Add Frederik Braun as the reporter for CVE-2013-4409.

This was, unfortunately, missing from our release notes. I've added him
and given credit for finding and fixing the problem.
Merge branch 'release-1.7.x'
Move the FileDiffData insert/delete line counts into extra_data.

This replaces the insert/delete line count fields with entries in a new
extra_data field. These count fields were introduced in 2.0 beta, and
long-term, we may want additional metadata around diff data, so it's a
good time to replace them.

This will introduce another potentially long evolution, given that there
may be a lot of entries in the database. However, it'll help prevent
long evolutions in the future, and won't be any longer for users who
upgrade from 1.7.x or earlier (since either way, they'll need to evolve
this table). Might actually be faster, since there's only one column to
add.
Factor out all common request fields for comment API resources.

There's a number of fields that are common between all the comment
resources' create/update requests. In order to reduce code duplication
and to make it easier to add or change these lists, I've pulled out
these common fields into a set of variables in BaseCommentResource that
can be reused.
Add baselines for unique_together for Django Evolution 0.7.

unique_together changed were ignored by Django Evolution in the past,
but that's no longer the case with 0.7. However, projects do need to
establish a baseline for unique_together now, to get the database back
in sync with the evolution signatures.

This adds a ChangeMeta for every unique_together we use, in order to
establish that baseline.
Update to CodeMirror 1.20, and enable auto-continuation of lists.

This updates CodeMirror to 1.20, which has some fixes for lists in
Markdown (in particular, bullet points at the beginning of a list
sometimes turning into emphasis).

It also enables auto-continuation of lists. For example, starting a line
with "* blah" and hitting enter will start the next line off with a new
list item. This works for ordered and unordered lists.
Fix a breakage in move detection when moving from the end of a file.

The move detection logic tries a look-ahead for a blank line on the
source range, which assumed there would be a line following that range.
That's not true when moving the very last lines in a file, though.

This change only does the look-ahead if there is a line to look ahead
at.
Remove ancient SQL index creation files.

We had these files from way back when Django didn't auto-create indexes
for us for Many-to-Many through tables. Now, MySQL's warning about these
whenever Django tries to apply them, so it's time to get rid of them.
Improve the usefulness of the user info box.

The user info box has always been less useful than it should be. It was
scared of mouse pointers, meaning it would disappear as soon as you
moved your mouse onto it, making it impossible to select e-mail
addresses.

Now it's possible to move the mouse onto the infobox and click the
username (going to their profile page) or the e-mail address (which is a
valid mail link).

The box will fade out once the mouse moves off the box, after a small
delay. It also fades in much faster now.
Fix Subversion repositories on hosting services.

The Subversion code expects to be able to access Subversion repositories
directly. This works fine, except when accessing through a hosting
service and needing a login/password. The Subversion code expects
repository.username and repository.password to be filled in.

There's now a Repository.get_credentials() function that fetches the
username/password from either the repository or the hosting service (if
it otherwise stores the password). This allows the Subversion support to
log in appropriately.

There are other SCMTools that also make use of the username/password, so
I've updated all call sites to use get_credentials. This will allow us
to do stuff like use decrypt_password in a central place in the future.
Add support for the Unfuddle hosting service.

This supports Unfuddle as a hosting service. Unfuddle provides Git and
Subversion hosting.

Unfuddle's pretty straightforward to support. It makes use of HTTP Basic
Auth, and requires base commit IDs for posting.

There's also some improvements to RepositoryForm to provide more data to
the HostingService's authorize and check_repository functions.
The Unfuddle support uses this to do better validation of a repository
and an account, which we should make use of for other services.
Fix a breakage from a whitespace cleanup.

The tabs-to-spaces cleanup I made in my recent svn.py change caused a
statement to be unindented one extra level. This is now fixed.
Merge branch 'release-1.7.x'
Add a condensediffs management command for condensing stored diff data.

Review Board 1.7 introduced deduping of new diffs, but older diffs
remained duplicated in the database. This would add up, particularly
when using parent diffs or when uploading multiple revisions of diffs
containing many files unchanged between revisions.

This introduces a condensediffs command that performs the deduping logic
for all older diffs. This operation is safe to perform while the
database is running, and should be safe to terminate if needed. The
actual logic for all this is in the new FileDiffManager.

Upon completion, the command will display the amount of bytes saved as a
before/after comparison and as a percentage of reduction.

rb-site upgrade will recommend that users run this if they have any
unmigrated data as well.

This will be backported to 1.7.x, after the migrate-on-access code is
backported.
Improve the model and capabilities for rich text in the API.

This updates the rich text support in the API to allow clients to force
text to be of a specific type. There's now a `?force-text-type=` query
parameter that will cause all Markdown-aware fields to be formatted in
the requested way. If passing "plain", then any Markdown escaping will be
unescaped before being returned, and if "markdown", then any plain text
will be escaped.

This can later be expanded. For example, we may add "html" to do the
rendering server-side, further reducing the burden on the client.

In order to be consistent, this also replaces the `rich_text` field in
request and response paylods with `text_type`. For response payloads,
this will show "markdown" or "plain" (instead of True/False), or will
show the forced text mode (if/when a different mode is supported). For
requests, it will accept only "markdown" or "plain".

This is the first half of the change. The second half moves the
JavaScript codebase and templates to make use of the new API changes.
Use the new text_type API, and remove client-side Markdown escaping.

This makes use of the new `?force-text-type` capabilities of the API to
force all requests to come in as Markdown. It also ensures all
appropriate text rendered in the templates are Markdown, meaning that
the JavaScript doesn't have to deal with handling escaping. That greatly
simplifies the Markdown-related logic, removes inconsistencies in
escaping logic, and prevents browser-related issues with Regular
Expressions.
Add multi-select actions and visual improvements to the dashboard.

This is the first big update we've had to the dashboard in some time.

First, it adds support for multiple selection of review requests, and
actions that can be invoked for those that are selected. The actions
right now are limited to closing review requests, but more can be added
down the road.

The action pane appears over the sidebar. It's in a darker color and is
semi-transparent (but only barely). It goes away when no review requests
are selected.

This also makes the dashboard take up the full height of the page
(excluding some padding and the content above it). The rows of entries
scroll now, instead of having to scroll the entire page. With the new
changes to datagrids in Djblets, the rows are able to scroll without
affecting the header, meaning you can always see what column represents
what cell.
Add extra_data fields and API support to a number of objects.

This adds extra_data fields to DiffSet, DiffSetHistory, FileDiff,
ReviewRequest, Group, Review, and ReviewRequestDraft. Along with this,
there's API support for retrieving and modifying extra_data for DiffSet,
FileDiff, ReviewRequest, Group, Review, and ReviewRequestDraft.

This change may impact upgrade times for larger installs, but is
necessary for future expansion.
Fix linking the Djblets static directory in rb-site.

The static directory for Djblets media wasn't being linked in, causing
stale egg directories, breaking the site. We now link it just like the
Review Board static directories.
Remove an unnecessary external image from the review request email.

We use an image for the background of top of the review request table, but it
doesn't add much, and external images in email are annoying.

Testing done: Ran tests. Viewed emails.

Fixes bug 3080.

Reviewed at https://reviews.reviewboard.org/r/5182/