Don't expect the build-media script to be executable.

This changes the setup script to invoke python explicitly, instead of expecting
execute permissions on the build-media script.
Exclude "tests" python package from build.

This should not be installed along with djblets.

Reviewed at https://reviews.reviewboard.org/r/4339/
Document the hard limit on the max-results query parameter.

We cap API requests to 200 results, even if people have passed a higher number
for "max-results". This is still a good idea, but we should document that
limit.

Fixes bug 2662.
Reviewed at http://reviews.reviewboard.org/r/4421/
Add "X-Content-Type-Options: nosniff" header for IE8

This should help prevent IE8 from offering to download API payloads.

Fixes bug 2889.
Reviewed at http://reviews.reviewboard.org/r/4422/
Use named arguments instead of positional ones for i18n purposes.

We don't really localize any of this yet, but xgettext warns about the use of
positional arguments.
Fix compatibility with Python 2.5

Our controlled_subprocess context manager used Popen.kill, which is only
available in Python 2.6. Additionally, os.kill didn't gain windows
compatibility until 2.7, so we're stuck having to do some kind of gross things
to kill the process.

Fixes bug 2935.
Add utilities for the javascript message catalog.

Django has a view for serving a javascript implementation of gettext and a
message catalog for the desired language. This view recomputes everything every
time it's fetched, which is kind of terrible. This change adds some utilities
for caching the data in a way which works like our old media serial did.

Testing done:
Used this in conjunction with some mocked-up javascript i18n files for
different languages and saw it generate and use good cache keys.

Reviewed at https://reviews.reviewboard.org/r/4451/
Use extension package name rather than display name for the media dir.

Extensions have two different "Name" fields--one of which comes from the
packaging, and is often short and ugly, and one of which is defined in the
extension metadata dictionary, and is meant for display to the user. Since the
introduction of the metadata overrides, we were using the latter for the name
of the media dir, when we wanted to be using the former.

Testing done:
Enabled an extension in reviewboard with an overridden "Name" field and saw
that the media directory in htdocs/media/ext was created using the package
name.

Reviewed at https://reviews.reviewboard.org/r/4461/
Require the latest security release of Django 1.4.
Fix an incorrect and now broken unit test.

The recent change to fix the media directory broke a unit test, which
was assuming the broken behavior was correct. It's now been updated to
test against the correct path.
Fix a Python 2.5 compatibility issue with list-siteconfig.

list-siteconfig was trying to import json, which doesn't exist in Python
2.5. It now uses simplejson from Django.
Release Djblets 0.7.17.
Add an API-specific 404 handler.

URLs within the /api/ tree that return 404 end up returning the full HTML 404,
rather than an API error code. This is kind of crummy, especially when using
the python API bindings. This change adds a catch-all handler at the end of the
URL patterns to return the API error code.

Testing done:
curl http://127.0.0.1:8080/notfound/
curl http://127.0.0.1:8080/api/notfound/

Fixes bug 3052.
Reviewed at https://reviews.reviewboard.org/r/4464/
Give the inlineEditor widget a "raw value" option.

When we use the inline editor today, we take the contents of whichever element
is set, strip out any HTML formatting (like links that we may have inserted),
and then set that as the contents of the input widget. This is insufficient if
we want to do things like format things with markdown.

This change adds a couple options, hasRawValue and rawValue, to the widget. If
these are not set, everything works as before. If hasRawValue is true, the
contents of the rawValue option are used as the source text, rather than
calling .text() on the element and stripping it.

Testing done:
Used this with both raw-value and normal inline editors. Saw that my original
text was visible in the former, even after markdown changed things a lot, and
that the latter behaved as before.

Reviewed at https://reviews.reviewboard.org/r/4484/
For edit icons on inline editors, use CSS visibility instead of display.

We try to use CSS min-height on the labels for inline editors to keep them the
same height when the edit icon disappears, which works for the most part,
except many browsers think that the text baseline moves, which still makes the
text jump by a pixel or two.

This change alters our javascript to manipulate the visibility parameter of the
icon rather than just calling .show() and .hide(), which retains space for the
element on the page.

Testing done:
Opened and closed a bunch of inline editors and saw it be silky smooth.

Reviewed at https://reviews.reviewboard.org/r/4503/
Add an option to inlineEditor to prevent the height-matching behavior.

In cases where we're rendering rich text formats like markdown, it's often that
the height of the raw text won't match the height of the rendered element.
Rather than try to do this matching and have it make the editor (often
significantly) too big, always autosize it to fit the source text.

By default, this will animate to the target size, which makes it seem just as
smooth as before. It's only if people have disabled animation that it will seem
jumpy.

Testing done:
Tested opening and closing the editor for various blocks of text. In
particular, I tested the empty case (animate to minimum size) and the case
where I had a big block of markdown text that rendered significantly larger
than the text (due to images). In all cases, the text box was sized
appropriately for the contents within, and the transitions were smooth.

Reviewed at https://reviews.reviewboard.org/r/4498/
Include the edit icon width in the single-line width calculation

Without this, we bust our britches. Trivial fix.
Fix access permissions for WebAPIResource.get_list with parent objects.

The list resources didn't do any permissions checking other than the basic
logged-in/local-site checks. This meant that if you had a protected resource
with children, you could get lists of the children even without access to the
parents.

For a concrete example: in Review Board, review requests assigned to an "invite
only group" are visible only to members of that group. If you went to
/api/review-requests/<n>/, you'd get a permission denied, but if you went to
/api/review-requests/<n>/reviews/, you'd get a list of all the reviews on it.

Testing done: Added a unit test to the review board test suite for this case.
Reviewed at https://reviews.reviewboard.org/r/4557/
Require Django 1.4.8 at a minimum.

This release has some important security updates that affect all users
of the auth module.
Release Djblets 0.7.18.