def PUT(self, id, setting):
        if setting not in self.Settings:
            web.notfound()
            return None

        try:
            configData = json.loads(web.data())

            id = int(id)
            vm = model.getVM(web.ctx.veerezoDB, id)
            if vm['user'] != web.ctx.username:
                web.forbidden()
                return None
        except (ValueError, KeyError):
            web.notfound()
            return None

        fn = '_put' + self.Settings[setting]
        f = getattr(self, fn)
        try:
            f(id, vm, configData)
        except ValueError as e:
            web.badrequest()
            return {'error': 'ValueError: {0}'.format(e.message)}

        web.nocontent()
        return None

 def authenticate(self, username, password):
     if not config.SECURITY:
         return True
     if users.users[username] == password:
         return True
     else:
         web.forbidden()
         return False

 def __call__(self, method):
   if not self.config.hooks.pre():
     forbidden() # TODO: customize
   else:
     return {
       'GET':    self._GET,
       'PUT':    self._PUT,
       'POST':   self._POST,
       'DELETE': self._DELETE
     }.get(method, internalerror)()

def protect(what, *a, **kw):
  try:
    return what(*a, **kw) or ""
  except (IOError, OSError) as e:
    if e.errno in [EACCES, ENOTDIR]:
      forbidden()
    else:
      internalerror()
    return str(e)
  except CalledProcessError as e:
    internalerror()
    return str(e)

 def new(*args):
     uri = web.ctx.env.get('REQUEST_URI')
     key = web.ctx.env.get('HTTP_X_API_KEY')
     log = lambda status: db.insert('access_log', description=uri, date=datetime.now(), key=key, status=status)
     if not is_valid_key(key):
         log('invalid key')
         web.badrequest()
     elif exist_key(key):
         log('access')
         return fn(*args)
     else:
         log('key not found')
         web.forbidden()

    def GET(self, id):
        try:
            id = int(id)

            network = model.getNetwork(web.ctx.veerezoDB, id)
            if network['user'] != web.ctx.username:
                web.forbidden()
                return None

            return network
        except (ValueError, KeyError):
            web.notfound()
            return None

    def DELETE(self, id):
        try:
            id = int(id)

            sshkey = model.getSSHKey(web.ctx.veerezoDB, id)
            if sshkey['user'] != web.ctx.username:
                web.forbidden()
                return None

            model.deleteSSHKey(web.ctx.veerezoDB, id)
        except:
            web.notfound()
            return None

        web.nocontent()
        return None

 def GET(self):
     get_input = web.input(_method='get')
     session = get_input['session']
     response, code = session_request_get('session/%s' % session, None)
     if response.get('has_access'):
         start, count = get_pagination()
         tracks = sql.select("SELECT * FROM `tracks` LIMIT %s, %s" % (start, count))
         tracks_count = sql.select("SELECT COUNT(*) FROM `tracks`")
         tracks_json_list = []
         for track in tracks:
             track_json = {'id': str(track[0]),
                           'title': track[2],
                           'length': str(track[3]),
                           'file_size': str(track[4]),
                           'singer_id': track[1]
                          }
             tracks_json_list.append(track_json)
         result = {
             'tracks': tracks_json_list,
             'start': str(start),
             'count': str(count),
             'total_count': str(tracks_count[0][0])
         }
         web.header('Content-Type', 'json/text')
         return json.dumps(result)
     else:
         return web.forbidden()

 def GET(self):
     user_token = has_access()
     if user_token:
         start, count = get_pagination()
         tracks = select("SELECT * FROM `tracks` LIMIT %s, %s" % (start, count))
         tracks_count = select("SELECT COUNT(*) FROM `tracks`")
         tracks_json_list = []
         for track in tracks:
             track_json = {'id': str(track[0]),
                           'title': track[2],
                           'length': str(track[3]),
                           'file_size': str(track[4]),
                           'singer_id': track[1]
                          }
             tracks_json_list.append(track_json)
         result = {
             'tracks': tracks_json_list,
             'start': str(start),
             'count': str(count),
             'total_count': str(tracks_count[0][0])
         }
         web.header('Content-Type', 'json/text')
         return json.dumps(result)
     else:
         return web.forbidden()

    def POST(self):
        try:
            args = web.input(track_id="", token=None)
            logging.debug("Vote request: %s" % args)

            sender = auth.get_id_by_token(args.token)
            if sender is None:
                raise web.forbidden("Bad token.")

            if args.track_id.isdigit():
                track_id = int(args.track_id)
            else:
                track_id = tracks.get_last_track_id()

            weight = tracks.add_vote(track_id, sender, self.vote_value)
            if weight is None:
                return {"status": "error", "message": "No such track."}

            database.commit()

            message = 'OK, current weight of track #%u is %.04f.' % (track_id, weight)
            return {
                "status": "ok",
                "message": message,
                "id": track_id,
                "weight": weight,
            }
        except web.Forbidden:
            raise
        except Exception, e:
            log.log_error(str(e), e)
            return {"status": "error", "message": str(e)}

    def __init__(self):
        if (self.disallow_api or self.moderator_only or self.admin_only) and weasyl.api.is_api_user():
            raise web.forbidden()

        self.user_id = define.get_userid()
        self.status = define.common_status_check(self.user_id)

