def submit(self):
		"""
		Verify username and password
		"""
		# Both fields filled?
		form_username = str(request.params.get('username'))
		form_password = str(request.params.get('password'))
		m = hashlib.md5()
		m.update(form_password)
		passhash = m.hexdigest()
		# Get user data from database
		if app_globals.rpcservice.check_admin(form_username, passhash):
			# Mark admin as logged in
			session['user'] = form_username
			session['passhash'] = passhash
			session.save()
			return redirect(url(controller='syncuser', action='index'))

		if app_globals.rpcservice.check_user(form_username, passhash):
			# Mark user as logged in
			session['user'] = form_username
			session['passhash'] = passhash
			session.save()
			return redirect(url.current(controller='account', action='index'))
		return redirect(url.current(action = 'invalid'))

 def critique(self, id):
     load_user()
     self.load_matches(id)
     act = meta.Session.query(Activity).get(id)
     if c.user and self._can_comment(c.user.id, c.service_matches):
         rt = Rating()
         # raise Exception('inserting rating by user %s of user %s'%(c.user.id,act.user.id))
         rt.by_user = c.user
         # rt.by_user_id = c.user.id
         # c.user.ratings_by.append(rt)
         rt.of_user = act.user
         # rt.of_user_id = act.user.id
         act.user.ratings_of.append(rt)
         rt.rating = self.form_result.get("rating")
         rt.comment = self.form_result.get("comment")
         meta.Session.add(rt)
         meta.Session.commit()
         sess = facebook.check_session()
         if sess:
             facebook.notifications.send(
                 [act.user.fb_uid],
                 _(
                     u' נתן ציון לשירותך באתר <a href="http://www.greenie.co.il/">השליחים הירוקים</a> - <a href="http://www.greenie.co.il%s">%s</a>'
                 )
                 % (url.current(controller=act.activity_type, action="index", id=act.id), act),
             )
         redirect(url.current(action="index", id=id))
     else:
         raise Exception("permission denied to comment for this user here")

 def create(self, id, tags):
     if not hasattr(self, 'form_result'):
         redirect(url.current(action='add'))
     location = LocationTag.get(tags)
     subject = Subject.get(location, id)
     page = Page(self.form_result['page_title'],
                 self.form_result['page_content'])
     subject.pages.append(page)
     meta.Session.add(page)
     meta.Session.commit()
     redirect(url.current(action='index', page_id=page.id))

 def delete(self, id=None):
     """ Delete an existing address record."""
     address = Session.query(Address).get(id)
     if address:
         Session.delete(address)
         Session.commit()
         flash_message(_("Address record deleted"), 'success')
         return redirect(url.current(action='index'))
     else:
         flash_message(_("This record did not exist"), 'warning')
         return redirect(url.current(action='index', id=None))

 def __before__(self):
     if self.requires_auth and not session.get('logged_in'):
         if session.get('after_login') is None:
             session.clear()
             if url.current() != url(controller='auth/login', action='index'):
                 session['after_login'] = url.current()
             else:
                 session['after_login'] = url('/')
             session.save()
             
         redirect(url(controller='auth/login', action='index'))

 def delete(self, id=None):
     """ Delete an existing excavation record."""
     excavation = Session.query(Excavation).get(id)
     if excavation:
         Session.delete(excavation)
         Session.commit()
         flash_message(_("Excavation record deleted"), 'success')
         return redirect(url.current(action='index'))
     else:
         flash_message(_("This record did not exist"), 'warning')
         return redirect(url.current(action='index', id=None))

 def award_medal(self, user):
     try:
         medal_type = request.GET['medal_type']
     except KeyError:
         abort(404)
     if medal_type not in Medal.available_medal_types():
         abort(404)
     if medal_type in [m.medal_type for m in user.medals]:
         redirect(url.current(action='medals')) # Medal already granted.
     m = Medal(user, medal_type)
     meta.Session.add(m)
     meta.Session.commit()
     redirect(url.current(action='medals'))

 def update(self, id=None):
     """ Update an existing address record."""
     address = Session.query(Address).get(id)
     if address:
         # update record attributes
         for key, value in self.form_result.items():
             setattr(address, key, value)
         Session.commit()
         flash_message(_("Address record updated"), 'success')
         return redirect(url.current(action='show', id=address.address_id))
     else:
         flash_message(_("This record did not exist"), 'warning')
         return redirect(url.current(action='index', id=None))

 def take_away_medal(self, user):
     try:
         medal_id = int(request.GET['medal_id'])
     except KeyError:
         abort(404)
     try:
         medal = meta.Session.query(Medal).filter_by(id=medal_id).one()
     except NoResultFound:
         redirect(url.current(action='medals')) # Medal has been already taken away.
     if medal.user is not user:
         abort(404)
     meta.Session.delete(medal)
     meta.Session.commit()
     redirect(url.current(action='medals'))

    def post_login(self):
        """ Post login action.

