From 8f267a19c491f2cfcf3454b1e73e263fe96fa760 Mon Sep 17 00:00:00 2001
From: mdipierro <massimo.dipierro@gmail.com>
Date: Thu, 13 Sep 2012 14:06:58 -0500
Subject: [PATCH] fixed grid layout again

---
 VERSION                                       |  2 +-
 applications/welcome/languages/it.py          | 29 ++++++++++++++
 applications/welcome/static/css/web2py.css    | 25 ++++--------
 applications/welcome/views/default/index.html |  2 +
 applications/welcome/views/layout.html        |  5 ++-
 gluon/html.py                                 | 10 +++--
 gluon/rewrite.py                              | 18 ++++++---
 gluon/sqlhtml.py                              | 40 ++++++++++++-------
 gluon/tools.py                                |  1 -
 9 files changed, 87 insertions(+), 45 deletions(-)

diff --git a/VERSION b/VERSION
index 9528f6a7..8046f55a 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-Version 2.0.8 (2012-09-13 09:28:40) stable
+Version 2.0.8 (2012-09-13 14:06:52) stable
diff --git a/applications/welcome/languages/it.py b/applications/welcome/languages/it.py
index ad59b34d..fcd9c933 100644
--- a/applications/welcome/languages/it.py
+++ b/applications/welcome/languages/it.py
@@ -1,23 +1,33 @@
 # coding: utf8
 {
+'!=': '!=',
 '!langcode!': 'it',
 '!langname!': 'Italiano',
 '"update" is an optional expression like "field1=\'newvalue\'". You cannot update or delete the results of a JOIN': '"update" è un\'espressione opzionale come "campo1=\'nuovo valore\'". Non si può fare "update" o "delete" dei risultati di un JOIN ',
+'%(nrows)s records found': '%(nrows)s records found',
 '%d seconds ago': '%d seconds ago',
 '%s %%{row} deleted': '%s righe ("record") cancellate',
 '%s %%{row} updated': '%s righe ("record") modificate',
 '%s selected': '%s selezionato',
 '%Y-%m-%d': '%d/%m/%Y',
 '%Y-%m-%d %H:%M:%S': '%d/%m/%Y %H:%M:%S',
+'<': '<',
+'<=': '<=',
+'=': '=',
+'>': '>',
+'>=': '>=',
 '@markmin\x01Number of entries: **%s**': 'Number of entries: **%s**',
 'About': 'About',
 'Access Control': 'Access Control',
+'Add': 'Add',
 'Administrative Interface': 'Administrative Interface',
 'Administrative interface': 'Interfaccia amministrativa',
 'Ajax Recipes': 'Ajax Recipes',
+'And': 'And',
 'appadmin is disabled because insecure channel': 'Amministrazione (appadmin) disabilitata: comunicazione non sicura',
 'Are you sure you want to delete this object?': 'Are you sure you want to delete this object?',
 'Available Databases and Tables': 'Database e tabelle disponibili',
+'Back': 'Back',
 'Buy this book': 'Buy this book',
 'cache': 'cache',
 'Cache': 'Cache',
@@ -26,16 +36,22 @@
 'Change password': 'Change password',
 'change password': 'Cambia password',
 'Check to delete': 'Seleziona per cancellare',
+'Clear': 'Clear',
 'Clear CACHE?': 'Clear CACHE?',
 'Clear DISK': 'Clear DISK',
 'Clear RAM': 'Clear RAM',
 'Client IP': 'Client IP',
+'Close': 'Close',
+'Cognome': 'Cognome',
 'Community': 'Community',
 'Components and Plugins': 'Components and Plugins',
+'contains': 'contains',
 'Controller': 'Controller',
 'Copyright': 'Copyright',
 'Created By': 'Created By',
 'Created On': 'Created On',
+'CSV': 'CSV',
+'CSV (hidden cols)': 'CSV (hidden cols)',
 'Current request': 'Richiesta (request) corrente',
 'Current response': 'Risposta (response) corrente',
 'Current session': 'Sessione (session) corrente',
@@ -67,7 +83,9 @@
 'Email non valida': 'Email non valida',
 'enter an integer between %(min)g and %(max)g': 'enter an integer between %(min)g and %(max)g',
 'Errors': 'Errors',
+'Errors in form, please check it out.': 'Errors in form, please check it out.',
 'export as csv file': 'esporta come file CSV',
+'Export:': 'Export:',
 'FAQ': 'FAQ',
 'First name': 'Nome',
 'Forgot username?': 'Forgot username?',
@@ -83,6 +101,7 @@
 'Hello World in a flash!': 'Salve Mondo in un flash!',
 'Home': 'Home',
 'How did you get here?': 'How did you get here?',
+'HTML': 'HTML',
 'import': 'import',
 'Import/Export': 'Importa/Esporta',
 'Index': 'Indice',
@@ -117,16 +136,20 @@
 'Modified On': 'Modified On',
 'My Sites': 'My Sites',
 'Name': 'Nome',
+'New': 'New',
 'New password': 'New password',
 'New Record': 'Nuovo elemento (record)',
 'new record inserted': 'nuovo record inserito',
 'next 100 rows': 'prossime 100 righe',
 'No databases in this application': 'Nessun database presente in questa applicazione',
+'No records found': 'No records found',
+'Nome': 'Nome',
 'Non può essere vuoto': 'Non può essere vuoto',
 'not authorized': 'non autorizzato',
 'Object or table name': 'Object or table name',
 'Old password': 'Old password',
 'Online examples': 'Vedere gli esempi',
+'Or': 'Or',
 'or import from csv file': 'oppure importa da file CSV',
 'Origin': 'Origine',
 'Other Plugins': 'Other Plugins',
@@ -163,9 +186,11 @@
 'Rows in Table': 'Righe nella tabella',
 'Rows selected': 'Righe selezionate',
 'Save profile': 'Save profile',
+'Search': 'Search',
 'Semantic': 'Semantic',
 'Services': 'Services',
 'Size of cache:': 'Size of cache:',
+'starts with': 'starts with',
 'state': 'stato',
 'Statistics': 'Statistics',
 'Stylesheet': 'Foglio di stile (stylesheet)',
@@ -184,6 +209,8 @@
 'Time in Cache (h:m:s)': 'Time in Cache (h:m:s)',
 'Timestamp': 'Ora (timestamp)',
 'too short': 'too short',
+'TSV (Excel compatible)': 'TSV (Excel compatible)',
+'TSV (Excel compatible, hidden cols)': 'TSV (Excel compatible, hidden cols)',
 'Twitter': 'Twitter',
 'unable to parse csv file': 'non riesco a decodificare questo file CSV',
 'Update': 'Update',
@@ -196,6 +223,7 @@
 'User %(id)s Profile updated': 'User %(id)s Profile updated',
 'User %(id)s Registered': 'User %(id)s Registered',
 'User ID': 'ID Utente',
+'value already in database or empty': 'value already in database or empty',
 'Verify Password': 'Verify Password',
 'Videos': 'Videos',
 'View': 'Vista',
@@ -204,6 +232,7 @@
 'Welcome to web2py': 'Benvenuto su web2py',
 'Welcome to web2py!': 'Welcome to web2py!',
 'Which called the function %s located in the file %s': 'che ha chiamato la funzione %s presente nel file %s',
+'XML': 'XML',
 'You are successfully running web2py': 'Stai eseguendo web2py con successo',
 'You can modify this application and adapt it to your needs': 'Puoi modificare questa applicazione adattandola alle tue necessità',
 'You visited the url %s': "Hai visitato l'URL %s",
diff --git a/applications/welcome/static/css/web2py.css b/applications/welcome/static/css/web2py.css
index 8943432f..f0cdaf63 100644
--- a/applications/welcome/static/css/web2py.css
+++ b/applications/welcome/static/css/web2py.css
@@ -176,19 +176,6 @@ div.error {
 
