def remove_user_from_group(self, user_name, group_name):
        """
        Removes user from group.
        Updates the published time of the project accordingly.

        :param str user_name: User name
        :param str group_name: Group name
        :raises InvalidPermissionState: User cannot be removed
        :raises DatabaseError: Query failure
        :raises ValueError: User not found
        """
        user = get_userstore().getUser(user_name)
        if not user:
            raise ValueError('User not found')

        # TODO: just check that there's TRAC_ADMIN left?
        # Checks that it is ok to remove user from group
        ug = self.get_all_user_groups()
        ug = [(user, group) for user, group in ug if not (user == user_name and group == group_name)]
        self.is_valid_group_members(user_groups=ug)

        group_name = group_name.encode('utf-8')
        group_id = self.get_group_id(group_name)
        self._cache.clear_user_groups(self.trac_environment_key)

        with admin_query() as cursor:
            cursor.callproc("remove_user_from_group", [user.id, group_id])

        self._update_published_time()

    def process_request(self, req):
        """ Render welcome page
        """

        # Prepare data for template
        prjs = Projects()
        data = {}
        data['baseurl'] = conf.url_projects_path
        if req.authname == 'anonymous':
            conf.redirect(req)

        # Get project count
        data['project_count'] = prjs.project_count()

        user = get_userstore().getUser(req.authname)
        global_timeline = GlobalTimeline()

        data['show_explore'] = self.env[FindProjectsModule].has_explore_perm(req)
        data['latest_events'] = global_timeline.get_latest_events(req.authname, 5)

        # Check if user is allowed to create project
        data['can_create_project'] = user.can_create_project()

        # Configuration values the welcome page wants
        data['site_name'] = conf.site_name
        data['site_title_text'] = conf.site_title_text
        data['site_punch_line'] = conf.punch_line
        data['site_theme_path'] = conf.getThemePath()

        wiki_welcome = self._get_welcome_page(req)
        if wiki_welcome:
            data['wiki_welcome'] = wiki_welcome

        return "welcome.html", data, None

    def render_admin_panel(self, req, category, page, path_info):
        """
        Process a request for an admin panel.

        :Returns: A tuple of the form `(template, data)`,
        """
        # Ensure the user has project admin permissions
        req.perm.assert_permission('TRAC_ADMIN')

        backups = []
        backup_href = Href('%s/admin/general/backup' % req.base_path)

        # Load the user based on authname
        user = get_userstore().getUser(req.authname)

        # Get the current environment name
        env_name = conf.resolveProjectName(self.env)

        # Initiate ProjectBackup, containing the backup/restore implementation
        prj = Project.get(env_name=env_name)
        pb = ProjectBackup(prj)
        backups = pb.get_backups()

        # Do the backup
        if req.path_info.endswith('backup/backup') and req.method == 'POST':
            try:
                pb.backup(user_id=user.id, description=req.args.get('description'))
                add_notice(req, _('Backup created'))
            except TracError, e:
                add_warning(req, _('Backup failed: %s' % e))

            # Return back to default backup page
            return req.redirect(backup_href())

    def process_request(self, req):
        req.perm.assert_permission('MESSAGE_VIEW')

        msgsrv = self.env[MessageService]
        userstore = get_userstore()
        user = userstore.getUser(req.authname)

        message_groups = msgsrv.get_latest_message_groups(user.id, limit=15)

        # Fetch and set notifications if component is enabled
        # TODO: Move into MessageService?
        if self.env.is_component_enabled('multiproject.common.notifications.push.NotificationSystem'):
            from multiproject.common.notifications.push import NotificationSystem

            ns = self.env[NotificationSystem]
            chname = ns.generate_channel_name(user)

            try:
                # Update message objects to have notification count
                for message_group in message_groups:
                    message_keys = ['message-%s' % message.id for message in message_group.get_messages()]
                    message_group.notifications = ns.get_notifications(chname, message_keys)

            except TracError, e:
                self.log.error('Failed to retrieve notifications')

    def expand_macro(self, formatter, name, content, args=None):
        """
        Returns the outcome from macro.
        """
        req = formatter.req
        userstore = get_userstore()
        user = userstore.getUser(req.authname)
        msgsrv = self.env[MessageService]

        # Parse optional arguments
        if args is None:
            args = parse_args(content)
            if len(args) > 1:
                args = args[1]

        data = {
            'groups': msgsrv.get_messages_grouped_by(user.id)
        }

        # FIXME: Temporary fix for IE8 + jQuery 1.4.4 + Transparency combination
        agent = req.get_header('user-agent')
        if agent and 'MSIE 8.0' not in agent:
            add_script(req, 'multiproject/js/transparency.js')

        add_script(req, 'multiproject/js/multiproject.js')
        add_script(req, 'multiproject/js/messages_group_macro.js')

        chrome = Chrome(self.env)
        return chrome.render_template(req, 'multiproject_messages_group_macro.html', data, fragment=True)

    def authenticate(self, username, password):
        """ Check username and password - either from local database, LDAP,
            or some other external authentication server.
            Return username on success, None on failure.
        """
        if not username or not password:
            return None

