Add a differential.createinline method to Conduit

Summary: a silly thing because I was bored

Test Plan: and I said "arc call-conduit", and there were comments

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Maniphest Tasks: T1500

Differential Revision: https://secure.phabricator.com/D2971
Fix path autocomplete

Summary: Paths autocompleter sometimes omits `/`.

Test Plan:
# Go to https://secure.phabricator.com/owners/new/.
# Write `/specs/h` to path.
# Delete the second slash resulting in `/specsh`.
# Don't find `/specshistorytest.html` in autocomplete.

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D2981
[easy] Add limit param to recent commits

Summary: as title

Test Plan: https://phabricator.fb.com/conduit/method/diffusion.getrecentcommitsbypath/

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D2838
Highlight .divinerconfig as JavaScript

Test Plan: Displayed `.arcconfig` and verified that it is still highlighted.

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D2987
Centralize rendering of application mail bodies

Summary: This is a minor quality-of-life improvement to prevent D2968 from being as nasty as it is.

Test Plan: Ran unit tests; generated Differential, Maniphest and Diffusion emails and verified the bodies looked sensible.

Reviewers: btrahan, vrana

Reviewed By: vrana

CC: aran

Maniphest Tasks: T931

Differential Revision: https://secure.phabricator.com/D2986
Allow noncritical blocks in email bodies to be disabled via config

Summary:
See T931. LLVM users would also prefer simpler mail, and have similarly harsh opinions about the current state of affairs.

Allow installs to disable the hint blocks if they don't want them.

Test Plan: Sent myself mail with these settings on/off, got mail with/without the blocks.

Reviewers: btrahan, vrana

Reviewed By: vrana

CC: aran

Maniphest Tasks: T931

Differential Revision: https://secure.phabricator.com/D2968
'phd status' should exit with non-zero if daemons are not running.

'phd status' may be invoked by tools (such as puppet) which need to make
automated decisions about whether to start/restart the daemon. To enable this,
'phd status' now exits with 0 if all daemons are running, 1 if no daemons are
running, and 2 if some (but not all) daemons are running.
Retain pid files for dead daemons in 'phd status'.

'phd status' should have a stable result when invoked multiple times.
Automatically removing PID files for dead daemons every time 'phd status' is
invoked prevents tools from noticing that a daemon has died if something
happens to invoke 'phd status' before the tool looks. This affects Puppet
noticably, since it probably runs the status command every half hour.
Improve `differential.createinline`

Summary:
  - Share code between `createinline` and `getcomments`
  - Make them both extend the base class.
  - Sync up the parameters (this is more or less nonbreaking since the call is ~6 hours old).

Test Plan: Created and fetched inlines via the API.

Reviewers: alanh, vrana, btrahan

Reviewed By: vrana

CC: aran

Maniphest Tasks: T1500

Differential Revision: https://secure.phabricator.com/D2988
Add "stop on redirect" and "always profile" debugging options

Summary:
Currently, it's hard to debug performance issues on POST pages. Add flags to stop redirects and always collect profiles.

Also fix an issue with "all" profiles. This feature is mostly just for profiling DarkConsole itself and is rarely used, I think it's been broken for some time. There's no way to get to it with the UI.

NOTE: Some JS workflows don't stop on redirect because they use JS/AJAX redirects.

Test Plan: Enabled options, browsed, got stopped on redirects and had profiles generated. Disabled options and verified redirects and profiles work normally.

Reviewers: vrana, btrahan

Reviewed By: vrana

CC: aran

Differential Revision: https://secure.phabricator.com/D2990
Use OpaqueEnvelopes for all passwords in Phabricator

Summary:
See D2991 / T1526. Two major changes here:

  - PHP just straight-up logs passwords on ldap_bind() failures. Suppress that with "@" and keep them out of DarkConsole by enabling discard mode.
  - Use PhutilOpaqueEnvelope whenever we send a password into a call stack.

Test Plan:
  - Created a new account.
  - Reset password.
  - Changed password.
  - Logged in with valid password.
  - Tried to login with bad password.
  - Changed password via accountadmin.
  - Hit various LDAP errors and made sure nothing appears in the logs.

Reviewers: vrana, btrahan

Reviewed By: vrana

CC: aran

Differential Revision: https://secure.phabricator.com/D2993
Mention non-zero exit from 'phd status' in 'phd help'.
Merge pull request #161 from ojacobson/phd-status-exit-status

Use exit statuses to communicate result of 'phd status' to tools
Fix some more ldap issues

Summary:
  - LDAP import needs to use envelopes.
  - Use ldap_sprintf().

Test Plan: Configured an LDAP server. Added an account. Imported it; logged in with it. Tried to login with accounts like ",", etc., got good errors.

Reviewers: vrana, btrahan

Reviewed By: btrahan

CC: aran

Differential Revision: https://secure.phabricator.com/D2995
Make Diffusion view sticky

Summary: Blame can be slow.

Test Plan:
Viewed a file with no preference, saw blame.
Changed view, saw it.
Viewed a file, saw the changed view.
Viewed a file as raw document.

Reviewers: Two9A, epriestley

Reviewed By: epriestley

CC: aran, epriestley, Korvin, btrahan

Maniphest Tasks: T1278

Differential Revision: https://secure.phabricator.com/D3000
Adding 'Secure Browsing' config setting to Facebook OAuth.

Summary: The Graph API exposes a new field, security_settings, which allows applications to see whether a user has enabled Secure Browsing. This diff adds a configuration setting to Phabricator which forces users to have Secure Browsing enabled when logging in via Facebook.

Test Plan: With the configuration setting off, verify that secure browsing does not affect the ability to log in. With the configuration setting on and secure browsing off, verify that the login attempts is rejected. Then verify that the login attempt succeeds when secure browsing is enabled.

Reviewers: epriestley

Reviewed By: epriestley

CC: arice, aran, Korvin

Maniphest Tasks: T1487

Differential Revision: https://secure.phabricator.com/D2964
[easy] add phid to repository.query

Summary:
owners.query returns paths as (repo phid, path). That should
get fixed in some non-breaking way, but for now just add phid to
repository.query so I can support non-E repos.

Would like to sneak this in before tomorrow's push

Test Plan: http://phabricator.mkedia.dev4925.snc6.facebook.com/conduit/method/repository.query/

Reviewers: epriestley, nh, vrana

Reviewed By: nh

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D3001
Merge branch 'master' of github.com:facebook/phabricator
Minor, mask some more sensitive values from DarkConsole.
Send messages with only a CC

Summary: This keeps people in the correct To or CC field on multiplexed messages.

Test Plan:
with multiplexing on, checked that I received an email with me in the CC
field instead of the To field for a diff I'm CC'd on.

Reviewers: epriestley, jungejason, vrana

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D2999