 /* #MEDIA QUERIES SECTION */
 
-    /* All Mobile Sizes (devices and browser) */
-    @media only screen and (max-width:767px) {
-/* removed because of bootswatch
-        .topbar {text-align:center}
-        #navbar,#menu {float:none}
-        #navbar {font-size:1.2em; padding:.6em 0 1.2em}
-        #menu  {padding:0 0 1.5em}
-        #menu select {font-size:1.2em; margin:0; padding:0}
-
-        div.flash {top:110px; right:10px}
-*/
-   }
-
 /*
 *Grid
 *
@@ -240,7 +227,7 @@ div.error {
     margin:0;
 }
 
-.web2py_search_actions{
+.web2py_search_actions {
     float:left;
     text-align:left;
 }
@@ -264,13 +251,13 @@ div.error {
 .web2py_console input[type=button],
 .web2py_console button {
     line-height:20px;
-    margin-right:5px; display:inline-block;
+    margin-right:2px; display:inline-block;
     padding:3px 5px 3px 5px;
 }
 
 .web2py_counter {
     margin-top:5px;
-    margin-right:5px;
+    margin-right:2px;
     width:35%;
     float:right;
     text-align:right;
@@ -308,7 +295,11 @@ li.w2p_grid_breadcrumb_elem {
     display:inline-block;
 }
 
-.ie9 #query_panel {padding-bottom:2px}
+.web2py_console form { vertical-align: middle; }
+.web2py_console input, .web2py_console select,
+.web2py_console a { margin: 2px; }
+
+.ie9 #w2p_query_panel {padding-bottom:2px}
 