        # Status check
        if self.status:
            self.replace_methods(self.status_check_fail)
            return

        # Guest check
        if self.guest_required and self.user_id != 0:
            self.replace_methods(self.login_guest_fail)
            return

        # Login check
        if self.login_required and self.user_id == 0:
            self.replace_methods(self.login_check_fail)
            return

        # Permission check
        if self.moderator_only and self.user_id not in staff.MODS:
            self.replace_methods(self.permission_check_fail)
            return
        if self.admin_only and self.user_id not in staff.ADMINS:
            self.replace_methods(self.permission_check_fail)
            return

    def PUT(self, cluster_id):
        """:returns: JSONized Cluster attributes.
        :http: * 200 (OK)
               * 400 (wrong attributes data specified)
               * 404 (cluster not found in db)
               * 500 (cluster has no attributes)
        """
        cluster = self.get_object_or_404(Cluster, cluster_id)
        if not cluster.attributes:
            raise web.internalerror("No attributes found!")

        data = self.checked_data()

        if cluster.is_locked:
            error = web.forbidden()
            error.data = "Environment attributes can't be changed " \
                         "after, or in deploy."
            raise error

        for key, value in data.iteritems():
            setattr(cluster.attributes, key, value)
        cluster.add_pending_changes("attributes")

        db().commit()
        return {"editable": cluster.attributes.editable}

 def get_openid(self, access_token):
     result = qqOAuth.request('GET', '/oauth2.0/me', access_token=access_token)
     result = result.lstrip("callback( ")
     result = result.rstrip(" );\n")
     result = json.loads(result)
     if 'openid' not in result:
         raise web.forbidden()
     return result['openid']

 def GET(self, id):
     response, code = tracks_request_get('track/%s' % id, get_session())
     response2, code2 = singers_request_get('singer/%s' % response.get('singer_id'), get_session())
     response['singer_name'] = response2.get('name')
     if code == 200:
         return response
     else:
         return web.forbidden()

 def new_func(*args, **kws):
     if web.ctx.get('account_id'):
         if web.ctx.get('account_actived'):
             return fn(*args, **kws)
         else:
             raise web.forbidden('Account has been locked')
     else:
         raise web.seeother(web.ctx.home + web.http.url('/'))

 def POST_unhide_workshop(self, workshop, i):
     user = account.get_current_user()
     if user and user.is_admin():
         workshop.unhide()
         signals.workshop_unhidden.send(workshop)
         flash("Workshop visible.", category="success")
         raise web.seeother("/workshops/{}".format(workshop.id))
     else:
         raise web.forbidden(render_template("permission_denied.html"))

 def wrapper(*args, **kwargs):
     hasrole = self.hasrole(*rargs)
     if hasrole:
         return function(*args, **kwargs)
     else:
         if self._lgn_pg:
             return web.seeother(self._lgn_pg)
         else:
             raise web.forbidden()

 def GET(self, path):
     # This is the callers IP.
     dip = web.ctx['ip']
     # Get the helper for the incoming IP address
     helper = isyhelperRESTObj.helpers.get_helper(dip)
     if helper is False:
         web.forbidden()
     if not path:
         raise web.notfound("path not defined from "+dip+"!")
     # TODO: Allow value param to be passed in?
     # TODO: Make sure split only returns 2 objects?
     #udata = web.input(value=None)
     li = path.split("/")
     varname = li[0]
     varvalue = li[1]
     info = 'REST:setvar:GET: ' + dip + ' varname='+ varname + ' value=' + str(varvalue)
     isyhelperRESTObj.helpers.logger.info(info)
     helper.setvar(varname,varvalue)
     return info

 def GET(self):
     get_input = web.input(_method="get")
     session = get_input["session"]
     response, code = session_request_get("session/%s" % session, None)
     if response.get("has_access"):
         user = sql.select("SELECT * FROM  `users` where `id` = '%s'" % (response.get("user_id")))
         user_json = {"id": user[0][1], "name": user[0][1], "email": user[0][3]}
         web.header("Content-Type", "json/text")
         return json.dumps(user_json)
     else:
         return web.forbidden()

 def GET(self):
     url_params = web.input(recipient='none', quantity=100, threading='threading')
     if url_params.recipient == 'none': return web.notfound()
     address = url_params.recipient
     if len(gutils.get_email_address(address)) < 2: return web.notfound()
     token = gutils.get_auth_token(address)
     if len(token) < 2: return web.forbidden()
     try:
         classified_mail = gutils.fetch_and_classify_recent_mail(token, address, 0, 100)
     except:
         return web.forbidden()
     if url_params.threading != 'threading': return json.dumps(classified_mail)
     classified_threads = {}
     # could just sort and would probably be much more efficient
     for msg in classified_mail:
         if msg['subject'] not in classified_threads:
             classified_threads[msg['subject']] = msg
         elif gutils.earlier_time(classified_threads[msg['subject']]['time'], msg['time']) == msg['time']:
                 classified_threads[msg['subject']] = msg
     return json.dumps([msg for (subj, msg) in classified_threads.iteritems()])