        # old user
        user = get_userstore().getUser(username)
        if user:
            authentication_name = self.auth_store.get_authentication_method(user.authentication_key)
            auth_module = self._get_auth_module(authentication_name)
            if auth_module:
                auth_username = auth_module.authenticate(username, password)
                if auth_username:
                    User.update_last_login(auth_username)
                    return auth_username
            return None

        # new user
        for x in conf.authentication_order:
            auth_module = self._get_auth_module(x)
            if auth_module:
                auth_username = auth_module.authenticate(username, password)
                if auth_username:
                    User.update_last_login(auth_username)
                    return auth_username
        return None

    def _list_message_groups(self, req):
        """
        Returns list of message groups: messages grouped by the sender
        """
        # Check permission from home env
        home_env = HomeProject().get_env()
        perm = PermissionCache(home_env, req.authname)
        query = req.args.get('q') or None # If empty, return latest
        limit = req.args.get('limit', 5)

        # Convert types
        try:
            limit = int(limit)
        except ValueError:
            return send_json(req, {'result': 'Invalid request'}, status=403)

        # Check permission
        if 'MESSAGE_VIEW' not in perm:
            return send_json(req, {'result': 'Permission denied'}, status=403)

        msgsrv = self.env[MessageService]
        userstore = get_userstore()
        user = userstore.getUser(req.authname)

        # TODO: Permission checks?
        return send_json(req, msgsrv.get_messages_grouped_by(user.id, query=query, limit=limit))

def _chrome_format_author_replacement(self, req, author):
    """
    Audit Chrome.format_author method so that we get link to user profile

    Downside: This is a hack that interfere with the way trac renders usernames.
              Will have some unwanted behaviour.

              One such known unwanted behaviour is in the ticket view where owner and
              reporter links are changed
    """
    if not author:
        return ""
    unwanted_users = ['trac', 'tracadmin', 'anonymous', 'authenticated', 'somebody']
    not_ticket = req.path_info.rsplit('/', 2)[1] != 'ticket'
    contain_email = bool(re.search('<.+>', author))
    ok_user = author not in unwanted_users
    username = author
    if not contain_email:
        user = get_userstore().getUser(author)
        if user:
            author = user.getDisplayName()
    elif not Chrome(self.env).show_email_addresses:
        author = obfuscate_email_address(author)

    # Create a link to profile page or return author in plain
    if ok_user and not_ticket and not contain_email and conf.public_user_page_url:
        return tag.a(author, **{'href':conf.public_user_page_url + username, 'class':'author'})
    else:
        return author

    def render_preference_panel(self, req, panel):
        """ Renders preference panel and handles image change on POST
        """

        if req.authname == 'anonymous':
            raise TracError("User is not authenticated", "No access")

        userstore = get_userstore()
        user = userstore.getUser(req.authname)

        if req.method == 'POST':
            if 'removeicon' in req.args:
                user.icon = None
                userstore.updateUser(user)
            elif 'icon' in req.args:
                user.createIcon(req.args['icon'])

                if user.icon:
                    userstore.updateUser(user)

        data = {'user':user, 'base_path':req.base_path}
        if 'limitexceeded' in req.args:
            add_warning(req, 'Picture you tried to upload was too big. Try a smaller one.')

        return 'multiproject_user_prefs_image.html', data

    def _do_save(self, req, user):
        """ Update user information into database
        """
        userstore = get_userstore()

        if not req.args.get('mail'):
            add_warning(req, _('User should have an e-mail address'))
            return user

        user.mail = req.args.get('mail')

        if not req.args.get('lastName'):
            add_warning(req, _('Last name required'))
            return user

        # NOTE: Values are escaped in userstore update
        user.lastName = req.args.get('lastName')
        user.givenName = req.args.get('givenName')
        user.mobile = req.args.get('mobile')

        if userstore.updateUser(user):
            user = userstore.getUser(user.username)
            add_notice(req, _('Updated user settings'))

            if req.args.get('approve') == 'on' and user.status == user.STATUS_INACTIVE:
                user.activate()
                add_notice(req, _("Your account is now activated."))

            return user

        add_warning(req, _('Failed to update user'))
        return user

    def _create_user(self, username):
        """
        Create new user using data available in LDAP service

