Code

- registration is now a two-step process, with confirmation from the email
[roundup.git] / roundup / cgi / templating.py
index 8bf2cee7f52e697ba3d80dadcb392b6e8cfbc3b9..dff1bbcbe405b5cdb409b5e20ddc7d88918a0756 100644 (file)
@@ -22,111 +22,92 @@ from roundup.cgi.PageTemplates.Expressions import getEngine
 from roundup.cgi.TAL.TALInterpreter import TALInterpreter
 from roundup.cgi import ZTUtils
 
-# XXX WAH pagetemplates aren't pickleable :(
-#def getTemplate(dir, name, classname=None, request=None):
-#    ''' Interface to get a template, possibly loading a compiled template.
-#    '''
-#    # source
-#    src = os.path.join(dir, name)
-#
-#    # see if we can get a compile from the template"c" directory (most
-#    # likely is "htmlc"
-#    split = list(os.path.split(dir))
-#    split[-1] = split[-1] + 'c'
-#    cdir = os.path.join(*split)
-#    split.append(name)
-#    cpl = os.path.join(*split)
-#
-#    # ok, now see if the source is newer than the compiled (or if the
-#    # compiled even exists)
-#    MTIME = os.path.stat.ST_MTIME
-#    if (not os.path.exists(cpl) or os.stat(cpl)[MTIME] < os.stat(src)[MTIME]):
-#        # nope, we need to compile
-#        pt = RoundupPageTemplate()
-#        pt.write(open(src).read())
-#        pt.id = name
-#
-#        # save off the compiled template
-#        if not os.path.exists(cdir):
-#            os.makedirs(cdir)
-#        f = open(cpl, 'wb')
-#        pickle.dump(pt, f)
-#        f.close()
-#    else:
-#        # yay, use the compiled template
-#        f = open(cpl, 'rb')
-#        pt = pickle.load(f)
-#    return pt
-
-templates = {}
-
 class NoTemplate(Exception):
     pass
 
-def precompileTemplates(dir):
-    ''' Go through a directory and precompile all the templates therein
-    '''
-    for filename in os.listdir(dir):
-        if os.path.isdir(filename): continue
-        if '.' in filename:
-            name, extension = filename.split('.')
-            getTemplate(dir, name, extension)
-        else:
-            getTemplate(dir, filename, None)
+class Templates:
+    templates = {}
 
-def getTemplate(dir, name, extension, classname=None, request=None):
-    ''' Interface to get a template, possibly loading a compiled template.
+    def __init__(self, dir):
+        self.dir = dir
+
+    def precompileTemplates(self):
+        ''' Go through a directory and precompile all the templates therein
+        '''
+        for filename in os.listdir(self.dir):
+            if os.path.isdir(filename): continue
+            if '.' in filename:
+                name, extension = filename.split('.')
+                self.getTemplate(name, extension)
+            else:
+                self.getTemplate(filename, None)
 
-        "name" and "extension" indicate the template we're after, which in
-        most cases will be "name.extension". If "extension" is None, then
-        we look for a template just called "name" with no extension.
+    def get(self, name, extension=None):
+        ''' Interface to get a template, possibly loading a compiled template.
 
-        If the file "name.extension" doesn't exist, we look for
-        "_generic.extension" as a fallback.
-    '''
-    # default the name to "home"
-    if name is None:
-        name = 'home'
+            "name" and "extension" indicate the template we're after, which in
+            most cases will be "name.extension". If "extension" is None, then
+            we look for a template just called "name" with no extension.
 
-    # find the source, figure the time it was last modified
-    if extension:
-        filename = '%s.%s'%(name, extension)
-    else:
-        filename = name
-    src = os.path.join(dir, filename)
-    try:
-        stime = os.stat(src)[os.path.stat.ST_MTIME]
-    except os.error, error:
-        if error.errno != errno.ENOENT:
-            raise
-        if not extension:
-            raise NoTemplate, 'Template file "%s" doesn\'t exist'%name
-
-        # try for a generic template
-        generic = '_generic.%s'%extension
-        src = os.path.join(dir, generic)
+            If the file "name.extension" doesn't exist, we look for
+            "_generic.extension" as a fallback.
+        '''
+        # default the name to "home"
+        if name is None:
+            name = 'home'
+        elif extension is None and '.' in name:
+            # split name
+            name, extension = name.split('.')
+
+        # find the source, figure the time it was last modified
+        if extension:
+            filename = '%s.%s'%(name, extension)
+        else:
+            filename = name
+
+        src = os.path.join(self.dir, filename)
         try:
             stime = os.stat(src)[os.path.stat.ST_MTIME]
         except os.error, error:
             if error.errno != errno.ENOENT:
                 raise
-            # nicer error
-            raise NoTemplate, 'No template file exists for templating '\
-                '"%s" with template "%s" (neither "%s" nor "%s")'%(name,
-                extension, filename, generic)
-        filename = generic
-
-    key = (dir, filename)
-    if templates.has_key(key) and stime < templates[key].mtime:
-        # compiled template is up to date
-        return templates[key]
-
-    # compile the template
-    templates[key] = pt = RoundupPageTemplate()
-    pt.write(open(src).read())
-    pt.id = filename
-    pt.mtime = time.time()
-    return pt
+            if not extension:
+                raise NoTemplate, 'Template file "%s" doesn\'t exist'%name
+
+            # try for a generic template
+            generic = '_generic.%s'%extension
+            src = os.path.join(self.dir, generic)
+            try:
+                stime = os.stat(src)[os.path.stat.ST_MTIME]
+            except os.error, error:
+                if error.errno != errno.ENOENT:
+                    raise
+                # nicer error
+                raise NoTemplate, 'No template file exists for templating '\
+                    '"%s" with template "%s" (neither "%s" nor "%s")'%(name,
+                    extension, filename, generic)
+            filename = generic
+
+        if self.templates.has_key(src) and \
+                stime < self.templates[src].mtime:
+            # compiled template is up to date
+            return self.templates[src]
+
+        # compile the template
+        self.templates[src] = pt = RoundupPageTemplate()
+        pt.write(open(src).read())
+        pt.id = filename
+        pt.mtime = time.time()
+        return pt
+
+    def __getitem__(self, name):
+        name, extension = os.path.splitext(name)
+        if extension:
+            extension = extension[1:]
+        try:
+            return self.get(name, extension)
+        except NoTemplate, message:
+            raise KeyError, message
 
