Merge branch 'develop' of github.com:divio/django-cms into security/t…

…ext-plugin-xss-develop-premerge

Conflicts:
	CHANGELOG.txt
	cms/__init__.py
	cms/tests/security.py
	setup.py
	tests/buildout.cfg

.tx/config

@@ -0,0 +1,13 @@
+[django-cms.js]
+file_filter = cms/locale/<lang>/LC_MESSAGES/djangojs.po
+source_file = cms/locale/en/LC_MESSAGES/djangojs.po
+source_lang = en
+
+[main]
+host = http://www.transifex.net
+
+[django-cms.core]
+file_filter = cms/locale/<lang>/LC_MESSAGES/django.po
+source_file = cms/locale/en/LC_MESSAGES/django.po
+source_lang = en
+

AUTHORS

@@ -1,5 +1,6 @@
 Current or previous core committers:
 
+* Angelo Dini
 * Chris Glass
 * Eric Robitaille
 * Jonas Obrist
@@ -15,9 +16,9 @@ Contributors (in alphabetical order):
 * Aaron Renner
 * aball
 * Adi Sieker
+* Adrián Ribao
 * Alberto Paro
 * Alessandro Ronchi
-* Angelo Dini
 * angular_circle
 * Antoni Aloy López
 * Arne Gellhaus
@@ -36,8 +37,9 @@ Contributors (in alphabetical order):
 * Cheng-Chia Tseng
 * Chris Adams
 * Chris Hughes
+* Chris Wesseling
 * Christof Hagedorn
-* daniele
+* Daniele Procida
 * DaNmarner
 * Darryl Woods
 * David Jean Louis
@@ -48,10 +50,12 @@ Contributors (in alphabetical order):
 * eged
 * Egor V. Nazarkin
 * Ekrem Seren
+* Erik Allik
 * Evandro Miquelito
 * f4nt
 * fcurella
 * Filip Kazimierczak
+* Frank Bieniek
 * GaretJax
 * George Marshall
 * Gerard Świderski
@@ -60,7 +64,7 @@ Contributors (in alphabetical order):
 * Iacopo Spalletti
 * Ian Lewis
 * indexofire
-* Ionel Maries Cristian
+* Ionel Cristian Maries
 * Ivan Vershigora
 * izi
 * Jameel Al-Aziz
@@ -75,7 +79,9 @@ Contributors (in alphabetical order):
 * John-Scott Atlakson
 * Jonathan Stoppani
 * jordanjambazov
+* Jorge Vargas (elpargo)
 * kar1m
+* Keryn Knight
 * kochin
 * Krzysztof Bandurski
 * kunitoki
@@ -84,14 +90,17 @@ Contributors (in alphabetical order):
 * limpbrains :P
 * Lucas Vogelsang
 * Lucio Asnaghi
+* Luke Crooks
 * Luke Plant
 * m000
 * Maik Lustenberger
 * Manolis Stamatogiannakis
 * Manuel Schmidt
+* Marco Bonetti
 * Marco Rimoldi
 * Mark Rogers
 * Martin Bommeli
+* Martin Brochhaus
 * Martin Kosír
 * martinkosir
 * mathijs
@@ -102,6 +111,8 @@ Contributors (in alphabetical order):
 * meers
 * MerLex
 * Mokys
+* Mike Johnson
+* Mitar
 * mrlundis
 * MW
 * neoprolog
@@ -127,8 +138,10 @@ Contributors (in alphabetical order):
 * Rodolfo Carvalho
 * rtpm
 * Samuel Lüscher
+* Scott Barnham
 * sealibora
 * Sean Bleier
+* Seth Buntin
 * Seyhun Akyurek
 * Shatalov Vadim
 * shed
@@ -139,6 +152,7 @@ Contributors (in alphabetical order):
 * spookylukey
 * ssteinerX
 * Stavros Korokithakis
+* Stephan Jaekel
 * Steve R. Jones
 * Steve Steiner
 * Tanel Külaots
@@ -147,12 +161,12 @@ Contributors (in alphabetical order):
 * Tino de Bruijn
 * tiret
 * Ulrich Petri
+* Vasil Vangelovski
 * wangJunjie
 * Wayne Moore
 * wid
 * wildermesser
 * Yann Malet
-* Yann Malet
 * yedpodtrzitko
 * yohanboniface
 * Yosuke Ikeda

CHANGELOG.txt

@@ -55,3 +55,11 @@
 ==== 2.1.4 (2011-08-24) ====
 
 - Fixed a XSS issue in Text Plugins
+
+==== 2.2.0 (In Development) ====
+
+- Replaced the old plugin media framework with django-sekizai. (This changed some plugin templates which might cause problems with your CSS styling).
+- Made django-mptt a proper dependency
+- Removed support for django-dbgettext
+- Google Maps Plugin now defaults to use HTTPS.
+- Google Maps Plugin now uses the version 3 of their API, no longer requiring an API Key.

