Upgrade lesscss to 1.7.5.

During Review Board 2.0 development, we upgraded to less 1.5.1, which
had some changes we provided to them needed for our extension support.
Many improvements have since gone in that we'd like to take advantage
of.

This change bumps us up to 1.7.5. This is backwards-compatible with
1.5.1, and shouldn't negatively impact any extensions or the site.
Remove an extra console.log() call.

At some point during recent development, a console.log() slipped into the test
suite for the review dialog (presumably to debug a failing test). This isn't
necessary anymore.
Sandbox reviewboard.reviews.ui.ReviewUI

Extensions that create a FileAttachmentReviewUI subclass (using the
ReviewUIHook) can throw exceptions inside Review Board. The parts of Review
Board that call those methods have been sandboxed.

Now when a FileAttachmentReviewUI subclass from an extension throws an
exception, Review Board logs the errors with enough information to find which
method in the FileAttachmentReviewUI subclass threw the exception.

Testing Done:
Unit tests have been written to make sure that functions from an
FileAttachmentReviewUI subclass have been called, and when an exception is
thrown it gets logged.

The tests fail without the sanboxing, and succeed with it.

Reviewed at https://reviews.reviewboard.org/r/6551/
Fix escaping issues with the new Markdown support.

Text normalized for edit worked fine when being injected straight into
JavaScript code using the normalize_text_for_edit template tag, but it
didn't work so well for data-raw-value= attributes, nor did it work for
comment arrays for review UIs/diff viewer.

We now default to HTML-escaping text, and only turn this off in the case
where we're outputting to JavaScript code using the template tag.

This prevents things like &amp; from turning into &, and double quotes
from breaking data attributes.

Unit tests were added to cover the various cases.

Reviewed at https://reviews.reviewboard.org/r/6568/
Fix formatting of reply text with the latest Markdown changes.

The reply code wasn't updated to properly handle plain text or to
correctly render provided HTML. This led to showing tags instead of
rendering those tags, and resulted in the Markdown checkbox doing
nothing.

This updates the reply code to work with the new Markdown changes.

Reviewed at https://reviews.reviewboard.org/r/6566/
Swap the order in which attachments are made inactive.

The code for marking file attachments as inactive would first remove
from the list of active attachments and then add to the list of
inactive attachments. If anything went wrong in-between, the attachment
could go missing.

It might still be bad for an attachment to be in both locations, but at
least now it shouldn't out-right disappear and break things (in the same
way).

Reviewed at https://reviews.reviewboard.org/r/6564/
Fix using the search field to jump to a review request by ID.

In Review Board 1.7.x, it was possible to enter an ID in the search
field and, if search was enabled for that installation, go directly to
the review request page.

The search rewrite in 2.0 lost this ability. This change adds it back
through the same mechanism.

We probably want to support this functionality directly in the quick
search widget in the future, so that it would work without having to
have full-on search enabled. In the meantime, however, this at least
fixes this particular regression.

It's also worth noting that in 1.7.x, this was broken with Local Sites,
as it tried to use database IDs and not display IDs. This is fixed
properly for 2.0.

Reviewed at https://reviews.reviewboard.org/r/6565/
Merge branch 'release-2.0.x'
Bullet-proof change descriptions with deleted file attachments.

Because of the ways that file attachments and change descriptions are stored,
it's possible to delete a file attachment from the database but still have its
old pk referenced from the change description. In this case, trying to render
that change description would crash because it no longer exists.

This change adds some bullet-proofing to ensure that we don't show a traceback.

Testing done:
Ran unit tests.

Reviewed at https://reviews.reviewboard.org/r/6563/
Only show diff expansion links in review comments.

Add the `show_controls` parameter to `build_diff_fragments` which determines if
expansion controls should be shown for the diff fragments. This parameter
defaults to `False`.

The `comment_diff_fragments` view sets this `show_controls` parameter to `True`
if and only if it is showing the fragments in a review and not the edit review
	dialog.

Testing Done:
Tested on local server:

 - Review comments contain expansion links.
 - Edit review dialog does not contain expansion links.
 - Emails do not contain expansion links.

Reviewed at https://reviews.reviewboard.org/r/6567/
Fix problems when adding invalid users to target_people via the API.

When doing a PUT on the ReviewRequestDraftResource, if find_user() returned
None, that would be added to the relation, generating a database error and
aborting the transaction. In production this worked OK but it didn't from the
API unit tests.

Now, after find_user() is called the return value is tested; if None then it
throws an ObjectDoesNotExist exception and skips getting added to the database.
In update() it checks for invalid_fields, which will contain target_people if
no user was found and returns a webAPI error of INVALID_FORM_DATA. So the HTTP
response gives an informative error, and None never gets added to the database.

Testing Done:
The unit test asserts that find_user() returns null, then checks that
find_user() is called, checks the response code for 105 (INVALID_FORM_DATA),
and that there is no TransactionManagmentError thrown by the database.

Reviewed at https://reviews.reviewboard.org/r/6559/
Merge branch 'release-2.0.x'
Fix a language-o I introduced.

Appending to a list in python uses "append", rather than "push". Ah, the life
of a polyglot.
Merge branch 'release-2.0.x'
Sandbox reviewboard.accounts.AuthBackend

Poorly-written AuthBackend implementations provided by extensions could
theoretically break parts of Review Board. While a number of the AuthBackend
calls are done from Django (and therefore can't be changed), there are several
Review Board-specific features that can be wrapped with sandboxing.

Now when an AuthBackend subclass from an extension throws an exception, Review
Board logs the errors with enough information to find which method in the
AuthBackend subclass threw the exception.

Testing Done:
Unit tests have been written to make sure that functions from an AuthBackend
subclass have been called, and when an exception is thrown it gets logged.

The tests fail without the sanboxing, and succeed with it.

Reviewed at https://reviews.reviewboard.org/r/6399/
Fix fetching commits by branch on GitHub.

When I fixed filtering of SVN commits by branch, several versions
ago, I broke filtering by branch on GitHub.

The New Review Request page was no longer passing the starting SHA,
which GitHub needed, resulting in all commits being returned. This call
has been fixed.

It's worth noting that the GitHub API allows for filtering by branch,
but you can't both use that and SHAs for pagination. The SHA is good
enough, if provided, so we'll continue to use that, falling back on a
branch if only a branch is provided. The code has been updated with
documentation to cover this.

Reviewed at https://reviews.reviewboard.org/r/6575/
Merge branch 'release-2.0.x'