 class RoundupPageTemplate(PageTemplate.PageTemplate):
     ''' A Roundup-specific PageTemplate.
@@ -149,29 +130,43 @@ class RoundupPageTemplate(PageTemplate.PageTemplate):
            - methods for easy filterspec link generation
            - *user*, the current user node as an HTMLItem instance
            - *form*, the current CGI form information as a FieldStorage
-        *instance*
-          The current instance
+        *config*
+          The current tracker config.
         *db*
-          The current database, through which db.config may be reached.
+          The current database, used to access arbitrary database items.
+        *utils*
+          This is a special class that has its base in the TemplatingUtils
+          class in this file. If the tracker interfaces module defines a
+          TemplatingUtils class then it is mixed in, overriding the methods
+          in the base class.
     '''
     def getContext(self, client, classname, request):
+        # construct the TemplatingUtils class
+        utils = TemplatingUtils
+        if hasattr(client.instance.interfaces, 'TemplatingUtils'):
+            class utils(client.instance.interfaces.TemplatingUtils, utils):
+                pass
+
         c = {
              'options': {},
              'nothing': None,
              'request': request,
-             'content': client.content,
              'db': HTMLDatabase(client),
-             'instance': client.instance,
-             'utils': TemplatingUtils(client),
+             'config': client.instance.config,
+             'tracker': client.instance,
+             'utils': utils(client),
+             'templates': Templates(client.instance.config.TEMPLATES),
         }
         # add in the item if there is one
         if client.nodeid:
             if classname == 'user':
-                c['context'] = HTMLUser(client, classname, client.nodeid)
+                c['context'] = HTMLUser(client, classname, client.nodeid,
+                    anonymous=1)
             else:
-                c['context'] = HTMLItem(client, classname, client.nodeid)
-        else:
-            c['context'] = HTMLClass(client, classname)
+                c['context'] = HTMLItem(client, classname, client.nodeid,
+                    anonymous=1)
+        elif client.db.classes.has_key(classname):
+            c['context'] = HTMLClass(client, classname, anonymous=1)
         return c
 
     def render(self, client, classname, request, **options):
@@ -194,7 +189,7 @@ class RoundupPageTemplate(PageTemplate.PageTemplate):
 
         # and go
         output = StringIO.StringIO()
-        TALInterpreter(self._v_program, self._v_macros,
+        TALInterpreter(self._v_program, self.macros,
             getEngine().getContext(c), output, tal=1, strictinsert=0)()
         return output.getvalue()
 
@@ -207,9 +202,15 @@ class HTMLDatabase:
         # we want config to be exposed
         self.config = client.db.config
 
-    def __getitem__(self, item):
-        self._client.db.getclass(item)
-        return HTMLClass(self._client, item)
+    def __getitem__(self, item, desre=re.compile(r'(?P<cl>\w+)(?P<id>[-\d]+)')):
+        # check to see if we're actually accessing an item
+        m = desre.match(item)
+        if m:
+            self._client.db.getclass(m.group('cl'))
+            return HTMLItem(self._client, m.group('cl'), m.group('id'))
+        else:
+            self._client.db.getclass(item)
+            return HTMLClass(self._client, item)
 
     def __getattr__(self, attr):
         try:
@@ -229,7 +230,11 @@ def lookupIds(db, prop, ids, num_re=re.compile('-?\d+')):
         if num_re.match(entry):
             l.append(entry)
         else:
-            l.append(cl.lookup(entry))
+            try:
+                l.append(cl.lookup(entry))
+            except KeyError:
+                # ignore invalid keys
+                pass
     return l
 
 class HTMLPermissions:
@@ -253,16 +258,16 @@ class HTMLPermissions:
 class HTMLClass(HTMLPermissions):
     ''' Accesses through a class (either through *class* or *db.<classname>*)
     '''
-    def __init__(self, client, classname):
+    def __init__(self, client, classname, anonymous=0):
         self._client = client
         self._db = client.db
+        self._anonymous = anonymous
 
