Backport the new testing app.

This transitions the new testing app on master to older releases. This
contains utilities for making it easier to write new unit tests without
the need of slow-to-load fixtures, and adds fixture caching.
Filter inaccessible private review requests from queries.

Review requests that were not private to a user would still show up in
the All Review Requests page and in the /api/review-requests/ API. The
query function wasn't taking into account what should have been visible.

Now, ReviewRequest.objects.public() filters out such review requests if
the user cannot see them.

Many unit tests were added to test for these various combinations.
Prevent access to unjoined groups in the dashboard.

In the dashboard, it's possible to construct a URL to show review
requests for groups that you haven't joined. While normally harmless,
this is problematic for private groups, which should not be accessible.

Now, the only valid groups are those that the user is a member of.
All others will result in a 404.
Backport the new testing app.

This transitions the new testing app on master to older releases. This
contains utilities for making it easier to write new unit tests without
the need of slow-to-load fixtures, and adds fixture caching.
Add ExtensionMiddlewareRunner middleware.

This allows extensions to inject middleware. This is useful for things like
authentication methods which need access to the request.

Testing done:
All tests pass:
Ran 746 tests in 68.571s
OK (SKIP=12)

The skipped tests are all related to perforce, which I don't have installed.
They should be unrelated to my patch.

Reviewed at https://reviews.reviewboard.org/r/4563/
Serialize "service" field in /api/hosting-service-accounts/

The service field wasn't being serialized correctly, which meant that if you
tried to use this resource to get a list of things, you'd get a 500 instead.

Testing done:
Connected a GitHub repo, then $ curl /api/hosting-service-accounts/

Reviewed at https://reviews.reviewboard.org/r/4702/
Merge branch 'release-1.7.x'
Strip off #index_header before starting the diff router.

Backbone's router will turn hashes into URL components. This is a problem for
the diff page, which uses #index_header to jump past the review request
details. I've added some code to strip out the hash before we start Backbone's
history tracking, which fixes the URL.

Testing done:
Loaded /diff/#index_header and saw that the URL changed to /diff/# instead of
/diff/index_header.

Reviewed at https://reviews.reviewboard.org/r/4701/
Fix an error in saving profile

This fixes an error in profile saving, because get_or_create returns a tuple
(object, created).

Testing done: Tested that profile saving works.
Reviewed at https://reviews.reviewboard.org/r/4698/
Fix several access and payload issues with the REST API.

We had a handful of functions that weren't properly checking for valid access.
This only affected installations using local sites and private review requests,
and required knowledge of table IDs, but it was still possible to get access to
some information. This change ensures we have the proper decorators on all
functions (and removes some redundant decorators), and that access permissions
are checked in all cases.

There were also some issues in returning 404 when resources couldn't be
accessed, and a case where the wrong payload was returned. These have been
fixed as well.

This change does affect extensions that provide API resources. They will need
to provide a has_access_permisisons method that returns True if the user should
be able to access the resource. That's no longer going to allow access by
default, as it's now opt-in.
Don't show private review requests or groups on the user page.

The user page was showing the summaries of private review requests and
the names of invite-only groups, which was an information leak. We now
restrict the lists to those that the viewing user may see.
Remove some hacks and quirks from reviewboard javascript.

This change removes a few of our hacks from the Review Board code. There's
still a few in there for IE8 and 9, which I'd like to eliminate, but I haven't
figured out how to do so in a way that won't keep relying on $.browser

Reviewed at https://reviews.reviewboard.org/r/4679/
Tweak the heck out of the repository search box.

The search box had some drawing problems, especially when scrollbars were
visible. I hadn't noticed this during the initial development because OSX.

This change tweaks the heck out of the javascript and CSS to try to make things
draw more reliably. The "Repositories" header is now hidden when the search box
is visible, to make it less likely that things will overlap. I've also tried to
tweak the positioning code to make it work better when scrollbars are present.

This is still not 100% perfect, but I'm about ready to hunt down the box model
spec authors and stab them in the face, so I'm going to leave it here for now.

Testing done:
Played around with this in Chrome, Safari, and Firefox, using a handful of zoom
levels. Turned on scrollbars always and saw that things were improved (though
not perfect).

Reviewed at https://reviews.reviewboard.org/r/4700/
Release Review Board 1.6.19.
Add extra_data support to all comment types.

FileAttachmentComment had an extra_data field and API support for
setting it, which was handy, but this can be handy for other comment
types as well.

This support now exists in BaseComment, and all comment REST API support
has been updated to allow getting and setting it.

While I was at it, I moved some of the common field definitions into
BaseCommentResource, instead of duplicating it in the other base comment
subclasses.
Filter inaccessible private review requests from queries.

Review requests that were not private to a user would still show up in
the All Review Requests page and in the /api/review-requests/ API. The
query function wasn't taking into account what should have been visible.

Now, ReviewRequest.objects.public() filters out such review requests if
the user cannot see them.

Many unit tests were added to test for these various combinations.
Backport HeaderActionHook and HeaderDropdownActionHooks to 1.7.

Cherry-picks 33ed256007 from master, with the one small modification
whereby we use the old-style dropdown.png instead of &#9662; in the
templates. This is for consistency, since that's what 1.7 always
used for the dropdown marker.

Reviewed at https://reviews.reviewboard.org/r/4703/.
Upgrade to LESS 1.4.1

I was hoping this would fix the weirdness with !important but it didn't seem
to. Anyhow, we might as well track the latest for this.
Fix several access and payload issues with the REST API.

We had a handful of functions that weren't properly checking for valid access.
This only affected installations using local sites and private review requests,
and required knowledge of table IDs, but it was still possible to get access to
some information. This change ensures we have the proper decorators on all
functions (and removes some redundant decorators), and that access permissions
are checked in all cases.

There were also some issues in returning 404 when resources couldn't be
accessed, and a case where the wrong payload was returned. These have been
fixed as well.

This change does affect extensions that provide API resources. They will need
to provide a has_access_permisisons method that returns True if the user should
be able to access the resource. That's no longer going to allow access by
default, as it's now opt-in.
Add a new ExtensionResource for Review Board that is localsite aware.

This new ExtensionResource wraps the Djblets ExtensionResource, and
makes it work with Review Board's notion of localsites.

Reviewed at https://reviews.reviewboard.org/r/4660/.