        This method is used in two cases:
        - when the user is authenticated for the first time (by self.authenticate)
        - when the user, which doesn't yet exist in the local DB, is added to project group
          (by self.store_user_if_necessary)

        :param str username: Name of the user in LDAP
        :returns: username on success, otherwise None
        """
        users = get_userstore()
        ldap_store = get_authstore()

        # If user does not exists in LDAP, do not continue
        if not ldap_store.userExists(username):
            conf.log.debug('Cannot find user %s from LDAP' % username)
            return None

        # Create user using LDAP store
        user = ldap_store.getUser(username)
        user.authentication_key = self.ldap_authentication_key
        user.organization_keys = self.org_store.get_organization_keys(user, self.LDAP) or None

        # Store user in user store
        conf.log.info('Created new user from LDAP: %s' % user.username)
        users.storeUser(user)
        users.invalidate_user_password(user)

        return user.username

    def _list_notifications(self, req):
        """
        Returns the list of missed notification and optionally reset them
        """
        chname = None
        initiator = req.args.get('initiator', '')
        reset = req.args.get('reset', 'false').lower() in ('yes', 'true', 'on', '1')
        ntype = req.args.get('type', '')

        # Check permissions
        if req.authname == 'anonymous':
            return send_json(req, {'result': 'Permission denied'}, status=403)

        userstore = get_userstore()
        user = userstore.getUser(req.authname)
        ns = self.env[NotificationSystem]
        if not ns:
            return send_json(req, [])

        # Fetch notifications sent to user
        chname = ns.generate_channel_name(user_id=user.id)

        # Get notifications
        try:
            notifications = ns.get_notifications(chname)
        except TracError, e:
            self.log.error('Failed to retrieve notifications')
            return send_json(req, {'result': e.message}, status=500)

    def list_users(self, req):
        """
        Handle user listing
        """
        req.perm.require('USER_AUTHOR')

        data = {}
        userstore = get_userstore()

        # State
        data['states'] = userstore.USER_STATUS_LABELS

        # Available backend organizations
        # TODO: Add support for listing users based on organization in user REST API
        orgman = self.env[OrganizationManager]
        data['organizations'] = [org for org in orgman.get_organizations() if org['type'] == 'backend']

        # Add jquery ui for autocomplete
        add_script(req, 'multiproject/js/jquery-ui.js')
        add_script(req, 'multiproject/js/transparency.js')
        add_script(req, 'multiproject/js/multiproject.js')
        add_script(req, 'multiproject/js/admin_user_list.js')
        add_stylesheet(req, 'multiproject/css/jquery-ui.css')

        return 'admin_user_list.html', data

 def get_preference_panels(self, req):
     """ Give name of the panel
     """
     user = get_userstore().getUser(req.authname)
     has_external_avatar = Authentication().has_external_profile(user)
     if req.authname != 'anonymous' and not has_external_avatar:
         yield ('image', 'Face image')

    def get_projects_with_rights(self, username, action):
        """
        :returns: a list of projects where user have right for "action".

        .. note::

           Permissions coming via LDAP groups are not included in the results

        """
        user = get_userstore().getUser(username)

        # Get subjects
        subjects = set([username])
        subjects.update(get_special_users(username))

        # Surround string elements with ' and join them with comma
        actions_str = ','.join("'%s'" % safe_string(p) for p in [action, 'TRAC_ADMIN'])
        subjects_str = ','.join(["'{0}'".format(safe_string(subject)) for subject in subjects])
        organizations_str = ','.join(["{0}".format(safe_int(org_key)) for org_key in user.organization_keys])

        query = ("SELECT DISTINCT projects.* FROM projects "
                 "INNER JOIN `group` ON group.trac_environment_key = projects.trac_environment_key "
                 "INNER JOIN group_permission ON group_permission.group_key = group.group_id "
                 "INNER JOIN action ON group_permission.permission_key = action.action_id "
                 "LEFT JOIN user_group ON user_group.group_key = group.group_id "
                 "LEFT JOIN user ON user.user_id = user_group.user_key "
                 "LEFT JOIN organization_group ON organization_group.group_key = group.group_id "
                 "WHERE (user.username IN(%s) "
                 "OR organization_group.organization_key IN(%s)) "
                 "AND action.action_string IN(%s) "
                 "ORDER BY projects.project_name" % (subjects_str, organizations_str, actions_str))

        return self.queryProjectObjects(query)

    def get_participated_public_projects(self, username):
        """ Get public projects username has participated in
        """
        store = get_userstore()
        user = store.getUser(username)
        if not user:
            return []

        anon = store.getUser('anonymous')

        order = " ORDER BY projects.project_name"