         # we want classname to be exposed, but _classname gives a
         # consistent API for extending Class/Item
         self._classname = self.classname = classname
-        if classname is not None:
-            self._klass = self._db.getclass(self.classname)
-            self._props = self._klass.getprops()
+        self._klass = self._db.getclass(self.classname)
+        self._props = self._klass.getprops()
 
     def __repr__(self):
         return '<HTMLClass(0x%x) %s>'%(id(self), self.classname)
@@ -287,7 +292,7 @@ class HTMLClass(HTMLPermissions):
             if form.has_key(item):
                 if isinstance(prop, hyperdb.Multilink):
                     value = lookupIds(self._db, prop,
-                        handleListCGIValue(None, form[item]))
+                        handleListCGIValue(form[item]))
                 elif isinstance(prop, hyperdb.Link):
                     value = form[item].value.strip()
                     if value:
@@ -301,7 +306,8 @@ class HTMLClass(HTMLPermissions):
                     value = []
                 else:
                     value = None
-            return htmlklass(self._client, '', prop, item, value)
+            return htmlklass(self._client, self._classname, '', prop, item,
+                value, self._anonymous)
 
         # no good
         raise KeyError, item
@@ -338,7 +344,8 @@ class HTMLClass(HTMLPermissions):
                 else:
                     value = None
                 if isinstance(prop, klass):
-                    l.append(htmlklass(self._client, '', prop, name, value))
+                    l.append(htmlklass(self._client, self._classname, '',
+                        prop, name, value, self._anonymous))
         return l
 
     def list(self):
@@ -399,6 +406,10 @@ class HTMLClass(HTMLPermissions):
             filterspec = request.filterspec
             sort = request.sort
             group = request.group
+        else:
+            filterspec = {}
+            sort = (None,None)
+            group = (None,None)
         if self.classname == 'user':
             klass = HTMLUser
         else:
@@ -426,8 +437,8 @@ class HTMLClass(HTMLPermissions):
             properties.sort()
             properties = ','.join(properties)
         return '<a href="javascript:help_window(\'%s?:template=help&' \
-            ':contentonly=1&properties=%s\', \'%s\', \'%s\')"><b>'\
-            '(%s)</b></a>'%(self.classname, properties, width, height, label)
+            'properties=%s\', \'%s\', \'%s\')"><b>(%s)</b></a>'%(
+            self.classname, properties, width, height, label)
 
     def submit(self, label="Submit New Entry"):
         ''' Generate a submit button (and action hidden element)
@@ -447,7 +458,7 @@ class HTMLClass(HTMLPermissions):
         req.update(kwargs)
 
         # new template, using the specified classname and request
-        pt = getTemplate(self._db.config.TEMPLATES, self.classname, name)
+        pt = Templates(self._db.config.TEMPLATES).get(self.classname, name)
 
         # use our fabricated request
         return pt.render(self._client, self.classname, req)
@@ -455,7 +466,7 @@ class HTMLClass(HTMLPermissions):
 class HTMLItem(HTMLPermissions):
     ''' Accesses through an *item*
     '''
-    def __init__(self, client, classname, nodeid):
+    def __init__(self, client, classname, nodeid, anonymous=0):
         self._client = client
         self._db = client.db
         self._classname = classname
@@ -463,6 +474,9 @@ class HTMLItem(HTMLPermissions):
         self._klass = self._db.getclass(classname)
         self._props = self._klass.getprops()
 
+        # do we prefix the form items with the item's identification?
+        self._anonymous = anonymous
+
     def __repr__(self):
         return '<HTMLItem(0x%x) %s %s>'%(id(self), self._classname,
             self._nodeid)
@@ -478,7 +492,9 @@ class HTMLItem(HTMLPermissions):
         prop = self._props[item]
 
         # get the value, handling missing values
-        value = self._klass.get(self._nodeid, item, None)
+        value = None
+        if int(self._nodeid) > 0:
+            value = self._klass.get(self._nodeid, item, None)
         if value is None:
             if isinstance(self._props[item], hyperdb.Multilink):
                 value = []
@@ -486,9 +502,10 @@ class HTMLItem(HTMLPermissions):
         # look up the correct HTMLProperty class
         for klass, htmlklass in propclasses:
             if isinstance(prop, klass):
-                return htmlklass(self._client, self._nodeid, prop, item, value)
+                return htmlklass(self._client, self._classname,
+                    self._nodeid, prop, item, value, self._anonymous)
 
-        raise KeyErorr, item
+        raise KeyError, item
 
     def __getattr__(self, attr):
         ''' convenience access to properties '''
@@ -509,7 +526,7 @@ class HTMLItem(HTMLPermissions):
         # XXX do this
         return []
 