 #wiki_page_body {
    width: 600px;
diff --git a/applications/welcome/views/default/index.html b/applications/welcome/views/default/index.html
index 6e9ab1ff..8e47f8b8 100644
--- a/applications/welcome/views/default/index.html
+++ b/applications/welcome/views/default/index.html
@@ -1,6 +1,8 @@
 {{left_sidebar_enabled,right_sidebar_enabled=False,('message' in globals())}}
 {{extend 'layout.html'}}
 
+{{=SQLFORM.grid(db.auth_user)}}
+
 {{if 'message' in globals():}}
 <h3>{{=message}}</h3>
 
diff --git a/applications/welcome/views/layout.html b/applications/welcome/views/layout.html
index 721d9deb..8747ee79 100644
--- a/applications/welcome/views/layout.html
+++ b/applications/welcome/views/layout.html
@@ -6,6 +6,7 @@
 <!--[if IE 9]><html class="ie9 ie-lte9 no-js" lang="{{=T.accepted_language or 'en'}}"> <![endif]-->
 <!--[if (gt IE 9)|!(IE)]><!--> <html class="no-js" lang="{{=T.accepted_language or 'en'}}"> <!--<![endif]-->
 <head>
+
   <meta charset="utf-8" />
   <!-- www.phpied.com/conditional-comments-block-downloads/ -->
   <!-- Always force latest IE rendering engine
@@ -167,7 +168,9 @@
         });
       }
       jQuery('ul.nav li.dropdown a').click(function(){window.location=jQuery(this).attr('href');});
-    });
+      // make all buttons bootstrap buttons
+      jQuery('button, form input[type="submit"], form input[type="button"]').addClass('btn').css({'margin-right':'2px','margin-bottom':'2px'});
+  });
   </script>
   <script src="{{=URL('static','js/bootstrap.min.js')}}"></script>
   <!--[if lt IE 7 ]>
diff --git a/gluon/html.py b/gluon/html.py
index b267d951..0498c0d5 100644
--- a/gluon/html.py
+++ b/gluon/html.py
@@ -243,7 +243,8 @@ def URL(
         elif a and c and not f: (c,f,a)=(a,c,f)
         from globals import current
         if hasattr(current,'request'):
-            r = current.request
+            r = current.request    
+
     if r:
         application = r.application
         controller = r.controller
@@ -296,10 +297,10 @@ def URL(
     if other.endswith('/'):
         other += '/'    # add trailing slash to make last trailing empty arg explicit
 
-    if '_signature' in vars:
-        vars.pop('_signature')
     list_vars = []
     for (key, vals) in sorted(vars.items()):
+        if key == '_signature':
+            continue
         if not isinstance(vals, (list, tuple)):
             vals = [vals]
         for val in vals:
@@ -347,7 +348,8 @@ def URL(
 
     if regex_crlf.search(join([application, controller, function, other])):
         raise SyntaxError, 'CRLF Injection Detected'
-    url = url_out(r, env, application, controller, function,
+
+    url = url_out(r,env, application, controller, function,
                   args, other, scheme, host, port)
     return url
 
diff --git a/gluon/rewrite.py b/gluon/rewrite.py
index da9f28f0..bd7cd408 100644
--- a/gluon/rewrite.py
+++ b/gluon/rewrite.py
@@ -162,10 +162,12 @@ def url_in(request, environ):
         return map_url_in(request, environ)
     return regex_url_in(request, environ)
 
-def url_out(request, env, application, controller, function, args, other, scheme, host, port):
+def url_out(request, env, application, controller, function, 
+            args, other, scheme, host, port):
     "assemble and rewrite outgoing URL"
     if routers:
-        acf = map_url_out(request, env, application, controller, function, args, other, scheme, host, port)
+        acf = map_url_out(request, env, application, controller,
+                          function, args, other, scheme, host, port)
         url = '%s%s' % (acf, other)
     else:
         url = '/%s/%s/%s%s' % (application, controller, function, other)
@@ -226,7 +228,8 @@ def try_rewrite_on_error(http_response, request, environ, ticket=None):
                     # Rewrite routes_onerror path.
                     path_info = '/' + path_info.lstrip('/') # add leading '/' if missing
                     environ['PATH_INFO'] = path_info
-                    error_handling_path = url_in(request, environ)[1]['PATH_INFO']
+                    error_handling_path = \
+                        url_in(request, environ)[1]['PATH_INFO']
                     # Avoid infinite loop.
                     if error_handling_path != error_raising_path:
                         # wsgibase will be called recursively with the routes_onerror path.
@@ -1122,7 +1125,8 @@ class MapUrlIn(object):
 class MapUrlOut(object):
     "logic for mapping outgoing URLs"
 
