pyramid-beaker pysqlite python-dateutil python-ldap python-memcached python-pam recaptcha-client repoze.lru requests simplejson waitress zope.cachedescriptors psutil py-bcrypt];
@@ -1177,13 +1177,13 @@
     };
   };
   urllib3 = super.buildPythonPackage {
-    name = "urllib3-1.15.1";
+    name = "urllib3-1.16";
     buildInputs = with self; [];
     doCheck = false;
     propagatedBuildInputs = with self; [];
     src = fetchurl {
-      url = "https://pypi.python.org/packages/49/26/a7d12ea00cb4b9fa1e13b5980e5a04a1fe7c477eb8f657ce0b757a7a497d/urllib3-1.15.1.tar.gz";
-      md5 = "5be254b0dbb55d1307ede99e1895c8dd";
+      url = "https://pypi.python.org/packages/3b/f0/e763169124e3f5db0926bc3dbfcd580a105f9ca44cf5d8e6c7a803c9f6b5/urllib3-1.16.tar.gz";
+      md5 = "fcaab1c5385c57deeb7053d3d7d81d59";
     };
   };
   venusian = super.buildPythonPackage {

rhodecode/VERSION

@@ -1 +1 @@
-4.2.0
+4.2.0

rhodecode/authentication/views.py

@@ -44,7 +44,10 @@ class AuthnPluginViewBase(object):
         self.request = request
         self.context = context
         self.plugin = context.plugin
+        self._rhodecode_user = request.user
 
+    @LoginRequired()
+    @HasPermissionAllDecorator('hg.admin')
     def settings_get(self, defaults=None, errors=None):
         """
         View that displays the plugin settings as a form.
@@ -67,6 +70,9 @@ class AuthnPluginViewBase(object):
 
         return template_context
 
+    @LoginRequired()
+    @HasPermissionAllDecorator('hg.admin')
+    @auth.CSRFRequired()
     def settings_post(self):
         """
         View that validates and stores the plugin settings.

rhodecode/login/views.py

@@ -208,6 +208,8 @@ class LoginView(object):
         })
         return render_ctx
 
+    @HasPermissionAnyDecorator(
+        'hg.admin', 'hg.register.auto_activate', 'hg.register.manual_activate')
     @view_config(
         route_name='register', request_method='POST',
         renderer='rhodecode:templates/register.html')