-    def history(self, direction='descending'):
+    def history(self, direction='descending', dre=re.compile('\d+')):
         l = ['<table class="history">'
              '<tr><th colspan="4" class="header">',
              _('History'),
@@ -519,13 +536,27 @@ class HTMLItem(HTMLPermissions):
              _('<th>Action</th>'),
              _('<th>Args</th>'),
             '</tr>']
+        current = {}
         comments = {}
         history = self._klass.history(self._nodeid)
         history.sort()
+        timezone = self._db.getUserTimezone()
         if direction == 'descending':
             history.reverse()
+            for prop_n in self._props.keys():
+                prop = self[prop_n]
+                if isinstance(prop, HTMLProperty):
+                    current[prop_n] = prop.plain()
+                    # make link if hrefable
+                    if (self._props.has_key(prop_n) and
+                            isinstance(self._props[prop_n], hyperdb.Link)):
+                        classname = self._props[prop_n].classname
+                        if os.path.exists(os.path.join(self._db.config.TEMPLATES, classname + '.item')):
+                            current[prop_n] = '<a href="%s%s">%s</a>'%(classname,
+                                self._klass.get(self._nodeid, prop_n, None), current[prop_n])
         for id, evt_date, user, action, args in history:
-            date_s = str(evt_date).replace("."," ")
+            date_s = str(evt_date.local(timezone)).replace("."," ")
             arg_s = ''
             if action == 'link' and type(args) == type(()):
                 if len(args) == 3:
@@ -585,7 +616,8 @@ class HTMLItem(HTMLPermissions):
                                     # TODO: test for node existence even when
                                     # there's no labelprop!
                                     try:
-                                        if labelprop is not None:
+                                        if labelprop is not None and \
+                                                labelprop != 'id':
                                             label = linkcl.get(linkid, labelprop)
                                     except IndexError:
                                         comments['no_link'] = _('''<strike>The
@@ -596,6 +628,8 @@ class HTMLItem(HTMLPermissions):
                                         if hrefable:
                                             subml.append('<a href="%s%s">%s</a>'%(
                                                 classname, linkid, label))
+                                        else:
+                                            subml.append(label)
                                 ml.append(sublabel + ', '.join(subml))
                             cell.append('%s:\n  %s'%(k, ', '.join(ml)))
                         elif isinstance(prop, hyperdb.Link) and args[k]:
@@ -603,7 +637,7 @@ class HTMLItem(HTMLPermissions):
                             # if we have a label property, try to use it
                             # TODO: test for node existence even when
                             # there's no labelprop!
-                            if labelprop is not None:
+                            if labelprop is not None and labelprop != 'id':
                                 try:
                                     label = linkcl.get(args[k], labelprop)
                                 except IndexError:
@@ -615,27 +649,46 @@ class HTMLItem(HTMLPermissions):
                                     label = None
                             if label is not None:
                                 if hrefable:
-                                    cell.append('%s: <a href="%s%s">%s</a>\n'%(k,
-                                        classname, args[k], label))
+                                    old = '<a href="%s%s">%s</a>'%(classname, args[k], label)
                                 else:
-                                    cell.append('%s: %s' % (k,label))
+                                    old = label;
+                                cell.append('%s: %s' % (k,old))
+                                if current.has_key(k):
+                                    cell[-1] += ' -> %s'%current[k]
+                                    current[k] = old
 
                         elif isinstance(prop, hyperdb.Date) and args[k]:
-                            d = date.Date(args[k])
+                            d = date.Date(args[k]).local(timezone)
                             cell.append('%s: %s'%(k, str(d)))
+                            if current.has_key(k):
+                                cell[-1] += ' -> %s' % current[k]
+                                current[k] = str(d)
 
                         elif isinstance(prop, hyperdb.Interval) and args[k]:
                             d = date.Interval(args[k])
                             cell.append('%s: %s'%(k, str(d)))
+                            if current.has_key(k):
+                                cell[-1] += ' -> %s'%current[k]
+                                current[k] = str(d)
 
                         elif isinstance(prop, hyperdb.String) and args[k]:
                             cell.append('%s: %s'%(k, cgi.escape(args[k])))
+                            if current.has_key(k):
+                                cell[-1] += ' -> %s'%current[k]
+                                current[k] = cgi.escape(args[k])
 
                         elif not args[k]:
-                            cell.append('%s: (no value)\n'%k)
+                            if current.has_key(k):
+                                cell.append('%s: %s'%(k, current[k]))
+                                current[k] = '(no value)'
+                            else:
+                                cell.append('%s: (no value)'%k)
 
                         else:
-                            cell.append('%s: %s\n'%(k, str(args[k])))
+                            cell.append('%s: %s'%(k, str(args[k])))
+                            if current.has_key(k):
+                                cell[-1] += ' -> %s'%current[k]
+                                current[k] = str(args[k])
                     else:
                         # property no longer exists
                         comments['no_exist'] = _('''<em>The indicated property
@@ -648,6 +701,10 @@ class HTMLItem(HTMLPermissions):
                     handled by the history display!</em></strong>''')
                 arg_s = '<strong><em>' + str(args) + '</em></strong>'
             date_s = date_s.replace(' ', '&nbsp;')
+            # if the user's an itemid, figure the username (older journals
+            # have the username)
+            if dre.match(user):
+                user = self._db.user.get(user, 'username')
             l.append('<tr><td>%s</td><td>%s</td><td>%s</td><td>%s</td></tr>'%(
                 date_s, user, action, arg_s))
         if comments:
@@ -663,10 +720,12 @@ class HTMLItem(HTMLPermissions):
         # create a new request and override the specified args
         req = HTMLRequest(self._client)
         req.classname = self._klass.get(self._nodeid, 'klass')
-        req.updateFromURL(self._klass.get(self._nodeid, 'url'))
+        name = self._klass.get(self._nodeid, 'name')
+        req.updateFromURL(self._klass.get(self._nodeid, 'url') +
+            '&:queryname=%s'%urllib.quote(name))
 