-    def __init__(self, request, env, application, controller, function, args, other, scheme, host, port):
+    def __init__(self, request, env, application, controller,
+                 function, args, other, scheme, host, port):
         "initialize a map-out object"
         self.default_application = routers.BASE.default_application
         if application in routers:
@@ -1323,7 +1327,8 @@ def map_url_in(request, env, app=False):
     map.update_request()
     return (None, map.env)
 
-def map_url_out(request, env, application, controller, function, args, other, scheme, host, port):
+def map_url_out(request, env, application, controller,
+                function, args, other, scheme, host, port):
     '''
     supply /a/c/f (or /a/lang/c/f) portion of outgoing url
 
@@ -1349,7 +1354,8 @@ def map_url_out(request, env, application, controller, function, args, other, sc
 
     We assume that language names do not collide with a/c/f names.
     '''
-    map = MapUrlOut(request, env, application, controller, function, args, other, scheme, host, port)
+    map = MapUrlOut(request, env, application, controller,
+                    function, args, other, scheme, host, port)
     return map.acf()
 
 def get_effective_router(appname):
diff --git a/gluon/sqlhtml.py b/gluon/sqlhtml.py
index 94082f68..ead2ac0b 100644
--- a/gluon/sqlhtml.py
+++ b/gluon/sqlhtml.py
@@ -1664,15 +1664,20 @@ class SQLFORM(FORM):
             return URL(**b)
 
         referrer = session.get('_web2py_grid_referrer_'+formname, url())
-        if user_signature:            
-            if ('/'.join(str(a) for a in args) != '/'.join(request.args) and \
-                    user_signature and \
-                    not URL.verify(request,user_signature=user_signature)) or \
-                    (not (session.auth and session.auth.user) and \
-                         ('edit' in request.args or \
-                              'create' in request.args or \
-                              'delete' in request.args)):
-                session.flash = T('not authorized')
+        # if not user_signature every action is accessible
+        # else forbid access unless
+        # - url is based url
+        # - url has valid signature (vars are not signed, only path_info)
+        # = url does not contain 'create','delete','edit' (readonly)
+        if user_signature:
+            if not(
+                '/'.join(str(a) for a in args) == '/'.join(request.args) or
+                URL.verify(request,user_signature=user_signature,
+                           hash_vars=False) or not (
+                    'create' in request.args or
+                    'delete' in request.args or
+                    'edit' in request.args)):
+                session.flash = T('not authorized')                
                 redirect(referrer)
 
         def gridbutton(buttonclass='buttonadd', buttontext='Add',
@@ -1868,6 +1873,16 @@ class SQLFORM(FORM):
         session['_web2py_grid_referrer_'+formname] = url2(vars=request.vars)
         console = DIV(_class='web2py_console %(header)s %(cornertop)s' % ui)
         error = None
+        if create:
+            add = gridbutton(
+                    buttonclass='buttonadd',
+                    buttontext='Add',
+                    buttonurl=url(args=['new',tablename]))
+            if not searchable:
+                console.append(add)
+        else:
+            add = ''
+
         if searchable:
             sfields = reduce(lambda a,b:a+b,
                              [[f for f in t if f.readable] for t in tables])
@@ -1875,7 +1890,7 @@ class SQLFORM(FORM):
                 search_widget = search_widget[tablename]
             if search_widget=='default':
                 search_menu = SQLFORM.search_menu(sfields)
-                search_widget = lambda sfield, url: DIV(FORM(
+                search_widget = lambda sfield, url: CAT(add,FORM(
                     INPUT(_name='keywords',_value=request.vars.keywords,
                           _id='web2py_keywords',_onfocus="jQuery('#w2p_query_fields').change();jQuery('#w2p_query_panel').slideDown();"),
                     INPUT(_type='submit',_value=T('Search'),_class="btn"),
@@ -1895,11 +1910,6 @@ class SQLFORM(FORM):
                 error = T('Invalid query')
         else:
             subquery = None
-        if create:
-            console.append(gridbutton(
-                    buttonclass='buttonadd',
-                    buttontext='Add',
-                    buttonurl=url(args=['new',tablename])))
 
         if subquery:
             dbset = dbset(subquery)
diff --git a/gluon/tools.py b/gluon/tools.py
index 0213e611..dbfb16d8 100644
--- a/gluon/tools.py
+++ b/gluon/tools.py
@@ -1225,7 +1225,6 @@ class Auth(object):
         else:
             next = '?_next=' + urllib.quote(URL(args=request.args,
                                                 vars=request.get_vars))
-
         href = lambda function: '%s/%s%s' % (action, function,
             next if referrer_actions is DEFAULT or function in referrer_actions else '')