Backport the new testing app.

This transitions the new testing app on master to older releases. This
contains utilities for making it easier to write new unit tests without
the need of slow-to-load fixtures, and adds fixture caching.
Filter inaccessible private review requests from queries.

Review requests that were not private to a user would still show up in
the All Review Requests page and in the /api/review-requests/ API. The
query function wasn't taking into account what should have been visible.

Now, ReviewRequest.objects.public() filters out such review requests if
the user cannot see them.

Many unit tests were added to test for these various combinations.
Prevent access to unjoined groups in the dashboard.

In the dashboard, it's possible to construct a URL to show review
requests for groups that you haven't joined. While normally harmless,
this is problematic for private groups, which should not be accessible.

Now, the only valid groups are those that the user is a member of.
All others will result in a 404.
Fix several access and payload issues with the REST API.

We had a handful of functions that weren't properly checking for valid access.
This only affected installations using local sites and private review requests,
and required knowledge of table IDs, but it was still possible to get access to
some information. This change ensures we have the proper decorators on all
functions (and removes some redundant decorators), and that access permissions
are checked in all cases.

There were also some issues in returning 404 when resources couldn't be
accessed, and a case where the wrong payload was returned. These have been
fixed as well.

This change does affect extensions that provide API resources. They will need
to provide a has_access_permisisons method that returns True if the user should
be able to access the resource. That's no longer going to allow access by
default, as it's now opt-in.
Don't show private review requests or groups on the user page.

The user page was showing the summaries of private review requests and
the names of invite-only groups, which was an information leak. We now
restrict the lists to those that the viewing user may see.
Release Review Board 1.6.19.
Filter inaccessible private review requests from queries.

Review requests that were not private to a user would still show up in
the All Review Requests page and in the /api/review-requests/ API. The
query function wasn't taking into account what should have been visible.

Now, ReviewRequest.objects.public() filters out such review requests if
the user cannot see them.

Many unit tests were added to test for these various combinations.
Backport HeaderActionHook and HeaderDropdownActionHooks to 1.7.

Cherry-picks 33ed256007 from master, with the one small modification
whereby we use the old-style dropdown.png instead of &#9662; in the
templates. This is for consistency, since that's what 1.7 always
used for the dropdown marker.

Reviewed at https://reviews.reviewboard.org/r/4703/.
Upgrade to LESS 1.4.1

I was hoping this would fix the weirdness with !important but it didn't seem
to. Anyhow, we might as well track the latest for this.
Fix several access and payload issues with the REST API.

We had a handful of functions that weren't properly checking for valid access.
This only affected installations using local sites and private review requests,
and required knowledge of table IDs, but it was still possible to get access to
some information. This change ensures we have the proper decorators on all
functions (and removes some redundant decorators), and that access permissions
are checked in all cases.

There were also some issues in returning 404 when resources couldn't be
accessed, and a case where the wrong payload was returned. These have been
fixed as well.

This change does affect extensions that provide API resources. They will need
to provide a has_access_permisisons method that returns True if the user should
be able to access the resource. That's no longer going to allow access by
default, as it's now opt-in.
Add a new ExtensionResource for Review Board that is localsite aware.

This new ExtensionResource wraps the Djblets ExtensionResource, and
makes it work with Review Board's notion of localsites.

Reviewed at https://reviews.reviewboard.org/r/4660/.
Merge branch 'release-1.6.x' into release-1.7.x
Document the markdown review UI.

This reads very much like the existing pages for commenting on diffs and
images.

Testing done: Built html docs and verified that the page looked correct.
Reviewed at https://reviews.reviewboard.org/r/4712/
Release Review Board 1.7.15.
Merge tag 'release-1.7.15' into release-1.7.x
Add a lintian tool for the webapi resources and tests.

This checks our webapi resources and test suites for issues. These
issues include:

* Missing decorators on the handlers
* Missing docstrings
* Missing test methods and suites
* Missing lists of errors for docs
* Missing permission checks

At this point, there's a lot of work to do before we pass all these
tests.
Fix several access and payload issues with the REST API.

We had a handful of functions that weren't properly checking for valid
access. This only affected installations using local sites and private
review requests, and required knowledge of table IDs, but it was still
possible to get access to some information. This change ensures we have
the proper decorators on all functions (and removes some redundant
decorators), and that access permissions are checked in all cases.

There were also some issues in returning 404 when resources couldn't be
accessed, and a case where the wrong payload was returned. These have
been fixed as well.

This change does affect extensions that provide API resources. They will
need to provide a has_access_permisisons method that returns True if the
user should be able to access the resource. That's no longer going to
allow access by default, as it's now opt-in.
Expand our REST API test suite, and simplify the codebase.

This enhances the API test suite to automate a bunch of the common tests
for resources. The standard GET, POST, PUT, DELETE tests that test basic
behavior, with local sites, and without access to local sites have all
been generalized through mixins. Tests for resources that exist as
direct or indirect children of ReviewRequestResource also have
additional tests that test for access when review requests are made
private.

Much of the test suite code has been removed in favor of the new
mixed in tests. An additional 20+ seconds of tests have been added.
Filter inaccessible private review requests from queries.

Review requests that were not private to a user would still show up in
the All Review Requests page and in the /api/review-requests/ API. The
query function wasn't taking into account what should have been visible.

Now, ReviewRequest.objects.public() filters out such review requests if
the user cannot see them.

Many unit tests were added to test for these various combinations.
Prevent access to unjoined groups in the dashboard.

In the dashboard, it's possible to construct a URL to show review
requests for groups that you haven't joined. While normally harmless,
this is problematic for private groups, which should not be accessible.

Now, the only valid groups are those that the user is a member of.
All others will result in a 404.