         # new template, using the specified classname and request
-        pt = getTemplate(self._db.config.TEMPLATES, req.classname, 'search')
+        pt = Templates(self._db.config.TEMPLATES).get(req.classname, 'search')
 
         # use our fabricated request
         return pt.render(self._client, req.classname, req)
@@ -674,23 +733,23 @@ class HTMLItem(HTMLPermissions):
 class HTMLUser(HTMLItem):
     ''' Accesses through the *user* (a special case of item)
     '''
-    def __init__(self, client, classname, nodeid):
-        HTMLItem.__init__(self, client, 'user', nodeid)
+    def __init__(self, client, classname, nodeid, anonymous=0):
+        HTMLItem.__init__(self, client, 'user', nodeid, anonymous)
         self._default_classname = client.classname
 
         # used for security checks
         self._security = client.db.security
 
     _marker = []
-    def hasPermission(self, role, classname=_marker):
-        ''' Determine if the user has the Role.
+    def hasPermission(self, permission, classname=_marker):
+        ''' Determine if the user has the Permission.
 
             The class being tested defaults to the template's class, but may
             be overidden for this test by suppling an alternate classname.
         '''
         if classname is self._marker:
             classname = self._default_classname
-        return self._security.hasPermission(role, self._nodeid, classname)
+        return self._security.hasPermission(permission, self._nodeid, classname)
 
     def is_edit_ok(self):
         ''' Is the user allowed to Edit the current class?
@@ -716,15 +775,22 @@ class HTMLProperty:
 
         A wrapper object which may be stringified for the plain() behaviour.
     '''
-    def __init__(self, client, nodeid, prop, name, value):
+    def __init__(self, client, classname, nodeid, prop, name, value,
+            anonymous=0):
         self._client = client
         self._db = client.db
+        self._classname = classname
         self._nodeid = nodeid
         self._prop = prop
-        self._name = name
         self._value = value
+        self._anonymous = anonymous
+        if not anonymous:
+            self._name = '%s%s@%s'%(classname, nodeid, name)
+        else:
+            self._name = name
     def __repr__(self):
-        return '<HTMLProperty(0x%x) %s %r %r>'%(id(self), self._name, self._prop, self._value)
+        return '<HTMLProperty(0x%x) %s %r %r>'%(id(self), self._name,
+            self._prop, self._value)
     def __str__(self):
         return self.plain()
     def __cmp__(self, other):
@@ -733,14 +799,45 @@ class HTMLProperty:
         return cmp(self._value, other)
 
 class StringHTMLProperty(HTMLProperty):
-    def plain(self, escape=0):
+    hyper_re = re.compile(r'((?P<url>\w{3,6}://\S+)|'
+                          r'(?P<email>[\w\.]+@[\w\.\-]+)|'
+                          r'(?P<item>(?P<class>[a-z_]+)(?P<id>\d+)))')
+    def _hyper_repl(self, match):
+        if match.group('url'):
+            s = match.group('url')
+            return '<a href="%s">%s</a>'%(s, s)
+        elif match.group('email'):
+            s = match.group('email')
+            return '<a href="mailto:%s">%s</a>'%(s, s)
+        else:
+            s = match.group('item')
+            s1 = match.group('class')
+            s2 = match.group('id')
+            try:
+                # make sure s1 is a valid tracker classname
+                self._db.getclass(s1)
+                return '<a href="%s">%s %s</a>'%(s, s1, s2)
+            except KeyError:
+                return '%s%s'%(s1, s2)
+
+    def plain(self, escape=0, hyperlink=0):
         ''' Render a "plain" representation of the property
+            
+            "escape" turns on/off HTML quoting
+            "hyperlink" turns on/off in-text hyperlinking of URLs, email
+                addresses and designators
         '''
         if self._value is None:
             return ''
         if escape:
-            return cgi.escape(str(self._value))
-        return str(self._value)
+            s = cgi.escape(str(self._value))
+        else:
+            s = str(self._value)
+        if hyperlink:
+            if not escape:
+                s = cgi.escape(s)
+            s = self.hyper_re.sub(self._hyper_repl, s)
+        return s
 
     def stext(self, escape=0):
         ''' Render the value of the property as StructuredText.
@@ -805,9 +902,9 @@ class PasswordHTMLProperty(HTMLProperty):
     def confirm(self, size = 30):
         ''' Render a second form edit field for the property, used for 
             confirmation that the user typed the password correctly. Generates
-            a field with name "name:confirm".
+            a field with name ":confirm:name".
         '''
-        return '<input type="password" name="%s:confirm" size="%s">'%(
+        return '<input type="password" name=":confirm:%s" size="%s">'%(
             self._name, size)
 
 class NumberHTMLProperty(HTMLProperty):
@@ -830,7 +927,7 @@ class BooleanHTMLProperty(HTMLProperty):
     def plain(self):
         ''' Render a "plain" representation of the property
         '''
-        if self.value is None:
+        if self._value is None:
             return ''
         return self._value and "Yes" or "No"
 