        If the credentials are good the user is connected and redirect to the
        main index page . If they are wrong the user his resend to login.
        """
        credentials = request.environ.get('repoze.what.credentials', False)
        if credentials:
            userid = credentials['repoze.what.userid']
            flash_message(_("Successful login, %s!") % userid)
            redirect(url.current(action='index'))
        else:
            flash_message(_("Wrong credentials"), 'warning')
            redirect(url.current(action='login'))

 def update(self, id=None):
     """ Update an existing person record."""
     person = Session.query(Person).get(id)
     if person:
         # check first for a duplicate entry
         self._check_duplicate(self.form_result, person.person_id)
         # update record attributes
         for key, value in self.form_result.items():
             setattr(person, key, value)
         Session.commit()
         flash_message(_("Person record updated"), 'success')
         return redirect(url.current(action='show', id=person.person_id))
     else:
         flash_message(_("This record did not exist"), 'warning')
         return redirect(url.current(action='index', id=None))

    def document(self):
        resp = request.environ.get('pylons.original_response')
        req = request.environ.get('pylons.original_request')
        c.came_from = url.current()
        if resp is None:
            return render("/error.mako")

        c.reason = req.environ.get('ututi.access_denied_reason', None)
        if resp.status_int in [403, 404]:
            self.form_result = {}
            self._search()
            c.came_from = url('/')
            if resp.status_int == 403:
                return render("/access_denied.mako")

            elif resp.status_int == 404:
                h.flash(_("Document at %(url)s was not found, but maybe you are interested in something else?") % {
                        'url': req.url.encode('ascii', 'ignore')})

                # if user is logged in, show search form, otherwise - login form
                try:
                    if session['login']:
                        return render('/search/index.mako')
                except KeyError:
                    return render('/login.mako')

        return render("/error.mako")

	def save(self, id=None):
		log.debug('save: id %s params %s', id, str(request.params))
		user = dict()
		if id is None:
			user['name'] = request.params['name']
		else:
			user['name'] = id

		for f in ('email', 'server', 'hwkey', 'comment'):
			user[f] = request.params[f]

		user['sync'] = self._get_selected_bases(request)

		if request.params['exp'] == 'date':
			user['expired'] = request.params['expired']
		else:
			user['expired'] = '-1'
		if id is None:
			try:
				password = app_globals.rpcservice.add_user(session['user'], session['passhash'], user)
				msg = _("Your SZARP Synchronization account has been created.\n\nYour login: %s\nYour password: %s\nVisist %s to change your password and view your settings.\n\nSZARP Synchronization Server\n") % (user['name'], password, url('home', qualified = True))
				send_email(user['email'], _("SZARP sync new account"), msg)
			except Exception, e:
				log.error(str(e))
				raise e
			return redirect(url.current(action='edit', id=user['name']))

        def create_comparison_link(target, replace_with=None, move=0):
            u"""Manipulates the list of Pokémon before creating a link.

            `target` is the FoundPokemon to be operated upon.  It can be either
            replaced with a new string or moved left/right.
            """

            new_found_pokemon = c.found_pokemon[:]

            # Do the swapping first
            if move:
                idx1 = new_found_pokemon.index(target)
                idx2 = (idx1 + move) % len(new_found_pokemon)
                new_found_pokemon[idx1], new_found_pokemon[idx2] = \
                    new_found_pokemon[idx2], new_found_pokemon[idx1]

