GitLab

This command allows to preview content before deleting it.

Run `grouprisectl grouprise_settings dump-django` in order to see the
result of settings processing.

Previously the ".delete" method was incorrectly called for the
GenericRelationsManager instead of the queryset.
Thus deletion simply failed before.

This feature is used in kroetenzaeune.de.

Example HTML widget:

```html
<div data-component="tabs" class="tabs">
  <ol class="tabbed-tabs">
    <li><a href="#" class="tabbed-tab">foo</a></li>
    <li><a href="#" class="tabbed-tab">bar</a></li>
    <li><a href="#" class="tabbed-tab">baz</a></li>
  </ol>
  <ol class="tabbed-contents">
    <li><div class="tabbed-content">foo-content</div></li>
    <li><div class="tabbed-content">bar-content</div></li>
    <li><div class="tabbed-content">baz-content</div></li>
  </ol>
</div>
```

The widget is rendered as a tabbed view and the first tab is
selected (if one exists).

Previously the file storage suffered from files with the same name being
uploaded multiple times (each creating a new `File` or `Image`
instance), but the physical file locations were simply overwritten.

The normalization does the following:
* all `File` and `Image` objects are processed, if their filename does
  not follow the new filename schema (non-nested, 16 characters)
* the old file is renamed (moved) to its new location
* the file is copied (instead of moved), if more than one `File`
  object pointing at the old filename exists
    * thus duplicate uploads of the same file are split into multiple
      copies (each bound to a different physical file)
* a redirect (from `/stadt/media/...` to the new URL) is added for each
  file

This is a fixup for commit e83a9e9c.

`translitcodec` should not be in use anymore since commit 58282a31.

In addition we use `random.choices` instead of `secrets.choice`, since
the former can generate the full string (instead of single characters)
and we do not need the predictability properties offered by `secrets`.

This is simply a style beautification.
In addition it prevents *almost* duplicate random filenames, which
differ just in the lower/upper case of the filename extension.

The "boltons" package offers a function similar to the "translit/"
encoding (i.e. replacing umlauts with their two-characters equivalents).

The benefits of switching to "boltons" are:

* fewer style overrides ("noqa" was required due to the implicit hook
  registration used by translitcodec)
* the "boltons" package is packaged for Debian

Previously the streaming optimization was only applied to "file"
download (not images).

We are using a separate storage, which generates random filenames.
Thus we do not need to generate a filename in advance.

Probably we want to introduce redirects for migrating the old structure
of file delivery to the new one.

The recent switch to case-insensitive tags requires a cleanup of the
existing tags.

Closes: #770

The previous commit (d2671327) erroneously enabled
dango-downloadview's middleware.
But instead we just use decorators for all relevant views.
Thus we can remove the middleware entry and also the
"DOWNLOADVIEW_BACKEND" setting, which is only relevant for the
middleware.

Previously the reverse-proxy optimizations (e.g. "X-Sendfile") were not
in use, since the middleware was not activated.
Instead, CSP checks were inadvertently enabled (causing problems for
sites without expicit CSP rules).

It was caused by incompatible behehavior of django-simple-math-captcha.
The incompatibility was fixed in a recent release.

Attachments of emails were previously processed by `django_mailbox`.
This module uploaded the files to `mailbox_attachemnts/YEAR/MONTH/DAY/`
below the media directory.  This multi-level path is incompatible
with our current flat filename URL specification.

See: #774

See: #773

Previously "false" and "False" were acceptable.
Now only False is accepted.
Probably this behavior depends on the Django version.

Commit a81776f3 introduced an error in the argument list of datetime.

The previous regular expression suffered from a few issues:
* URLs including an anchor in the path (e.g. `/#contribution-123`) were
  misinterpreted as a tag
* trailing hyphens, underscores or colons were assumed to be part of the
  tag

The changes of the tests should express all relevant changes of the
parser.

The current state of the tests does not necessarily correspond with the
*desired* state (e.g. the URL anchor should not be parsed as a tag).
We should fix these later.

This should improve performance (insignificantly).

The log contained warnings regarding naive datetime objects.
These were based on the misconception, that
"django.utils.timezone.datetime" would produce timezone-aware datetime
objects.
But this object is just a bare datetime.datetime object (provided
accidentally as an import).

Since we do not (can not?) signal uwsgi, that it should re-open the log
file, we use logrotate's "copytruncate" feature instead.
It ensures, that the old log *content* is moved to the next file, while
the current log file is truncated and keeps receiving new log data.

The uwsgi package for Debian uses the same approach for logrotate.

Maybe we want to recycle this filter later (e.g. for automatic account
removal).

See: #713

The "can_login" state just indicates, whether an account was created
automaticall outside of the web interface.

See: #713

Previously I assumed, that a short delay between registration and login
can be interpreted as a bot-like behavior (being automated).
But in reality, this is just the automatic behavior of grouprise: new
users are immediately logged in right after registration.

Thus the time delta between "last_login" and "date_joined" can only be
used for determining, whether a user logged in *again* after the
registration.

This reduces the number of potential bot accounts on stadtgestalten.org
significantly (from 8000 down to 500).
Probably the "can_login" test is misleading here (creating false
negatives).