@@ -854,7 +951,16 @@ class DateHTMLProperty(HTMLProperty):
         '''
         if self._value is None:
             return ''
-        return str(self._value)
+        return str(self._value.local(self._db.getUserTimezone()))
+
+    def now(self):
+        ''' Return the current time.
+
+            This is useful for defaulting a new value. Returns a
+            DateHTMLProperty.
+        '''
+        return DateHTMLProperty(self._client, self._nodeid, self._prop,
+            self._name, date.Date('.'))
 
     def field(self, size = 30):
         ''' Render a form edit field for the property
@@ -862,7 +968,7 @@ class DateHTMLProperty(HTMLProperty):
         if self._value is None:
             value = ''
         else:
-            value = cgi.escape(str(self._value))
+            value = cgi.escape(str(self._value.local(self._db.getUserTimezone())))
             value = '&quot;'.join(value.split('"'))
         return '<input name="%s" value="%s" size="%s">'%(self._name, value, size)
 
@@ -880,6 +986,26 @@ class DateHTMLProperty(HTMLProperty):
             return interval.pretty()
         return str(interval)
 
+    _marker = []
+    def pretty(self, format=_marker):
+        ''' Render the date in a pretty format (eg. month names, spaces).
+
+            The format string is a standard python strftime format string.
+            Note that if the day is zero, and appears at the start of the
+            string, then it'll be stripped from the output. This is handy
+            for the situatin when a date only specifies a month and a year.
+        '''
+        if format is not self._marker:
+            return self._value.pretty(format)
+        else:
+            return self._value.pretty()
+
+    def local(self, offset):
+        ''' Return the date/time as a local (timezone offset) date/time.
+        '''
+        return DateHTMLProperty(self._client, self._nodeid, self._prop,
+            self._name, self._value.local(offset))
+
 class IntervalHTMLProperty(HTMLProperty):
     def plain(self):
         ''' Render a "plain" representation of the property
@@ -913,6 +1039,13 @@ class LinkHTMLProperty(HTMLProperty):
         entry identified by the assignedto property on item, and then the
         name property of that user)
     '''
+    def __init__(self, *args, **kw):
+        HTMLProperty.__init__(self, *args, **kw)
+        # if we're representing a form value, then the -1 from the form really
+        # should be a None
+        if str(self._value) == '-1':
+            self._value = None
+
     def __getattr__(self, attr):
         ''' return a new HTMLItem '''
        #print 'Link.getattr', (self, attr, self._value)
@@ -954,6 +1087,11 @@ class LinkHTMLProperty(HTMLProperty):
         else:
             s = ''
         l.append(_('<option %svalue="-1">- no selection -</option>')%s)
+
+        # make sure we list the current value if it's retired
+        if self._value and self._value not in options:
+            options.insert(0, self._value)
+
         for optionid in options:
             # get the option value, and if it's None use an empty string
             option = linkcl.get(optionid, k) or ''
@@ -1000,6 +1138,11 @@ class LinkHTMLProperty(HTMLProperty):
         else:  
             sort_on = ('+', linkcl.labelprop())
         options = linkcl.filter(None, conditions, sort_on, (None, None))
+
+        # make sure we list the current value if it's retired
+        if self._value and self._value not in options:
+            options.insert(0, self._value)
+
         for optionid in options:
             # get the option value, and if it's None use an empty string
             option = linkcl.get(optionid, k) or ''
@@ -1057,9 +1200,10 @@ class MultilinkHTMLProperty(HTMLProperty):
         return klass(self._client, self._prop.classname, value)
 
     def __contains__(self, value):
-        ''' Support the "in" operator
+        ''' Support the "in" operator. We have to make sure the passed-in
+            value is a string first, not a *HTMLProperty.
         '''
-        return value in self._value
+        return str(value) in self._value
 
     def reverse(self):
         ''' return the list in reverse order
@@ -1120,6 +1264,12 @@ class MultilinkHTMLProperty(HTMLProperty):
         height = height or min(len(options), 7)
         l = ['<select multiple name="%s" size="%s">'%(self._name, height)]
         k = linkcl.labelprop(1)
+
+        # make sure we list the current values if they're retired
+        for val in value:
+            if val not in options:
+                options.insert(0, val)
+
         for optionid in options:
             # get the option value, and if it's None use an empty string
             option = linkcl.get(optionid, k) or ''
@@ -1174,30 +1324,17 @@ def make_sort_function(db, classname):
         return cmp(linkcl.get(a, sort_on), linkcl.get(b, sort_on))
     return sortfunc
 