MANIFEST.in

@@ -4,8 +4,8 @@ include README.rst
 include CHANGELOG.txt
 recursive-include cms/locale *
 recursive-include cms/templates *
-recursive-include cms/media *
+recursive-include cms/static *
 recursive-include cms/plugins *
 recursive-include menus/templates *
-recursive-include mptt/tests/fixtures *.json
 recursive-include docs *
+recursive-exclude * *.pyc

cms/__init__.py

@@ -1,10 +1,5 @@
 # -*- coding: utf-8 -*-
-VERSION = (2, 1, 4, 'final')
-if VERSION[-1] != "final": # pragma: no cover
-    __version__ = '.'.join(map(str, VERSION))
-else: # pragma: no cover
-    __version__ = '.'.join(map(str, VERSION[:-1]))
-
+__version__ = '2.2rc1.post2'
 
 # patch settings 
 try:

cms/admin/change_list.py

@@ -8,7 +8,7 @@
 from django.contrib.admin.views.main import ChangeList, ALL_VAR, IS_POPUP_VAR, \
     ORDER_TYPE_VAR, ORDER_VAR, SEARCH_VAR
 from django.contrib.sites.models import Site
-from menus.utils import find_children
+from mptt.templatetags import mptt_tags
 
 
 
@@ -50,7 +50,7 @@ def get_query_set(self, request=None):
                 self.root_query_set = self.root_query_set.filter(pk__in=permissions)
             self.real_queryset = True
             qs = qs.filter(site=self._current_site)
-        qs = qs.order_by('tree_id', 'parent', 'lft')
+        qs = qs.order_by('tree_id',  'lft')
         return qs
 
     def is_filtered(self):
@@ -75,7 +75,8 @@ def set_items(self, request):
         site = self._current_site
         # Get all the pages, ordered by tree ID (it's convenient to build the 
         # tree using a stack now)
-        pages = self.get_query_set(request).drafts().order_by('tree_id', 'parent', 'lft').select_related()
+        pages = self.get_query_set(request).drafts().order_by('tree_id',  'lft').select_related()
+
 
         # Get lists of page IDs for which the current user has 
         # "permission to..." on the current site. 
@@ -111,13 +112,23 @@ def set_items(self, request):
         ids = []
         root_pages = []
         pages = list(pages)
-        all_pages = pages[:]
+        all_pages = pages[:] # That is, basically, a copy.
         try:
             home_pk = Page.objects.drafts().get_home(self.current_site()).pk
         except NoHomeFound:
-            home_pk = 0    
+            home_pk = 0
+
+        # Make the pages a tree (using MPTT awesomeness).
+        # This is normally a tag filter, but it's really nice in our case too:
+        # It caches children for every page in the list we pass it, so no
+        # further queries are needed.
+
+        mptt_tags.cache_tree_children(pages)
+
         for page in pages:
-            children = []
+
+
+            children = page.get_children()
 
             # note: We are using change_list permission here, because we must
             # display also pages which user must not edit, but he haves a 
@@ -133,7 +144,7 @@ def set_items(self, request):
                 # caching the permissions
                 page.permission_edit_cache = perm_edit_ids == Page.permissions.GRANT_ALL or page.pk in perm_edit_ids
                 page.permission_publish_cache = perm_publish_ids == Page.permissions.GRANT_ALL or page.pk in perm_publish_ids
-                page.permission_advanced_settings_cache = perm_publish_ids == Page.permissions.GRANT_ALL or page.pk in perm_advanced_settings_ids
+                page.permission_advanced_settings_cache = perm_advanced_settings_ids == Page.permissions.GRANT_ALL or page.pk in perm_advanced_settings_ids
                 page.permission_user_cache = request.user
 
             if settings.CMS_MODERATOR:
@@ -155,6 +166,8 @@ def set_items(self, request):
             if page.root_node or self.is_filtered():
                 page.last = True
                 if len(children):
+                    # TODO: WTF!?!
+                    # The last one is not the last... wait, what?
                     children[-1].last = False
                 page.menu_level = 0
                 root_pages.append(page)
@@ -163,10 +176,11 @@ def set_items(self, request):
                 else:
                     page.ancestors_ascending = []
                 page.home_pk_cache = home_pk
-                if not self.is_filtered():
-                    find_children(page, pages, 1000, 1000, [], -1, soft_roots=False, request=request, no_extended=True, to_levels=1000)
-                else:
-                    page.childrens = []
+
+            # childrens is the reverse accessor for the parent foreign key.
+            # We want to set it so the JSTree can display it nicely in admin.
+            # "childrens" is the fully cached version of children.
+            page.childrens = children
 
         # TODO: OPTIMIZE!!
         titles = Title.objects.filter(page__in=ids)

cms/admin/dialog/views.py

@@ -29,7 +29,7 @@ def get_copy_dialog(request, page_id):
     target = get_object_or_404(Page, pk=request.REQUEST['target'])
 
     if not page.has_change_permission(request) or \
-        not target.has_add_permission(request): # pragma: no cover
+            not target.has_add_permission(request): # pragma: no cover
         raise Http404 
 
     context = {