        # We need projects where _both_ anonymous and the specified user exist
        query = """
        SELECT projects.environment_name AS name, projects.description AS description, projects.created AS date,
          '%(user_name)s' AS author, projects.project_name, projects.icon_name
        FROM projects
        INNER JOIN `group` ON group.trac_environment_key = projects.trac_environment_key
        INNER JOIN user_group ON user_group.group_key = group.group_id
        INNER JOIN `user` ON user_group.user_key = user.user_id
        WHERE user_group.user_key = %(user_id)d AND EXISTS
        (SELECT * FROM projects P
        INNER JOIN `group` ON `group`.trac_environment_key = P.trac_environment_key
        INNER JOIN user_group ON user_group.group_key = group.group_id
        WHERE user_group.user_key = %(anon_id)d AND projects.project_id = P.project_id)
        """ % {"user_name": safe_string(user.getDisplayName().encode('utf-8')),
               "user_id": safe_int(user.id), "anon_id": safe_int(anon.id)}
        query += order
        return self.__queryProjectsWithDescr(query)

    def public_project_count(self):
        """ Number of public projects
        """

        # Chances are that we get these from the cache
        anon = get_userstore().getUser('anonymous')
        auth = None #users.getUser('authenticated')

        users_in = []
        if anon:
            users_in.append(str(safe_int(anon.id)))
        if auth:
            users_in.append(str(safe_int(auth.id)))
        users_in_str = ','.join(users_in)

        query = ("SELECT count(DISTINCT project_id) FROM projects "
                 "INNER JOIN `group` ON `group`.trac_environment_key = projects.trac_environment_key "
                 "INNER JOIN user_group ON user_group.group_key = `group`.group_id "
                 "WHERE user_group.user_key IN(%s)" % users_in_str)

        count = 0
        with admin_query() as cursor:
            cursor.execute(query)
            row = cursor.fetchone()
            count = row[0]

        return count

    def remove_user_from_group(self, user_name, group_name):
        """
        Removes user from group.

        :param str user_name: User name
        :param str group_name: Group name
        :raises InvalidPermissionState: User cannot be removed
        :raises DatabaseError: Query failure
        :raises ValueError: User not found
        """

        userstore = get_userstore()
        user = userstore.getUser(user_name)

        if not user:
            raise InvalidPermissionsState('Unknown user %s' % user_name)

        # Get the group
        group_name = group_name.encode('utf-8')
        group_id = self.get_group_id(group_name)
        if group_id is None:
            conf.log.exception("Group %s doesn't exists'" % group_name)

        self._cache.clear_user_groups(self.trac_environment_key)

        with admin_query() as cursor:
            cursor.callproc("remove_user_from_group", [user.id, group_id])

    def changePassword(self, req):
        userstore = get_userstore()
        user = userstore.getUser(req.authname)

        oldpw = req.args.get('oldpassword')
        newpw = req.args.get('newpassword')

        if not oldpw or not userstore.userExists(req.authname, oldpw):
            add_warning(req, _('Old password is invalid'))
            return user

        if not newpw or len(newpw) < 7:
            add_warning(req, _('New password should be at least 7 characters long'))
            return user

        if newpw != req.args.get('confirmpw'):
            add_warning(req, _('Passwords do not match'))
            return user

        if not userstore.updatePassword(user, newpw):
            add_warning(req, _('Failed to change the password'))
            return user

        add_notice(req, _('Password changed'))
        return user

    def _select_login_action(self, req, remote_user):
        """
        Select login action based on user status.

        - If user is expired, error msg is shown
        - If user is active, user will be logged in
        - If user is inactive, legal process is started
        - Otherwise user has no way of logging in (is banned or disabled)

        """
        user_store = get_userstore()
        user = user_store.getUser(remote_user)
        if not user:
            # This may happen if authentication method is case-insensitive
            add_notice(req, _("Incorrect username or password - please try again"))
            return self._show_login(req)

        # Check if expired
        if user.expires and user.expires <= datetime.utcnow():
            author = user_store.get_user_author(user)
            if author:
                add_warning(req, _('Account expired. Contact {0} for extension'.format(author.getDisplayName())))
            else:
                add_warning(req, _('Account expired. Contact service support for extension'))
            return self._show_login(req)

        # User is authentic but can not log in before knowing he is not banned or disabled or activation required
        if user.status == user.STATUS_INACTIVE and self.env.config.getbool('multiproject', 'login_requires_agreed_terms'):
            return self._request_legal_approval(req, remote_user)

        if user.status in (user.STATUS_ACTIVE, user.STATUS_INACTIVE):
            return self._login_success(req, remote_user)

        add_warning(req, _("User status is '%s'. Can not log in." % user_store.USER_STATUS_LABELS[user.status]))
        return self._show_login(req)