-def handleListCGIValue(klass, value, num_re=re.compile('\d+')):
+def handleListCGIValue(value):
     ''' Value is either a single item or a list of items. Each item has a
         .value that we're actually interested in.
     '''
     if isinstance(value, type([])):
-        l = [value.value for value in value]
+        return [value.value for value in value]
     else:
         value = value.value.strip()
         if not value:
             return []
-        l = value.split(',')
-
-    if klass is None:
-        return l
-
-    # otherwise, try to make sure the values are itemids of the given class
-    r = []
-    for itemid in l:
-        # make sure we're looking at an itemid
-        if not num_re.match(itemid):
-            itemid = self._klass.lookup(itemid)
-        else:
-            r.append(itemid)
-    return r
+        return value.split(',')
 
 class ShowDict:
     ''' A convenience access to the :columns index parameters
@@ -1243,6 +1380,9 @@ class HTMLRequest:
         self.classname = client.classname
         self.template = client.template
 
+        # the special char to use for special vars
+        self.special_char = '@'
+
         self._post_init()
 
     def _post_init(self):
@@ -1250,36 +1390,46 @@ class HTMLRequest:
         '''
         # extract the index display information from the form
         self.columns = []
-        if self.form.has_key(':columns'):
-            self.columns = handleListCGIValue(None, self.form[':columns'])
+        for name in ':columns @columns'.split():
+            if self.form.has_key(name):
+                self.special_char = name[0]
+                self.columns = handleListCGIValue(self.form[name])
+                break
         self.show = ShowDict(self.columns)
 
         # sorting
         self.sort = (None, None)
-        if self.form.has_key(':sort'):
-            sort = self.form[':sort'].value
-            if sort.startswith('-'):
-                self.sort = ('-', sort[1:])
-            else:
-                self.sort = ('+', sort)
-        if self.form.has_key(':sortdir'):
-            self.sort = ('-', self.sort[1])
+        for name in ':sort @sort'.split():
+            if self.form.has_key(name):
+                self.special_char = name[0]
+                sort = self.form[name].value
+                if sort.startswith('-'):
+                    self.sort = ('-', sort[1:])
+                else:
+                    self.sort = ('+', sort)
+                if self.form.has_key(self.special_char+'sortdir'):
+                    self.sort = ('-', self.sort[1])
 
         # grouping
         self.group = (None, None)
-        if self.form.has_key(':group'):
-            group = self.form[':group'].value
-            if group.startswith('-'):
-                self.group = ('-', group[1:])
-            else:
-                self.group = ('+', group)
-        if self.form.has_key(':groupdir'):
-            self.group = ('-', self.group[1])
+        for name in ':group @group'.split():
+            if self.form.has_key(name):
+                self.special_char = name[0]
+                group = self.form[name].value
+                if group.startswith('-'):
+                    self.group = ('-', group[1:])
+                else:
+                    self.group = ('+', group)
+                if self.form.has_key(self.special_char+'groupdir'):
+                    self.group = ('-', self.group[1])
 
         # filtering
         self.filter = []
-        if self.form.has_key(':filter'):
-            self.filter = handleListCGIValue(None, self.form[':filter'])
+        for name in ':filter @filter'.split():
+            if self.form.has_key(name):
+                self.special_char = name[0]
+                self.filter = handleListCGIValue(self.form[name])
+
         self.filterspec = {}
         db = self.client.db
         if self.classname is not None:
@@ -1290,26 +1440,31 @@ class HTMLRequest:
                     fv = self.form[name]
                     if (isinstance(prop, hyperdb.Link) or
                             isinstance(prop, hyperdb.Multilink)):
-                        cl = db.getclass(prop.classname)
-                        self.filterspec[name] = handleListCGIValue(cl, fv)
+                        self.filterspec[name] = lookupIds(db, prop,
+                            handleListCGIValue(fv))
                     else:
                         self.filterspec[name] = fv.value
 
         # full-text search argument
         self.search_text = None
-        if self.form.has_key(':search_text'):
-            self.search_text = self.form[':search_text'].value
+        for name in ':search_text @search_text'.split():
+            if self.form.has_key(name):
+                self.special_char = name[0]
+                self.search_text = self.form[name].value
 
         # pagination - size and start index
         # figure batch args
-        if self.form.has_key(':pagesize'):
-            self.pagesize = int(self.form[':pagesize'].value)
-        else:
-            self.pagesize = 50
-        if self.form.has_key(':startwith'):
-            self.startwith = int(self.form[':startwith'].value)
-        else:
-            self.startwith = 0
+        self.pagesize = 50
+        for name in ':pagesize @pagesize'.split():
+            if self.form.has_key(name):
+                self.special_char = name[0]
+                self.pagesize = int(self.form[name].value)
+
+        self.startwith = 0
+        for name in ':startwith @startwith'.split():
+            if self.form.has_key(name):
+                self.special_char = name[0]
+                self.startwith = int(self.form[name].value)
 