            # Construct a new query
            query_pokemon = []
            for found_pokemon in new_found_pokemon:
                if found_pokemon is None:
                    # Empty slot
                    query_pokemon.append(u'')
                elif found_pokemon is target and replace_with != None:
                    # Substitute a new Pokémon
                    query_pokemon.append(replace_with)
                else:
                    # Keep what we have now
                    query_pokemon.append(found_pokemon.input)

            short_params = self._shorten_compare_pokemon(query_pokemon)
            return url.current(**short_params)

    def __wrapper(self, func, *fargs, **fkwargs):
        cls = fargs[0]
        self.user = cls.rhodecode_user
        self.user_perms = self.user.permissions
        log.debug('checking %s permissions %s for %s %s',
           self.__class__.__name__, self.required_perms, cls,
               self.user)

        if self.check_permissions():
            log.debug('Permission granted for %s %s', cls, self.user)
            return func(*fargs, **fkwargs)

        else:
            log.warning('Permission denied for %s %s', cls, self.user)


            anonymous = self.user.username == 'default'

            if anonymous:
                p = url.current()

                import rhodecode.lib.helpers as h
                h.flash(_('You need to be a signed in to '
                          'view this page'),
                        category='warning')
                return redirect(url('login_home', came_from=p))

            else:
                #redirect with forbidden ret code
                return abort(403)

 def build_url(self, request, facet_values):
     '''
     Build an url from the *request* and the *facet_value*
     '''
     params = self.build_params(request, facet_values)
     url_base = url.current(qualified=True)
     return url_base + "?" + urllib.urlencode(params)

 def make_order(self):
     username = session['user']
     user = Session.query(User).filter(User.name==username).first()
     
     dish_id = request.params['dish_id']
     
     o = Session.query(Order).filter(Order.date==datetime.date.today()).first()
     
     if o == None:
         o = Order()
         o.date = datetime.date.today()
         Session.add(o)
         Session.commit()
     
     od = OrderDetail()
     od.order_id = o.id
     od.user_id = user.id
     od.dish_id = dish_id
     od.quantity = request.params['quantity']
     od.notes = request.params['notes']
     od.date = datetime.date.today()
     
     Session.add(od)
     Session.commit()
     
     redirect(url.current(action='get_today_order'))

    def authenticate(self):
        form_username = str(request.params.get('username'))
        form_password = str(request.params.get('password'))


        # Get user data from database
        user = Session.query(User).filter(User.name==form_username).first()

        if user is None: # User does not exist
            return render('/login.mako')

        # Wrong password? (MD5 hashes used here)
        
        #if user.password != md5.md5(form_password).hexdigest():
        if user.password != form_password:
            return "Bad authentication." #render('login.mako')

        # Mark user as logged in
        session['user'] = form_username
        session.save()

        if user.name == "admin":
            return redirect(url(controller='admin/menu', action='index'))
        else:
            return redirect(url.current(action='index'))
        """    

 def generate_header_link(self, column_number, column, label_text):
     """ This handles generation of link and then decides to call
     self.default_header_ordered_column_format 
     or 
     self.default_header_column_format 
     based on if current column is the one that is used for sorting or not
     """ 
     from pylons import url
     # this will handle possible URL generation
     request_copy = dict(self.request.copy().GET) 
     self.order_column = request_copy.pop("order_col", None)
     self.order_dir = request_copy.pop("order_dir", None)
     
     if column == self.order_column and self.order_dir == "asc":
         new_order_dir = "dsc"
     else:
         new_order_dir = "asc"
     
     url_href = url.current(order_col=column, order_dir=new_order_dir,
                            **request_copy)
     label_text = HTML.tag("a", href=url_href, c=label_text)
     # Is the current column the one we're ordering on?
     if column == self.order_column:
         return self.default_header_ordered_column_format(column_number,
                                                          column,
                                                          label_text)
     else:
         return self.default_header_column_format(column_number, column,
                                                  label_text)

    def __wrapper(self, func, *fargs, **fkwargs):
        cls = fargs[0]
        user = cls.rhodecode_user

        api_access_ok = False
        if self.api_access:
            log.debug('Checking API KEY access for %s' % cls)
            if user.api_key == request.GET.get('api_key'):
                api_access_ok = True
            else:
                log.debug("API KEY token not valid")
        loc = "%s:%s" % (cls.__class__.__name__, func.__name__)
        log.debug('Checking if %s is authenticated @ %s' % (user.username, loc))
        if user.is_authenticated or api_access_ok:
            log.info('user %s is authenticated and granted access to %s' % (
                       user.username, loc)
            )
            return func(*fargs, **fkwargs)
        else:
            log.warn('user %s NOT authenticated on func: %s' % (
                user, loc)
            )
            p = url.current()

            log.debug('redirecting to login page with %s' % p)
            return redirect(url('login_home', came_from=p))