     def updateFromURL(self, url):
         ''' Parse the URL for query args, and update my attributes using the
@@ -1357,7 +1512,7 @@ class HTMLRequest:
         d.update(self.__dict__)
         f = ''
         for k in self.form.keys():
-            f += '\n      %r=%r'%(k,handleListCGIValue(None, self.form[k]))
+            f += '\n      %r=%r'%(k,handleListCGIValue(self.form[k]))
         d['form'] = f
         e = ''
         for k,v in self.env.items():
@@ -1382,60 +1537,79 @@ env: %(env)s
             filterspec=1):
         ''' return the current index args as form elements '''
         l = []
+        sc = self.special_char
         s = '<input type="hidden" name="%s" value="%s">'
         if columns and self.columns:
-            l.append(s%(':columns', ','.join(self.columns)))
+            l.append(s%(sc+'columns', ','.join(self.columns)))
         if sort and self.sort[1] is not None:
             if self.sort[0] == '-':
                 val = '-'+self.sort[1]
             else:
                 val = self.sort[1]
-            l.append(s%(':sort', val))
+            l.append(s%(sc+'sort', val))
         if group and self.group[1] is not None:
             if self.group[0] == '-':
                 val = '-'+self.group[1]
             else:
                 val = self.group[1]
-            l.append(s%(':group', val))
+            l.append(s%(sc+'group', val))
         if filter and self.filter:
-            l.append(s%(':filter', ','.join(self.filter)))
+            l.append(s%(sc+'filter', ','.join(self.filter)))
         if filterspec:
             for k,v in self.filterspec.items():
-                l.append(s%(k, ','.join(v)))
+                if type(v) == type([]):
+                    l.append(s%(k, ','.join(v)))
+                else:
+                    l.append(s%(k, v))
         if self.search_text:
-            l.append(s%(':search_text', self.search_text))
-        l.append(s%(':pagesize', self.pagesize))
-        l.append(s%(':startwith', self.startwith))
+            l.append(s%(sc+'search_text', self.search_text))
+        l.append(s%(sc+'pagesize', self.pagesize))
+        l.append(s%(sc+'startwith', self.startwith))
         return '\n'.join(l)
 
     def indexargs_url(self, url, args):
-        ''' embed the current index args in a URL '''
+        ''' Embed the current index args in a URL
+        '''
+        sc = self.special_char
         l = ['%s=%s'%(k,v) for k,v in args.items()]
-        if self.columns and not args.has_key(':columns'):
-            l.append(':columns=%s'%(','.join(self.columns)))
-        if self.sort[1] is not None and not args.has_key(':sort'):
+
+        # pull out the special values (prefixed by @ or :)
+        specials = {}
+        for key in args.keys():
+            if key[0] in '@:':
+                specials[key[1:]] = args[key]
+
+        # ok, now handle the specials we received in the request
+        if self.columns and not specials.has_key('columns'):
+            l.append(sc+'columns=%s'%(','.join(self.columns)))
+        if self.sort[1] is not None and not specials.has_key('sort'):
             if self.sort[0] == '-':
                 val = '-'+self.sort[1]
             else:
                 val = self.sort[1]
-            l.append(':sort=%s'%val)
-        if self.group[1] is not None and not args.has_key(':group'):
+            l.append(sc+'sort=%s'%val)
+        if self.group[1] is not None and not specials.has_key('group'):
             if self.group[0] == '-':
                 val = '-'+self.group[1]
             else:
                 val = self.group[1]
-            l.append(':group=%s'%val)
-        if self.filter and not args.has_key(':columns'):
-            l.append(':filter=%s'%(','.join(self.filter)))
+            l.append(sc+'group=%s'%val)
+        if self.filter and not specials.has_key('filter'):
+            l.append(sc+'filter=%s'%(','.join(self.filter)))
+        if self.search_text and not specials.has_key('search_text'):
+            l.append(sc+'search_text=%s'%self.search_text)
+        if not specials.has_key('pagesize'):
+            l.append(sc+'pagesize=%s'%self.pagesize)
+        if not specials.has_key('startwith'):
+            l.append(sc+'startwith=%s'%self.startwith)
+
+        # finally, the remainder of the filter args in the request
         for k,v in self.filterspec.items():
             if not args.has_key(k):
-                l.append('%s=%s'%(k, ','.join(v)))
-        if self.search_text and not args.has_key(':search_text'):
-            l.append(':search_text=%s'%self.search_text)
-        if not args.has_key(':pagesize'):
-            l.append(':pagesize=%s'%self.pagesize)
-        if not args.has_key(':startwith'):
-            l.append(':startwith=%s'%self.startwith)
+                if type(v) == type([]):
+                    l.append('%s=%s'%(k, ','.join(v)))
+                else:
+                    l.append('%s=%s'%(k, v))
         return '%s?%s'%(url, '&'.join(l))
     indexargs_href = indexargs_url
 
@@ -1453,7 +1627,7 @@ function submit_once() {
 }
 
 function help_window(helpurl, width, height) {
-    HelpWin = window.open('%s/' + helpurl, 'RoundupHelpWindow', 'scrollbars=yes,resizable=yes,toolbar=no,height='+height+',width='+width);
+    HelpWin = window.open('%s' + helpurl, 'RoundupHelpWindow', 'scrollbars=yes,resizable=yes,toolbar=no,height='+height+',width='+width);
 }
 </script>
 '''%self.base